utf8/nucleus/libs/ADMIN.php

   1 <?php\r
   2 /*\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2009 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2009 The Nucleus Group\r
  17  * @version $Id$\r
  18  * @version $NucleusJP: ADMIN.php,v 1.21.2.4 2007/10/30 19:04:24 kmorimatsu Exp $\r
  19  */\r
  20 \r
  21 if ( !function_exists('requestVar') ) exit;\r
  22 require_once dirname(__FILE__) . '/showlist.php';\r
  23 \r
  24 /**\r
  25  * Builds the admin area and executes admin actions\r
  26  */\r
  27 class ADMIN {\r
  28 \r
  29         /**\r
  30          * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)\r
  31          */\r
  32         var $action;\r
  33 \r
  34         /**\r
  35          * Class constructor\r
  36          */\r
  37         function ADMIN() {\r
  38 \r
  39         }\r
  40 \r
  41         /**\r
  42          * Executes an action\r
  43          *\r
  44          * @param string $action action to be performed\r
  45          */\r
  46         function action($action) {\r
  47                 global $CONF, $manager;\r
  48 \r
  49                 // list of action aliases\r
  50                 $alias = array(\r
  51                         'login' => 'overview',\r
  52                         '' => 'overview'\r
  53                 );\r
  54 \r
  55                 if (isset($alias[$action]))\r
  56                         $action = $alias[$action];\r
  57 \r
  58                 $methodName = 'action_' . $action;\r
  59 \r
  60                 $this->action = strtolower($action);\r
  61 \r
  62                 // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action\r
  63                 // is an action that requires user interaction before something is actually done)\r
  64                 // all safe actions are in this array:\r
  65                 $aActionsNotToCheck = array(\r
  66                         'showlogin',\r
  67                         'login',\r
  68                         'overview',\r
  69                         'itemlist',\r
  70                         'blogcommentlist',\r
  71                         'bookmarklet',\r
  72                         'blogsettings',\r
  73                         'banlist',\r
  74                         'deleteblog',\r
  75                         'editmembersettings',\r
  76                         'browseownitems',\r
  77                         'browseowncomments',\r
  78                         'createitem',\r
  79                         'itemedit',\r
  80                         'itemmove',\r
  81                         'categoryedit',\r
  82                         'categorydelete',\r
  83                         'manage',\r
  84                         'actionlog',\r
  85                         'settingsedit',\r
  86                         'backupoverview',\r
  87                         'pluginlist',\r
  88                         'createnewlog',\r
  89                         'usermanagement',\r
  90                         'skinoverview',\r
  91                         'templateoverview',\r
  92                         'skinieoverview',\r
  93                         'itemcommentlist',\r
  94                         'commentedit',\r
  95                         'commentdelete',\r
  96                         'banlistnewfromitem',\r
  97                         'banlistdelete',\r
  98                         'itemdelete',\r
  99                         'manageteam',\r
 100                         'teamdelete',\r
 101                         'banlistnew',\r
 102                         'memberedit',\r
 103                         'memberdelete',\r
 104                         'pluginhelp',\r
 105                         'pluginoptions',\r
 106                         'plugindelete',\r
 107                         'skinedittype',\r
 108                         'skinremovetype',\r
 109                         'skindelete',\r
 110                         'skinedit',\r
 111                         'templateedit',\r
 112                         'templatedelete',\r
 113                         'activate',\r
 114                         'systemoverview'\r
 115                 );\r
 116 /*\r
 117                 // the rest of the actions needs to be checked\r
 118                 $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'sendping', 'rawping', 'activatesetpwd');\r
 119 */\r
 120                 if (!in_array($this->action, $aActionsNotToCheck))\r
 121                 {\r
 122                         if (!$manager->checkTicket())\r
 123                                 $this->error(_ERROR_BADTICKET);\r
 124                 }\r
 125 \r
 126                 if (method_exists($this, $methodName))\r
 127                         call_user_func(array(&$this, $methodName));\r
 128                 else\r
 129                         $this->error(_BADACTION . htmlspecialchars(" ($action)"));\r
 130 \r
 131         }\r
 132 \r
 133         /**\r
 134          * @todo document this\r
 135          */\r
 136         function action_showlogin() {\r
 137                 global $error;\r
 138                 $this->action_login($error);\r
 139         }\r
 140 \r
 141         /**\r
 142          * @todo document this\r
 143          */\r
 144         function action_login($msg = '', $passvars = 1) {\r
 145                 global $member;\r
 146 \r
 147                 // skip to overview when allowed\r
 148                 if ($member->isLoggedIn() && $member->canLogin()) {\r
 149                         $this->action_overview();\r
 150                         exit;\r
 151                 }\r
 152 \r
 153                 $this->pagehead();\r
 154 \r
 155                 echo '<h2>', _LOGIN ,'</h2>';\r
 156                 if ($msg) echo _MESSAGE , ': ', htmlspecialchars($msg);\r
 157                 ?>\r
 158 \r
 159                 <form action="index.php" method="post"><p>\r
 160                 <?php echo _LOGIN_NAME; ?> <br /><input name="login"  tabindex="10" />\r
 161                 <br />\r
 162                 <?php echo _LOGIN_PASSWORD; ?> <br /><input name="password"  tabindex="20" type="password" />\r
 163                 <br />\r
 164                 <input name="action" value="login" type="hidden" />\r
 165                 <br />\r
 166                 <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />\r
 167                 <br />\r
 168                 <small>\r
 169                         <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>\r
 170                         <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>\r
 171                 </small>\r
 172                 <?php                   // pass through vars\r
 173 \r
 174                         $oldaction = postVar('oldaction');\r
 175                         if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {\r
 176                                 passRequestVars();\r
 177                         }\r
 178 \r
 179 \r
 180                 ?>\r
 181                 </p></form>\r
 182                 <?php           $this->pagefoot();\r
 183         }\r
 184 \r
 185 \r
 186         /**\r
 187          * provides a screen with the overview of the actions available\r
 188          * @todo document parameter\r
 189          */\r
 190         function action_overview($msg = '') {\r
 191                 global $member;\r
 192 \r
 193                 $this->pagehead();\r
 194 \r
 195                 if ($msg)\r
 196                         echo _MESSAGE , ': ', $msg;\r
 197 \r
 198                 /* ---- add items ---- */\r
 199                 echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';\r
 200 \r
 201                 $showAll = requestVar('showall');\r
 202 \r
 203                 if (($member->isAdmin()) && ($showAll == 'yes')) {\r
 204                         // Super-Admins have access to all blogs! (no add item support though)\r
 205                         $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'\r
 206                                    . ' FROM ' . sql_table('blog')\r
 207                                    . ' ORDER BY bname';\r
 208                 } else {\r
 209                         $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'\r
 210                                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')\r
 211                                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()\r
 212                                    . ' ORDER BY bname';\r
 213                 }\r
 214                 $template['content'] = 'bloglist';\r
 215                 $template['superadmin'] = $member->isAdmin();\r
 216                 $amount = showlist($query,'table',$template);\r
 217 \r
 218                 if (($showAll != 'yes') && ($member->isAdmin())) {\r
 219                         $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));\r
 220                         if ($total > $amount)\r
 221                                 echo '<p><a href="index.php?action=overview&amp;showall=yes">' . _OVERVIEW_SHOWALL . '</a></p>';\r
 222                 }\r
 223 \r
 224                 if ($amount == 0)\r
 225                         echo _OVERVIEW_NOBLOGS;\r
 226 \r
 227                 if ($amount != 0) {\r
 228                         echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';\r
 229                         $query =  'SELECT ititle, inumber, bshortname'\r
 230                                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')\r
 231                                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';\r
 232                         $template['content'] = 'draftlist';\r
 233                         $amountdrafts = showlist($query, 'table', $template);\r
 234                         if ($amountdrafts == 0)\r
 235                                 echo _OVERVIEW_NODRAFTS;\r
 236                 }\r
 237 \r
 238                 /* ---- user settings ---- */\r
 239                 echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';\r
 240                 echo '<ul>';\r
 241                 echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';\r
 242                 echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';\r
 243                 echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';\r
 244                 echo '</ul>';\r
 245 \r
 246                 /* ---- general settings ---- */\r
 247                 if ($member->isAdmin()) {\r
 248                         echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';\r
 249                         echo '<ul>';\r
 250                         echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';\r
 251                         echo '</ul>';\r
 252                 }\r
 253 \r
 254 \r
 255                 $this->pagefoot();\r
 256         }\r
 257 \r
 258         /**\r
 259          * Returns a link to a weblog\r
 260          * @param object BLOG\r
 261          */\r
 262         function bloglink(&$blog) {\r
 263                 return '<a href="'.htmlspecialchars($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. htmlspecialchars( $blog->getName() ) .'</a>';\r
 264         }\r
 265 \r
 266         /**\r
 267          * @todo document this\r
 268          */\r
 269         function action_manage($msg = '') {\r
 270                 global $member;\r
 271 \r
 272                 $member->isAdmin() or $this->disallow();\r
 273 \r
 274                 $this->pagehead();\r
 275 \r
 276                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
 277 \r
 278                 if ($msg)\r
 279                         echo '<p>' , _MESSAGE , ': ', $msg , '</p>';\r
 280 \r
 281 \r
 282                 echo '<h2>' . _MANAGE_GENERAL. '</h2>';\r
 283 \r
 284                 echo '<ul>';\r
 285                 echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';\r
 286                 echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';\r
 287                 echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';\r
 288                 echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';\r
 289                 echo '</ul>';\r
 290 \r
 291                 echo '<h2>' . _MANAGE_SKINS . '</h2>';\r
 292                 echo '<ul>';\r
 293                 echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';\r
 294                 echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';\r
 295                 echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';\r
 296                 echo '</ul>';\r
 297 \r
 298                 echo '<h2>' . _MANAGE_EXTRA . '</h2>';\r
 299                 echo '<ul>';\r
 300                 echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';\r
 301                 echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';\r
 302                 echo '</ul>';\r
 303 \r
 304                 $this->pagefoot();\r
 305         }\r
 306 \r
 307         /**\r
 308          * @todo document this\r
 309          */\r
 310         function action_itemlist($blogid = '') {\r
 311                 global $member, $manager, $CONF;\r
 312 \r
 313                 if ($blogid == '')\r
 314                         $blogid = intRequestVar('blogid');\r
 315 \r
 316                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();\r
 317 \r
 318                 $this->pagehead();\r
 319                 $blog =& $manager->getBlog($blogid);\r
 320 \r
 321                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
 322                 echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';\r
 323 \r
 324                 // start index\r
 325                 if (postVar('start'))\r
 326                         $start = intPostVar('start');\r
 327                 else\r
 328                         $start = 0;\r
 329 \r
 330                 if ($start == 0)\r
 331                         echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';\r
 332 \r
 333                 // amount of items to show\r
 334                 if (postVar('amount'))\r
 335                         $amount = intPostVar('amount');\r
 336                 else {\r
 337                         $amount = intval($CONF['DefaultListSize']);\r
 338                         if ($amount < 1)\r
 339                                 $amount = 10;\r
 340                 }\r
 341 \r
 342                 $search = postVar('search');    // search through items\r
 343 \r
 344                 $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'\r
 345                            . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')\r
 346                            . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;\r
 347 \r
 348                 if ($search)\r
 349                         $query .= ' and ((ititle LIKE "%' . addslashes($search) . '%") or (ibody LIKE "%' . addslashes($search) . '%") or (imore LIKE "%' . addslashes($search) . '%"))';\r
 350 \r
 351                 // non-blog-admins can only edit/delete their own items\r
 352                 if (!$member->blogAdminRights($blogid))\r
 353                         $query .= ' and iauthor=' . $member->getID();\r
 354 \r
 355 \r
 356                 $query .= ' ORDER BY itime DESC'\r
 357                                 . " LIMIT $start,$amount";\r
 358 \r
 359                 $template['content'] = 'itemlist';\r
 360                 $template['now'] = $blog->getCorrectTime(time());\r
 361 \r
 362                 $manager->loadClass("ENCAPSULATE");\r
 363                 $navList =& new NAVLIST('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);\r
 364                 $navList->showBatchList('item',$query,'table',$template);\r
 365 \r
 366 \r
 367                 $this->pagefoot();\r
 368         }\r
 369 \r
 370         /**\r
 371          * @todo document this\r
 372          */\r
 373         function action_batchitem() {\r
 374                 global $member, $manager;\r
 375 \r
 376                 // check if logged in\r
 377                 $member->isLoggedIn() or $this->disallow();\r
 378 \r
 379                 // more precise check will be done for each performed operation\r
 380 \r
 381                 // get array of itemids from request\r
 382                 $selected = requestIntArray('batch');\r
 383                 $action = requestVar('batchaction');\r
 384 \r
 385                 // Show error when no items were selected\r
 386                 if (!is_array($selected) || sizeof($selected) == 0)\r
 387                         $this->error(_BATCH_NOSELECTION);\r
 388 \r
 389                 // On move: when no destination blog/category chosen, show choice now\r
 390                 $destCatid = intRequestVar('destcatid');\r
 391                 if (($action == 'move') && (!$manager->existsCategory($destCatid)))\r
 392                         $this->batchMoveSelectDestination('item',$selected);\r
 393 \r
 394                 // On delete: check if confirmation has been given\r
 395                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))\r
 396                         $this->batchAskDeleteConfirmation('item',$selected);\r
 397 \r
 398                 $this->pagehead();\r
 399 \r
 400                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';\r
 401                 echo '<h2>',_BATCH_ITEMS,'</h2>';\r
 402                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';\r
 403                 echo '<ul>';\r
 404 \r
 405 \r
 406                 // walk over all itemids and perform action\r
 407                 foreach ($selected as $itemid) {\r
 408                         $itemid = intval($itemid);\r
 409                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';\r
 410 \r
 411                         // perform action, display errors if needed\r
 412                         switch($action) {\r
 413                                 case 'delete':\r
 414                                         $error = $this->deleteOneItem($itemid);\r
 415                                         break;\r
 416                                 case 'move':\r
 417                                         $error = $this->moveOneItem($itemid, $destCatid);\r
 418                                         break;\r
 419                                 default:\r
 420                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);\r
 421                         }\r
 422 \r
 423                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';\r
 424                         echo '</li>';\r
 425                 }\r
 426 \r
 427                 echo '</ul>';\r
 428                 echo '<b>',_BATCH_DONE,'</b>';\r
 429 \r
 430                 $this->pagefoot();\r
 431 \r
 432 \r
 433         }\r
 434 \r
 435         /**\r
 436          * @todo document this\r
 437          */\r
 438         function action_batchcomment() {\r
 439                 global $member;\r
 440 \r
 441                 // check if logged in\r
 442                 $member->isLoggedIn() or $this->disallow();\r
 443 \r
 444                 // more precise check will be done for each performed operation\r
 445 \r
 446                 // get array of itemids from request\r
 447                 $selected = requestIntArray('batch');\r
 448                 $action = requestVar('batchaction');\r
 449 \r
 450                 // Show error when no items were selected\r
 451                 if (!is_array($selected) || sizeof($selected) == 0)\r
 452                         $this->error(_BATCH_NOSELECTION);\r
 453 \r
 454                 // On delete: check if confirmation has been given\r
 455                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))\r
 456                         $this->batchAskDeleteConfirmation('comment',$selected);\r
 457 \r
 458                 $this->pagehead();\r
 459 \r
 460                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';\r
 461                 echo '<h2>',_BATCH_COMMENTS,'</h2>';\r
 462                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';\r
 463                 echo '<ul>';\r
 464 \r
 465                 // walk over all itemids and perform action\r
 466                 foreach ($selected as $commentid) {\r
 467                         $commentid = intval($commentid);\r
 468                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';\r
 469 \r
 470                         // perform action, display errors if needed\r
 471                         switch($action) {\r
 472                                 case 'delete':\r
 473                                         $error = $this->deleteOneComment($commentid);\r
 474                                         break;\r
 475                                 default:\r
 476                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);\r
 477                         }\r
 478 \r
 479                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';\r
 480                         echo '</li>';\r
 481                 }\r
 482 \r
 483                 echo '</ul>';\r
 484                 echo '<b>',_BATCH_DONE,'</b>';\r
 485 \r
 486                 $this->pagefoot();\r
 487 \r
 488 \r
 489         }\r
 490 \r
 491         /**\r
 492          * @todo document this\r
 493          */\r
 494         function action_batchmember() {\r
 495                 global $member;\r
 496 \r
 497                 // check if logged in and admin\r
 498                 ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();\r
 499 \r
 500                 // get array of itemids from request\r
 501                 $selected = requestIntArray('batch');\r
 502                 $action = requestVar('batchaction');\r
 503 \r
 504                 // Show error when no members selected\r
 505                 if (!is_array($selected) || sizeof($selected) == 0)\r
 506                         $this->error(_BATCH_NOSELECTION);\r
 507 \r
 508                 // On delete: check if confirmation has been given\r
 509                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))\r
 510                         $this->batchAskDeleteConfirmation('member',$selected);\r
 511 \r
 512                 $this->pagehead();\r
 513 \r
 514                 echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';\r
 515                 echo '<h2>',_BATCH_MEMBERS,'</h2>';\r
 516                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';\r
 517                 echo '<ul>';\r
 518 \r
 519                 // walk over all itemids and perform action\r
 520                 foreach ($selected as $memberid) {\r
 521                         $memberid = intval($memberid);\r
 522                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';\r
 523 \r
 524                         // perform action, display errors if needed\r
 525                         switch($action) {\r
 526                                 case 'delete':\r
 527                                         $error = $this->deleteOneMember($memberid);\r
 528                                         break;\r
 529                                 case 'setadmin':\r
 530                                         // always succeeds\r
 531                                         sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);\r
 532                                         $error = '';\r
 533                                         break;\r
 534                                 case 'unsetadmin':\r
 535                                         // there should always remain at least one super-admin\r
 536                                         $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');\r
 537                                         if (mysql_num_rows($r) < 2)\r
 538                                                 $error = _ERROR_ATLEASTONEADMIN;\r
 539                                         else\r
 540                                                 sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);\r
 541                                         break;\r
 542                                 default:\r
 543                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);\r
 544                         }\r
 545 \r
 546                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';\r
 547                         echo '</li>';\r
 548                 }\r
 549 \r
 550                 echo '</ul>';\r
 551                 echo '<b>',_BATCH_DONE,'</b>';\r
 552 \r
 553                 $this->pagefoot();\r
 554 \r
 555 \r
 556         }\r
 557 \r
 558         /**\r
 559          * @todo document this\r
 560          */\r
 561         function action_batchteam() {\r
 562                 global $member;\r
 563 \r
 564                 $blogid = intRequestVar('blogid');\r
 565 \r
 566                 // check if logged in and admin\r
 567                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();\r
 568 \r
 569                 // get array of itemids from request\r
 570                 $selected = requestIntArray('batch');\r
 571                 $action = requestVar('batchaction');\r
 572 \r
 573                 // Show error when no members selected\r
 574                 if (!is_array($selected) || sizeof($selected) == 0)\r
 575                         $this->error(_BATCH_NOSELECTION);\r
 576 \r
 577                 // On delete: check if confirmation has been given\r
 578                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))\r
 579                         $this->batchAskDeleteConfirmation('team',$selected);\r
 580 \r
 581                 $this->pagehead();\r
 582 \r
 583                 echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';\r
 584 \r
 585                 echo '<h2>',_BATCH_TEAM,'</h2>';\r
 586                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';\r
 587                 echo '<ul>';\r
 588 \r
 589                 // walk over all itemids and perform action\r
 590                 foreach ($selected as $memberid) {\r
 591                         $memberid = intval($memberid);\r
 592                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';\r
 593 \r
 594                         // perform action, display errors if needed\r
 595                         switch($action) {\r
 596                                 case 'delete':\r
 597                                         $error = $this->deleteOneTeamMember($blogid, $memberid);\r
 598                                         break;\r
 599                                 case 'setadmin':\r
 600                                         // always succeeds\r
 601                                         sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);\r
 602                                         $error = '';\r
 603                                         break;\r
 604                                 case 'unsetadmin':\r
 605                                         // there should always remain at least one admin\r
 606                                         $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);\r
 607                                         if (mysql_num_rows($r) < 2)\r
 608                                                 $error = _ERROR_ATLEASTONEBLOGADMIN;\r
 609                                         else\r
 610                                                 sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);\r
 611                                         break;\r
 612                                 default:\r
 613                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);\r
 614                         }\r
 615 \r
 616                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';\r
 617                         echo '</li>';\r
 618                 }\r
 619 \r
 620                 echo '</ul>';\r
 621                 echo '<b>',_BATCH_DONE,'</b>';\r
 622 \r
 623                 $this->pagefoot();\r
 624 \r
 625 \r
 626         }\r
 627 \r
 628         /**\r
 629          * @todo document this\r
 630          */\r
 631         function action_batchcategory() {\r
 632                 global $member, $manager;\r
 633 \r
 634                 // check if logged in\r
 635                 $member->isLoggedIn() or $this->disallow();\r
 636 \r
 637                 // more precise check will be done for each performed operation\r
 638 \r
 639                 // get array of itemids from request\r
 640                 $selected = requestIntArray('batch');\r
 641                 $action = requestVar('batchaction');\r
 642 \r
 643                 // Show error when no items were selected\r
 644                 if (!is_array($selected) || sizeof($selected) == 0)\r
 645                         $this->error(_BATCH_NOSELECTION);\r
 646 \r
 647                 // On move: when no destination blog chosen, show choice now\r
 648                 $destBlogId = intRequestVar('destblogid');\r
 649                 if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))\r
 650                         $this->batchMoveCategorySelectDestination('category',$selected);\r
 651 \r
 652                 // On delete: check if confirmation has been given\r
 653                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))\r
 654                         $this->batchAskDeleteConfirmation('category',$selected);\r
 655 \r
 656                 $this->pagehead();\r
 657 \r
 658                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';\r
 659                 echo '<h2>',BATCH_CATEGORIES,'</h2>';\r
 660                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';\r
 661                 echo '<ul>';\r
 662 \r
 663                 // walk over all itemids and perform action\r
 664                 foreach ($selected as $catid) {\r
 665                         $catid = intval($catid);\r
 666                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';\r
 667 \r
 668                         // perform action, display errors if needed\r
 669                         switch($action) {\r
 670                                 case 'delete':\r
 671                                         $error = $this->deleteOneCategory($catid);\r
 672                                         break;\r
 673                                 case 'move':\r
 674                                         $error = $this->moveOneCategory($catid, $destBlogId);\r
 675                                         break;\r
 676                                 default:\r
 677                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);\r
 678                         }\r
 679 \r
 680                         echo '<b>',($error ? 'Error: '.$error : _BATCH_SUCCESS),'</b>';\r
 681                         echo '</li>';\r
 682                 }\r
 683 \r
 684                 echo '</ul>';\r
 685                 echo '<b>',_BATCH_DONE,'</b>';\r
 686 \r
 687                 $this->pagefoot();\r
 688 \r
 689         }\r
 690 \r
 691         /**\r
 692          * @todo document this\r
 693          */\r
 694         function batchMoveSelectDestination($type, $ids) {\r
 695                 global $manager;\r
 696                 $this->pagehead();\r
 697                 ?>\r
 698                 <h2><?php echo _MOVE_TITLE?></h2>\r
 699                 <form method="post" action="index.php"><div>\r
 700 \r
 701                         <input type="hidden" name="action" value="batch<?php echo $type?>" />\r
 702                         <input type="hidden" name="batchaction" value="move" />\r
 703                         <?php\r
 704                                 $manager->addTicketHidden();\r
 705 \r
 706                                 // insert selected item numbers\r
 707                                 $idx = 0;\r
 708                                 foreach ($ids as $id)\r
 709                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';\r
 710 \r
 711                                 // show blog/category selection list\r
 712                                 $this->selectBlogCategory('destcatid');\r
 713 \r
 714                         ?>\r
 715 \r
 716 \r
 717                         <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />\r
 718 \r
 719                 </div></form>\r
 720                 <?php           $this->pagefoot();\r
 721                 exit;\r
 722         }\r
 723 \r
 724         /**\r
 725          * @todo document this\r
 726          */\r
 727         function batchMoveCategorySelectDestination($type, $ids) {\r
 728                 global $manager;\r
 729                 $this->pagehead();\r
 730                 ?>\r
 731                 <h2><?php echo _MOVECAT_TITLE?></h2>\r
 732                 <form method="post" action="index.php"><div>\r
 733 \r
 734                         <input type="hidden" name="action" value="batch<?php echo $type?>" />\r
 735                         <input type="hidden" name="batchaction" value="move" />\r
 736                         <?php\r
 737                                 $manager->addTicketHidden();\r
 738 \r
 739                                 // insert selected item numbers\r
 740                                 $idx = 0;\r
 741                                 foreach ($ids as $id)\r
 742                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';\r
 743 \r
 744                                 // show blog/category selection list\r
 745                                 $this->selectBlog('destblogid');\r
 746 \r
 747                         ?>\r
 748 \r
 749 \r
 750                         <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />\r
 751 \r
 752                 </div></form>\r
 753                 <?php           $this->pagefoot();\r
 754                 exit;\r
 755         }\r
 756 \r
 757         /**\r
 758          * @todo document this\r
 759          */\r
 760         function batchAskDeleteConfirmation($type, $ids) {\r
 761                 global $manager;\r
 762 \r
 763                 $this->pagehead();\r
 764                 ?>\r
 765                 <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>\r
 766                 <form method="post" action="index.php"><div>\r
 767 \r
 768                         <input type="hidden" name="action" value="batch<?php echo $type?>" />\r
 769                         <?php $manager->addTicketHidden() ?>\r
 770                         <input type="hidden" name="batchaction" value="delete" />\r
 771                         <input type="hidden" name="confirmation" value="yes" />\r
 772                         <?php                           // insert selected item numbers\r
 773                                 $idx = 0;\r
 774                                 foreach ($ids as $id)\r
 775                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';\r
 776 \r
 777                                 // add hidden vars for team & comment\r
 778                                 if ($type == 'team')\r
 779                                 {\r
 780                                         echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';\r
 781                                 }\r
 782                                 if ($type == 'comment')\r
 783                                 {\r
 784                                         echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';\r
 785                                 }\r
 786 \r
 787                         ?>\r
 788 \r
 789                         <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />\r
 790 \r
 791                 </div></form>\r
 792                 <?php           $this->pagefoot();\r
 793                 exit;\r
 794         }\r
 795 \r
 796 \r
 797         /**\r
 798          * Inserts a HTML select element with choices for all categories to which the current\r
 799          * member has access\r
 800          * @see function selectBlog\r
 801          */\r
 802         function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {\r
 803                 ADMIN::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);\r
 804         }\r
 805 \r
 806         /**\r
 807          * Inserts a HTML select element with choices for all blogs to which the user has access\r
 808          *              mode = 'blog' => shows blognames and values are blogids\r
 809          *              mode = 'category' => show category names and values are catids\r
 810          *\r
 811          * @param $iForcedBlogInclude\r
 812          *              ID of a blog that always needs to be included, without checking if the\r
 813          *              member is on the blog team (-1 = none)\r
 814          * @todo document parameters\r
 815          */\r
 816         function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {\r
 817                 global $member, $CONF;\r
 818 \r
 819                 // 0. get IDs of blogs to which member can post items (+ forced blog)\r
 820                 $aBlogIds = array();\r
 821                 if ($iForcedBlogInclude != -1)\r
 822                         $aBlogIds[] = intval($iForcedBlogInclude);\r
 823 \r
 824                 if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))\r
 825                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';\r
 826                 else\r
 827                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();\r
 828                 $rblogids = sql_query($queryBlogs);\r
 829                 while ($o = mysql_fetch_object($rblogids))\r
 830                         if ($o->bnumber != $iForcedBlogInclude)\r
 831                                 $aBlogIds[] = intval($o->bnumber);\r
 832 \r
 833                 if (count($aBlogIds) == 0)\r
 834                         return;\r
 835 \r
 836                 echo '<select name="',$name,'" tabindex="',$tabindex,'">';\r
 837 \r
 838                 // 1. select blogs (we'll create optiongroups)\r
 839                 // (only select those blogs that have the user on the team)\r
 840                 $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';\r
 841                 $blogs = sql_query($queryBlogs);\r
 842                 if ($mode == 'category') {\r
 843                         if (mysql_num_rows($blogs) > 1)\r
 844                                 $multipleBlogs = 1;\r
 845 \r
 846                         while ($oBlog = mysql_fetch_object($blogs)) {\r
 847                                 if ($multipleBlogs)\r
 848                                         echo '<optgroup label="',htmlspecialchars($oBlog->bname),'">';\r
 849 \r
 850                                 // show selection to create new category when allowed/wanted\r
 851                                 if ($showNewCat) {\r
 852                                         // check if allowed to do so\r
 853                                         if ($member->blogAdminRights($oBlog->bnumber))\r
 854                                                 echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';\r
 855                                 }\r
 856 \r
 857                                 // 2. for each category in that blog\r
 858                                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');\r
 859                                 while ($oCat = mysql_fetch_object($categories)) {\r
 860                                         if ($oCat->catid == $selected)\r
 861                                                 $selectText = ' selected="selected" ';\r
 862                                         else\r
 863                                                 $selectText = '';\r
 864                                         echo '<option value="',$oCat->catid,'" ', $selectText,'>',htmlspecialchars($oCat->cname),'</option>';\r
