OSDN Git Service

FIX: PHP5/MySQL5における文法違反コードの修正
[nucleus-jp/nucleus-jp-ancient.git] / nucleus / libs / ADMIN.php
1 <?php\r
2 /*\r
3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
4  * Copyright (C) 2002-2011 The Nucleus Group\r
5  *\r
6  * This program is free software; you can redistribute it and/or\r
7  * modify it under the terms of the GNU General Public License\r
8  * as published by the Free Software Foundation; either version 2\r
9  * of the License, or (at your option) any later version.\r
10  * (see nucleus/documentation/index.html#license for more info)\r
11  */\r
12 /**\r
13  * The code for the Nucleus admin area\r
14  *\r
15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
16  * @copyright Copyright (C) 2002-2011 The Nucleus Group\r
17  * @version $Id$\r
18  * @version $NucleusJP: ADMIN.php,v 1.21.2.4 2007/10/30 19:04:24 kmorimatsu Exp $\r
19  */\r
20 \r
21 if ( !function_exists('requestVar') ) exit;\r
22 require_once dirname(__FILE__) . '/showlist.php';\r
23 \r
24 /**\r
25  * Builds the admin area and executes admin actions\r
26  */\r
27 class ADMIN {\r
28 \r
29         /**\r
30          * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)\r
31          */\r
32         var $action;\r
33 \r
34         /**\r
35          * Class constructor\r
36          */\r
37         function ADMIN() {\r
38 \r
39         }\r
40 \r
41         /**\r
42          * Executes an action\r
43          *\r
44          * @param string $action action to be performed\r
45          */\r
46         function action($action) {\r
47                 global $CONF, $manager;\r
48 \r
49                 // list of action aliases\r
50                 $alias = array(\r
51                         'login' => 'overview',\r
52                         '' => 'overview'\r
53                 );\r
54 \r
55                 if (isset($alias[$action]))\r
56                         $action = $alias[$action];\r
57 \r
58                 $methodName = 'action_' . $action;\r
59 \r
60                 $this->action = strtolower($action);\r
61 \r
62                 // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action\r
63                 // is an action that requires user interaction before something is actually done)\r
64                 // all safe actions are in this array:\r
65                 $aActionsNotToCheck = array(\r
66                         'showlogin',\r
67                         'login',\r
68                         'overview',\r
69                         'itemlist',\r
70                         'blogcommentlist',\r
71                         'bookmarklet',\r
72                         'blogsettings',\r
73                         'banlist',\r
74                         'deleteblog',\r
75                         'editmembersettings',\r
76                         'browseownitems',\r
77                         'browseowncomments',\r
78                         'createitem',\r
79                         'itemedit',\r
80                         'itemmove',\r
81                         'categoryedit',\r
82                         'categorydelete',\r
83                         'manage',\r
84                         'actionlog',\r
85                         'settingsedit',\r
86                         'backupoverview',\r
87                         'pluginlist',\r
88                         'createnewlog',\r
89                         'usermanagement',\r
90                         'skinoverview',\r
91                         'templateoverview',\r
92                         'skinieoverview',\r
93                         'itemcommentlist',\r
94                         'commentedit',\r
95                         'commentdelete',\r
96                         'banlistnewfromitem',\r
97                         'banlistdelete',\r
98                         'itemdelete',\r
99                         'manageteam',\r
100                         'teamdelete',\r
101                         'banlistnew',\r
102                         'memberedit',\r
103                         'memberdelete',\r
104                         'pluginhelp',\r
105                         'pluginoptions',\r
106                         'plugindelete',\r
107                         'skinedittype',\r
108                         'skinremovetype',\r
109                         'skindelete',\r
110                         'skinedit',\r
111                         'templateedit',\r
112                         'templatedelete',\r
113                         'activate',\r
114                         'systemoverview'\r
115                 );\r
116 /*\r
117                 // the rest of the actions needs to be checked\r
118                 $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'activatesetpwd');\r
119 */\r
120                 if (!in_array($this->action, $aActionsNotToCheck))\r
121                 {\r
122                         if (!$manager->checkTicket())\r
123                                 $this->error(_ERROR_BADTICKET);\r
124                 }\r
125 \r
126                 if (method_exists($this, $methodName))\r
127                         call_user_func(array($this, $methodName));\r
128                 else\r
129                         $this->error(_BADACTION . htmlspecialchars(" ($action)"));\r
130 \r
131         }\r
132 \r
133         /**\r
134          * @todo document this\r
135          */\r
136         function action_showlogin() {\r
137                 global $error;\r
138                 $this->action_login($error);\r
139         }\r
140 \r
141         /**\r
142          * @todo document this\r
143          */\r
144         function action_login($msg = '', $passvars = 1) {\r
145                 global $member;\r
146 \r
147                 // skip to overview when allowed\r
148                 if ($member->isLoggedIn() && $member->canLogin()) {\r
149                         $this->action_overview();\r
150                         exit;\r
151                 }\r
152 \r
153                 $this->pagehead();\r
154 \r
155                 echo '<h2>', _LOGIN ,'</h2>';\r
156                 if ($msg) echo _MESSAGE , ': ', htmlspecialchars($msg);\r
157                 ?>\r
158 \r
159                 <form action="index.php" method="post"><p>\r
160                 <?php echo _LOGIN_NAME; ?> <br /><input name="login"  tabindex="10" />\r
161                 <br />\r
162                 <?php echo _LOGIN_PASSWORD; ?> <br /><input name="password"  tabindex="20" type="password" />\r
163                 <br />\r
164                 <input name="action" value="login" type="hidden" />\r
165                 <br />\r
166                 <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />\r
167                 <br />\r
168                 <small>\r
169                         <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>\r
170                         <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>\r
171                 </small>\r
172                 <?php              // pass through vars\r
173 \r
174                         $oldaction = postVar('oldaction');\r
175                         if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {\r
176                                 passRequestVars();\r
177                         }\r
178 \r
179 \r
180                 ?>\r
181                 </p></form>\r
182                 <?php      $this->pagefoot();\r
183         }\r
184 \r
185 \r
186         /**\r
187          * provides a screen with the overview of the actions available\r
188          * @todo document parameter\r
189          */\r
190         function action_overview($msg = '') {\r
191                 global $member;\r
192 \r
193                 $this->pagehead();\r
194 \r
195                 if ($msg)\r
196                         echo _MESSAGE , ': ', $msg;\r
197 \r
198                 /* ---- add items ---- */\r
199                 echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';\r
200 \r
201                 $showAll = requestVar('showall');\r
202 \r
203                 if (($member->isAdmin()) && ($showAll == 'yes')) {\r
204                         // Super-Admins have access to all blogs! (no add item support though)\r
205                         $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'\r
206                                    . ' FROM ' . sql_table('blog')\r
207                                    . ' ORDER BY bname';\r
208                 } else {\r
209                         $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'\r
210                                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')\r
211                                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()\r
212                                    . ' ORDER BY bname';\r
213                 }\r
214                 $template['content'] = 'bloglist';\r
215                 $template['superadmin'] = $member->isAdmin();\r
216                 $amount = showlist($query,'table',$template);\r
217 \r
218                 if (($showAll != 'yes') && ($member->isAdmin())) {\r
219                         $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));\r
220                         if ($total > $amount)\r
221                                 echo '<p><a href="index.php?action=overview&amp;showall=yes">' . _OVERVIEW_SHOWALL . '</a></p>';\r
222                 }\r
223 \r
224                 if ($amount == 0)\r
225                         echo _OVERVIEW_NOBLOGS;\r
226 \r
227                 if ($amount != 0) {\r
228                         echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';\r
229                         $query =  'SELECT ititle, inumber, bshortname'\r
230                                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')\r
231                                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';\r
232                         $template['content'] = 'draftlist';\r
233                         $amountdrafts = showlist($query, 'table', $template);\r
234                         if ($amountdrafts == 0)\r
235                                 echo _OVERVIEW_NODRAFTS;\r
236                 }\r
237 \r
238                 /* ---- user settings ---- */\r
239                 echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';\r
240                 echo '<ul>';\r
241                 echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';\r
242                 echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';\r
243                 echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';\r
244                 echo '</ul>';\r
245 \r
246                 /* ---- general settings ---- */\r
247                 if ($member->isAdmin()) {\r
248                         echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';\r
249                         echo '<ul>';\r
250                         echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';\r
251                         echo '</ul>';\r
252                 }\r
253 \r
254 \r
255                 $this->pagefoot();\r
256         }\r
257 \r
258         /**\r
259          * Returns a link to a weblog\r
260          * @param object BLOG\r
261          */\r
262         function bloglink(&$blog) {\r
263                 return '<a href="'.htmlspecialchars($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. htmlspecialchars( $blog->getName() ) .'</a>';\r
264         }\r
265 \r
266         /**\r
267          * @todo document this\r
268          */\r
269         function action_manage($msg = '') {\r
270                 global $member;\r
271 \r
272                 $member->isAdmin() or $this->disallow();\r
273 \r
274                 $this->pagehead();\r
275 \r
276                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
277 \r
278                 if ($msg)\r
279                         echo '<p>' , _MESSAGE , ': ', $msg , '</p>';\r
280 \r
281 \r
282                 echo '<h2>' . _MANAGE_GENERAL. '</h2>';\r
283 \r
284                 echo '<ul>';\r
285                 echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';\r
286                 echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';\r
287                 echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';\r
288                 echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';\r
289                 echo '</ul>';\r
290 \r
291                 echo '<h2>' . _MANAGE_SKINS . '</h2>';\r
292                 echo '<ul>';\r
293                 echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';\r
294                 echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';\r
295                 echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';\r
296                 echo '</ul>';\r
297 \r
298                 echo '<h2>' . _MANAGE_EXTRA . '</h2>';\r
299                 echo '<ul>';\r
300                 echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';\r
301                 echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';\r
302                 echo '</ul>';\r
303 \r
304                 $this->pagefoot();\r
305         }\r
306 \r
307         /**\r
308          * @todo document this\r
309          */\r
310         function action_itemlist($blogid = '') {\r
311                 global $member, $manager, $CONF;\r
312 \r
313                 if ($blogid == '')\r
314                         $blogid = intRequestVar('blogid');\r
315 \r
316                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();\r
317 \r
318                 $this->pagehead();\r
319                 $blog =& $manager->getBlog($blogid);\r
320 \r
321                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
322                 echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';\r
323 \r
324                 // start index\r
325                 if (postVar('start'))\r
326                         $start = intPostVar('start');\r
327                 else\r
328                         $start = 0;\r
329 \r
330                 if ($start == 0)\r
331                         echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';\r
332 \r
333                 // amount of items to show\r
334                 if (postVar('amount'))\r
335                         $amount = intPostVar('amount');\r
336                 else {\r
337                         $amount = intval($CONF['DefaultListSize']);\r
338                         if ($amount < 1)\r
339                                 $amount = 10;\r
340                 }\r
341 \r
342                 $search = postVar('search');    // search through items\r
343 \r
344                 $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime, bnumber, catid'\r
345                            . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')\r
346                            . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;\r
347 \r
348                 if ($search)\r
349                         $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';\r
