utf8/nucleus/libs/ADMIN.php

   1 <?php
   2 /*
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2007 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2007 The Nucleus Group
  17  * @version $Id: ADMIN.php,v 1.24 2008-02-08 09:31:22 kimitake Exp $
  18  * @version $NucleusJP: ADMIN.php,v 1.21.2.4 2007/10/30 19:04:24 kmorimatsu Exp $
  19  */
  20
  21 if ( !function_exists('requestVar') ) exit;
  22 require_once dirname(__FILE__) . '/showlist.php';
  23
  24 /**
  25  * Builds the admin area and executes admin actions
  26  */
  27 class ADMIN {
  28
  29         /**
  30          * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)
  31          */
  32         var $action;
  33
  34         /**
  35          * Class constructor
  36          */
  37         function ADMIN() {
  38
  39         }
  40
  41         /**
  42          * Executes an action
  43          *
  44          * @param string $action action to be performed
  45          */
  46         function action($action) {
  47                 global $CONF, $manager;
  48
  49                 // list of action aliases
  50                 $alias = array(
  51                         'login' => 'overview',
  52                         '' => 'overview'
  53                 );
  54
  55                 if (isset($alias[$action]))
  56                         $action = $alias[$action];
  57
  58                 $methodName = 'action_' . $action;
  59
  60                 $this->action = strtolower($action);
  61
  62                 // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action
  63                 // is an action that requires user interaction before something is actually done)
  64                 // all safe actions are in this array:
  65                 $aActionsNotToCheck = array('showlogin', 'login', 'overview', 'itemlist', 'blogcommentlist', 'bookmarklet', 'blogsettings', 'banlist', 'deleteblog', 'editmembersettings', 'browseownitems', 'browseowncomments', 'createitem', 'itemedit', 'itemmove', 'categoryedit', 'categorydelete', 'manage', 'actionlog', 'settingsedit', 'backupoverview', 'pluginlist', 'createnewlog', 'usermanagement', 'skinoverview', 'templateoverview', 'skinieoverview', 'itemcommentlist', 'commentedit', 'commentdelete', 'banlistnewfromitem', 'banlistdelete', 'itemdelete', 'manageteam', 'teamdelete', 'banlistnew', 'memberedit', 'memberdelete', 'pluginhelp', 'pluginoptions', 'plugindelete', 'skinedittype', 'skinremovetype', 'skindelete', 'skinedit', 'templateedit', 'templatedelete', 'activate');
  66 /*
  67                 // the rest of the actions needs to be checked
  68                 $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'sendping', 'rawping', 'activatesetpwd');
  69 */
  70                 if (!in_array($this->action, $aActionsNotToCheck))
  71                 {
  72                         if (!$manager->checkTicket())
  73                                 $this->error(_ERROR_BADTICKET);
  74                 }
  75
  76                 if (method_exists($this, $methodName))
  77                         call_user_func(array(&$this, $methodName));
  78                 else
  79                         $this->error(_BADACTION . htmlspecialchars(" ($action)"));
  80
  81         }
  82
  83         /**
  84          * @todo document this
  85          */
  86         function action_showlogin() {
  87                 global $error;
  88                 $this->action_login($error);
  89         }
  90
  91         /**
  92          * @todo document this
  93          */
  94         function action_login($msg = '', $passvars = 1) {
  95                 global $member;
  96
  97                 // skip to overview when allowed
  98                 if ($member->isLoggedIn() && $member->canLogin()) {
  99                         $this->action_overview();
 100                         exit;
 101                 }
 102
 103                 $this->pagehead();
 104
 105                 echo '<h2>', _LOGIN ,'</h2>';
 106                 if ($msg) echo _MESSAGE , ': ', htmlspecialchars($msg);
 107                 ?>
 108
 109                 <form action="index.php" method="post"><p>
 110                 <?php echo _LOGIN_NAME?>: <br /><input name="login"  tabindex="10" />
 111                 <br />
 112                 <?php echo _LOGIN_PASSWORD?>: <br /><input name="password"  tabindex="20" type="password" />
 113                 <br />
 114                 <input name="action" value="login" type="hidden" />
 115                 <br />
 116                 <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />
 117                 <br />
 118                 <small>
 119                         <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>
 120                         <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>
 121                 </small>
 122                 <?php                   // pass through vars
 123
 124                         $oldaction = postVar('oldaction');
 125                         if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {
 126                                 passRequestVars();
 127                         }
 128
 129
 130                 ?>
 131                 </p></form>
 132                 <?php           $this->pagefoot();
 133         }
 134
 135
 136         /**
 137          * provides a screen with the overview of the actions available
 138          * @todo document parameter
 139          */
 140         function action_overview($msg = '') {
 141                 global $member;
 142
 143                 $this->pagehead();
 144
 145                 if ($msg)
 146                         echo _MESSAGE , ': ', $msg;
 147
 148                 /* ---- add items ---- */
 149                 echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';
 150
 151                 $showAll = requestVar('showall');
 152
 153                 if (($member->isAdmin()) && ($showAll == 'yes')) {
 154                         // Super-Admins have access to all blogs! (no add item support though)
 155                         $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'
 156                                    . ' FROM ' . sql_table('blog')
 157                                    . ' ORDER BY bname';
 158                 } else {
 159                         $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'
 160                                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
 161                                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
 162                                    . ' ORDER BY bname';
 163                 }
 164                 $template['content'] = 'bloglist';
 165                 $template['superadmin'] = $member->isAdmin();
 166                 $amount = showlist($query,'table',$template);
 167
 168                 if (($showAll != 'yes') && ($member->isAdmin())) {
 169                         $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));
 170                         if ($total > $amount)
 171                                 echo '<p><a href="index.php?action=overview&amp;showall=yes">Show all blogs</a></p>';
 172                 }
 173
 174                 if ($amount == 0)
 175                         echo _OVERVIEW_NOBLOGS;
 176
 177                 if ($amount != 0) {
 178                         echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';
 179                         $query =  'SELECT ititle, inumber, bshortname'
 180                                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')
 181                                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';
 182                         $template['content'] = 'draftlist';
 183                         $amountdrafts = showlist($query, 'table', $template);
 184                         if ($amountdrafts == 0)
 185                                 echo _OVERVIEW_NODRAFTS;
 186                 }
 187
 188                 /* ---- user settings ---- */
 189                 echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';
 190                 echo '<ul>';
 191                 echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';
 192                 echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';
 193                 echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';
 194                 echo '</ul>';
 195
 196                 /* ---- general settings ---- */
 197                 if ($member->isAdmin()) {
 198                         echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';
 199                         echo '<ul>';
 200                         echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';
 201                         echo '</ul>';
 202                 }
 203
 204
 205                 $this->pagefoot();
 206         }
 207
 208         /**
 209          * Returns a link to a weblog
 210          * @param object BLOG
 211          */
 212         function bloglink(&$blog) {
 213                 return '<a href="'.htmlspecialchars($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. htmlspecialchars( $blog->getName() ) .'</a>';
 214         }
 215
 216         /**
 217          * @todo document this
 218          */
 219         function action_manage($msg = '') {
 220                 global $member;
 221
 222                 $member->isAdmin() or $this->disallow();
 223
 224                 $this->pagehead();
 225
 226                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 227
 228                 if ($msg)
 229                         echo '<p>' , _MESSAGE , ': ', $msg , '</p>';
 230
 231
 232                 echo '<h2>' . _MANAGE_GENERAL. '</h2>';
 233
 234                 echo '<ul>';
 235                 echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';
 236                 echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';
 237                 echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';
 238                 echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';
 239                 echo '</ul>';
 240
 241                 echo '<h2>' . _MANAGE_SKINS . '</h2>';
 242                 echo '<ul>';
 243                 echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';
 244                 echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';
 245                 echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';
 246                 echo '</ul>';
 247
 248                 echo '<h2>' . _MANAGE_EXTRA . '</h2>';
 249                 echo '<ul>';
 250                 echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';
 251                 echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';
 252                 echo '</ul>';
 253
 254                 $this->pagefoot();
 255         }
 256
 257         /**
 258          * @todo document this
 259          */
 260         function action_itemlist($blogid = '') {
 261                 global $member, $manager;
 262
 263                 if ($blogid == '')
 264                         $blogid = intRequestVar('blogid');
 265
 266                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 267
 268                 $this->pagehead();
 269                 $blog =& $manager->getBlog($blogid);
 270
 271                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 272                 echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';
 273
 274                 // start index
 275                 if (postVar('start'))
 276                         $start = intPostVar('start');
 277                 else
 278                         $start = 0;
 279
 280                 if ($start == 0)
 281                         echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';
 282
 283                 // amount of items to show
 284                 if (postVar('amount'))
 285                         $amount = intPostVar('amount');
 286                 else
 287                         $amount = 10;
 288
 289                 $search = postVar('search');    // search through items
 290
 291                 $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'
 292                            . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')
 293                            . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;
 294
 295                 if ($search)
 296                         $query .= ' and ((ititle LIKE "%' . addslashes($search) . '%") or (ibody LIKE "%' . addslashes($search) . '%") or (imore LIKE "%' . addslashes($search) . '%"))';
 297
 298                 // non-blog-admins can only edit/delete their own items
 299                 if (!$member->blogAdminRights($blogid))
 300                         $query .= ' and iauthor=' . $member->getID();
 301
 302
 303                 $query .= ' ORDER BY itime DESC'
 304                                 . " LIMIT $start,$amount";
 305
 306                 $template['content'] = 'itemlist';
 307                 $template['now'] = $blog->getCorrectTime(time());
 308
 309                 $manager->loadClass("ENCAPSULATE");
 310                 $navList =& new NAVLIST('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);
 311                 $navList->showBatchList('item',$query,'table',$template);
 312
 313
 314                 $this->pagefoot();
 315         }
 316
 317         /**
 318          * @todo document this
 319          */
 320         function action_batchitem() {
 321                 global $member, $manager;
 322
 323                 // check if logged in
 324                 $member->isLoggedIn() or $this->disallow();
 325
 326                 // more precise check will be done for each performed operation
 327
 328                 // get array of itemids from request
 329                 $selected = requestIntArray('batch');
 330                 $action = requestVar('batchaction');
 331
 332                 // Show error when no items were selected
 333                 if (!is_array($selected) || sizeof($selected) == 0)
 334                         $this->error(_BATCH_NOSELECTION);
 335
 336                 // On move: when no destination blog/category chosen, show choice now
 337                 $destCatid = intRequestVar('destcatid');
 338                 if (($action == 'move') && (!$manager->existsCategory($destCatid)))
 339                         $this->batchMoveSelectDestination('item',$selected);
 340
 341                 // On delete: check if confirmation has been given
 342                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 343                         $this->batchAskDeleteConfirmation('item',$selected);
 344
 345                 $this->pagehead();
 346
 347                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 348                 echo '<h2>',_BATCH_ITEMS,'</h2>';
 349                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 350                 echo '<ul>';
 351
 352
 353                 // walk over all itemids and perform action
 354                 foreach ($selected as $itemid) {
 355                         $itemid = intval($itemid);
 356                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';
 357
 358                         // perform action, display errors if needed
 359                         switch($action) {
 360                                 case 'delete':
 361                                         $error = $this->deleteOneItem($itemid);
 362                                         break;
 363                                 case 'move':
 364                                         $error = $this->moveOneItem($itemid, $destCatid);
 365                                         break;
 366                                 default:
 367                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);
 368                         }
 369
 370                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 371                         echo '</li>';
 372                 }
 373
 374                 echo '</ul>';
 375                 echo '<b>',_BATCH_DONE,'</b>';
 376
 377                 $this->pagefoot();
 378
 379
 380         }
 381
 382         /**
 383          * @todo document this
 384          */
 385         function action_batchcomment() {
 386                 global $member;
 387
 388                 // check if logged in
 389                 $member->isLoggedIn() or $this->disallow();
 390
 391                 // more precise check will be done for each performed operation
 392
 393                 // get array of itemids from request
 394                 $selected = requestIntArray('batch');
 395                 $action = requestVar('batchaction');
 396
 397                 // Show error when no items were selected
 398                 if (!is_array($selected) || sizeof($selected) == 0)
 399                         $this->error(_BATCH_NOSELECTION);
 400
 401                 // On delete: check if confirmation has been given
 402                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 403                         $this->batchAskDeleteConfirmation('comment',$selected);
 404
 405                 $this->pagehead();
 406
 407                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 408                 echo '<h2>',_BATCH_COMMENTS,'</h2>';
 409                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 410                 echo '<ul>';
 411
 412                 // walk over all itemids and perform action
 413                 foreach ($selected as $commentid) {
 414                         $commentid = intval($commentid);
 415                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';
 416
 417                         // perform action, display errors if needed
 418                         switch($action) {
 419                                 case 'delete':
 420                                         $error = $this->deleteOneComment($commentid);
 421                                         break;
 422                                 default:
 423                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);
 424                         }
 425
 426                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 427                         echo '</li>';
 428                 }
 429
 430                 echo '</ul>';
 431                 echo '<b>',_BATCH_DONE,'</b>';
 432
 433                 $this->pagefoot();
 434
 435
 436         }
 437
 438         /**
 439          * @todo document this
 440          */
 441         function action_batchmember() {
 442                 global $member;
 443
 444                 // check if logged in and admin
 445                 ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();
 446
 447                 // get array of itemids from request
 448                 $selected = requestIntArray('batch');
 449                 $action = requestVar('batchaction');
 450
 451                 // Show error when no members selected
 452                 if (!is_array($selected) || sizeof($selected) == 0)
 453                         $this->error(_BATCH_NOSELECTION);
 454
 455                 // On delete: check if confirmation has been given
 456                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 457                         $this->batchAskDeleteConfirmation('member',$selected);
 458
 459                 $this->pagehead();
 460
 461                 echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';
 462                 echo '<h2>',_BATCH_MEMBERS,'</h2>';
 463                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 464                 echo '<ul>';
 465
 466                 // walk over all itemids and perform action
 467                 foreach ($selected as $memberid) {
 468                         $memberid = intval($memberid);
 469                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';
 470
 471                         // perform action, display errors if needed
 472                         switch($action) {
 473                                 case 'delete':
 474                                         $error = $this->deleteOneMember($memberid);
 475                                         break;
 476                                 case 'setadmin':
 477                                         // always succeeds
 478                                         sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);
 479                                         $error = '';
 480                                         break;
 481                                 case 'unsetadmin':
 482                                         // there should always remain at least one super-admin
 483                                         $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');
 484                                         if (mysql_num_rows($r) < 2)
 485                                                 $error = _ERROR_ATLEASTONEADMIN;
 486                                         else
 487                                                 sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);
 488                                         break;
 489                                 default:
 490                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);
 491                         }
 492
 493                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 494                         echo '</li>';
 495                 }
 496
 497                 echo '</ul>';
 498                 echo '<b>',_BATCH_DONE,'</b>';
 499
 500                 $this->pagefoot();
 501
 502
 503         }
 504
 505         /**
 506          * @todo document this
 507          */
 508         function action_batchteam() {
 509                 global $member;
 510
 511                 $blogid = intRequestVar('blogid');
 512
 513                 // check if logged in and admin
 514                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();
 515
 516                 // get array of itemids from request
 517                 $selected = requestIntArray('batch');
 518                 $action = requestVar('batchaction');
 519
 520                 // Show error when no members selected
 521                 if (!is_array($selected) || sizeof($selected) == 0)
 522                         $this->error(_BATCH_NOSELECTION);
 523
 524                 // On delete: check if confirmation has been given
 525                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 526                         $this->batchAskDeleteConfirmation('team',$selected);
 527
 528                 $this->pagehead();
 529
 530                 echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';
 531
 532                 echo '<h2>',_BATCH_TEAM,'</h2>';
 533                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 534                 echo '<ul>';
 535
 536                 // walk over all itemids and perform action
 537                 foreach ($selected as $memberid) {
 538                         $memberid = intval($memberid);
 539                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';
 540
 541                         // perform action, display errors if needed
 542                         switch($action) {
 543                                 case 'delete':
 544                                         $error = $this->deleteOneTeamMember($blogid, $memberid);
 545                                         break;
 546                                 case 'setadmin':
 547                                         // always succeeds
 548                                         sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);
 549                                         $error = '';
 550                                         break;
 551                                 case 'unsetadmin':
 552                                         // there should always remain at least one admin
 553                                         $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);
 554                                         if (mysql_num_rows($r) < 2)
 555                                                 $error = _ERROR_ATLEASTONEBLOGADMIN;
 556                                         else
 557                                                 sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);
 558                                         break;
 559                                 default:
 560                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);
 561                         }
 562
 563                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 564                         echo '</li>';
 565                 }
 566
 567                 echo '</ul>';
 568                 echo '<b>',_BATCH_DONE,'</b>';
 569
 570                 $this->pagefoot();
 571
 572
 573         }
 574
 575         /**
 576          * @todo document this
 577          */
 578         function action_batchcategory() {
 579                 global $member, $manager;
 580
 581                 // check if logged in
 582                 $member->isLoggedIn() or $this->disallow();
 583
 584                 // more precise check will be done for each performed operation
 585
 586                 // get array of itemids from request
 587                 $selected = requestIntArray('batch');
 588                 $action = requestVar('batchaction');
 589
 590                 // Show error when no items were selected
 591                 if (!is_array($selected) || sizeof($selected) == 0)
 592                         $this->error(_BATCH_NOSELECTION);
 593
 594                 // On move: when no destination blog chosen, show choice now
 595                 $destBlogId = intRequestVar('destblogid');
 596                 if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))
 597                         $this->batchMoveCategorySelectDestination('category',$selected);
 598
 599                 // On delete: check if confirmation has been given
 600                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 601                         $this->batchAskDeleteConfirmation('category',$selected);
 602
 603                 $this->pagehead();
 604
 605                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 606                 echo '<h2>',BATCH_CATEGORIES,'</h2>';
 607                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 608                 echo '<ul>';
 609
 610                 // walk over all itemids and perform action
 611                 foreach ($selected as $catid) {
 612                         $catid = intval($catid);
 613                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';
 614
 615                         // perform action, display errors if needed
 616                         switch($action) {
 617                                 case 'delete':
 618                                         $error = $this->deleteOneCategory($catid);
 619                                         break;
 620                                 case 'move':
 621                                         $error = $this->moveOneCategory($catid, $destBlogId);
 622                                         break;
 623                                 default:
 624                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);
 625                         }
 626
 627                         echo '<b>',($error ? 'Error: '.$error : _BATCH_SUCCESS),'</b>';
 628                         echo '</li>';
 629                 }
 630
 631                 echo '</ul>';
 632                 echo '<b>',_BATCH_DONE,'</b>';
 633
 634                 $this->pagefoot();
 635
 636         }
 637
 638         /**
 639          * @todo document this
 640          */
 641         function batchMoveSelectDestination($type, $ids) {
 642                 global $manager;
 643                 $this->pagehead();
 644                 ?>
 645                 <h2><?php echo _MOVE_TITLE?></h2>
 646                 <form method="post" action="index.php"><div>
 647
 648                         <input type="hidden" name="action" value="batch<?php echo $type?>" />
 649                         <input type="hidden" name="batchaction" value="move" />
 650                         <?php
 651                                 $manager->addTicketHidden();
 652
 653                                 // insert selected item numbers
 654                                 $idx = 0;
 655                                 foreach ($ids as $id)
 656                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 657
 658                                 // show blog/category selection list
 659                                 $this->selectBlogCategory('destcatid');
 660
 661                         ?>
 662
 663
 664                         <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />
 665
 666                 </div></form>
 667                 <?php           $this->pagefoot();
 668                 exit;
 669         }
 670
 671         /**
 672          * @todo document this
 673          */
 674         function batchMoveCategorySelectDestination($type, $ids) {
 675                 global $manager;
 676                 $this->pagehead();
 677                 ?>
 678                 <h2><?php echo _MOVECAT_TITLE?></h2>
 679                 <form method="post" action="index.php"><div>
 680
 681                         <input type="hidden" name="action" value="batch<?php echo $type?>" />
 682                         <input type="hidden" name="batchaction" value="move" />
 683                         <?php
 684                                 $manager->addTicketHidden();
 685
 686                                 // insert selected item numbers
 687                                 $idx = 0;
 688                                 foreach ($ids as $id)
 689                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 690
 691                                 // show blog/category selection list
 692                                 $this->selectBlog('destblogid');
 693
 694                         ?>
 695
 696
 697                         <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />
 698
 699                 </div></form>
 700                 <?php           $this->pagefoot();
 701                 exit;
 702         }
 703
 704         /**
 705          * @todo document this
 706          */
 707         function batchAskDeleteConfirmation($type, $ids) {
 708                 global $manager;
 709
 710                 $this->pagehead();
 711                 ?>
 712                 <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>
 713                 <form method="post" action="index.php"><div>
 714
 715                         <input type="hidden" name="action" value="batch<?php echo $type?>" />
 716                         <?php $manager->addTicketHidden() ?>
 717                         <input type="hidden" name="batchaction" value="delete" />
 718                         <input type="hidden" name="confirmation" value="yes" />
 719                         <?php                           // insert selected item numbers
 720                                 $idx = 0;
 721                                 foreach ($ids as $id)