 865                                 }\r
 866 \r
 867                                 if ($multipleBlogs)\r
 868                                         echo '</optgroup>';\r
 869                         }\r
 870                 } else {\r
 871                         // blog mode\r
 872                         while ($oBlog = mysql_fetch_object($blogs)) {\r
 873                                 echo '<option value="',$oBlog->bnumber,'"';\r
 874                                 if ($oBlog->bnumber == $selected)\r
 875                                         echo ' selected="selected"';\r
 876                                 echo'>',htmlspecialchars($oBlog->bname),'</option>';\r
 877                         }\r
 878                 }\r
 879                 echo '</select>';\r
 880 \r
 881         }\r
 882 \r
 883         /**\r
 884          * @todo document this\r
 885          */\r
 886         function action_browseownitems() {\r
 887                 global $member, $manager, $CONF;\r
 888 \r
 889                 $this->pagehead();\r
 890 \r
 891                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
 892                 echo '<h2>' . _ITEMLIST_YOUR. '</h2>';\r
 893 \r
 894                 // start index\r
 895                 if (postVar('start'))\r
 896                         $start = intPostVar('start');\r
 897                 else\r
 898                         $start = 0;\r
 899 \r
 900                 // amount of items to show\r
 901                 if (postVar('amount'))\r
 902                         $amount = intPostVar('amount');\r
 903                 else {\r
 904                         $amount = intval($CONF['DefaultListSize']);\r
 905                         if ($amount < 1)\r
 906                                 $amount = 10;\r
 907                 }\r
 908 \r
 909                 $search = postVar('search');    // search through items\r
 910 \r
 911                 $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'\r
 912                            . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')\r
 913                            . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';\r
 914 \r
 915                 if ($search)\r
 916                         $query .= ' and ((ititle LIKE "%' . addslashes($search) . '%") or (ibody LIKE "%' . addslashes($search) . '%") or (imore LIKE "%' . addslashes($search) . '%"))';\r
 917 \r
 918                 $query .= ' ORDER BY itime DESC'\r
 919                                 . " LIMIT $start,$amount";\r
 920 \r
 921                 $template['content'] = 'itemlist';\r
 922                 $template['now'] = time();\r
 923 \r
 924                 $manager->loadClass("ENCAPSULATE");\r
 925                 $navList =& new NAVLIST('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);\r
 926                 $navList->showBatchList('item',$query,'table',$template);\r
 927 \r
 928                 $this->pagefoot();\r
 929 \r
 930         }\r
 931 \r
 932         /**\r
 933          * Show all the comments for a given item\r
 934          * @param int $itemid\r
 935          */\r
 936         function action_itemcommentlist($itemid = '') {\r
 937                 global $member, $manager, $CONF;\r
 938 \r
 939                 if ($itemid == '')\r
 940                         $itemid = intRequestVar('itemid');\r
 941 \r
 942                 // only allow if user is allowed to alter item\r
 943                 $member->canAlterItem($itemid) or $this->disallow();\r
 944 \r
 945                 $blogid = getBlogIdFromItemId($itemid);\r
 946 \r
 947                 $this->pagehead();\r
 948 \r
 949                 // start index\r
 950                 if (postVar('start'))\r
 951                         $start = intPostVar('start');\r
 952                 else\r
 953                         $start = 0;\r
 954 \r
 955                 // amount of items to show\r
 956                 if (postVar('amount'))\r
 957                         $amount = intPostVar('amount');\r
 958                 else {\r
 959                         $amount = intval($CONF['DefaultListSize']);\r
 960                         if ($amount < 1)\r
 961                                 $amount = 10;\r
 962                 }\r
 963 \r
 964                 $search = postVar('search');\r
 965 \r
 966                 echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';\r
 967                 echo '<h2>',_COMMENTS,'</h2>';\r
 968 \r
 969                 $query = 'SELECT cbody, cuser, cmail, cemail, mname, ctime, chost, cnumber, cip, citem FROM ' . sql_table('comment') . ' LEFT OUTER JOIN ' . sql_table('member') . ' ON mnumber = cmember WHERE citem = ' . $itemid;\r
 970 \r
 971                 if ($search)\r
 972                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';\r
 973 \r
 974                 $query .= ' ORDER BY ctime ASC'\r
 975                                 . " LIMIT $start,$amount";\r
 976 \r
 977                 $template['content'] = 'commentlist';\r
 978                 $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));\r
 979 \r
 980                 $manager->loadClass("ENCAPSULATE");\r
 981                 $navList =& new NAVLIST('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);\r
 982                 $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);\r
 983 \r
 984                 $this->pagefoot();\r
 985         }\r
 986 \r
 987         /**\r
 988          * Browse own comments\r
 989          */\r
 990         function action_browseowncomments() {\r
 991                 global $member, $manager, $CONF;\r
 992 \r
 993                 // start index\r
 994                 if (postVar('start'))\r
 995                         $start = intPostVar('start');\r
 996                 else\r
 997                         $start = 0;\r
 998 \r
 999                 // amount of items to show\r
1000                 if (postVar('amount'))\r
1001                         $amount = intPostVar('amount');\r
1002                 else {\r
1003                         $amount = intval($CONF['DefaultListSize']);\r
1004                         if ($amount < 1)\r
1005                                 $amount = 10;\r
1006                 }\r
1007 \r
1008                 $search = postVar('search');\r
1009 \r
1010 \r
1011                 $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();\r
1012 \r
1013                 if ($search)\r
1014                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';\r
1015 \r
1016                 $query .= ' ORDER BY ctime DESC'\r
1017                                 . " LIMIT $start,$amount";\r
1018 \r
1019                 $this->pagehead();\r
1020 \r
1021                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
1022                 echo '<h2>', _COMMENTS_YOUR ,'</h2>';\r
1023 \r
1024                 $template['content'] = 'commentlist';\r
1025                 $template['canAddBan'] = 0;     // doesn't make sense to allow banning yourself\r
1026 \r
1027                 $manager->loadClass("ENCAPSULATE");\r
1028                 $navList =& new NAVLIST('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);\r
1029                 $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);\r
1030 \r
1031                 $this->pagefoot();\r
1032         }\r
1033 \r
1034         /**\r
1035          * Browse all comments for a weblog\r
1036          * @param int $blogid\r
1037          */\r
1038         function action_blogcommentlist($blogid = '')\r
1039         {\r
1040                 global $member, $manager, $CONF;\r
1041 \r
1042                 if ($blogid == '')\r
1043                         $blogid = intRequestVar('blogid');\r
1044                 else\r
1045                         $blogid = intval($blogid);\r
1046 \r
1047                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();\r
1048 \r
1049                 // start index\r
1050                 if (postVar('start'))\r
1051                         $start = intPostVar('start');\r
1052                 else\r
1053                         $start = 0;\r
1054 \r
1055                 // amount of items to show\r
1056                 if (postVar('amount'))\r
1057                         $amount = intPostVar('amount');\r
1058                 else {\r
1059                         $amount = intval($CONF['DefaultListSize']);\r
1060                         if ($amount < 1)\r
1061                                 $amount = 10;\r
1062                 }\r
1063 \r
1064                 $search = postVar('search');            // search through comments\r
1065 \r
1066 \r
1067                 $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);\r
1068 \r
1069                 if ($search != '')\r
1070                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';\r
1071 \r
1072 \r
1073                 $query .= ' ORDER BY ctime DESC'\r
1074                                 . " LIMIT $start,$amount";\r
1075 \r
1076 \r
1077                 $blog =& $manager->getBlog($blogid);\r
1078 \r
1079                 $this->pagehead();\r
1080 \r
1081                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
1082                 echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';\r
1083 \r
1084                 $template['content'] = 'commentlist';\r
1085                 $template['canAddBan'] = $member->blogAdminRights($blogid);\r
1086 \r
1087                 $manager->loadClass("ENCAPSULATE");\r
1088                 $navList =& new NAVLIST('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);\r
1089                 $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);\r
1090 \r
1091                 $this->pagefoot();\r
1092         }\r
1093 \r
1094         /**\r
1095          * Provide a page to item a new item to the given blog\r
1096          */\r
1097         function action_createitem() {\r
1098                 global $member, $manager;\r
1099 \r
1100                 $blogid = intRequestVar('blogid');\r
1101 \r
1102                 // check if allowed\r
1103                 $member->teamRights($blogid) or $this->disallow();\r
1104 \r
1105                 $memberid = $member->getID();\r
1106 \r
1107                 $blog =& $manager->getBlog($blogid);\r
1108 \r
1109                 $this->pagehead();\r
1110 \r
1111                 // generate the add-item form\r
1112                 $formfactory =& new PAGEFACTORY($blogid);\r
1113                 $formfactory->createAddForm('admin');\r
1114 \r
1115                 $this->pagefoot();\r
1116         }\r
1117 \r
1118         /**\r
1119          * @todo document this\r
1120          */\r
1121         function action_itemedit() {\r
1122                 global $member, $manager;\r
1123 \r
1124                 $itemid = intRequestVar('itemid');\r
1125 \r
1126                 // only allow if user is allowed to alter item\r
1127                 $member->canAlterItem($itemid) or $this->disallow();\r
1128 \r
1129                 $item =& $manager->getItem($itemid,1,1);\r
1130                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));\r
1131 \r
1132                 $manager->notify('PrepareItemForEdit', array('item' => &$item));\r
1133 \r
1134                 if ($blog->convertBreaks()) {\r
1135                         $item['body'] = removeBreaks($item['body']);\r
1136                         $item['more'] = removeBreaks($item['more']);\r
1137                 }\r
1138 \r
1139                 // form to edit blog items\r
1140                 $this->pagehead();\r
1141                 $formfactory =& new PAGEFACTORY($blog->getID());\r
1142                 $formfactory->createEditForm('admin',$item);\r
1143                 $this->pagefoot();\r
1144         }\r
1145 \r
1146         /**\r
1147          * @todo document this\r
1148          */\r
1149         function action_itemupdate() {\r
1150                 global $member, $manager, $CONF;\r
1151 \r
1152                 $itemid = intRequestVar('itemid');\r
1153                 $catid = postVar('catid');\r
1154 \r
1155                 // only allow if user is allowed to alter item\r
1156                 $member->canUpdateItem($itemid, $catid) or $this->disallow();\r
1157 \r
1158                 $actiontype = postVar('actiontype');\r
1159 \r
1160                 // delete actions are handled by itemdelete (which has confirmation)\r
1161                 if ($actiontype == 'delete') {\r
1162                         $this->action_itemdelete();\r
1163                         return;\r
1164                 }\r
1165 \r
1166                 $body   = postVar('body');\r
1167                 $title  = postVar('title');\r
1168                 $more   = postVar('more');\r
1169                 $closed = intPostVar('closed');\r
1170                 $draftid = intPostVar('draftid');\r
1171 \r
1172                 // default action = add now\r
1173                 if (!$actiontype)\r
1174                         $actiontype='addnow';\r
1175 \r
1176                 // create new category if needed\r
1177                 if (strstr($catid,'newcat')) {\r
1178                         // get blogid\r
1179                         list($blogid) = sscanf($catid,"newcat-%d");\r
1180 \r
1181                         // create\r
1182                         $blog =& $manager->getBlog($blogid);\r
1183                         $catid = $blog->createNewCategory();\r
1184 \r
1185                         // show error when sth goes wrong\r
1186                         if (!$catid)\r
1187                                 $this->doError(_ERROR_CATCREATEFAIL);\r
1188                 }\r
1189 \r
1190                 /*\r
1191                         set some variables based on actiontype\r
1192 \r
1193                         actiontypes:\r
1194                                 draft items -> addnow, addfuture, adddraft, delete\r
1195                                 non-draft items -> edit, changedate, delete\r
1196 \r
1197                         variables set:\r
1198                                 $timestamp: set to a nonzero value for future dates or date changes\r
1199                                 $wasdraft: set to 1 when the item used to be a draft item\r
1200                                 $publish: set to 1 when the edited item is not a draft\r
1201                 */\r
1202 /*<del by shizuki>\r
1203                 switch ($actiontype) {\r
1204                         case 'adddraft':\r
1205                                 $publish = 0;\r
1206                                 $wasdraft = 1;\r
1207                                 $timestamp = 0;\r
1208                                 break;\r
1209                         case 'addfuture':\r
1210                                 $wasdraft = 1;\r
1211                                 $publish = 1;\r
1212                                 $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
1213                                 break;\r
1214                         case 'addnow':\r
1215                                 $wasdraft = 1;\r
1216                                 $publish = 1;\r
1217                                 $timestamp = 0;\r
1218                                 break;\r
1219                         case 'changedate':\r
1220                                 $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
1221                                 $publish = 1;\r
1222                                 $wasdraft = 0;\r
1223                                 break;\r
1224                         case 'backtodrafts':\r
1225                                 $wasdraft = 0;\r
1226                                 $publish = 0;\r
1227                                 $timestamp = 0;\r
1228                                 break;\r
1229                         case 'edit':\r
1230                         default:\r
1231                                 $publish = 1;\r
1232                                 $wasdraft = 0;\r
1233                                 $timestamp = 0;\r
1234                 }\r
1235 </del by shizuki>*/\r
1236 // <add by shizuki>\r
1237                 $blogid =  getBlogIDFromItemID($itemid);\r
1238                 $blog   =& $manager->getBlog($blogid);\r
1239 \r
1240                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
1241                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
1242                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
1243                 if ($actiontype == 'addfuture' || $actiontype == 'changedate') {\r
1244                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
1245                 } else {\r
1246                         $timestamp =0;\r
1247                 }\r
1248                 $doping = ($publish && $timestamp < $blog->getCorrectTime() && postVar('dosendping')) ? 1 : 0;\r
1249 // </add by shizuki>\r
1250 \r
1251                 // edit the item for real\r
1252                 ITEM::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
1253 \r
1254 /* <del by shizuki>\r
1255                 $blogid = getBlogIDFromItemID($itemid);\r
1256                 $blog =& $manager->getBlog($blogid);\r
1257 \r
1258                 $isFuture = 0;\r
1259                 if ($timestamp > $blog->getCorrectTime(time())) {\r
1260                         $isFuture = 1;\r
1261                 }\r
1262 \r
1263 </del by shizuki>*/\r
1264                 $this->updateFuturePosted($blogid);\r
1265 \r
1266                 if ($draftid > 0) {\r
1267                         // delete permission is checked inside ITEM::delete()\r
1268                         ITEM::delete($draftid);\r
1269                 }\r
1270 \r
1271 //              if (!$closed && $publish && $wasdraft && $blog->sendPing() && numberOfEventSubscriber('SendPing') > 0 && !$isFuture) {\r
1272                 if (!$closed && $doping && $blog->sendPing() && numberOfEventSubscriber('SendPing') > 0) {              //<mod by shizuki />\r
1273                         $this->action_sendping($blogid);\r
1274                         return;\r
1275                 }\r
1276 \r
1277                 // show category edit window when we created a new category\r
1278                 // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')\r
1279                 if ($catid != intPostVar('catid')) {\r
1280                         $this->action_categoryedit(\r
1281                                 $catid,\r
1282                                 $blog->getID(),\r
1283                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
1284                         );\r
1285                 } else {\r
1286                         // TODO: set start item correctly for itemlist\r
1287                         $this->action_itemlist(getBlogIDFromItemID($itemid));\r
1288                 }\r
1289         }\r
1290 \r
1291         /**\r
1292          * @todo document this\r
1293          */\r
1294         function action_itemdelete() {\r
1295                 global $member, $manager;\r
1296 \r
1297                 $itemid = intRequestVar('itemid');\r
1298 \r
1299                 // only allow if user is allowed to alter item\r
1300                 $member->canAlterItem($itemid) or $this->disallow();\r
1301 \r
1302                 if (!$manager->existsItem($itemid,1,1))\r
1303                         $this->error(_ERROR_NOSUCHITEM);\r
1304 \r
1305                 $item =& $manager->getItem($itemid,1,1);\r
1306                 $title = htmlspecialchars(strip_tags($item['title']));\r
1307                 $body = strip_tags($item['body']);\r
1308                 $body = htmlspecialchars(shorten($body,300,'...'));\r
1309 \r
1310                 $this->pagehead();\r
1311                 ?>\r
1312                         <h2><?php echo _DELETE_CONFIRM?></h2>\r
1313 \r
1314                         <p><?php echo _CONFIRMTXT_ITEM?></p>\r
1315 \r
1316                         <div class="note">\r
1317                                 <b>"<?php echo  $title ?>"</b>\r
1318                                 <br />\r
1319                                 <?php echo $body?>\r
1320                         </div>\r
1321 \r
1322                         <form method="post" action="index.php"><div>\r
1323                                 <input type="hidden" name="action" value="itemdeleteconfirm" />\r
1324                                 <?php $manager->addTicketHidden() ?>\r
1325                                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />\r
1326                                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>"  tabindex="10" />\r
1327                         </div></form>\r
1328                 <?php\r
1329                 $this->pagefoot();\r
1330         }\r
1331 \r
1332         /**\r
1333          * @todo document this\r
1334          */\r
1335         function action_itemdeleteconfirm() {\r
1336                 global $member;\r
1337 \r
1338                 $itemid = intRequestVar('itemid');\r
1339 \r
1340                 // only allow if user is allowed to alter item\r
1341                 $member->canAlterItem($itemid) or $this->disallow();\r
1342 \r
1343                 // get blogid first\r
1344                 $blogid = getBlogIdFromItemId($itemid);\r
1345 \r
1346                 // delete item (note: some checks will be performed twice)\r
1347                 $this->deleteOneItem($itemid);\r
1348 \r
1349                 $this->action_itemlist($blogid);\r
1350         }\r
1351 \r
1352         /**\r
1353          * Deletes one item and returns error if something goes wrong\r
1354          * @param int $itemid\r
1355          */\r
1356         function deleteOneItem($itemid) {\r
1357                 global $member, $manager;\r
1358 \r
1359                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1360                 if (!$member->canAlterItem($itemid))\r
1361                         return _ERROR_DISALLOWED;\r
1362 \r
1363                 // need to get blogid before the item is deleted\r
1364                 $blogid = getBlogIDFromItemId($itemid);\r
1365 \r
1366                 $manager->loadClass('ITEM');\r
1367                 ITEM::delete($itemid);\r
1368 \r
1369                 // update blog's futureposted\r
1370                 $this->updateFuturePosted($blogid);\r
1371         }\r
1372 \r
1373         /**\r
1374          * Update a blog's future posted flag\r
1375          * @param int $blogid\r
1376          */\r
1377         function updateFuturePosted($blogid) {\r
1378                 global $manager;\r
1379 \r
1380                 $blog =& $manager->getBlog($blogid);\r
1381                 $currenttime = $blog->getCorrectTime(time());\r
1382                 $result = sql_query("SELECT * FROM ".sql_table('item').\r
1383                         " WHERE iblog='".$blogid."' AND iposted=0 AND itime>".mysqldate($currenttime));\r
1384                 if (mysql_num_rows($result) > 0) {\r
1385                                 $blog->setFuturePost();\r
1386                 }\r
1387                 else {\r
1388                                 $blog->clearFuturePost();\r
1389                 }\r
1390         }\r
1391 \r
1392         /**\r
1393          * @todo document this\r
1394          */\r
1395         function action_itemmove() {\r
1396                 global $member, $manager;\r
1397 \r
1398                 $itemid = intRequestVar('itemid');\r
1399 \r
1400                 // only allow if user is allowed to alter item\r
1401                 $member->canAlterItem($itemid) or $this->disallow();\r
1402 \r
1403                 $item =& $manager->getItem($itemid,1,1);\r
1404 \r
1405                 $this->pagehead();\r
1406                 ?>\r
1407                         <h2><?php echo _MOVE_TITLE?></h2>\r
1408                         <form method="post" action="index.php"><div>\r
1409                                 <input type="hidden" name="action" value="itemmoveto" />\r
1410                                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />\r
1411 \r
1412                                 <?php\r
1413 \r
1414                                         $manager->addTicketHidden();\r
1415                                         $this->selectBlogCategory('catid',$item['catid'],10,1);\r
1416                                 ?>\r
1417 \r
1418                                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />\r
1419                         </div></form>\r
1420                 <?php\r
1421                 $this->pagefoot();\r
1422         }\r
1423 \r
1424         /**\r
1425          * @todo document this\r
1426          */\r
1427         function action_itemmoveto() {\r
1428                 global $member, $manager;\r
1429 \r
1430                 $itemid = intRequestVar('itemid');\r
1431                 $catid = requestVar('catid');\r
1432 \r
1433                 // create new category if needed\r
1434                 if (strstr($catid,'newcat')) {\r
1435                         // get blogid\r
1436                         list($blogid) = sscanf($catid,'newcat-%d');\r
1437 \r
1438                         // create\r
1439                         $blog =& $manager->getBlog($blogid);\r
1440                         $catid = $blog->createNewCategory();\r
1441 \r
1442                         // show error when sth goes wrong\r
1443                         if (!$catid)\r
1444                                 $this->doError(_ERROR_CATCREATEFAIL);\r
1445                 }\r
1446 \r
1447                 // only allow if user is allowed to alter item\r
1448                 $member->canUpdateItem($itemid, $catid) or $this->disallow();\r
1449 \r
1450                 $old_blogid = getBlogIDFromItemId($itemid);\r
1451 \r
1452                 ITEM::move($itemid, $catid);\r
1453 \r
1454                 // set the futurePosted flag on the blog\r
1455                 $this->updateFuturePosted(getBlogIDFromItemId($itemid));\r
1456 \r
1457                 // reset the futurePosted in case the item is moved from one blog to another\r
1458                 $this->updateFuturePosted($old_blogid);\r
1459 \r
1460                 if ($catid != intRequestVar('catid'))\r
1461                         $this->action_categoryedit($catid, $blog->getID());\r
1462                 else\r
1463                         $this->action_itemlist(getBlogIDFromCatID($catid));\r
1464         }\r
1465 \r
1466         /**\r
1467          * Moves one item to a given category (category existance should be checked by caller)\r
1468          * errors are returned\r
1469          * @param int $itemid\r
1470          * @param int $destCatid category ID to which the item will be moved\r
1471          */\r
1472         function moveOneItem($itemid, $destCatid) {\r
1473                 global $member;\r
1474 \r
1475                 // only allow if user is allowed to move item\r
1476                 if (!$member->canUpdateItem($itemid, $destCatid))\r
1477                         return _ERROR_DISALLOWED;\r
1478 \r
1479                 ITEM::move($itemid, $destCatid);\r
1480         }\r
1481 \r
1482         /**\r
1483          * Adds a item to the chosen blog\r
1484          */\r
1485         function action_additem() {\r
1486                 global $member, $manager, $CONF;\r
1487 \r
1488                 $manager->loadClass('ITEM');\r
1489 \r
1490                 $result = ITEM::createFromRequest();\r
1491 \r
1492                 if ($result['status'] == 'error')\r
1493                         $this->error($result['message']);\r
1494 \r
1495                 $blogid = getBlogIDFromItemID($result['itemid']);\r
1496                 $blog =& $manager->getBlog($blogid);\r
1497 /* <del by shizuki>\r
1498                 $pingUrl = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=sendping&blogid=' . intval($blogid));\r
1499 \r
1500                 if ($result['status'] == 'newcategory')\r
1501                         $this->action_categoryedit(\r
1502                                 $result['catid'],\r
1503                                 $blogid,\r
1504                                 $blog->sendPing() && numberOfEventSubscriber('SendPing') > 0 ? $pingUrl : ''\r
1505                         );\r
1506                 elseif ((postVar('actiontype') == 'addnow') && $blog->sendPing() && numberOfEventSubscriber('SendPing') > 0)\r
1507                         $this->action_sendping($blogid);\r
1508                 else\r
1509                         $this->action_itemlist($blogid);\r
1510 </del by shizuki>*/\r
1511 // <add by shizuki>\r
1512                 $btimestamp = $blog->getCorrectTime();\r
1513                 $bPingInfo  = ($blog->sendPing() && numberOfEventSubscriber('SendPing') > 0);\r
1514                 $item       = $manager->getItem(intval($result['itemid']), 1, 1);\r
1515                 $iPingInfo  = (!$item['draft'] && postVar('dosendping') && $item['timestamp'] <= $btimestamp);\r
1516                 if ($iPingInfo && $bPingInfo) {\r
1517                         $nextAction = 'sendping';\r
1518                 } else {\r
1519                         $nextAction = 'itemlist';\r
1520                 }\r
1521                 if ($result['status'] == 'newcategory') {\r
1522 //                      $distURI = ($nextAction == 'sendping') ? $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action='\r
1523 //                                       . $nextAction . '&blogid=' . intval($blogid)) :\r
1524 //                                         '';\r
1525                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=' . $nextAction . '&blogid=' . intval($blogid));\r
1526                         $this->action_categoryedit($result['catid'], $blogid, $distURI);\r
1527                 } else {\r
1528                         $methodName = 'action_' . $nextAction;\r
1529                         call_user_func(array(&$this, $methodName), $blogid);\r
1530                 }\r
1531 //</add by shizuki>\r
1532         }\r
1533 \r
1534         /**\r
1535          * Shows a window that says we're about to ping.\r
1536          * immediately refresh to the real pinging page, which will\r
1537          * show an error, or redirect to the blog.\r
1538          *\r
1539          * @param int $blogid ID of blog for which ping needs to be sent out\r
1540          */\r
1541         function action_sendping($blogid = -1) {\r
1542                 global $member, $manager;\r
1543 \r
1544                 if ($blogid == -1)\r
1545                         $blogid = intRequestVar('blogid');\r
1546 \r
1547                 $member->isLoggedIn() or $this->disallow();\r
1548 \r
1549                 $rawPingUrl = $manager->addTicketToUrl('index.php?action=rawping&blogid=' . intval($blogid));\r
1550 \r
1551                 $this->pagehead('<meta http-equiv="refresh" content="1; url='.htmlspecialchars($rawPingUrl).'" />');\r
1552                 echo _UPDATEDPING_MESSAGE;\r
1553                 ?>\r
1554                 <a href="index.php?action=rawping&amp;blogid=<?php echo $blogid?>"><?php echo _UPDATEDPING_GOPINGPAGE ?></a>\r
1555                 </p>\r
1556                 <?php\r
1557                 $this->pagefoot();\r
1558         }\r
1559 \r
1560         /**\r
1561          * Sends the real ping (can take up to 10 seconds!)\r
1562          */\r
1563         function action_rawping() {\r
1564                 global $manager;\r
1565                 // TODO: checks?\r
1566 \r
1567                 $blogid = intRequestVar('blogid');\r
1568                 $blog =& $manager->getBlog($blogid);\r
1569 \r
1570                 $this->pagehead();\r
1571 \r
1572                 ?>\r
1573 \r
1574                 <h2><?php echo _UPDATEDPING_PINGING ?></h2>\r
1575                 <div class='note'>\r
1576                 <?php\r
1577 \r
1578                 // send sendPing event\r
1579                 $manager->notify('SendPing', array('blogid' => $blogid));\r
1580 \r
1581                 ?>\r
1582                 </div>\r
1583 \r
1584                 <ul>\r
1585                         <li><a href="index.php?action=itemlist&amp;blogid=<?php echo $blog->getID()?>"><?php echo _UPDATEDPING_VIEWITEM . htmlspecialchars($blog->getName())?></a></li>\r
1586                         <li><a href="<?php echo $blog->getURL()?>"><?php echo _UPDATEDPING_VISITOWNSITE ?></a></li>\r
1587                 </ul>\r
1588 \r
1589                 <?php           $this->pagefoot();\r
1590         }\r
1591 \r
1592         /**\r
1593          * Allows to edit previously made comments\r
1594          */\r
1595         function action_commentedit() {\r
1596                 global $member, $manager;\r
1597 \r
1598                 $commentid = intRequestVar('commentid');\r
1599 \r
1600                 $member->canAlterComment($commentid) or $this->disallow();\r
1601 \r
1602                 $comment = COMMENT::getComment($commentid);\r
1603 \r
1604                 $manager->notify('PrepareCommentForEdit',array('comment' => &$comment));\r
1605 \r
1606                 // change <br /> to \n\r
1607                 $comment['body'] = str_replace('<br />','',$comment['body']);\r
1608 \r
1609                 $comment['body'] = eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>","\\1",$comment['body']);\r
1610 \r
1611                 $this->pagehead();\r
1612 \r
1613                 ?>\r
1614                 <h2><?php echo _EDITC_TITLE?></h2>\r
1615 \r
1616                 <form action="index.php" method="post"><div>\r
1617 \r
1618                 <input type="hidden" name="action" value="commentupdate" />\r
1619                 <?php $manager->addTicketHidden(); ?>\r
1620                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />\r
1621                 <table><tr>\r
1622                         <th colspan="2"><?php echo _EDITC_TITLE?></th>\r
1623                 </tr><tr>\r
1624                         <td><?php echo _EDITC_WHO?></td>\r
1625                         <td>\r
1626                         <?php                           if ($comment['member'])\r
1627                                         echo $comment['member'] . " (" . _EDITC_MEMBER . ")";\r
1628                                 else\r
1629                                         echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";\r
1630                         ?>\r
1631                         </td>\r
1632                 </tr><tr>\r
1633                         <td><?php echo _EDITC_WHEN?></td>\r
1634                         <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>\r
1635                 </tr><tr>\r
1636                         <td><?php echo _EDITC_HOST?></td>\r
1637                         <td><?php echo  $comment['host']; ?></td>\r
1638                 </tr>\r
1639                 <tr>\r
1640                         <td><?php echo _EDITC_URL; ?></td>\r
1641                         <td><input type="text" name="url" size="30" tabindex="6" value="<?php echo $comment['userid']; ?>" /></td>\r
1642                 </tr>\r
1643                 <tr>\r
1644                         <td><?php echo _EDITC_EMAIL; ?></td>\r
1645                         <td><input type="text" name="email" size="30" tabindex="8" value="<?php echo $comment['email']; ?>" /></td>\r
1646                 </tr>\r
1647                 <tr>\r
1648                         <td><?php echo _EDITC_TEXT?></td>\r
1649                         <td>\r
1650                                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                                   // htmlspecialchars not needed (things should be escaped already)\r
1651                                         echo $comment['body'];\r
1652                                 ?></textarea>\r
1653                         </td>\r
1654                 </tr><tr>\r
1655                         <td><?php echo _EDITC_EDIT?></td>\r
1656                         <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>\r
1657                 </tr></table>\r
1658 \r
1659                 </div></form>\r
1660                 <?php\r
1661                 $this->pagefoot();\r
1662         }\r
1663 \r
1664         /**\r
1665          * @todo document this\r
1666          */\r
1667         function action_commentupdate() {\r
1668                 global $member, $manager;\r
1669 \r
1670                 $commentid = intRequestVar('commentid');\r
1671 \r
1672                 $member->canAlterComment($commentid) or $this->disallow();\r
1673 \r
1674                 $url = postVar('url');\r
1675                 $email = postVar('email');\r
1676                 $body = postVar('body');\r
1677 \r
1678                 // intercept words that are too long\r
1679                 if (eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}",$body) != false)\r
1680                         $this->error(_ERROR_COMMENT_LONGWORD);\r
1681 \r
1682                 // check length\r
1683                 if (strlen($body)<3)\r
1684                         $this->error(_ERROR_COMMENT_NOCOMMENT);\r
1685                 if (strlen($body)>5000)\r
1686                         $this->error(_ERROR_COMMENT_TOOLONG);\r
1687 \r
1688 \r
1689                 // prepare body\r
1690                 $body = COMMENT::prepareBody($body);\r
1691 \r
1692                 // call plugins\r
1693                 $manager->notify('PreUpdateComment',array('body' => &$body));\r
1694 \r
1695                 $query =  'UPDATE '.sql_table('comment')\r
1696                            . " SET cmail = '" . addslashes($url) . "', cemail = '" . addslashes($email) . "', cbody = '" . addslashes($body) . "'"\r
1697                            . " WHERE cnumber=" . $commentid;\r
1698                 sql_query($query);\r
1699 \r
1700                 // get itemid\r
1701                 $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);\r
1702                 $o = mysql_fetch_object($res);\r
1703                 $itemid = $o->citem;\r
1704 \r
1705                 if ($member->canAlterItem($itemid))\r
1706                         $this->action_itemcommentlist($itemid);\r
1707                 else\r
1708                         $this->action_browseowncomments();\r
1709 \r
1710         }\r
1711 \r
1712         /**\r
1713          * @todo document this\r
1714          */\r
1715         function action_commentdelete() {\r
1716                 global $member, $manager;\r
1717 \r
1718                 $commentid = intRequestVar('commentid');\r
1719 \r
1720                 $member->canAlterComment($commentid) or $this->disallow();\r
1721 \r
1722                 $comment = COMMENT::getComment($commentid);\r
1723 \r
1724                 $body = strip_tags($comment['body']);\r
1725                 $body = htmlspecialchars(shorten($body, 300, '...'));\r
1726 \r
1727                 if ($comment['member'])\r
1728                         $author = $comment['member'];\r
1729                 else\r
1730                         $author = $comment['user'];\r
1731 \r
1732                 $this->pagehead();\r
1733                 ?>\r
1734 \r
1735                         <h2><?php echo _DELETE_CONFIRM?></h2>\r
1736 \r
1737                         <p><?php echo _CONFIRMTXT_COMMENT?></p>\r
1738 \r
1739                         <div class="note">\r
1740                         <b><?php echo _EDITC_WHO?>:</b> <?php echo  $author ?>\r
1741                         <br />\r
1742                         <b><?php echo _EDITC_TEXT?>:</b> <?php echo  $body ?>\r
1743                         </div>\r
1744 \r
1745                         <form method="post" action="index.php"><div>\r
1746                                 <input type="hidden" name="action" value="commentdeleteconfirm" />\r
1747                                 <?php $manager->addTicketHidden() ?>\r