350 \r
351                 // non-blog-admins can only edit/delete their own items\r
352                 if (!$member->blogAdminRights($blogid))\r
353                         $query .= ' and iauthor=' . $member->getID();\r
354 \r
355 \r
356                 $query .= ' ORDER BY itime DESC'\r
357                                 . " LIMIT $start,$amount";\r
358 \r
359                 $template['content'] = 'itemlist';\r
360                 $template['now'] = $blog->getCorrectTime(time());\r
361 \r
362                 $manager->loadClass("ENCAPSULATE");\r
363                 $navList = new NAVLIST('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);\r
364                 $navList->showBatchList('item',$query,'table',$template);\r
365 \r
366 \r
367                 $this->pagefoot();\r
368         }\r
369 \r
370         /**\r
371          * @todo document this\r
372          */\r
373         function action_batchitem() {\r
374                 global $member, $manager;\r
375 \r
376                 // check if logged in\r
377                 $member->isLoggedIn() or $this->disallow();\r
378 \r
379                 // more precise check will be done for each performed operation\r
380 \r
381                 // get array of itemids from request\r
382                 $selected = requestIntArray('batch');\r
383                 $action = requestVar('batchaction');\r
384 \r
385                 // Show error when no items were selected\r
386                 if (!is_array($selected) || sizeof($selected) == 0)\r
387                         $this->error(_BATCH_NOSELECTION);\r
388 \r
389                 // On move: when no destination blog/category chosen, show choice now\r
390                 $destCatid = intRequestVar('destcatid');\r
391                 if (($action == 'move') && (!$manager->existsCategory($destCatid)))\r
392                         $this->batchMoveSelectDestination('item',$selected);\r
393 \r
394                 // On delete: check if confirmation has been given\r
395                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))\r
396                         $this->batchAskDeleteConfirmation('item',$selected);\r
397 \r
398                 $this->pagehead();\r
399 \r
400                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';\r
401                 echo '<h2>',_BATCH_ITEMS,'</h2>';\r
402                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';\r
403                 echo '<ul>';\r
404 \r
405 \r
406                 // walk over all itemids and perform action\r
407                 foreach ($selected as $itemid) {\r
408                         $itemid = intval($itemid);\r
409                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';\r
410 \r
411                         // perform action, display errors if needed\r
412                         switch($action) {\r
413                                 case 'delete':\r
414                                         $error = $this->deleteOneItem($itemid);\r
415                                         break;\r
416                                 case 'move':\r
417                                         $error = $this->moveOneItem($itemid, $destCatid);\r
418                                         break;\r
419                                 default:\r
420                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);\r
421                         }\r
422 \r
423                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';\r
424                         echo '</li>';\r
425                 }\r
426 \r
427                 echo '</ul>';\r
428                 echo '<b>',_BATCH_DONE,'</b>';\r
429 \r
430                 $this->pagefoot();\r
431 \r
432 \r
433         }\r
434 \r
435         /**\r
436          * @todo document this\r
437          */\r
438         function action_batchcomment() {\r
439                 global $member;\r
440 \r
441                 // check if logged in\r
442                 $member->isLoggedIn() or $this->disallow();\r
443 \r
444                 // more precise check will be done for each performed operation\r
445 \r
446                 // get array of itemids from request\r
447                 $selected = requestIntArray('batch');\r
448                 $action = requestVar('batchaction');\r
449 \r
450                 // Show error when no items were selected\r
451                 if (!is_array($selected) || sizeof($selected) == 0)\r
452                         $this->error(_BATCH_NOSELECTION);\r
453 \r
454                 // On delete: check if confirmation has been given\r
455                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))\r
456                         $this->batchAskDeleteConfirmation('comment',$selected);\r
457 \r
458                 $this->pagehead();\r
459 \r
460                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';\r
461                 echo '<h2>',_BATCH_COMMENTS,'</h2>';\r
462                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';\r
463                 echo '<ul>';\r
464 \r
465                 // walk over all itemids and perform action\r
466                 foreach ($selected as $commentid) {\r
467                         $commentid = intval($commentid);\r
468                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';\r
469 \r
470                         // perform action, display errors if needed\r
471                         switch($action) {\r
472                                 case 'delete':\r
473                                         $error = $this->deleteOneComment($commentid);\r
474                                         break;\r
475                                 default:\r
476                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);\r
477                         }\r
478 \r
479                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';\r
480                         echo '</li>';\r
481                 }\r
482 \r
483                 echo '</ul>';\r
484                 echo '<b>',_BATCH_DONE,'</b>';\r
485 \r
486                 $this->pagefoot();\r
487 \r
488 \r
489         }\r
490 \r
491         /**\r
492          * @todo document this\r
493          */\r
494         function action_batchmember() {\r
495                 global $member;\r
496 \r
497                 // check if logged in and admin\r
498                 ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();\r
499 \r
500                 // get array of itemids from request\r
501                 $selected = requestIntArray('batch');\r
502                 $action = requestVar('batchaction');\r
503 \r
504                 // Show error when no members selected\r
505                 if (!is_array($selected) || sizeof($selected) == 0)\r
506                         $this->error(_BATCH_NOSELECTION);\r
507 \r
508                 // On delete: check if confirmation has been given\r
509                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))\r
510                         $this->batchAskDeleteConfirmation('member',$selected);\r
511 \r
512                 $this->pagehead();\r
513 \r
514                 echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';\r
515                 echo '<h2>',_BATCH_MEMBERS,'</h2>';\r
516                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';\r
517                 echo '<ul>';\r
518 \r
519                 // walk over all itemids and perform action\r
520                 foreach ($selected as $memberid) {\r
521                         $memberid = intval($memberid);\r
522                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';\r
523 \r
524                         // perform action, display errors if needed\r
525                         switch($action) {\r
526                                 case 'delete':\r
527                                         $error = $this->deleteOneMember($memberid);\r
528                                         break;\r
529                                 case 'setadmin':\r
530                                         // always succeeds\r
531                                         sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);\r
532                                         $error = '';\r
533                                         break;\r
534                                 case 'unsetadmin':\r
535                                         // there should always remain at least one super-admin\r
536                                         $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');\r
537                                         if (sql_num_rows($r) < 2)\r
538                                                 $error = _ERROR_ATLEASTONEADMIN;\r
539                                         else\r
540                                                 sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);\r
541                                         break;\r
542                                 default:\r
543                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);\r
544                         }\r
545 \r
546                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';\r
547                         echo '</li>';\r
548                 }\r
549 \r
550                 echo '</ul>';\r
551                 echo '<b>',_BATCH_DONE,'</b>';\r
552 \r
553                 $this->pagefoot();\r
554 \r
555 \r
556         }\r
557 \r
558         /**\r
559          * @todo document this\r
560          */\r
561         function action_batchteam() {\r
562                 global $member;\r
563 \r
564                 $blogid = intRequestVar('blogid');\r
565 \r
566                 // check if logged in and admin\r
567                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();\r
568 \r
569                 // get array of itemids from request\r
570                 $selected = requestIntArray('batch');\r
571                 $action = requestVar('batchaction');\r
572 \r
573                 // Show error when no members selected\r
574                 if (!is_array($selected) || sizeof($selected) == 0)\r
575                         $this->error(_BATCH_NOSELECTION);\r
576 \r
577                 // On delete: check if confirmation has been given\r
578                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))\r
579                         $this->batchAskDeleteConfirmation('team',$selected);\r
580 \r
581                 $this->pagehead();\r
582 \r
583                 echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';\r
584 \r
585                 echo '<h2>',_BATCH_TEAM,'</h2>';\r
586                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';\r
587                 echo '<ul>';\r
588 \r
589                 // walk over all itemids and perform action\r
590                 foreach ($selected as $memberid) {\r
591                         $memberid = intval($memberid);\r
592                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';\r
593 \r
594                         // perform action, display errors if needed\r
595                         switch($action) {\r
596                                 case 'delete':\r
597                                         $error = $this->deleteOneTeamMember($blogid, $memberid);\r
598                                         break;\r
599                                 case 'setadmin':\r
600                                         // always succeeds\r
601                                         sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);\r
602                                         $error = '';\r
603                                         break;\r
604                                 case 'unsetadmin':\r
605                                         // there should always remain at least one admin\r
606                                         $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);\r
607                                         if (sql_num_rows($r) < 2)\r
608                                                 $error = _ERROR_ATLEASTONEBLOGADMIN;\r
609                                         else\r
610                                                 sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);\r
611                                         break;\r
612                                 default:\r
613                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);\r
614                         }\r
615 \r
616                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';\r
617                         echo '</li>';\r
618                 }\r
619 \r
620                 echo '</ul>';\r
621                 echo '<b>',_BATCH_DONE,'</b>';\r
622 \r
623                 $this->pagefoot();\r
624 \r
625 \r
626         }\r
627 \r
628         /**\r
629          * @todo document this\r
630          */\r
631         function action_batchcategory() {\r
632                 global $member, $manager;\r
633 \r
634                 // check if logged in\r
635                 $member->isLoggedIn() or $this->disallow();\r
636 \r
637                 // more precise check will be done for each performed operation\r
638 \r
639                 // get array of itemids from request\r
640                 $selected = requestIntArray('batch');\r
641                 $action = requestVar('batchaction');\r
642 \r
643                 // Show error when no items were selected\r
644                 if (!is_array($selected) || sizeof($selected) == 0)\r
645                         $this->error(_BATCH_NOSELECTION);\r
646 \r
647                 // On move: when no destination blog chosen, show choice now\r
648                 $destBlogId = intRequestVar('destblogid');\r
649                 if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))\r
650                         $this->batchMoveCategorySelectDestination('category',$selected);\r
651 \r
652                 // On delete: check if confirmation has been given\r
653                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))\r
654                         $this->batchAskDeleteConfirmation('category',$selected);\r
655 \r
656                 $this->pagehead();\r
657 \r
658                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';\r
659                 echo '<h2>',BATCH_CATEGORIES,'</h2>';\r
660                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';\r
661                 echo '<ul>';\r
662 \r
663                 // walk over all itemids and perform action\r
664                 foreach ($selected as $catid) {\r
665                         $catid = intval($catid);\r
666                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';\r
667 \r
668                         // perform action, display errors if needed\r
669                         switch($action) {\r
670                                 case 'delete':\r
671                                         $error = $this->deleteOneCategory($catid);\r
672                                         break;\r