 722                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 723
 724                                 // add hidden vars for team & comment
 725                                 if ($type == 'team')
 726                                 {
 727                                         echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';
 728                                 }
 729                                 if ($type == 'comment')
 730                                 {
 731                                         echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';
 732                                 }
 733
 734                         ?>
 735
 736                         <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />
 737
 738                 </div></form>
 739                 <?php           $this->pagefoot();
 740                 exit;
 741         }
 742
 743
 744         /**
 745          * Inserts a HTML select element with choices for all categories to which the current
 746          * member has access
 747          * @see function selectBlog
 748          */
 749         function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 750                 ADMIN::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);
 751         }
 752
 753         /**
 754          * Inserts a HTML select element with choices for all blogs to which the user has access
 755          *              mode = 'blog' => shows blognames and values are blogids
 756          *              mode = 'category' => show category names and values are catids
 757          *
 758          * @param $iForcedBlogInclude
 759          *              ID of a blog that always needs to be included, without checking if the
 760          *              member is on the blog team (-1 = none)
 761          * @todo document parameters
 762          */
 763         function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 764                 global $member, $CONF;
 765
 766                 // 0. get IDs of blogs to which member can post items (+ forced blog)
 767                 $aBlogIds = array();
 768                 if ($iForcedBlogInclude != -1)
 769                         $aBlogIds[] = intval($iForcedBlogInclude);
 770
 771                 if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))
 772                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';
 773                 else
 774                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();
 775                 $rblogids = sql_query($queryBlogs);
 776                 while ($o = mysql_fetch_object($rblogids))
 777                         if ($o->bnumber != $iForcedBlogInclude)
 778                                 $aBlogIds[] = intval($o->bnumber);
 779
 780                 if (count($aBlogIds) == 0)
 781                         return;
 782
 783                 echo '<select name="',$name,'" tabindex="',$tabindex,'">';
 784
 785                 // 1. select blogs (we'll create optiongroups)
 786                 // (only select those blogs that have the user on the team)
 787                 $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';
 788                 $blogs = sql_query($queryBlogs);
 789                 if ($mode == 'category') {
 790                         if (mysql_num_rows($blogs) > 1)
 791                                 $multipleBlogs = 1;
 792
 793                         while ($oBlog = mysql_fetch_object($blogs)) {
 794                                 if ($multipleBlogs)
 795                                         echo '<optgroup label="',htmlspecialchars($oBlog->bname),'">';
 796
 797                                 // show selection to create new category when allowed/wanted
 798                                 if ($showNewCat) {
 799                                         // check if allowed to do so
 800                                         if ($member->blogAdminRights($oBlog->bnumber))
 801                                                 echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';
 802                                 }
 803
 804                                 // 2. for each category in that blog
 805                                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');
 806                                 while ($oCat = mysql_fetch_object($categories)) {
 807                                         if ($oCat->catid == $selected)
 808                                                 $selectText = ' selected="selected" ';
 809                                         else
 810                                                 $selectText = '';
 811                                         echo '<option value="',$oCat->catid,'" ', $selectText,'>',htmlspecialchars($oCat->cname),'</option>';
 812                                 }
 813
 814                                 if ($multipleBlogs)
 815                                         echo '</optgroup>';
 816                         }
 817                 } else {
 818                         // blog mode
 819                         while ($oBlog = mysql_fetch_object($blogs)) {
 820                                 echo '<option value="',$oBlog->bnumber,'"';
 821                                 if ($oBlog->bnumber == $selected)
 822                                         echo ' selected="selected"';
 823                                 echo'>',htmlspecialchars($oBlog->bname),'</option>';
 824                         }
 825                 }
 826                 echo '</select>';
 827
 828         }
 829
 830         /**
 831          * @todo document this
 832          */
 833         function action_browseownitems() {
 834                 global $member, $manager;
 835
 836                 $this->pagehead();
 837
 838                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 839                 echo '<h2>' . _ITEMLIST_YOUR. '</h2>';
 840
 841                 // start index
 842                 if (postVar('start'))
 843                         $start = intPostVar('start');
 844                 else
 845                         $start = 0;
 846
 847                 // amount of items to show
 848                 if (postVar('amount'))
 849                         $amount = intPostVar('amount');
 850                 else
 851                         $amount = 10;
 852
 853                 $search = postVar('search');    // search through items
 854
 855                 $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'
 856                            . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')
 857                            . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';
 858
 859                 if ($search)
 860                         $query .= ' and ((ititle LIKE "%' . addslashes($search) . '%") or (ibody LIKE "%' . addslashes($search) . '%") or (imore LIKE "%' . addslashes($search) . '%"))';
 861
 862                 $query .= ' ORDER BY itime DESC'
 863                                 . " LIMIT $start,$amount";
 864
 865                 $template['content'] = 'itemlist';
 866                 $template['now'] = time();
 867
 868                 $manager->loadClass("ENCAPSULATE");
 869                 $navList =& new NAVLIST('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);
 870                 $navList->showBatchList('item',$query,'table',$template);
 871
 872                 $this->pagefoot();
 873
 874         }
 875
 876         /**
 877          * Show all the comments for a given item
 878          * @param int $itemid
 879          */
 880         function action_itemcommentlist($itemid = '') {
 881                 global $member, $manager;
 882
 883                 if ($itemid == '')
 884                         $itemid = intRequestVar('itemid');
 885
 886                 // only allow if user is allowed to alter item
 887                 $member->canAlterItem($itemid) or $this->disallow();
 888
 889                 $blogid = getBlogIdFromItemId($itemid);
 890
 891                 $this->pagehead();
 892
 893                 // start index
 894                 if (postVar('start'))
 895                         $start = intPostVar('start');
 896                 else
 897                         $start = 0;
 898
 899                 // amount of items to show
 900                 if (postVar('amount'))
 901                         $amount = intPostVar('amount');
 902                 else
 903                         $amount = 10;
 904
 905                 $search = postVar('search');
 906
 907                 echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';
 908                 echo '<h2>',_COMMENTS,'</h2>';
 909
 910                 $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE citem=' . $itemid;
 911
 912                 if ($search)
 913                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
 914
 915                 $query .= ' ORDER BY ctime ASC'
 916                                 . " LIMIT $start,$amount";
 917
 918                 $template['content'] = 'commentlist';
 919                 $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));
 920
 921                 $manager->loadClass("ENCAPSULATE");
 922                 $navList =& new NAVLIST('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);
 923                 $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);
 924
 925                 $this->pagefoot();
 926         }
 927
 928         /**
 929          * Browse own comments
 930          */
 931         function action_browseowncomments() {
 932                 global $member, $manager;
 933
 934                 // start index
 935                 if (postVar('start'))
 936                         $start = intPostVar('start');
 937                 else
 938                         $start = 0;
 939
 940                 // amount of items to show
 941                 if (postVar('amount'))
 942                         $amount = intPostVar('amount');
 943                 else
 944                         $amount = 10;
 945
 946                 $search = postVar('search');
 947
 948
 949                 $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();
 950
 951                 if ($search)
 952                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
 953
 954                 $query .= ' ORDER BY ctime DESC'
 955                                 . " LIMIT $start,$amount";
 956
 957                 $this->pagehead();
 958
 959                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 960                 echo '<h2>', _COMMENTS_YOUR ,'</h2>';
 961
 962                 $template['content'] = 'commentlist';
 963                 $template['canAddBan'] = 0;     // doesn't make sense to allow banning yourself
 964
 965                 $manager->loadClass("ENCAPSULATE");
 966                 $navList =& new NAVLIST('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);
 967                 $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);
 968
 969                 $this->pagefoot();
 970         }
 971
 972         /**
 973          * Browse all comments for a weblog
 974          * @param int $blogid
 975          */
 976         function action_blogcommentlist($blogid = '')
 977         {
 978                 global $member, $manager;
 979
 980                 if ($blogid == '')
 981                         $blogid = intRequestVar('blogid');
 982                 else
 983                         $blogid = intval($blogid);
 984
 985                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 986
 987                 // start index
 988                 if (postVar('start'))
 989                         $start = intPostVar('start');
 990                 else
 991                         $start = 0;
 992
 993                 // amount of items to show
 994                 if (postVar('amount'))
 995                         $amount = intPostVar('amount');
 996                 else
 997                         $amount = 10;
 998
 999                 $search = postVar('search');            // search through comments
1000
1001
1002                 $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);
1003
1004                 if ($search != '')
1005                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
1006
1007
1008                 $query .= ' ORDER BY ctime DESC'
1009                                 . " LIMIT $start,$amount";
1010
1011
1012                 $blog =& $manager->getBlog($blogid);
1013
1014                 $this->pagehead();
1015
1016                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1017                 echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';
1018
1019                 $template['content'] = 'commentlist';
1020                 $template['canAddBan'] = $member->blogAdminRights($blogid);
1021
1022                 $manager->loadClass("ENCAPSULATE");
1023                 $navList =& new NAVLIST('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);
1024                 $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);
1025
1026                 $this->pagefoot();
1027         }
1028
1029         /**
1030          * Provide a page to item a new item to the given blog
1031          */
1032         function action_createitem() {
1033                 global $member, $manager;
1034
1035                 $blogid = intRequestVar('blogid');
1036
1037                 // check if allowed
1038                 $member->teamRights($blogid) or $this->disallow();
1039
1040                 $memberid = $member->getID();
1041
1042                 $blog =& $manager->getBlog($blogid);
1043
1044                 $this->pagehead();
1045
1046                 // generate the add-item form
1047                 $formfactory =& new PAGEFACTORY($blogid);
1048                 $formfactory->createAddForm('admin');
1049
1050                 $this->pagefoot();
1051         }
1052
1053         /**
1054          * @todo document this
1055          */
1056         function action_itemedit() {
1057                 global $member, $manager;
1058
1059                 $itemid = intRequestVar('itemid');
1060
1061                 // only allow if user is allowed to alter item
1062                 $member->canAlterItem($itemid) or $this->disallow();
1063
1064                 $item =& $manager->getItem($itemid,1,1);
1065                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));
1066
1067                 $manager->notify('PrepareItemForEdit', array('item' => &$item));
1068
1069                 if ($blog->convertBreaks()) {
1070                         $item['body'] = removeBreaks($item['body']);
1071                         $item['more'] = removeBreaks($item['more']);
1072                 }
1073
1074                 // form to edit blog items
1075                 $this->pagehead();
1076                 $formfactory =& new PAGEFACTORY($blog->getID());
1077                 $formfactory->createEditForm('admin',$item);
1078                 $this->pagefoot();
1079         }
1080
1081         /**
1082          * @todo document this
1083          */
1084         function action_itemupdate() {
1085                 global $member, $manager, $CONF;
1086
1087                 $itemid = intRequestVar('itemid');
1088                 $catid = postVar('catid');
1089
1090                 // only allow if user is allowed to alter item
1091                 $member->canUpdateItem($itemid, $catid) or $this->disallow();
1092
1093                 $actiontype = postVar('actiontype');
1094
1095                 // delete actions are handled by itemdelete (which has confirmation)
1096                 if ($actiontype == 'delete') {
1097                         $this->action_itemdelete();
1098                         return;
1099                 }
1100
1101                 $body   = postVar('body');
1102                 $title  = postVar('title');
1103                 $more   = postVar('more');
1104                 $closed = intPostVar('closed');
1105                 $draftid = intPostVar('draftid');
1106
1107                 // default action = add now
1108                 if (!$actiontype)
1109                         $actiontype='addnow';
1110
1111                 // create new category if needed
1112                 if (strstr($catid,'newcat')) {
1113                         // get blogid
1114                         list($blogid) = sscanf($catid,"newcat-%d");
1115
1116                         // create
1117                         $blog =& $manager->getBlog($blogid);
1118                         $catid = $blog->createNewCategory();
1119
1120                         // show error when sth goes wrong
1121                         if (!$catid)
1122                                 $this->doError(_ERROR_CATCREATEFAIL);
1123                 }
1124
1125                 /*
1126                         set some variables based on actiontype
1127
1128                         actiontypes:
1129                                 draft items -> addnow, addfuture, adddraft, delete
1130                                 non-draft items -> edit, changedate, delete
1131
1132                         variables set:
1133                                 $timestamp: set to a nonzero value for future dates or date changes
1134                                 $wasdraft: set to 1 when the item used to be a draft item
1135                                 $publish: set to 1 when the edited item is not a draft
1136                 */
1137                 switch ($actiontype) {
1138                         case 'adddraft':
1139                                 $publish = 0;
1140                                 $wasdraft = 1;
1141                                 $timestamp = 0;
1142                                 break;
1143                         case 'addfuture':
1144                                 $wasdraft = 1;
1145                                 $publish = 1;
1146                                 $timestamp = mktime(postVar('hour'), postVar('minutes'), 0, postVar('month'), postVar('day'), postVar('year'));
1147                                 break;
1148                         case 'addnow':
1149                                 $wasdraft = 1;
1150                                 $publish = 1;
1151                                 $timestamp = 0;
1152                                 break;
1153                         case 'changedate':
1154                                 $timestamp = mktime(postVar('hour'), postVar('minutes'), 0, postVar('month'), postVar('day'), postVar('year'));
1155                                 $publish = 1;
1156                                 $wasdraft = 0;
1157                                 break;
1158                         case 'edit':
1159                         default:
1160                                 $publish = 1;
1161                                 $wasdraft = 0;
1162                                 $timestamp = 0;
1163                 }
1164
1165                 // edit the item for real
1166                 ITEM::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
1167
1168                 $blogid = getBlogIDFromItemID($itemid);
1169                 $blog =& $manager->getBlog($blogid);
1170
1171                 $isFuture = 0;
1172                 if ($timestamp > $blog->getCorrectTime(time())) {
1173                         $isFuture = 1;
1174                 }
1175
1176                 $this->updateFuturePosted($blogid);
1177
1178                 if ($draftid > 0 && $member->canAlterItem($draftid)) {
1179                         ITEM::delete($draftid);
1180                 }
1181
1182                 if (!$closed && $publish && $wasdraft && $blog->sendPing() && numberOfEventSubscriber('SendPing') > 0 && !$isFuture) {
1183                         $this->action_sendping($blogid);
1184                         return;
1185                 }
1186
1187                 // show category edit window when we created a new category
1188                 // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')
1189                 if ($catid != intPostVar('catid')) {
1190                         $this->action_categoryedit(
1191                                 $catid,
1192                                 $blog->getID(),
1193                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
1194                         );
1195                 } else {
1196                         // TODO: set start item correctly for itemlist
1197                         $this->action_itemlist(getBlogIDFromItemID($itemid));
1198                 }
1199         }
1200
1201         /**
1202          * @todo document this
1203          */
1204         function action_itemdelete() {
1205                 global $member, $manager;
1206
1207                 $itemid = intRequestVar('itemid');
1208
1209                 // only allow if user is allowed to alter item
1210                 $member->canAlterItem($itemid) or $this->disallow();
1211
1212                 if (!$manager->existsItem($itemid,1,1))
1213                         $this->error(_ERROR_NOSUCHITEM);
1214
1215                 $item =& $manager->getItem($itemid,1,1);
1216                 $title = htmlspecialchars(strip_tags($item['title']));
1217                 $body = strip_tags($item['body']);
1218                 $body = htmlspecialchars(shorten($body,300,'...'));
1219
1220                 $this->pagehead();
1221                 ?>
1222                         <h2><?php echo _DELETE_CONFIRM?></h2>
1223
1224                         <p><?php echo _CONFIRMTXT_ITEM?></p>
1225
1226                         <div class="note">
1227                                 <b>"<?php echo  $title ?>"</b>
1228                                 <br />
1229                                 <?php echo $body?>
1230                         </div>
1231
1232                         <form method="post" action="index.php"><div>
1233                                 <input type="hidden" name="action" value="itemdeleteconfirm" />
1234                                 <?php $manager->addTicketHidden() ?>
1235                                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1236                                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>"  tabindex="10" />
1237                         </div></form>
1238                 <?php
1239                 $this->pagefoot();
1240         }
1241
1242         /**
1243          * @todo document this
1244          */
1245         function action_itemdeleteconfirm() {
1246                 global $member;
1247
1248                 $itemid = intRequestVar('itemid');
1249
1250                 // only allow if user is allowed to alter item
1251                 $member->canAlterItem($itemid) or $this->disallow();
1252
1253                 // get blogid first
1254                 $blogid = getBlogIdFromItemId($itemid);
1255
1256                 // delete item (note: some checks will be performed twice)
1257                 $this->deleteOneItem($itemid);
1258
1259                 $this->action_itemlist($blogid);
1260         }
1261
1262         /**
1263          * Deletes one item and returns error if something goes wrong
1264          * @param int $itemid
1265          */
1266         function deleteOneItem($itemid) {
1267                 global $member, $manager;
1268
1269                 // only allow if user is allowed to alter item (also checks if itemid exists)
1270                 if (!$member->canAlterItem($itemid))
1271                         return _ERROR_DISALLOWED;
1272
1273                 // need to get blogid before the item is deleted
1274                 $blogid = getBlogIDFromItemId($itemid);
1275
1276                 $manager->loadClass('ITEM');
1277                 ITEM::delete($itemid);
1278
1279                 // update blog's futureposted
1280                 $this->updateFuturePosted($blogid);
1281         }
1282
1283         /**
1284          * Update a blog's future posted flag
1285          * @param int $blogid
1286          */
1287         function updateFuturePosted($blogid) {
1288                 global $manager;
1289
1290                 $blog =& $manager->getBlog($blogid);
1291                 $currenttime = $blog->getCorrectTime(time());
1292                 $result = sql_query("SELECT * FROM ".sql_table('item').
1293                         " WHERE iblog='".$blogid."' AND iposted=0 AND itime>".mysqldate($currenttime));
1294                 if (mysql_num_rows($result) > 0) {
1295                                 $blog->setFuturePost();
1296                 }
1297                 else {
1298                                 $blog->clearFuturePost();
1299                 }
1300         }
1301
1302         /**
1303          * @todo document this
1304          */
1305         function action_itemmove() {
1306                 global $member, $manager;
1307
1308                 $itemid = intRequestVar('itemid');
1309
1310                 // only allow if user is allowed to alter item
1311                 $member->canAlterItem($itemid) or $this->disallow();
1312
1313                 $item =& $manager->getItem($itemid,1,1);
1314
1315                 $this->pagehead();
1316                 ?>
1317                         <h2><?php echo _MOVE_TITLE?></h2>
1318                         <form method="post" action="index.php"><div>
1319                                 <input type="hidden" name="action" value="itemmoveto" />
1320                                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1321
1322                                 <?php
1323
1324                                         $manager->addTicketHidden();
1325                                         $this->selectBlogCategory('catid',$item['catid'],10,1);
1326                                 ?>
1327
1328                                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />
1329                         </div></form>
1330                 <?php
1331                 $this->pagefoot();
1332         }
1333
1334         /**
1335          * @todo document this
1336          */
1337         function action_itemmoveto() {
1338                 global $member, $manager;
1339
1340                 $itemid = intRequestVar('itemid');
1341                 $catid = requestVar('catid');
1342
1343                 // create new category if needed
1344                 if (strstr($catid,'newcat')) {
1345                         // get blogid
1346                         list($blogid) = sscanf($catid,'newcat-%d');
1347
1348                         // create
1349                         $blog =& $manager->getBlog($blogid);
1350                         $catid = $blog->createNewCategory();
1351
1352                         // show error when sth goes wrong
1353                         if (!$catid)
1354                                 $this->doError(_ERROR_CATCREATEFAIL);
1355                 }
1356
1357                 // only allow if user is allowed to alter item
1358                 $member->canUpdateItem($itemid, $catid) or $this->disallow();
1359
1360                 $old_blogid = getBlogIDFromItemId($itemid);
1361
1362                 ITEM::move($itemid, $catid);
1363
1364                 // set the futurePosted flag on the blog
1365                 $this->updateFuturePosted(getBlogIDFromItemId($itemid));
1366
1367                 // reset the futurePosted in case the item is moved from one blog to another
1368                 $this->updateFuturePosted($old_blogid);
1369
1370                 if ($catid != intRequestVar('catid'))
1371                         $this->action_categoryedit($catid, $blog->getID());
1372                 else
1373                         $this->action_itemlist(getBlogIDFromCatID($catid));
1374         }
1375
1376         /**
1377          * Moves one item to a given category (category existance should be checked by caller)
1378          * errors are returned
1379          * @param int $itemid
1380          * @param int $destCatid category ID to which the item will be moved
1381          */
1382         function moveOneItem($itemid, $destCatid) {
1383                 global $member;
1384
1385                 // only allow if user is allowed to move item
1386                 if (!$member->canUpdateItem($itemid, $destCatid))
1387                         return _ERROR_DISALLOWED;
1388
1389                 ITEM::move($itemid, $destCatid);
1390         }
1391
1392         /**
1393          * Adds a item to the chosen blog
1394          */
1395         function action_additem() {
1396                 global $member, $manager, $CONF;
1397
1398                 $manager->loadClass('ITEM');
1399
1400                 $result = ITEM::createFromRequest();
1401
1402                 if ($result['status'] == 'error')
1403                         $this->error($result['message']);
1404
1405                 $blogid = getBlogIDFromItemID($result['itemid']);
1406                 $blog =& $manager->getBlog($blogid);
1407
1408                 $pingUrl = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=sendping&blogid=' . intval($blogid));
1409
1410                 if ($result['status'] == 'newcategory')
1411                         $this->action_categoryedit(
1412                                 $result['catid'],
1413                                 $blogid,
1414                                 $blog->sendPing() && numberOfEventSubscriber('SendPing') > 0 ? $pingUrl : ''
1415                         );
1416                 elseif ((postVar('actiontype') == 'addnow') && $blog->sendPing() && numberOfEventSubscriber('SendPing') > 0)
1417                         $this->action_sendping($blogid);
1418                 else
1419                         $this->action_itemlist($blogid);
1420         }
1421
1422         /**
1423          * Shows a window that says we're about to ping.
1424          * immediately refresh to the real pinging page, which will
1425          * show an error, or redirect to the blog.
1426          *
1427          * @param int $blogid ID of blog for which ping needs to be sent out
1428          */
1429         function action_sendping($blogid = -1) {
1430                 global $member, $manager;
1431
1432                 if ($blogid == -1)
1433                         $blogid = intRequestVar('blogid');
1434
1435                 $member->isLoggedIn() or $this->disallow();
1436
1437                 $rawPingUrl = $manager->addTicketToUrl('index.php?action=rawping&blogid=' . intval($blogid));
1438
1439                 $this->pagehead('<meta http-equiv="refresh" content="1; url='.htmlspecialchars($rawPingUrl).'" />');
1440                 ?>
1441                 <h2>Site Updated, Now pinging various weblog listing services...</h2>
1442
1443                 <p>
1444                         This can take a while...
1445                 </p>
1446
1447                 <p>
1448                         If you aren't automatically passed through, <a href="index.php?action=rawping&amp;blogid=<?php echo $blogid?>">try again</a>
1449                 </p>
1450                 <?php           $this->pagefoot();
1451         }
1452
1453         /**
1454          * Sends the real ping (can take up to 10 seconds!)
1455          */
1456         function action_rawping() {
1457                 global $manager;
1458                 // TODO: checks?