1748                                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />\r
1749                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
1750                         </div></form>\r
1751                 <?php\r
1752                 $this->pagefoot();\r
1753         }\r
1754 \r
1755         /**\r
1756          * @todo document this\r
1757          */\r
1758         function action_commentdeleteconfirm() {\r
1759                 global $member;\r
1760 \r
1761                 $commentid = intRequestVar('commentid');\r
1762 \r
1763                 // get item id first\r
1764                 $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);\r
1765                 $o = mysql_fetch_object($res);\r
1766                 $itemid = $o->citem;\r
1767 \r
1768                 $error = $this->deleteOneComment($commentid);\r
1769                 if ($error)\r
1770                         $this->doError($error);\r
1771 \r
1772                 if ($member->canAlterItem($itemid))\r
1773                         $this->action_itemcommentlist($itemid);\r
1774                 else\r
1775                         $this->action_browseowncomments();\r
1776         }\r
1777 \r
1778         /**\r
1779          * @todo document this\r
1780          */\r
1781         function deleteOneComment($commentid) {\r
1782                 global $member, $manager;\r
1783 \r
1784                 $commentid = intval($commentid);\r
1785 \r
1786                 if (!$member->canAlterComment($commentid))\r
1787                         return _ERROR_DISALLOWED;\r
1788 \r
1789                 $manager->notify('PreDeleteComment', array('commentid' => $commentid));\r
1790 \r
1791                 // delete the comments associated with the item\r
1792                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;\r
1793                 sql_query($query);\r
1794 \r
1795                 $manager->notify('PostDeleteComment', array('commentid' => $commentid));\r
1796 \r
1797                 return '';\r
1798         }\r
1799 \r
1800         /**\r
1801          * Usermanagement main\r
1802          */\r
1803         function action_usermanagement() {\r
1804                 global $member, $manager;\r
1805 \r
1806                 // check if allowed\r
1807                 $member->isAdmin() or $this->disallow();\r
1808 \r
1809                 $this->pagehead();\r
1810 \r
1811                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
1812 \r
1813                 echo '<h2>' . _MEMBERS_TITLE .'</h2>';\r
1814 \r
1815                 echo '<h3>' . _MEMBERS_CURRENT .'</h3>';\r
1816 \r
1817                 // show list of members with actions\r
1818                 $query =  'SELECT *'\r
1819                            . ' FROM '.sql_table('member');\r
1820                 $template['content'] = 'memberlist';\r
1821                 $template['tabindex'] = 10;\r
1822 \r
1823                 $manager->loadClass("ENCAPSULATE");\r
1824                 $batch =& new BATCH('member');\r
1825                 $batch->showlist($query,'table',$template);\r
1826 \r
1827                 echo '<h3>' . _MEMBERS_NEW .'</h3>';\r
1828                 ?>\r
1829                         <form method="post" action="index.php" name="memberedit"><div>\r
1830 \r
1831                         <input type="hidden" name="action" value="memberadd" />\r
1832                         <?php $manager->addTicketHidden() ?>\r
1833 \r
1834                         <table>\r
1835                         <tr>\r
1836                                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>\r
1837                         </tr><tr>\r
1838                                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>\r
1839                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>\r
1840                                 </td>\r
1841                                 <td><input tabindex="10010" name="name" size="16" maxlength="16" /></td>\r
1842                         </tr><tr>\r
1843                                 <td><?php echo _MEMBERS_REALNAME?></td>\r
1844                                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>\r
1845                         </tr><tr>\r
1846                                 <td><?php echo _MEMBERS_PWD?></td>\r
1847                                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>\r
1848                         </tr><tr>\r
1849                                 <td><?php echo _MEMBERS_REPPWD?></td>\r
1850                                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>\r
1851                         </tr><tr>\r
1852                                 <td><?php echo _MEMBERS_EMAIL?></td>\r
1853                                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>\r
1854                         </tr><tr>\r
1855                                 <td><?php echo _MEMBERS_URL?></td>\r
1856                                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>\r
1857                         </tr><tr>\r
1858                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>\r
1859                                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>\r
1860                         </tr><tr>\r
1861                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>\r
1862                                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>\r
1863                         </tr><tr>\r
1864                                 <td><?php echo _MEMBERS_NOTES?></td>\r
1865                                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>\r
1866                         </tr><tr>\r
1867                                 <td><?php echo _MEMBERS_NEW?></td>\r
1868                                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>\r
1869                         </tr></table>\r
1870 \r
1871                         </div></form>\r
1872                 <?php\r
1873                 $this->pagefoot();\r
1874         }\r
1875 \r
1876         /**\r
1877          * Edit member settings\r
1878          */\r
1879         function action_memberedit() {\r
1880                 $this->action_editmembersettings(intRequestVar('memberid'));\r
1881         }\r
1882 \r
1883         /**\r
1884          * @todo document this\r
1885          */\r
1886         function action_editmembersettings($memberid = '') {\r
1887                 global $member, $manager, $CONF;\r
1888 \r
1889                 if ($memberid == '')\r
1890                         $memberid = $member->getID();\r
1891 \r
1892                 // check if allowed\r
1893                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();\r
1894 \r
1895                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
1896                 $this->pagehead($extrahead);\r
1897 \r
1898                 // show message to go back to member overview (only for admins)\r
1899                 if ($member->isAdmin())\r
1900                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';\r
1901                 else\r
1902                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';\r
1903 \r
1904                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';\r
1905 \r
1906                 $mem = MEMBER::createFromID($memberid);\r
1907 \r
1908                 ?>\r
1909                 <form method="post" action="index.php" name="memberedit"><div>\r
1910 \r
1911                 <input type="hidden" name="action" value="changemembersettings" />\r
1912                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />\r
1913                 <?php $manager->addTicketHidden() ?>\r
1914 \r
1915                 <table><tr>\r
1916                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>\r
1917                 </tr><tr>\r
1918                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>\r
1919                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>\r
1920                         </td>\r
1921                         <td>\r
1922                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>\r
1923                                 <input name="name" tabindex="10" maxlength="16" size="16" value="<?php echo  htmlspecialchars($mem->getDisplayName()); ?>" />\r
1924                         <?php } else {\r
1925                                 echo htmlspecialchars($member->getDisplayName());\r
1926                            }\r
1927                         ?>\r
1928                         </td>\r
1929                 </tr><tr>\r
1930                         <td><?php echo _MEMBERS_REALNAME?></td>\r
1931                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  htmlspecialchars($mem->getRealName()); ?>" /></td>\r
1932                 </tr><tr>\r
1933                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>\r
1934                         <td><?php echo _MEMBERS_PWD?></td>\r
1935                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>\r
1936                 </tr><tr>\r
1937                         <td><?php echo _MEMBERS_REPPWD?></td>\r
1938                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>\r
1939                 <?php } ?>\r
1940                 </tr><tr>\r
1941                         <td><?php echo _MEMBERS_EMAIL?>\r
1942                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>\r
1943                         </td>\r
1944                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  htmlspecialchars($mem->getEmail()); ?>" /></td>\r
1945                 </tr><tr>\r
1946                         <td><?php echo _MEMBERS_URL?></td>\r
1947                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  htmlspecialchars($mem->getURL()); ?>" /></td>\r
1948                 <?php // only allow to change this by super-admins\r
1949                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)\r
1950                    if ($member->isAdmin()) {\r
1951                 ?>\r
1952                         </tr><tr>\r
1953                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>\r
1954                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>\r
1955                         </tr><tr>\r
1956                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>\r
1957                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70,1,0,_YES,_NO,$mem->isAdmin()); ?></td>\r
1958                 <?php } ?>\r
1959                 </tr><tr>\r
1960                         <td><?php echo _MEMBERS_NOTES?></td>\r
1961                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  htmlspecialchars($mem->getNotes()); ?>" /></td>\r
1962                 </tr><tr>\r
1963                         <td><?php echo _MEMBERS_DEFLANG?> <?php help('language'); ?>\r
1964                         </td>\r
1965                         <td>\r
1966 \r
1967                                 <select name="deflang" tabindex="85">\r
1968                                         <option value=""><?php echo _MEMBERS_USESITELANG?></option>\r
1969                                 <?php                           // show a dropdown list of all available languages\r
1970                                 global $DIR_LANG;\r
1971                                 $dirhandle = opendir($DIR_LANG);\r
1972                                 while ($filename = readdir($dirhandle)) {\r
1973                                         if (ereg("^(.*)\.php$",$filename,$matches)) {\r
1974                                                 $name = $matches[1];\r
1975                                                 echo "<option value='$name'";\r
1976                                                 if ($name == $mem->getLanguage())\r
1977                                                         echo " selected='selected'";\r
1978                                                 echo ">$name</option>";\r
1979                                         }\r
1980                                 }\r
1981                                 closedir($dirhandle);\r
1982 \r
1983                                 ?>\r
1984                                 </select>\r
1985 \r
1986                         </td>\r
1987                 </tr>\r
1988                 <tr>\r
1989                         <td><?php echo _MEMBERS_USEAUTOSAVE?> <?php help('autosave'); ?></td>\r
1990                         <td><?php $this->input_yesno('autosave', $mem->getAutosave(), 87); ?></td>\r
1991                 </tr>\r
1992                 <?php\r
1993                         // plugin options\r
1994                         $this->_insertPluginOptions('member',$memberid);\r
1995                 ?>\r
1996                 <tr>\r
1997                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>\r
1998                 </tr><tr>\r
1999                         <td><?php echo _MEMBERS_EDIT?></td>\r
2000                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>\r
2001                 </tr></table>\r
2002 \r
2003                 </div></form>\r
2004 \r
2005                 <?php\r
2006                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';\r
2007 \r
2008                         $manager->notify(\r
2009                                 'MemberSettingsFormExtras',\r
2010                                 array(\r
2011                                         'member' => &$mem\r
2012                                 )\r
2013                         );\r
2014 \r
2015                 $this->pagefoot();\r
2016         }\r
2017 \r
2018         /**\r
2019          * @todo document this\r
2020          */\r
2021         function action_changemembersettings() {\r
2022                 global $member, $CONF, $manager;\r
2023 \r
2024                 $memberid = intRequestVar('memberid');\r
2025 \r
2026                 // check if allowed\r
2027                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();\r
2028 \r
2029                 $name                   = trim(strip_tags(postVar('name')));\r
2030                 $realname               = trim(strip_tags(postVar('realname')));\r
2031                 $password               = postVar('password');\r
2032                 $repeatpassword = postVar('repeatpassword');\r
2033                 $email                  = strip_tags(postVar('email'));\r
2034                 $url                    = strip_tags(postVar('url'));\r
2035 \r
2036                 // Sometimes user didn't prefix the URL with http://, this cause a malformed URL. Let's fix it.\r
2037                 if (!eregi("^https?://", $url))\r
2038                         $url = "http://".$url;\r
2039 \r
2040                 $admin                  = postVar('admin');\r
2041                 $canlogin               = postVar('canlogin');\r
2042                 $notes                  = strip_tags(postVar('notes'));\r
2043                 $deflang                = postVar('deflang');\r
2044 \r
2045                 $mem = MEMBER::createFromID($memberid);\r
2046 \r
2047                 if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {\r
2048 \r
2049                         if (!isValidDisplayName($name))\r
2050                                 $this->error(_ERROR_BADNAME);\r
2051 \r
2052                         if (($name != $mem->getDisplayName()) && MEMBER::exists($name))\r
2053                                 $this->error(_ERROR_NICKNAMEINUSE);\r
2054 \r
2055                         if ($password != $repeatpassword)\r
2056                                 $this->error(_ERROR_PASSWORDMISMATCH);\r
2057 \r
2058                         if ($password && (strlen($password) < 6))\r
2059                                 $this->error(_ERROR_PASSWORDTOOSHORT);\r
2060                 }\r
2061 \r
2062                 if (!isValidMailAddress($email))\r
2063                         $this->error(_ERROR_BADMAILADDRESS);\r
2064 \r
2065 \r
2066                 if (!$realname)\r
2067                         $this->error(_ERROR_REALNAMEMISSING);\r
2068 \r
2069                 if (($deflang != '') && (!checkLanguage($deflang)))\r
2070                         $this->error(_ERROR_NOSUCHLANGUAGE);\r
2071 \r
2072                 // check if there will remain at least one site member with both the logon and admin rights\r
2073                 // (check occurs when taking away one of these rights from such a member)\r
2074                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
2075                          || (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
2076                    )\r
2077                 {\r
2078                         $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
2079                         if (mysql_num_rows($r) < 2)\r
2080                                 $this->error(_ERROR_ATLEASTONEADMIN);\r
2081                 }\r
2082 \r
2083                 if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {\r
2084                         $mem->setDisplayName($name);\r
2085                         if ($password)\r
2086                                 $mem->setPassword($password);\r
2087                 }\r
2088 \r
2089                 $oldEmail = $mem->getEmail();\r
2090 \r
2091                 $mem->setRealName($realname);\r
2092                 $mem->setEmail($email);\r
2093                 $mem->setURL($url);\r
2094                 $mem->setNotes($notes);\r
2095                 $mem->setLanguage($deflang);\r
2096 \r
2097 \r
2098                 // only allow super-admins to make changes to the admin status\r
2099                 if ($member->isAdmin()) {\r
2100                         $mem->setAdmin($admin);\r
2101                         $mem->setCanLogin($canlogin);\r
2102                 }\r
2103 \r
2104                 $autosave = postVar ('autosave');\r
2105                 $mem->setAutosave($autosave);\r
2106 \r
2107                 $mem->write();\r
2108 \r
2109                 // store plugin options\r
2110                 $aOptions = requestArray('plugoption');\r
2111                 NucleusPlugin::_applyPluginOptions($aOptions);\r
2112                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));\r
2113 \r
2114                 // if email changed, generate new password\r
2115                 if ($oldEmail != $mem->getEmail())\r
2116                 {\r
2117                         $mem->sendActivationLink('addresschange', $oldEmail);\r
2118                         // logout member\r
2119                         $mem->newCookieKey();\r
2120 \r
2121                         // only log out if the member being edited is the current member.\r
2122                         if ($member->getID() == $memberid)\r
2123                                 $member->logout();\r
2124                         $this->action_login(_MSG_ACTIVATION_SENT, 0);\r
2125                         return;\r
2126                 }\r
2127 \r
2128 \r
2129                 if (  ( $mem->getID() == $member->getID() )\r
2130                    && ( $mem->getDisplayName() != $member->getDisplayName() )\r
2131                    ) {\r
2132                         $mem->newCookieKey();\r
2133                         $member->logout();\r
2134                         $this->action_login(_MSG_LOGINAGAIN, 0);\r
2135                 } else {\r
2136                         $this->action_overview(_MSG_SETTINGSCHANGED);\r
2137                 }\r
2138         }\r
2139 \r
2140         /**\r
2141          * @todo document this\r
2142          */\r
2143         function action_memberadd() {\r
2144                 global $member, $manager;\r
2145 \r
2146                 // check if allowed\r
2147                 $member->isAdmin() or $this->disallow();\r
2148 \r
2149                 if (postVar('password') != postVar('repeatpassword'))\r
2150                         $this->error(_ERROR_PASSWORDMISMATCH);\r
2151                 if (strlen(postVar('password')) < 6)\r
2152                         $this->error(_ERROR_PASSWORDTOOSHORT);\r
2153 \r
2154                 $res = MEMBER::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));\r
2155                 if ($res != 1)\r
2156                         $this->error($res);\r
2157 \r
2158                 // fire PostRegister event\r
2159                 $newmem = new MEMBER();\r
2160                 $newmem->readFromName(postVar('name'));\r
2161                 $manager->notify('PostRegister',array('member' => &$newmem));\r
2162 \r
2163                 $this->action_usermanagement();\r
2164         }\r
2165 \r
2166         /**\r
2167          * Account activation\r
2168          *\r
2169          * @author dekarma\r
2170          */\r
2171         function action_activate() {\r
2172 \r
2173                 $key = getVar('key');\r
2174                 $this->_showActivationPage($key);\r
2175         }\r
2176 \r
2177         /**\r
2178          * @todo document this\r
2179          */\r
2180         function _showActivationPage($key, $message = '')\r
2181         {\r
2182                 global $manager;\r
2183 \r
2184                 // clean up old activation keys\r
2185                 MEMBER::cleanupActivationTable();\r
2186 \r
2187                 // get activation info\r
2188                 $info = MEMBER::getActivationInfo($key);\r
2189 \r
2190                 if (!$info)\r
2191                         $this->error(_ERROR_ACTIVATE);\r
2192 \r
2193                 $mem = MEMBER::createFromId($info->vmember);\r
2194 \r
2195                 if (!$mem)\r
2196                         $this->error(_ERROR_ACTIVATE);\r
2197 \r
2198                 $text = '';\r
2199                 $title = '';\r
2200                 $bNeedsPasswordChange = true;\r
2201 \r
2202                 switch ($info->vtype)\r
2203                 {\r
2204                         case 'forgot':\r
2205                                 $title = _ACTIVATE_FORGOT_TITLE;\r
2206                                 $text = _ACTIVATE_FORGOT_TEXT;\r
2207                                 break;\r
2208                         case 'register':\r
2209                                 $title = _ACTIVATE_REGISTER_TITLE;\r
2210                                 $text = _ACTIVATE_REGISTER_TEXT;\r
2211                                 break;\r
2212                         case 'addresschange':\r
2213                                 $title = _ACTIVATE_CHANGE_TITLE;\r
2214                                 $text = _ACTIVATE_CHANGE_TEXT;\r
2215                                 $bNeedsPasswordChange = false;\r
2216                                 MEMBER::activate($key);\r
2217                                 break;\r
2218                 }\r
2219 \r
2220                 $aVars = array(\r
2221                         'memberName' => htmlspecialchars($mem->getDisplayName())\r
2222                 );\r
2223                 $title = TEMPLATE::fill($title, $aVars);\r
2224                 $text = TEMPLATE::fill($text, $aVars);\r
2225 \r
2226                 $this->pagehead();\r
2227 \r
2228                         echo '<h2>' , $title, '</h2>';\r
2229                         echo '<p>' , $text, '</p>';\r
2230 \r
2231                         if ($message != '')\r
2232                         {\r
2233                                 echo '<p class="error">',$message,'</p>';\r
2234                         }\r
2235 \r
2236                         if ($bNeedsPasswordChange)\r
2237                         {\r
2238                                 ?>\r
2239                                         <div><form action="index.php" method="post">\r
2240 \r
2241                                                 <input type="hidden" name="action" value="activatesetpwd" />\r
2242                                                 <?php $manager->addTicketHidden() ?>\r
2243                                                 <input type="hidden" name="key" value="<?php echo htmlspecialchars($key) ?>" />\r
2244 \r
2245                                                 <table><tr>\r
2246                                                         <td><?php echo _MEMBERS_PWD?></td>\r
2247                                                         <td><input type="password" maxlength="40" size="16" name="password" /></td>\r
2248                                                 </tr><tr>\r
2249                                                         <td><?php echo _MEMBERS_REPPWD?></td>\r
2250                                                         <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>\r
2251                                                 <?php\r
2252 \r
2253                                                         global $manager;\r
2254                                                         $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));\r
2255 \r
2256                                                 ?>\r
2257                                                 </tr><tr>\r
2258                                                         <td><?php echo _MEMBERS_SETPWD ?></td>\r
2259                                                         <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>\r
2260                                                 </tr></table>\r
2261 \r
2262 \r
2263                                         </form></div>\r
2264 \r
2265                                 <?php\r
2266 \r
2267                         }\r
2268 \r
2269                 $this->pagefoot();\r
2270 \r
2271         }\r
2272 \r
2273         /**\r
2274          * Account activation - set password part\r
2275          *\r
2276          * @author dekarma\r
2277          */\r
2278         function action_activatesetpwd() {\r
2279 \r
2280                 $key = postVar('key');\r
2281 \r
2282                 // clean up old activation keys\r
2283                 MEMBER::cleanupActivationTable();\r
2284 \r
2285                 // get activation info\r
2286                 $info = MEMBER::getActivationInfo($key);\r
2287 \r
2288                 if (!$info || ($info->type == 'addresschange'))\r
2289                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);\r
2290 \r
2291                 $mem = MEMBER::createFromId($info->vmember);\r
2292 \r
2293                 if (!$mem)\r
2294                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);\r
2295 \r
2296                 $password               = postVar('password');\r
2297                 $repeatpassword = postVar('repeatpassword');\r
2298 \r
2299                 if ($password != $repeatpassword)\r
2300                         return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
2301 \r
2302                 if ($password && (strlen($password) < 6))\r
2303                         return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
2304 \r
2305                 $error = '';\r
2306                 global $manager;\r
2307                 $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));\r
2308                 if ($error != '')\r
2309                         return $this->_showActivationPage($key, $error);\r
2310 \r
2311 \r
2312                 // set password\r
2313                 $mem->setPassword($password);\r
2314                 $mem->write();\r
2315 \r
2316                 // do the activation\r
2317                 MEMBER::activate($key);\r
2318 \r
2319                 $this->pagehead();\r
2320                         echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';\r
2321                         echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';\r
2322                 $this->pagefoot();\r
2323         }\r
2324 \r
2325         /**\r
2326          * Manage team\r
2327          */\r
2328         function action_manageteam() {\r
2329                 global $member, $manager;\r
2330 \r
2331                 $blogid = intRequestVar('blogid');\r
2332 \r
2333                 // check if allowed\r
2334                 $member->blogAdminRights($blogid) or $this->disallow();\r
2335 \r
2336                 $this->pagehead();\r
2337 \r
2338                 echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";\r
2339 \r
2340                 echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';\r
2341 \r
2342                 echo '<h3>' . _TEAM_CURRENT . '</h3>';\r
2343 \r
2344 \r
2345 \r
2346                 $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'\r
2347                            . ' FROM '.sql_table('member').', '.sql_table('team')\r
2348                            . ' WHERE tmember=mnumber and tblog=' . $blogid;\r
2349 \r
2350                 $template['content'] = 'teamlist';\r
2351                 $template['tabindex'] = 10;\r
2352 \r
2353                 $manager->loadClass("ENCAPSULATE");\r
2354                 $batch =& new BATCH('team');\r
2355                 $batch->showlist($query, 'table', $template);\r
2356 \r
2357                 ?>\r
2358                         <h3><?php echo _TEAM_ADDNEW?></h3>\r
2359 \r
2360                         <form method='post' action='index.php'><div>\r
2361 \r
2362                         <input type='hidden' name='action' value='teamaddmember' />\r
2363                         <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />\r
2364                         <?php $manager->addTicketHidden() ?>\r
2365 \r
2366                         <table><tr>\r
2367                                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>\r
2368                                 <td><?php                                       // TODO: try to make it so only non-team-members are listed\r
2369                                         $query =  'SELECT mname as text, mnumber as value'\r
2370                                                    . ' FROM '.sql_table('member');\r
2371 \r
2372                                         $template['name'] = 'memberid';\r
2373                                         $template['tabindex'] = 10000;\r
2374                                         showlist($query,'select',$template);\r
2375                                 ?></td>\r
2376                         </tr><tr>\r
2377                                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>\r
2378                                 <td><?php $this->input_yesno('admin',0,10020); ?></td>\r
2379                         </tr><tr>\r
2380                                 <td><?php echo _TEAM_ADD?></td>\r
2381                                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>\r
2382                         </tr></table>\r
2383 \r
2384                         </div></form>\r
2385                 <?php\r
2386                 $this->pagefoot();\r
2387         }\r
2388 \r
2389         /**\r
2390          * Add member to team\r
2391          */\r
2392         function action_teamaddmember() {\r
2393                 global $member, $manager;\r
2394 \r
2395                 $memberid = intPostVar('memberid');\r
2396                 $blogid = intPostVar('blogid');\r
2397                 $admin = intPostVar('admin');\r
2398 \r
2399                 // check if allowed\r
2400                 $member->blogAdminRights($blogid) or $this->disallow();\r
2401 \r
2402                 $blog =& $manager->getBlog($blogid);\r
2403                 if (!$blog->addTeamMember($memberid, $admin))\r
2404                         $this->error(_ERROR_ALREADYONTEAM);\r
2405 \r
2406                 $this->action_manageteam();\r
2407 \r
2408         }\r
2409 \r
2410         /**\r
2411          * @todo document this\r
2412          */\r
2413         function action_teamdelete() {\r
2414                 global $member, $manager;\r
2415 \r
2416                 $memberid = intRequestVar('memberid');\r
2417                 $blogid = intRequestVar('blogid');\r
2418 \r
2419                 // check if allowed\r
2420                 $member->blogAdminRights($blogid) or $this->disallow();\r
2421 \r
2422                 $teammem = MEMBER::createFromID($memberid);\r
2423                 $blog =& $manager->getBlog($blogid);\r
2424 \r
2425                 $this->pagehead();\r
2426                 ?>\r
2427                         <h2><?php echo _DELETE_CONFIRM?></h2>\r
2428 \r
2429                         <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  htmlspecialchars($teammem->getDisplayName()) ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  htmlspecialchars(strip_tags($blog->getName())) ?></b>\r
2430                         </p>\r
2431 \r
2432 \r
2433                         <form method="post" action="index.php"><div>\r
2434                         <input type="hidden" name="action" value="teamdeleteconfirm" />\r
2435                         <?php $manager->addTicketHidden() ?>\r
2436                         <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />\r
2437                         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />\r
2438                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
2439                         </div></form>\r
2440                 <?php\r
2441                 $this->pagefoot();\r
2442         }\r
2443 \r
2444         /**\r
2445          * @todo document this\r
2446          */\r
2447         function action_teamdeleteconfirm() {\r
2448                 global $member;\r
2449 \r
2450                 $memberid = intRequestVar('memberid');\r
2451                 $blogid = intRequestVar('blogid');\r
2452 \r
2453                 $error = $this->deleteOneTeamMember($blogid, $memberid);\r
2454                 if ($error)\r
2455                         $this->error($error);\r
2456 \r
2457 \r
2458                 $this->action_manageteam();\r
2459         }\r
2460 \r
2461         /**\r
2462          * @todo document this\r
2463          */\r
2464         function deleteOneTeamMember($blogid, $memberid) {\r
2465                 global $member, $manager;\r
2466 \r
2467                 $blogid = intval($blogid);\r
2468                 $memberid = intval($memberid);\r
2469 \r
2470                 // check if allowed\r
2471                 if (!$member->blogAdminRights($blogid))\r
2472                         return _ERROR_DISALLOWED;\r
2473 \r
2474                 // check if: - there remains at least one blog admin\r
2475                 //           - (there remains at least one team member)\r
2476                 $tmem = MEMBER::createFromID($memberid);\r
2477 \r
2478                 $manager->notify('PreDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));\r
2479 \r
2480                 if ($tmem->isBlogAdmin($blogid)) {\r
2481                         // check if there are more blog members left and at least one admin\r
2482                         // (check for at least two admins before deletion)\r
2483                         $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';\r
2484                         $r = sql_query($query);\r
2485                         if (mysql_num_rows($r) < 2)\r
2486                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
2487                 }\r
2488 \r
2489                 $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";\r
2490                 sql_query($query);\r
2491 \r
2492                 $manager->notify('PostDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));\r
2493 \r
2494                 return '';\r
2495         }\r
2496 \r
2497         /**\r
2498          * @todo document this\r
2499          */\r
2500         function action_teamchangeadmin() {\r
2501                 global $member;\r
2502 \r
2503                 $blogid = intRequestVar('blogid');\r
2504                 $memberid = intRequestVar('memberid');\r
2505 \r
2506                 // check if allowed\r
2507                 $member->blogAdminRights($blogid) or $this->disallow();\r
2508 \r
2509                 $mem = MEMBER::createFromID($memberid);\r
2510 \r
2511                 // don't allow when there is only one admin at this moment\r
2512                 if ($mem->isBlogAdmin($blogid)) {\r
2513                         $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");\r
2514                         if (mysql_num_rows($r) == 1)\r
2515                                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);\r
2516                 }\r
2517 \r
2518                 if ($mem->isBlogAdmin($blogid))\r
2519                         $newval = 0;\r
2520                 else\r
2521                         $newval = 1;\r
2522 \r
2523                 $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";\r
2524                 sql_query($query);\r
2525 \r
2526                 // only show manageteam if member did not change its own admin privileges\r
2527                 if ($member->isBlogAdmin($blogid))\r
2528                         $this->action_manageteam();\r
2529                 else\r
2530                         $this->action_overview(_MSG_ADMINCHANGED);\r
2531         }\r
2532 \r
2533         /**\r
2534          * @todo document this\r
2535          */\r
2536         function action_blogsettings() {\r
2537                 global $member, $manager;\r
2538 \r
2539                 $blogid = intRequestVar('blogid');\r
2540 \r
2541                 // check if allowed\r
2542                 $member->blogAdminRights($blogid) or $this->disallow();\r
2543 \r
2544                 $blog =& $manager->getBlog($blogid);\r
2545 \r
2546                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2547                 $this->pagehead($extrahead);\r
2548 \r
2549                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
2550                 ?>\r
2551                 <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>\r
2552 \r
2553                 <h3><?php echo _EBLOG_TEAM_TITLE?></h3>\r
2554 \r
2555                 <p><?php echo _EBLOG_CURRENT_TEAM_MEMBER; ?>\r
2556                 <?php\r
2557                         $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));\r
2558                         $aMemberNames = array();\r
2559                         while ($o = mysql_fetch_object($res))\r
2560                                 array_push($aMemberNames, htmlspecialchars($o->mname) . ' (' . htmlspecialchars($o->mrealname). ')');\r
2561                         echo implode(',', $aMemberNames);\r
2562                 ?>\r
2563                 </p>\r
2564 \r
2565 \r
2566 \r
2567                 <p>\r
2568                 <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>\r
2569                 </p>\r
2570 \r
2571                 <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>\r
2572 \r
2573                 <form method="post" action="index.php"><div>\r
2574 \r
2575                 <input type="hidden" name="action" value="blogsettingsupdate" />\r
2576                 <?php $manager->addTicketHidden() ?>\r
2577                 <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />\r
2578                 <table><tr>\r
2579                         <td><?php echo _EBLOG_NAME?></td>\r
2580                         <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  htmlspecialchars($blog->getName()) ?>" /></td>\r
2581                 </tr><tr>\r
2582                         <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>\r
2583                                 <?php echo _EBLOG_SHORTNAME_EXTRA?>\r
2584                         </td>\r
2585                         <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  htmlspecialchars($blog->getShortName()) ?>" /></td>\r
2586                 </tr><tr>\r
2587                         <td><?php echo _EBLOG_DESC?></td>\r
2588                         <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  htmlspecialchars($blog->getDescription()) ?>" /></td>\r
2589                 </tr><tr>\r
2590                         <td><?php echo _EBLOG_URL?></td>\r