673                                 case 'move':\r
674                                         $error = $this->moveOneCategory($catid, $destBlogId);\r
675                                         break;\r
676                                 default:\r
677                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);\r
678                         }\r
679 \r
680                         echo '<b>',($error ? _ERROR . ': '.$error : _BATCH_SUCCESS),'</b>';\r
681                         echo '</li>';\r
682                 }\r
683 \r
684                 echo '</ul>';\r
685                 echo '<b>',_BATCH_DONE,'</b>';\r
686 \r
687                 $this->pagefoot();\r
688 \r
689         }\r
690 \r
691         /**\r
692          * @todo document this\r
693          */\r
694         function batchMoveSelectDestination($type, $ids) {\r
695                 global $manager;\r
696                 $this->pagehead();\r
697                 ?>\r
698                 <h2><?php echo _MOVE_TITLE?></h2>\r
699                 <form method="post" action="index.php"><div>\r
700 \r
701                         <input type="hidden" name="action" value="batch<?php echo $type?>" />\r
702                         <input type="hidden" name="batchaction" value="move" />\r
703                         <?php\r
704                                 $manager->addTicketHidden();\r
705 \r
706                                 // insert selected item numbers\r
707                                 $idx = 0;\r
708                                 foreach ($ids as $id)\r
709                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';\r
710 \r
711                                 // show blog/category selection list\r
712                                 $this->selectBlogCategory('destcatid');\r
713 \r
714                         ?>\r
715 \r
716 \r
717                         <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />\r
718 \r
719                 </div></form>\r
720                 <?php      $this->pagefoot();\r
721                 exit;\r
722         }\r
723 \r
724         /**\r
725          * @todo document this\r
726          */\r
727         function batchMoveCategorySelectDestination($type, $ids) {\r
728                 global $manager;\r
729                 $this->pagehead();\r
730                 ?>\r
731                 <h2><?php echo _MOVECAT_TITLE?></h2>\r
732                 <form method="post" action="index.php"><div>\r
733 \r
734                         <input type="hidden" name="action" value="batch<?php echo $type?>" />\r
735                         <input type="hidden" name="batchaction" value="move" />\r
736                         <?php\r
737                                 $manager->addTicketHidden();\r
738 \r
739                                 // insert selected item numbers\r
740                                 $idx = 0;\r
741                                 foreach ($ids as $id)\r
742                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';\r
743 \r
744                                 // show blog/category selection list\r
745                                 $this->selectBlog('destblogid');\r
746 \r
747                         ?>\r
748 \r
749 \r
750                         <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />\r
751 \r
752                 </div></form>\r
753                 <?php      $this->pagefoot();\r
754                 exit;\r
755         }\r
756 \r
757         /**\r
758          * @todo document this\r
759          */\r
760         function batchAskDeleteConfirmation($type, $ids) {\r
761                 global $manager;\r
762 \r
763                 $this->pagehead();\r
764                 ?>\r
765                 <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>\r
766                 <form method="post" action="index.php"><div>\r
767 \r
768                         <input type="hidden" name="action" value="batch<?php echo $type?>" />\r
769                         <?php $manager->addTicketHidden() ?>\r
770                         <input type="hidden" name="batchaction" value="delete" />\r
771                         <input type="hidden" name="confirmation" value="yes" />\r
772                         <?php                      // insert selected item numbers\r
773                                 $idx = 0;\r
774                                 foreach ($ids as $id)\r
775                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';\r
776 \r
777                                 // add hidden vars for team & comment\r
778                                 if ($type == 'team')\r
779                                 {\r
780                                         echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';\r
781                                 }\r
782                                 if ($type == 'comment')\r
783                                 {\r
784                                         echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';\r
785                                 }\r
786 \r
787                         ?>\r
788 \r
789                         <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />\r
790 \r
791                 </div></form>\r
792                 <?php      $this->pagefoot();\r
793                 exit;\r
794         }\r
795 \r
796 \r
797         /**\r
798          * Inserts a HTML select element with choices for all categories to which the current\r
799          * member has access\r
800          * @see function selectBlog\r
801          */\r
802         function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {\r
803                 ADMIN::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);\r
804         }\r
805 \r
806         /**\r
807          * Inserts a HTML select element with choices for all blogs to which the user has access\r
808          *        mode = 'blog' => shows blognames and values are blogids\r
809          *        mode = 'category' => show category names and values are catids\r
810          *\r
811          * @param $iForcedBlogInclude\r
812          *        ID of a blog that always needs to be included, without checking if the\r
813          *        member is on the blog team (-1 = none)\r
814          * @todo document parameters\r
815          */\r
816         function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {\r
817                 global $member, $CONF;\r
818 \r
819                 // 0. get IDs of blogs to which member can post items (+ forced blog)\r
820                 $aBlogIds = array();\r
821                 if ($iForcedBlogInclude != -1)\r
822                         $aBlogIds[] = intval($iForcedBlogInclude);\r
823 \r
824                 if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))\r
825                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';\r
826                 else\r
827                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();\r
828                 $rblogids = sql_query($queryBlogs);\r
829                 while ($o = sql_fetch_object($rblogids))\r
830                         if ($o->bnumber != $iForcedBlogInclude)\r
831                                 $aBlogIds[] = intval($o->bnumber);\r
832 \r
833                 if (count($aBlogIds) == 0)\r
834                         return;\r
835 \r
836                 echo '<select name="',$name,'" tabindex="',$tabindex,'">';\r
837 \r
838                 // 1. select blogs (we'll create optiongroups)\r
839                 // (only select those blogs that have the user on the team)\r
840                 $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';\r
841                 $blogs = sql_query($queryBlogs);\r
842                 if ($mode == 'category') {\r
843                         if (sql_num_rows($blogs) > 1)\r
844                                 $multipleBlogs = 1;\r
845 \r
846                         while ($oBlog = sql_fetch_object($blogs)) {\r
847                                 if ($multipleBlogs)\r
848                                         echo '<optgroup label="',htmlspecialchars($oBlog->bname),'">';\r
849 \r
850                                 // show selection to create new category when allowed/wanted\r
851                                 if ($showNewCat) {\r
852                                         // check if allowed to do so\r
853                                         if ($member->blogAdminRights($oBlog->bnumber))\r
854                                                 echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';\r
855                                 }\r
856 \r
857                                 // 2. for each category in that blog\r
858                                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');\r
859                                 while ($oCat = sql_fetch_object($categories)) {\r
860                                         if ($oCat->catid == $selected)\r
861                                                 $selectText = ' selected="selected" ';\r
862                                         else\r
863                                                 $selectText = '';\r
864                                         echo '<option value="',$oCat->catid,'" ', $selectText,'>',htmlspecialchars($oCat->cname),'</option>';\r
865                                 }\r
866 \r
867                                 if ($multipleBlogs)\r
868                                         echo '</optgroup>';\r
869                         }\r
870                 } else {\r
871                         // blog mode\r
872                         while ($oBlog = sql_fetch_object($blogs)) {\r
873                                 echo '<option value="',$oBlog->bnumber,'"';\r
874                                 if ($oBlog->bnumber == $selected)\r
875                                         echo ' selected="selected"';\r
876                                 echo'>',htmlspecialchars($oBlog->bname),'</option>';\r
877                         }\r
878                 }\r
879                 echo '</select>';\r
880 \r
881         }\r
882 \r
883         /**\r
884          * @todo document this\r
885          */\r
886         function action_browseownitems() {\r
887                 global $member, $manager, $CONF;\r
888 \r
889                 $this->pagehead();\r
890 \r
891                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
892                 echo '<h2>' . _ITEMLIST_YOUR. '</h2>';\r
893 \r
894                 // start index\r
895                 if (postVar('start'))\r
896                         $start = intPostVar('start');\r
897                 else\r
898                         $start = 0;\r
899 \r
900                 // amount of items to show\r
901                 if (postVar('amount'))\r
902                         $amount = intPostVar('amount');\r
903                 else {\r
904                         $amount = intval($CONF['DefaultListSize']);\r
905                         if ($amount < 1)\r
906                                 $amount = 10;\r
907                 }\r
908 \r
909                 $search = postVar('search');    // search through items\r
910 \r
911                 $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'\r
912                            . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')\r
913                            . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';\r
914 \r
915                 if ($search)\r
916                         $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';\r
917 \r
918                 $query .= ' ORDER BY itime DESC'\r
919                                 . " LIMIT $start,$amount";\r
920 \r
921                 $template['content'] = 'itemlist';\r
922                 $template['now'] = time();\r
923 \r
924                 $manager->loadClass("ENCAPSULATE");\r
925                 $navList = new NAVLIST('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);\r
926                 $navList->showBatchList('item',$query,'table',$template);\r
927 \r
928                 $this->pagefoot();\r
929 \r
930         }\r
931 \r
932         /**\r
933          * Show all the comments for a given item\r
934          * @param int $itemid\r
935          */\r
936         function action_itemcommentlist($itemid = '') {\r
937                 global $member, $manager, $CONF;\r
938 \r
939                 if ($itemid == '')\r
940                         $itemid = intRequestVar('itemid');\r
941 \r
942                 // only allow if user is allowed to alter item\r
943                 $member->canAlterItem($itemid) or $this->disallow();\r
944 \r
945                 $blogid = getBlogIdFromItemId($itemid);\r
946 \r
947                 $this->pagehead();\r
948 \r
949                 // start index\r
950                 if (postVar('start'))\r
951                         $start = intPostVar('start');\r
952                 else\r
953                         $start = 0;\r
954 \r
955                 // amount of items to show\r
956                 if (postVar('amount'))\r
957                         $amount = intPostVar('amount');\r
958                 else {\r
959                         $amount = intval($CONF['DefaultListSize']);\r
960                         if ($amount < 1)\r
961                                 $amount = 10;\r
962                 }\r
963 \r
964                 $search = postVar('search');\r
965 \r
966                 echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';\r
967                 echo '<h2>',_COMMENTS,'</h2>';\r
968 \r
969                 $query = 'SELECT cbody, cuser, cmail, cemail, mname, ctime, chost, cnumber, cip, citem FROM ' . sql_table('comment') . ' LEFT OUTER JOIN ' . sql_table('member') . ' ON mnumber = cmember WHERE citem = ' . $itemid;\r
970 \r
971                 if ($search)\r
972                         $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';\r
973 \r
974                 $query .= ' ORDER BY ctime ASC'\r
975                                 . " LIMIT $start,$amount";\r
976 \r
977                 $template['content'] = 'commentlist';\r
978                 $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));\r
979 \r
980                 $manager->loadClass("ENCAPSULATE");\r
981                 $navList = new NAVLIST('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);\r
982                 $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);\r
983 \r
984                 $this->pagefoot();\r
985         }\r
986 \r
987         /**\r
988          * Browse own comments\r
989          */\r
990         function action_browseowncomments() {\r
991                 global $member, $manager, $CONF;\r
992 \r
993                 // start index\r
994                 if (postVar('start'))\r
995                         $start = intPostVar('start');\r
996                 else\r
997                         $start = 0;\r
998 \r
999                 // amount of items to show\r
1000                 if (postVar('amount'))\r