1459
1460                 $blogid = intRequestVar('blogid');
1461                 $blog =& $manager->getBlog($blogid);
1462
1463                 $this->pagehead();
1464
1465                 ?>
1466
1467                 <h2>Pinging services, please wait...</h2>
1468                 <div class='note'>
1469                 <?php
1470
1471                 // send sendPing event
1472                 $manager->notify('SendPing', array('blogid' => $blogid));
1473
1474                 ?>
1475                 </div>
1476
1477                 <ul>
1478                         <li><a href="index.php?action=itemlist&amp;blogid=<?php echo $blog->getID()?>">View list of recent items for <?php echo htmlspecialchars($blog->getName())?></a></li>
1479                         <li><a href="<?php echo $blog->getURL()?>">Visit your own site</a></li>
1480                 </ul>
1481
1482                 <?php           $this->pagefoot();
1483         }
1484
1485         /**
1486          * Allows to edit previously made comments
1487          */
1488         function action_commentedit() {
1489                 global $member, $manager;
1490
1491                 $commentid = intRequestVar('commentid');
1492
1493                 $member->canAlterComment($commentid) or $this->disallow();
1494
1495                 $comment = COMMENT::getComment($commentid);
1496
1497                 $manager->notify('PrepareCommentForEdit',array('comment' => &$comment));
1498
1499                 // change <br /> to \n
1500                 $comment['body'] = str_replace('<br />','',$comment['body']);
1501
1502                 $comment['body'] = eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>","\\1",$comment['body']);
1503
1504                 $this->pagehead();
1505
1506                 ?>
1507                 <h2><?php echo _EDITC_TITLE?></h2>
1508
1509                 <form action="index.php" method="post"><div>
1510
1511                 <input type="hidden" name="action" value="commentupdate" />
1512                 <?php $manager->addTicketHidden(); ?>
1513                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1514                 <table><tr>
1515                         <th colspan="2"><?php echo _EDITC_TITLE?></th>
1516                 </tr><tr>
1517                         <td><?php echo _EDITC_WHO?></td>
1518                         <td>
1519                         <?php                           if ($comment['member'])
1520                                         echo $comment['member'] . " (" . _EDITC_MEMBER . ")";
1521                                 else
1522                                         echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";
1523                         ?>
1524                         </td>
1525                 </tr><tr>
1526                         <td><?php echo _EDITC_WHEN?></td>
1527                         <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>
1528                 </tr><tr>
1529                         <td><?php echo _EDITC_HOST?></td>
1530                         <td><?php echo  $comment['host']; ?></td>
1531                 </tr><tr>
1532                         <td><?php echo _EDITC_TEXT?></td>
1533                         <td>
1534                                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                                   // htmlspecialchars not needed (things should be escaped already)
1535                                         echo $comment['body'];
1536                                 ?></textarea>
1537                         </td>
1538                 </tr><tr>
1539                         <td><?php echo _EDITC_EDIT?></td>
1540                         <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>
1541                 </tr></table>
1542
1543                 </div></form>
1544                 <?php
1545                 $this->pagefoot();
1546         }
1547
1548         /**
1549          * @todo document this
1550          */
1551         function action_commentupdate() {
1552                 global $member, $manager;
1553
1554                 $commentid = intRequestVar('commentid');
1555
1556                 $member->canAlterComment($commentid) or $this->disallow();
1557
1558                 $body = postVar('body');
1559
1560                 // intercept words that are too long
1561                 if (eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}",$body) != false)
1562                         $this->error(_ERROR_COMMENT_LONGWORD);
1563
1564                 // check length
1565                 if (strlen($body)<3)
1566                         $this->error(_ERROR_COMMENT_NOCOMMENT);
1567                 if (strlen($body)>5000)
1568                         $this->error(_ERROR_COMMENT_TOOLONG);
1569
1570
1571                 // prepare body
1572                 $body = COMMENT::prepareBody($body);
1573
1574                 // call plugins
1575                 $manager->notify('PreUpdateComment',array('body' => &$body));
1576
1577                 $query =  'UPDATE '.sql_table('comment')
1578                            . " SET cbody='" .addslashes($body). "'"
1579                            . " WHERE cnumber=" . $commentid;
1580                 sql_query($query);
1581
1582                 // get itemid
1583                 $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);
1584                 $o = mysql_fetch_object($res);
1585                 $itemid = $o->citem;
1586
1587                 if ($member->canAlterItem($itemid))
1588                         $this->action_itemcommentlist($itemid);
1589                 else
1590                         $this->action_browseowncomments();
1591
1592         }
1593
1594         /**
1595          * @todo document this
1596          */
1597         function action_commentdelete() {
1598                 global $member, $manager;
1599
1600                 $commentid = intRequestVar('commentid');
1601
1602                 $member->canAlterComment($commentid) or $this->disallow();
1603
1604                 $comment = COMMENT::getComment($commentid);
1605
1606                 $body = strip_tags($comment['body']);
1607                 $body = htmlspecialchars(shorten($body, 300, '...'));
1608
1609                 if ($comment['member'])
1610                         $author = $comment['member'];
1611                 else
1612                         $author = $comment['user'];
1613
1614                 $this->pagehead();
1615                 ?>
1616
1617                         <h2><?php echo _DELETE_CONFIRM?></h2>
1618
1619                         <p><?php echo _CONFIRMTXT_COMMENT?></p>
1620
1621                         <div class="note">
1622                         <b><?php echo _EDITC_WHO?>:</b> <?php echo  $author ?>
1623                         <br />
1624                         <b><?php echo _EDITC_TEXT?>:</b> <?php echo  $body ?>
1625                         </div>
1626
1627                         <form method="post" action="index.php"><div>
1628                                 <input type="hidden" name="action" value="commentdeleteconfirm" />
1629                                 <?php $manager->addTicketHidden() ?>
1630                                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1631                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
1632                         </div></form>
1633                 <?php
1634                 $this->pagefoot();
1635         }
1636
1637         /**
1638          * @todo document this
1639          */
1640         function action_commentdeleteconfirm() {
1641                 global $member;
1642
1643                 $commentid = intRequestVar('commentid');
1644
1645                 // get item id first
1646                 $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);
1647                 $o = mysql_fetch_object($res);
1648                 $itemid = $o->citem;
1649
1650                 $error = $this->deleteOneComment($commentid);
1651                 if ($error)
1652                         $this->doError($error);
1653
1654                 if ($member->canAlterItem($itemid))
1655                         $this->action_itemcommentlist($itemid);
1656                 else
1657                         $this->action_browseowncomments();
1658         }
1659
1660         /**
1661          * @todo document this
1662          */
1663         function deleteOneComment($commentid) {
1664                 global $member, $manager;
1665
1666                 $commentid = intval($commentid);
1667
1668                 if (!$member->canAlterComment($commentid))
1669                         return _ERROR_DISALLOWED;
1670
1671                 $manager->notify('PreDeleteComment', array('commentid' => $commentid));
1672
1673                 // delete the comments associated with the item
1674                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;
1675                 sql_query($query);
1676
1677                 $manager->notify('PostDeleteComment', array('commentid' => $commentid));
1678
1679                 return '';
1680         }
1681
1682         /**
1683          * Usermanagement main
1684          */
1685         function action_usermanagement() {
1686                 global $member, $manager;
1687
1688                 // check if allowed
1689                 $member->isAdmin() or $this->disallow();
1690
1691                 $this->pagehead();
1692
1693                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
1694
1695                 echo '<h2>' . _MEMBERS_TITLE .'</h2>';
1696
1697                 echo '<h3>' . _MEMBERS_CURRENT .'</h3>';
1698
1699                 // show list of members with actions
1700                 $query =  'SELECT *'
1701                            . ' FROM '.sql_table('member');
1702                 $template['content'] = 'memberlist';
1703                 $template['tabindex'] = 10;
1704
1705                 $manager->loadClass("ENCAPSULATE");
1706                 $batch =& new BATCH('member');
1707                 $batch->showlist($query,'table',$template);
1708
1709                 echo '<h3>' . _MEMBERS_NEW .'</h3>';
1710                 ?>
1711                         <form method="post" action="index.php" name="memberedit"><div>
1712
1713                         <input type="hidden" name="action" value="memberadd" />
1714                         <?php $manager->addTicketHidden() ?>
1715
1716                         <table>
1717                         <tr>
1718                                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>
1719                         </tr><tr>
1720                                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1721                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1722                                 </td>
1723                                 <td><input tabindex="10010" name="name" size="16" maxlength="16" /></td>
1724                         </tr><tr>
1725                                 <td><?php echo _MEMBERS_REALNAME?></td>
1726                                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>
1727                         </tr><tr>
1728                                 <td><?php echo _MEMBERS_PWD?></td>
1729                                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>
1730                         </tr><tr>
1731                                 <td><?php echo _MEMBERS_REPPWD?></td>
1732                                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>
1733                         </tr><tr>
1734                                 <td><?php echo _MEMBERS_EMAIL?></td>
1735                                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>
1736                         </tr><tr>
1737                                 <td><?php echo _MEMBERS_URL?></td>
1738                                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>
1739                         </tr><tr>
1740                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1741                                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>
1742                         </tr><tr>
1743                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1744                                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>
1745                         </tr><tr>
1746                                 <td><?php echo _MEMBERS_NOTES?></td>
1747                                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>
1748                         </tr><tr>
1749                                 <td><?php echo _MEMBERS_NEW?></td>
1750                                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>
1751                         </tr></table>
1752
1753                         </div></form>
1754                 <?php
1755                 $this->pagefoot();
1756         }
1757
1758         /**
1759          * Edit member settings
1760          */
1761         function action_memberedit() {
1762                 $this->action_editmembersettings(intRequestVar('memberid'));
1763         }
1764
1765         /**
1766          * @todo document this
1767          */
1768         function action_editmembersettings($memberid = '') {
1769                 global $member, $manager, $CONF;
1770
1771                 if ($memberid == '')
1772                         $memberid = $member->getID();
1773
1774                 // check if allowed
1775                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1776
1777                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
1778                 $this->pagehead($extrahead);
1779
1780                 // show message to go back to member overview (only for admins)
1781                 if ($member->isAdmin())
1782                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';
1783                 else
1784                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';
1785
1786                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';
1787
1788                 $mem = MEMBER::createFromID($memberid);
1789
1790                 ?>
1791                 <form method="post" action="index.php" name="memberedit"><div>
1792
1793                 <input type="hidden" name="action" value="changemembersettings" />
1794                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
1795                 <?php $manager->addTicketHidden() ?>
1796
1797                 <table><tr>
1798                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>
1799                 </tr><tr>
1800                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1801                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1802                         </td>
1803                         <td>
1804                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1805                                 <input name="name" tabindex="10" maxlength="16" size="16" value="<?php echo  htmlspecialchars($mem->getDisplayName()); ?>" />
1806                         <?php } else {
1807                                 echo htmlspecialchars($member->getDisplayName());
1808                            }
1809                         ?>
1810                         </td>
1811                 </tr><tr>
1812                         <td><?php echo _MEMBERS_REALNAME?></td>
1813                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  htmlspecialchars($mem->getRealName()); ?>" /></td>
1814                 </tr><tr>
1815                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1816                         <td><?php echo _MEMBERS_PWD?></td>
1817                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>
1818                 </tr><tr>
1819                         <td><?php echo _MEMBERS_REPPWD?></td>
1820                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>
1821                 <?php } ?>
1822                 </tr><tr>
1823                         <td><?php echo _MEMBERS_EMAIL?>
1824                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>
1825                         </td>
1826                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  htmlspecialchars($mem->getEmail()); ?>" /></td>
1827                 </tr><tr>
1828                         <td><?php echo _MEMBERS_URL?></td>
1829                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  htmlspecialchars($mem->getURL()); ?>" /></td>
1830                 <?php // only allow to change this by super-admins
1831                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)
1832                    if ($member->isAdmin()) {
1833                 ?>
1834                         </tr><tr>
1835                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1836                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>
1837                         </tr><tr>
1838                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1839                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70,1,0,_YES,_NO,$mem->isAdmin()); ?></td>
1840                 <?php } ?>
1841                 </tr><tr>
1842                         <td><?php echo _MEMBERS_NOTES?></td>
1843                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  htmlspecialchars($mem->getNotes()); ?>" /></td>
1844                 </tr><tr>
1845                         <td><?php echo _MEMBERS_DEFLANG?> <?php help('language'); ?>
1846                         </td>
1847                         <td>
1848
1849                                 <select name="deflang" tabindex="85">
1850                                         <option value=""><?php echo _MEMBERS_USESITELANG?></option>
1851                                 <?php                           // show a dropdown list of all available languages
1852                                 global $DIR_LANG;
1853                                 $dirhandle = opendir($DIR_LANG);
1854                                 while ($filename = readdir($dirhandle)) {
1855                                         if (ereg("^(.*)\.php$",$filename,$matches)) {
1856                                                 $name = $matches[1];
1857                                                 echo "<option value='$name'";
1858                                                 if ($name == $mem->getLanguage())
1859                                                         echo " selected='selected'";
1860                                                 echo ">$name</option>";
1861                                         }
1862                                 }
1863                                 closedir($dirhandle);
1864
1865                                 ?>
1866                                 </select>
1867
1868                         </td>
1869                 </tr>
1870                 <?php
1871                         // plugin options
1872                         $this->_insertPluginOptions('member',$memberid);
1873                 ?>
1874                 <tr>
1875                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>
1876                 </tr><tr>
1877                         <td><?php echo _MEMBERS_EDIT?></td>
1878                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>
1879                 </tr></table>
1880
1881                 </div></form>
1882
1883                 <?php
1884                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
1885
1886                         $manager->notify(
1887                                 'MemberSettingsFormExtras',
1888                                 array(
1889                                         'member' => &$mem
1890                                 )
1891                         );
1892
1893                 $this->pagefoot();
1894         }
1895
1896         /**
1897          * @todo document this
1898          */
1899         function action_changemembersettings() {
1900                 global $member, $CONF, $manager;
1901
1902                 $memberid = intRequestVar('memberid');
1903
1904                 // check if allowed
1905                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1906
1907                 $name                   = trim(strip_tags(postVar('name')));
1908                 $realname               = trim(strip_tags(postVar('realname')));
1909                 $password               = postVar('password');
1910                 $repeatpassword = postVar('repeatpassword');
1911                 $email                  = strip_tags(postVar('email'));
1912                 $url                    = strip_tags(postVar('url'));
1913
1914                 // Sometimes user didn't prefix the URL with http://, this cause a malformed URL. Let's fix it.
1915                 if (!eregi("^https?://", $url))
1916                         $url = "http://".$url;
1917
1918                 $admin                  = postVar('admin');
1919                 $canlogin               = postVar('canlogin');
1920                 $notes                  = strip_tags(postVar('notes'));
1921                 $deflang                = postVar('deflang');
1922
1923                 $mem = MEMBER::createFromID($memberid);
1924
1925                 if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1926
1927                         if (!isValidDisplayName($name))
1928                                 $this->error(_ERROR_BADNAME);
1929
1930                         if (($name != $mem->getDisplayName()) && MEMBER::exists($name))
1931                                 $this->error(_ERROR_NICKNAMEINUSE);
1932
1933                         if ($password != $repeatpassword)
1934                                 $this->error(_ERROR_PASSWORDMISMATCH);
1935
1936                         if ($password && (strlen($password) < 6))
1937                                 $this->error(_ERROR_PASSWORDTOOSHORT);
1938                 }
1939
1940                 if (!isValidMailAddress($email))
1941                         $this->error(_ERROR_BADMAILADDRESS);
1942
1943
1944                 if (!$realname)
1945                         $this->error(_ERROR_REALNAMEMISSING);
1946
1947                 if (($deflang != '') && (!checkLanguage($deflang)))
1948                         $this->error(_ERROR_NOSUCHLANGUAGE);
1949
1950                 // check if there will remain at least one site member with both the logon and admin rights
1951                 // (check occurs when taking away one of these rights from such a member)
1952                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
1953                          || (!$canlogin && $mem->isAdmin() && $mem->canLogin())
1954                    )
1955                 {
1956                         $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
1957                         if (mysql_num_rows($r) < 2)
1958                                 $this->error(_ERROR_ATLEASTONEADMIN);
1959                 }
1960
1961                 if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1962                         $mem->setDisplayName($name);
1963                         if ($password)
1964                                 $mem->setPassword($password);
1965                 }
1966
1967                 $oldEmail = $mem->getEmail();
1968
1969                 $mem->setRealName($realname);
1970                 $mem->setEmail($email);
1971                 $mem->setURL($url);
1972                 $mem->setNotes($notes);
1973                 $mem->setLanguage($deflang);
1974
1975
1976                 // only allow super-admins to make changes to the admin status
1977                 if ($member->isAdmin()) {
1978                         $mem->setAdmin($admin);
1979                         $mem->setCanLogin($canlogin);
1980                 }
1981
1982
1983                 $mem->write();
1984
1985                 // store plugin options
1986                 $aOptions = requestArray('plugoption');
1987                 NucleusPlugin::_applyPluginOptions($aOptions);
1988                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));
1989
1990                 // if email changed, generate new password
1991                 if ($oldEmail != $mem->getEmail())
1992                 {
1993                         $mem->sendActivationLink('addresschange', $oldEmail);
1994                         // logout member
1995                         $mem->newCookieKey();
1996
1997                         // only log out if the member being edited is the current member.
1998                         if ($member->getID() == $memberid)
1999                                 $member->logout();
2000                         $this->action_login(_MSG_ACTIVATION_SENT, 0);
2001                         return;
2002                 }
2003
2004
2005                 if (  ( $mem->getID() == $member->getID() )
2006                    && ( $mem->getDisplayName() != $member->getDisplayName() )
2007                    ) {
2008                         $mem->newCookieKey();
2009                         $member->logout();
2010                         $this->action_login(_MSG_LOGINAGAIN, 0);
2011                 } else {
2012                         $this->action_overview(_MSG_SETTINGSCHANGED);
2013                 }
2014         }
2015
2016         /**
2017          * @todo document this
2018          */
2019         function action_memberadd() {
2020                 global $member, $manager;
2021
2022                 // check if allowed
2023                 $member->isAdmin() or $this->disallow();
2024
2025                 if (postVar('password') != postVar('repeatpassword'))
2026                         $this->error(_ERROR_PASSWORDMISMATCH);
2027                 if (strlen(postVar('password')) < 6)
2028                         $this->error(_ERROR_PASSWORDTOOSHORT);
2029
2030                 $res = MEMBER::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));
2031                 if ($res != 1)
2032                         $this->error($res);
2033
2034                 // fire PostRegister event
2035                 $newmem = new MEMBER();
2036                 $newmem->readFromName(postVar('name'));
2037                 $manager->notify('PostRegister',array('member' => &$newmem));
2038
2039                 $this->action_usermanagement();
2040         }
2041
2042         /**
2043          * Account activation
2044          *
2045          * @author dekarma
2046          */
2047         function action_activate() {
2048
2049                 $key = getVar('key');
2050                 $this->_showActivationPage($key);
2051         }
2052
2053         /**
2054          * @todo document this
2055          */
2056         function _showActivationPage($key, $message = '')
2057         {
2058                 global $manager;
2059
2060                 // clean up old activation keys
2061                 MEMBER::cleanupActivationTable();
2062
2063                 // get activation info
2064                 $info = MEMBER::getActivationInfo($key);
2065
2066                 if (!$info)
2067                         $this->error(_ERROR_ACTIVATE);
2068
2069                 $mem = MEMBER::createFromId($info->vmember);
2070
2071                 if (!$mem)
2072                         $this->error(_ERROR_ACTIVATE);
2073
2074                 $text = '';
2075                 $title = '';
2076                 $bNeedsPasswordChange = true;
2077
2078                 switch ($info->vtype)
2079                 {
2080                         case 'forgot':
2081                                 $title = _ACTIVATE_FORGOT_TITLE;
2082                                 $text = _ACTIVATE_FORGOT_TEXT;
2083                                 break;
2084                         case 'register':
2085                                 $title = _ACTIVATE_REGISTER_TITLE;
2086                                 $text = _ACTIVATE_REGISTER_TEXT;
2087                                 break;
2088                         case 'addresschange':
2089                                 $title = _ACTIVATE_CHANGE_TITLE;
2090                                 $text = _ACTIVATE_CHANGE_TEXT;
2091                                 $bNeedsPasswordChange = false;
2092                                 MEMBER::activate($key);
2093                                 break;
2094                 }
2095
2096                 $aVars = array(
2097                         'memberName' => htmlspecialchars($mem->getDisplayName())
2098                 );
2099                 $title = TEMPLATE::fill($title, $aVars);
2100                 $text = TEMPLATE::fill($text, $aVars);
2101
2102                 $this->pagehead();
2103
2104                         echo '<h2>' , $title, '</h2>';
2105                         echo '<p>' , $text, '</p>';
2106
2107                         if ($message != '')
2108                         {
2109                                 echo '<p class="error">',$message,'</p>';
2110                         }
2111
2112                         if ($bNeedsPasswordChange)
2113                         {
2114                                 ?>
2115                                         <div><form action="index.php" method="post">
2116
2117                                                 <input type="hidden" name="action" value="activatesetpwd" />
2118                                                 <?php $manager->addTicketHidden() ?>
2119                                                 <input type="hidden" name="key" value="<?php echo htmlspecialchars($key) ?>" />
2120
2121                                                 <table><tr>
2122                                                         <td><?php echo _MEMBERS_PWD?></td>
2123                                                         <td><input type="password" maxlength="40" size="16" name="password" /></td>
2124                                                 </tr><tr>
2125                                                         <td><?php echo _MEMBERS_REPPWD?></td>
2126                                                         <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>
2127                                                 <?php
2128
2129                                                         global $manager;
2130                                                         $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));
2131
2132                                                 ?>
2133                                                 </tr><tr>
2134                                                         <td><?php echo _MEMBERS_SETPWD ?></td>
2135                                                         <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>
2136                                                 </tr></table>
2137
2138
2139                                         </form></div>
2140
2141                                 <?php
2142
2143                         }
2144
2145                 $this->pagefoot();
2146
2147         }
2148
2149         /**
2150          * Account activation - set password part
2151          *
2152          * @author dekarma
2153          */
2154         function action_activatesetpwd() {
2155
2156                 $key = postVar('key');
2157
2158                 // clean up old activation keys
2159                 MEMBER::cleanupActivationTable();
2160
2161                 // get activation info
2162                 $info = MEMBER::getActivationInfo($key);
2163
2164                 if (!$info || ($info->type == 'addresschange'))
2165                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2166
2167                 $mem = MEMBER::createFromId($info->vmember);
2168
2169                 if (!$mem)
2170                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2171
2172                 $password               = postVar('password');
2173                 $repeatpassword = postVar('repeatpassword');
2174
2175                 if ($password != $repeatpassword)
2176                         return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);
2177
2178                 if ($password && (strlen($password) < 6))
2179                         return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
2180
2181                 $error = '';
2182                 global $manager;
2183                 $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));
2184                 if ($error != '')
2185                         return $this->_showActivationPage($key, $error);
2186
2187
2188                 // set password
2189                 $mem->setPassword($password);
2190                 $mem->write();
2191
2192                 // do the activation
2193                 MEMBER::activate($key);
2194
2195                 $this->pagehead();
2196                         echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';
2197                         echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';
2198                 $this->pagefoot();
2199         }
2200
2201         /**
2202          * Manage team
2203          */
2204         function action_manageteam() {
2205                 global $member, $manager;
2206
2207                 $blogid = intRequestVar('blogid');
2208
2209                 // check if allowed
2210                 $member->blogAdminRights($blogid) or $this->disallow();
2211
2212                 $this->pagehead();
2213
2214                 echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2215
2216                 echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';
2217
2218                 echo '<h3>' . _TEAM_CURRENT . '</h3>';
2219
2220
2221
2222                 $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'
2223                            . ' FROM '.sql_table('member').', '.sql_table('team')
2224                            . ' WHERE tmember=mnumber and tblog=' . $blogid;
2225
2226                 $template['content'] = 'teamlist';
2227                 $template['tabindex'] = 10;
2228
2229                 $manager->loadClass("ENCAPSULATE");
2230                 $batch =& new BATCH('team');
2231                 $batch->showlist($query, 'table', $template);
2232
2233                 ?>
2234                         <h3><?php echo _TEAM_ADDNEW?></h3>
2235
2236                         <form method='post' action='index.php'><div>
2237
2238                         <input type='hidden' name='action' value='teamaddmember' />
2239                         <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />
2240                         <?php $manager->addTicketHidden() ?>
2241
2242                         <table><tr>
2243                                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>
2244                                 <td><?php                                       // TODO: try to make it so only non-team-members are listed
2245                                         $query =  'SELECT mname as text, mnumber as value'
2246                                                    . ' FROM '.sql_table('member');
2247
2248                                         $template['name'] = 'memberid';
2249                                         $template['tabindex'] = 10000;
2250                                         showlist($query,'select',$template);
2251                                 ?></td>
2252                         </tr><tr>
2253                                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>
2254                                 <td><?php $this->input_yesno('admin',0,10020); ?></td>
2255                         </tr><tr>
2256                                 <td><?php echo _TEAM_ADD?></td>
2257                                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>
2258                         </tr></table>
2259
2260                         </div></form>
2261                 <?php
2262                 $this->pagefoot();
2263         }
2264
2265         /**
2266          * Add member to team
2267          */
2268         function action_teamaddmember() {
2269                 global $member, $manager;
2270
2271                 $memberid = intPostVar('memberid');
2272                 $blogid = intPostVar('blogid');
2273                 $admin = intPostVar('admin');
2274
2275                 // check if allowed
2276                 $member->blogAdminRights($blogid) or $this->disallow();
2277
2278                 $blog =& $manager->getBlog($blogid);
2279                 if (!$blog->addTeamMember($memberid, $admin))
2280                         $this->error(_ERROR_ALREADYONTEAM);
2281
2282                 $this->action_manageteam();
2283
2284         }
2285
2286         /**
2287          * @todo document this
2288          */
2289         function action_teamdelete() {
2290                 global $member, $manager;
2291
2292                 $memberid = intRequestVar('memberid');
2293                 $blogid = intRequestVar('blogid');
2294
2295                 // check if allowed
2296                 $member->blogAdminRights($blogid) or $this->disallow();
2297
2298                 $teammem = MEMBER::createFromID($memberid);
2299                 $blog =& $manager->getBlog($blogid);
2300
2301                 $this->pagehead();
2302                 ?>
2303                         <h2><?php echo _DELETE_CONFIRM?></h2>
2304
2305                         <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  htmlspecialchars($teammem->getDisplayName()) ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  htmlspecialchars(strip_tags($blog->getName())) ?></b>