2591                         <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  htmlspecialchars($blog->getURL()) ?>" /></td>\r
2592                 </tr><tr>\r
2593                         <td><?php echo _EBLOG_DEFSKIN?>\r
2594                                 <?php help('blogdefaultskin'); ?>\r
2595                         </td>\r
2596                         <td>\r
2597                                 <?php\r
2598                                         $query =  'SELECT sdname as text, sdnumber as value'\r
2599                                                    . ' FROM '.sql_table('skin_desc');\r
2600                                         $template['name'] = 'defskin';\r
2601                                         $template['selected'] = $blog->getDefaultSkin();\r
2602                                         $template['tabindex'] = 50;\r
2603                                         showlist($query,'select',$template);\r
2604                                 ?>\r
2605 \r
2606                         </td>\r
2607                 </tr><tr>\r
2608                         <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>\r
2609                         </td>\r
2610                         <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>\r
2611                 </tr><tr>\r
2612                         <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>\r
2613                         </td>\r
2614                         <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>\r
2615                 </tr><tr>\r
2616                         <td><?php echo _EBLOG_DISABLECOMMENTS?>\r
2617                         </td>\r
2618                         <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>\r
2619                 </tr><tr>\r
2620                         <td><?php echo _EBLOG_ANONYMOUS?>\r
2621                         </td>\r
2622                         <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>\r
2623                 </tr><tr>\r
2624         <td><?php echo _EBLOG_REQUIREDEMAIL?>\r
2625                  </td>\r
2626                  <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>\r
2627           </tr><tr>\r
2628                         <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>\r
2629                         <td><input name="notify" tabindex="80" maxlength="60" size="40" value="<?php echo  htmlspecialchars($blog->getNotifyAddress()); ?>" /></td>\r
2630                 </tr><tr>\r
2631                         <td><?php echo _EBLOG_NOTIFY_ON?></td>\r
2632                         <td>\r
2633                                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"\r
2634                                         <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>\r
2635                                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>\r
2636                                 <br />\r
2637                                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"\r
2638                                         <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>\r
2639                                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>\r
2640                                 <br />\r
2641                                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"\r
2642                                         <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>\r
2643                                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>\r
2644                         </td>\r
2645                 </tr><tr>\r
2646                 <?php\r
2647                 if (numberOfEventSubscriber('SendPing') > 0) {\r
2648                 ?>\r
2649                         <td><?php echo _EBLOG_PING?> <?php help('sendping'); ?></td>\r
2650                         <td><?php $this->input_yesno('sendping',$blog->sendPing(),85); ?></td>\r
2651                 </tr><tr>\r
2652                 <?php\r
2653                 }\r
2654                 ?>\r
2655                         <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>\r
2656                         <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  htmlspecialchars($blog->getMaxComments()); ?>" /></td>\r
2657                 </tr><tr>\r
2658                         <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>\r
2659                         <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  htmlspecialchars($blog->getUpdateFile()) ?>" /></td>\r
2660                 </tr><tr>\r
2661                         <td><?php echo _EBLOG_DEFCAT?></td>\r
2662                         <td>\r
2663                                 <?php\r
2664                                         $query =  'SELECT cname as text, catid as value'\r
2665                                                    . ' FROM '.sql_table('category')\r
2666                                                    . ' WHERE cblog=' . $blog->getID();\r
2667                                         $template['name'] = 'defcat';\r
2668                                         $template['selected'] = $blog->getDefaultCategory();\r
2669                                         $template['tabindex'] = 110;\r
2670                                         showlist($query,'select',$template);\r
2671                                 ?>\r
2672                         </td>\r
2673                 </tr><tr>\r
2674                         <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>\r
2675                                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  strftime("%H:%M",time()); ?></b>\r
2676                                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  strftime("%H:%M",$blog->getCorrectTime()); ?></b>\r
2677                                 </td>\r
2678                         <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  htmlspecialchars($blog->getTimeOffset()); ?>" /></td>\r
2679                 </tr><tr>\r
2680                         <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>\r
2681                         <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>\r
2682                 </tr>\r
2683                 <?php\r
2684                         // plugin options\r
2685                         $this->_insertPluginOptions('blog',$blogid);\r
2686                 ?>\r
2687                 <tr>\r
2688                         <th colspan="2"><?php echo _EBLOG_CHANGE?></th>\r
2689                 </tr><tr>\r
2690                         <td><?php echo _EBLOG_CHANGE?></td>\r
2691                         <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>\r
2692                 </tr></table>\r
2693 \r
2694                 </div></form>\r
2695 \r
2696                 <h3><?php echo _EBLOG_CAT_TITLE?></h3>\r
2697 \r
2698 \r
2699                 <?php\r
2700                 $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';\r
2701                 $template['content'] = 'categorylist';\r
2702                 $template['tabindex'] = 200;\r
2703 \r
2704                 $manager->loadClass("ENCAPSULATE");\r
2705                 $batch =& new BATCH('category');\r
2706                 $batch->showlist($query,'table',$template);\r
2707 \r
2708                 ?>\r
2709 \r
2710 \r
2711                 <form action="index.php" method="post"><div>\r
2712                 <input name="action" value="categorynew" type="hidden" />\r
2713                 <?php $manager->addTicketHidden() ?>\r
2714                 <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />\r
2715 \r
2716                 <table><tr>\r
2717                         <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>\r
2718                 </tr><tr>\r
2719                         <td><?php echo _EBLOG_CAT_NAME?></td>\r
2720                         <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>\r
2721                 </tr><tr>\r
2722                         <td><?php echo _EBLOG_CAT_DESC?></td>\r
2723                         <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>\r
2724                 </tr><tr>\r
2725                         <td><?php echo _EBLOG_CAT_CREATE?></td>\r
2726                         <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>\r
2727                 </tr></table>\r
2728 \r
2729                 </div></form>\r
2730 \r
2731                 <?php\r
2732 \r
2733                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';\r
2734 \r
2735                         $manager->notify(\r
2736                                 'BlogSettingsFormExtras',\r
2737                                 array(\r
2738                                         'blog' => &$blog\r
2739                                 )\r
2740                         );\r
2741 \r
2742                 $this->pagefoot();\r
2743         }\r
2744 \r
2745         /**\r
2746          * @todo document this\r
2747          */\r
2748         function action_categorynew() {\r
2749                 global $member, $manager;\r
2750 \r
2751                 $blogid = intRequestVar('blogid');\r
2752 \r
2753                 $member->blogAdminRights($blogid) or $this->disallow();\r
2754 \r
2755                 $cname = postVar('cname');\r
2756                 $cdesc = postVar('cdesc');\r
2757 \r
2758                 if (!isValidCategoryName($cname))\r
2759                         $this->error(_ERROR_BADCATEGORYNAME);\r
2760 \r
2761                 $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . addslashes($cname).'\' and cblog=' . intval($blogid);\r
2762                 $res = sql_query($query);\r
2763                 if (mysql_num_rows($res) > 0)\r
2764                         $this->error(_ERROR_DUPCATEGORYNAME);\r
2765 \r
2766                 $blog           =& $manager->getBlog($blogid);\r
2767                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2768 \r
2769                 $this->action_blogsettings();\r
2770         }\r
2771 \r
2772         /**\r
2773          * @todo document this\r
2774          */\r
2775         function action_categoryedit($catid = '', $blogid = '', $desturl = '') {\r
2776                 global $member, $manager;\r
2777 \r
2778                 if ($blogid == '')\r
2779                         $blogid = intGetVar('blogid');\r
2780                 else\r
2781                         $blogid = intval($blogid);\r
2782                 if ($catid == '')\r
2783                         $catid = intGetVar('catid');\r
2784                 else\r
2785                         $catid = intval($catid);\r
2786 \r
2787                 $member->blogAdminRights($blogid) or $this->disallow();\r
2788 \r
2789                 $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");\r
2790                 $obj = mysql_fetch_object($res);\r
2791 \r
2792                 $cname = $obj->cname;\r
2793                 $cdesc = $obj->cdesc;\r
2794 \r
2795                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2796                 $this->pagehead($extrahead);\r
2797 \r
2798                 echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";\r
2799 \r
2800                 ?>\r
2801                 <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo htmlspecialchars($cname)?>'</h2>\r
2802                 <form method='post' action='index.php'><div>\r
2803                 <input name="blogid" type="hidden" value="<?php echo $blogid?>" />\r
2804                 <input name="catid" type="hidden" value="<?php echo $catid?>" />\r
2805                 <input name="desturl" type="hidden" value="<?php echo htmlspecialchars($desturl) ?>" />\r
2806                 <input name="action" type="hidden" value="categoryupdate" />\r
2807                 <?php $manager->addTicketHidden(); ?>\r
2808 \r
2809                 <table><tr>\r
2810                         <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>\r
2811                 </tr><tr>\r
2812                         <td><?php echo _EBLOG_CAT_NAME?></td>\r
2813                         <td><input type="text" name="cname" value="<?php echo htmlspecialchars($cname)?>" size="40" maxlength="40" /></td>\r
2814                 </tr><tr>\r
2815                         <td><?php echo _EBLOG_CAT_DESC?></td>\r
2816                         <td><input type="text" name="cdesc" value="<?php echo htmlspecialchars($cdesc)?>" size="40" maxlength="200" /></td>\r
2817                 </tr>\r
2818                 <?php\r
2819                         // insert plugin options\r
2820                         $this->_insertPluginOptions('category',$catid);\r
2821                 ?>\r
2822                 <tr>\r
2823                         <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>\r
2824                 </tr><tr>\r
2825                         <td><?php echo _EBLOG_CAT_UPDATE?></td>\r
2826                         <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>\r
2827                 </tr></table>\r
2828 \r
2829                 </div></form>\r
2830                 <?php\r
2831                 $this->pagefoot();\r
2832         }\r
2833 \r
2834         /**\r
2835          * @todo document this\r
2836          */\r
2837         function action_categoryupdate() {\r
2838                 global $member, $manager;\r
2839 \r
2840                 $blogid = intPostVar('blogid');\r
2841                 $catid = intPostVar('catid');\r
2842                 $cname = postVar('cname');\r
2843                 $cdesc = postVar('cdesc');\r
2844                 $desturl = postVar('desturl');\r
2845 \r
2846                 $member->blogAdminRights($blogid) or $this->disallow();\r
2847 \r
2848                 if (!isValidCategoryName($cname))\r
2849                         $this->error(_ERROR_BADCATEGORYNAME);\r
2850 \r
2851                 $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . addslashes($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";\r
2852                 $res = sql_query($query);\r
2853                 if (mysql_num_rows($res) > 0)\r
2854                         $this->error(_ERROR_DUPCATEGORYNAME);\r
2855 \r
2856                 $query =  'UPDATE '.sql_table('category').' SET'\r
2857                            . " cname='" . addslashes($cname) . "',"\r
2858                            . " cdesc='" . addslashes($cdesc) . "'"\r
2859                            . " WHERE catid=" . $catid;\r
2860 \r
2861                 sql_query($query);\r
2862 \r
2863                 // store plugin options\r
2864                 $aOptions = requestArray('plugoption');\r
2865                 NucleusPlugin::_applyPluginOptions($aOptions);\r
2866                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));\r
2867 \r
2868 \r
2869                 if ($desturl) {\r
2870                         redirect($desturl);\r
2871                         exit;\r
2872                 } else {\r
2873                         $this->action_blogsettings();\r
2874                 }\r
2875         }\r
2876 \r
2877         /**\r
2878          * @todo document this\r
2879          */\r
2880         function action_categorydelete() {\r
2881                 global $member, $manager;\r
2882 \r
2883                 $blogid = intRequestVar('blogid');\r
2884                 $catid = intRequestVar('catid');\r
2885 \r
2886                 $member->blogAdminRights($blogid) or $this->disallow();\r
2887 \r
2888                 $blog =& $manager->getBlog($blogid);\r
2889 \r
2890                 // check if the category is valid\r
2891                 if (!$blog->isValidCategory($catid))\r
2892                         $this->error(_ERROR_NOSUCHCATEGORY);\r
2893 \r
2894                 // don't allow deletion of default category\r
2895                 if ($blog->getDefaultCategory() == $catid)\r
2896                         $this->error(_ERROR_DELETEDEFCATEGORY);\r
2897 \r
2898                 // check if catid is the only category left for blogid\r
2899                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;\r
2900                 $res = sql_query($query);\r
2901                 if (mysql_num_rows($res) == 1)\r
2902                         $this->error(_ERROR_DELETELASTCATEGORY);\r
2903 \r
2904 \r
2905                 $this->pagehead();\r
2906                 ?>\r
2907                         <h2><?php echo _DELETE_CONFIRM?></h2>\r
2908 \r
2909                         <div>\r
2910                         <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  htmlspecialchars($blog->getCategoryName($catid))?></b>\r
2911                         </div>\r
2912 \r
2913                         <form method="post" action="index.php"><div>\r
2914                         <input type="hidden" name="action" value="categorydeleteconfirm" />\r
2915                         <?php $manager->addTicketHidden() ?>\r
2916                         <input type="hidden" name="blogid" value="<?php echo $blogid?>" />\r
2917                         <input type="hidden" name="catid" value="<?php echo $catid?>" />\r
2918                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
2919                         </div></form>\r
2920                 <?php\r
2921                 $this->pagefoot();\r
2922         }\r
2923 \r
2924         /**\r
2925          * @todo document this\r
2926          */\r
2927         function action_categorydeleteconfirm() {\r
2928                 global $member, $manager;\r
2929 \r
2930                 $blogid = intRequestVar('blogid');\r
2931                 $catid = intRequestVar('catid');\r
2932 \r
2933                 $member->blogAdminRights($blogid) or $this->disallow();\r
2934 \r
2935                 $error = $this->deleteOneCategory($catid);\r
2936                 if ($error)\r
2937                         $this->error($error);\r
2938 \r
2939                 $this->action_blogsettings();\r
2940         }\r
2941 \r
2942         /**\r
2943          * @todo document this\r
2944          */\r
2945         function deleteOneCategory($catid) {\r
2946                 global $manager, $member;\r
2947 \r
2948                 $catid = intval($catid);\r
2949 \r
2950                 $manager->notify('PreDeleteCategory', array('catid' => $catid));\r
2951 \r
2952                 $blogid = getBlogIDFromCatID($catid);\r
2953 \r
2954                 if (!$member->blogAdminRights($blogid))\r
2955                         return ERROR_DISALLOWED;\r
2956 \r
2957                 // get blog\r
2958                 $blog =& $manager->getBlog($blogid);\r
2959 \r
2960                 // check if the category is valid\r
2961                 if (!$blog || !$blog->isValidCategory($catid))\r
2962                         return _ERROR_NOSUCHCATEGORY;\r
2963 \r
2964                 $destcatid = $blog->getDefaultCategory();\r
2965 \r
2966                 // don't allow deletion of default category\r
2967                 if ($blog->getDefaultCategory() == $catid)\r
2968                         return _ERROR_DELETEDEFCATEGORY;\r
2969 \r
2970                 // check if catid is the only category left for blogid\r
2971                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;\r
2972                 $res = sql_query($query);\r
2973                 if (mysql_num_rows($res) == 1)\r
2974                         return _ERROR_DELETELASTCATEGORY;\r
2975 \r
2976                 // change category for all items to the default category\r
2977                 $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";\r
2978                 sql_query($query);\r
2979 \r
2980                 // delete all associated plugin options\r
2981                 NucleusPlugin::_deleteOptionValues('category', $catid);\r
2982 \r
2983                 // delete category\r
2984                 $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;\r
2985                 sql_query($query);\r
2986 \r
2987                 $manager->notify('PostDeleteCategory', array('catid' => $catid));\r
2988 \r
2989         }\r
2990 \r
2991         /**\r
2992          * @todo document this\r
2993          */\r
2994         function moveOneCategory($catid, $destblogid) {\r
2995                 global $manager, $member;\r
2996 \r
2997                 $catid = intval($catid);\r
2998                 $destblogid = intval($destblogid);\r
2999 \r
3000                 $blogid = getBlogIDFromCatID($catid);\r
3001 \r
3002                 // mover should have admin rights on both blogs\r
3003                 if (!$member->blogAdminRights($blogid))\r
3004                         return _ERROR_DISALLOWED;\r
3005                 if (!$member->blogAdminRights($destblogid))\r
3006                         return _ERROR_DISALLOWED;\r
3007 \r
3008                 // cannot move to self\r
3009                 if ($blogid == $destblogid)\r
3010                         return _ERROR_MOVETOSELF;\r
3011 \r
3012                 // get blogs\r
3013                 $blog =& $manager->getBlog($blogid);\r
3014                 $destblog =& $manager->getBlog($destblogid);\r
3015 \r
3016                 // check if the category is valid\r
3017                 if (!$blog || !$blog->isValidCategory($catid))\r
3018                         return _ERROR_NOSUCHCATEGORY;\r
3019 \r
3020                 // don't allow default category to be moved\r
3021                 if ($blog->getDefaultCategory() == $catid)\r
3022                         return _ERROR_MOVEDEFCATEGORY;\r
3023 \r
3024                 $manager->notify(\r
3025                         'PreMoveCategory',\r
3026                         array(\r
3027                                 'catid' => &$catid,\r
3028                                 'sourceblog' => &$blog,\r
3029                                 'destblog' => &$destblog\r
3030                         )\r
3031                 );\r
3032 \r
3033                 // update comments table (cblog)\r
3034                 $query = 'SELECT inumber FROM '.sql_table('item').' WHERE icat='.$catid;\r
3035                 $items = sql_query($query);\r
3036                 while ($oItem = mysql_fetch_object($items)) {\r
3037                         sql_query('UPDATE '.sql_table('comment').' SET cblog='.$destblogid.' WHERE citem='.$oItem->inumber);\r
3038                 }\r
3039 \r
3040                 // update items (iblog)\r
3041                 $query = 'UPDATE '.sql_table('item').' SET iblog='.$destblogid.' WHERE icat='.$catid;\r
3042                 sql_query($query);\r
3043 \r
3044                 // move category\r
3045                 $query = 'UPDATE '.sql_table('category').' SET cblog='.$destblogid.' WHERE catid='.$catid;\r
3046                 sql_query($query);\r
3047 \r
3048                 $manager->notify(\r
3049                         'PostMoveCategory',\r
3050                         array(\r
3051                                 'catid' => &$catid,\r
3052                                 'sourceblog' => &$blog,\r
3053                                 'destblog' => $destblog\r
3054                         )\r
3055                 );\r
3056 \r
3057         }\r
3058 \r
3059         /**\r
3060          * @todo document this\r
3061          */\r
3062         function action_blogsettingsupdate() {\r
3063                 global $member, $manager;\r
3064 \r
3065                 $blogid = intRequestVar('blogid');\r
3066 \r
3067                 $member->blogAdminRights($blogid) or $this->disallow();\r
3068 \r
3069                 $blog =& $manager->getBlog($blogid);\r
3070 \r
3071                 $notify                 = trim(postVar('notify'));\r
3072                 $shortname              = trim(postVar('shortname'));\r
3073                 $updatefile             = trim(postVar('update'));\r
3074 \r
3075                 $notifyComment  = intPostVar('notifyComment');\r
3076                 $notifyVote             = intPostVar('notifyVote');\r
3077                 $notifyNewItem  = intPostVar('notifyNewItem');\r
3078 \r
3079                 if ($notifyComment == 0)        $notifyComment = 1;\r
3080                 if ($notifyVote == 0)           $notifyVote = 1;\r
3081                 if ($notifyNewItem == 0)        $notifyNewItem = 1;\r
3082 \r
3083                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
3084 \r
3085 \r
3086                 if ($notify) {\r
3087                         $not =& new NOTIFICATION($notify);\r
3088                         if (!$not->validAddresses())\r
3089                                 $this->error(_ERROR_BADNOTIFY);\r
3090 \r
3091                 }\r
3092 \r
3093                 if (!isValidShortName($shortname))\r
3094                         $this->error(_ERROR_BADSHORTBLOGNAME);\r
3095 \r
3096                 if (($blog->getShortName() != $shortname) && $manager->existsBlog($shortname))\r
3097                         $this->error(_ERROR_DUPSHORTBLOGNAME);\r
3098 \r
3099                 // check if update file is writable\r
3100                 if ($updatefile && !is_writeable($updatefile))\r
3101                         $this->error(_ERROR_UPDATEFILE);\r
3102 \r
3103                 $blog->setName(trim(postVar('name')));\r
3104                 $blog->setShortName($shortname);\r
3105                 $blog->setNotifyAddress($notify);\r
3106                 $blog->setNotifyType($notifyType);\r
3107                 $blog->setMaxComments(postVar('maxcomments'));\r
3108                 $blog->setCommentsEnabled(postVar('comments'));\r
3109                 $blog->setTimeOffset(postVar('timeoffset'));\r
3110                 $blog->setUpdateFile($updatefile);\r
3111                 $blog->setURL(trim(postVar('url')));\r
3112                 $blog->setDefaultSkin(intPostVar('defskin'));\r
3113                 $blog->setDescription(trim(postVar('desc')));\r
3114                 $blog->setPublic(postVar('public'));\r
3115                 $blog->setPingUserland(postVar('sendping'));\r
3116                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
3117                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
3118                 $blog->setDefaultCategory(intPostVar('defcat'));\r
3119                 $blog->setSearchable(intPostVar('searchable'));\r
3120                 $blog->setEmailRequired(intPostVar('reqemail'));\r
3121 \r
3122                 $blog->writeSettings();\r
3123 \r
3124                 // store plugin options\r
3125                 $aOptions = requestArray('plugoption');\r
3126                 NucleusPlugin::_applyPluginOptions($aOptions);\r
3127                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));\r
3128 \r
3129 \r
3130                 $this->action_overview(_MSG_SETTINGSCHANGED);\r
3131         }\r
3132 \r
3133         /**\r
3134          * @todo document this\r
3135          */\r
3136         function action_deleteblog() {\r
3137                 global $member, $CONF, $manager;\r
3138 \r
3139                 $blogid = intRequestVar('blogid');\r
3140 \r
3141                 $member->blogAdminRights($blogid) or $this->disallow();\r
3142 \r
3143                 // check if blog is default blog\r
3144                 if ($CONF['DefaultBlog'] == $blogid)\r
3145                         $this->error(_ERROR_DELDEFBLOG);\r
3146 \r
3147                 $blog =& $manager->getBlog($blogid);\r
3148 \r
3149                 $this->pagehead();\r
3150                 ?>\r
3151                         <h2><?php echo _DELETE_CONFIRM?></h2>\r
3152 \r
3153                         <p><?php echo _WARNINGTXT_BLOGDEL?>\r
3154                         </p>\r
3155 \r
3156                         <div>\r
3157                         <?php echo _CONFIRMTXT_BLOG?><b><?php echo  htmlspecialchars($blog->getName())?></b>\r
3158                         </div>\r
3159 \r
3160                         <form method="post" action="index.php"><div>\r
3161                         <input type="hidden" name="action" value="deleteblogconfirm" />\r
3162                         <?php $manager->addTicketHidden() ?>\r
3163                         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />\r
3164                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
3165                         </div></form>\r
3166                 <?php\r
3167                 $this->pagefoot();\r
3168         }\r
3169 \r
3170         /**\r
3171          * @todo document this\r
3172          */\r
3173         function action_deleteblogconfirm() {\r
3174                 global $member, $CONF, $manager;\r
3175 \r
3176                 $blogid = intRequestVar('blogid');\r
3177 \r
3178                 $manager->notify('PreDeleteBlog', array('blogid' => $blogid));\r
3179 \r
3180                 $member->blogAdminRights($blogid) or $this->disallow();\r
3181 \r
3182                 // check if blog is default blog\r
3183                 if ($CONF['DefaultBlog'] == $blogid)\r
3184                         $this->error(_ERROR_DELDEFBLOG);\r
3185 \r
3186                 // delete all comments\r
3187                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;\r
3188                 sql_query($query);\r
3189 \r
3190                 // delete all items\r
3191                 $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;\r
3192                 sql_query($query);\r
3193 \r
3194                 // delete all team members\r
3195                 $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;\r
3196                 sql_query($query);\r
3197 \r
3198                 // delete all bans\r
3199                 $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;\r
3200                 sql_query($query);\r
3201 \r
3202                 // delete all categories\r
3203                 $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;\r
3204                 sql_query($query);\r
3205 \r
3206                 // delete all associated plugin options\r
3207                 NucleusPlugin::_deleteOptionValues('blog', $blogid);\r
3208 \r
3209                 // delete the blog itself\r
3210                 $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;\r
3211                 sql_query($query);\r
3212 \r
3213                 $manager->notify('PostDeleteBlog', array('blogid' => $blogid));\r
3214 \r
3215                 $this->action_overview(_DELETED_BLOG);\r
3216         }\r
3217 \r
3218         /**\r
3219          * @todo document this\r
3220          */\r
3221         function action_memberdelete() {\r
3222                 global $member, $manager;\r
3223 \r
3224                 $memberid = intRequestVar('memberid');\r
3225 \r
3226                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();\r
3227 \r
3228                 $mem = MEMBER::createFromID($memberid);\r
3229 \r
3230                 $this->pagehead();\r
3231                 ?>\r
3232                         <h2><?php echo _DELETE_CONFIRM?></h2>\r
3233 \r
3234                         <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo htmlspecialchars($mem->getDisplayName()) ?></b>\r
3235                         </p>\r
3236 \r
3237                         <p>\r
3238                         <?php echo _WARNINGTXT_NOTDELMEDIAFILES ?>\r
3239                         </p>\r
3240 \r
3241                         <form method="post" action="index.php"><div>\r
3242                         <input type="hidden" name="action" value="memberdeleteconfirm" />\r
3243                         <?php $manager->addTicketHidden() ?>\r
3244                         <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />\r
3245                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
3246                         </div></form>\r
3247                 <?php\r
3248                 $this->pagefoot();\r
3249         }\r
3250 \r
3251         /**\r
3252          * @todo document this\r
3253          */\r
3254         function action_memberdeleteconfirm() {\r
3255                 global $member;\r
3256 \r
3257                 $memberid = intRequestVar('memberid');\r
3258 \r
3259                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();\r
3260 \r
3261                 $error = $this->deleteOneMember($memberid);\r
3262                 if ($error)\r
3263                         $this->error($error);\r
3264 \r
3265                 if ($member->isAdmin())\r
3266                         $this->action_usermanagement();\r
3267                 else\r
3268                         $this->action_overview(_DELETED_MEMBER);\r
3269         }\r
3270 \r
3271         /**\r
3272          * @static\r
3273          * @todo document this\r
3274          */\r
3275         function deleteOneMember($memberid) {\r
3276                 global $manager;\r
3277 \r
3278                 $memberid = intval($memberid);\r
3279                 $mem = MEMBER::createFromID($memberid);\r
3280 \r
3281                 if (!$mem->canBeDeleted())\r
3282                         return _ERROR_DELETEMEMBER;\r
3283 \r
3284                 $manager->notify('PreDeleteMember', array('member' => &$mem));\r
3285 \r
3286                 /* unlink comments from memberid */\r
3287                 if ($memberid) {\r
3288                         $query = 'UPDATE ' . sql_table('comment') . ' SET cmember="0", cuser="'. addslashes($mem->getDisplayName())\r
3289                                    .'" WHERE cmember='.$memberid;\r
3290                         sql_query($query);\r
3291                 }\r
3292 \r
3293                 $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;\r
3294                 sql_query($query);\r
3295 \r
3296                 $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;\r
3297                 sql_query($query);\r
3298 \r
3299                 $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;\r
3300                 sql_query($query);\r
3301 \r
3302                 // delete all associated plugin options\r
3303                 NucleusPlugin::_deleteOptionValues('member', $memberid);\r
3304 \r
3305                 $manager->notify('PostDeleteMember', array('member' => &$mem));\r
3306 \r
3307                 return '';\r
3308         }\r
3309 \r
3310         /**\r
3311          * @todo document this\r
3312          */\r
3313         function action_createnewlog() {\r
3314                 global $member, $CONF, $manager;\r
3315 \r
3316                 // Only Super-Admins can do this\r
3317                 $member->isAdmin() or $this->disallow();\r
3318 \r
3319                 $this->pagehead();\r
3320 \r
3321                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
3322                 ?>\r
3323                 <h2><?php echo _EBLOG_CREATE_TITLE?></h2>\r
3324 \r
3325                 <h3><?php echo _ADMIN_NOTABILIA ?></h3>\r
3326 \r
3327                 <p><?php echo _ADMIN_PLEASE_READ ?></p>\r
3328 \r
3329                 <p><?php echo _ADMIN_HOW_TO_ACCESS ?></p>\r
3330 \r
3331                 <ol>\r
3332                         <li><?php echo _ADMIN_SIMPLE_WAY ?></li>\r
3333                         <li><?php echo _ADMIN_ADVANCED_WAY ?></li>\r
3334                 </ol>\r
3335 \r
3336                 <h3><?php echo _ADMIN_HOW_TO_CREATE ?></h3>\r
3337 \r
3338                 <p>\r
3339                 <?php echo _EBLOG_CREATE_TEXT?>\r
3340                 </p>\r
3341 \r
3342                 <form method="post" action="index.php"><div>\r
3343 \r
3344                 <input type="hidden" name="action" value="addnewlog" />\r
3345                 <?php $manager->addTicketHidden() ?>\r
3346 \r
3347 \r
3348                 <table><tr>\r
3349                         <td><?php echo _EBLOG_NAME?></td>\r
3350                         <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>\r
3351                 </tr><tr>\r
3352                         <td><?php echo _EBLOG_SHORTNAME?>\r
3353                                 <?php help('shortblogname'); ?>\r
3354                         </td>\r
3355                         <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>\r
3356                 </tr><tr>\r
3357                         <td><?php echo _EBLOG_DESC?></td>\r
3358                         <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>\r
3359                 </tr><tr>\r
3360                         <td><?php echo _EBLOG_DEFSKIN?>\r
3361                                 <?php help('blogdefaultskin'); ?>\r
3362                         </td>\r
3363                         <td>\r
3364                                 <?php\r
3365                                         $query =  'SELECT sdname as text, sdnumber as value'\r
3366                                                    . ' FROM '.sql_table('skin_desc');\r
3367                                         $template['name'] = 'defskin';\r
3368                                         $template['tabindex'] = 50;\r
3369                                         $template['selected'] = $CONF['BaseSkin'];      // set default selected skin to be globally defined base skin\r
3370                                         showlist($query,'select',$template);\r
3371                                 ?>\r
3372                         </td>\r
3373                 </tr><tr>\r
3374                         <td><?php echo _EBLOG_OFFSET?>\r
3375                                 <?php help('blogtimeoffset'); ?>\r
3376                                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  strftime("%H:%M",time()); ?></b>\r
3377                         </td>\r
3378                         <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>\r
3379                 </tr><tr>\r
3380                         <td><?php echo _EBLOG_ADMIN?>\r
3381                                 <?php help('teamadmin'); ?>\r
3382                         </td>\r
3383                         <td><?php echo _EBLOG_ADMIN_MSG?></td>\r
3384                 </tr><tr>\r
3385                         <td><?php echo _EBLOG_CREATE?></td>\r
3386                         <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>\r
3387                 </tr></table>\r
3388 \r
3389                 </div></form>\r
3390                 <?php\r
3391                 $this->pagefoot();\r
3392         }\r
3393 \r
3394         /**\r
3395          * @todo document this\r
3396          */\r
3397         function action_addnewlog() {\r
3398                 global $member, $manager, $CONF;\r
3399 \r
3400                 // Only Super-Admins can do this\r
3401                 $member->isAdmin() or $this->disallow();\r
3402 \r
3403                 $bname                  = trim(postVar('name'));\r
3404                 $bshortname             = trim(postVar('shortname'));\r
3405                 $btimeoffset    = postVar('timeoffset');\r
3406                 $bdesc                  = trim(postVar('desc'));\r
3407                 $bdefskin               = postVar('defskin');\r
3408 \r
3409                 if (!isValidShortName($bshortname))\r
3410                         $this->error(_ERROR_BADSHORTBLOGNAME);\r
3411 \r
3412                 if ($manager->existsBlog($bshortname))\r
3413                         $this->error(_ERROR_DUPSHORTBLOGNAME);\r
3414 \r
3415                 $manager->notify(\r
3416                         'PreAddBlog',\r
3417                         array(\r
3418                                 'name'        => &$bname,\r
3419                                 'shortname'   => &$bshortname,\r
3420                                 'timeoffset'  => &$btimeoffset,\r
3421                                 'description' => &$bdesc,\r
3422                                 'defaultskin' => &$bdefskin\r
3423                         )\r
3424                 );\r
3425 \r
3426 \r
3427                 // add slashes for sql queries\r
3428                 $bname       = addslashes($bname);\r
3429                 $bshortname  = addslashes($bshortname);\r