1001                         $amount = intPostVar('amount');\r
1002                 else {\r
1003                         $amount = intval($CONF['DefaultListSize']);\r
1004                         if ($amount < 1)\r
1005                                 $amount = 10;\r
1006                 }\r
1007 \r
1008                 $search = postVar('search');\r
1009 \r
1010 \r
1011                 $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();\r
1012 \r
1013                 if ($search)\r
1014                         $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';\r
1015 \r
1016                 $query .= ' ORDER BY ctime DESC'\r
1017                                 . " LIMIT $start,$amount";\r
1018 \r
1019                 $this->pagehead();\r
1020 \r
1021                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
1022                 echo '<h2>', _COMMENTS_YOUR ,'</h2>';\r
1023 \r
1024                 $template['content'] = 'commentlist';\r
1025                 $template['canAddBan'] = 0; // doesn't make sense to allow banning yourself\r
1026 \r
1027                 $manager->loadClass("ENCAPSULATE");\r
1028                 $navList = new NAVLIST('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);\r
1029                 $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);\r
1030 \r
1031                 $this->pagefoot();\r
1032         }\r
1033 \r
1034         /**\r
1035          * Browse all comments for a weblog\r
1036          * @param int $blogid\r
1037          */\r
1038         function action_blogcommentlist($blogid = '')\r
1039         {\r
1040                 global $member, $manager, $CONF;\r
1041 \r
1042                 if ($blogid == '')\r
1043                         $blogid = intRequestVar('blogid');\r
1044                 else\r
1045                         $blogid = intval($blogid);\r
1046 \r
1047                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();\r
1048 \r
1049                 // start index\r
1050                 if (postVar('start'))\r
1051                         $start = intPostVar('start');\r
1052                 else\r
1053                         $start = 0;\r
1054 \r
1055                 // amount of items to show\r
1056                 if (postVar('amount'))\r
1057                         $amount = intPostVar('amount');\r
1058                 else {\r
1059                         $amount = intval($CONF['DefaultListSize']);\r
1060                         if ($amount < 1)\r
1061                                 $amount = 10;\r
1062                 }\r
1063 \r
1064                 $search = postVar('search');            // search through comments\r
1065 \r
1066 \r
1067                 $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);\r
1068 \r
1069                 if ($search != '')\r
1070                         $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';\r
1071 \r
1072 \r
1073                 $query .= ' ORDER BY ctime DESC'\r
1074                                 . " LIMIT $start,$amount";\r
1075 \r
1076 \r
1077                 $blog =& $manager->getBlog($blogid);\r
1078 \r
1079                 $this->pagehead();\r
1080 \r
1081                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
1082                 echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';\r
1083 \r
1084                 $template['content'] = 'commentlist';\r
1085                 $template['canAddBan'] = $member->blogAdminRights($blogid);\r
1086 \r
1087                 $manager->loadClass("ENCAPSULATE");\r
1088                 $navList = new NAVLIST('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);\r
1089                 $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);\r
1090 \r
1091                 $this->pagefoot();\r
1092         }\r
1093 \r
1094         /**\r
1095          * Provide a page to item a new item to the given blog\r
1096          */\r
1097         function action_createitem() {\r
1098                 global $member, $manager;\r
1099 \r
1100                 $blogid = intRequestVar('blogid');\r
1101 \r
1102                 // check if allowed\r
1103                 $member->teamRights($blogid) or $this->disallow();\r
1104 \r
1105                 $memberid = $member->getID();\r
1106 \r
1107                 $blog =& $manager->getBlog($blogid);\r
1108 \r
1109                 $this->pagehead();\r
1110 \r
1111                 // generate the add-item form\r
1112                 $formfactory = new PAGEFACTORY($blogid);\r
1113                 $formfactory->createAddForm('admin');\r
1114 \r
1115                 $this->pagefoot();\r
1116         }\r
1117 \r
1118         /**\r
1119          * @todo document this\r
1120          */\r
1121         function action_itemedit() {\r
1122                 global $member, $manager;\r
1123 \r
1124                 $itemid = intRequestVar('itemid');\r
1125 \r
1126                 // only allow if user is allowed to alter item\r
1127                 $member->canAlterItem($itemid) or $this->disallow();\r
1128 \r
1129                 $item =& $manager->getItem($itemid,1,1);\r
1130                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));\r
1131 \r
1132                 $param = array('item' => &$item);\r
1133                 $manager->notify('PrepareItemForEdit', $param);\r
1134 \r
1135                 if ($blog->convertBreaks()) {\r
1136                         $item['body'] = removeBreaks($item['body']);\r
1137                         $item['more'] = removeBreaks($item['more']);\r
1138                 }\r
1139 \r
1140                 // form to edit blog items\r
1141                 $this->pagehead();\r
1142                 $formfactory = new PAGEFACTORY($blog->getID());\r
1143                 $formfactory->createEditForm('admin',$item);\r
1144                 $this->pagefoot();\r
1145         }\r
1146 \r
1147         /**\r
1148          * @todo document this\r
1149          */\r
1150         function action_itemupdate() {\r
1151                 global $member, $manager, $CONF;\r
1152 \r
1153                 $itemid = intRequestVar('itemid');\r
1154                 $catid = postVar('catid');\r
1155 \r
1156                 // only allow if user is allowed to alter item\r
1157                 $member->canUpdateItem($itemid, $catid) or $this->disallow();\r
1158 \r
1159                 $actiontype = postVar('actiontype');\r
1160 \r
1161                 // delete actions are handled by itemdelete (which has confirmation)\r
1162                 if ($actiontype == 'delete') {\r
1163                         $this->action_itemdelete();\r
1164                         return;\r
1165                 }\r
1166 \r
1167                 $body   = postVar('body');\r
1168                 $title  = postVar('title');\r
1169                 $more   = postVar('more');\r
1170                 $closed = intPostVar('closed');\r
1171                 $draftid = intPostVar('draftid');\r
1172 \r
1173                 // default action = add now\r
1174                 if (!$actiontype)\r
1175                         $actiontype='addnow';\r
1176 \r
1177                 // create new category if needed\r
1178                 if (strstr($catid,'newcat')) {\r
1179                         // get blogid\r
1180                         list($blogid) = sscanf($catid,"newcat-%d");\r
1181 \r
1182                         // create\r
1183                         $blog =& $manager->getBlog($blogid);\r
1184                         $catid = $blog->createNewCategory();\r
1185 \r
1186                         // show error when sth goes wrong\r
1187                         if (!$catid)\r
1188                                 $this->doError(_ERROR_CATCREATEFAIL);\r
1189                 }\r
1190 \r
1191                 /*\r
1192                         set some variables based on actiontype\r
1193 \r
1194                         actiontypes:\r
1195                                 draft items -> addnow, addfuture, adddraft, delete\r
1196                                 non-draft items -> edit, changedate, delete\r
1197 \r
1198                         variables set:\r
1199                                 $timestamp: set to a nonzero value for future dates or date changes\r
1200                                 $wasdraft: set to 1 when the item used to be a draft item\r
1201                                 $publish: set to 1 when the edited item is not a draft\r
1202                 */\r
1203                 $blogid =  getBlogIDFromItemID($itemid);\r
1204                 $blog   =& $manager->getBlog($blogid);\r
1205 \r
1206                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
1207                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
1208                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
1209                 if ($actiontype == 'addfuture' || $actiontype == 'changedate') {\r
1210                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
1211                 } else {\r
1212                         $timestamp =0;\r
1213                 }\r
1214 \r
1215                 // edit the item for real\r
1216                 ITEM::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
1217 \r
1218                 $this->updateFuturePosted($blogid);\r
1219 \r
1220                 if ($draftid > 0) {\r
1221                         // delete permission is checked inside ITEM::delete()\r
1222                         ITEM::delete($draftid);\r
1223                 }\r
1224 \r
1225                 // show category edit window when we created a new category\r
1226                 // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')\r
1227                 if ($catid != intPostVar('catid')) {\r
1228                         $this->action_categoryedit(\r
1229                                 $catid,\r
1230                                 $blog->getID(),\r
1231                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
1232                         );\r
1233                 } else {\r
1234                         // TODO: set start item correctly for itemlist\r
1235                         $this->action_itemlist(getBlogIDFromItemID($itemid));\r
1236                 }\r
1237         }\r
1238 \r
1239         /**\r
1240          * @todo document this\r
1241          */\r
1242         function action_itemdelete() {\r
1243                 global $member, $manager;\r
1244 \r
1245                 $itemid = intRequestVar('itemid');\r
1246 \r
1247                 // only allow if user is allowed to alter item\r
1248                 $member->canAlterItem($itemid) or $this->disallow();\r
1249 \r
1250                 if (!$manager->existsItem($itemid,1,1))\r
1251                         $this->error(_ERROR_NOSUCHITEM);\r
1252 \r
1253                 $item =& $manager->getItem($itemid,1,1);\r
1254                 $title = htmlspecialchars(strip_tags($item['title']));\r
1255                 $body = strip_tags($item['body']);\r
1256                 $body = htmlspecialchars(shorten($body,300,'...'));\r
1257 \r
1258                 $this->pagehead();\r
1259                 ?>\r
1260                         <h2><?php echo _DELETE_CONFIRM?></h2>\r
1261 \r
1262                         <p><?php echo _CONFIRMTXT_ITEM?></p>\r
1263 \r
1264                         <div class="note">\r
1265                                 <b>"<?php echo  $title ?>"</b>\r
1266                                 <br />\r
1267                                 <?php echo $body?>\r
1268                         </div>\r
1269 \r
1270                         <form method="post" action="index.php"><div>\r
1271                                 <input type="hidden" name="action" value="itemdeleteconfirm" />\r
1272                                 <?php $manager->addTicketHidden() ?>\r
1273                                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />\r
1274                                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>"  tabindex="10" />\r
1275                         </div></form>\r
1276                 <?php\r
1277                 $this->pagefoot();\r
1278         }\r
1279 \r
1280         /**\r
1281          * @todo document this\r
1282          */\r
1283         function action_itemdeleteconfirm() {\r
1284                 global $member;\r
1285 \r
1286                 $itemid = intRequestVar('itemid');\r
1287 \r
1288                 // only allow if user is allowed to alter item\r
1289                 $member->canAlterItem($itemid) or $this->disallow();\r
1290 \r
1291                 // get blogid first\r
1292                 $blogid = getBlogIdFromItemId($itemid);\r
1293 \r
1294                 // delete item (note: some checks will be performed twice)\r
1295                 $this->deleteOneItem($itemid);\r
1296 \r
1297                 $this->action_itemlist($blogid);\r
1298         }\r
1299 \r
1300         /**\r
1301          * Deletes one item and returns error if something goes wrong\r
1302          * @param int $itemid\r
1303          */\r
1304         function deleteOneItem($itemid) {\r
1305                 global $member, $manager;\r
1306 \r
1307                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1308                 if (!$member->canAlterItem($itemid))\r
1309                         return _ERROR_DISALLOWED;\r
1310 \r
1311                 // need to get blogid before the item is deleted\r
1312                 $blogid = getBlogIDFromItemId($itemid);\r
1313 \r
1314                 $manager->loadClass('ITEM');\r
1315                 ITEM::delete($itemid);\r
1316 \r
1317                 // update blog's futureposted\r
1318                 $this->updateFuturePosted($blogid);\r
1319         }\r
1320 \r
1321         /**\r
1322          * Update a blog's future posted flag\r
1323          * @param int $blogid\r
1324          */\r
1325         function updateFuturePosted($blogid) {\r
1326                 global $manager;\r
1327 \r
1328                 $blog =& $manager->getBlog($blogid);\r
1329                 $currenttime = $blog->getCorrectTime(time());\r
1330                 $result = sql_query("SELECT * FROM ".sql_table('item').\r
1331                         " WHERE iblog='".$blogid."' AND iposted=0 AND itime>".mysqldate($currenttime));\r
1332                 if (sql_num_rows($result) > 0) {\r
1333                                 $blog->setFuturePost();\r
1334                 }\r
1335                 else {\r
1336                                 $blog->clearFuturePost();\r
1337                 }\r
1338         }\r
1339 \r
1340         /**\r
1341          * @todo document this\r
1342          */\r
1343         function action_itemmove() {\r
1344                 global $member, $manager;\r
1345 \r
1346                 $itemid = intRequestVar('itemid');\r
1347 \r
1348                 // only allow if user is allowed to alter item\r
1349                 $member->canAlterItem($itemid) or $this->disallow();\r
1350 \r
1351                 $item =& $manager->getItem($itemid,1,1);\r