2306                         </p>
2307
2308
2309                         <form method="post" action="index.php"><div>
2310                         <input type="hidden" name="action" value="teamdeleteconfirm" />
2311                         <?php $manager->addTicketHidden() ?>
2312                         <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
2313                         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2314                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2315                         </div></form>
2316                 <?php
2317                 $this->pagefoot();
2318         }
2319
2320         /**
2321          * @todo document this
2322          */
2323         function action_teamdeleteconfirm() {
2324                 global $member;
2325
2326                 $memberid = intRequestVar('memberid');
2327                 $blogid = intRequestVar('blogid');
2328
2329                 $error = $this->deleteOneTeamMember($blogid, $memberid);
2330                 if ($error)
2331                         $this->error($error);
2332
2333
2334                 $this->action_manageteam();
2335         }
2336
2337         /**
2338          * @todo document this
2339          */
2340         function deleteOneTeamMember($blogid, $memberid) {
2341                 global $member, $manager;
2342
2343                 $blogid = intval($blogid);
2344                 $memberid = intval($memberid);
2345
2346                 // check if allowed
2347                 if (!$member->blogAdminRights($blogid))
2348                         return _ERROR_DISALLOWED;
2349
2350                 // check if: - there remains at least one blog admin
2351                 //           - (there remains at least one team member)
2352                 $mem = MEMBER::createFromID($memberid);
2353
2354                 $manager->notify('PreDeleteTeamMember', array('member' => &$mem, 'blogid' => $blogid));
2355
2356                 if ($mem->isBlogAdmin($blogid)) {
2357                         // check if there are more blog members left and at least one admin
2358                         // (check for at least two admins before deletion)
2359                         $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';
2360                         $r = sql_query($query);
2361                         if (mysql_num_rows($r) < 2)
2362                                 return _ERROR_ATLEASTONEBLOGADMIN;
2363                 }
2364
2365                 $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";
2366                 sql_query($query);
2367
2368                 $manager->notify('PostDeleteTeamMember', array('member' => &$mem, 'blogid' => $blogid));
2369
2370                 return '';
2371         }
2372
2373         /**
2374          * @todo document this
2375          */
2376         function action_teamchangeadmin() {
2377                 global $member;
2378
2379                 $blogid = intRequestVar('blogid');
2380                 $memberid = intRequestVar('memberid');
2381
2382                 // check if allowed
2383                 $member->blogAdminRights($blogid) or $this->disallow();
2384
2385                 $mem = MEMBER::createFromID($memberid);
2386
2387                 // don't allow when there is only one admin at this moment
2388                 if ($mem->isBlogAdmin($blogid)) {
2389                         $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");
2390                         if (mysql_num_rows($r) == 1)
2391                                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);
2392                 }
2393
2394                 if ($mem->isBlogAdmin($blogid))
2395                         $newval = 0;
2396                 else
2397                         $newval = 1;
2398
2399                 $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";
2400                 sql_query($query);
2401
2402                 // only show manageteam if member did not change its own admin privileges
2403                 if ($member->isBlogAdmin($blogid))
2404                         $this->action_manageteam();
2405                 else
2406                         $this->action_overview(_MSG_ADMINCHANGED);
2407         }
2408
2409         /**
2410          * @todo document this
2411          */
2412         function action_blogsettings() {
2413                 global $member, $manager;
2414
2415                 $blogid = intRequestVar('blogid');
2416
2417                 // check if allowed
2418                 $member->blogAdminRights($blogid) or $this->disallow();
2419
2420                 $blog =& $manager->getBlog($blogid);
2421
2422                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2423                 $this->pagehead($extrahead);
2424
2425                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
2426                 ?>
2427                 <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>
2428
2429                 <h3><?php echo _EBLOG_TEAM_TITLE?></h3>
2430
2431                 <p>Members currently on your team:
2432                 <?php
2433                         $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));
2434                         $aMemberNames = array();
2435                         while ($o = mysql_fetch_object($res))
2436                                 array_push($aMemberNames, htmlspecialchars($o->mname) . ' (' . htmlspecialchars($o->mrealname). ')');
2437                         echo implode(',', $aMemberNames);
2438                 ?>
2439                 </p>
2440
2441
2442
2443                 <p>
2444                 <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>
2445                 </p>
2446
2447                 <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>
2448
2449                 <form method="post" action="index.php"><div>
2450
2451                 <input type="hidden" name="action" value="blogsettingsupdate" />
2452                 <?php $manager->addTicketHidden() ?>
2453                 <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2454                 <table><tr>
2455                         <td><?php echo _EBLOG_NAME?></td>
2456                         <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  htmlspecialchars($blog->getName()) ?>" /></td>
2457                 </tr><tr>
2458                         <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>
2459                                 <?php echo _EBLOG_SHORTNAME_EXTRA?>
2460                         </td>
2461                         <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  htmlspecialchars($blog->getShortName()) ?>" /></td>
2462                 </tr><tr>
2463                         <td><?php echo _EBLOG_DESC?></td>
2464                         <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  htmlspecialchars($blog->getDescription()) ?>" /></td>
2465                 </tr><tr>
2466                         <td><?php echo _EBLOG_URL?></td>
2467                         <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  htmlspecialchars($blog->getURL()) ?>" /></td>
2468                 </tr><tr>
2469                         <td><?php echo _EBLOG_DEFSKIN?>
2470                                 <?php help('blogdefaultskin'); ?>
2471                         </td>
2472                         <td>
2473                                 <?php
2474                                         $query =  'SELECT sdname as text, sdnumber as value'
2475                                                    . ' FROM '.sql_table('skin_desc');
2476                                         $template['name'] = 'defskin';
2477                                         $template['selected'] = $blog->getDefaultSkin();
2478                                         $template['tabindex'] = 50;
2479                                         showlist($query,'select',$template);
2480                                 ?>
2481
2482                         </td>
2483                 </tr><tr>
2484                         <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>
2485                         </td>
2486                         <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>
2487                 </tr><tr>
2488                         <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>
2489                         </td>
2490                         <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>
2491                 </tr><tr>
2492                         <td><?php echo _EBLOG_DISABLECOMMENTS?>
2493                         </td>
2494                         <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>
2495                 </tr><tr>
2496                         <td><?php echo _EBLOG_ANONYMOUS?>
2497                         </td>
2498                         <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>
2499                 </tr><tr>
2500         <td><?php echo _EBLOG_REQUIREDEMAIL?>
2501                  </td>
2502                  <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>
2503           </tr><tr>
2504                         <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>
2505                         <td><input name="notify" tabindex="80" maxlength="60" size="40" value="<?php echo  htmlspecialchars($blog->getNotifyAddress()); ?>" /></td>
2506                 </tr><tr>
2507                         <td><?php echo _EBLOG_NOTIFY_ON?></td>
2508                         <td>
2509                                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"
2510                                         <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>
2511                                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>
2512                                 <br />
2513                                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"
2514                                         <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>
2515                                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>
2516                                 <br />
2517                                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"
2518                                         <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>
2519                                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>
2520                         </td>
2521                 </tr><tr>
2522                 <?php
2523                 if (numberOfEventSubscriber('SendPing') > 0) {
2524                 ?>
2525                         <td><?php echo _EBLOG_PING?> <?php help('sendping'); ?></td>
2526                         <td><?php $this->input_yesno('sendping',$blog->sendPing(),85); ?></td>
2527                 </tr><tr>
2528                 <?php
2529                 }
2530                 ?>
2531                         <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>
2532                         <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  htmlspecialchars($blog->getMaxComments()); ?>" /></td>
2533                 </tr><tr>
2534                         <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>
2535                         <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  htmlspecialchars($blog->getUpdateFile()) ?>" /></td>
2536                 </tr><tr>
2537                         <td><?php echo _EBLOG_DEFCAT?></td>
2538                         <td>
2539                                 <?php
2540                                         $query =  'SELECT cname as text, catid as value'
2541                                                    . ' FROM '.sql_table('category')
2542                                                    . ' WHERE cblog=' . $blog->getID();
2543                                         $template['name'] = 'defcat';
2544                                         $template['selected'] = $blog->getDefaultCategory();
2545                                         $template['tabindex'] = 110;
2546                                         showlist($query,'select',$template);
2547                                 ?>
2548                         </td>
2549                 </tr><tr>
2550                         <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>
2551                                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  strftime("%H:%M",time()); ?></b>
2552                                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  strftime("%H:%M",$blog->getCorrectTime()); ?></b>
2553                                 </td>
2554                         <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  htmlspecialchars($blog->getTimeOffset()); ?>" /></td>
2555                 </tr><tr>
2556                         <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>
2557                         <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>
2558                 </tr>
2559                 <?php
2560                         // plugin options
2561                         $this->_insertPluginOptions('blog',$blogid);
2562                 ?>
2563                 <tr>
2564                         <th colspan="2"><?php echo _EBLOG_CHANGE?></th>
2565                 </tr><tr>
2566                         <td><?php echo _EBLOG_CHANGE?></td>
2567                         <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
2568                 </tr></table>
2569
2570                 </div></form>
2571
2572                 <h3><?php echo _EBLOG_CAT_TITLE?></h3>
2573
2574
2575                 <?php
2576                 $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';
2577                 $template['content'] = 'categorylist';
2578                 $template['tabindex'] = 200;
2579
2580                 $manager->loadClass("ENCAPSULATE");
2581                 $batch =& new BATCH('category');
2582                 $batch->showlist($query,'table',$template);
2583
2584                 ?>
2585
2586
2587                 <form action="index.php" method="post"><div>
2588                 <input name="action" value="categorynew" type="hidden" />
2589                 <?php $manager->addTicketHidden() ?>
2590                 <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />
2591
2592                 <table><tr>
2593                         <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>
2594                 </tr><tr>
2595                         <td><?php echo _EBLOG_CAT_NAME?></td>
2596                         <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>
2597                 </tr><tr>
2598                         <td><?php echo _EBLOG_CAT_DESC?></td>
2599                         <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>
2600                 </tr><tr>
2601                         <td><?php echo _EBLOG_CAT_CREATE?></td>
2602                         <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>
2603                 </tr></table>
2604
2605                 </div></form>
2606
2607                 <?php
2608
2609                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
2610
2611                         $manager->notify(
2612                                 'BlogSettingsFormExtras',
2613                                 array(
2614                                         'blog' => &$blog
2615                                 )
2616                         );
2617
2618                 $this->pagefoot();
2619         }
2620
2621         /**
2622          * @todo document this
2623          */
2624         function action_categorynew() {
2625                 global $member, $manager;
2626
2627                 $blogid = intRequestVar('blogid');
2628
2629                 $member->blogAdminRights($blogid) or $this->disallow();
2630
2631                 $cname = postVar('cname');
2632                 $cdesc = postVar('cdesc');
2633
2634                 if (!isValidCategoryName($cname))
2635                         $this->error(_ERROR_BADCATEGORYNAME);
2636
2637                 $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . addslashes($cname).'\' and cblog=' . intval($blogid);
2638                 $res = sql_query($query);
2639                 if (mysql_num_rows($res) > 0)
2640                         $this->error(_ERROR_DUPCATEGORYNAME);
2641
2642                 $blog           =& $manager->getBlog($blogid);
2643                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);
2644
2645                 $this->action_blogsettings();
2646         }
2647
2648         /**
2649          * @todo document this
2650          */
2651         function action_categoryedit($catid = '', $blogid = '', $desturl = '') {
2652                 global $member, $manager;
2653
2654                 if ($blogid == '')
2655                         $blogid = intGetVar('blogid');
2656                 else
2657                         $blogid = intval($blogid);
2658                 if ($catid == '')
2659                         $catid = intGetVar('catid');
2660                 else
2661                         $catid = intval($catid);
2662
2663                 $member->blogAdminRights($blogid) or $this->disallow();
2664
2665                 $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");
2666                 $obj = mysql_fetch_object($res);
2667
2668                 $cname = $obj->cname;
2669                 $cdesc = $obj->cdesc;
2670
2671                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2672                 $this->pagehead($extrahead);
2673
2674                 echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2675
2676                 ?>
2677                 <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo htmlspecialchars($cname)?>'</h2>
2678                 <form method='post' action='index.php'><div>
2679                 <input name="blogid" type="hidden" value="<?php echo $blogid?>" />
2680                 <input name="catid" type="hidden" value="<?php echo $catid?>" />
2681                 <input name="desturl" type="hidden" value="<?php echo htmlspecialchars($desturl) ?>" />
2682                 <input name="action" type="hidden" value="categoryupdate" />
2683                 <?php $manager->addTicketHidden(); ?>
2684
2685                 <table><tr>
2686                         <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2687                 </tr><tr>
2688                         <td><?php echo _EBLOG_CAT_NAME?></td>
2689                         <td><input type="text" name="cname" value="<?php echo htmlspecialchars($cname)?>" size="40" maxlength="40" /></td>
2690                 </tr><tr>
2691                         <td><?php echo _EBLOG_CAT_DESC?></td>
2692                         <td><input type="text" name="cdesc" value="<?php echo htmlspecialchars($cdesc)?>" size="40" maxlength="200" /></td>
2693                 </tr>
2694                 <?php
2695                         // insert plugin options
2696                         $this->_insertPluginOptions('category',$catid);
2697                 ?>
2698                 <tr>
2699                         <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2700                 </tr><tr>
2701                         <td><?php echo _EBLOG_CAT_UPDATE?></td>
2702                         <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>
2703                 </tr></table>
2704
2705                 </div></form>
2706                 <?php
2707                 $this->pagefoot();
2708         }
2709
2710         /**
2711          * @todo document this
2712          */
2713         function action_categoryupdate() {
2714                 global $member, $manager;
2715
2716                 $blogid = intPostVar('blogid');
2717                 $catid = intPostVar('catid');
2718                 $cname = postVar('cname');
2719                 $cdesc = postVar('cdesc');
2720                 $desturl = postVar('desturl');
2721
2722                 $member->blogAdminRights($blogid) or $this->disallow();
2723
2724                 if (!isValidCategoryName($cname))
2725                         $this->error(_ERROR_BADCATEGORYNAME);
2726
2727                 $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . addslashes($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
2728                 $res = sql_query($query);
2729                 if (mysql_num_rows($res) > 0)
2730                         $this->error(_ERROR_DUPCATEGORYNAME);
2731
2732                 $query =  'UPDATE '.sql_table('category').' SET'
2733                            . " cname='" . addslashes($cname) . "',"
2734                            . " cdesc='" . addslashes($cdesc) . "'"
2735                            . " WHERE catid=" . $catid;
2736
2737                 sql_query($query);
2738
2739                 // store plugin options
2740                 $aOptions = requestArray('plugoption');
2741                 NucleusPlugin::_applyPluginOptions($aOptions);
2742                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));
2743
2744
2745                 if ($desturl) {
2746                         redirect($desturl);
2747                         exit;
2748                 } else {
2749                         $this->action_blogsettings();
2750                 }
2751         }
2752
2753         /**
2754          * @todo document this
2755          */
2756         function action_categorydelete() {
2757                 global $member, $manager;
2758
2759                 $blogid = intRequestVar('blogid');
2760                 $catid = intRequestVar('catid');
2761
2762                 $member->blogAdminRights($blogid) or $this->disallow();
2763
2764                 $blog =& $manager->getBlog($blogid);
2765
2766                 // check if the category is valid
2767                 if (!$blog->isValidCategory($catid))
2768                         $this->error(_ERROR_NOSUCHCATEGORY);
2769
2770                 // don't allow deletion of default category
2771                 if ($blog->getDefaultCategory() == $catid)
2772                         $this->error(_ERROR_DELETEDEFCATEGORY);
2773
2774                 // check if catid is the only category left for blogid
2775                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2776                 $res = sql_query($query);
2777                 if (mysql_num_rows($res) == 1)
2778                         $this->error(_ERROR_DELETELASTCATEGORY);
2779
2780
2781                 $this->pagehead();
2782                 ?>
2783                         <h2><?php echo _DELETE_CONFIRM?></h2>
2784
2785                         <div>
2786                         <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  htmlspecialchars($blog->getCategoryName($catid))?></b>
2787                         </div>
2788
2789                         <form method="post" action="index.php"><div>
2790                         <input type="hidden" name="action" value="categorydeleteconfirm" />
2791                         <?php $manager->addTicketHidden() ?>
2792                         <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
2793                         <input type="hidden" name="catid" value="<?php echo $catid?>" />
2794                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2795                         </div></form>
2796                 <?php
2797                 $this->pagefoot();
2798         }
2799
2800         /**
2801          * @todo document this
2802          */
2803         function action_categorydeleteconfirm() {
2804                 global $member, $manager;
2805
2806                 $blogid = intRequestVar('blogid');
2807                 $catid = intRequestVar('catid');
2808
2809                 $member->blogAdminRights($blogid) or $this->disallow();
2810
2811                 $error = $this->deleteOneCategory($catid);
2812                 if ($error)
2813                         $this->error($error);
2814
2815                 $this->action_blogsettings();
2816         }
2817
2818         /**
2819          * @todo document this
2820          */
2821         function deleteOneCategory($catid) {
2822                 global $manager, $member;
2823
2824                 $catid = intval($catid);
2825
2826                 $manager->notify('PreDeleteCategory', array('catid' => $catid));
2827
2828                 $blogid = getBlogIDFromCatID($catid);
2829
2830                 if (!$member->blogAdminRights($blogid))
2831                         return ERROR_DISALLOWED;
2832
2833                 // get blog
2834                 $blog =& $manager->getBlog($blogid);
2835
2836                 // check if the category is valid
2837                 if (!$blog || !$blog->isValidCategory($catid))
2838                         return _ERROR_NOSUCHCATEGORY;
2839
2840                 $destcatid = $blog->getDefaultCategory();
2841
2842                 // don't allow deletion of default category
2843                 if ($blog->getDefaultCategory() == $catid)
2844                         return _ERROR_DELETEDEFCATEGORY;
2845
2846                 // check if catid is the only category left for blogid
2847                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2848                 $res = sql_query($query);
2849                 if (mysql_num_rows($res) == 1)
2850                         return _ERROR_DELETELASTCATEGORY;
2851
2852                 // change category for all items to the default category
2853                 $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";
2854                 sql_query($query);
2855
2856                 // delete all associated plugin options
2857                 NucleusPlugin::_deleteOptionValues('category', $catid);
2858
2859                 // delete category
2860                 $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;
2861                 sql_query($query);
2862
2863                 $manager->notify('PostDeleteCategory', array('catid' => $catid));
2864
2865         }
2866
2867         /**
2868          * @todo document this
2869          */
2870         function moveOneCategory($catid, $destblogid) {
2871                 global $manager, $member;
2872
2873                 $catid = intval($catid);
2874                 $destblogid = intval($destblogid);
2875
2876                 $blogid = getBlogIDFromCatID($catid);
2877
2878                 // mover should have admin rights on both blogs
2879                 if (!$member->blogAdminRights($blogid))
2880                         return _ERROR_DISALLOWED;
2881                 if (!$member->blogAdminRights($destblogid))
2882                         return _ERROR_DISALLOWED;
2883
2884                 // cannot move to self
2885                 if ($blogid == $destblogid)
2886                         return _ERROR_MOVETOSELF;
2887
2888                 // get blogs
2889                 $blog =& $manager->getBlog($blogid);
2890                 $destblog =& $manager->getBlog($destblogid);
2891
2892                 // check if the category is valid
2893                 if (!$blog || !$blog->isValidCategory($catid))
2894                         return _ERROR_NOSUCHCATEGORY;
2895
2896                 // don't allow default category to be moved
2897                 if ($blog->getDefaultCategory() == $catid)
2898                         return _ERROR_MOVEDEFCATEGORY;
2899
2900                 $manager->notify(
2901                         'PreMoveCategory',
2902                         array(
2903                                 'catid' => &$catid,
2904                                 'sourceblog' => &$blog,
2905                                 'destblog' => &$destblog
2906                         )
2907                 );
2908
2909                 // update comments table (cblog)
2910                 $query = 'SELECT inumber FROM '.sql_table('item').' WHERE icat='.$catid;
2911                 $items = sql_query($query);
2912                 while ($oItem = mysql_fetch_object($items)) {
2913                         sql_query('UPDATE '.sql_table('comment').' SET cblog='.$destblogid.' WHERE citem='.$oItem->inumber);
2914                 }
2915
2916                 // update items (iblog)
2917                 $query = 'UPDATE '.sql_table('item').' SET iblog='.$destblogid.' WHERE icat='.$catid;
2918                 sql_query($query);
2919
2920                 // move category
2921                 $query = 'UPDATE '.sql_table('category').' SET cblog='.$destblogid.' WHERE catid='.$catid;
2922                 sql_query($query);
2923
2924                 $manager->notify(
2925                         'PostMoveCategory',
2926                         array(
2927                                 'catid' => &$catid,
2928                                 'sourceblog' => &$blog,
2929                                 'destblog' => $destblog
2930                         )
2931                 );
2932
2933         }
2934
2935         /**
2936          * @todo document this
2937          */
2938         function action_blogsettingsupdate() {
2939                 global $member, $manager;
2940
2941                 $blogid = intRequestVar('blogid');
2942
2943                 $member->blogAdminRights($blogid) or $this->disallow();
2944
2945                 $blog =& $manager->getBlog($blogid);
2946
2947                 $notify                 = trim(postVar('notify'));
2948                 $shortname              = trim(postVar('shortname'));
2949                 $updatefile             = trim(postVar('update'));
2950
2951                 $notifyComment  = intPostVar('notifyComment');
2952                 $notifyVote             = intPostVar('notifyVote');
2953                 $notifyNewItem  = intPostVar('notifyNewItem');
2954
2955                 if ($notifyComment == 0)        $notifyComment = 1;
2956                 if ($notifyVote == 0)           $notifyVote = 1;
2957                 if ($notifyNewItem == 0)        $notifyNewItem = 1;
2958
2959                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
2960
2961
2962                 if ($notify) {
2963                         $not =& new NOTIFICATION($notify);
2964                         if (!$not->validAddresses())
2965                                 $this->error(_ERROR_BADNOTIFY);
2966
2967                 }
2968
2969                 if (!isValidShortName($shortname))
2970                         $this->error(_ERROR_BADSHORTBLOGNAME);
2971
2972                 if (($blog->getShortName() != $shortname) && $manager->existsBlog($shortname))
2973                         $this->error(_ERROR_DUPSHORTBLOGNAME);
2974
2975                 // check if update file is writable
2976                 if ($updatefile && !is_writeable($updatefile))
2977                         $this->error(_ERROR_UPDATEFILE);
2978
2979                 $blog->setName(trim(postVar('name')));
2980                 $blog->setShortName($shortname);
2981                 $blog->setNotifyAddress($notify);
2982                 $blog->setNotifyType($notifyType);
2983                 $blog->setMaxComments(postVar('maxcomments'));
2984                 $blog->setCommentsEnabled(postVar('comments'));
2985                 $blog->setTimeOffset(postVar('timeoffset'));
2986                 $blog->setUpdateFile($updatefile);
2987                 $blog->setURL(trim(postVar('url')));
2988                 $blog->setDefaultSkin(intPostVar('defskin'));
2989                 $blog->setDescription(trim(postVar('desc')));
2990                 $blog->setPublic(postVar('public'));
2991                 $blog->setPingUserland(postVar('sendping'));
2992                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
2993                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
2994                 $blog->setDefaultCategory(intPostVar('defcat'));
2995                 $blog->setSearchable(intPostVar('searchable'));
2996                 $blog->setEmailRequired(intPostVar('reqemail'));
2997
2998                 $blog->writeSettings();
2999
3000                 // store plugin options
3001                 $aOptions = requestArray('plugoption');
3002                 NucleusPlugin::_applyPluginOptions($aOptions);
3003                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));
3004
3005
3006                 $this->action_overview(_MSG_SETTINGSCHANGED);
3007         }
3008
3009         /**
3010          * @todo document this
3011          */
3012         function action_deleteblog() {
3013                 global $member, $CONF, $manager;
3014
3015                 $blogid = intRequestVar('blogid');
3016
3017                 $member->blogAdminRights($blogid) or $this->disallow();
3018
3019                 // check if blog is default blog
3020                 if ($CONF['DefaultBlog'] == $blogid)
3021                         $this->error(_ERROR_DELDEFBLOG);
3022
3023                 $blog =& $manager->getBlog($blogid);
3024
3025                 $this->pagehead();
3026                 ?>
3027                         <h2><?php echo _DELETE_CONFIRM?></h2>
3028
3029                         <p><?php echo _WARNINGTXT_BLOGDEL?>
3030                         </p>
3031
3032                         <div>
3033                         <?php echo _CONFIRMTXT_BLOG?><b><?php echo  htmlspecialchars($blog->getName())?></b>
3034                         </div>
3035
3036                         <form method="post" action="index.php"><div>
3037                         <input type="hidden" name="action" value="deleteblogconfirm" />
3038                         <?php $manager->addTicketHidden() ?>
3039                         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
3040                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3041                         </div></form>
3042                 <?php
3043                 $this->pagefoot();
3044         }
3045
3046         /**
3047          * @todo document this
3048          */
3049         function action_deleteblogconfirm() {
3050                 global $member, $CONF, $manager;
3051
3052                 $blogid = intRequestVar('blogid');
3053
3054                 $manager->notify('PreDeleteBlog', array('blogid' => $blogid));
3055
3056                 $member->blogAdminRights($blogid) or $this->disallow();
3057
3058                 // check if blog is default blog
3059                 if ($CONF['DefaultBlog'] == $blogid)
3060                         $this->error(_ERROR_DELDEFBLOG);
3061
3062                 // delete all comments
3063                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;
3064                 sql_query($query);
3065
3066                 // delete all items
3067                 $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;
3068                 sql_query($query);
3069
3070                 // delete all team members
3071                 $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;
3072                 sql_query($query);
3073
3074                 // delete all bans
3075                 $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;
3076                 sql_query($query);
3077
3078                 // delete all categories
3079                 $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;
3080                 sql_query($query);
3081
3082                 // delete all associated plugin options
3083                 NucleusPlugin::_deleteOptionValues('blog', $blogid);
3084
3085                 // delete the blog itself
3086                 $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;
3087                 sql_query($query);
3088
3089                 $manager->notify('PostDeleteBlog', array('blogid' => $blogid));
3090
3091                 $this->action_overview(_DELETED_BLOG);
3092         }
3093
3094         /**
3095          * @todo document this
3096          */
3097         function action_memberdelete() {
3098                 global $member, $manager;
3099
3100                 $memberid = intRequestVar('memberid');
3101
3102                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3103
3104                 $mem = MEMBER::createFromID($memberid);
3105
3106                 $this->pagehead();
3107                 ?>
3108                         <h2><?php echo _DELETE_CONFIRM?></h2>
3109
3110                         <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo htmlspecialchars($mem->getDisplayName()) ?></b>
3111                         </p>
3112
3113                         <p>
3114                         Please note that media files will <b>NOT</b> be deleted. (At least not in this Nucleus version)
3115                         </p>
3116
3117                         <form method="post" action="index.php"><div>
3118                         <input type="hidden" name="action" value="memberdeleteconfirm" />
3119                         <?php $manager->addTicketHidden() ?>
3120                         <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
3121                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3122                         </div></form>
3123                 <?php
3124                 $this->pagefoot();
3125         }
3126
3127         /**
3128          * @todo document this
3129          */
3130         function action_memberdeleteconfirm() {
3131                 global $member;
3132
3133                 $memberid = intRequestVar('memberid');
3134
3135                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3136
3137                 $error = $this->deleteOneMember($memberid);
3138                 if ($error)