3430                 $btimeoffset = addslashes($btimeoffset);\r
3431                 $bdesc       = addslashes($bdesc);\r
3432                 $bdefskin    = addslashes($bdefskin);\r
3433 \r
3434                 // create blog\r
3435                 $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";\r
3436                 sql_query($query);\r
3437                 $blogid = mysql_insert_id();\r
3438                 $blog   =& $manager->getBlog($blogid);\r
3439 \r
3440                 // create new category\r
3441                 $sql = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';\r
3442                 sql_query(sprintf($sql, sql_table('category'), $blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC));\r
3443 //              sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC)");\r
3444                 $catid = mysql_insert_id();\r
3445 \r
3446                 // set as default category\r
3447                 $blog->setDefaultCategory($catid);\r
3448                 $blog->writeSettings();\r
3449 \r
3450                 // create team member\r
3451                 $memberid = $member->getID();\r
3452                 $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";\r
3453                 sql_query($query);\r
3454 \r
3455 \r
3456                 $blog->additem($blog->getDefaultCategory(),_EBLOG_FIRSTITEM_TITLE,_EBLOG_FIRSTITEM_BODY,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);\r
3457 \r
3458                 $manager->notify(\r
3459                         'PostAddBlog',\r
3460                         array(\r
3461                                 'blog' => &$blog\r
3462                         )\r
3463                 );\r
3464 \r
3465                 $manager->notify(\r
3466                         'PostAddCategory',\r
3467                         array(\r
3468                                 'blog'        => &$blog,\r
3469                                 'name'        => _EBLOGDEFAULTCATEGORY_NAME,\r
3470                                 'description' => _EBLOGDEFAULTCATEGORY_DESC,\r
3471                                 'catid'       => $catid\r
3472                         )\r
3473                 );\r
3474 \r
3475                 $this->pagehead();\r
3476                 ?>\r
3477                 <h2><?php echo _BLOGCREATED_TITLE ?></h2>\r
3478 \r
3479                 <p><?php echo sprintf(_BLOGCREATED_ADDEDTXT, htmlspecialchars($bname)) ?></p>\r
3480 \r
3481                 <ol>\r
3482                         <li><a href="#index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEWAY, htmlspecialchars($bshortname)) ?></a></li>\r
3483                         <li><a href="#skins"><?php echo _BLOGCREATED_ADVANCEDWAY ?></a></li>\r
3484                 </ol>\r
3485 \r
3486                 <h3><a id="index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEDESC1, htmlspecialchars($bshortname)) ?></a></h3>\r
3487 \r
3488                 <p><?php echo sprintf(_BLOGCREATED_SIMPLEDESC2, htmlspecialchars($bshortname)) ?></p>\r
3489 <pre><code>&lt;?php\r
3490 \r
3491 $CONF['Self'] = '<b><?php echo htmlspecialchars($bshortname)?>.php</b>';\r
3492 \r
3493 include('<i>./config.php</i>');\r
3494 \r
3495 selectBlog('<b><?php echo htmlspecialchars($bshortname)?></b>');\r
3496 selector();\r
3497 \r
3498 ?&gt;</code></pre>\r
3499 \r
3500                 <p><?php echo _BLOGCREATED_SIMPLEDESC3 ?></p>\r
3501 \r
3502                 <p><?php echo _BLOGCREATED_SIMPLEDESC4 ?></p>\r
3503 \r
3504                 <form action="index.php" method="post"><div>\r
3505                         <input type="hidden" name="action" value="addnewlog2" />\r
3506                         <?php $manager->addTicketHidden() ?>\r
3507                         <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />\r
3508                         <table><tr>\r
3509                                 <td><?php echo _EBLOG_URL?></td>\r
3510                                 <td><input name="url" maxlength="100" size="40" value="<?php echo htmlspecialchars($CONF['IndexURL'].$bshortname.'.php')?>" /></td>\r
3511                         </tr><tr>\r
3512                                 <td><?php echo _EBLOG_CREATE?></td>\r
3513                                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>\r
3514                         </tr></table>\r
3515                 </div></form>\r
3516 \r
3517                 <h3><a id="skins"><?php echo _BLOGCREATED_ADVANCEDWAY2 ?></a></h3>\r
3518 \r
3519                 <p><?php echo _BLOGCREATED_ADVANCEDWAY3 ?></p>\r
3520 \r
3521                 <form action="index.php" method="post"><div>\r
3522                         <input type="hidden" name="action" value="addnewlog2" />\r
3523                         <?php $manager->addTicketHidden() ?>\r
3524                         <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />\r
3525                         <table><tr>\r
3526                                 <td><?php echo _EBLOG_URL?></td>\r
3527                                 <td><input name="url" maxlength="100" size="40" /></td>\r
3528                         </tr><tr>\r
3529                                 <td><?php echo _EBLOG_CREATE?></td>\r
3530                                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>\r
3531                         </tr></table>\r
3532                 </div></form>\r
3533 \r
3534                 <?php           $this->pagefoot();\r
3535 \r
3536         }\r
3537 \r
3538         /**\r
3539          * @todo document this\r
3540          */\r
3541         function action_addnewlog2() {\r
3542                 global $member, $manager;\r
3543 \r
3544                 $member->blogAdminRights($blogid) or $this->disallow();\r
3545 \r
3546                 $burl   = requestVar('url');\r
3547                 $blogid = intRequestVar('blogid');\r
3548 \r
3549                 $blog =& $manager->getBlog($blogid);\r
3550                 $blog->setURL(trim($burl));\r
3551                 $blog->writeSettings();\r
3552 \r
3553                 $this->action_overview(_MSG_NEWBLOG);\r
3554         }\r
3555 \r
3556         /**\r
3557          * @todo document this\r
3558          */\r
3559         function action_skinieoverview() {\r
3560                 global $member, $DIR_LIBS, $manager;\r
3561 \r
3562                 $member->isAdmin() or $this->disallow();\r
3563 \r
3564                 // load skinie class\r
3565                 include_once($DIR_LIBS . 'skinie.php');\r
3566 \r
3567                 $this->pagehead();\r
3568 \r
3569                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
3570 \r
3571         ?>\r
3572                 <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>\r
3573 \r
3574                                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>\r
3575                                 <?php                                   global $DIR_SKINS;\r
3576 \r
3577                                         $candidates = SKINIMPORT::searchForCandidates($DIR_SKINS);\r
3578 \r
3579                                         if (sizeof($candidates) > 0) {\r
3580                                                 ?>\r
3581                                                         <form method="post" action="index.php"><div>\r
3582                                                                 <input type="hidden" name="action" value="skinieimport" />\r
3583                                                                 <?php $manager->addTicketHidden() ?>\r
3584                                                                 <input type="hidden" name="mode" value="file" />\r
3585                                                                 <select name="skinfile" id="skinie_import_local">\r
3586                                                                 <?php                                                                   foreach ($candidates as $skinname => $skinfile) {\r
3587                                                                                 $html = htmlspecialchars($skinfile);\r
3588                                                                                 echo '<option value="',$html,'">',$skinname,'</option>';\r
3589                                                                         }\r
3590                                                                 ?>\r
3591                                                                 </select>\r
3592                                                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />\r
3593                                                         </div></form>\r
3594                                                 <?php                                   } else {\r
3595                                                 echo _SKINIE_NOCANDIDATES;\r
3596                                         }\r
3597                                 ?>\r
3598                                 </p>\r
3599 \r
3600                                 <p><em><?php echo _OR?></em></p>\r
3601 \r
3602                                 <form method="post" action="index.php"><p>\r
3603                                         <?php $manager->addTicketHidden() ?>\r
3604                                         <input type="hidden" name="action" value="skinieimport" />\r
3605                                         <input type="hidden" name="mode" value="url" />\r
3606                                         <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>\r
3607                                         <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />\r
3608                                         <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />\r
3609                                 </p></form>\r
3610 \r
3611 \r
3612                 <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>\r
3613                 <form method="post" action="index.php"><div>\r
3614                         <input type="hidden" name="action" value="skinieexport" />\r
3615                         <?php $manager->addTicketHidden() ?>\r
3616 \r
3617                         <p><?php echo _SKINIE_EXPORT_INTRO?></p>\r
3618 \r
3619                         <table><tr>\r
3620                                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>\r
3621                         </tr><tr>\r
3622         <?php           // show list of skins\r
3623                 $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));\r
3624                 while ($skinObj = mysql_fetch_object($res)) {\r
3625                         $id = 'skinexp' . $skinObj->sdnumber;\r
3626                         echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';\r
3627                         echo '<label for="',$id,'">',htmlspecialchars($skinObj->sdname),'</label></td>';\r
3628                         echo '<td>',htmlspecialchars($skinObj->sddesc),'</td>';\r
3629                         echo '</tr><tr>';\r
3630                 }\r
3631 \r
3632                 echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';\r
3633 \r
3634                 // show list of templates\r
3635                 $res = sql_query('SELECT * FROM '.sql_table('template_desc'));\r
3636                 while ($templateObj = mysql_fetch_object($res)) {\r
3637                         $id = 'templateexp' . $templateObj->tdnumber;\r
3638                         echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';\r
3639                         echo '<label for="',$id,'">',htmlspecialchars($templateObj->tdname),'</label></td>';\r
3640                         echo '<td>',htmlspecialchars($templateObj->tddesc),'</td>';\r
3641                         echo '</tr><tr>';\r
3642                 }\r
3643 \r
3644         ?>\r
3645                                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>\r
3646                         </tr><tr>\r
3647                                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>\r
3648                         </tr><tr>\r
3649                                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>\r
3650                         </tr><tr>\r
3651                                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>\r
3652                         </tr></table>\r
3653                 </div></form>\r
3654 \r
3655         <?php\r
3656                 $this->pagefoot();\r
3657 \r
3658         }\r
3659 \r
3660         /**\r
3661          * @todo document this\r
3662          */\r
3663         function action_skinieimport() {\r
3664                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
3665 \r
3666                 $member->isAdmin() or $this->disallow();\r
3667 \r
3668                 // load skinie class\r
3669                 include_once($DIR_LIBS . 'skinie.php');\r
3670 \r
3671                 $skinFileRaw= postVar('skinfile');\r
3672                 $mode           = postVar('mode');\r
3673 \r
3674                 $importer =& new SKINIMPORT();\r
3675 \r
3676                 // get full filename\r
3677                 if ($mode == 'file')\r
3678                 {\r
3679                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
3680 \r
3681                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
3682                         if (!file_exists($skinFile))\r
3683                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
3684                 } else {\r
3685                         $skinFile = $skinFileRaw;\r
3686                 }\r
3687 \r
3688                 // read only metadata\r
3689                 $error = $importer->readFile($skinFile, 1);\r
3690 \r
3691                 // clashes\r
3692                 $skinNameClashes = $importer->checkSkinNameClashes();\r
3693                 $templateNameClashes = $importer->checkTemplateNameClashes();\r
3694                 $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
3695 \r
3696                 if ($error) $this->error($error);\r
3697 \r
3698                 $this->pagehead();\r
3699 \r
3700                 echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';\r
3701                 ?>\r
3702                 <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>\r
3703 \r
3704                 <ul>\r
3705                         <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo htmlspecialchars($importer->getInfo())?></p></li>\r
3706                         <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>\r
3707                         <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>\r
3708                         <?php\r
3709                                 if ($hasNameClashes)\r
3710                                 {\r
3711                         ?>\r
3712                         <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>\r
3713                         <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>\r
3714                         <?php\r
3715                                 } // if (hasNameClashes)\r
3716                         ?>\r
3717                 </ul>\r
3718 \r
3719                 <form method="post" action="index.php"><div>\r
3720                         <input type="hidden" name="action" value="skiniedoimport" />\r
3721                         <?php $manager->addTicketHidden() ?>\r
3722                         <input type="hidden" name="skinfile" value="<?php echo htmlspecialchars(postVar('skinfile'))?>" />\r
3723                         <input type="hidden" name="mode" value="<?php echo htmlspecialchars($mode)?>" />\r
3724                         <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />\r
3725                         <?php\r
3726                                 if ($hasNameClashes)\r
3727                                 {\r
3728                         ?>\r
3729                         <br />\r
3730                         <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>\r
3731                         <?php\r
3732                                 } // if (hasNameClashes)\r
3733                         ?>\r
3734                 </div></form>\r
3735 \r
3736 \r
3737                 <?php\r
3738                 $this->pagefoot();\r
3739         }\r
3740 \r
3741         /**\r
3742          * @todo document this\r
3743          */\r
3744         function action_skiniedoimport() {\r
3745                 global $member, $DIR_LIBS, $DIR_SKINS;\r
3746 \r
3747                 $member->isAdmin() or $this->disallow();\r
3748 \r
3749                 // load skinie class\r
3750                 include_once($DIR_LIBS . 'skinie.php');\r
3751 \r
3752                 $skinFileRaw= postVar('skinfile');\r
3753                 $mode           = postVar('mode');\r
3754 \r
3755                 $allowOverwrite = intPostVar('overwrite');\r
3756 \r
3757                 // get full filename\r
3758                 if ($mode == 'file')\r
3759                 {\r
3760                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
3761 \r
3762                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
3763                         if (!file_exists($skinFile))\r
3764                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
3765 \r
3766                 } else {\r
3767                         $skinFile = $skinFileRaw;\r
3768                 }\r
3769 \r
3770                 $importer =& new SKINIMPORT();\r
3771 \r
3772                 $error = $importer->readFile($skinFile);\r
3773 \r
3774                 if ($error)\r
3775                         $this->error($error);\r
3776 \r
3777                 $error = $importer->writeToDatabase($allowOverwrite);\r
3778 \r
3779                 if ($error)\r
3780                         $this->error($error);\r
3781 \r
3782                 $this->pagehead();\r
3783 \r
3784                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
3785         ?>\r
3786                 <h2><?php echo _SKINIE_DONE?></h2>\r
3787 \r
3788                 <ul>\r
3789                         <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo htmlspecialchars($importer->getInfo())?></p></li>\r
3790                         <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>\r
3791                         <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>\r
3792                 </ul>\r
3793 \r
3794         <?php           $this->pagefoot();\r
3795 \r
3796         }\r
3797 \r
3798         /**\r
3799          * @todo document this\r
3800          */\r
3801         function action_skinieexport() {\r
3802                 global $member, $DIR_LIBS;\r
3803 \r
3804                 $member->isAdmin() or $this->disallow();\r
3805 \r
3806                 // load skinie class\r
3807                 include_once($DIR_LIBS . 'skinie.php');\r
3808 \r
3809                 $aSkins = requestIntArray('skin');\r
3810                 $aTemplates = requestIntArray('template');\r
3811 \r
3812                 if (!is_array($aTemplates)) $aTemplates = array();\r
3813                 if (!is_array($aSkins)) $aSkins = array();\r
3814 \r
3815                 $skinList = array_keys($aSkins);\r
3816                 $templateList = array_keys($aTemplates);\r
3817 \r
3818                 $info = postVar('info');\r
3819 \r
3820                 $exporter =& new SKINEXPORT();\r
3821                 foreach ($skinList as $skinId) {\r
3822                         $exporter->addSkin($skinId);\r
3823                 }\r
3824                 foreach ($templateList as $templateId) {\r
3825                         $exporter->addTemplate($templateId);\r
3826                 }\r
3827                 $exporter->setInfo($info);\r
3828 \r
3829                 $exporter->export();\r
3830         }\r
3831 \r
3832         /**\r
3833          * @todo document this\r
3834          */\r
3835         function action_templateoverview() {\r
3836                 global $member, $manager;\r
3837 \r
3838                 $member->isAdmin() or $this->disallow();\r
3839 \r
3840                 $this->pagehead();\r
3841 \r
3842                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
3843 \r
3844                 echo '<h2>' . _TEMPLATE_TITLE . '</h2>';\r
3845                 echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';\r
3846 \r
3847                 $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';\r
3848                 $template['content'] = 'templatelist';\r
3849                 $template['tabindex'] = 10;\r
3850                 showlist($query,'table',$template);\r
3851 \r
3852                 echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';\r
3853 \r
3854                 ?>\r
3855                 <form method="post" action="index.php"><div>\r
3856 \r
3857                 <input name="action" value="templatenew" type="hidden" />\r
3858                 <?php $manager->addTicketHidden() ?>\r
3859                 <table><tr>\r
3860                         <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>\r
3861                         <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>\r
3862                 </tr><tr>\r
3863                         <td><?php echo _TEMPLATE_DESC?></td>\r
3864                         <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>\r
3865                 </tr><tr>\r
3866                         <td><?php echo _TEMPLATE_CREATE?></td>\r
3867                         <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>\r
3868                 </tr></table>\r
3869 \r
3870                 </div></form>\r
3871 \r
3872                 <?php\r
3873                 $this->pagefoot();\r
3874         }\r
3875 \r
3876         /**\r
3877          * @todo document this\r
3878          */\r
3879         function action_templateedit($msg = '') {\r
3880                 global $member, $manager;\r
3881 \r
3882                 $templateid = intRequestVar('templateid');\r
3883 \r
3884                 $member->isAdmin() or $this->disallow();\r
3885 \r
3886                 $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';\r
3887                 $extrahead .= '<script type="text/javascript">setTemplateEditText("'.addslashes(_EDITTEMPLATE_EMPTY).'");</script>';\r
3888 \r
3889                 $this->pagehead($extrahead);\r
3890 \r
3891                 $templatename = TEMPLATE::getNameFromId($templateid);\r
3892                 $templatedescription = TEMPLATE::getDesc($templateid);\r
3893                 $template =& $manager->getTemplate($templatename);\r
3894 \r
3895                 ?>\r
3896                 <p>\r
3897                 <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>\r
3898                 </p>\r
3899 \r
3900                 <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  htmlspecialchars($templatename); ?>'</h2>\r
3901 \r
3902                 <?php                                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";\r
3903                 ?>\r
3904 \r
3905                 <p><?php echo _TEMPLATE_EDIT_MSG?></p>\r
3906 \r
3907                 <form method="post" action="index.php">\r
3908                 <div>\r
3909 \r
3910                 <input type="hidden" name="action" value="templateupdate" />\r
3911                 <?php $manager->addTicketHidden() ?>\r
3912                 <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />\r
3913 \r
3914                 <table><tr>\r
3915                         <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>\r
3916                 </tr><tr>\r
3917                         <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>\r
3918                         <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  htmlspecialchars($templatename) ?>" /></td>\r
3919                 </tr><tr>\r
3920                         <td><?php echo _TEMPLATE_DESC?></td>\r
3921                         <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  htmlspecialchars($templatedescription) ?>" /></td>\r
3922                 </tr><tr>\r
3923                         <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>\r
3924                 </tr><tr>\r
3925                         <td><?php echo _TEMPLATE_UPDATE?></td>\r
3926                         <td>\r
3927                                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />\r
3928                                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />\r
3929                         </td>\r
3930                 </tr><tr>\r
3931                         <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>\r
3932 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);\r
3933         $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);\r
3934         $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);\r
3935         $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);\r
3936         $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);\r
3937         $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);\r
3938 ?>\r
3939                 </tr><tr>\r
3940                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>\r
3941 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);\r
3942         $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);\r
3943         $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);\r
3944         $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);\r
3945         $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);\r
3946         $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);\r
3947         $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);\r
3948 ?>\r
3949                 </tr><tr>\r
3950                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>\r
3951 <?php\r
3952         $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);\r
3953 ?>\r
3954                 </tr><tr>\r
3955                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>\r
3956 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);\r
3957 ?>\r
3958                 </tr><tr>\r
3959                         <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>\r
3960 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);\r
3961         $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);\r
3962         $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);\r
3963 ?>\r
3964                 </tr><tr>\r
3965                         <th colspan="2"><?php echo _TEMPLATE_BLOGLIST?> <?php help('templatebloglists'); ?></th>\r
3966 <?php   $this->_templateEditRow($template, _TEMPLATE_BLOGHEADER, 'BLOGLIST_HEADER', '', 160);\r
3967         $this->_templateEditRow($template, _TEMPLATE_BLOGITEM, 'BLOGLIST_LISTITEM', '', 170);\r
3968         $this->_templateEditRow($template, _TEMPLATE_BLOGFOOTER, 'BLOGLIST_FOOTER', '', 180);\r
3969 ?>\r
3970                 </tr><tr>\r
3971                         <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>\r
3972 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 190);\r
3973         $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 200);\r
3974         $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 210);\r
3975 ?>\r
3976                 </tr><tr>\r
3977                         <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>\r
3978 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 220);\r
3979         $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 230);\r
3980         $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 240);\r
3981         $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 250);\r
3982         $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 260);\r
3983 ?>\r
3984                 </tr><tr>\r
3985                         <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>\r
3986 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 270);\r
3987         $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 280);\r
3988         $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 290);\r
3989 ?>\r
3990                 </tr><tr>\r
3991                         <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>\r
3992 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',300);\r
3993         $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',310);\r
3994 ?>\r
3995                 </tr><tr>\r
3996                         <th colspan="2"><?php echo _TEMPLATE_PLUGIN_FIELDS?></th>\r
3997 <?php\r
3998                 $tab = 600;\r
3999                 $pluginfields = array();\r
4000                 $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));\r
4001 \r
4002                 foreach ($pluginfields as $pfkey=>$pfvalue) {\r
4003                         echo "</tr><tr>\n";\r
4004                         echo '<th colspan="2">'.htmlentities($pfkey)."</th>\n";\r
4005                         foreach ($pfvalue as $pffield=>$pfdesc) {\r
4006                                 $this->_templateEditRow($template, $pfdesc, $pffield, '',++$tab,0);\r
4007                         }\r
4008                 }\r
4009 ?>\r
4010                 </tr><tr>\r
4011                         <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>\r
4012                 </tr><tr>\r
4013                         <td><?php echo _TEMPLATE_UPDATE?></td>\r
4014                         <td>\r
4015                                 <input type="submit" tabindex="800" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />\r
4016                                 <input type="reset" tabindex="810" value="<?php echo _TEMPLATE_RESET_BTN?>" />\r
4017                         </td>\r
4018                 </tr></table>\r
4019 \r
4020                 </div>\r
4021                 </form>\r
4022                 <?php\r
4023                 $this->pagefoot();\r
4024         }\r
4025 \r
4026         /**\r
4027          * @todo document this\r
4028          */\r
4029         function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {\r
4030                 static $count = 1;\r
4031                 if (!isset($template[$name])) $template[$name] = '';\r
4032         ?>\r
4033                 </tr><tr>\r
4034                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>\r
4035                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  htmlspecialchars($template[$name]); ?></textarea></td>\r
4036         <?php           $count++;\r
4037         }\r
4038 \r
4039         /**\r
4040          * @todo document this\r
4041          */\r
4042         function action_templateupdate() {\r
4043                 global $member, $manager;\r
4044 \r
4045                 $templateid = intRequestVar('templateid');\r
4046 \r
4047                 $member->isAdmin() or $this->disallow();\r
4048 \r
4049                 $name = postVar('tname');\r
4050                 $desc = postVar('tdesc');\r
4051 \r
4052                 if (!isValidTemplateName($name))\r
4053                         $this->error(_ERROR_BADTEMPLATENAME);\r
4054 \r
4055                 if ((TEMPLATE::getNameFromId($templateid) != $name) && TEMPLATE::exists($name))\r
4056                         $this->error(_ERROR_DUPTEMPLATENAME);\r
4057 \r
4058 \r
4059                 $name = addslashes($name);\r
4060                 $desc = addslashes($desc);\r
4061 \r
4062                 // 1. Remove all template parts\r
4063                 $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;\r
4064                 sql_query($query);\r
4065 \r
4066                 // 2. Update description\r
4067                 $query =  'UPDATE '.sql_table('template_desc').' SET'\r
4068                            . " tdname='" . $name . "',"\r
4069                            . " tddesc='" . $desc . "'"\r
4070                            . " WHERE tdnumber=" . $templateid;\r
4071                 sql_query($query);\r
4072 \r
4073                 // 3. Add non-empty template parts\r
4074                 $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));\r
4075                 $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));\r
4076                 $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));\r
4077                 $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));\r
4078                 $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));\r
4079                 $this->addToTemplate($templateid, 'NEW', postVar('NEW'));\r
4080                 $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));\r
4081                 $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));\r
4082                 $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));\r
4083                 $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));\r
4084                 $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));\r
4085                 $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));\r
4086                 $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));\r
4087                 $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));\r
4088                 $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));\r
4089                 $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));\r
4090                 $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
4091                 $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));\r
4092                 $this->addToTemplate($templateid, 'BLOGLIST_HEADER', postVar('BLOGLIST_HEADER'));\r
4093                 $this->addToTemplate($templateid, 'BLOGLIST_LISTITEM', postVar('BLOGLIST_LISTITEM'));\r
4094                 $this->addToTemplate($templateid, 'BLOGLIST_FOOTER', postVar('BLOGLIST_FOOTER'));\r
4095                 $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));\r
4096                 $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));\r
4097                 $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));\r
4098                 $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));\r
4099                 $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));\r
4100                 $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));\r
4101                 $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));\r
4102                 $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));\r
4103                 $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));\r
4104                 $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
4105                 $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));\r
4106                 $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));\r
4107                 $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));\r
4108 \r
4109                 $pluginfields = array();\r
4110                 $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));\r
4111                 foreach ($pluginfields as $pfkey=>$pfvalue) {\r
4112                         foreach ($pfvalue as $pffield=>$pfdesc) {\r
4113                                 $this->addToTemplate($templateid, $pffield, postVar($pffield));\r
4114                         }\r
4115                 }\r
4116 \r
4117                 // jump back to template edit\r
4118                 $this->action_templateedit(_TEMPLATE_UPDATED);\r
4119 \r
4120         }\r
4121 \r
4122         /**\r
4123          * @todo document this\r
4124          */\r
4125         function addToTemplate($id, $partname, $content) {\r
4126                 $partname = addslashes($partname);\r
4127                 $content = addslashes($content);\r
4128 \r
4129                 $id = intval($id);\r
4130 \r
4131                 // don't add empty parts:\r
4132                 if (!trim($content)) return -1;\r
4133 \r
4134                 $query = 'INSERT INTO '.sql_table('template')." (tdesc, tpartname, tcontent) "\r
4135                            . "VALUES ($id, '$partname', '$content')";\r
4136                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . mysql_error());\r
4137                 return mysql_insert_id();\r
4138         }\r
4139 \r
4140         /**\r
4141          * @todo document this\r
4142          */\r
4143         function action_templatedelete() {\r
4144                 global $member, $manager;\r
4145 \r
4146                 $member->isAdmin() or $this->disallow();\r
4147 \r
4148                 $templateid = intRequestVar('templateid');\r
4149                 // TODO: check if template can be deleted\r
4150 \r
4151                 $this->pagehead();\r
4152 \r
4153                 $name = TEMPLATE::getNameFromId($templateid);\r
4154                 $desc = TEMPLATE::getDesc($templateid);\r
4155 \r
4156                 ?>\r
4157                         <h2><?php echo _DELETE_CONFIRM?></h2>\r
4158 \r
4159                         <p>\r
4160                         <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo htmlspecialchars($name)?></b> (<?php echo  htmlspecialchars($desc) ?>)\r
4161                         </p>\r
4162 \r
4163                         <form method="post" action="index.php"><div>\r
4164                                 <input type="hidden" name="action" value="templatedeleteconfirm" />\r
4165                                 <?php $manager->addTicketHidden() ?>\r
4166                                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />\r
4167                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
4168                         </div></form>\r
4169                 <?php\r
4170                 $this->pagefoot();\r
4171         }\r
4172 \r
4173         /**\r
4174          * @todo document this\r
4175          */\r
4176         function action_templatedeleteconfirm() {\r
4177                 global $member, $manager;\r
4178 \r
4179                 $templateid = intRequestVar('templateid');\r
4180 \r
4181                 $member->isAdmin() or $this->disallow();\r
4182 \r
4183                 $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));\r
4184 \r
4185                 // 1. delete description\r
4186                 sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);\r
4187 \r
4188                 // 2. delete parts\r
4189                 sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);\r
4190 \r
4191                 $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));\r
4192 \r
4193                 $this->action_templateoverview();\r
4194         }\r
4195 \r
4196         /**\r
4197          * @todo document this\r
4198          */\r
4199         function action_templatenew() {\r
4200                 global $member;\r
4201 \r
4202                 $member->isAdmin() or $this->disallow();\r
4203 \r
4204                 $name = postVar('name');\r
4205                 $desc = postVar('desc');\r
4206 \r
4207                 if (!isValidTemplateName($name))\r
4208                         $this->error(_ERROR_BADTEMPLATENAME);\r
4209 \r
4210                 if (TEMPLATE::exists($name))\r
4211                         $this->error(_ERROR_DUPTEMPLATENAME);\r
4212 \r
4213                 $newTemplateId = TEMPLATE::createNew($name, $desc);\r
4214 \r
4215                 $this->action_templateoverview();\r
4216         }\r
4217 \r
4218         /**\r
4219          * @todo document this\r
4220          */\r
4221         function action_templateclone() {\r
4222                 global $member;\r
4223 \r
4224                 $templateid = intRequestVar('templateid');\r
4225 \r
4226                 $member->isAdmin() or $this->disallow();\r
4227 \r
4228                 // 1. read old template\r
4229                 $name = TEMPLATE::getNameFromId($templateid);\r
4230                 $desc = TEMPLATE::getDesc($templateid);\r
4231 \r
4232                 // 2. create desc thing\r
4233                 $name = "cloned" . $name;\r
4234 \r