1352 \r
1353                 $this->pagehead();\r
1354                 ?>\r
1355                         <h2><?php echo _MOVE_TITLE?></h2>\r
1356                         <form method="post" action="index.php"><div>\r
1357                                 <input type="hidden" name="action" value="itemmoveto" />\r
1358                                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />\r
1359 \r
1360                                 <?php\r
1361 \r
1362                                         $manager->addTicketHidden();\r
1363                                         $this->selectBlogCategory('catid',$item['catid'],10,1);\r
1364                                 ?>\r
1365 \r
1366                                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />\r
1367                         </div></form>\r
1368                 <?php\r
1369                 $this->pagefoot();\r
1370         }\r
1371 \r
1372         /**\r
1373          * @todo document this\r
1374          */\r
1375         function action_itemmoveto() {\r
1376                 global $member, $manager;\r
1377 \r
1378                 $itemid = intRequestVar('itemid');\r
1379                 $catid = requestVar('catid');\r
1380 \r
1381                 // create new category if needed\r
1382                 if (strstr($catid,'newcat')) {\r
1383                         // get blogid\r
1384                         list($blogid) = sscanf($catid,'newcat-%d');\r
1385 \r
1386                         // create\r
1387                         $blog =& $manager->getBlog($blogid);\r
1388                         $catid = $blog->createNewCategory();\r
1389 \r
1390                         // show error when sth goes wrong\r
1391                         if (!$catid)\r
1392                                 $this->doError(_ERROR_CATCREATEFAIL);\r
1393                 }\r
1394 \r
1395                 // only allow if user is allowed to alter item\r
1396                 $member->canUpdateItem($itemid, $catid) or $this->disallow();\r
1397 \r
1398                 $old_blogid = getBlogIDFromItemId($itemid);\r
1399 \r
1400                 ITEM::move($itemid, $catid);\r
1401 \r
1402                 // set the futurePosted flag on the blog\r
1403                 $this->updateFuturePosted(getBlogIDFromItemId($itemid));\r
1404 \r
1405                 // reset the futurePosted in case the item is moved from one blog to another\r
1406                 $this->updateFuturePosted($old_blogid);\r
1407 \r
1408                 if ($catid != intRequestVar('catid'))\r
1409                         $this->action_categoryedit($catid, $blog->getID());\r
1410                 else\r
1411                         $this->action_itemlist(getBlogIDFromCatID($catid));\r
1412         }\r
1413 \r
1414         /**\r
1415          * Moves one item to a given category (category existance should be checked by caller)\r
1416          * errors are returned\r
1417          * @param int $itemid\r
1418          * @param int $destCatid category ID to which the item will be moved\r
1419          */\r
1420         function moveOneItem($itemid, $destCatid) {\r
1421                 global $member;\r
1422 \r
1423                 // only allow if user is allowed to move item\r
1424                 if (!$member->canUpdateItem($itemid, $destCatid))\r
1425                         return _ERROR_DISALLOWED;\r
1426 \r
1427                 ITEM::move($itemid, $destCatid);\r
1428         }\r
1429 \r
1430         /**\r
1431          * Adds a item to the chosen blog\r
1432          */\r
1433         function action_additem() {\r
1434                 global $manager, $CONF;\r
1435 \r
1436                 $manager->loadClass('ITEM');\r
1437 \r
1438                 $result = ITEM::createFromRequest();\r
1439 \r
1440                 if ($result['status'] == 'error')\r
1441                         $this->error($result['message']);\r
1442 \r
1443                 $blogid = getBlogIDFromItemID($result['itemid']);\r
1444                 $blog =& $manager->getBlog($blogid);\r
1445                 $btimestamp = $blog->getCorrectTime();\r
1446                 $item      = $manager->getItem(intval($result['itemid']), 1, 1);\r
1447 \r
1448                 if ($result['status'] == 'newcategory') {\r
1449                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));\r
1450                         $this->action_categoryedit($result['catid'], $blogid, $distURI);\r
1451                 } else {\r
1452                         $methodName = 'action_itemList';\r
1453                         call_user_func(array($this, $methodName), $blogid);\r
1454                 }\r
1455         }\r
1456 \r
1457         /**\r
1458          * Allows to edit previously made comments\r
1459          */\r
1460         function action_commentedit() {\r
1461                 global $member, $manager;\r
1462 \r
1463                 $commentid = intRequestVar('commentid');\r
1464 \r
1465                 $member->canAlterComment($commentid) or $this->disallow();\r
1466 \r
1467                 $comment = COMMENT::getComment($commentid);\r
1468 \r
1469                 $param = array('comment' => &$comment);\r
1470                 $manager->notify('PrepareCommentForEdit', $param);\r
1471 \r
1472                 // change <br /> to \n\r
1473                 $comment['body'] = str_replace('<br />','',$comment['body']);\r
1474                 \r
1475                 // replaced eregi_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0\r
1476                 /* original eregi_replace: eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>", "\\1", $comment['body']) */\r
1477                 $comment['body'] = preg_replace("#<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>#i", "\\1", $comment['body']);\r
1478                 \r
1479                 $this->pagehead();\r
1480 \r
1481                 ?>\r
1482                 <h2><?php echo _EDITC_TITLE?></h2>\r
1483 \r
1484                 <form action="index.php" method="post"><div>\r
1485 \r
1486                 <input type="hidden" name="action" value="commentupdate" />\r
1487                 <?php $manager->addTicketHidden(); ?>\r
1488                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />\r
1489                 <table><tr>\r
1490                         <th colspan="2"><?php echo _EDITC_TITLE?></th>\r
1491                 </tr><tr>\r
1492                         <td><?php echo _EDITC_WHO?></td>\r
1493                         <td>\r
1494                         <?php                      if ($comment['member'])\r
1495                                         echo $comment['member'] . " (" . _EDITC_MEMBER . ")";\r
1496                                 else\r
1497                                         echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";\r
1498                         ?>\r
1499                         </td>\r
1500                 </tr><tr>\r
1501                         <td><?php echo _EDITC_WHEN?></td>\r
1502                         <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>\r
1503                 </tr><tr>\r
1504                         <td><?php echo _EDITC_HOST?></td>\r
1505                         <td><?php echo  $comment['host']; ?></td>\r
1506                 </tr>\r
1507                 <tr>\r
1508                         <td><?php echo _EDITC_URL; ?></td>\r
1509                         <td><input type="text" name="url" size="30" tabindex="6" value="<?php echo $comment['userid']; ?>" /></td>\r
1510                 </tr>\r
1511                 <tr>\r
1512                         <td><?php echo _EDITC_EMAIL; ?></td>\r
1513                         <td><input type="text" name="email" size="30" tabindex="8" value="<?php echo $comment['email']; ?>" /></td>\r
1514                 </tr>\r
1515                 <tr>\r
1516                         <td><?php echo _EDITC_TEXT?></td>\r
1517                         <td>\r
1518                                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                              // htmlspecialchars not needed (things should be escaped already)\r
1519                                         echo $comment['body'];\r
1520                                 ?></textarea>\r
1521                         </td>\r
1522                 </tr><tr>\r
1523                         <td><?php echo _EDITC_EDIT?></td>\r
1524                         <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>\r
1525                 </tr></table>\r
1526 \r
1527                 </div></form>\r
1528                 <?php\r
1529                 $this->pagefoot();\r
1530         }\r
1531 \r
1532         /**\r
1533          * @todo document this\r
1534          */\r
1535         function action_commentupdate() {\r
1536                 global $member, $manager;\r
1537 \r
1538                 $commentid = intRequestVar('commentid');\r
1539 \r
1540                 $member->canAlterComment($commentid) or $this->disallow();\r
1541 \r
1542                 $url = postVar('url');\r
1543                 $email = postVar('email');\r
1544                 $body = postVar('body');\r
1545                 \r
1546                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0\r
1547                 # original eregi: eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}", $body) != FALSE\r
1548                 # important note that '\' must be matched with '\\\\' in preg* expressions\r
1549                 // intercept words that are too long\r
1550                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1551                 {\r
1552                         $this->error(_ERROR_COMMENT_LONGWORD);\r
1553                 }\r
1554                 \r
1555                 // check length\r
1556                 if (strlen($body) < 3)\r
1557                 {\r
1558                         $this->error(_ERROR_COMMENT_NOCOMMENT);\r
1559                 }\r
1560                 if (strlen($body)>5000)\r
1561                 {\r
1562                         $this->error(_ERROR_COMMENT_TOOLONG);\r
1563                 }\r
1564                 \r
1565                 // prepare body\r
1566                 $body = COMMENT::prepareBody($body);\r
1567 \r
1568                 // call plugins\r
1569                 $param = array('body' => &$body);\r
1570                 $manager->notify('PreUpdateComment', $param);\r
1571 \r
1572                 $query =  'UPDATE '.sql_table('comment')\r
1573                            . " SET cmail = '" . sql_real_escape_string($url) . "', cemail = '" . sql_real_escape_string($email) . "', cbody = '" . sql_real_escape_string($body) . "'"\r
1574                            . " WHERE cnumber=" . $commentid;\r
1575                 sql_query($query);\r
1576 \r
1577                 // get itemid\r
1578                 $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);\r
1579                 $o = sql_fetch_object($res);\r
1580                 $itemid = $o->citem;\r
1581 \r
1582                 if ($member->canAlterItem($itemid))\r
1583                         $this->action_itemcommentlist($itemid);\r
1584                 else\r
1585                         $this->action_browseowncomments();\r
1586 \r
1587         }\r
1588 \r
1589         /**\r
1590          * @todo document this\r
1591          */\r
1592         function action_commentdelete() {\r
1593                 global $member, $manager;\r
1594 \r
1595                 $commentid = intRequestVar('commentid');\r
1596 \r
1597                 $member->canAlterComment($commentid) or $this->disallow();\r
1598 \r
1599                 $comment = COMMENT::getComment($commentid);\r
1600 \r
1601                 $body = strip_tags($comment['body']);\r
1602                 $body = htmlspecialchars(shorten($body, 300, '...'));\r
1603 \r
1604                 if ($comment['member'])\r
1605                         $author = $comment['member'];\r
1606                 else\r
1607                         $author = $comment['user'];\r
1608 \r
1609                 $this->pagehead();\r
1610                 ?>\r
1611 \r
1612                         <h2><?php echo _DELETE_CONFIRM?></h2>\r
1613 \r
1614                         <p><?php echo _CONFIRMTXT_COMMENT?></p>\r
1615 \r
1616                         <div class="note">\r
1617                         <b><?php echo _EDITC_WHO?>:</b> <?php echo  $author ?>\r
1618                         <br />\r
1619                         <b><?php echo _EDITC_TEXT?>:</b> <?php echo  $body ?>\r
1620                         </div>\r
1621 \r
1622                         <form method="post" action="index.php"><div>\r
1623                                 <input type="hidden" name="action" value="commentdeleteconfirm" />\r
1624                                 <?php $manager->addTicketHidden() ?>\r
1625                                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />\r
1626                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
1627                         </div></form>\r
1628                 <?php\r
1629                 $this->pagefoot();\r
1630         }\r
1631 \r
1632         /**\r
1633          * @todo document this\r
1634          */\r
1635         function action_commentdeleteconfirm() {\r
1636                 global $member;\r
1637 \r
1638                 $commentid = intRequestVar('commentid');\r
1639 \r
1640                 // get item id first\r
1641                 $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);\r
1642                 $o = sql_fetch_object($res);\r
1643                 $itemid = $o->citem;\r
1644 \r
1645                 $error = $this->deleteOneComment($commentid);\r
1646                 if ($error)\r
1647                         $this->doError($error);\r
1648 \r
1649                 if ($member->canAlterItem($itemid))\r
1650                         $this->action_itemcommentlist($itemid);\r
1651                 else\r
1652                         $this->action_browseowncomments();\r
1653         }\r
1654 \r
1655         /**\r
1656          * @todo document this\r
1657          */\r
1658         function deleteOneComment($commentid) {\r
1659                 global $member, $manager;\r
1660 \r
1661                 $commentid = intval($commentid);\r
1662 \r
1663                 if (!$member->canAlterComment($commentid))\r
1664                         return _ERROR_DISALLOWED;\r
1665 \r
1666                 $param =array('commentid' => $commentid);\r
1667                 $manager->notify('PreDeleteComment', $param);\r
1668 \r
1669                 // delete the comments associated with the item\r
1670                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;\r
1671                 sql_query($query);\r
1672 \r
1673                 $param = array('commentid' => $commentid);\r
1674                 $manager->notify('PostDeleteComment', $param);\r
1675 \r
1676                 return '';\r
1677         }\r
1678 \r
1679         /**\r
1680          * Usermanagement main\r