3139                         $this->error($error);
3140
3141                 if ($member->isAdmin())
3142                         $this->action_usermanagement();
3143                 else
3144                         $this->action_overview(_DELETED_MEMBER);
3145         }
3146
3147         /**
3148          * @static
3149          * @todo document this
3150          */
3151         function deleteOneMember($memberid) {
3152                 global $manager;
3153
3154                 $memberid = intval($memberid);
3155                 $mem = MEMBER::createFromID($memberid);
3156
3157                 if (!$mem->canBeDeleted())
3158                         return _ERROR_DELETEMEMBER;
3159
3160                 $manager->notify('PreDeleteMember', array('member' => &$mem));
3161
3162                 /* unlink comments from memberid */
3163                 $query = 'UPDATE ' . sql_table('comment') . ' SET cmember="0", cuser="'. addslashes($mem->getDisplayName())
3164                                         .'" WHERE cmember='.$memberid;
3165                 sql_query($query);
3166
3167                 $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;
3168                 sql_query($query);
3169
3170                 $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;
3171                 sql_query($query);
3172
3173                 $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;
3174                 sql_query($query);
3175
3176                 // delete all associated plugin options
3177                 NucleusPlugin::_deleteOptionValues('member', $memberid);
3178
3179                 $manager->notify('PostDeleteMember', array('member' => &$mem));
3180
3181                 return '';
3182         }
3183
3184         /**
3185          * @todo document this
3186          */
3187         function action_createnewlog() {
3188                 global $member, $CONF, $manager;
3189
3190                 // Only Super-Admins can do this
3191                 $member->isAdmin() or $this->disallow();
3192
3193                 $this->pagehead();
3194
3195                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3196                 ?>
3197                 <h2><?php echo _EBLOG_CREATE_TITLE?></h2>
3198
3199                 <h3>注意事項</h3>
3200
3201                 <p>作成にあたって、下記の<strong>注意事項</strong> をまずお読み下さい</p>
3202
3203                 <p>新しいweblogを作成した後に、このblogにアクセスするための方法を紹介しておきます。方法は2つあります:</p>
3204
3205                 <ol>
3206                         <li><strong>簡単な方法:</strong> <code>index.php</code>の複製を作り、新しいblogを表示するように変更を加えます。 この変更の詳細は、作成後に表示されます。</li>
3207                         <li><strong>高度な方法:</strong> 現在のblogで使用しているスキンに<code>otherblog</code>というコードを使った記述を加えます。この方法では、同じページ内で複数のblogを展開することが可能となります。</li>
3208                 </ol>
3209
3210                 <h3>Weblogの作成</h3>
3211
3212                 <p>
3213                 <?php echo _EBLOG_CREATE_TEXT?>
3214                 </p>
3215
3216                 <form method="post" action="index.php"><div>
3217
3218                 <input type="hidden" name="action" value="addnewlog" />
3219                 <?php $manager->addTicketHidden() ?>
3220
3221
3222                 <table><tr>
3223                         <td><?php echo _EBLOG_NAME?></td>
3224                         <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>
3225                 </tr><tr>
3226                         <td><?php echo _EBLOG_SHORTNAME?>
3227                                 <?php help('shortblogname'); ?>
3228                         </td>
3229                         <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>
3230                 </tr><tr>
3231                         <td><?php echo _EBLOG_DESC?></td>
3232                         <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>
3233                 </tr><tr>
3234                         <td><?php echo _EBLOG_DEFSKIN?>
3235                                 <?php help('blogdefaultskin'); ?>
3236                         </td>
3237                         <td>
3238                                 <?php
3239                                         $query =  'SELECT sdname as text, sdnumber as value'
3240                                                    . ' FROM '.sql_table('skin_desc');
3241                                         $template['name'] = 'defskin';
3242                                         $template['tabindex'] = 50;
3243                                         $template['selected'] = $CONF['BaseSkin'];      // set default selected skin to be globally defined base skin
3244                                         showlist($query,'select',$template);
3245                                 ?>
3246                         </td>
3247                 </tr><tr>
3248                         <td><?php echo _EBLOG_OFFSET?>
3249                                 <?php help('blogtimeoffset'); ?>
3250                                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  strftime("%H:%M",time()); ?></b>
3251                         </td>
3252                         <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>
3253                 </tr><tr>
3254                         <td><?php echo _EBLOG_ADMIN?>
3255                                 <?php help('teamadmin'); ?>
3256                         </td>
3257                         <td><?php echo _EBLOG_ADMIN_MSG?></td>
3258                 </tr><tr>
3259                         <td><?php echo _EBLOG_CREATE?></td>
3260                         <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3261                 </tr></table>
3262
3263                 </div></form>
3264                 <?php
3265                 $this->pagefoot();
3266         }
3267
3268         /**
3269          * @todo document this
3270          */
3271         function action_addnewlog() {
3272                 global $member, $manager, $CONF;
3273
3274                 // Only Super-Admins can do this
3275                 $member->isAdmin() or $this->disallow();
3276
3277                 $bname                  = trim(postVar('name'));
3278                 $bshortname             = trim(postVar('shortname'));
3279                 $btimeoffset    = postVar('timeoffset');
3280                 $bdesc                  = trim(postVar('desc'));
3281                 $bdefskin               = postVar('defskin');
3282
3283                 if (!isValidShortName($bshortname))
3284                         $this->error(_ERROR_BADSHORTBLOGNAME);
3285
3286                 if ($manager->existsBlog($bshortname))
3287                         $this->error(_ERROR_DUPSHORTBLOGNAME);
3288
3289                 $manager->notify(
3290                         'PreAddBlog',
3291                         array(
3292                                 'name' => &$bname,
3293                                 'shortname' => &$bshortname,
3294                                 'timeoffset' => &$btimeoffset,
3295                                 'description' => &$bdesc,
3296                                 'defaultskin' => &$bdefskin
3297                         )
3298                 );
3299
3300
3301                 // add slashes for sql queries
3302                 $bname =                addslashes($bname);
3303                 $bshortname =   addslashes($bshortname);
3304                 $btimeoffset =  addslashes($btimeoffset);
3305                 $bdesc =                addslashes($bdesc);
3306                 $bdefskin =     addslashes($bdefskin);
3307
3308                 // create blog
3309                 $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";
3310                 sql_query($query);
3311                 $blogid = mysql_insert_id();
3312                 $blog   =& $manager->getBlog($blogid);
3313
3314                 // create new category
3315                 sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, 'General','Items that do not fit in other categories')");
3316                 $catid = mysql_insert_id();
3317
3318                 // set as default category
3319                 $blog->setDefaultCategory($catid);
3320                 $blog->writeSettings();
3321
3322                 // create team member
3323                 $memberid = $member->getID();
3324                 $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";
3325                 sql_query($query);
3326
3327
3328                 $blog->additem($blog->getDefaultCategory(),'First Item','これはあなたのweblogにおける最初のアイテムです。自由に削除していただいてかまいません。','',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3329
3330                 $manager->notify(
3331                         'PostAddBlog',
3332                         array(
3333                                 'blog' => &$blog
3334                         )
3335                 );
3336
3337                 $manager->notify(
3338                         'PostAddCategory',
3339                         array(
3340                                 'blog' => &$blog,
3341                                 'name' => 'General',
3342                                 'description' => 'Items that do not fit in other categories',
3343                                 'catid' => $catid
3344                         )
3345                 );
3346
3347                 $this->pagehead();
3348                 ?>
3349                 <h2>新しいweblogが作成されました</h2>
3350
3351                 <p>新しいweblog 「<?php echo htmlspecialchars($bname)?>」が作成されました。続けて、これにアクセスするために以下のどちらかの手順に進んでください。</p>
3352
3353                 <ol>
3354                         <li><a href="#index_php">簡単な方法: 下のコードを貼付けた <code><?php echo htmlspecialchars($bshortname)?>.php</code> というファイルを作成する</a></li>
3355                         <li><a href="#skins">高度な方法: 現在使用しているスキンに新しいweblogを展開させるための記述を加える</a></li>
3356                 </ol>
3357
3358                 <h3><a id="index_php">方法 1: <code><?php echo htmlspecialchars($bshortname)?>.php</code> というファイルを作成</a></h3>
3359
3360                 <p><code><?php echo htmlspecialchars($bshortname)?>.php</code> というファイルを作成して、中身に以下のコードを貼り付ける:</p>
3361 <pre><code>&lt;?php
3362
3363 $CONF['Self'] = '<b><?php echo htmlspecialchars($bshortname)?>.php</b>';
3364
3365 include('<i>./config.php</i>');
3366
3367 selectBlog('<b><?php echo htmlspecialchars($bshortname)?></b>');
3368 selector();
3369
3370 ?&gt;</code></pre>
3371
3372                 <p>すでにある<code>index.php</code>と同じディレクトリにアップロードします。</p>
3373
3374                 <p>新しいweblogの作成を完了するためには、下にこのファイルのURLを入力してください。 (すでに用意した値で合っているとは思いますが保証はしません):</p>
3375
3376                 <form action="index.php" method="post"><div>
3377                         <input type="hidden" name="action" value="addnewlog2" />
3378                         <?php $manager->addTicketHidden() ?>
3379                         <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3380                         <table><tr>
3381                                 <td><?php echo _EBLOG_URL?></td>
3382                                 <td><input name="url" maxlength="100" size="40" value="<?php echo htmlspecialchars($CONF['IndexURL'].$bshortname.'.php')?>" /></td>
3383                         </tr><tr>
3384                                 <td><?php echo _EBLOG_CREATE?></td>
3385                                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3386                         </tr></table>
3387                 </div></form>
3388
3389                 <h3><a id="skins">方法 2: 現在使用しているスキンに新しいweblogを展開する記述を加える</a></h3>
3390
3391                 <p>新しいweblogの作成を完了するためには、下にURLを入力してください。 (大抵は既存blogと同じURL)</p>
3392
3393                 <form action="index.php" method="post"><div>
3394                         <input type="hidden" name="action" value="addnewlog2" />
3395                         <?php $manager->addTicketHidden() ?>
3396                         <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3397                         <table><tr>
3398                                 <td><?php echo _EBLOG_URL?></td>
3399                                 <td><input name="url" maxlength="100" size="40" /></td>
3400                         </tr><tr>
3401                                 <td><?php echo _EBLOG_CREATE?></td>
3402                                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3403                         </tr></table>
3404                 </div></form>
3405
3406                 <?php           $this->pagefoot();
3407
3408         }
3409
3410         /**
3411          * @todo document this
3412          */
3413         function action_addnewlog2() {
3414                 global $member, $manager;
3415
3416                 $member->blogAdminRights($blogid) or $this->disallow();
3417
3418                 $burl   = requestVar('url');
3419                 $blogid = intRequestVar('blogid');
3420
3421                 $blog =& $manager->getBlog($blogid);
3422                 $blog->setURL(trim($burl));
3423                 $blog->writeSettings();
3424
3425                 $this->action_overview(_MSG_NEWBLOG);
3426         }
3427
3428         /**
3429          * @todo document this
3430          */
3431         function action_skinieoverview() {
3432                 global $member, $DIR_LIBS, $manager;
3433
3434                 $member->isAdmin() or $this->disallow();
3435
3436                 // load skinie class
3437                 include_once($DIR_LIBS . 'skinie.php');
3438
3439                 $this->pagehead();
3440
3441                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3442
3443         ?>
3444                 <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>
3445
3446                                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>
3447                                 <?php                                   global $DIR_SKINS;
3448
3449                                         $candidates = SKINIMPORT::searchForCandidates($DIR_SKINS);
3450
3451                                         if (sizeof($candidates) > 0) {
3452                                                 ?>
3453                                                         <form method="post" action="index.php"><div>
3454                                                                 <input type="hidden" name="action" value="skinieimport" />
3455                                                                 <?php $manager->addTicketHidden() ?>
3456                                                                 <input type="hidden" name="mode" value="file" />
3457                                                                 <select name="skinfile" id="skinie_import_local">
3458                                                                 <?php                                                                   foreach ($candidates as $skinname => $skinfile) {
3459                                                                                 $html = htmlspecialchars($skinfile);
3460                                                                                 echo '<option value="',$html,'">',$skinname,'</option>';
3461                                                                         }
3462                                                                 ?>
3463                                                                 </select>
3464                                                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3465                                                         </div></form>
3466                                                 <?php                                   } else {
3467                                                 echo _SKINIE_NOCANDIDATES;
3468                                         }
3469                                 ?>
3470                                 </p>
3471
3472                                 <p><em><?php echo _OR?></em></p>
3473
3474                                 <form method="post" action="index.php"><p>
3475                                         <?php $manager->addTicketHidden() ?>
3476                                         <input type="hidden" name="action" value="skinieimport" />
3477                                         <input type="hidden" name="mode" value="url" />
3478                                         <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>
3479                                         <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />
3480                                         <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3481                                 </p></form>
3482
3483
3484                 <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>
3485                 <form method="post" action="index.php"><div>
3486                         <input type="hidden" name="action" value="skinieexport" />
3487                         <?php $manager->addTicketHidden() ?>
3488
3489                         <p><?php echo _SKINIE_EXPORT_INTRO?></p>
3490
3491                         <table><tr>
3492                                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>
3493                         </tr><tr>
3494         <?php           // show list of skins
3495                 $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));
3496                 while ($skinObj = mysql_fetch_object($res)) {
3497                         $id = 'skinexp' . $skinObj->sdnumber;
3498                         echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';
3499                         echo '<label for="',$id,'">',htmlspecialchars($skinObj->sdname),'</label></td>';
3500                         echo '<td>',htmlspecialchars($skinObj->sddesc),'</td>';
3501                         echo '</tr><tr>';
3502                 }
3503
3504                 echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';
3505
3506                 // show list of templates
3507                 $res = sql_query('SELECT * FROM '.sql_table('template_desc'));
3508                 while ($templateObj = mysql_fetch_object($res)) {
3509                         $id = 'templateexp' . $templateObj->tdnumber;
3510                         echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';
3511                         echo '<label for="',$id,'">',htmlspecialchars($templateObj->tdname),'</label></td>';
3512                         echo '<td>',htmlspecialchars($templateObj->tddesc),'</td>';
3513                         echo '</tr><tr>';
3514                 }
3515
3516         ?>
3517                                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>
3518                         </tr><tr>
3519                                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>
3520                         </tr><tr>
3521                                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>
3522                         </tr><tr>
3523                                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>
3524                         </tr></table>
3525                 </div></form>
3526
3527         <?php
3528                 $this->pagefoot();
3529
3530         }
3531
3532         /**
3533          * @todo document this
3534          */
3535         function action_skinieimport() {
3536                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;
3537
3538                 $member->isAdmin() or $this->disallow();
3539
3540                 // load skinie class
3541                 include_once($DIR_LIBS . 'skinie.php');
3542
3543                 $skinFileRaw= postVar('skinfile');
3544                 $mode           = postVar('mode');
3545
3546                 $importer =& new SKINIMPORT();
3547
3548                 // get full filename
3549                 if ($mode == 'file')
3550                 {
3551                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3552
3553                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3554                         if (!file_exists($skinFile))
3555                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3556                 } else {
3557                         $skinFile = $skinFileRaw;
3558                 }
3559
3560                 // read only metadata
3561                 $error = $importer->readFile($skinFile, 1);
3562
3563                 // clashes
3564                 $skinNameClashes = $importer->checkSkinNameClashes();
3565                 $templateNameClashes = $importer->checkTemplateNameClashes();
3566                 $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
3567
3568                 if ($error) $this->error($error);
3569
3570                 $this->pagehead();
3571
3572                 echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';
3573                 ?>
3574                 <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>
3575
3576                 <ul>
3577                         <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo htmlspecialchars($importer->getInfo())?></p></li>
3578                         <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3579                         <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3580                         <?php
3581                                 if ($hasNameClashes)
3582                                 {
3583                         ?>
3584                         <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>
3585                         <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>
3586                         <?php
3587                                 } // if (hasNameClashes)
3588                         ?>
3589                 </ul>
3590
3591                 <form method="post" action="index.php"><div>
3592                         <input type="hidden" name="action" value="skiniedoimport" />
3593                         <?php $manager->addTicketHidden() ?>
3594                         <input type="hidden" name="skinfile" value="<?php echo htmlspecialchars(postVar('skinfile'))?>" />
3595                         <input type="hidden" name="mode" value="<?php echo htmlspecialchars($mode)?>" />
3596                         <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />
3597                         <?php
3598                                 if ($hasNameClashes)
3599                                 {
3600                         ?>
3601                         <br />
3602                         <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>
3603                         <?php
3604                                 } // if (hasNameClashes)
3605                         ?>
3606                 </div></form>
3607
3608
3609                 <?php
3610                 $this->pagefoot();
3611         }
3612
3613         /**
3614          * @todo document this
3615          */
3616         function action_skiniedoimport() {
3617                 global $member, $DIR_LIBS, $DIR_SKINS;
3618
3619                 $member->isAdmin() or $this->disallow();
3620
3621                 // load skinie class
3622                 include_once($DIR_LIBS . 'skinie.php');
3623
3624                 $skinFileRaw= postVar('skinfile');
3625                 $mode           = postVar('mode');
3626
3627                 $allowOverwrite = intPostVar('overwrite');
3628
3629                 // get full filename
3630                 if ($mode == 'file')
3631                 {
3632                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3633
3634                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3635                         if (!file_exists($skinFile))
3636                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3637
3638                 } else {
3639                         $skinFile = $skinFileRaw;
3640                 }
3641
3642                 $importer =& new SKINIMPORT();
3643
3644                 $error = $importer->readFile($skinFile);
3645
3646                 if ($error)
3647                         $this->error($error);
3648
3649                 $error = $importer->writeToDatabase($allowOverwrite);
3650
3651                 if ($error)
3652                         $this->error($error);
3653
3654                 $this->pagehead();
3655
3656                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3657         ?>
3658                 <h2><?php echo _SKINIE_DONE?></h2>
3659
3660                 <ul>
3661                         <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo htmlspecialchars($importer->getInfo())?></p></li>
3662                         <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3663                         <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3664                 </ul>
3665
3666         <?php           $this->pagefoot();
3667
3668         }
3669
3670         /**
3671          * @todo document this
3672          */
3673         function action_skinieexport() {
3674                 global $member, $DIR_LIBS;
3675
3676                 $member->isAdmin() or $this->disallow();
3677
3678                 // load skinie class
3679                 include_once($DIR_LIBS . 'skinie.php');
3680
3681                 $aSkins = requestIntArray('skin');
3682                 $aTemplates = requestIntArray('template');
3683
3684                 if (!is_array($aTemplates)) $aTemplates = array();
3685                 if (!is_array($aSkins)) $aSkins = array();
3686
3687                 $skinList = array_keys($aSkins);
3688                 $templateList = array_keys($aTemplates);
3689
3690                 $info = postVar('info');
3691
3692                 $exporter =& new SKINEXPORT();
3693                 foreach ($skinList as $skinId) {
3694                         $exporter->addSkin($skinId);
3695                 }
3696                 foreach ($templateList as $templateId) {
3697                         $exporter->addTemplate($templateId);
3698                 }
3699                 $exporter->setInfo($info);
3700
3701                 $exporter->export();
3702         }
3703
3704         /**
3705          * @todo document this
3706          */
3707         function action_templateoverview() {
3708                 global $member, $manager;
3709
3710                 $member->isAdmin() or $this->disallow();
3711
3712                 $this->pagehead();
3713
3714                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3715
3716                 echo '<h2>' . _TEMPLATE_TITLE . '</h2>';
3717                 echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';
3718
3719                 $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';
3720                 $template['content'] = 'templatelist';
3721                 $template['tabindex'] = 10;
3722                 showlist($query,'table',$template);
3723
3724                 echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';
3725
3726                 ?>
3727                 <form method="post" action="index.php"><div>
3728
3729                 <input name="action" value="templatenew" type="hidden" />
3730                 <?php $manager->addTicketHidden() ?>
3731                 <table><tr>
3732                         <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3733                         <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
3734                 </tr><tr>
3735                         <td><?php echo _TEMPLATE_DESC?></td>
3736                         <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
3737                 </tr><tr>
3738                         <td><?php echo _TEMPLATE_CREATE?></td>
3739                         <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3740                 </tr></table>
3741
3742                 </div></form>
3743
3744                 <?php
3745                 $this->pagefoot();
3746         }
3747
3748         /**
3749          * @todo document this
3750          */
3751         function action_templateedit($msg = '') {
3752                 global $member, $manager;
3753
3754                 $templateid = intRequestVar('templateid');
3755
3756                 $member->isAdmin() or $this->disallow();
3757
3758                 $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';
3759                 $extrahead .= '<script type="text/javascript">setTemplateEditText("'.addslashes(_EDITTEMPLATE_EMPTY).'");</script>';
3760
3761                 $this->pagehead($extrahead);
3762
3763                 $templatename = TEMPLATE::getNameFromId($templateid);
3764                 $templatedescription = TEMPLATE::getDesc($templateid);
3765                 $template =& $manager->getTemplate($templatename);
3766
3767                 ?>
3768                 <p>
3769                 <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>
3770                 </p>
3771
3772                 <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  htmlspecialchars($templatename); ?>'</h2>
3773
3774                 <?php                                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
3775                 ?>
3776
3777                 <p><?php echo _TEMPLATE_EDIT_MSG?></p>
3778
3779                 <form method="post" action="index.php">
3780                 <div>
3781
3782                 <input type="hidden" name="action" value="templateupdate" />
3783                 <?php $manager->addTicketHidden() ?>
3784                 <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />
3785
3786                 <table><tr>
3787                         <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>
3788                 </tr><tr>
3789                         <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3790                         <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  htmlspecialchars($templatename) ?>" /></td>
3791                 </tr><tr>
3792                         <td><?php echo _TEMPLATE_DESC?></td>
3793                         <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  htmlspecialchars($templatedescription) ?>" /></td>
3794                 </tr><tr>
3795                         <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3796                 </tr><tr>
3797                         <td><?php echo _TEMPLATE_UPDATE?></td>
3798                         <td>
3799                                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3800                                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3801                         </td>
3802                 </tr><tr>
3803                         <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>
3804 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);
3805         $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);
3806         $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);
3807         $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);
3808         $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);
3809         $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);
3810 ?>
3811                 </tr><tr>
3812                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>
3813 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);
3814         $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);
3815         $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);
3816         $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);
3817         $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);
3818         $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);
3819         $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);
3820 ?>
3821                 </tr><tr>
3822                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>
3823 <?php
3824         $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);
3825 ?>
3826                 </tr><tr>
3827                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>
3828 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);
3829 ?>
3830                 </tr><tr>
3831                         <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>
3832 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);
3833         $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);
3834         $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);
3835 ?>
3836                 </tr><tr>
3837                         <th colspan="2"><?php echo _TEMPLATE_BLOGLIST?> <?php help('templatebloglists'); ?></th>
3838 <?php   $this->_templateEditRow($template, _TEMPLATE_BLOGHEADER, 'BLOGLIST_HEADER', '', 160);
3839         $this->_templateEditRow($template, _TEMPLATE_BLOGITEM, 'BLOGLIST_LISTITEM', '', 170);
3840         $this->_templateEditRow($template, _TEMPLATE_BLOGFOOTER, 'BLOGLIST_FOOTER', '', 180);
3841 ?>
3842                 </tr><tr>
3843                         <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>
3844 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 160);
3845         $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 170);
3846         $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 180);
3847 ?>
3848                 </tr><tr>
3849                         <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>
3850 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 190);
3851         $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 200);
3852         $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 210);
3853         $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 220);
3854         $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 230);
3855 ?>
3856                 </tr><tr>
3857                         <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>
3858 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 240);
3859         $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 250);
3860         $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 260);
3861 ?>
3862                 </tr><tr>
3863                         <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>
3864 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',270);
3865         $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',280);
3866 ?>
3867                 </tr><tr>
3868                         <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3869                 </tr><tr>
3870                         <td><?php echo _TEMPLATE_UPDATE?></td>
3871                         <td>
3872                                 <input type="submit" tabindex="290" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3873                                 <input type="reset" tabindex="300" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3874                         </td>
3875                 </tr></table>
3876
3877                 </div>
3878                 </form>
3879                 <?php
3880                 $this->pagefoot();
3881         }
3882
3883         /**
3884          * @todo document this
3885          */
3886         function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {
3887                 static $count = 1;
3888         ?>
3889                 </tr><tr>
3890                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>
3891                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  htmlspecialchars($template[$name]); ?></textarea></td>
3892         <?php           $count++;
3893         }
3894
3895         /**
3896          * @todo document this
3897          */
3898         function action_templateupdate() {
3899                 global $member;
3900
3901                 $templateid = intRequestVar('templateid');
3902
3903                 $member->isAdmin() or $this->disallow();
3904
3905                 $name = postVar('tname');
3906                 $desc = postVar('tdesc');
3907
3908                 if (!isValidTemplateName($name))
3909                         $this->error(_ERROR_BADTEMPLATENAME);
3910
3911                 if ((TEMPLATE::getNameFromId($templateid) != $name) && TEMPLATE::exists($name))
3912                         $this->error(_ERROR_DUPTEMPLATENAME);
3913
3914
3915                 $name = addslashes($name);
3916                 $desc = addslashes($desc);
3917
3918                 // 1. Remove all template parts
3919                 $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;
3920                 sql_query($query);
3921
3922                 // 2. Update description
3923                 $query =  'UPDATE '.sql_table('template_desc').' SET'
3924                            . " tdname='" . $name . "',"
3925                            . " tddesc='" . $desc . "'"
3926                            . " WHERE tdnumber=" . $templateid;
3927                 sql_query($query);
3928
3929                 // 3. Add non-empty template parts
3930                 $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));
3931                 $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));
3932                 $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));
3933                 $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));
3934                 $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));
3935                 $this->addToTemplate($templateid, 'NEW', postVar('NEW'));
3936                 $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));
3937                 $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));
3938                 $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));
3939                 $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));
3940                 $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));