4235                 // if a template with that name already exists:\r
4236                 if (TEMPLATE::exists($name)) {\r
4237                         $i = 1;\r
4238                         while (TEMPLATE::exists($name . $i))\r
4239                                 $i++;\r
4240                         $name .= $i;\r
4241                 }\r
4242 \r
4243                 $newid = TEMPLATE::createNew($name, $desc);\r
4244 \r
4245                 // 3. create clone\r
4246                 // go through parts of old template and add them to the new one\r
4247                 $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);\r
4248                 while ($o = mysql_fetch_object($res)) {\r
4249                         $this->addToTemplate($newid, $o->tpartname, $o->tcontent);\r
4250                 }\r
4251 \r
4252                 $this->action_templateoverview();\r
4253         }\r
4254 \r
4255         /**\r
4256          * @todo document this\r
4257          */\r
4258         function action_skinoverview() {\r
4259                 global $member, $manager;\r
4260 \r
4261                 $member->isAdmin() or $this->disallow();\r
4262 \r
4263                 $this->pagehead();\r
4264 \r
4265                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
4266 \r
4267                 echo '<h2>' . _SKIN_EDIT_TITLE . '</h2>';\r
4268 \r
4269                 echo '<h3>' . _SKIN_AVAILABLE_TITLE . '</h3>';\r
4270 \r
4271                 $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname';\r
4272                 $template['content'] = 'skinlist';\r
4273                 $template['tabindex'] = 10;\r
4274                 showlist($query,'table',$template);\r
4275 \r
4276                 echo '<h3>' . _SKIN_NEW_TITLE . '</h3>';\r
4277 \r
4278                 ?>\r
4279                 <form method="post" action="index.php">\r
4280                 <div>\r
4281 \r
4282                 <input name="action" value="skinnew" type="hidden" />\r
4283                 <?php $manager->addTicketHidden() ?>\r
4284                 <table><tr>\r
4285                         <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>\r
4286                         <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>\r
4287                 </tr><tr>\r
4288                         <td><?php echo _SKIN_DESC?></td>\r
4289                         <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>\r
4290                 </tr><tr>\r
4291                         <td><?php echo _SKIN_CREATE?></td>\r
4292                         <td><input type="submit" tabindex="10030" value="<?php echo _SKIN_CREATE_BTN?>" onclick="return checkSubmit();" /></td>\r
4293                 </tr></table>\r
4294 \r
4295                 </div>\r
4296                 </form>\r
4297 \r
4298                 <?php\r
4299                 $this->pagefoot();\r
4300         }\r
4301 \r
4302         /**\r
4303          * @todo document this\r
4304          */\r
4305         function action_skinnew() {\r
4306                 global $member;\r
4307 \r
4308                 $member->isAdmin() or $this->disallow();\r
4309 \r
4310                 $name = trim(postVar('name'));\r
4311                 $desc = trim(postVar('desc'));\r
4312 \r
4313                 if (!isValidSkinName($name))\r
4314                         $this->error(_ERROR_BADSKINNAME);\r
4315 \r
4316                 if (SKIN::exists($name))\r
4317                         $this->error(_ERROR_DUPSKINNAME);\r
4318 \r
4319                 $newId = SKIN::createNew($name, $desc);\r
4320 \r
4321                 $this->action_skinoverview();\r
4322         }\r
4323 \r
4324         /**\r
4325          * @todo document this\r
4326          */\r
4327         function action_skinedit() {\r
4328                 global $member, $manager;\r
4329 \r
4330                 $skinid = intRequestVar('skinid');\r
4331 \r
4332                 $member->isAdmin() or $this->disallow();\r
4333 \r
4334                 $skin =& new SKIN($skinid);\r
4335 \r
4336                 $this->pagehead();\r
4337                 ?>\r
4338                 <p>\r
4339                         <a href="index.php?action=skinoverview">(<?php echo _SKIN_BACK?>)</a>\r
4340                 </p>\r
4341                 <h2><?php echo _SKIN_EDITONE_TITLE?> '<?php echo  $skin->getName() ?>'</h2>\r
4342 \r
4343                 <h3><?php echo _SKIN_PARTS_TITLE?></h3>\r
4344                 <?php echo _SKIN_PARTS_MSG?>\r
4345                 <ul>\r
4346                         <li><a tabindex="10" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=index"><?php echo _SKIN_PART_MAIN?></a> <?php help('skinpartindex')?></li>\r
4347                         <li><a tabindex="20" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=item"><?php echo _SKIN_PART_ITEM?></a> <?php help('skinpartitem')?></li>\r
4348                         <li><a tabindex="30" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archivelist"><?php echo _SKIN_PART_ALIST?></a> <?php help('skinpartarchivelist')?></li>\r
4349                         <li><a tabindex="40" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archive"><?php echo _SKIN_PART_ARCHIVE?></a> <?php help('skinpartarchive')?></li>\r
4350                         <li><a tabindex="50" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=search"><?php echo _SKIN_PART_SEARCH?></a> <?php help('skinpartsearch')?></li>\r
4351                         <li><a tabindex="60" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=error"><?php echo _SKIN_PART_ERROR?></a> <?php help('skinparterror')?></li>\r
4352                         <li><a tabindex="70" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=member"><?php echo _SKIN_PART_MEMBER?></a> <?php help('skinpartmember')?></li>\r
4353                         <li><a tabindex="75" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=imagepopup"><?php echo _SKIN_PART_POPUP?></a> <?php help('skinpartimagepopup')?></li>\r
4354                 </ul>\r
4355 \r
4356                 <?php\r
4357 \r
4358                 $query = "SELECT stype FROM " . sql_table('skin') . " WHERE stype NOT IN ('index', 'item', 'error', 'search', 'archive', 'archivelist', 'imagepopup', 'member') and sdesc = " . $skinid;\r
4359                 $res = sql_query($query);\r
4360 \r
4361                 echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';\r
4362                 echo '<form method="get" action="index.php">' . "\r\n";\r
4363                 echo '<input type="hidden" name="action" value="skinedittype" />' . "\r\n";\r
4364                 echo '<input type="hidden" name="skinid" value="' . $skinid . '" />' . "\r\n";\r
4365                 echo '<input name="type" tabindex="89" size="20" maxlength="20" />' . "\r\n";\r
4366                 echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . '" onclick="return checkSubmit();" />' . "\r\n";\r
4367                 echo '</form>' . "\r\n";\r
4368 \r
4369                 if ($res && mysql_num_rows($res) > 0) {\r
4370                         echo '<ul>';\r
4371                         $tabstart = 75;\r
4372 \r
4373                         while ($row = mysql_fetch_assoc($res)) {\r
4374                                 echo '<li><a tabindex="' . ($tabstart++) . '" href="index.php?action=skinedittype&amp;skinid=' . $skinid . '&amp;type=' . htmlspecialchars(strtolower($row['stype'])) . '">' . htmlspecialchars(ucfirst($row['stype'])) . '</a> (<a tabindex="' . ($tabstart++) . '" href="index.php?action=skinremovetype&amp;skinid=' . $skinid . '&amp;type=' . htmlspecialchars(strtolower($row['stype'])) . '">remove</a>)</li>';\r
4375                         }\r
4376 \r
4377                         echo '</ul>';\r
4378                 }\r
4379 \r
4380                 ?>\r
4381 \r
4382                 <h3><?php echo _SKIN_GENSETTINGS_TITLE; ?></h3>\r
4383                 <form method="post" action="index.php">\r
4384                 <div>\r
4385 \r
4386                 <input type="hidden" name="action" value="skineditgeneral" />\r
4387                 <?php $manager->addTicketHidden() ?>\r
4388                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />\r
4389                 <table><tr>\r
4390                         <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>\r
4391                         <td><input name="name" tabindex="90" value="<?php echo  htmlspecialchars($skin->getName()) ?>" maxlength="20" size="20" /></td>\r
4392                 </tr><tr>\r
4393                         <td><?php echo _SKIN_DESC?></td>\r
4394                         <td><input name="desc" tabindex="100" value="<?php echo  htmlspecialchars($skin->getDescription()) ?>" maxlength="200" size="50" /></td>\r
4395                 </tr><tr>\r
4396                         <td><?php echo _SKIN_TYPE?></td>\r
4397                         <td><input name="type" tabindex="110" value="<?php echo  htmlspecialchars($skin->getContentType()) ?>" maxlength="40" size="20" /></td>\r
4398                 </tr><tr>\r
4399                         <td><?php echo _SKIN_INCLUDE_MODE?> <?php help('includemode')?></td>\r
4400                         <td><?php $this->input_yesno('inc_mode',$skin->getIncludeMode(),120,'skindir','normal',_PARSER_INCMODE_SKINDIR,_PARSER_INCMODE_NORMAL);?></td>\r
4401                 </tr><tr>\r
4402                         <td><?php echo _SKIN_INCLUDE_PREFIX?> <?php help('includeprefix')?></td>\r
4403                         <td><input name="inc_prefix" tabindex="130" value="<?php echo  htmlspecialchars($skin->getIncludePrefix()) ?>" maxlength="40" size="20" /></td>\r
4404                 </tr><tr>\r
4405                         <td><?php echo _SKIN_CHANGE?></td>\r
4406                         <td><input type="submit" tabindex="140" value="<?php echo _SKIN_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>\r
4407                 </tr></table>\r
4408 \r
4409                 </div>\r
4410                 </form>\r
4411 \r
4412 \r
4413                 <?php           $this->pagefoot();\r
4414         }\r
4415 \r
4416         /**\r
4417          * @todo document this\r
4418          */\r
4419         function action_skineditgeneral() {\r
4420                 global $member;\r
4421 \r
4422                 $skinid = intRequestVar('skinid');\r
4423 \r
4424                 $member->isAdmin() or $this->disallow();\r
4425 \r
4426                 $name = postVar('name');\r
4427                 $desc = postVar('desc');\r
4428                 $type = postVar('type');\r
4429                 $inc_mode = postVar('inc_mode');\r
4430                 $inc_prefix = postVar('inc_prefix');\r
4431 \r
4432                 $skin =& new SKIN($skinid);\r
4433 \r
4434                 // 1. Some checks\r
4435                 if (!isValidSkinName($name))\r
4436                         $this->error(_ERROR_BADSKINNAME);\r
4437 \r
4438                 if (($skin->getName() != $name) && SKIN::exists($name))\r
4439                         $this->error(_ERROR_DUPSKINNAME);\r
4440 \r
4441                 if (!$type) $type = 'text/html';\r
4442                 if (!$inc_mode) $inc_mode = 'normal';\r
4443 \r
4444                 // 2. Update description\r
4445                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4446 \r
4447                 $this->action_skinedit();\r
4448 \r
4449         }\r
4450 \r
4451         /**\r
4452          * @todo document this\r
4453          */\r
4454         function action_skinedittype($msg = '') {\r
4455                 global $member, $manager;\r
4456 \r
4457                 $skinid = intRequestVar('skinid');\r
4458                 $type = requestVar('type');\r
4459 \r
4460                 $member->isAdmin() or $this->disallow();\r
4461 \r
4462                 $type = trim($type);\r
4463                 $type = strtolower($type);\r
4464 \r
4465                 if (!isValidShortName($type)) {\r
4466                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4467                 }\r
4468 \r
4469                 $skin =& new SKIN($skinid);\r
4470 \r
4471                 $friendlyNames = SKIN::getFriendlyNames();\r
4472 \r
4473                 $this->pagehead();\r
4474                 ?>\r
4475                 <p>(<a href="index.php?action=skinoverview"><?php echo _SKIN_GOBACK?></a>)</p>\r
4476 \r
4477                 <h2><?php echo _SKIN_EDITPART_TITLE?> '<?php echo htmlspecialchars($skin->getName()) ?>': <?php echo htmlspecialchars(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?></h2>\r
4478 \r
4479                 <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";\r
4480                 ?>\r
4481 \r
4482 \r
4483                 <form method="post" action="index.php">\r
4484                 <div>\r
4485 \r
4486                 <input type="hidden" name="action" value="skinupdate" />\r
4487                 <?php $manager->addTicketHidden() ?>\r
4488                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />\r
4489                 <input type="hidden" name="type" value="<?php echo  $type ?>" />\r
4490 \r
4491                 <input type="submit" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />\r
4492                 <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />\r
4493                 (skin type: <?php echo htmlspecialchars(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)\r
4494                 <?php if (in_array($type, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {\r
4495                         help('skinpart' . $type);\r
4496                 } else {\r
4497                         help('skinpartspecial');\r
4498                 }?>\r
4499                 <br />\r
4500 \r
4501                 <textarea class="skinedit" tabindex="10" rows="20" cols="80" name="content"><?php echo  htmlspecialchars($skin->getContent($type)) ?></textarea>\r
4502 \r
4503                 <br />\r
4504                 <input type="submit" tabindex="20" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />\r
4505                 <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />\r
4506                 (skin type: <?php echo htmlspecialchars(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)\r
4507 \r
4508                 <br /><br />\r
4509                 <?php echo _SKIN_ALLOWEDVARS?>\r
4510                 <?php                   $actions = SKIN::getAllowedActionsForType($type);\r
4511 \r
4512                         sort($actions);\r
4513 \r
4514                         while ($current = array_shift($actions)) {\r
4515                                 // skip deprecated vars\r
4516                                 if ($current == 'ifcat') continue;\r
4517                                 if ($current == 'imagetext') continue;\r
4518                                 if ($current == 'vars') continue;\r
4519 \r
4520                                 echo helplink('skinvar-' . $current) . "$current</a>";\r
4521                                 if (count($actions) != 0) echo ", ";\r
4522                         }\r
4523                 echo '<br /><br />' . _SKINEDIT_ALLOWEDBLOGS;\r
4524                 $query = 'SELECT bshortname, bname FROM '.sql_table('blog');\r
4525                         showlist($query,'table',array('content'=>'shortblognames'));\r
4526                 echo '<br />' . _SKINEDIT_ALLOWEDTEMPLATESS;\r
4527                 $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');\r
4528                         showlist($query,'table',array('content'=>'shortnames'));\r
4529                 echo '</div></form>';\r
4530                 $this->pagefoot();\r
4531         }\r
4532 \r
4533         /**\r
4534          * @todo document this\r
4535          */\r
4536         function action_skinupdate() {\r
4537                 global $member;\r
4538 \r
4539                 $skinid = intRequestVar('skinid');\r
4540                 $content = trim(postVar('content'));\r
4541                 $type = postVar('type');\r
4542 \r
4543                 $member->isAdmin() or $this->disallow();\r
4544 \r
4545                 $skin =& new SKIN($skinid);\r
4546                 $skin->update($type, $content);\r
4547 \r
4548                 $this->action_skinedittype(_SKIN_UPDATED);\r
4549         }\r
4550 \r
4551         /**\r
4552          * @todo document this\r
4553          */\r
4554         function action_skindelete() {\r
4555                 global $member, $manager, $CONF;\r
4556 \r
4557                 $skinid = intRequestVar('skinid');\r
4558 \r
4559                 $member->isAdmin() or $this->disallow();\r
4560 \r
4561                 // don't allow default skin to be deleted\r
4562                 if ($skinid == $CONF['BaseSkin'])\r
4563                         $this->error(_ERROR_DEFAULTSKIN);\r
4564 \r
4565                 // don't allow deletion of default skins for blogs\r
4566                 $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;\r
4567                 $r = sql_query($query);\r
4568                 if ($o = mysql_fetch_object($r))\r
4569                         $this->error(_ERROR_SKINDEFDELETE . htmlspecialchars($o->bname));\r
4570 \r
4571                 $this->pagehead();\r
4572 \r
4573                 $skin =& new SKIN($skinid);\r
4574                 $name = $skin->getName();\r
4575                 $desc = $skin->getDescription();\r
4576 \r
4577                 ?>\r
4578                         <h2><?php echo _DELETE_CONFIRM?></h2>\r
4579 \r
4580                         <p>\r
4581                                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo htmlspecialchars($name) ?></b> (<?php echo  htmlspecialchars($desc)?>)\r
4582                         </p>\r
4583 \r
4584                         <form method="post" action="index.php"><div>\r
4585                                 <input type="hidden" name="action" value="skindeleteconfirm" />\r
4586                                 <?php $manager->addTicketHidden() ?>\r
4587                                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />\r
4588                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
4589                         </div></form>\r
4590                 <?php\r
4591                 $this->pagefoot();\r
4592         }\r
4593 \r
4594         /**\r
4595          * @todo document this\r
4596          */\r
4597         function action_skindeleteconfirm() {\r
4598                 global $member, $CONF, $manager;\r
4599 \r
4600                 $skinid = intRequestVar('skinid');\r
4601 \r
4602                 $member->isAdmin() or $this->disallow();\r
4603 \r
4604                 // don't allow default skin to be deleted\r
4605                 if ($skinid == $CONF['BaseSkin'])\r
4606                         $this->error(_ERROR_DEFAULTSKIN);\r
4607 \r
4608                 // don't allow deletion of default skins for blogs\r
4609                 $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;\r
4610                 $r = sql_query($query);\r
4611                 if ($o = mysql_fetch_object($r))\r
4612                         $this->error(_ERROR_SKINDEFDELETE .$o->bname);\r
4613 \r
4614                 $manager->notify('PreDeleteSkin', array('skinid' => $skinid));\r
4615 \r
4616                 // 1. delete description\r
4617                 sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);\r
4618 \r
4619                 // 2. delete parts\r
4620                 sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);\r
4621 \r
4622                 $manager->notify('PostDeleteSkin', array('skinid' => $skinid));\r
4623 \r
4624                 $this->action_skinoverview();\r
4625         }\r
4626 \r
4627         /**\r
4628          * @todo document this\r
4629          */\r
4630         function action_skinremovetype() {\r
4631                 global $member, $manager, $CONF;\r
4632 \r
4633                 $skinid = intRequestVar('skinid');\r
4634                 $skintype = requestVar('type');\r
4635 \r
4636                 if (!isValidShortName($skintype)) {\r
4637                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4638                 }\r
4639 \r
4640                 $member->isAdmin() or $this->disallow();\r
4641 \r
4642                 // don't allow default skinparts to be deleted\r
4643                 if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {\r
4644                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4645                 }\r
4646 \r
4647                 $this->pagehead();\r
4648 \r
4649                 $skin =& new SKIN($skinid);\r
4650                 $name = $skin->getName();\r
4651                 $desc = $skin->getDescription();\r
4652 \r
4653                 ?>\r
4654                         <h2><?php echo _DELETE_CONFIRM?></h2>\r
4655 \r
4656                         <p>\r
4657                                 <?php echo _CONFIRMTXT_SKIN_PARTS_SPECIAL; ?> <b><?php echo htmlspecialchars($skintype); ?> (<?php echo htmlspecialchars($name); ?>)</b> (<?php echo  htmlspecialchars($desc)?>)\r
4658                         </p>\r
4659 \r
4660                         <form method="post" action="index.php"><div>\r
4661                                 <input type="hidden" name="action" value="skinremovetypeconfirm" />\r
4662                                 <?php $manager->addTicketHidden() ?>\r
4663                                 <input type="hidden" name="skinid" value="<?php echo $skinid; ?>" />\r
4664                                 <input type="hidden" name="type" value="<?php echo htmlspecialchars($skintype); ?>" />\r
4665                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
4666                         </div></form>\r
4667                 <?php\r
4668                 $this->pagefoot();\r
4669         }\r
4670 \r
4671         /**\r
4672          * @todo document this\r
4673          */\r
4674         function action_skinremovetypeconfirm() {\r
4675                 global $member, $CONF, $manager;\r
4676 \r
4677                 $skinid = intRequestVar('skinid');\r
4678                 $skintype = requestVar('type');\r
4679 \r
4680                 if (!isValidShortName($skintype)) {\r
4681                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4682                 }\r
4683 \r
4684                 $member->isAdmin() or $this->disallow();\r
4685 \r
4686                 // don't allow default skinparts to be deleted\r
4687                 if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {\r
4688                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4689                 }\r
4690 \r
4691                 $manager->notify('PreDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));\r
4692 \r
4693                 // delete part\r
4694                 sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid . ' AND stype=\'' . $skintype . '\'');\r
4695 \r
4696                 $manager->notify('PostDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));\r
4697 \r
4698                 $this->action_skinedit();\r
4699         }\r
4700 \r
4701         /**\r
4702          * @todo document this\r
4703          */\r
4704         function action_skinclone() {\r
4705                 global $member;\r
4706 \r
4707                 $skinid = intRequestVar('skinid');\r
4708 \r
4709                 $member->isAdmin() or $this->disallow();\r
4710 \r
4711                 // 1. read skin to clone\r
4712                 $skin =& new SKIN($skinid);\r
4713 \r
4714                 $name = "clone_" . $skin->getName();\r
4715 \r
4716                 // if a skin with that name already exists:\r
4717                 if (SKIN::exists($name)) {\r
4718                         $i = 1;\r
4719                         while (SKIN::exists($name . $i))\r
4720                                 $i++;\r
4721                         $name .= $i;\r
4722                 }\r
4723 \r
4724                 // 2. create skin desc\r
4725                 $newid = SKIN::createNew(\r
4726                         $name,\r
4727                         $skin->getDescription(),\r
4728                         $skin->getContentType(),\r
4729                         $skin->getIncludeMode(),\r
4730                         $skin->getIncludePrefix()\r
4731                 );\r
4732 \r
4733 \r
4734                 // 3. clone\r
4735                 /*\r
4736                 $this->skinclonetype($skin, $newid, 'index');\r
4737                 $this->skinclonetype($skin, $newid, 'item');\r
4738                 $this->skinclonetype($skin, $newid, 'archivelist');\r
4739                 $this->skinclonetype($skin, $newid, 'archive');\r
4740                 $this->skinclonetype($skin, $newid, 'search');\r
4741                 $this->skinclonetype($skin, $newid, 'error');\r
4742                 $this->skinclonetype($skin, $newid, 'member');\r
4743                 $this->skinclonetype($skin, $newid, 'imagepopup');\r
4744                 */\r
4745 \r
4746                 $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;\r
4747                 $res = sql_query($query);\r
4748                 while ($row = mysql_fetch_assoc($res)) {\r
4749                         $this->skinclonetype($skin, $newid, $row['stype']);\r
4750                 }\r
4751 \r
4752                 $this->action_skinoverview();\r
4753 \r
4754         }\r
4755 \r
4756         /**\r
4757          * @todo document this\r
4758          */\r
4759         function skinclonetype($skin, $newid, $type) {\r
4760                 $newid = intval($newid);\r
4761                 $content = $skin->getContent($type);\r
4762                 if ($content) {\r
4763                         $query = 'INSERT INTO '.sql_table('skin')." (sdesc, scontent, stype) VALUES ($newid,'". addslashes($content)."', '". addslashes($type)."')";\r
4764                         sql_query($query);\r
4765                 }\r
4766         }\r
4767 \r
4768         /**\r
4769          * @todo document this\r
4770          */\r
4771         function action_settingsedit() {\r
4772                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4773 \r
4774                 $member->isAdmin() or $this->disallow();\r
4775 \r
4776                 $this->pagehead();\r
4777 \r
4778                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
4779                 ?>\r
4780 \r
4781                 <h2><?php echo _SETTINGS_TITLE?></h2>\r
4782 \r
4783                 <form action="index.php" method="post">\r
4784                 <div>\r
4785 \r
4786                 <input type="hidden" name="action" value="settingsupdate" />\r
4787                 <?php $manager->addTicketHidden() ?>\r
4788 \r
4789                 <table><tr>\r
4790                         <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>\r
4791                 </tr><tr>\r
4792                         <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>\r
4793                         <td>\r
4794                                 <?php\r
4795                                         $query =  'SELECT bname as text, bnumber as value'\r
4796                                                    . ' FROM '.sql_table('blog');\r
4797                                         $template['name'] = 'DefaultBlog';\r
4798                                         $template['selected'] = $CONF['DefaultBlog'];\r
4799                                         $template['tabindex'] = 10;\r
4800                                         showlist($query,'select',$template);\r
4801                                 ?>\r
4802                         </td>\r
4803                 </tr><tr>\r
4804                         <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>\r
4805                         <td>\r
4806                                 <?php\r
4807                                         $query =  'SELECT sdname as text, sdnumber as value'\r
4808                                                    . ' FROM '.sql_table('skin_desc');\r
4809                                         $template['name'] = 'BaseSkin';\r
4810                                         $template['selected'] = $CONF['BaseSkin'];\r
4811                                         $template['tabindex'] = 1;\r
4812                                         showlist($query,'select',$template);\r
4813                                 ?>\r
4814                         </td>\r
4815                 </tr><tr>\r
4816                         <td><?php echo _SETTINGS_ADMINMAIL?></td>\r
4817                         <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  htmlspecialchars($CONF['AdminEmail']) ?>" /></td>\r
4818                 </tr><tr>\r
4819                         <td><?php echo _SETTINGS_SITENAME?></td>\r
4820                         <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  htmlspecialchars($CONF['SiteName']) ?>" /></td>\r
4821                 </tr><tr>\r
4822                         <td><?php echo _SETTINGS_SITEURL?></td>\r
4823                         <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  htmlspecialchars($CONF['IndexURL']) ?>" /></td>\r
4824                 </tr><tr>\r
4825                         <td><?php echo _SETTINGS_ADMINURL?></td>\r
4826                         <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  htmlspecialchars($CONF['AdminURL']) ?>" /></td>\r
4827                 </tr><tr>\r
4828                         <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>\r
4829                         <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  htmlspecialchars($CONF['PluginURL']) ?>" /></td>\r
4830                 </tr><tr>\r
4831                         <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>\r
4832                         <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  htmlspecialchars($CONF['SkinsURL']) ?>" /></td>\r
4833                 </tr><tr>\r
4834                         <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>\r
4835                         <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  htmlspecialchars($CONF['ActionURL']) ?>" /></td>\r
4836                 </tr><tr>\r
4837                         <td><?php echo _SETTINGS_LANGUAGE?> <?php help('language'); ?>\r
4838                         </td>\r
4839                         <td>\r
4840 \r
4841                                 <select name="Language" tabindex="10050">\r
4842                                 <?php                           // show a dropdown list of all available languages\r
4843                                 global $DIR_LANG;\r
4844                                 $dirhandle = opendir($DIR_LANG);\r
4845                                 while ($filename = readdir($dirhandle)) {\r
4846                                         if (ereg("^(.*)\.php$",$filename,$matches)) {\r
4847                                                 $name = $matches[1];\r
4848                                                 echo "<option value='$name'";\r
4849                                                 if ($name == $CONF['Language'])\r
4850                                                         echo " selected='selected'";\r
4851                                                 echo ">$name</option>";\r
4852                                         }\r
4853                                 }\r
4854                                 closedir($dirhandle);\r
4855 \r
4856                                 ?>\r
4857                                 </select>\r
4858 \r
4859                         </td>\r
4860                 </tr><tr>\r
4861                         <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>\r
4862                         </td>\r
4863                         <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>\r
4864                                         <br />\r
4865                                 <?php echo _SETTINGS_DISABLESITEURL ?> <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  htmlspecialchars($CONF['DisableSiteURL'])?>" />\r
4866                         </td>\r
4867                 </tr><tr>\r
4868                         <td><?php echo _SETTINGS_DIRS?></td>\r
4869                         <td><?php echo  htmlspecialchars($DIR_NUCLEUS) ?>\r
4870                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>\r
4871                 </tr><tr>\r
4872                         <td><?php echo _SETTINGS_DBLOGIN?></td>\r
4873                         <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>\r
4874                 </tr><tr>\r
4875                         <td>\r
4876                         <?php\r
4877                                 echo _SETTINGS_JSTOOLBAR\r
4878                                 /* =_SETTINGS_DISABLEJS\r
4879 \r
4880                                         I temporary changed the meaning of DisableJsTools, until I can find a good\r
4881                                         way to select the javascript version to use\r
4882 \r
4883                                         now, its:\r
4884                                                 0 : IE\r
4885                                                 1 : all javascript disabled\r
4886                                                 2 : 'simpler' javascript (for mozilla/opera/mac)\r
4887                                 */\r
4888                            ?>\r
4889                         </td>\r
4890                         <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>\r
4891                                 <select name="DisableJsTools" tabindex="10075">\r
4892                         <?php                                   $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';\r
4893                                         echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";\r
4894                                         $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';\r
4895                                         echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";\r
4896                                         $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';\r
4897                                         echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";\r
4898                         ?>\r
4899                                 </select>\r
4900                         </td>\r
4901                 </tr><tr>\r
4902                         <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>\r
4903                                            <td><?php\r
4904 \r
4905                                            $this->input_yesno('URLMode',$CONF['URLMode'],10077,\r
4906                                                           'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);\r
4907 \r
4908                                            echo ' ', _SETTINGS_URLMODE_HELP;\r
4909 \r
4910                                                          ?>\r
4911 \r
4912                                            </td>\r
4913                 </tr><tr>\r
4914                         <td><?php echo _SETTINGS_DEBUGVARS?> <?php help('debugvars');?></td>\r
4915                                            <td><?php\r
4916 \r
4917                                                 $this->input_yesno('DebugVars',$CONF['DebugVars'],10078);\r
4918 \r
4919                                                          ?>\r
4920 \r
4921                                            </td>\r
4922                 </tr><tr>\r
4923                         <td><?php echo _SETTINGS_DEFAULTLISTSIZE?> <?php help('defaultlistsize');?></td>\r
4924                         <td>\r
4925                         <?php\r
4926                                 if (!array_key_exists('DefaultListSize',$CONF)) {\r
4927                                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('DefaultListSize', '10')");\r
4928                                         $CONF['DefaultListSize'] = 10;\r
4929                                 }\r
4930                         ?>\r
4931                                 <input name="DefaultListSize" tabindex="10079" size="40" value="<?php echo  htmlspecialchars((intval($CONF['DefaultListSize']) < 1 ? '10' : $CONF['DefaultListSize'])) ?>" />\r
4932                         </td>\r
4933                 </tr><tr>\r
4934                         <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>\r
4935                 </tr><tr>\r
4936                         <td><?php echo _SETTINGS_MEDIADIR?></td>\r
4937                         <td><?php echo  htmlspecialchars($DIR_MEDIA) ?>\r
4938                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>\r
4939                                 <?php                           if (!is_dir($DIR_MEDIA))\r
4940                                                 echo "<br /><b>" . _WARNING_NOTADIR . "</b>";\r
4941                                         if (!is_readable($DIR_MEDIA))\r
4942                                                 echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";\r
4943                                         if (!is_writeable($DIR_MEDIA))\r
4944                                                 echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";\r
4945                                 ?>\r
4946                         </td>\r
4947                 </tr><tr>\r
4948                         <td><?php echo _SETTINGS_MEDIAURL?></td>\r
4949                         <td>\r
4950                                 <input name="MediaURL" tabindex="10080" size="40" value="<?php echo  htmlspecialchars($CONF['MediaURL']) ?>" />\r
4951                         </td>\r
4952                 </tr><tr>\r
4953                         <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>\r
4954                         <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>\r
4955                 </tr><tr>\r
4956                         <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>\r
4957                         <td>\r
4958                                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  htmlspecialchars($CONF['AllowedTypes']) ?>" />\r
4959                         </td>\r
4960                 </tr><tr>\r
4961                         <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>\r
4962                         <td>\r
4963                                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  htmlspecialchars($CONF['MaxUploadSize']) ?>" />\r
4964                         </td>\r
4965                 </tr><tr>\r
4966                         <td><?php echo _SETTINGS_MEDIAPREFIX?></td>\r
4967                         <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>\r
4968 \r
4969                 </tr><tr>\r
4970                         <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>\r
4971                 </tr><tr>\r
4972                         <td><?php echo _SETTINGS_CHANGELOGIN?></td>\r
4973                         <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>\r
4974                 </tr><tr>\r
4975                         <td><?php echo _SETTINGS_ALLOWCREATE?>\r
4976                                 <?php help('allowaccountcreation'); ?>\r
4977                         </td>\r
4978                         <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>\r
4979                         </td>\r
4980                 </tr><tr>\r
4981                         <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>\r
4982                                 <br /><?php echo _SETTINGS_NEWLOGIN2?>\r
4983                         </td>\r
4984                         <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>\r
4985                         </td>\r
4986                 </tr><tr>\r
4987                         <td><?php echo _SETTINGS_MEMBERMSGS?>\r