1681          */\r
1682         function action_usermanagement() {\r
1683                 global $member, $manager;\r
1684 \r
1685                 // check if allowed\r
1686                 $member->isAdmin() or $this->disallow();\r
1687 \r
1688                 $this->pagehead();\r
1689 \r
1690                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
1691 \r
1692                 echo '<h2>' . _MEMBERS_TITLE .'</h2>';\r
1693 \r
1694                 echo '<h3>' . _MEMBERS_CURRENT .'</h3>';\r
1695 \r
1696                 // show list of members with actions\r
1697                 $query =  'SELECT *'\r
1698                            . ' FROM '.sql_table('member');\r
1699                 $template['content'] = 'memberlist';\r
1700                 $template['tabindex'] = 10;\r
1701 \r
1702                 $manager->loadClass("ENCAPSULATE");\r
1703                 $batch = new BATCH('member');\r
1704                 $batch->showlist($query,'table',$template);\r
1705 \r
1706                 echo '<h3>' . _MEMBERS_NEW .'</h3>';\r
1707                 ?>\r
1708                         <form method="post" action="index.php" name="memberedit"><div>\r
1709 \r
1710                         <input type="hidden" name="action" value="memberadd" />\r
1711                         <?php $manager->addTicketHidden() ?>\r
1712 \r
1713                         <table>\r
1714                         <tr>\r
1715                                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>\r
1716                         </tr><tr>\r
1717                                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>\r
1718                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>\r
1719                                 </td>\r
1720                                 <td><input tabindex="10010" name="name" size="32" maxlength="32" /></td>\r
1721                         </tr><tr>\r
1722                                 <td><?php echo _MEMBERS_REALNAME?></td>\r
1723                                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>\r
1724                         </tr><tr>\r
1725                                 <td><?php echo _MEMBERS_PWD?></td>\r
1726                                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>\r
1727                         </tr><tr>\r
1728                                 <td><?php echo _MEMBERS_REPPWD?></td>\r
1729                                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>\r
1730                         </tr><tr>\r
1731                                 <td><?php echo _MEMBERS_EMAIL?></td>\r
1732                                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>\r
1733                         </tr><tr>\r
1734                                 <td><?php echo _MEMBERS_URL?></td>\r
1735                                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>\r
1736                         </tr><tr>\r
1737                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>\r
1738                                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>\r
1739                         </tr><tr>\r
1740                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>\r
1741                                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>\r
1742                         </tr><tr>\r
1743                                 <td><?php echo _MEMBERS_NOTES?></td>\r
1744                                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>\r
1745                         </tr><tr>\r
1746                                 <td><?php echo _MEMBERS_NEW?></td>\r
1747                                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>\r
1748                         </tr></table>\r
1749 \r
1750                         </div></form>\r
1751                 <?php\r
1752                 $this->pagefoot();\r
1753         }\r
1754 \r
1755         /**\r
1756          * Edit member settings\r
1757          */\r
1758         function action_memberedit() {\r
1759                 $this->action_editmembersettings(intRequestVar('memberid'));\r
1760         }\r
1761 \r
1762         /**\r
1763          * @todo document this\r
1764          */\r
1765         function action_editmembersettings($memberid = '') {\r
1766                 global $member, $manager, $CONF;\r
1767 \r
1768                 if ($memberid == '')\r
1769                         $memberid = $member->getID();\r
1770 \r
1771                 // check if allowed\r
1772                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();\r
1773 \r
1774                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
1775                 $this->pagehead($extrahead);\r
1776 \r
1777                 // show message to go back to member overview (only for admins)\r
1778                 if ($member->isAdmin())\r
1779                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';\r
1780                 else\r
1781                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';\r
1782 \r
1783                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';\r
1784 \r
1785                 $mem = MEMBER::createFromID($memberid);\r
1786 \r
1787                 ?>\r
1788                 <form method="post" action="index.php" name="memberedit"><div>\r
1789 \r
1790                 <input type="hidden" name="action" value="changemembersettings" />\r
1791                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />\r
1792                 <?php $manager->addTicketHidden() ?>\r
1793 \r
1794                 <table><tr>\r
1795                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>\r
1796                 </tr><tr>\r
1797                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>\r
1798                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>\r
1799                         </td>\r
1800                         <td>\r
1801                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>\r
1802                                 <input name="name" tabindex="10" maxlength="32" size="32" value="<?php echo  htmlspecialchars($mem->getDisplayName()); ?>" />\r
1803                         <?php } else {\r
1804                                 echo htmlspecialchars($member->getDisplayName());\r
1805                            }\r
1806                         ?>\r
1807                         </td>\r
1808                 </tr><tr>\r
1809                         <td><?php echo _MEMBERS_REALNAME?></td>\r
1810                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  htmlspecialchars($mem->getRealName()); ?>" /></td>\r
1811                 </tr><tr>\r
1812                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>\r
1813                         <td><?php echo _MEMBERS_PWD?></td>\r
1814                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>\r
1815                 </tr><tr>\r
1816                         <td><?php echo _MEMBERS_REPPWD?></td>\r
1817                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>\r
1818                 <?php } ?>\r
1819                 </tr><tr>\r
1820                         <td><?php echo _MEMBERS_EMAIL?>\r
1821                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>\r
1822                         </td>\r
1823                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  htmlspecialchars($mem->getEmail()); ?>" /></td>\r
1824                 </tr><tr>\r
1825                         <td><?php echo _MEMBERS_URL?></td>\r
1826                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  htmlspecialchars($mem->getURL()); ?>" /></td>\r
1827                 <?php // only allow to change this by super-admins\r
1828                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)\r
1829                    if ($member->isAdmin()) {\r
1830                 ?>\r
1831                         </tr><tr>\r
1832                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>\r
1833                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>\r
1834                         </tr><tr>\r
1835                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>\r
1836                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70,1,0,_YES,_NO,$mem->isAdmin()); ?></td>\r
1837                 <?php } ?>\r
1838                 </tr><tr>\r
1839                         <td><?php echo _MEMBERS_NOTES?></td>\r
1840                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  htmlspecialchars($mem->getNotes()); ?>" /></td>\r
1841                 </tr><tr>\r
1842                         <td><?php echo _MEMBERS_DEFLANG?> <?php help('language'); ?>\r
1843                         </td>\r
1844                         <td>\r
1845 \r
1846                                 <select name="deflang" tabindex="85">\r
1847                                         <option value=""><?php echo _MEMBERS_USESITELANG?></option>\r
1848                                 <?php                      // show a dropdown list of all available languages\r
1849                                 global $DIR_LANG;\r
1850                                 $dirhandle = opendir($DIR_LANG);\r
1851                                 while ($filename = readdir($dirhandle))\r
1852                                 {\r
1853                                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0\r
1854                                         # original ereg: ereg("^(.*)\.php$", $filename, $matches)\r
1855                                         if (preg_match('#^(.*)\.php$#', $filename, $matches) )\r
1856                                         {\r
1857                                                 $name = $matches[1];\r
1858                                                 echo "<option value=\"$name\"";\r
1859                                                 if ($name == $mem->getLanguage() )\r
1860                                                 {\r
1861                                                         echo " selected=\"selected\"";\r
1862                                                 }\r
1863                                                 echo ">$name</option>";\r
1864                                         }\r
1865                                 }\r
1866                                 closedir($dirhandle);\r
1867                                 \r
1868                                 ?>\r
1869                                 </select>\r
1870 \r
1871                         </td>\r
1872                 </tr>\r
1873                 <tr>\r
1874                         <td><?php echo _MEMBERS_USEAUTOSAVE?> <?php help('autosave'); ?></td>\r
1875                         <td><?php $this->input_yesno('autosave', $mem->getAutosave(), 87); ?></td>\r
1876                 </tr>\r
1877                 <?php\r
1878                         // plugin options\r
1879                         $this->_insertPluginOptions('member',$memberid);\r
1880                 ?>\r
1881                 <tr>\r
1882                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>\r
1883                 </tr><tr>\r
1884                         <td><?php echo _MEMBERS_EDIT?></td>\r
1885                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>\r
1886                 </tr></table>\r
1887 \r
1888                 </div></form>\r
1889 \r
1890                 <?php\r
1891                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';\r
1892 \r
1893                         $param = array('member' => &$mem);\r
1894                         $manager->notify('MemberSettingsFormExtras', $param);\r
1895 \r
1896                 $this->pagefoot();\r
1897         }\r
1898 \r
1899         /**\r
1900          * @todo document this\r
1901          */\r
1902         function action_changemembersettings() {\r
1903                 global $member, $CONF, $manager;\r
1904 \r
1905                 $memberid = intRequestVar('memberid');\r
1906 \r
1907                 // check if allowed\r
1908                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();\r
1909 \r
1910                 $name              = trim(strip_tags(postVar('name')));\r
1911                 $realname          = trim(strip_tags(postVar('realname')));\r
1912                 $password          = postVar('password');\r
1913                 $repeatpassword = postVar('repeatpassword');\r
1914                 $email            = strip_tags(postVar('email'));\r
1915                 $url                    = strip_tags(postVar('url'));\r
1916 \r
1917                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0\r
1918                 # original eregi: !eregi("^https?://", $url)\r
1919                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1920                 if (!preg_match('#^https?://#', $url) )\r
1921                 {\r
1922                         $url = 'http://' . $url;\r
1923                 }\r
1924                 $admin            = postVar('admin');\r
1925                 $canlogin          = postVar('canlogin');\r
1926                 $notes            = strip_tags(postVar('notes'));\r
1927                 $deflang                = postVar('deflang');\r
1928 \r
1929                 $mem = MEMBER::createFromID($memberid);\r
1930 \r
1931                 if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {\r
1932 \r
1933                         if (!isValidDisplayName($name))\r
1934                                 $this->error(_ERROR_BADNAME);\r
1935 \r
1936                         if (($name != $mem->getDisplayName()) && MEMBER::exists($name))\r
1937                                 $this->error(_ERROR_NICKNAMEINUSE);\r
1938 \r
1939                         if ($password != $repeatpassword)\r
1940                                 $this->error(_ERROR_PASSWORDMISMATCH);\r
1941 \r
1942                         if ($password && (strlen($password) < 6))\r
1943                                 $this->error(_ERROR_PASSWORDTOOSHORT);\r
1944 \r
1945                         if ($password) {\r
1946                                 $pwdvalid = true;\r
1947                                 $pwderror = '';\r
1948                                 $param = array(\r
1949                                         'password'              =>  $password,\r
1950                                         'errormessage'  => &$pwderror,\r
1951                                         'valid'                 => &$pwdvalid\r
1952                                 );\r
1953                                 $manager->notify('PrePasswordSet', $param);\r
1954                                 if (!$pwdvalid) {\r
1955                                         $this->error($pwderror);\r
1956                                 }\r
1957                         }\r
1958                 }\r
1959 \r
1960                 if (!isValidMailAddress($email))\r