3941                 $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));
3942                 $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));
3943                 $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));
3944                 $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));
3945                 $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));
3946                 $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
3947                 $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));
3948                 $this->addToTemplate($templateid, 'BLOGLIST_HEADER', postVar('BLOGLIST_HEADER'));
3949                 $this->addToTemplate($templateid, 'BLOGLIST_LISTITEM', postVar('BLOGLIST_LISTITEM'));
3950                 $this->addToTemplate($templateid, 'BLOGLIST_FOOTER', postVar('BLOGLIST_FOOTER'));
3951                 $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));
3952                 $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));
3953                 $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));
3954                 $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));
3955                 $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));
3956                 $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));
3957                 $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));
3958                 $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));
3959                 $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));
3960                 $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
3961                 $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));
3962                 $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));
3963                 $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));
3964
3965
3966                 // jump back to template edit
3967                 $this->action_templateedit(_TEMPLATE_UPDATED);
3968
3969         }
3970
3971         /**
3972          * @todo document this
3973          */
3974         function addToTemplate($id, $partname, $content) {
3975                 $partname = addslashes($partname);
3976                 $content = addslashes($content);
3977
3978                 $id = intval($id);
3979
3980                 // don't add empty parts:
3981                 if (!trim($content)) return -1;
3982
3983                 $query = 'INSERT INTO '.sql_table('template')." (tdesc, tpartname, tcontent) "
3984                            . "VALUES ($id, '$partname', '$content')";
3985                 sql_query($query) or die("Query error: " . mysql_error());
3986                 return mysql_insert_id();
3987         }
3988
3989         /**
3990          * @todo document this
3991          */
3992         function action_templatedelete() {
3993                 global $member, $manager;
3994
3995                 $member->isAdmin() or $this->disallow();
3996
3997                 $templateid = intRequestVar('templateid');
3998                 // TODO: check if template can be deleted
3999
4000                 $this->pagehead();
4001
4002                 $name = TEMPLATE::getNameFromId($templateid);
4003                 $desc = TEMPLATE::getDesc($templateid);
4004
4005                 ?>
4006                         <h2><?php echo _DELETE_CONFIRM?></h2>
4007
4008                         <p>
4009                         <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo htmlspecialchars($name)?></b> (<?php echo  htmlspecialchars($desc) ?>)
4010                         </p>
4011
4012                         <form method="post" action="index.php"><div>
4013                                 <input type="hidden" name="action" value="templatedeleteconfirm" />
4014                                 <?php $manager->addTicketHidden() ?>
4015                                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />
4016                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4017                         </div></form>
4018                 <?php
4019                 $this->pagefoot();
4020         }
4021
4022         /**
4023          * @todo document this
4024          */
4025         function action_templatedeleteconfirm() {
4026                 global $member, $manager;
4027
4028                 $templateid = intRequestVar('templateid');
4029
4030                 $member->isAdmin() or $this->disallow();
4031
4032                 $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));
4033
4034                 // 1. delete description
4035                 sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);
4036
4037                 // 2. delete parts
4038                 sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4039
4040                 $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));
4041
4042                 $this->action_templateoverview();
4043         }
4044
4045         /**
4046          * @todo document this
4047          */
4048         function action_templatenew() {
4049                 global $member;
4050
4051                 $member->isAdmin() or $this->disallow();
4052
4053                 $name = postVar('name');
4054                 $desc = postVar('desc');
4055
4056                 if (!isValidTemplateName($name))
4057                         $this->error(_ERROR_BADTEMPLATENAME);
4058
4059                 if (TEMPLATE::exists($name))
4060                         $this->error(_ERROR_DUPTEMPLATENAME);
4061
4062                 $newTemplateId = TEMPLATE::createNew($name, $desc);
4063
4064                 $this->action_templateoverview();
4065         }
4066
4067         /**
4068          * @todo document this
4069          */
4070         function action_templateclone() {
4071                 global $member;
4072
4073                 $templateid = intRequestVar('templateid');
4074
4075                 $member->isAdmin() or $this->disallow();
4076
4077                 // 1. read old template
4078                 $name = TEMPLATE::getNameFromId($templateid);
4079                 $desc = TEMPLATE::getDesc($templateid);
4080
4081                 // 2. create desc thing
4082                 $name = "cloned" . $name;
4083
4084                 // if a template with that name already exists:
4085                 if (TEMPLATE::exists($name)) {
4086                         $i = 1;
4087                         while (TEMPLATE::exists($name . $i))
4088                                 $i++;
4089                         $name .= $i;
4090                 }
4091
4092                 $newid = TEMPLATE::createNew($name, $desc);
4093
4094                 // 3. create clone
4095                 // go through parts of old template and add them to the new one
4096                 $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4097                 while ($o = mysql_fetch_object($res)) {
4098                         $this->addToTemplate($newid, $o->tpartname, $o->tcontent);
4099                 }
4100
4101                 $this->action_templateoverview();
4102         }
4103
4104         /**
4105          * @todo document this
4106          */
4107         function action_skinoverview() {
4108                 global $member, $manager;
4109
4110                 $member->isAdmin() or $this->disallow();
4111
4112                 $this->pagehead();
4113
4114                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4115
4116                 echo '<h2>' . _SKIN_EDIT_TITLE . '</h2>';
4117
4118                 echo '<h3>' . _SKIN_AVAILABLE_TITLE . '</h3>';
4119
4120                 $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname';
4121                 $template['content'] = 'skinlist';
4122                 $template['tabindex'] = 10;
4123                 showlist($query,'table',$template);
4124
4125                 echo '<h3>' . _SKIN_NEW_TITLE . '</h3>';
4126
4127                 ?>
4128                 <form method="post" action="index.php">
4129                 <div>
4130
4131                 <input name="action" value="skinnew" type="hidden" />
4132                 <?php $manager->addTicketHidden() ?>
4133                 <table><tr>
4134                         <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4135                         <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
4136                 </tr><tr>
4137                         <td><?php echo _SKIN_DESC?></td>
4138                         <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
4139                 </tr><tr>
4140                         <td><?php echo _SKIN_CREATE?></td>
4141                         <td><input type="submit" tabindex="10030" value="<?php echo _SKIN_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
4142                 </tr></table>
4143
4144                 </div>
4145                 </form>
4146
4147                 <?php
4148                 $this->pagefoot();
4149         }
4150
4151         /**
4152          * @todo document this
4153          */
4154         function action_skinnew() {
4155                 global $member;
4156
4157                 $member->isAdmin() or $this->disallow();
4158
4159                 $name = trim(postVar('name'));
4160                 $desc = trim(postVar('desc'));
4161
4162                 if (!isValidSkinName($name))
4163                         $this->error(_ERROR_BADSKINNAME);
4164
4165                 if (SKIN::exists($name))
4166                         $this->error(_ERROR_DUPSKINNAME);
4167
4168                 $newId = SKIN::createNew($name, $desc);
4169
4170                 $this->action_skinoverview();
4171         }
4172
4173         /**
4174          * @todo document this
4175          */
4176         function action_skinedit() {
4177                 global $member, $manager;
4178
4179                 $skinid = intRequestVar('skinid');
4180
4181                 $member->isAdmin() or $this->disallow();
4182
4183                 $skin =& new SKIN($skinid);
4184
4185                 $this->pagehead();
4186                 ?>
4187                 <p>
4188                         <a href="index.php?action=skinoverview">(<?php echo _SKIN_BACK?>)</a>
4189                 </p>
4190                 <h2><?php echo _SKIN_EDITONE_TITLE?> '<?php echo  $skin->getName() ?>'</h2>
4191
4192                 <h3><?php echo _SKIN_PARTS_TITLE?></h3>
4193                 <?php echo _SKIN_PARTS_MSG?>
4194                 <ul>
4195                         <li><a tabindex="10" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=index"><?php echo _SKIN_PART_MAIN?></a> <?php help('skinpartindex')?></li>
4196                         <li><a tabindex="20" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=item"><?php echo _SKIN_PART_ITEM?></a> <?php help('skinpartitem')?></li>
4197                         <li><a tabindex="30" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archivelist"><?php echo _SKIN_PART_ALIST?></a> <?php help('skinpartarchivelist')?></li>
4198                         <li><a tabindex="40" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archive"><?php echo _SKIN_PART_ARCHIVE?></a> <?php help('skinpartarchive')?></li>
4199                         <li><a tabindex="50" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=search"><?php echo _SKIN_PART_SEARCH?></a> <?php help('skinpartsearch')?></li>
4200                         <li><a tabindex="60" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=error"><?php echo _SKIN_PART_ERROR?></a> <?php help('skinparterror')?></li>
4201                         <li><a tabindex="70" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=member"><?php echo _SKIN_PART_MEMBER?></a> <?php help('skinpartmember')?></li>
4202                         <li><a tabindex="75" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=imagepopup"><?php echo _SKIN_PART_POPUP?></a> <?php help('skinpartimagepopup')?></li>
4203                 </ul>
4204
4205                 <?php
4206
4207                 $query = "SELECT stype FROM " . sql_table('skin') . " WHERE stype NOT IN ('index', 'item', 'error', 'search', 'archive', 'archivelist', 'imagepopup', 'member') and sdesc = " . $skinid;
4208                 $res = sql_query($query);
4209
4210                 echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';
4211                 echo '<form method="get" action="index.php">' . "\r\n";
4212                 echo '<input type="hidden" name="action" value="skinedittype" />' . "\r\n";
4213                 echo '<input type="hidden" name="skinid" value="' . $skinid . '" />' . "\r\n";
4214                 echo '<input name="type" tabindex="89" size="20" maxlength="20" />' . "\r\n";
4215                 echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . '" onclick="return checkSubmit();" />' . "\r\n";
4216                 echo '</form>' . "\r\n";
4217
4218                 if ($res && mysql_num_rows($res) > 0) {
4219                         echo '<ul>';
4220                         $tabstart = 75;
4221
4222                         while ($row = mysql_fetch_assoc($res)) {
4223                                 echo '<li><a tabindex="' . ($tabstart++) . '" href="index.php?action=skinedittype&amp;skinid=' . $skinid . '&amp;type=' . htmlspecialchars(strtolower($row['stype'])) . '">' . htmlspecialchars(ucfirst($row['stype'])) . '</a> (<a tabindex="' . ($tabstart++) . '" href="index.php?action=skinremovetype&amp;skinid=' . $skinid . '&amp;type=' . htmlspecialchars(strtolower($row['stype'])) . '">remove</a>)</li>';
4224                         }
4225
4226                         echo '</ul>';
4227                 }
4228
4229                 ?>
4230
4231                 <h3><?php echo _SKIN_GENSETTINGS_TITLE; ?></h3>
4232                 <form method="post" action="index.php">
4233                 <div>
4234
4235                 <input type="hidden" name="action" value="skineditgeneral" />
4236                 <?php $manager->addTicketHidden() ?>
4237                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4238                 <table><tr>
4239                         <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4240                         <td><input name="name" tabindex="90" value="<?php echo  htmlspecialchars($skin->getName()) ?>" maxlength="20" size="20" /></td>
4241                 </tr><tr>
4242                         <td><?php echo _SKIN_DESC?></td>
4243                         <td><input name="desc" tabindex="100" value="<?php echo  htmlspecialchars($skin->getDescription()) ?>" maxlength="200" size="50" /></td>
4244                 </tr><tr>
4245                         <td><?php echo _SKIN_TYPE?></td>
4246                         <td><input name="type" tabindex="110" value="<?php echo  htmlspecialchars($skin->getContentType()) ?>" maxlength="40" size="20" /></td>
4247                 </tr><tr>
4248                         <td><?php echo _SKIN_INCLUDE_MODE?> <?php help('includemode')?></td>
4249                         <td><?php $this->input_yesno('inc_mode',$skin->getIncludeMode(),120,'skindir','normal',_PARSER_INCMODE_SKINDIR,_PARSER_INCMODE_NORMAL);?></td>
4250                 </tr><tr>
4251                         <td><?php echo _SKIN_INCLUDE_PREFIX?> <?php help('includeprefix')?></td>
4252                         <td><input name="inc_prefix" tabindex="130" value="<?php echo  htmlspecialchars($skin->getIncludePrefix()) ?>" maxlength="40" size="20" /></td>
4253                 </tr><tr>
4254                         <td><?php echo _SKIN_CHANGE?></td>
4255                         <td><input type="submit" tabindex="140" value="<?php echo _SKIN_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
4256                 </tr></table>
4257
4258                 </div>
4259                 </form>
4260
4261
4262                 <?php           $this->pagefoot();
4263         }
4264
4265         /**
4266          * @todo document this
4267          */
4268         function action_skineditgeneral() {
4269                 global $member;
4270
4271                 $skinid = intRequestVar('skinid');
4272
4273                 $member->isAdmin() or $this->disallow();
4274
4275                 $name = postVar('name');
4276                 $desc = postVar('desc');
4277                 $type = postVar('type');
4278                 $inc_mode = postVar('inc_mode');
4279                 $inc_prefix = postVar('inc_prefix');
4280
4281                 $skin =& new SKIN($skinid);
4282
4283                 // 1. Some checks
4284                 if (!isValidSkinName($name))
4285                         $this->error(_ERROR_BADSKINNAME);
4286
4287                 if (($skin->getName() != $name) && SKIN::exists($name))
4288                         $this->error(_ERROR_DUPSKINNAME);
4289
4290                 if (!$type) $type = 'text/html';
4291                 if (!$inc_mode) $inc_mode = 'normal';
4292
4293                 // 2. Update description
4294                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
4295
4296                 $this->action_skinedit();
4297
4298         }
4299
4300         /**
4301          * @todo document this
4302          */
4303         function action_skinedittype($msg = '') {
4304                 global $member, $manager;
4305
4306                 $skinid = intRequestVar('skinid');
4307                 $type = requestVar('type');
4308
4309                 $member->isAdmin() or $this->disallow();
4310
4311                 $type = trim($type);
4312                 $type = strtolower($type);
4313
4314                 if (!isValidShortName($type)) {
4315                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
4316                 }
4317
4318                 $skin =& new SKIN($skinid);
4319
4320                 $friendlyNames = SKIN::getFriendlyNames();
4321
4322                 $this->pagehead();
4323                 ?>
4324                 <p>(<a href="index.php?action=skinoverview"><?php echo _SKIN_GOBACK?></a>)</p>
4325
4326                 <h2><?php echo _SKIN_EDITPART_TITLE?> '<?php echo htmlspecialchars($skin->getName()) ?>': <?php echo htmlspecialchars(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?></h2>
4327
4328                 <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
4329                 ?>
4330
4331
4332                 <form method="post" action="index.php">
4333                 <div>
4334
4335                 <input type="hidden" name="action" value="skinupdate" />
4336                 <?php $manager->addTicketHidden() ?>
4337                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4338                 <input type="hidden" name="type" value="<?php echo  $type ?>" />
4339
4340                 <input type="submit" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4341                 <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4342                 (skin type: <?php echo htmlspecialchars(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4343                 <?php if (in_array($type, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4344                         help('skinpart' . $type);
4345                 } else {
4346                         help('skinpartspecial');
4347                 }?>
4348                 <br />
4349
4350                 <textarea class="skinedit" tabindex="10" rows="20" cols="80" name="content"><?php echo  htmlspecialchars($skin->getContent($type)) ?></textarea>
4351
4352                 <br />
4353                 <input type="submit" tabindex="20" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4354                 <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4355                 (skin type: <?php echo htmlspecialchars(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4356
4357                 <br /><br />
4358                 <?php echo _SKIN_ALLOWEDVARS?>
4359                 <?php                   $actions = SKIN::getAllowedActionsForType($type);
4360
4361                         sort($actions);
4362
4363                         while ($current = array_shift($actions)) {
4364                                 // skip deprecated vars
4365                                 if ($current == 'ifcat') continue;
4366                                 if ($current == 'imagetext') continue;
4367                                 if ($current == 'vars') continue;
4368
4369                                 echo helplink('skinvar-' . $current) . "$current</a>";
4370                                 if (count($actions) != 0) echo ", ";
4371                         }
4372                 ?>
4373                 <br /><br />
4374                 Short blog names:
4375                 <?php                   $query = 'SELECT bshortname, bname FROM '.sql_table('blog');
4376                         showlist($query,'table',array('content'=>'shortblognames'));
4377                 ?>
4378
4379                 <br />
4380                 Template names:
4381                 <?php                   $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');
4382                         showlist($query,'table',array('content'=>'shortnames'));
4383                 ?>
4384
4385
4386                 </div>
4387                 </form>
4388
4389
4390                 <?php           $this->pagefoot();
4391         }
4392
4393         /**
4394          * @todo document this
4395          */
4396         function action_skinupdate() {
4397                 global $member;
4398
4399                 $skinid = intRequestVar('skinid');
4400                 $content = trim(postVar('content'));
4401                 $type = postVar('type');
4402
4403                 $member->isAdmin() or $this->disallow();
4404
4405                 $skin =& new SKIN($skinid);
4406                 $skin->update($type, $content);
4407
4408                 $this->action_skinedittype(_SKIN_UPDATED);
4409         }
4410
4411         /**
4412          * @todo document this
4413          */
4414         function action_skindelete() {
4415                 global $member, $manager, $CONF;
4416
4417                 $skinid = intRequestVar('skinid');
4418
4419                 $member->isAdmin() or $this->disallow();
4420
4421                 // don't allow default skin to be deleted
4422                 if ($skinid == $CONF['BaseSkin'])
4423                         $this->error(_ERROR_DEFAULTSKIN);
4424
4425                 // don't allow deletion of default skins for blogs
4426                 $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4427                 $r = sql_query($query);
4428                 if ($o = mysql_fetch_object($r))
4429                         $this->error(_ERROR_SKINDEFDELETE . htmlspecialchars($o->bname));
4430
4431                 $this->pagehead();
4432
4433                 $skin =& new SKIN($skinid);
4434                 $name = $skin->getName();
4435                 $desc = $skin->getDescription();
4436
4437                 ?>
4438                         <h2><?php echo _DELETE_CONFIRM?></h2>
4439
4440                         <p>
4441                                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo htmlspecialchars($name) ?></b> (<?php echo  htmlspecialchars($desc)?>)
4442                         </p>
4443
4444                         <form method="post" action="index.php"><div>
4445                                 <input type="hidden" name="action" value="skindeleteconfirm" />
4446                                 <?php $manager->addTicketHidden() ?>
4447                                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4448                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4449                         </div></form>
4450                 <?php
4451                 $this->pagefoot();
4452         }
4453
4454         /**
4455          * @todo document this
4456          */
4457         function action_skindeleteconfirm() {
4458                 global $member, $CONF, $manager;
4459
4460                 $skinid = intRequestVar('skinid');
4461
4462                 $member->isAdmin() or $this->disallow();
4463
4464                 // don't allow default skin to be deleted
4465                 if ($skinid == $CONF['BaseSkin'])
4466                         $this->error(_ERROR_DEFAULTSKIN);
4467
4468                 // don't allow deletion of default skins for blogs
4469                 $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4470                 $r = sql_query($query);
4471                 if ($o = mysql_fetch_object($r))
4472                         $this->error(_ERROR_SKINDEFDELETE .$o->bname);
4473
4474                 $manager->notify('PreDeleteSkin', array('skinid' => $skinid));
4475
4476                 // 1. delete description
4477                 sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);
4478
4479                 // 2. delete parts
4480                 sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);
4481
4482                 $manager->notify('PostDeleteSkin', array('skinid' => $skinid));
4483
4484                 $this->action_skinoverview();
4485         }
4486
4487         /**
4488          * @todo document this
4489          */
4490         function action_skinremovetype() {
4491                 global $member, $manager, $CONF;
4492
4493                 $skinid = intRequestVar('skinid');
4494                 $skintype = requestVar('type');
4495
4496                 if (!isValidShortName($skintype)) {
4497                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4498                 }
4499
4500                 $member->isAdmin() or $this->disallow();
4501
4502                 // don't allow default skinparts to be deleted
4503                 if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4504                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4505                 }
4506
4507                 $this->pagehead();
4508
4509                 $skin =& new SKIN($skinid);
4510                 $name = $skin->getName();
4511                 $desc = $skin->getDescription();
4512
4513                 ?>
4514                         <h2><?php echo _DELETE_CONFIRM?></h2>
4515
4516                         <p>
4517                                 <?php echo _CONFIRMTXT_SKIN_PARTS_SPECIAL; ?> <b><?php echo htmlspecialchars($skintype); ?> (<?php echo htmlspecialchars($name); ?>)</b> (<?php echo  htmlspecialchars($desc)?>)
4518                         </p>
4519
4520                         <form method="post" action="index.php"><div>
4521                                 <input type="hidden" name="action" value="skinremovetypeconfirm" />
4522                                 <?php $manager->addTicketHidden() ?>
4523                                 <input type="hidden" name="skinid" value="<?php echo $skinid; ?>" />
4524                                 <input type="hidden" name="type" value="<?php echo htmlspecialchars($skintype); ?>" />
4525                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4526                         </div></form>
4527                 <?php
4528                 $this->pagefoot();
4529         }
4530
4531         /**
4532          * @todo document this
4533          */
4534         function action_skinremovetypeconfirm() {
4535                 global $member, $CONF, $manager;
4536
4537                 $skinid = intRequestVar('skinid');
4538                 $skintype = requestVar('type');
4539
4540                 if (!isValidShortName($skintype)) {
4541                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4542                 }
4543
4544                 $member->isAdmin() or $this->disallow();
4545
4546                 // don't allow default skinparts to be deleted
4547                 if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4548                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4549                 }
4550
4551                 $manager->notify('PreDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4552
4553                 // delete part
4554                 sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid . ' AND stype=\'' . $skintype . '\'');
4555
4556                 $manager->notify('PostDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4557
4558                 $this->action_skinedit();
4559         }
4560
4561         /**
4562          * @todo document this
4563          */
4564         function action_skinclone() {
4565                 global $member;
4566
4567                 $skinid = intRequestVar('skinid');
4568
4569                 $member->isAdmin() or $this->disallow();
4570
4571                 // 1. read skin to clone
4572                 $skin =& new SKIN($skinid);
4573
4574                 $name = "clone_" . $skin->getName();
4575
4576                 // if a skin with that name already exists:
4577                 if (SKIN::exists($name)) {
4578                         $i = 1;
4579                         while (SKIN::exists($name . $i))
4580                                 $i++;
4581                         $name .= $i;
4582                 }
4583
4584                 // 2. create skin desc
4585                 $newid = SKIN::createNew(
4586                         $name,
4587                         $skin->getDescription(),
4588                         $skin->getContentType(),
4589                         $skin->getIncludeMode(),
4590                         $skin->getIncludePrefix()
4591                 );
4592
4593
4594                 // 3. clone
4595                 /*
4596                 $this->skinclonetype($skin, $newid, 'index');
4597                 $this->skinclonetype($skin, $newid, 'item');
4598                 $this->skinclonetype($skin, $newid, 'archivelist');
4599                 $this->skinclonetype($skin, $newid, 'archive');
4600                 $this->skinclonetype($skin, $newid, 'search');
4601                 $this->skinclonetype($skin, $newid, 'error');
4602                 $this->skinclonetype($skin, $newid, 'member');
4603                 $this->skinclonetype($skin, $newid, 'imagepopup');
4604                 */
4605
4606                 $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;
4607                 $res = sql_query($query);
4608                 while ($row = mysql_fetch_assoc($res)) {
4609                         $this->skinclonetype($skin, $newid, $row['stype']);
4610                 }
4611
4612                 $this->action_skinoverview();
4613
4614         }
4615
4616         /**
4617          * @todo document this
4618          */
4619         function skinclonetype($skin, $newid, $type) {
4620                 $newid = intval($newid);
4621                 $content = $skin->getContent($type);
4622                 if ($content) {
4623                         $query = 'INSERT INTO '.sql_table('skin')." (sdesc, scontent, stype) VALUES ($newid,'". addslashes($content)."', '". addslashes($type)."')";
4624                         sql_query($query);
4625                 }
4626         }
4627
4628         /**
4629          * @todo document this
4630          */
4631         function action_settingsedit() {
4632                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4633
4634                 $member->isAdmin() or $this->disallow();
4635
4636                 $this->pagehead();
4637
4638                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4639                 ?>
4640
4641                 <h2><?php echo _SETTINGS_TITLE?></h2>
4642
4643                 <form action="index.php" method="post">
4644                 <div>
4645
4646                 <input type="hidden" name="action" value="settingsupdate" />
4647                 <?php $manager->addTicketHidden() ?>
4648
4649                 <table><tr>
4650                         <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>
4651                 </tr><tr>
4652                         <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>
4653                         <td>
4654                                 <?php
4655                                         $query =  'SELECT bname as text, bnumber as value'
4656                                                    . ' FROM '.sql_table('blog');
4657                                         $template['name'] = 'DefaultBlog';
4658                                         $template['selected'] = $CONF['DefaultBlog'];
4659                                         $template['tabindex'] = 10;
4660                                         showlist($query,'select',$template);
4661                                 ?>
4662                         </td>
4663                 </tr><tr>
4664                         <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>
4665                         <td>
4666                                 <?php
4667                                         $query =  'SELECT sdname as text, sdnumber as value'
4668                                                    . ' FROM '.sql_table('skin_desc');
4669                                         $template['name'] = 'BaseSkin';
4670                                         $template['selected'] = $CONF['BaseSkin'];
4671                                         $template['tabindex'] = 1;
4672                                         showlist($query,'select',$template);
4673                                 ?>
4674                         </td>
4675                 </tr><tr>
4676                         <td><?php echo _SETTINGS_ADMINMAIL?></td>
4677                         <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  htmlspecialchars($CONF['AdminEmail']) ?>" /></td>
4678                 </tr><tr>
4679                         <td><?php echo _SETTINGS_SITENAME?></td>
4680                         <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  htmlspecialchars($CONF['SiteName']) ?>" /></td>
4681                 </tr><tr>
4682                         <td><?php echo _SETTINGS_SITEURL?></td>
4683                         <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  htmlspecialchars($CONF['IndexURL']) ?>" /></td>
4684                 </tr><tr>
4685                         <td><?php echo _SETTINGS_ADMINURL?></td>
4686                         <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  htmlspecialchars($CONF['AdminURL']) ?>" /></td>
4687                 </tr><tr>
4688                         <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>
4689                         <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  htmlspecialchars($CONF['PluginURL']) ?>" /></td>
4690                 </tr><tr>
4691                         <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>
4692                         <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  htmlspecialchars($CONF['SkinsURL']) ?>" /></td>
4693                 </tr><tr>
4694                         <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>
4695                         <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  htmlspecialchars($CONF['ActionURL']) ?>" /></td>
4696                 </tr><tr>
4697                         <td><?php echo _SETTINGS_LANGUAGE?> <?php help('language'); ?>
4698                         </td>
4699                         <td>
4700
4701                                 <select name="Language" tabindex="10050">
4702                                 <?php                           // show a dropdown list of all available languages
4703                                 global $DIR_LANG;
4704                                 $dirhandle = opendir($DIR_LANG);
4705                                 while ($filename = readdir($dirhandle)) {
4706                                         if (ereg("^(.*)\.php$",$filename,$matches)) {
4707                                                 $name = $matches[1];
4708                                                 echo "<option value='$name'";
4709                                                 if ($name == $CONF['Language'])
4710                                                         echo " selected='selected'";
4711                                                 echo ">$name</option>";
4712                                         }
4713                                 }
4714                                 closedir($dirhandle);
4715
4716                                 ?>
4717                                 </select>
4718
4719                         </td>
4720                 </tr><tr>
4721                         <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>
4722                         </td>
4723                         <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>
4724                                         <br />
4725                                 URL: <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  htmlspecialchars($CONF['DisableSiteURL'])?>" />
4726                         </td>
4727                 </tr><tr>
4728                         <td><?php echo _SETTINGS_DIRS?></td>
4729                         <td><?php echo  htmlspecialchars($DIR_NUCLEUS) ?>
4730                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4731                 </tr><tr>
4732                         <td><?php echo _SETTINGS_DBLOGIN?></td>
4733                         <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4734                 </tr><tr>
4735                         <td>
4736                         <?php
4737                                 echo _SETTINGS_JSTOOLBAR
4738                                 /* =_SETTINGS_DISABLEJS
4739