4988                                 <?php help('messageservice'); ?>\r
4989                         </td>\r
4990                         <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>\r
4991                         </td>\r
4992                 </tr><tr>\r
4993                         <td><?php echo _SETTINGS_NONMEMBERMSGS?>\r
4994                                 <?php help('messageservice'); ?>\r
4995                         </td>\r
4996                         <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>\r
4997                         </td>\r
4998                 </tr><tr>\r
4999                         <td><?php echo _SETTINGS_PROTECTMEMNAMES?>\r
5000                                 <?php help('protectmemnames'); ?>\r
5001                         </td>\r
5002                         <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>\r
5003                         </td>\r
5004 \r
5005 \r
5006 \r
5007                 </tr><tr>\r
5008                         <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>\r
5009                 </tr><tr>\r
5010                         <td><?php echo _SETTINGS_COOKIEPREFIX?></td>\r
5011                         <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  htmlspecialchars($CONF['CookiePrefix'])?>" /></td>\r
5012                 </tr><tr>\r
5013                         <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>\r
5014                         <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  htmlspecialchars($CONF['CookieDomain'])?>" /></td>\r
5015                 </tr><tr>\r
5016                         <td><?php echo _SETTINGS_COOKIEPATH?></td>\r
5017                         <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  htmlspecialchars($CONF['CookiePath'])?>" /></td>\r
5018                 </tr><tr>\r
5019                         <td><?php echo _SETTINGS_COOKIESECURE?></td>\r
5020                         <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>\r
5021                 </tr><tr>\r
5022                         <td><?php echo _SETTINGS_COOKIELIFE?></td>\r
5023                         <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,\r
5024                                                           1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>\r
5025                         </td>\r
5026                 </tr><tr>\r
5027                         <td><?php echo _SETTINGS_LASTVISIT?></td>\r
5028                         <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>\r
5029 \r
5030 \r
5031 \r
5032                 </tr><tr>\r
5033                         <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>\r
5034                 </tr><tr>\r
5035                         <td><?php echo _SETTINGS_UPDATE?></td>\r
5036                         <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>\r
5037                 </tr></table>\r
5038 \r
5039                 </div>\r
5040                 </form>\r
5041 \r
5042                 <?php\r
5043                         echo '<h2>',_PLUGINS_EXTRA,'</h2>';\r
5044 \r
5045                         $manager->notify(\r
5046                                 'GeneralSettingsFormExtras',\r
5047                                 array()\r
5048                         );\r
5049 \r
5050                 $this->pagefoot();\r
5051         }\r
5052 \r
5053         /**\r
5054          * @todo document this\r
5055          */\r
5056         function action_settingsupdate() {\r
5057                 global $member, $CONF;\r
5058 \r
5059                 $member->isAdmin() or $this->disallow();\r
5060 \r
5061                 // check if email address for admin is valid\r
5062                 if (!isValidMailAddress(postVar('AdminEmail')))\r
5063                         $this->error(_ERROR_BADMAILADDRESS);\r
5064 \r
5065 \r
5066                 // save settings\r
5067                 $this->updateConfig('DefaultBlog',              postVar('DefaultBlog'));\r
5068                 $this->updateConfig('BaseSkin',                 postVar('BaseSkin'));\r
5069                 $this->updateConfig('IndexURL',                 postVar('IndexURL'));\r
5070                 $this->updateConfig('AdminURL',                 postVar('AdminURL'));\r
5071                 $this->updateConfig('PluginURL',                postVar('PluginURL'));\r
5072                 $this->updateConfig('SkinsURL',                 postVar('SkinsURL'));\r
5073                 $this->updateConfig('ActionURL',                postVar('ActionURL'));\r
5074                 $this->updateConfig('Language',                 postVar('Language'));\r
5075                 $this->updateConfig('AdminEmail',               postVar('AdminEmail'));\r
5076                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));\r
5077                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));\r
5078                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));\r
5079                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));\r
5080                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));\r
5081                 $this->updateConfig('SiteName',                 postVar('SiteName'));\r
5082                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));\r
5083                 $this->updateConfig('DisableSite',              postVar('DisableSite'));\r
5084                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));\r
5085                 $this->updateConfig('LastVisit',                postVar('LastVisit'));\r
5086                 $this->updateConfig('MediaURL',                 postVar('MediaURL'));\r
5087                 $this->updateConfig('AllowedTypes',             postVar('AllowedTypes'));\r
5088                 $this->updateConfig('AllowUpload',              postVar('AllowUpload'));\r
5089                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));\r
5090                 $this->updateConfig('MediaPrefix',              postVar('MediaPrefix'));\r
5091                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));\r
5092                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));\r
5093                 $this->updateConfig('CookieDomain',             postVar('CookieDomain'));\r
5094                 $this->updateConfig('CookiePath',               postVar('CookiePath'));\r
5095                 $this->updateConfig('CookieSecure',             postVar('CookieSecure'));\r
5096                 $this->updateConfig('URLMode',                  postVar('URLMode'));\r
5097                 $this->updateConfig('CookiePrefix',             postVar('CookiePrefix'));\r
5098                 $this->updateConfig('DebugVars',                postVar('DebugVars'));\r
5099                 $this->updateConfig('DefaultListSize',  postVar('DefaultListSize'));\r
5100 \r
5101                 // load new config and redirect (this way, the new language will be used is necessary)\r
5102                 // note that when changing cookie settings, this redirect might cause the user\r
5103                 // to have to log in again.\r
5104                 getConfig();\r
5105                 redirect($CONF['AdminURL'] . '?action=manage');\r
5106                 exit;\r
5107 \r
5108         }\r
5109 \r
5110         /**\r
5111          *  Give an overview over the used system\r
5112          */\r
5113         function action_systemoverview() {\r
5114                 global $member, $nucleus, $CONF;\r
5115 \r
5116                 $this->pagehead();\r
5117 \r
5118                 echo '<h2>' . _ADMIN_SYSTEMOVERVIEW_HEADING . "</h2>\n";\r
5119 \r
5120                 if ($member->isLoggedIn() && $member->isAdmin()) {\r
5121 \r
5122                         // Information about the used PHP and MySQL installation\r
5123                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_PHPANDMYSQL . "</h3>\n";\r
5124 \r
5125                         // Version of PHP MySQL\r
5126                         echo "<table>\n";\r
5127                         echo "\t<tr>\n";\r
5128                         echo "\t\t" . '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "</th>\n";\r
5129                         echo "\t</tr><tr>\n";\r
5130                         echo "\t\t" . '<td width="50%">' . _ADMIN_SYSTEMOVERVIEW_PHPVERSION . "</td>\n";\r
5131                         echo "\t\t" . '<td>' . phpversion() . "</td>\n";\r
5132                         echo "\t</tr><tr>\n";\r
5133                         echo "\t\t" . '<td>' . _ADMIN_SYSTEMOVERVIEW_MYSQLVERSION . "</td>\n";\r
5134                         echo "\t\t" . '<td>' . mysql_get_server_info() . ' (' . mysql_get_client_info() . ')' . "</td>\n";\r
5135                         echo "\t</tr>";\r
5136                         echo "</table>\n";\r
5137 \r
5138                         // Important PHP settings\r
5139                         echo "<table>\n";\r
5140                         echo "\t<tr>\n";\r
5141                         echo "\t\t" . '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "</th>\n";\r
5142                         echo "\t</tr><tr>\n";\r
5143                         echo "\t\t" . '<td width="50%">magic_quotes_gpc' . "</td>\n";\r
5144                         $mqg = get_magic_quotes_gpc() ? 'On' : 'Off';\r
5145                         echo "\t\t" . '<td>' . $mqg . "</td>\n";\r
5146                         echo "\t</tr><tr>\n";\r
5147                         echo "\t\t" . '<td>magic_quotes_runtime' . "</td>\n";\r
5148                         $mqr = get_magic_quotes_runtime() ? 'On' : 'Off';\r
5149                         echo "\t\t" . '<td>' . $mqr . "</td>\n";\r
5150                         echo "\t</tr><tr>\n";\r
5151                         echo "\t\t" . '<td>register_globals' . "</td>\n";\r
5152                         $rg = ini_get('register_globals') ? 'On' : 'Off';\r
5153                         echo "\t\t" . '<td>' . $rg . "</td>\n";\r
5154                         echo "\t</tr>";\r
5155                         echo "</table>\n";\r
5156 \r
5157                         // Information about GD library\r
5158                         $gdinfo = gd_info();\r
5159                         echo "<table>\n";\r
5160                         echo "\t<tr>";\r
5161                         echo "\t\t" . '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "</th>\n";\r
5162                         echo "\t</tr>\n";\r
5163                         foreach ($gdinfo as $key=>$value) {\r
5164                                 if (is_bool($value)) {\r
5165                                         $value = $value ? _ADMIN_SYSTEMOVERVIEW_ENABLE : _ADMIN_SYSTEMOVERVIEW_DISABLE;\r
5166                                 } else {\r
5167                                         $value = htmlspecialchars($value, ENT_QUOTES);\r
5168                                 }\r
5169                                 echo "\t<tr>";\r
5170                                 echo "\t\t" . '<td width="50%">' . $key . "</td>\n";\r
5171                                 echo "\t\t" . '<td>' . $value . "</td>\n";\r
5172                                 echo "\t</tr>\n";\r
5173                         }\r
5174                         echo "</table>\n";\r
5175 \r
5176                         // Check if special modules are loaded\r
5177                         ob_start();\r
5178                         phpinfo(INFO_MODULES);\r
5179                         $im = ob_get_contents();\r
5180                         ob_clean();\r
5181                         echo "<table>\n";\r
5182                         echo "\t<tr>";\r
5183                         echo "\t\t" . '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_MODULES . "</th>\n";\r
5184                         echo "\t</tr><tr>\n";\r
5185                         echo "\t\t" . '<td width="50%">mod_rewrite' . "</td>\n";\r
5186                         $modrewrite = (strstr($im, 'mod_rewrite') != '') ?\r
5187                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :\r
5188                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;\r
5189                         echo "\t\t" . '<td>' . $modrewrite . "</td>\n";\r
5190                         echo "\t</tr>\n";\r
5191                         echo "</table>\n";\r
5192 \r
5193                         // Information about the used Nucleus CMS\r
5194                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSYSTEM . "</h3>\n";\r
5195                         global $nucleus;\r
5196                         $nv = getNucleusVersion() / 100 . '(' . $nucleus['version'] . ')';\r
5197                         $np = getNucleusPatchLevel();\r
5198                         echo "<table>\n";\r
5199                         echo "\t<tr>";\r
5200                         echo "\t\t" . '<th colspan="2">Nucleus CMS' . "</th>\n";\r
5201                         echo "\t</tr><tr>\n";\r
5202                         echo "\t\t" . '<td width="50%">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSVERSION . "</td>\n";\r
5203                         echo "\t\t" . '<td>' . $nv . "</td>\n";\r
5204                         echo "\t</tr><tr>\n";\r
5205                         echo "\t\t" . '<td width="50%">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSPATCHLEVEL . "</td>\n";\r
5206                         echo "\t\t" . '<td>' . $np . "</td>\n";\r
5207                         echo "\t</tr>\n";\r
5208                         echo "</table>\n";\r
5209 \r
5210                         // Important settings of the installation\r
5211                         echo "<table>\n";\r
5212                         echo "\t<tr>";\r
5213                         echo "\t\t" . '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "</th>\n";\r
5214                         echo "\t</tr><tr>\n";\r
5215                         echo "\t\t" . '<td width="50%">' . '$CONF[' . "'Self']</td>\n";\r
5216                         echo "\t\t" . '<td>' . $CONF['Self'] . "</td>\n";\r
5217                         echo "\t</tr><tr>\n";\r
5218                         echo "\t\t" . '<td width="50%">' . '$CONF[' . "'ItemURL']</td>\n";\r
5219                         echo "\t\t" . '<td>' . $CONF['ItemURL'] . "</td>\n";\r
5220                         echo "\t</tr><tr>\n";\r
5221                         echo "\t\t" . '<td width="50%">' . '$CONF[' . "'alertOnHeadersSent']</td>\n";\r
5222                         $ohs = $CONF['alertOnHeadersSent'] ?\r
5223                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :\r
5224                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;\r
5225                         echo "\t\t" . '<td>' . $ohs . "</td>\n";\r
5226                         echo "\t</tr>\n";\r
5227                         echo "</table>\n";\r
5228 \r
5229                         // Link to the online version test at the Nucleus CMS website\r
5230                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK . "</h3>\n";\r
5231                         if ($nucleus['codename'] != '') {\r
5232                                 $codenamestring = ' &quot;' . $nucleus['codename'] . '&quot;';\r
5233                         } else {\r
5234                                 $codenamestring = '';\r
5235                         }\r
5236                         echo _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TXT;\r
5237                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());\r
5238                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">';\r
5239                         echo 'Nucleus CMS ' . $nv . $codenamestring;\r
5240                         echo '</a>';\r
5241                 //echo '<br />';\r
5242                 }\r
5243                 else {\r
5244                         echo _ADMIN_SYSTEMOVERVIEW_NOT_ADMIN;\r
5245                 }\r
5246 \r
5247                 $this->pagefoot();\r
5248         }\r
5249 \r
5250         /**\r
5251          * @todo document this\r
5252          */\r
5253         function updateConfig($name, $val) {\r
5254                 $name = addslashes($name);\r
5255                 $val = trim(addslashes($val));\r
5256 \r
5257                 $query = 'UPDATE '.sql_table('config')\r
5258                            . " SET value='$val'"\r
5259                            . " WHERE name='$name'";\r
5260 \r
5261                 sql_query($query) or die("Query error: " . mysql_error());\r
5262                 return mysql_insert_id();\r
5263         }\r
5264 \r
5265         /**\r
5266          * Error message\r
5267          * @param string $msg message that will be shown\r
5268          */\r
5269         function error($msg) {\r
5270                 $this->pagehead();\r
5271                 ?>\r
5272                 <h2>Error!</h2>\r
5273                 <?php           echo $msg;\r
5274                 echo "<br />";\r
5275                 echo "<a href='index.php' onclick='history.back()'>"._BACK."</a>";\r
5276                 $this->pagefoot();\r
5277                 exit;\r
5278         }\r
5279 \r
5280         /**\r
5281          * @todo document this\r
5282          */\r
5283         function disallow() {\r
5284                 ACTIONLOG::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
5285 \r
5286                 $this->error(_ERROR_DISALLOWED);\r
5287         }\r
5288 \r
5289         /**\r
5290          * @todo document this\r
5291          */\r
5292         function pagehead($extrahead = '') {\r
5293                 global $member, $nucleus, $CONF, $manager;\r
5294 \r
5295                 $manager->notify(\r
5296                         'AdminPrePageHead',\r
5297                         array(\r
5298                                 'extrahead' => &$extrahead,\r
5299                                 'action' => $this->action\r
5300                         )\r
5301                 );\r
5302 \r
5303                 $baseUrl = htmlspecialchars($CONF['AdminURL']);\r
5304 \r
5305                 ?>\r
5306                 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">\r
5307                 <html <?php echo _HTML_XML_NAME_SPACE_AND_LANG_CODE; ?>>\r
5308                 <head>\r
5309                         <meta http-equiv="Content-Type" content="text/html; charset=<?php echo _CHARSET ?>" />\r
5310                         <title><?php echo htmlspecialchars($CONF['SiteName'])?> - Admin</title>\r
5311                         <link rel="stylesheet" title="Nucleus Admin Default" type="text/css" href="<?php echo $baseUrl?>styles/admin.css" />\r
5312                         <link rel="stylesheet" title="Nucleus Admin Default" type="text/css"\r
5313                         href="<?php echo $baseUrl?>styles/addedit.css" />\r
5314 \r
5315                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/edit.js"></script>\r
5316                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/admin.js"></script>\r
5317                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/compatibility.js"></script>\r
5318 \r
5319           <meta http-equiv='Pragma' content='no-cache' />\r
5320           <meta http-equiv='Cache-Control' content='no-cache, must-revalidate' />\r
5321           <meta http-equiv='Expires' content='-1' />\r
5322 \r
5323                         <?php echo $extrahead?>\r
5324                 </head>\r
5325                 <body>\r
5326                 <div class="header">\r
5327                 <h1><?php echo htmlspecialchars($CONF['SiteName'])?></h1>\r
5328                 </div>\r
5329                 <div id="container">\r
5330                 <div id="content">\r
5331                 <div class="loginname">\r
5332                 <?php                   if ($member->isLoggedIn())\r
5333                                 echo _LOGGEDINAS . ' ' . $member->getDisplayName()\r
5334                                         ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a>"\r
5335                                         . "<br /><a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";\r
5336                         else\r
5337                                 echo '<a href="index.php?action=showlogin" title="Log in">' , _NOTLOGGEDIN , '</a> <br />';\r
5338 \r
5339                         echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a>";\r
5340 \r
5341                         echo '<br />(';\r
5342 \r
5343                         $codenamestring = ($nucleus['codename']!='')? ' &quot;'.$nucleus['codename'].'&quot;':'';\r
5344 \r
5345                         if ($member->isLoggedIn() && $member->isAdmin()) {\r
5346                                 $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());\r
5347                                 echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';\r
5348                         } else {\r
5349                                 echo 'Nucleus CMS ' . $nucleus['version'] . $codenamestring;\r
5350                         }\r
5351                         echo ')';\r
5352                 echo '</div>';\r
5353         }\r
5354 \r
5355         /**\r
5356          * @todo document this\r
5357          */\r
5358         function pagefoot() {\r
5359                 global $action, $member, $manager;\r
5360 \r
5361                 $manager->notify(\r
5362                         'AdminPrePageFoot',\r
5363                         array(\r
5364                                 'action' => $this->action\r
5365                         )\r
5366                 );\r
5367 \r
5368                 if ($member->isLoggedIn() && ($action != 'showlogin')) {\r
5369                         ?>\r
5370                         <h2><?php echo  _LOGOUT ?></h2>\r
5371                         <ul>\r
5372                                 <li><a href="index.php?action=overview"><?php echo  _BACKHOME?></a></li>\r
5373                                 <li><a href='index.php?action=logout'><?php echo  _LOGOUT?></a></li>\r
5374                         </ul>\r
5375                         <?php           }\r
5376                 ?>\r
5377                         <div class="foot">\r
5378                                 <a href="<?php echo _ADMINPAGEFOOT_OFFICIALURL ?>">Nucleus CMS</a> &copy; 2002-<?php echo date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT; ?>\r
5379                                 -\r
5380                                 <a href="<?php echo _ADMINPAGEFOOT_DONATEURL ?>"><?php echo _ADMINPAGEFOOT_DONATE ?></a>\r
5381                         </div>\r
5382 \r
5383                         </div><!-- content -->\r
5384 \r
5385                         <div id="quickmenu">\r
5386 \r
5387                                 <?php                           // ---- user settings ----\r
5388                                 if (($action != 'showlogin') && ($member->isLoggedIn())) {\r
5389                                         echo '<ul>';\r
5390                                         echo '<li><a href="index.php?action=overview">',_QMENU_HOME,'</a></li>';\r
5391                                         echo '</ul>';\r
5392 \r
5393                                         echo '<h2>',_QMENU_ADD,'</h2>';\r
5394                                         echo '<form method="get" action="index.php"><div>';\r
5395                                         echo '<input type="hidden" name="action" value="createitem" />';\r
5396 \r
5397                                                 $showAll = requestVar('showall');\r
5398                                                 if (($member->isAdmin()) && ($showAll == 'yes')) {\r
5399                                                         // Super-Admins have access to all blogs! (no add item support though)\r
5400                                                         $query =  'SELECT bnumber as value, bname as text'\r
5401                                                                    . ' FROM ' . sql_table('blog')\r
5402                                                                    . ' ORDER BY bname';\r
5403                                                 } else {\r
5404                                                         $query =  'SELECT bnumber as value, bname as text'\r
5405                                                                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')\r
5406                                                                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()\r
5407                                                                    . ' ORDER BY bname';\r
5408                                                 }\r
5409                                                 $template['name'] = 'blogid';\r
5410                                                 $template['tabindex'] = 15000;\r
5411                                                 $template['extra'] = _QMENU_ADD_SELECT;\r
5412                                                 $template['selected'] = -1;\r
5413                                                 $template['shorten'] = 10;\r
5414                                                 $template['shortenel'] = '';\r
5415                                                 $template['javascript'] = 'onchange="return form.submit()"';\r
5416                                                 showlist($query,'select',$template);\r
5417 \r
5418                                         echo '</div></form>';\r
5419 \r
5420                                         echo '<h2>' . $member->getDisplayName(). '</h2>';\r
5421                                         echo '<ul>';\r
5422                                         echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . '</a></li>';\r
5423                                         echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . '</a></li>';\r
5424                                         echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . '</a></li>';\r
5425                                         echo '</ul>';\r
5426 \r
5427 \r
5428 \r
5429 \r
5430                                         // ---- general settings ----\r
5431                                         if ($member->isAdmin()) {\r
5432 \r
5433                                                 echo '<h2>',_QMENU_MANAGE,'</h2>';\r
5434 \r
5435                                                 echo '<ul>';\r
5436                                                 echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . '</a></li>';\r
5437                                                 echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . '</a></li>';\r
5438                                                 echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . '</a></li>';\r
5439                                                 echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . '</a></li>';\r
5440                                                 echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . '</a></li>';\r
5441                                                 echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . '</a></li>';\r
5442                                                 echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . '</a></li>';\r
5443                                                 echo '</ul>';\r
5444 \r
5445                                                 echo '<h2>',_QMENU_LAYOUT,'</h2>';\r
5446                                                 echo '<ul>';\r
5447                                                 echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . '</a></li>';\r
5448                                                 echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . '</a></li>';\r
5449                                                 echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . '</a></li>';\r
5450                                                 echo '</ul>';\r
5451 \r
5452                                         }\r
5453 \r
5454                                         $aPluginExtras = array();\r
5455                                         $manager->notify(\r
5456                                                 'QuickMenu',\r
5457                                                 array(\r
5458                                                         'options' => &$aPluginExtras\r
5459                                                 )\r
5460                                         );\r
5461                                         if (count($aPluginExtras) > 0)\r
5462                                         {\r
5463                                                 echo '<h2>', _QMENU_PLUGINS, '</h2>';\r
5464                                                 echo '<ul>';\r
5465                                                 foreach ($aPluginExtras as $aInfo)\r
5466                                                 {\r
5467                                                         echo '<li><a href="'.htmlspecialchars($aInfo['url']).'" title="'.htmlspecialchars($aInfo['tooltip']).'">'.htmlspecialchars($aInfo['title']).'</a></li>';\r
5468                                                 }\r
5469                                                 echo '</ul>';\r
5470                                         }\r
5471 \r
5472                                 } else if (($action == 'activate') || ($action == 'activatesetpwd')) {\r
5473 \r
5474                                         echo '<h2>', _QMENU_ACTIVATE, '</h2>', _QMENU_ACTIVATE_TEXT;\r
5475                                 } else {\r
5476                                         // introduction text on login screen\r
5477                                         echo '<h2>', _QMENU_INTRO, '</h2>', _QMENU_INTRO_TEXT;\r
5478                                 }\r
5479                                 ?>\r
5480                         </div>\r
5481 \r
5482                         <!-- content / quickmenu container -->\r
5483                         </div>\r
5484 \r
5485 \r
5486                         </body>\r
5487                         </html>\r
5488                 <?php   }\r
5489 \r
5490         /**\r
5491          * @todo document this\r
5492          */\r
5493         function action_regfile() {\r
5494                 global $member, $CONF;\r
5495 \r
5496                 $blogid = intRequestVar('blogid');\r
5497 \r
5498                 $member->teamRights($blogid) or $this->disallow();\r
5499 \r
5500                 // header-code stolen from phpMyAdmin\r
5501                 // REGEDIT and bookmarklet code stolen from GreyMatter\r
5502 \r
5503                 $sjisBlogName = sprintf(_WINREGFILE_TEXT, getBlogNameFromID($blogid));\r
5504                 $sjisBlogName = mb_convert_encoding($sjisBlogName, "SJIS", "auto");\r
5505 \r
5506                 header('Content-Type: application/octetstream');\r
5507                 header('Content-Disposition: filename="nucleus.reg"');\r
5508                 header('Pragma: no-cache');\r
5509                 header('Expires: 0');\r
5510 \r
5511                 echo "REGEDIT4\n";\r
5512                 echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\" . $sjisBlogName . "]\n";\r
5513                 echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";\r
5514                 echo '"contexts"=hex:31';\r
5515         }\r
5516 \r
5517         /**\r
5518          * @todo document this\r
5519          */\r
5520         function action_bookmarklet() {\r
5521                 global $member, $manager;\r
5522 \r
5523                 $blogid = intRequestVar('blogid');\r
5524 \r
5525                 $member->teamRights($blogid) or $this->disallow();\r
5526 \r
5527                 $blog =& $manager->getBlog($blogid);\r
5528                 $bm = getBookmarklet($blogid);\r
5529 \r
5530                 $this->pagehead();\r
5531 \r
5532                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
5533 \r
5534                 ?>\r
5535 \r
5536                 <h2><?php echo _BOOKMARKLET_TITLE ?></h2>\r
5537 \r
5538                 <p>\r
5539                 <?php echo _BOOKMARKLET_DESC1 . _BOOKMARKLET_DESC2 . _BOOKMARKLET_DESC3 . _BOOKMARKLET_DESC4 . _BOOKMARKLET_DESC5 ?>\r
5540                 </p>\r
5541 \r
5542                 <h3><?php echo _BOOKMARKLET_BOOKARKLET ?></h3>\r
5543                 <p>\r
5544                         <?php echo _BOOKMARKLET_BMARKTEXT ?><small><?php echo _BOOKMARKLET_BMARKTEST ?></small>\r
5545                         <br />\r
5546                         <br />\r
5547                         <?php echo '<a href="' . htmlspecialchars($bm, ENT_QUOTES) . '">' . sprintf(_BOOKMARKLET_ANCHOR, htmlspecialchars($blog->getName(), ENT_QUOTES)) . '</a>' . _BOOKMARKLET_BMARKFOLLOW; ?>\r
5548                 </p>\r
5549 \r
5550                 <h3><?php echo _BOOKMARKLET_RIGHTCLICK ?></h3>\r
5551                 <p>\r
5552                         <?php\r
5553                                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);\r
5554                                 $url = $manager->addTicketToUrl($url);\r
5555                         ?>\r
5556                         <?php echo _BOOKMARKLET_RIGHTTEXT1 . '<a href="' . htmlspecialchars($url, ENT_QUOTES, "SJIS") . '">' . _BOOKMARKLET_RIGHTLABEL . '</a>' . _BOOKMARKLET_RIGHTTEXT2; ?>\r
5557                 </p>\r
5558 \r
5559                 <p>\r
5560                         <?php echo _BOOKMARKLET_RIGHTTEXT3 ?>\r
5561                 </p>\r
5562 \r
5563                 <h3><?php echo _BOOKMARKLET_UNINSTALLTT ?></h3>\r
5564                 <p>\r
5565                         <?php echo _BOOKMARKLET_DELETEBAR ?>\r
5566                 </p>\r
5567 \r
5568                 <p>\r
5569                         <?php echo _BOOKMARKLET_DELETERIGHTT ?>\r
5570                 </p>\r
5571 \r
5572                 <ol>\r
5573                         <li><?php echo _BOOKMARKLET_DELETERIGHT1 ?></li>\r
5574                         <li><?php echo _BOOKMARKLET_DELETERIGHT2 ?></li>\r
5575                         <li><?php echo _BOOKMARKLET_DELETERIGHT3 ?></li>\r
5576                         <li><?php echo _BOOKMARKLET_DELETERIGHT4 ?></li>\r
5577                         <li><?php echo _BOOKMARKLET_DELETERIGHT5 ?></li>\r
5578                 </ol>\r
5579 \r
5580                 <?php\r
5581                 $this->pagefoot();\r
5582 \r
5583         }\r
5584 \r
5585         /**\r
5586          * @todo document this\r
5587          */\r
5588         function action_actionlog() {\r
5589                 global $member, $manager;\r
5590 \r
5591                 $member->isAdmin() or $this->disallow();\r
5592 \r
5593                 $this->pagehead();\r
5594 \r
5595                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
5596 \r
5597                 $url = $manager->addTicketToUrl('index.php?action=clearactionlog');\r
5598 \r
5599                 ?>\r
5600                         <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>\r
5601                         <p><a href="<?php echo htmlspecialchars($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>\r
5602                 <?php\r
5603                 echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';\r
5604 \r
5605                 $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';\r
5606                 $template['content'] = 'actionlist';\r
5607                 $amount = showlist($query,'table',$template);\r
5608 \r
5609                 $this->pagefoot();\r
5610 \r
5611         }\r
5612 \r
5613         /**\r
5614          * @todo document this\r
5615          */\r
5616         function action_banlist() {\r
5617                 global $member, $manager;\r
5618 \r
5619                 $blogid = intRequestVar('blogid');\r
5620 \r
5621                 $member->blogAdminRights($blogid) or $this->disallow();\r
5622 \r
5623                 $blog =& $manager->getBlog($blogid);\r
5624 \r
5625                 $this->pagehead();\r
5626 \r
5627                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
5628 \r
5629                 echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";\r
5630 \r
5631                 $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';\r
5632                 $template['content'] = 'banlist';\r
5633                 $amount = showlist($query,'table',$template);\r
5634 \r
5635                 if ($amount == 0)\r
5636                         echo _BAN_NONE;\r
5637 \r
5638                 echo '<h2>'._BAN_NEW_TITLE.'</h2>';\r
5639                 echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";\r
5640 \r
5641 \r
5642                 $this->pagefoot();\r
5643 \r
5644         }\r
5645 \r
5646         /**\r
5647          * @todo document this\r
5648          */\r
5649         function action_banlistdelete() {\r
5650                 global $member, $manager;\r
5651 \r
5652                 $blogid = intRequestVar('blogid');\r
5653                 $iprange = requestVar('iprange');\r
5654 \r
5655                 $member->blogAdminRights($blogid) or $this->disallow();\r
5656 \r
5657                 $blog =& $manager->getBlog($blogid);\r
5658                 $banBlogName =  htmlspecialchars($blog->getName(), ENT_QUOTES);\r
5659 \r
5660                 $this->pagehead();\r
5661                 ?>\r
5662                         <h2><?php echo _BAN_REMOVE_TITLE?></h2>\r
5663 \r
5664                         <form method="post" action="index.php">\r
5665 \r
5666                         <h3><?php echo _BAN_IPRANGE?></h3>\r
5667 \r
5668                         <p>\r
5669                                 <?php echo _CONFIRMTXT_BAN?> <?php echo htmlspecialchars($iprange) ?>\r
5670                                 <input name="iprange" type="hidden" value="<?php echo htmlspecialchars($iprange)?>" />\r
5671                         </p>\r
5672 \r
5673                         <h3><?php echo _BAN_BLOGS?></h3>\r
5674 \r
5675                         <div>\r
5676                                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />\r
5677                                 <input name="allblogs" type="radio" value="0" id="allblogs_one" />\r
5678                                 <label for="allblogs_one"><?php echo sprintf(_BAN_BANBLOGNAME, $banBlogName) ?></label>\r
5679                                 <br />\r
5680                                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>\r
5681                         </div>\r
5682 \r
5683                         <h3><?php echo _BAN_DELETE_TITLE?></h3>\r
5684 \r
5685                         <div>\r
5686                                 <?php $manager->addTicketHidden() ?>\r
5687                                 <input type="hidden" name="action" value="banlistdeleteconfirm" />\r
5688                                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
5689                         </div>\r
5690 \r
5691                         </form>\r
5692                 <?php\r
5693                 $this->pagefoot();\r
5694         }\r
5695 \r
5696         /**\r
5697          * @todo document this\r
5698          */\r
5699         function action_banlistdeleteconfirm() {\r
5700                 global $member, $manager;\r
5701 \r
5702                 $blogid = intPostVar('blogid');\r
5703                 $allblogs = postVar('allblogs');\r
5704                 $iprange = postVar('iprange');\r
5705 \r
5706                 $member->blogAdminRights($blogid) or $this->disallow();\r
5707 \r
5708                 $deleted = array();\r
5709 \r
5710                 if (!$allblogs) {\r
5711                         if (BAN::removeBan($blogid, $iprange))\r
5712                                 array_push($deleted, $blogid);\r
5713                 } else {\r
5714                         // get blogs fot which member has admin rights\r
5715                         $adminblogs = $member->getAdminBlogs();\r