1961                         $this->error(_ERROR_BADMAILADDRESS);\r
1962 \r
1963 \r
1964                 if (!$realname)\r
1965                         $this->error(_ERROR_REALNAMEMISSING);\r
1966 \r
1967                 if (($deflang != '') && (!checkLanguage($deflang)))\r
1968                         $this->error(_ERROR_NOSUCHLANGUAGE);\r
1969 \r
1970                 // check if there will remain at least one site member with both the logon and admin rights\r
1971                 // (check occurs when taking away one of these rights from such a member)\r
1972                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1973                          || (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1974                    )\r
1975                 {\r
1976                         $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1977                         if (sql_num_rows($r) < 2)\r
1978                                 $this->error(_ERROR_ATLEASTONEADMIN);\r
1979                 }\r
1980 \r
1981                 if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {\r
1982                         $mem->setDisplayName($name);\r
1983                         if ($password)\r
1984                                 $mem->setPassword($password);\r
1985                 }\r
1986 \r
1987                 $oldEmail = $mem->getEmail();\r
1988 \r
1989                 $mem->setRealName($realname);\r
1990                 $mem->setEmail($email);\r
1991                 $mem->setURL($url);\r
1992                 $mem->setNotes($notes);\r
1993                 $mem->setLanguage($deflang);\r
1994 \r
1995 \r
1996                 // only allow super-admins to make changes to the admin status\r
1997                 if ($member->isAdmin()) {\r
1998                         $mem->setAdmin($admin);\r
1999                         $mem->setCanLogin($canlogin);\r
2000                 }\r
2001 \r
2002                 $autosave = postVar ('autosave');\r
2003                 $mem->setAutosave($autosave);\r
2004 \r
2005                 $mem->write();\r
2006 \r
2007                 // store plugin options\r
2008                 $aOptions = requestArray('plugoption');\r
2009                 NucleusPlugin::_applyPluginOptions($aOptions);\r
2010                 $param = array(\r
2011                         'context'       =>  'member',\r
2012                         'memberid'      =>  $memberid,\r
2013                         'member'        => &$mem\r
2014                 );\r
2015                 $manager->notify('PostPluginOptionsUpdate', $param);\r
2016 \r
2017                 // if email changed, generate new password\r
2018                 if ($oldEmail != $mem->getEmail())\r
2019                 {\r
2020                         $mem->sendActivationLink('addresschange', $oldEmail);\r
2021                         // logout member\r
2022                         $mem->newCookieKey();\r
2023 \r
2024                         // only log out if the member being edited is the current member.\r
2025                         if ($member->getID() == $memberid)\r
2026                                 $member->logout();\r
2027                         $this->action_login(_MSG_ACTIVATION_SENT, 0);\r
2028                         return;\r
2029                 }\r
2030 \r
2031 \r
2032                 if (  ( $mem->getID() == $member->getID() )\r
2033                    && ( $mem->getDisplayName() != $member->getDisplayName() )\r
2034                    ) {\r
2035                         $mem->newCookieKey();\r
2036                         $member->logout();\r
2037                         $this->action_login(_MSG_LOGINAGAIN, 0);\r
2038                 } else {\r
2039                         $this->action_overview(_MSG_SETTINGSCHANGED);\r
2040                 }\r
2041         }\r
2042 \r
2043         /**\r
2044          * @todo document this\r
2045          */\r
2046         function action_memberadd() {\r
2047                 global $member, $manager;\r
2048 \r
2049                 // check if allowed\r
2050                 $member->isAdmin() or $this->disallow();\r
2051 \r
2052                 if (postVar('password') != postVar('repeatpassword'))\r
2053                         $this->error(_ERROR_PASSWORDMISMATCH);\r
2054                 if (strlen(postVar('password')) < 6)\r
2055                         $this->error(_ERROR_PASSWORDTOOSHORT);\r
2056 \r
2057                 $res = MEMBER::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));\r
2058                 if ($res != 1)\r
2059                         $this->error($res);\r
2060 \r
2061                 // fire PostRegister event\r
2062                 $newmem = new MEMBER();\r
2063                 $newmem->readFromName(postVar('name'));\r
2064                 $param = array('member' => &$newmem);\r
2065                 $manager->notify('PostRegister', $param);\r
2066 \r
2067                 $this->action_usermanagement();\r
2068         }\r
2069 \r
2070         /**\r
2071          * Account activation\r
2072          *\r
2073          * @author dekarma\r
2074          */\r
2075         function action_activate() {\r
2076 \r
2077                 $key = getVar('key');\r
2078                 $this->_showActivationPage($key);\r
2079         }\r
2080 \r
2081         /**\r
2082          * @todo document this\r
2083          */\r
2084         function _showActivationPage($key, $message = '')\r
2085         {\r
2086                 global $manager;\r
2087 \r
2088                 // clean up old activation keys\r
2089                 MEMBER::cleanupActivationTable();\r
2090 \r
2091                 // get activation info\r
2092                 $info = MEMBER::getActivationInfo($key);\r
2093 \r
2094                 if (!$info)\r
2095                         $this->error(_ERROR_ACTIVATE);\r
2096 \r
2097                 $mem = MEMBER::createFromId($info->vmember);\r
2098 \r
2099                 if (!$mem)\r
2100                         $this->error(_ERROR_ACTIVATE);\r
2101 \r
2102                 $text = '';\r
2103                 $title = '';\r
2104                 $bNeedsPasswordChange = true;\r
2105 \r
2106                 switch ($info->vtype)\r
2107                 {\r
2108                         case 'forgot':\r
2109                                 $title = _ACTIVATE_FORGOT_TITLE;\r
2110                                 $text = _ACTIVATE_FORGOT_TEXT;\r
2111                                 break;\r
2112                         case 'register':\r
2113                                 $title = _ACTIVATE_REGISTER_TITLE;\r
2114                                 $text = _ACTIVATE_REGISTER_TEXT;\r
2115                                 break;\r
2116                         case 'addresschange':\r
2117                                 $title = _ACTIVATE_CHANGE_TITLE;\r
2118                                 $text = _ACTIVATE_CHANGE_TEXT;\r
2119                                 $bNeedsPasswordChange = false;\r
2120                                 MEMBER::activate($key);\r
2121                                 break;\r
2122                 }\r
2123 \r
2124                 $aVars = array(\r
2125                         'memberName' => htmlspecialchars($mem->getDisplayName())\r
2126                 );\r
2127                 $title = TEMPLATE::fill($title, $aVars);\r
2128                 $text = TEMPLATE::fill($text, $aVars);\r
2129 \r
2130                 $this->pagehead();\r
2131 \r
2132                         echo '<h2>' , $title, '</h2>';\r
2133                         echo '<p>' , $text, '</p>';\r
2134 \r
2135                         if ($message != '')\r
2136                         {\r
2137                                 echo '<p class="error">',$message,'</p>';\r
2138                         }\r
2139 \r
2140                         if ($bNeedsPasswordChange)\r
2141                         {\r
2142                                 ?>\r
2143                                         <div><form action="index.php" method="post">\r
2144 \r
2145                                                 <input type="hidden" name="action" value="activatesetpwd" />\r
2146                                                 <?php $manager->addTicketHidden() ?>\r
2147                                                 <input type="hidden" name="key" value="<?php echo htmlspecialchars($key) ?>" />\r
2148 \r
2149                                                 <table><tr>\r
2150                                                         <td><?php echo _MEMBERS_PWD?></td>\r
2151                                                         <td><input type="password" maxlength="40" size="16" name="password" /></td>\r
2152                                                 </tr><tr>\r
2153                                                         <td><?php echo _MEMBERS_REPPWD?></td>\r
2154                                                         <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>\r
2155                                                 <?php\r
2156 \r
2157                                                         global $manager;\r
2158                                                         $param = array(\r
2159                                                                 'type'          => 'activation',\r
2160                                                                 'member'        => $mem\r
2161                                                         );\r
2162                                                         $manager->notify('FormExtra', $param);\r
2163 \r
2164                                                 ?>\r
2165                                                 </tr><tr>\r
2166                                                         <td><?php echo _MEMBERS_SETPWD ?></td>\r
2167                                                         <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>\r
2168                                                 </tr></table>\r
2169 \r
2170 \r
2171                                         </form></div>\r
2172 \r
2173                                 <?php\r
2174 \r
2175                         }\r
2176 \r
2177                 $this->pagefoot();\r
2178 \r
2179         }\r
2180 \r
2181         /**\r
2182          * Account activation - set password part\r
2183          *\r
2184          * @author dekarma\r
2185          */\r
2186         function action_activatesetpwd() {\r
2187                 \r
2188                 $key = postVar('key');\r
2189 \r
2190                 // clean up old activation keys\r
2191                 MEMBER::cleanupActivationTable();\r
2192 \r
2193                 // get activation info\r
2194                 $info = MEMBER::getActivationInfo($key);\r
2195 \r
2196                 if (!$info || ($info->type == 'addresschange'))\r
2197                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);\r
2198 \r
2199                 $mem = MEMBER::createFromId($info->vmember);\r
2200 \r
2201                 if (!$mem)\r
2202                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);\r
2203 \r
2204                 $password          = postVar('password');\r
2205                 $repeatpassword = postVar('repeatpassword');\r
2206 \r
2207                 if (!$password) {
2208                         return $this->_showActivationPage($key, _ERROR_PASSWORDMISSING);\r
2209                 }\r
2210                 \r
2211                 if ($password != $repeatpassword) {\r
2212                         return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
2213                 }\r
2214                 \r
2215                 if (strlen($password) < 6) {\r
2216                         return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
2217                 }\r
2218                 \r
2219                 $pwdvalid = true;\r
2220                 $pwderror = '';\r
2221                 \r
2222                 global $manager;\r
2223                 $param = array(\r
2224                         'password'              =>  $password,\r
2225                         'errormessage'  =>  &$pwderror,\r
2226                         'valid'                 => &$pwdvalid\r
2227                 );\r
2228                 $manager->notify('PrePasswordSet', $param);\r
2229                 \r
2230                 if (!$pwdvalid) {\r
2231                         return $this->_showActivationPage($key,$pwderror);\r
2232                 }\r
2233                 \r
2234                 $error = '';\r
2235                 $param = array(\r
2236                         'type'          =>  'activation',\r
2237                         'member'        =>  $mem,\r
2238                         'error'         => &$error\r
2239                 );\r
2240                 $manager->notify('ValidateForm', $param);\r
2241                 if ($error != '')\r
2242                         return $this->_showActivationPage($key, $error);\r
2243 \r
2244 \r
2245                 // set password\r
2246                 $mem->setPassword($password);\r
2247                 $mem->write();\r
2248 \r
2249                 // do the activation\r
2250                 MEMBER::activate($key);\r
2251 \r
2252                 $this->pagehead();\r
2253                         echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';\r
2254                         echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';\r
2255                 $this->pagefoot();\r
2256         }\r
2257 \r
2258         /**\r
2259          * Manage team\r
2260          */\r
2261         function action_manageteam() {\r
2262                 global $member, $manager;\r
2263 \r
2264                 $blogid = intRequestVar('blogid');\r
2265 \r
2266                 // check if allowed\r
2267                 $member->blogAdminRights($blogid) or $this->disallow();\r
2268 \r
2269                 $this->pagehead();\r
2270 \r
2271                 echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";\r
2272 \r
2273                 echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';\r
2274 \r
2275                 echo '<h3>' . _TEAM_CURRENT . '</h3>';\r
2276 \r
2277 \r
2278 \r
2279                 $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'\r
2280                            . ' FROM '.sql_table('member').', '.sql_table('team')\r
2281                            . ' WHERE tmember=mnumber and tblog=' . $blogid;\r
2282 \r
2283                 $template['content'] = 'teamlist';\r
2284                 $template['tabindex'] = 10;\r
2285 \r
2286                 $manager->loadClass("ENCAPSULATE");\r
2287                 $batch = new BATCH('team');\r
2288                 $batch->showlist($query, 'table', $template);\r
2289 \r
2290                 ?>\r
2291                         <h3><?php echo _TEAM_ADDNEW?></h3>\r
2292 \r
2293                         <form method='post' action='index.php'><div>\r
2294 \r
2295                         <input type='hidden' name='action' value='teamaddmember' />\r
2296                         <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />\r