4740                                         I temporary changed the meaning of DisableJsTools, until I can find a good
4741                                         way to select the javascript version to use
4742
4743                                         now, its:
4744                                                 0 : IE
4745                                                 1 : all javascript disabled
4746                                                 2 : 'simpler' javascript (for mozilla/opera/mac)
4747                                 */
4748                            ?>
4749                         </td>
4750                         <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>
4751                                 <select name="DisableJsTools" tabindex="10075">
4752                         <?php                                   $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';
4753                                         echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";
4754                                         $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';
4755                                         echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";
4756                                         $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';
4757                                         echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";
4758                         ?>
4759                                 </select>
4760                         </td>
4761                 </tr><tr>
4762                         <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>
4763                                            <td><?php
4764
4765                                            $this->input_yesno('URLMode',$CONF['URLMode'],10077,
4766                                                           'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);
4767
4768                                            echo ' ', _SETTINGS_URLMODE_HELP;
4769
4770                                                          ?>
4771
4772                                            </td>
4773                 </tr><tr>
4774                         <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>
4775                 </tr><tr>
4776                         <td><?php echo _SETTINGS_MEDIADIR?></td>
4777                         <td><?php echo  htmlspecialchars($DIR_MEDIA) ?>
4778                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>
4779                                 <?php                           if (!is_dir($DIR_MEDIA))
4780                                                 echo "<br /><b>" . _WARNING_NOTADIR . "</b>";
4781                                         if (!is_readable($DIR_MEDIA))
4782                                                 echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";
4783                                         if (!is_writeable($DIR_MEDIA))
4784                                                 echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";
4785                                 ?>
4786                         </td>
4787                 </tr><tr>
4788                         <td><?php echo _SETTINGS_MEDIAURL?></td>
4789                         <td>
4790                                 <input name="MediaURL" tabindex="10080" size="40" value="<?php echo  htmlspecialchars($CONF['MediaURL']) ?>" />
4791                         </td>
4792                 </tr><tr>
4793                         <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>
4794                         <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>
4795                 </tr><tr>
4796                         <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>
4797                         <td>
4798                                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  htmlspecialchars($CONF['AllowedTypes']) ?>" />
4799                         </td>
4800                 </tr><tr>
4801                         <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>
4802                         <td>
4803                                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  htmlspecialchars($CONF['MaxUploadSize']) ?>" />
4804                         </td>
4805                 </tr><tr>
4806                         <td><?php echo _SETTINGS_MEDIAPREFIX?></td>
4807                         <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>
4808
4809                 </tr><tr>
4810                         <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>
4811                 </tr><tr>
4812                         <td><?php echo _SETTINGS_CHANGELOGIN?></td>
4813                         <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>
4814                 </tr><tr>
4815                         <td><?php echo _SETTINGS_ALLOWCREATE?>
4816                                 <?php help('allowaccountcreation'); ?>
4817                         </td>
4818                         <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>
4819                         </td>
4820                 </tr><tr>
4821                         <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>
4822                                 <br /><?php echo _SETTINGS_NEWLOGIN2?>
4823                         </td>
4824                         <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>
4825                         </td>
4826                 </tr><tr>
4827                         <td><?php echo _SETTINGS_MEMBERMSGS?>
4828                                 <?php help('messageservice'); ?>
4829                         </td>
4830                         <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>
4831                         </td>
4832                 </tr><tr>
4833                         <td><?php echo _SETTINGS_NONMEMBERMSGS?>
4834                                 <?php help('messageservice'); ?>
4835                         </td>
4836                         <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>
4837                         </td>
4838                 </tr><tr>
4839                         <td><?php echo _SETTINGS_PROTECTMEMNAMES?>
4840                                 <?php help('protectmemnames'); ?>
4841                         </td>
4842                         <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>
4843                         </td>
4844
4845
4846
4847                 </tr><tr>
4848                         <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>
4849                 </tr><tr>
4850                         <td><?php echo _SETTINGS_COOKIEPREFIX?></td>
4851                         <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  htmlspecialchars($CONF['CookiePrefix'])?>" /></td>
4852                 </tr><tr>
4853                         <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>
4854                         <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  htmlspecialchars($CONF['CookieDomain'])?>" /></td>
4855                 </tr><tr>
4856                         <td><?php echo _SETTINGS_COOKIEPATH?></td>
4857                         <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  htmlspecialchars($CONF['CookiePath'])?>" /></td>
4858                 </tr><tr>
4859                         <td><?php echo _SETTINGS_COOKIESECURE?></td>
4860                         <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>
4861                 </tr><tr>
4862                         <td><?php echo _SETTINGS_COOKIELIFE?></td>
4863                         <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,
4864                                                           1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>
4865                         </td>
4866                 </tr><tr>
4867                         <td><?php echo _SETTINGS_LASTVISIT?></td>
4868                         <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>
4869
4870
4871
4872                 </tr><tr>
4873                         <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>
4874                 </tr><tr>
4875                         <td><?php echo _SETTINGS_UPDATE?></td>
4876                         <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>
4877                 </tr></table>
4878
4879                 </div>
4880                 </form>
4881
4882                 <?php
4883                         echo '<h2>',_PLUGINS_EXTRA,'</h2>';
4884
4885                         $manager->notify(
4886                                 'GeneralSettingsFormExtras',
4887                                 array()
4888                         );
4889
4890                 $this->pagefoot();
4891         }
4892
4893         /**
4894          * @todo document this
4895          */
4896         function action_settingsupdate() {
4897                 global $member, $CONF;
4898
4899                 $member->isAdmin() or $this->disallow();
4900
4901                 // check if email address for admin is valid
4902                 if (!isValidMailAddress(postVar('AdminEmail')))
4903                         $this->error(_ERROR_BADMAILADDRESS);
4904
4905
4906                 // save settings
4907                 $this->updateConfig('DefaultBlog',              postVar('DefaultBlog'));
4908                 $this->updateConfig('BaseSkin',                 postVar('BaseSkin'));
4909                 $this->updateConfig('IndexURL',                 postVar('IndexURL'));
4910                 $this->updateConfig('AdminURL',                 postVar('AdminURL'));
4911                 $this->updateConfig('PluginURL',                postVar('PluginURL'));
4912                 $this->updateConfig('SkinsURL',                 postVar('SkinsURL'));
4913                 $this->updateConfig('ActionURL',                postVar('ActionURL'));
4914                 $this->updateConfig('Language',                 postVar('Language'));
4915                 $this->updateConfig('AdminEmail',               postVar('AdminEmail'));
4916                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));
4917                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));
4918                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));
4919                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));
4920                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));
4921                 $this->updateConfig('SiteName',                 postVar('SiteName'));
4922                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));
4923                 $this->updateConfig('DisableSite',              postVar('DisableSite'));
4924                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));
4925                 $this->updateConfig('LastVisit',                postVar('LastVisit'));
4926                 $this->updateConfig('MediaURL',                 postVar('MediaURL'));
4927                 $this->updateConfig('AllowedTypes',             postVar('AllowedTypes'));
4928                 $this->updateConfig('AllowUpload',              postVar('AllowUpload'));
4929                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));
4930                 $this->updateConfig('MediaPrefix',              postVar('MediaPrefix'));
4931                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));
4932                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));
4933                 $this->updateConfig('CookieDomain',             postVar('CookieDomain'));
4934                 $this->updateConfig('CookiePath',               postVar('CookiePath'));
4935                 $this->updateConfig('CookieSecure',             postVar('CookieSecure'));
4936                 $this->updateConfig('URLMode',                  postVar('URLMode'));
4937                 $this->updateConfig('CookiePrefix',             postVar('CookiePrefix'));
4938
4939                 // load new config and redirect (this way, the new language will be used is necessary)
4940                 // note that when changing cookie settings, this redirect might cause the user
4941                 // to have to log in again.
4942                 getConfig();
4943                 redirect($CONF['AdminURL'] . '?action=manage');
4944                 exit;
4945
4946         }
4947
4948         /**
4949          * @todo document this
4950          */
4951         function updateConfig($name, $val) {
4952                 $name = addslashes($name);
4953                 $val = trim(addslashes($val));
4954
4955                 $query = 'UPDATE '.sql_table('config')
4956                            . " SET value='$val'"
4957                            . " WHERE name='$name'";
4958
4959                 sql_query($query) or die("Query error: " . mysql_error());
4960                 return mysql_insert_id();
4961         }
4962
4963         /**
4964          * Error message
4965          * @param string $msg message that will be shown
4966          */
4967         function error($msg) {
4968                 $this->pagehead();
4969                 ?>
4970                 <h2>Error!</h2>
4971                 <?php           echo $msg;
4972                 echo "<br />";
4973                 echo "<a href='index.php' onclick='history.back()'>"._BACK."</a>";
4974                 $this->pagefoot();
4975                 exit;
4976         }
4977
4978         /**
4979          * @todo document this
4980          */
4981         function disallow() {
4982                 ACTIONLOG::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
4983
4984                 $this->error(_ERROR_DISALLOWED);
4985         }
4986
4987         /**
4988          * @todo document this
4989          */
4990         function pagehead($extrahead = '') {
4991                 global $member, $nucleus, $CONF, $manager;
4992
4993                 $manager->notify(
4994                         'AdminPrePageHead',
4995                         array(
4996                                 'extrahead' => &$extrahead,
4997                                 'action' => $this->action
4998                         )
4999                 );
5000
5001                 $baseUrl = htmlspecialchars($CONF['AdminURL']);
5002
5003                 ?>
5004                 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
5005                 <html xmlns="http://www.w3.org/1999/xhtml">
5006                 <head>
5007                         <meta http-equiv="Content-Type" content="text/html; charset=<?php echo _CHARSET ?>" />
5008                         <title><?php echo htmlspecialchars($CONF['SiteName'])?> - Admin</title>
5009                         <link rel="stylesheet" title="Nucleus Admin Default" type="text/css" href="<?php echo $baseUrl?>styles/admin.css" />
5010                         <link rel="stylesheet" title="Nucleus Admin Default" type="text/css"
5011                         href="<?php echo $baseUrl?>styles/addedit.css" />
5012
5013                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/edit.js"></script>
5014                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/admin.js"></script>
5015                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/compatibility.js"></script>
5016
5017           <meta http-equiv='Pragma' content='no-cache' />
5018           <meta http-equiv='Cache-Control' content='no-cache, must-revalidate' />
5019           <meta http-equiv='Expires' content='-1' />
5020
5021                         <?php echo $extrahead?>
5022                 </head>
5023                 <body>
5024                 <div class="header">
5025                 <h1><?php echo htmlspecialchars($CONF['SiteName'])?></h1>
5026                 </div>
5027                 <div id="container">
5028                 <div id="content">
5029                 <div class="loginname">
5030                 <?php                   if ($member->isLoggedIn())
5031                                 echo _LOGGEDINAS . ' ' . $member->getDisplayName()
5032                                         ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a>"
5033                                         . "<br /><a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";
5034                         else
5035                                 echo '<a href="index.php?action=showlogin" title="Log in">' , _NOTLOGGEDIN , '</a> <br />';
5036
5037                         echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a>";
5038
5039                         echo '<br />(';
5040
5041                         // Note(JP): disabled code name description
5042 /*
5043                         if ($member->isLoggedIn() && $member->isAdmin())
5044                                 echo '<a href="http://nucleuscms.org/version.php?v=',getNucleusVersion(),'&amp;pl=',getNucleusPatchLevel(),'" title="Check for upgrade">Nucleus CMS ', $nucleus['version'], ' &quot;', $nucleus['codename'], '&quot;</a>';
5045                         else
5046                                 echo 'Nucleus CMS ', $nucleus['version'], ' &quot;', $nucleus['codename'], '&quot;';
5047 */
5048                         if ($member->isLoggedIn() && $member->isAdmin())
5049                                 echo '<a href="http://nucleuscms.org/version.php?v=',getNucleusVersion(),'&amp;pl=',getNucleusPatchLevel(),'" title="Check for upgrade">Nucleus CMS ', $nucleus['version'], ' </a>';
5050                         else
5051                                 echo 'Nucleus CMS ', $nucleus['version'];
5052                         echo ')';
5053                 echo '</div>';
5054         }
5055
5056         /**
5057          * @todo document this
5058          */
5059         function pagefoot() {
5060                 global $action, $member, $manager;
5061
5062                 $manager->notify(
5063                         'AdminPrePageFoot',
5064                         array(
5065                                 'action' => $this->action
5066                         )
5067                 );
5068
5069                 if ($member->isLoggedIn() && ($action != 'showlogin')) {
5070                         ?>
5071                         <h2><?php echo  _LOGOUT ?></h2>
5072                         <ul>
5073                                 <li><a href="index.php?action=overview"><?php echo  _BACKHOME?></a></li>
5074                                 <li><a href='index.php?action=logout'><?php echo  _LOGOUT?></a></li>
5075                         </ul>
5076                         <?php           }
5077                 ?>
5078                         <div class="foot">
5079                                 <a href="http://nucleuscms.org/">Nucleus CMS</a> &copy; 2002-<?php echo date('Y'); ?> The Nucleus Group
5080                                 -
5081                                 <a href="http://nucleuscms.org/donate.php">Donate!</a>
5082                         </div>
5083
5084                         </div><!-- content -->
5085
5086                         <div id="quickmenu">
5087
5088                                 <?php                           // ---- user settings ----
5089                                 if (($action != 'showlogin') && ($member->isLoggedIn())) {
5090                                         echo '<ul>';
5091                                         echo '<li><a href="index.php?action=overview">',_QMENU_HOME,'</a></li>';
5092                                         echo '</ul>';
5093
5094                                         echo '<h2>',_QMENU_ADD,'</h2>';
5095                                         echo '<form method="get" action="index.php"><div>';
5096                                         echo '<input type="hidden" name="action" value="createitem" />';
5097
5098                                                 $showAll = requestVar('showall');
5099                                                 if (($member->isAdmin()) && ($showAll == 'yes')) {
5100                                                         // Super-Admins have access to all blogs! (no add item support though)
5101                                                         $query =  'SELECT bnumber as value, bname as text'
5102                                                                    . ' FROM ' . sql_table('blog')
5103                                                                    . ' ORDER BY bname';
5104                                                 } else {
5105                                                         $query =  'SELECT bnumber as value, bname as text'
5106                                                                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
5107                                                                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
5108                                                                    . ' ORDER BY bname';
5109                                                 }
5110                                                 $template['name'] = 'blogid';
5111                                                 $template['tabindex'] = 15000;
5112                                                 $template['extra'] = _QMENU_ADD_SELECT;
5113                                                 $template['selected'] = -1;
5114                                                 $template['shorten'] = 10;
5115                                                 $template['shortenel'] = '';
5116                                                 $template['javascript'] = 'onchange="return form.submit()"';
5117                                                 showlist($query,'select',$template);
5118
5119                                         echo '</div></form>';
5120
5121                                         echo '<h2>' . $member->getDisplayName(). '</h2>';
5122                                         echo '<ul>';
5123                                         echo '<li><a href="index.php?action=editmembersettings">',_QMENU_USER_SETTINGS,'</a></li>';
5124                                         echo '<li><a href="index.php?action=browseownitems">',_QMENU_USER_ITEMS,'</a></li>';
5125                                         echo '<li><a href="index.php?action=browseowncomments">',_QMENU_USER_COMMENTS,'</a></li>';
5126                                         echo '</ul>';
5127
5128
5129
5130
5131                                         // ---- general settings ----
5132                                         if ($member->isAdmin()) {
5133
5134                                                 echo '<h2>',_QMENU_MANAGE,'</h2>';
5135
5136                                                 echo '<ul>';
5137                                                 echo '<li><a href="index.php?action=actionlog">',_QMENU_MANAGE_LOG,'</a></li>';
5138                                                 echo '<li><a href="index.php?action=settingsedit">',_QMENU_MANAGE_SETTINGS,'</a></li>';
5139                                                 echo '<li><a href="index.php?action=usermanagement">',_QMENU_MANAGE_MEMBERS,'</a></li>';
5140                                                 echo '<li><a href="index.php?action=createnewlog">',_QMENU_MANAGE_NEWBLOG,'</a></li>';
5141                                                 echo '<li><a href="index.php?action=backupoverview">',_QMENU_MANAGE_BACKUPS,'</a></li>';
5142                                                 echo '<li><a href="index.php?action=pluginlist">',_QMENU_MANAGE_PLUGINS,'</a></li>';
5143                                                 echo '</ul>';
5144
5145                                                 echo '<h2>',_QMENU_LAYOUT,'</h2>';
5146                                                 echo '<ul>';
5147                                                 echo '<li><a href="index.php?action=skinoverview">',_QMENU_LAYOUT_SKINS,'</a></li>';
5148                                                 echo '<li><a href="index.php?action=templateoverview">',_QMENU_LAYOUT_TEMPL,'</a></li>';
5149                                                 echo '<li><a href="index.php?action=skinieoverview">',_QMENU_LAYOUT_IEXPORT,'</a></li>';
5150                                                 echo '</ul>';
5151
5152                                         }
5153
5154                                         $aPluginExtras = array();
5155                                         $manager->notify(
5156                                                 'QuickMenu',
5157                                                 array(
5158                                                         'options' => &$aPluginExtras
5159                                                 )
5160                                         );
5161                                         if (count($aPluginExtras) > 0)
5162                                         {
5163                                                 echo '<h2>', _QMENU_PLUGINS, '</h2>';
5164                                                 echo '<ul>';
5165                                                 foreach ($aPluginExtras as $aInfo)
5166                                                 {
5167                                                         echo '<li><a href="'.htmlspecialchars($aInfo['url']).'" title="'.htmlspecialchars($aInfo['tooltip']).'">'.htmlspecialchars($aInfo['title']).'</a></li>';
5168                                                 }
5169                                                 echo '</ul>';
5170                                         }
5171
5172                                 } else if (($action == 'activate') || ($action == 'activatesetpwd')) {
5173
5174                                         echo '<h2>', _QMENU_ACTIVATE, '</h2>', _QMENU_ACTIVATE_TEXT;
5175                                 } else {
5176                                         // introduction text on login screen
5177                                         echo '<h2>', _QMENU_INTRO, '</h2>', _QMENU_INTRO_TEXT;
5178                                 }
5179                                 ?>
5180                         </div>
5181
5182                         <!-- content / quickmenu container -->
5183                         </div>
5184
5185
5186                         </body>
5187                         </html>
5188                 <?php   }
5189
5190         /**
5191          * @todo document this
5192          */
5193         function action_regfile() {
5194                 global $member, $CONF;
5195
5196                 $blogid = intRequestVar('blogid');
5197
5198                 $member->teamRights($blogid) or $this->disallow();
5199
5200                 // header-code stolen from phpMyAdmin
5201                 // REGEDIT and bookmarklet code stolen from GreyMatter
5202
5203                 $sjisBlogName = getBlogNameFromID($blogid);
5204                 $sjisBlogName = mb_convert_encoding($sjisBlogName, "SJIS", "auto");
5205
5206                 header('Content-Type: application/octetstream');
5207                 header('Content-Disposition: filename="nucleus.reg"');
5208                 header('Pragma: no-cache');
5209                 header('Expires: 0');
5210
5211                 echo "REGEDIT4\n";
5212                 echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\Post To &Nucleus (".$sjisBlogName.")]\n";
5213                 echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";
5214                 echo '"contexts"=hex:31';
5215         }
5216
5217         /**
5218          * @todo document this
5219          */
5220         function action_bookmarklet() {
5221                 global $member, $manager;
5222
5223                 $blogid = intRequestVar('blogid');
5224
5225                 $member->teamRights($blogid) or $this->disallow();
5226
5227                 $blog =& $manager->getBlog($blogid);
5228                 $bm = getBookmarklet($blogid);
5229
5230                 $this->pagehead();
5231
5232                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5233
5234                 ?>
5235
5236                 <h2>Bookmarklet<!-- and Right Click Menu --></h2>
5237
5238                 <p>
5239                 Bookmarklet とは、クリック1回で記事の投稿ができるシステムです。 この Bookmarklet をインストールすると、ブラウザのツールバーの'add to weblog'ボタンが利用可能となり、Nucleusの新規アイテムの追加ウィンドウがポップアップします。任意のWebページを開いた状態でこのボタンを押せば、そのWebページのタイトルと、そのページへのリンクタグがすでに埋め込まれた状態でアイテム追加ウィンドウが開き、さらに、そのページ内に引用したい文を選択した状態であればその引用文も自動的に引用します。
5240                 </p>
5241
5242                 <h3>Bookmarklet</h3>
5243                 <p>
5244                         下のリンク部分を「お気に入り」もしくはツールバーにドラッグできます。<small>(その前にテストしてみたい場合は単純に下のリンクをクリックしてみてください)</small>
5245                         <br />
5246                         <br />
5247                         <a href="<?php echo htmlspecialchars($bm)?>">Add to <?php echo $blog->getShortName()?></a> (ほとんどのブラウザで動作します)
5248                 </p>
5249
5250                 <h3>右クリックメニューにインストール (WindowsでIE使用時)</h3>
5251                 <p>
5252                         <?php
5253                                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);
5254                                 $url = $manager->addTicketToUrl($url);
5255                         ?>
5256                         あるいは<a href="<?php echo htmlspecialchars($url) ?>">右クリックメニュー</a>にインストールすることもできます (「開く」を選択すれば直接レジストリに登録します)
5257                 </p>
5258
5259                 <p>
5260                         このインストールした右クリックメニューを表示するためにはIEの再起動が必要です。
5261                 </p>
5262
5263                 <h3>アンインストール</h3>
5264                 <p>
5265                         「お気に入り」もしくはツールバーから消すには、単に削除するだけです。
5266                 </p>
5267
5268                 <p>
5269                         右クリックメニューから消したい時は、以下の手順を踏んでください:
5270                 </p>
5271
5272                 <ol>
5273                         <li>スタートメニューから「ファイルを指定して実行...」を選択</li>
5274                         <li>"regedit" と入力</li>
5275                         <li>"OK" ボタンを押す</li>
5276                         <li>"\HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt" をツリーの中から検索</li>
5277                         <li>"add to weblog" エントリを削除</li>
5278                 </ol>
5279
5280                 <?php
5281                 $this->pagefoot();
5282
5283         }
5284
5285         /**
5286          * @todo document this
5287          */
5288         function action_actionlog() {
5289                 global $member, $manager;
5290
5291                 $member->isAdmin() or $this->disallow();
5292
5293                 $this->pagehead();
5294
5295                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5296
5297                 $url = $manager->addTicketToUrl('index.php?action=clearactionlog');
5298
5299                 ?>
5300                         <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>
5301                         <p><a href="<?php echo htmlspecialchars($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>
5302                 <?php
5303                 echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';
5304
5305                 $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';
5306                 $template['content'] = 'actionlist';
5307                 $amount = showlist($query,'table',$template);
5308
5309                 $this->pagefoot();
5310
5311         }
5312
5313         /**
5314          * @todo document this
5315          */
5316         function action_banlist() {
5317                 global $member, $manager;
5318
5319                 $blogid = intRequestVar('blogid');
5320
5321                 $member->blogAdminRights($blogid) or $this->disallow();
5322
5323                 $blog =& $manager->getBlog($blogid);
5324
5325                 $this->pagehead();
5326
5327                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5328
5329                 echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";
5330
5331                 $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';
5332                 $template['content'] = 'banlist';
5333                 $amount = showlist($query,'table',$template);
5334
5335                 if ($amount == 0)
5336                         echo _BAN_NONE;
5337
5338                 echo '<h2>'._BAN_NEW_TITLE.'</h2>';
5339                 echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";
5340
5341
5342                 $this->pagefoot();
5343
5344         }
5345
5346         /**
5347          * @todo document this
5348          */
5349         function action_banlistdelete() {
5350                 global $member, $manager;
5351
5352                 $blogid = intRequestVar('blogid');
5353                 $iprange = requestVar('iprange');
5354
5355                 $member->blogAdminRights($blogid) or $this->disallow();
5356
5357                 $blog =& $manager->getBlog($blogid);
5358
5359                 $this->pagehead();
5360                 ?>
5361                         <h2><?php echo _BAN_REMOVE_TITLE?></h2>
5362
5363                         <form method="post" action="index.php">
5364
5365                         <h3><?php echo _BAN_IPRANGE?></h3>
5366
5367                         <p>
5368                                 <?php echo _CONFIRMTXT_BAN?> <?php echo htmlspecialchars($iprange) ?>
5369                                 <input name="iprange" type="hidden" value="<?php echo htmlspecialchars($iprange)?>" />
5370                         </p>
5371
5372                         <h3><?php echo _BAN_BLOGS?></h3>
5373
5374                         <div>
5375                                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5376                                 <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">Only blog '<?php echo htmlspecialchars($blog->getName())?>'</label>
5377                                 <br />
5378                                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5379                         </div>
5380
5381                         <h3><?php echo _BAN_DELETE_TITLE?></h3>
5382
5383                         <div>
5384                                 <?php $manager->addTicketHidden() ?>
5385                                 <input type="hidden" name="action" value="banlistdeleteconfirm" />
5386                                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5387                         </div>
5388
5389                         </form>
5390                 <?php
5391                 $this->pagefoot();
5392         }
5393
5394         /**
5395          * @todo document this
5396          */
5397         function action_banlistdeleteconfirm() {
5398                 global $member, $manager;
5399
5400                 $blogid = intPostVar('blogid');
5401                 $allblogs = postVar('allblogs');
5402                 $iprange = postVar('iprange');
5403
5404                 $member->blogAdminRights($blogid) or $this->disallow();
5405
5406                 $deleted = array();
5407
5408                 if (!$allblogs) {
5409                         if (BAN::removeBan($blogid, $iprange))
5410                                 array_push($deleted, $blogid);
5411                 } else {
5412                         // get blogs fot which member has admin rights
5413                         $adminblogs = $member->getAdminBlogs();
5414                         foreach ($adminblogs as $blogje) {
5415                                 if (BAN::removeBan($blogje, $iprange))
5416                                         array_push($deleted, $blogje);
5417                         }
5418                 }
5419
5420                 if (sizeof($deleted) == 0)
5421                         $this->error(_ERROR_DELETEBAN);
5422
5423                 $this->pagehead();
5424
5425                 echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';
5426                 echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';
5427                 echo "<p>"._BAN_REMOVED_TEXT."</p>";
5428
5429                 echo "<ul>";
5430                 foreach ($deleted as $delblog) {
5431                         $b =& $manager->getBlog($delblog);
5432                         echo "<li>" . htmlspecialchars($b->getName()). "</li>";
5433                 }
5434                 echo "</ul>";
5435
5436                 $this->pagefoot();
5437
5438         }
5439
5440         /**
5441          * @todo document this
5442          */
5443         function action_banlistnewfromitem() {
5444                 $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));
5445         }
5446
5447         /**
5448          * @todo document this
5449          */
5450         function action_banlistnew($blogid = '') {
5451                 global $member, $manager;
5452
5453                 if ($blogid == '')
5454                         $blogid = intRequestVar('blogid');
5455
5456                 $ip = requestVar('ip');
5457
5458                 $member->blogAdminRights($blogid) or $this->disallow();
5459
5460                 $blog =& $manager->getBlog($blogid);
5461
5462                 $this->pagehead();
5463                 ?>
5464                 <h2><?php echo _BAN_ADD_TITLE?></h2>
5465
5466
5467                 <form method="post" action="index.php">
5468
5469                 <h3><?php echo _BAN_IPRANGE?></h3>
5470
5471                 <p><?php echo _BAN_IPRANGE_TEXT?></p>
5472
5473                 <div class="note">
5474                 <b>An example</b>: "134.58.253.193" will only block one computer, while "134.58.253" will block 256 IP addresses, including the one from the first example.