5716                         foreach ($adminblogs as $blogje) {\r
5717                                 if (BAN::removeBan($blogje, $iprange))\r
5718                                         array_push($deleted, $blogje);\r
5719                         }\r
5720                 }\r
5721 \r
5722                 if (sizeof($deleted) == 0)\r
5723                         $this->error(_ERROR_DELETEBAN);\r
5724 \r
5725                 $this->pagehead();\r
5726 \r
5727                 echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';\r
5728                 echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';\r
5729                 echo "<p>"._BAN_REMOVED_TEXT."</p>";\r
5730 \r
5731                 echo "<ul>";\r
5732                 foreach ($deleted as $delblog) {\r
5733                         $b =& $manager->getBlog($delblog);\r
5734                         echo "<li>" . htmlspecialchars($b->getName()). "</li>";\r
5735                 }\r
5736                 echo "</ul>";\r
5737 \r
5738                 $this->pagefoot();\r
5739 \r
5740         }\r
5741 \r
5742         /**\r
5743          * @todo document this\r
5744          */\r
5745         function action_banlistnewfromitem() {\r
5746                 $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));\r
5747         }\r
5748 \r
5749         /**\r
5750          * @todo document this\r
5751          */\r
5752         function action_banlistnew($blogid = '') {\r
5753                 global $member, $manager;\r
5754 \r
5755                 if ($blogid == '')\r
5756                         $blogid = intRequestVar('blogid');\r
5757 \r
5758                 $ip = requestVar('ip');\r
5759 \r
5760                 $member->blogAdminRights($blogid) or $this->disallow();\r
5761 \r
5762                 $blog =& $manager->getBlog($blogid);\r
5763 \r
5764                 $this->pagehead();\r
5765                 ?>\r
5766                 <h2><?php echo _BAN_ADD_TITLE?></h2>\r
5767 \r
5768 \r
5769                 <form method="post" action="index.php">\r
5770 \r
5771                 <h3><?php echo _BAN_IPRANGE?></h3>\r
5772 \r
5773                 <p><?php echo _BAN_IPRANGE_TEXT?></p>\r
5774 \r
5775                 <div class="note">\r
5776                         <strong><?php echo _BAN_EXAMPLE_TITLE ?></strong>\r
5777                         <?php echo _BAN_EXAMPLE_TEXT ?>\r
5778                 </div>\r
5779 \r
5780                 <div>\r
5781                 <?php\r
5782                 if ($ip) {\r
5783                         $iprangeVal = htmlspecialchars($ip, ENT_QUOTES);\r
5784                 ?>\r
5785                         <input name="iprange" type="radio" value="<?php echo $iprangeVal ?>" checked="checked" id="ip_fixed" />\r
5786                         <label for="ip_fixed"><?php echo $iprangeVal ?></label>\r
5787                         <br />\r
5788                         <input name="iprange" type="radio" value="custom" id="ip_custom" />\r
5789                         <label for="ip_custom"><?php echo _BAN_IP_CUSTOM ?></label>\r
5790                         <input name='customiprange' value='<?php echo $iprangeVal ?>' maxlength='15' size='15' />\r
5791                 <?php\r
5792                 } else {\r
5793                                 echo "<input name='iprange' value='custom' type='hidden' />";\r
5794                                 echo "<input name='customiprange' value='' maxlength='15' size='15' />";\r
5795                         }\r
5796                 ?>\r
5797                 </div>\r
5798 \r
5799                 <h3><?php echo _BAN_BLOGS?></h3>\r
5800 \r
5801                 <p><?php echo _BAN_BLOGS_TEXT?></p>\r
5802 \r
5803                 <div>\r
5804                         <input type="hidden" name="blogid" value="<?php echo $blogid?>" />\r
5805                         <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo htmlspecialchars($blog->getName())?>'</label>\r
5806                         <br />\r
5807                         <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>\r
5808                 </div>\r
5809 \r
5810                 <h3><?php echo _BAN_REASON_TITLE?></h3>\r
5811 \r
5812                 <p><?php echo _BAN_REASON_TEXT?></p>\r
5813 \r
5814                 <div><textarea name="reason" cols="40" rows="5"></textarea></div>\r
5815 \r
5816                 <h3><?php echo _BAN_ADD_TITLE?></h3>\r
5817 \r
5818                 <div>\r
5819                         <input name="action" type="hidden" value="banlistadd" />\r
5820                         <?php $manager->addTicketHidden() ?>\r
5821                         <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />\r
5822                 </div>\r
5823 \r
5824                 </form>\r
5825 \r
5826                 <?php           $this->pagefoot();\r
5827         }\r
5828 \r
5829         /**\r
5830          * @todo document this\r
5831          */\r
5832         function action_banlistadd() {\r
5833                 global $member;\r
5834 \r
5835                 $blogid =               intPostVar('blogid');\r
5836                 $allblogs =     postVar('allblogs');\r
5837                 $iprange =              postVar('iprange');\r
5838                 if ($iprange == "custom")\r
5839                         $iprange = postVar('customiprange');\r
5840                 $reason =               postVar('reason');\r
5841 \r
5842                 $member->blogAdminRights($blogid) or $this->disallow();\r
5843 \r
5844                 // TODO: check IP range validity\r
5845 \r
5846                 if (!$allblogs) {\r
5847                         if (!BAN::addBan($blogid, $iprange, $reason))\r
5848                                 $this->error(_ERROR_ADDBAN);\r
5849                 } else {\r
5850                         // get blogs fot which member has admin rights\r
5851                         $adminblogs = $member->getAdminBlogs();\r
5852                         $failed = 0;\r
5853                         foreach ($adminblogs as $blogje) {\r
5854                                 if (!BAN::addBan($blogje, $iprange, $reason))\r
5855                                         $failed = 1;\r
5856                         }\r
5857                         if ($failed)\r
5858                                 $this->error(_ERROR_ADDBAN);\r
5859                 }\r
5860 \r
5861                 $this->action_banlist();\r
5862 \r
5863         }\r
5864 \r
5865         /**\r
5866          * @todo document this\r
5867          */\r
5868         function action_clearactionlog() {\r
5869                 global $member;\r
5870 \r
5871                 $member->isAdmin() or $this->disallow();\r
5872 \r
5873                 ACTIONLOG::clear();\r
5874 \r
5875                 $this->action_manage(_MSG_ACTIONLOGCLEARED);\r
5876         }\r
5877 \r
5878         /**\r
5879          * @todo document this\r
5880          */\r
5881         function action_backupoverview() {\r
5882                 global $member, $manager;\r
5883 \r
5884                 $member->isAdmin() or $this->disallow();\r
5885 \r
5886                 $this->pagehead();\r
5887 \r
5888                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
5889                 ?>\r
5890                 <h2><?php echo _BACKUPS_TITLE?></h2>\r
5891 \r
5892                 <h3><?php echo _BACKUP_TITLE?></h3>\r
5893 \r
5894                 <p><?php echo _BACKUP_INTRO?></p>\r
5895 \r
5896                 <form method="post" action="index.php"><p>\r
5897                 <input type="hidden" name="action" value="backupcreate" />\r
5898                 <?php $manager->addTicketHidden() ?>\r
5899 \r
5900                 <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>\r
5901                 <br />\r
5902                 <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>\r
5903                 <br /><br />\r
5904                 <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />\r
5905 \r
5906                 </p></form>\r
5907 \r
5908                 <div class="note"><?php echo _BACKUP_NOTE?></div>\r
5909 \r
5910 \r
5911                 <h3><?php echo _RESTORE_TITLE?></h3>\r
5912 \r
5913                 <div class="note"><?php echo _RESTORE_NOTE?></div>\r
5914 \r
5915                 <p><?php echo _RESTORE_INTRO?></p>\r
5916 \r
5917                 <form method="post" action="index.php" enctype="multipart/form-data"><p>\r
5918                         <input type="hidden" name="action" value="backuprestore" />\r
5919                         <?php $manager->addTicketHidden() ?>\r
5920                         <input name="backup_file" type="file" tabindex="30" />\r
5921                         <br /><br />\r
5922                         <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />\r
5923                         <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>\r
5924                         <br /><?php echo _RESTORE_WARNING?>\r
5925                 </p></form>\r
5926 \r
5927                 <?php           $this->pagefoot();\r
5928         }\r
5929 \r
5930         /**\r
5931          * @todo document this\r
5932          */\r
5933         function action_backupcreate() {\r
5934                 global $member, $DIR_LIBS;\r
5935 \r
5936                 $member->isAdmin() or $this->disallow();\r
5937 \r
5938                 // use compression ?\r
5939                 $useGzip = intval(postVar('gzip'));\r
5940 \r
5941                 include($DIR_LIBS . 'backup.php');\r
5942 \r
5943                 // try to extend time limit\r
5944                 // (creating/restoring dumps might take a while)\r
5945                 @set_time_limit(1200);\r
5946 \r
5947                 $bu = new Backup();\r
5948                 $bu->do_backup($useGzip);\r
5949                 exit;\r
5950         }\r
5951 \r
5952         /**\r
5953          * @todo document this\r
5954          */\r
5955         function action_backuprestore() {\r
5956                 global $member, $DIR_LIBS;\r
5957 \r
5958                 $member->isAdmin() or $this->disallow();\r
5959 \r
5960                 if (intPostVar('letsgo') != 1)\r
5961                         $this->error(_ERROR_BACKUP_NOTSURE);\r
5962 \r
5963                 include($DIR_LIBS . 'backup.php');\r
5964 \r
5965                 // try to extend time limit\r
5966                 // (creating/restoring dumps might take a while)\r
5967                 @set_time_limit(1200);\r
5968 \r
5969                 $bu = new Backup();\r
5970                 $message = $bu->do_restore();\r
5971                 if ($message != '')\r
5972                         $this->error($message);\r
5973 \r
5974                 $this->pagehead();\r
5975                 ?>\r
5976                 <h2><?php echo _RESTORE_COMPLETE?></h2>\r
5977                 <?php           $this->pagefoot();\r
5978 \r
5979         }\r
5980 \r
5981         /**\r
5982          * @todo document this\r
5983          */\r
5984         function action_pluginlist() {\r
5985                 global $member, $manager;\r
5986 \r
5987                 // check if allowed\r
5988                 $member->isAdmin() or $this->disallow();\r
5989 \r
5990                 $this->pagehead();\r
5991 \r
5992                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
5993 \r
5994                 echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';\r
5995 \r
5996                 echo '<h3>' , _PLUGS_TITLE_INSTALLED , '</h3>';\r
5997 \r
5998 \r
5999                 $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';\r
6000 \r
6001                 $template['content'] = 'pluginlist';\r
6002                 $template['tabindex'] = 10;\r
6003                 showlist($query, 'table', $template);\r
6004 \r
6005                 ?>\r
6006                         <h3><?php echo _PLUGS_TITLE_UPDATE?></h3>\r
6007 \r
6008                         <p><?php echo _PLUGS_TEXT_UPDATE?></p>\r
6009 \r
6010                         <form method="post" action="index.php"><div>\r
6011                                 <input type="hidden" name="action" value="pluginupdate" />\r
6012                                 <?php $manager->addTicketHidden() ?>\r
6013                                 <input type="submit" value="<?php echo _PLUGS_BTN_UPDATE ?>" tabindex="20" />\r
6014                         </div></form>\r
6015 \r
6016                         <h3><?php echo _PLUGS_TITLE_NEW?></h3>\r
6017 \r
6018                         <?php                           // find a list of possibly non-installed plugins\r
6019                                 $candidates = array();\r
6020                                 global $DIR_PLUGINS;\r
6021                                 $dirhandle = opendir($DIR_PLUGINS);\r
6022                                 while ($filename = readdir($dirhandle)) {\r
6023                                         if (ereg('^NP_(.*)\.php$',$filename,$matches)) {\r
6024                                                 $name = $matches[1];\r
6025                                                 // only show in list when not yet installed\r
6026                                                 $res = sql_query('SELECT * FROM '.sql_table('plugin').' WHERE pfile="NP_'.addslashes($name).'"');\r
6027                                                 if (mysql_num_rows($res) == 0)\r
6028                                                         array_push($candidates,$name);\r
6029                                         }\r
6030                                 }\r
6031                                 closedir($dirhandle);\r
6032 \r
6033                                 if (sizeof($candidates) > 0) {\r
6034                         ?>\r
6035 \r
6036                         <p><?php echo _PLUGS_ADD_TEXT?></p>\r
6037 \r
6038 \r
6039                         <form method='post' action='index.php'><div>\r
6040                                 <input type='hidden' name='action' value='pluginadd' />\r
6041                                 <?php $manager->addTicketHidden() ?>\r
6042                                 <select name="filename" tabindex="30">\r
6043                                 <?php                                   foreach($candidates as $name)\r
6044                                                 echo '<option value="NP_',$name,'">',htmlspecialchars($name),'</option>';\r
6045                                 ?>\r
6046                                 </select>\r
6047                                 <input type='submit' tabindex="40" value='<?php echo _PLUGS_BTN_INSTALL?>' />\r
6048                         </div></form>\r
6049 \r
6050                 <?php                   } else {        // sizeof(candidates) == 0\r
6051                                 echo '<p>',_PLUGS_NOCANDIDATES,'</p>';\r
6052                         }\r
6053 \r
6054                 $this->pagefoot();\r
6055         }\r
6056 \r
6057         /**\r
6058          * @todo document this\r
6059          */\r
6060         function action_pluginhelp() {\r
6061                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
6062 \r
6063                 // check if allowed\r
6064                 $member->isAdmin() or $this->disallow();\r
6065 \r
6066                 $plugid = intGetVar('plugid');\r
6067 \r
6068                 if (!$manager->pidInstalled($plugid))\r
6069                         $this->error(_ERROR_NOSUCHPLUGIN);\r
6070 \r
6071                 $plugName = getPluginNameFromPid($plugid);\r
6072 \r
6073                 $this->pagehead();\r
6074 \r
6075                 echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';\r
6076 \r
6077                 echo '<h2>',_PLUGS_HELP_TITLE,': ',htmlspecialchars($plugName),'</h2>';\r
6078 \r
6079                 $plug =& $manager->getPlugin($plugName);\r
6080                 $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';\r
6081 \r
6082                 if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {\r
6083                         @readfile($helpFile);\r
6084                 } else {\r
6085                         echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';\r
6086                         echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';\r
6087                 }\r
6088 \r
6089 \r
6090                 $this->pagefoot();\r
6091         }\r
6092 \r
6093         /**\r
6094          * @todo document this\r
6095          */\r
6096         function action_pluginadd() {\r
6097                 global $member, $manager, $DIR_PLUGINS;\r
6098 \r
6099                 // check if allowed\r
6100                 $member->isAdmin() or $this->disallow();\r
6101 \r
6102                 $name = postVar('filename');\r
6103 \r
6104                 if ($manager->pluginInstalled($name))\r
6105                         $this->error(_ERROR_DUPPLUGIN);\r
6106                 if (!checkPlugin($name))\r
6107                         $this->error(_ERROR_PLUGFILEERROR . ' (' . htmlspecialchars($name) . ')');\r
6108 \r
6109                 // get number of currently installed plugins\r
6110                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));\r
6111                 $numCurrent = mysql_num_rows($res);\r
6112 \r
6113                 // plugin will be added as last one in the list\r
6114                 $newOrder = $numCurrent + 1;\r
6115 \r
6116                 $manager->notify(\r
6117                         'PreAddPlugin',\r
6118                         array(\r
6119                                 'file' => &$name\r
6120                         )\r
6121                 );\r
6122 \r
6123                 // do this before calling getPlugin (in case the plugin id is used there)\r
6124                 $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.addslashes($name).'")';\r
6125                 sql_query($query);\r
6126                 $iPid = mysql_insert_id();\r
6127 \r
6128                 $manager->clearCachedInfo('installedPlugins');\r
6129 \r
6130                 // Load the plugin for condition checking and instalation\r
6131                 $plugin =& $manager->getPlugin($name);\r
6132 \r
6133                 // check if it got loaded (could have failed)\r
6134                 if (!$plugin)\r
6135                 {\r
6136                         sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));\r
6137                         $manager->clearCachedInfo('installedPlugins');\r
6138                         $this->error(_ERROR_PLUGIN_LOAD);\r
6139                 }\r
6140 \r
6141                 // check if plugin needs a newer Nucleus version\r
6142                 if (getNucleusVersion() < $plugin->getMinNucleusVersion())\r
6143                 {\r
6144                         // uninstall plugin again...\r
6145                         $this->deleteOnePlugin($plugin->getID());\r
6146 \r
6147                         // ...and show error\r
6148                         $this->error(_ERROR_NUCLEUSVERSIONREQ . htmlspecialchars($plugin->getMinNucleusVersion()));\r
6149                 }\r
6150 \r
6151                 // check if plugin needs a newer Nucleus version\r
6152                 if ((getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()))\r
6153                 {\r
6154                         // uninstall plugin again...\r
6155                         $this->deleteOnePlugin($plugin->getID());\r
6156 \r
6157                         // ...and show error\r
6158                         $this->error(_ERROR_NUCLEUSVERSIONREQ . htmlspecialchars( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
6159                 }\r
6160 \r
6161                 $pluginList = $plugin->getPluginDep();\r
6162                 foreach ($pluginList as $pluginName)\r
6163                 {\r
6164 \r
6165                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');\r
6166                         if (mysql_num_rows($res) == 0)\r
6167                         {\r
6168                                 // uninstall plugin again...\r
6169                                 $this->deleteOnePlugin($plugin->getID());\r
6170 \r
6171                                 $this->error(sprintf(_ERROR_INSREQPLUGIN, htmlspecialchars($pluginName, ENT_QUOTES)));\r
6172                         }\r
6173                 }\r
6174 \r
6175                 // call the install method of the plugin\r
6176                 $plugin->install();\r
6177 \r
6178                 $manager->notify(\r
6179                         'PostAddPlugin',\r
6180                         array(\r
6181                                 'plugin' => &$plugin\r
6182                         )\r
6183                 );\r
6184 \r
6185                 // update all events\r
6186                 $this->action_pluginupdate();\r
6187         }\r
6188 \r
6189         /**\r
6190          * @todo document this\r
6191          */\r
6192         function action_pluginupdate() {\r
6193                 global $member, $manager, $CONF;\r
6194 \r
6195                 // check if allowed\r
6196                 $member->isAdmin() or $this->disallow();\r
6197 \r
6198                 // delete everything from plugin_events\r
6199                 sql_query('DELETE FROM '.sql_table('plugin_event'));\r
6200 \r
6201                 // loop over all installed plugins\r
6202                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));\r
6203                 while($o = mysql_fetch_object($res)) {\r
6204                         $pid = $o->pid;\r
6205                         $plug =& $manager->getPlugin($o->pfile);\r
6206                         if ($plug)\r
6207                         {\r
6208                                 $eventList = $plug->getEventList();\r
6209                                 foreach ($eventList as $eventName)\r
6210                                         sql_query('INSERT INTO '.sql_table('plugin_event').' (pid, event) VALUES ('.$pid.', \''.addslashes($eventName).'\')');\r
6211                         }\r
6212                 }\r
6213 \r
6214                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
6215 //              $this->action_pluginlist();\r
6216         }\r
6217 \r
6218         /**\r
6219          * @todo document this\r
6220          */\r
6221         function action_plugindelete() {\r
6222                 global $member, $manager;\r
6223 \r
6224                 // check if allowed\r
6225                 $member->isAdmin() or $this->disallow();\r
6226 \r
6227                 $pid = intGetVar('plugid');\r
6228 \r
6229                 if (!$manager->pidInstalled($pid))\r
6230                         $this->error(_ERROR_NOSUCHPLUGIN);\r
6231 \r
6232                 $this->pagehead();\r
6233                 ?>\r
6234                         <h2><?php echo _DELETE_CONFIRM?></h2>\r
6235 \r
6236                         <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>\r
6237 \r
6238                         <form method="post" action="index.php"><div>\r
6239                         <?php $manager->addTicketHidden() ?>\r
6240                         <input type="hidden" name="action" value="plugindeleteconfirm" />\r
6241                         <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />\r
6242                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
6243                         </div></form>\r
6244                 <?php\r
6245                 $this->pagefoot();\r
6246         }\r
6247 \r
6248         /**\r
6249          * @todo document this\r
6250          */\r
6251         function action_plugindeleteconfirm() {\r
6252                 global $member, $manager, $CONF;\r
6253 \r
6254                 // check if allowed\r
6255                 $member->isAdmin() or $this->disallow();\r
6256 \r
6257                 $pid = intPostVar('plugid');\r
6258 \r
6259                 $error = $this->deleteOnePlugin($pid, 1);\r
6260                 if ($error) {\r
6261                         $this->error($error);\r
6262                 }\r
6263 \r
6264                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
6265 //              $this->action_pluginlist();\r
6266         }\r
6267 \r
6268         /**\r
6269          * @todo document this\r
6270          */\r
6271         function deleteOnePlugin($pid, $callUninstall = 0) {\r
6272                 global $manager;\r
6273 \r
6274                 $pid = intval($pid);\r
6275 \r
6276                 if (!$manager->pidInstalled($pid))\r
6277                         return _ERROR_NOSUCHPLUGIN;\r
6278 \r
6279                 $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);\r
6280 \r
6281 /*              // call the unInstall method of the plugin\r
6282                 if ($callUninstall) {\r
6283                         $plugin =& $manager->getPlugin($name);\r
6284                         if ($plugin) $plugin->unInstall();\r
6285                 }*/\r
6286 \r
6287                 // check dependency before delete\r
6288                 $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));\r
6289                 while($o = mysql_fetch_object($res)) {\r
6290                         $plug =& $manager->getPlugin($o->pfile);\r
6291                         if ($plug)\r
6292                         {\r
6293                                 $depList = $plug->getPluginDep();\r
6294                                 foreach ($depList as $depName)\r
6295                                 {\r
6296                                         if ($name == $depName)\r
6297                                         {\r
6298                                                 return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);\r
6299                                         }\r
6300                                 }\r
6301                         }\r
6302                 }\r
6303 \r
6304                 $manager->notify('PreDeletePlugin', array('plugid' => $pid));\r
6305 \r
6306                 // call the unInstall method of the plugin\r
6307                 if ($callUninstall) {\r
6308                         $plugin =& $manager->getPlugin($name);\r
6309                         if ($plugin) $plugin->unInstall();\r
6310                 }\r
6311 \r
6312                 // delete all subscriptions\r
6313                 sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);\r
6314 \r
6315                 // delete all options\r
6316                 // get OIDs from plugin_option_desc\r
6317                 $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
6318                 $aOIDs = array();\r
6319                 while ($o = mysql_fetch_object($res)) {\r
6320                         array_push($aOIDs, $o->oid);\r
6321                 }\r
6322 \r
6323                 // delete from plugin_option and plugin_option_desc\r
6324                 sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);\r
6325                 if (count($aOIDs) > 0)\r
6326                         sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');\r
6327 \r
6328                 // update order numbers\r
6329                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);\r
6330                 $o = mysql_fetch_object($res);\r
6331                 sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);\r
6332 \r
6333                 // delete row\r
6334                 sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);\r
6335 \r
6336                 $manager->clearCachedInfo('installedPlugins');\r
6337                 $manager->notify('PostDeletePlugin', array('plugid' => $pid));\r
6338 \r
6339                 return '';\r
6340         }\r
6341 \r
6342         /**\r
6343          * @todo document this\r
6344          */\r
6345         function action_pluginup() {\r
6346                 global $member, $manager, $CONF;\r
6347 \r
6348                 // check if allowed\r
6349                 $member->isAdmin() or $this->disallow();\r
6350 \r
6351                 $plugid = intGetVar('plugid');\r
6352 \r
6353                 if (!$manager->pidInstalled($plugid))\r
6354                         $this->error(_ERROR_NOSUCHPLUGIN);\r
6355 \r
6356                 // 1. get old order number\r
6357                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);\r
6358                 $o = mysql_fetch_object($res);\r
6359                 $oldOrder = $o->porder;\r
6360 \r
6361                 // 2. calculate new order number\r
6362                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
6363 \r
6364                 // 3. update plug numbers\r
6365                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);\r
6366                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);\r
6367 \r
6368                 //$this->action_pluginlist();\r
6369                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
6370                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
6371         }\r
6372 \r
6373         /**\r
6374          * @todo document this\r
6375          */\r
6376         function action_plugindown() {\r
6377                 global $member, $manager, $CONF;\r
6378 \r
6379                 // check if allowed\r
6380                 $member->isAdmin() or $this->disallow();\r
6381 \r
6382                 $plugid = intGetVar('plugid');\r
6383                 if (!$manager->pidInstalled($plugid))\r
6384                         $this->error(_ERROR_NOSUCHPLUGIN);\r
6385 \r
6386                 // 1. get old order number\r
6387                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);\r
6388                 $o = mysql_fetch_object($res);\r
6389                 $oldOrder = $o->porder;\r
6390 \r
6391                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));\r
6392                 $maxOrder = mysql_num_rows($res);\r
6393 \r
6394                 // 2. calculate new order number\r
6395                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
6396 \r
6397                 // 3. update plug numbers\r
6398                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);\r
6399                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);\r
6400 \r
6401                 //$this->action_pluginlist();\r
6402                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
6403                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
6404         }\r
6405 \r
6406         /**\r
6407          * @todo document this\r
6408          */\r
6409         function action_pluginoptions($message = '') {\r
6410                 global $member, $manager;\r
6411 \r
6412                 // check if allowed\r
6413                 $member->isAdmin() or $this->disallow();\r
6414 \r
6415                 $pid = intRequestVar('plugid');\r
6416                 if (!$manager->pidInstalled($pid))\r
6417                         $this->error(_ERROR_NOSUCHPLUGIN);\r
6418 \r
6419                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
6420                 $pluginName = htmlspecialchars(getPluginNameFromPid($pid), ENT_QUOTES);\r
6421                 $this->pagehead($extrahead);\r
6422 \r
6423                 ?>\r
6424                         <p><a href="index.php?action=pluginlist">(<?php echo _PLUGS_BACK?>)</a></p>\r
6425 \r
6426                         <h2><?php echo sprintf(_PLUGIN_OPTIONS_TITLE, $pluginName) ?></h2>\r
6427 \r
6428                         <?php if  ($message) echo $message?>\r
6429 \r
6430                         <form action="index.php" method="post">\r
6431                         <div>\r
6432                                 <input type="hidden" name="action" value="pluginoptionsupdate" />\r
6433                                 <input type="hidden" name="plugid" value="<?php echo $pid?>" />\r
6434 \r
6435                 <?php\r
6436 \r
6437                 $manager->addTicketHidden();\r
6438 \r
6439                 $aOptions = array();\r
6440                 $aOIDs = array();\r
6441                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ' WHERE ocontext=\'global\' and opid=' . $pid . ' ORDER BY oid ASC';\r
6442                 $r = sql_query($query);\r
6443                 while ($o = mysql_fetch_object($r)) {\r
6444                         array_push($aOIDs, $o->oid);\r
6445                         $aOptions[$o->oid] = array(\r
6446                                                 'oid' => $o->oid,\r
6447                                                 'value' => $o->odef,\r
6448                                                 'name' => $o->oname,\r
6449                                                 'description' => $o->odesc,\r
6450                                                 'type' => $o->otype,\r
6451                                                 'typeinfo' => $o->oextra,\r
6452                                                 'contextid' => 0\r
6453                         );\r
6454                 }\r
6455                 // fill out actual values\r
6456                 if (count($aOIDs) > 0) {\r
6457                         $r = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE oid in ('.implode(',',$aOIDs).')');\r
6458                         while ($o = mysql_fetch_object($r))\r
6459                                 $aOptions[$o->oid]['value'] = $o->ovalue;\r
6460                 }\r
6461 \r
6462                 // call plugins\r
6463                 $manager->notify('PrePluginOptionsEdit',array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions));\r
6464 \r
6465                 $template['content'] = 'plugoptionlist';\r
6466                 $amount = showlist($aOptions,'table',$template);\r
6467                 if ($amount == 0)\r
6468                         echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';\r
6469 \r
6470                 ?>\r
6471                         </div>\r
6472                         </form>\r
6473                 <?php           $this->pagefoot();\r
6474 \r
6475 \r
6476 \r
6477         }\r
6478 \r
6479         /**\r
6480          * @todo document this\r
6481          */\r
6482         function action_pluginoptionsupdate() {\r
6483                 global $member, $manager;\r
6484 \r
6485                 // check if allowed\r
6486                 $member->isAdmin() or $this->disallow();\r
6487 \r
6488                 $pid = intRequestVar('plugid');\r
6489                 if (!$manager->pidInstalled($pid))\r
6490                         $this->error(_ERROR_NOSUCHPLUGIN);\r
6491 \r
6492                 $aOptions = requestArray('plugoption');\r
6493                 NucleusPlugin::_applyPluginOptions($aOptions);\r
6494 \r
6495                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));\r
6496 \r
6497                 $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
6498         }\r
6499 \r
6500         /**\r
6501          * @static\r
6502          * @todo document this\r
6503          */\r
6504         function _insertPluginOptions($context, $contextid = 0) {\r
6505                 // get all current values for this contextid\r
6506                 // (note: this might contain doubles for overlapping contextids)\r
6507                 $aIdToValue = array();\r
6508                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));\r
6509                 while ($o = mysql_fetch_object($res)) {\r
6510                         $aIdToValue[$o->oid] = $o->ovalue;\r
6511                 }\r
6512 \r
6513                 // get list of oids per pid\r
6514                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')\r
6515                            . ' WHERE opid=pid and ocontext=\''.addslashes($context).'\' ORDER BY porder, oid ASC';\r
6516                 $res = sql_query($query);\r
6517                 $aOptions = array();\r
6518                 while ($o = mysql_fetch_object($res)) {\r
6519                         if (in_array($o->oid, array_keys($aIdToValue)))\r
6520                                 $value = $aIdToValue[$o->oid];\r
6521                         else\r
6522                                 $value = $o->odef;\r
6523 \r
6524                         array_push($aOptions, array(\r
6525                                 'pid' => $o->pid,\r
6526                                 'pfile' => $o->pfile,\r
6527                                 'oid' => $o->oid,\r
6528                                 'value' => $value,\r
6529                                 'name' => $o->oname,\r
6530                                 'description' => $o->odesc,\r
6531                                 'type' => $o->otype,\r
6532                                 'typeinfo' => $o->oextra,\r
6533                                 'contextid' => $contextid,\r
6534                                 'extra' => ''\r
6535                         ));\r
6536                 }\r
6537 \r
6538                 global $manager;\r
6539                 $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));\r
6540 \r
6541 \r
6542                 $iPrevPid = -1;\r
6543                 foreach ($aOptions as $aOption) {\r
6544 \r
6545                         // new plugin?\r
6546                         if ($iPrevPid != $aOption['pid']) {\r
6547                                 $iPrevPid = $aOption['pid'];\r
6548 \r
6549                                 echo '<tr><th colspan="2">Options for ', htmlspecialchars($aOption['pfile']),'</th></tr>';\r
6550                         }\r
6551 \r
6552                         $meta = NucleusPlugin::getOptionMeta($aOption['typeinfo']);\r
6553                         if (@$meta['access'] != 'hidden') {\r
6554                                 echo '<tr>';\r
6555                                 listplug_plugOptionRow($aOption);\r
6556                                 echo '</tr>';\r
6557                         }\r
6558 \r
6559                 }\r
6560 \r
6561 \r
6562         }\r
6563 \r
6564         /**\r
6565          * Helper functions to create option forms etc.\r
6566          * @todo document parameters\r
6567          */\r
6568         function input_yesno($name, $checkedval,$tabindex = 0, $value1 = 1, $value2 = 0, $yesval = _YES, $noval = _NO, $isAdmin = 0) {\r
6569                 $id = htmlspecialchars($name);\r
6570                 $id = str_replace('[','-',$id);\r
6571                 $id = str_replace(']','-',$id);\r
6572                 $id1 = $id . htmlspecialchars($value1);\r
6573                 $id2 = $id . htmlspecialchars($value2);\r
6574 \r
6575                 if ($name=="admin") {\r
6576                         echo '<input onclick="selectCanLogin(true);" type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value1),'" ';\r
6577                 } else {\r
6578                         echo '<input type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value1),'" ';\r
6579                 }\r
6580 \r
6581                         if ($checkedval == $value1)\r
6582                                 echo "tabindex='$tabindex' checked='checked'";\r
6583                         echo ' id="'.$id1.'" /><label for="'.$id1.'">' . $yesval . '</label>';\r
6584                 echo ' ';\r
6585                 if ($name=="admin") {\r
6586                         echo '<input onclick="selectCanLogin(false);" type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value2),'" ';\r
6587                 } else {\r
6588                         echo '<input type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value2),'" ';\r
6589                 }\r
6590                         if ($checkedval != $value1)\r
6591                                 echo "tabindex='$tabindex' checked='checked'";\r
6592                         if ($isAdmin && $name=="canlogin")\r
6593                                 echo ' disabled="disabled"';\r
6594                         echo ' id="'.$id2.'" /><label for="'.$id2.'">' . $noval . '</label>';\r
6595         }\r
6596 \r
6597 } // class ADMIN\r
6598 \r
6599 ?>