2297                         <?php $manager->addTicketHidden() ?>\r
2298 \r
2299                         <table><tr>\r
2300                                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>\r
2301                                 <td><?php                                  // TODO: try to make it so only non-team-members are listed\r
2302                                         $query =  'SELECT mname as text, mnumber as value'\r
2303                                                    . ' FROM '.sql_table('member');\r
2304 \r
2305                                         $template['name'] = 'memberid';\r
2306                                         $template['tabindex'] = 10000;\r
2307                                         showlist($query,'select',$template);\r
2308                                 ?></td>\r
2309                         </tr><tr>\r
2310                                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>\r
2311                                 <td><?php $this->input_yesno('admin',0,10020); ?></td>\r
2312                         </tr><tr>\r
2313                                 <td><?php echo _TEAM_ADD?></td>\r
2314                                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>\r
2315                         </tr></table>\r
2316 \r
2317                         </div></form>\r
2318                 <?php\r
2319                 $this->pagefoot();\r
2320         }\r
2321 \r
2322         /**\r
2323          * Add member to team\r
2324          */\r
2325         function action_teamaddmember() {\r
2326                 global $member, $manager;\r
2327 \r
2328                 $memberid = intPostVar('memberid');\r
2329                 $blogid = intPostVar('blogid');\r
2330                 $admin = intPostVar('admin');\r
2331 \r
2332                 // check if allowed\r
2333                 $member->blogAdminRights($blogid) or $this->disallow();\r
2334 \r
2335                 $blog =& $manager->getBlog($blogid);\r
2336                 if (!$blog->addTeamMember($memberid, $admin))\r
2337                         $this->error(_ERROR_ALREADYONTEAM);\r
2338 \r
2339                 $this->action_manageteam();\r
2340 \r
2341         }\r
2342 \r
2343         /**\r
2344          * @todo document this\r
2345          */\r
2346         function action_teamdelete() {\r
2347                 global $member, $manager;\r
2348 \r
2349                 $memberid = intRequestVar('memberid');\r
2350                 $blogid = intRequestVar('blogid');\r
2351 \r
2352                 // check if allowed\r
2353                 $member->blogAdminRights($blogid) or $this->disallow();\r
2354 \r
2355                 $teammem = MEMBER::createFromID($memberid);\r
2356                 $blog =& $manager->getBlog($blogid);\r
2357 \r
2358                 $this->pagehead();\r
2359                 ?>\r
2360                         <h2><?php echo _DELETE_CONFIRM?></h2>\r
2361 \r
2362                         <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  htmlspecialchars($teammem->getDisplayName()) ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  htmlspecialchars(strip_tags($blog->getName())) ?></b>\r
2363                         </p>\r
2364 \r
2365 \r
2366                         <form method="post" action="index.php"><div>\r
2367                         <input type="hidden" name="action" value="teamdeleteconfirm" />\r
2368                         <?php $manager->addTicketHidden() ?>\r
2369                         <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />\r
2370                         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />\r
2371                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
2372                         </div></form>\r
2373                 <?php\r
2374                 $this->pagefoot();\r
2375         }\r
2376 \r
2377         /**\r
2378          * @todo document this\r
2379          */\r
2380         function action_teamdeleteconfirm() {\r
2381                 global $member;\r
2382 \r
2383                 $memberid = intRequestVar('memberid');\r
2384                 $blogid = intRequestVar('blogid');\r
2385 \r
2386                 $error = $this->deleteOneTeamMember($blogid, $memberid);\r
2387                 if ($error)\r
2388                         $this->error($error);\r
2389 \r
2390 \r
2391                 $this->action_manageteam();\r
2392         }\r
2393 \r
2394         /**\r
2395          * @todo document this\r
2396          */\r
2397         function deleteOneTeamMember($blogid, $memberid) {\r
2398                 global $member, $manager;\r
2399 \r
2400                 $blogid = intval($blogid);\r
2401                 $memberid = intval($memberid);\r
2402 \r
2403                 // check if allowed\r
2404                 if (!$member->blogAdminRights($blogid))\r
2405                         return _ERROR_DISALLOWED;\r
2406 \r
2407                 // check if: - there remains at least one blog admin\r
2408                 //                 - (there remains at least one team member)\r
2409                 $tmem = MEMBER::createFromID($memberid);\r
2410 \r
2411                 $param = array(\r
2412                         'member' => &$tmem,\r
2413                         'blogid' =>  $blogid\r
2414                 );\r
2415                 $manager->notify('PreDeleteTeamMember', $param);\r
2416 \r
2417                 if ($tmem->isBlogAdmin($blogid)) {\r
2418                         // check if there are more blog members left and at least one admin\r
2419                         // (check for at least two admins before deletion)\r
2420                         $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';\r
2421                         $r = sql_query($query);\r
2422                         if (sql_num_rows($r) < 2)\r
2423                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
2424                 }\r
2425 \r
2426                 $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";\r
2427                 sql_query($query);\r
2428 \r
2429                 $param = array(\r
2430                         'member' => &$tmem,\r
2431                         'blogid' =>  $blogid\r
2432                 );\r
2433                 $manager->notify('PostDeleteTeamMember', $param);\r
2434 \r
2435                 return '';\r
2436         }\r
2437 \r
2438         /**\r
2439          * @todo document this\r
2440          */\r
2441         function action_teamchangeadmin() {\r
2442                 global $member;\r
2443 \r
2444                 $blogid = intRequestVar('blogid');\r
2445                 $memberid = intRequestVar('memberid');\r
2446 \r
2447                 // check if allowed\r
2448                 $member->blogAdminRights($blogid) or $this->disallow();\r
2449 \r
2450                 $mem = MEMBER::createFromID($memberid);\r
2451 \r
2452                 // don't allow when there is only one admin at this moment\r
2453                 if ($mem->isBlogAdmin($blogid)) {\r
2454                         $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");\r
2455                         if (sql_num_rows($r) == 1)\r
2456                                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);\r
2457                 }\r
2458 \r
2459                 if ($mem->isBlogAdmin($blogid))\r
2460                         $newval = 0;\r
2461                 else\r
2462                         $newval = 1;\r
2463 \r
2464                 $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";\r
2465                 sql_query($query);\r
2466 \r
2467                 // only show manageteam if member did not change its own admin privileges\r
2468                 if ($member->isBlogAdmin($blogid))\r
2469                         $this->action_manageteam();\r
2470                 else\r
2471                         $this->action_overview(_MSG_ADMINCHANGED);\r
2472         }\r
2473 \r
2474         /**\r
2475          * @todo document this\r
2476          */\r
2477         function action_blogsettings() {\r
2478                 global $member, $manager;\r
2479 \r
2480                 $blogid = intRequestVar('blogid');\r
2481 \r
2482                 // check if allowed\r
2483                 $member->blogAdminRights($blogid) or $this->disallow();\r
2484 \r
2485                 $blog =& $manager->getBlog($blogid);\r
2486 \r
2487                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2488                 $this->pagehead($extrahead);\r
2489 \r
2490                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
2491                 ?>\r
2492                 <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>\r
2493 \r
2494                 <h3><?php echo _EBLOG_TEAM_TITLE?></h3>\r
2495 \r
2496                 <p><?php echo _EBLOG_CURRENT_TEAM_MEMBER; ?>\r
2497                 <?php\r
2498                         $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));\r
2499                         $aMemberNames = array();\r
2500                         while ($o = sql_fetch_object($res))\r
2501                                 array_push($aMemberNames, htmlspecialchars($o->mname) . ' (' . htmlspecialchars($o->mrealname). ')');\r
2502                         echo implode(',', $aMemberNames);\r
2503                 ?>\r
2504                 </p>\r
2505 \r
2506 \r
2507 \r
2508                 <p>\r
2509                 <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>\r
2510                 </p>\r
2511 \r
2512                 <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>\r
2513 \r
2514                 <form method="post" action="index.php"><div>\r
2515 \r
2516                 <input type="hidden" name="action" value="blogsettingsupdate" />\r
2517                 <?php $manager->addTicketHidden() ?>\r
2518                 <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />\r
2519                 <table><tr>\r
2520                         <td><?php echo _EBLOG_NAME?></td>\r
2521                         <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  htmlspecialchars($blog->getName()) ?>" /></td>\r
2522                 </tr><tr>\r
2523                         <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>\r
2524                                 <?php echo _EBLOG_SHORTNAME_EXTRA?>\r
2525                         </td>\r
2526                         <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  htmlspecialchars($blog->getShortName()) ?>" /></td>\r
2527                 </tr><tr>\r
2528                         <td><?php echo _EBLOG_DESC?></td>\r
2529                         <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  htmlspecialchars($blog->getDescription()) ?>" /></td>\r
2530                 </tr><tr>\r
2531                         <td><?php echo _EBLOG_URL?></td>\r
2532                         <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  htmlspecialchars($blog->getURL()) ?>" /></td>\r
2533                 </tr><tr>\r
2534                         <td><?php echo _EBLOG_DEFSKIN?>\r
2535                                 <?php help('blogdefaultskin'); ?>\r
2536                         </td>\r
2537                         <td>\r
2538                                 <?php\r
2539                                         $query =  'SELECT sdname as text, sdnumber as value'\r
2540                                                    . ' FROM '.sql_table('skin_desc');\r
2541                                         $template['name'] = 'defskin';\r
2542                                         $template['selected'] = $blog->getDefaultSkin();\r
2543                                         $template['tabindex'] = 50;\r
2544                                         showlist($query,'select',$template);\r
2545                                 ?>\r
2546 \r
2547                         </td>\r
2548                 </tr><tr>\r
2549                         <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>\r
2550                         </td>\r
2551                         <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>\r
2552                 </tr><tr>\r
2553                         <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>\r
2554                         </td>\r
2555                         <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>\r
2556                 </tr><tr>\r
2557                         <td><?php echo _EBLOG_DISABLECOMMENTS?>\r
2558                         </td>\r
2559                         <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>\r
2560                 </tr><tr>\r
2561                         <td><?php echo _EBLOG_ANONYMOUS?>\r
2562                         </td>\r
2563                         <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>\r
2564                 </tr><tr>\r
2565         <td><?php echo _EBLOG_REQUIREDEMAIL?>\r
2566                  </td>\r
2567                  <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>\r
2568           </tr><tr>\r
2569                         <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>\r
2570                         <td><input name="notify" tabindex="80" maxlength="128" size="40" value="<?php echo  htmlspecialchars($blog->getNotifyAddress()); ?>" /></td>\r
2571                 </tr><tr>\r
2572                         <td><?php echo _EBLOG_NOTIFY_ON?></td>\r
2573                         <td>\r
2574                                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"\r
2575                                         <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>\r
2576                                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>\r
2577                                 <br />\r
2578                                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"\r
2579                                         <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>\r
2580                                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>\r
2581                                 <br />\r
2582                                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"\r
2583                                         <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>\r
2584                                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>\r
2585                         </td>\r
2586                 </tr><tr>\r
2587                         <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>\r
2588                         <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  htmlspecialchars($blog->getMaxComments()); ?>" /></td>\r
2589                 </tr><tr>\r
2590                         <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>\r
2591                         <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  htmlspecialchars($blog->getUpdateFile()) ?>" /></td>\r