5475                 </div>
5476
5477                 <div>
5478                 <?php                   if ($ip) {
5479                 ?>
5480                         <input name="iprange" type="radio" value="<?php echo htmlspecialchars($ip)?>" checked="checked" id="ip_fixed" /><label for="ip_fixed"><?php echo htmlspecialchars($ip)?></label>
5481                         <br />
5482                         <input name="iprange" type="radio" value="custom" id="ip_custom" /><label for="ip_custom">Custom: </label><input name='customiprange' value='<?php echo htmlspecialchars($ip)?>' maxlength='15' size='15' />
5483                 <?php   } else {
5484                                 echo "<input name='iprange' value='custom' type='hidden' />";
5485                                 echo "<input name='customiprange' value='' maxlength='15' size='15' />";
5486                         }
5487                 ?>
5488                 </div>
5489
5490                 <h3><?php echo _BAN_BLOGS?></h3>
5491
5492                 <p><?php echo _BAN_BLOGS_TEXT?></p>
5493
5494                 <div>
5495                         <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5496                         <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo htmlspecialchars($blog->getName())?>'</label>
5497                         <br />
5498                         <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5499                 </div>
5500
5501                 <h3><?php echo _BAN_REASON_TITLE?></h3>
5502
5503                 <p><?php echo _BAN_REASON_TEXT?></p>
5504
5505                 <div><textarea name="reason" cols="40" rows="5"></textarea></div>
5506
5507                 <h3><?php echo _BAN_ADD_TITLE?></h3>
5508
5509                 <div>
5510                         <input name="action" type="hidden" value="banlistadd" />
5511                         <?php $manager->addTicketHidden() ?>
5512                         <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />
5513                 </div>
5514
5515                 </form>
5516
5517                 <?php           $this->pagefoot();
5518         }
5519
5520         /**
5521          * @todo document this
5522          */
5523         function action_banlistadd() {
5524                 global $member;
5525
5526                 $blogid =               intPostVar('blogid');
5527                 $allblogs =     postVar('allblogs');
5528                 $iprange =              postVar('iprange');
5529                 if ($iprange == "custom")
5530                         $iprange = postVar('customiprange');
5531                 $reason =               postVar('reason');
5532
5533                 $member->blogAdminRights($blogid) or $this->disallow();
5534
5535                 // TODO: check IP range validity
5536
5537                 if (!$allblogs) {
5538                         if (!BAN::addBan($blogid, $iprange, $reason))
5539                                 $this->error(_ERROR_ADDBAN);
5540                 } else {
5541                         // get blogs fot which member has admin rights
5542                         $adminblogs = $member->getAdminBlogs();
5543                         $failed = 0;
5544                         foreach ($adminblogs as $blogje) {
5545                                 if (!BAN::addBan($blogje, $iprange, $reason))
5546                                         $failed = 1;
5547                         }
5548                         if ($failed)
5549                                 $this->error(_ERROR_ADDBAN);
5550                 }
5551
5552                 $this->action_banlist();
5553
5554         }
5555
5556         /**
5557          * @todo document this
5558          */
5559         function action_clearactionlog() {
5560                 global $member;
5561
5562                 $member->isAdmin() or $this->disallow();
5563
5564                 ACTIONLOG::clear();
5565
5566                 $this->action_manage(_MSG_ACTIONLOGCLEARED);
5567         }
5568
5569         /**
5570          * @todo document this
5571          */
5572         function action_backupoverview() {
5573                 global $member, $manager;
5574
5575                 $member->isAdmin() or $this->disallow();
5576
5577                 $this->pagehead();
5578
5579                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5580                 ?>
5581                 <h2><?php echo _BACKUPS_TITLE?></h2>
5582
5583                 <h3><?php echo _BACKUP_TITLE?></h3>
5584
5585                 <p><?php echo _BACKUP_INTRO?></p>
5586
5587                 <form method="post" action="index.php"><p>
5588                 <input type="hidden" name="action" value="backupcreate" />
5589                 <?php $manager->addTicketHidden() ?>
5590
5591                 <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>
5592                 <br />
5593                 <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>
5594                 <br /><br />
5595                 <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />
5596
5597                 </p></form>
5598
5599                 <div class="note"><?php echo _BACKUP_NOTE?></div>
5600
5601
5602                 <h3><?php echo _RESTORE_TITLE?></h3>
5603
5604                 <div class="note"><?php echo _RESTORE_NOTE?></div>
5605
5606                 <p><?php echo _RESTORE_INTRO?></p>
5607
5608                 <form method="post" action="index.php" enctype="multipart/form-data"><p>
5609                         <input type="hidden" name="action" value="backuprestore" />
5610                         <?php $manager->addTicketHidden() ?>
5611                         <input name="backup_file" type="file" tabindex="30" />
5612                         <br /><br />
5613                         <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />
5614                         <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>
5615                         <br /><?php echo _RESTORE_WARNING?>
5616                 </p></form>
5617
5618                 <?php           $this->pagefoot();
5619         }
5620
5621         /**
5622          * @todo document this
5623          */
5624         function action_backupcreate() {
5625                 global $member, $DIR_LIBS;
5626
5627                 $member->isAdmin() or $this->disallow();
5628
5629                 // use compression ?
5630                 $useGzip = intval(postVar('gzip'));
5631
5632                 include($DIR_LIBS . 'backup.php');
5633
5634                 // try to extend time limit
5635                 // (creating/restoring dumps might take a while)
5636                 @set_time_limit(1200);
5637
5638                 do_backup($useGzip);
5639                 exit;
5640         }
5641
5642         /**
5643          * @todo document this
5644          */
5645         function action_backuprestore() {
5646                 global $member, $DIR_LIBS;
5647
5648                 $member->isAdmin() or $this->disallow();
5649
5650                 if (intPostVar('letsgo') != 1)
5651                         $this->error(_ERROR_BACKUP_NOTSURE);
5652
5653                 include($DIR_LIBS . 'backup.php');
5654
5655                 // try to extend time limit
5656                 // (creating/restoring dumps might take a while)
5657                 @set_time_limit(1200);
5658
5659                 $message = do_restore();
5660                 if ($message != '')
5661                         $this->error($message);
5662
5663                 $this->pagehead();
5664                 ?>
5665                 <h2><?php echo _RESTORE_COMPLETE?></h2>
5666                 <?php           $this->pagefoot();
5667
5668         }
5669
5670         /**
5671          * @todo document this
5672          */
5673         function action_pluginlist() {
5674                 global $member, $manager;
5675
5676                 // check if allowed
5677                 $member->isAdmin() or $this->disallow();
5678
5679                 $this->pagehead();
5680
5681                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5682
5683                 echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';
5684
5685                 echo '<h3>' , _PLUGS_TITLE_INSTALLED , '</h3>';
5686
5687
5688                 $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';
5689
5690                 $template['content'] = 'pluginlist';
5691                 $template['tabindex'] = 10;
5692                 showlist($query, 'table', $template);
5693
5694                 ?>
5695                         <h3><?php echo _PLUGS_TITLE_UPDATE?></h3>
5696
5697                         <p><?php echo _PLUGS_TEXT_UPDATE?></p>
5698
5699                         <form method="post" action="index.php"><div>
5700                                 <input type="hidden" name="action" value="pluginupdate" />
5701                                 <?php $manager->addTicketHidden() ?>
5702                                 <input type="submit" value="<?php echo _PLUGS_BTN_UPDATE ?>" tabindex="20" />
5703                         </div></form>
5704
5705                         <h3><?php echo _PLUGS_TITLE_NEW?></h3>
5706
5707                         <?php                           // find a list of possibly non-installed plugins
5708                                 $candidates = array();
5709                                 global $DIR_PLUGINS;
5710                                 $dirhandle = opendir($DIR_PLUGINS);
5711                                 while ($filename = readdir($dirhandle)) {
5712                                         if (ereg('^NP_(.*)\.php$',$filename,$matches)) {
5713                                                 $name = $matches[1];
5714                                                 // only show in list when not yet installed
5715                                                 $res = sql_query('SELECT * FROM '.sql_table('plugin').' WHERE pfile="NP_'.addslashes($name).'"');
5716                                                 if (mysql_num_rows($res) == 0)
5717                                                         array_push($candidates,$name);
5718                                         }
5719                                 }
5720                                 closedir($dirhandle);
5721
5722                                 if (sizeof($candidates) > 0) {
5723                         ?>
5724
5725                         <p><?php echo _PLUGS_ADD_TEXT?></p>
5726
5727
5728                         <form method='post' action='index.php'><div>
5729                                 <input type='hidden' name='action' value='pluginadd' />
5730                                 <?php $manager->addTicketHidden() ?>
5731                                 <select name="filename" tabindex="30">
5732                                 <?php                                   foreach($candidates as $name)
5733                                                 echo '<option value="NP_',$name,'">',htmlspecialchars($name),'</option>';
5734                                 ?>
5735                                 </select>
5736                                 <input type='submit' tabindex="40" value='<?php echo _PLUGS_BTN_INSTALL?>' />
5737                         </div></form>
5738
5739                 <?php                   } else {        // sizeof(candidates) == 0
5740                                 echo '<p>',_PLUGS_NOCANDIDATES,'</p>';
5741                         }
5742
5743                 $this->pagefoot();
5744         }
5745
5746         /**
5747          * @todo document this
5748          */
5749         function action_pluginhelp() {
5750                 global $member, $manager, $DIR_PLUGINS, $CONF;
5751
5752                 // check if allowed
5753                 $member->isAdmin() or $this->disallow();
5754
5755                 $plugid = intGetVar('plugid');
5756
5757                 if (!$manager->pidInstalled($plugid))
5758                         $this->error(_ERROR_NOSUCHPLUGIN);
5759
5760                 $plugName = getPluginNameFromPid($plugid);
5761
5762                 $this->pagehead();
5763
5764                 echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';
5765
5766                 echo '<h2>',_PLUGS_HELP_TITLE,': ',htmlspecialchars($plugName),'</h2>';
5767
5768                 $plug =& $manager->getPlugin($plugName);
5769                 $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';
5770
5771                 if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {
5772                         @readfile($helpFile);
5773                 } else {
5774                         echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';
5775                         echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';
5776                 }
5777
5778
5779                 $this->pagefoot();
5780         }
5781
5782         /**
5783          * @todo document this
5784          */
5785         function action_pluginadd() {
5786                 global $member, $manager, $DIR_PLUGINS;
5787
5788                 // check if allowed
5789                 $member->isAdmin() or $this->disallow();
5790
5791                 $name = postVar('filename');
5792
5793                 if ($manager->pluginInstalled($name))
5794                         $this->error(_ERROR_DUPPLUGIN);
5795                 if (!checkPlugin($name))
5796                         $this->error(_ERROR_PLUGFILEERROR . ' (' . htmlspecialchars($name) . ')');
5797
5798                 // get number of currently installed plugins
5799                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));
5800                 $numCurrent = mysql_num_rows($res);
5801
5802                 // plugin will be added as last one in the list
5803                 $newOrder = $numCurrent + 1;
5804
5805                 $manager->notify(
5806                         'PreAddPlugin',
5807                         array(
5808                                 'file' => &$name
5809                         )
5810                 );
5811
5812                 // do this before calling getPlugin (in case the plugin id is used there)
5813                 $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.addslashes($name).'")';
5814                 sql_query($query);
5815                 $iPid = mysql_insert_id();
5816
5817                 $manager->clearCachedInfo('installedPlugins');
5818
5819                 // Load the plugin for condition checking and instalation
5820                 $plugin =& $manager->getPlugin($name);
5821
5822                 // check if it got loaded (could have failed)
5823                 if (!$plugin)
5824                 {
5825                         sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));
5826                         $manager->clearCachedInfo('installedPlugins');
5827                         $this->error(_ERROR_PLUGIN_LOAD);
5828                 }
5829
5830                 // check if plugin needs a newer Nucleus version
5831                 if (getNucleusVersion() < $plugin->getMinNucleusVersion())
5832                 {
5833                         // uninstall plugin again...
5834                         $this->deleteOnePlugin($plugin->getID());
5835
5836                         // ...and show error
5837                         $this->error(_ERROR_NUCLEUSVERSIONREQ . htmlspecialchars($plugin->getMinNucleusVersion()));
5838                 }
5839
5840                 // check if plugin needs a newer Nucleus version
5841                 if ((getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()))
5842                 {
5843                         // uninstall plugin again...
5844                         $this->deleteOnePlugin($plugin->getID());
5845
5846                         // ...and show error
5847                         $this->error(_ERROR_NUCLEUSVERSIONREQ . htmlspecialchars( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );
5848                 }
5849
5850                 $pluginList = $plugin->getPluginDep();
5851                 foreach ($pluginList as $pluginName)
5852                 {
5853
5854                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');
5855                         if (mysql_num_rows($res) == 0)
5856                         {
5857                                 // uninstall plugin again...
5858                                 $this->deleteOnePlugin($plugin->getID());
5859
5860                                 $this->error(_ERROR_INSREQPLUGIN . htmlspecialchars($pluginName));
5861                         }
5862                 }
5863
5864                 // call the install method of the plugin
5865                 $plugin->install();
5866
5867                 $manager->notify(
5868                         'PostAddPlugin',
5869                         array(
5870                                 'plugin' => &$plugin
5871                         )
5872                 );
5873
5874                 // update all events
5875                 $this->action_pluginupdate();
5876         }
5877
5878         /**
5879          * @todo document this
5880          */
5881         function action_pluginupdate() {
5882                 global $member, $manager;
5883
5884                 // check if allowed
5885                 $member->isAdmin() or $this->disallow();
5886
5887                 // delete everything from plugin_events
5888                 sql_query('DELETE FROM '.sql_table('plugin_event'));
5889
5890                 // loop over all installed plugins
5891                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));
5892                 while($o = mysql_fetch_object($res)) {
5893                         $pid = $o->pid;
5894                         $plug =& $manager->getPlugin($o->pfile);
5895                         if ($plug)
5896                         {
5897                                 $eventList = $plug->getEventList();
5898                                 foreach ($eventList as $eventName)
5899                                         sql_query('INSERT INTO '.sql_table('plugin_event').' (pid, event) VALUES ('.$pid.', \''.addslashes($eventName).'\')');
5900                         }
5901                 }
5902
5903                 $this->action_pluginlist();
5904         }
5905
5906         /**
5907          * @todo document this
5908          */
5909         function action_plugindelete() {
5910                 global $member, $manager;
5911
5912                 // check if allowed
5913                 $member->isAdmin() or $this->disallow();
5914
5915                 $pid = intGetVar('plugid');
5916
5917                 if (!$manager->pidInstalled($pid))
5918                         $this->error(_ERROR_NOSUCHPLUGIN);
5919
5920                 $this->pagehead();
5921                 ?>
5922                         <h2><?php echo _DELETE_CONFIRM?></h2>
5923
5924                         <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>
5925
5926                         <form method="post" action="index.php"><div>
5927                         <?php $manager->addTicketHidden() ?>
5928                         <input type="hidden" name="action" value="plugindeleteconfirm" />
5929                         <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />
5930                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5931                         </div></form>
5932                 <?php           $this->pagefoot();
5933         }
5934
5935         /**
5936          * @todo document this
5937          */
5938         function action_plugindeleteconfirm() {
5939                 global $member, $manager;
5940
5941                 // check if allowed
5942                 $member->isAdmin() or $this->disallow();
5943
5944                 $pid = intPostVar('plugid');
5945
5946                 $error = $this->deleteOnePlugin($pid, 1);
5947                 if ($error) {
5948                         $this->error($error);
5949                 }
5950
5951                 $this->action_pluginlist();
5952         }
5953
5954         /**
5955          * @todo document this
5956          */
5957         function deleteOnePlugin($pid, $callUninstall = 0) {
5958                 global $manager;
5959
5960                 $pid = intval($pid);
5961
5962                 if (!$manager->pidInstalled($pid))
5963                         return _ERROR_NOSUCHPLUGIN;
5964
5965                 $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);
5966
5967                 // call the unInstall method of the plugin
5968                 if ($callUninstall) {
5969                         $plugin =& $manager->getPlugin($name);
5970                         if ($plugin) $plugin->unInstall();
5971                 }
5972
5973                 // check dependency before delete
5974                 $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));
5975                 while($o = mysql_fetch_object($res)) {
5976                         $plug =& $manager->getPlugin($o->pfile);
5977                         if ($plug)
5978                         {
5979                                 $depList = $plug->getPluginDep();
5980                                 foreach ($depList as $depName)
5981                                 {
5982                                         if ($name == $depName)
5983                                         {
5984                                                 return _ERROR_DELREQPLUGIN . $o->pfile;
5985                                         }
5986                                 }
5987                         }
5988                 }
5989
5990                 $manager->notify('PreDeletePlugin', array('plugid' => $pid));
5991
5992                 // delete all subscriptions
5993                 sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);
5994
5995                 // delete all options
5996                 // get OIDs from plugin_option_desc
5997                 $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
5998                 $aOIDs = array();
5999                 while ($o = mysql_fetch_object($res)) {
6000                         array_push($aOIDs, $o->oid);
6001                 }
6002
6003                 // delete from plugin_option and plugin_option_desc
6004                 sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);
6005                 if (count($aOIDs) > 0)
6006                         sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');
6007
6008                 // update order numbers
6009                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);
6010                 $o = mysql_fetch_object($res);
6011                 sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);
6012
6013                 // delete row
6014                 sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);
6015
6016                 $manager->clearCachedInfo('installedPlugins');
6017                 $manager->notify('PostDeletePlugin', array('plugid' => $pid));
6018
6019                 return '';
6020         }
6021
6022         /**
6023          * @todo document this
6024          */
6025         function action_pluginup() {
6026                 global $member, $manager;
6027
6028                 // check if allowed
6029                 $member->isAdmin() or $this->disallow();
6030
6031                 $plugid = intGetVar('plugid');
6032
6033                 if (!$manager->pidInstalled($plugid))
6034                         $this->error(_ERROR_NOSUCHPLUGIN);
6035
6036                 // 1. get old order number
6037                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6038                 $o = mysql_fetch_object($res);
6039                 $oldOrder = $o->porder;
6040
6041                 // 2. calculate new order number
6042                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
6043
6044                 // 3. update plug numbers
6045                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6046                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6047
6048                 //$this->action_pluginlist();
6049                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6050                 redirect('?action=pluginlist');
6051         }
6052
6053         /**
6054          * @todo document this
6055          */
6056         function action_plugindown() {
6057                 global $member, $manager;
6058
6059                 // check if allowed
6060                 $member->isAdmin() or $this->disallow();
6061
6062                 $plugid = intGetVar('plugid');
6063                 if (!$manager->pidInstalled($plugid))
6064                         $this->error(_ERROR_NOSUCHPLUGIN);
6065
6066                 // 1. get old order number
6067                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6068                 $o = mysql_fetch_object($res);
6069                 $oldOrder = $o->porder;
6070
6071                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6072                 $maxOrder = mysql_num_rows($res);
6073
6074                 // 2. calculate new order number
6075                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
6076
6077                 // 3. update plug numbers
6078                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6079                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6080
6081                 //$this->action_pluginlist();
6082                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6083                 redirect('?action=pluginlist');
6084         }
6085
6086         /**
6087          * @todo document this
6088          */
6089         function action_pluginoptions($message = '') {
6090                 global $member, $manager;
6091
6092                 // check if allowed
6093                 $member->isAdmin() or $this->disallow();
6094
6095                 $pid = intRequestVar('plugid');
6096                 if (!$manager->pidInstalled($pid))
6097                         $this->error(_ERROR_NOSUCHPLUGIN);
6098
6099                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
6100                 $this->pagehead($extrahead);
6101
6102                 ?>
6103                         <p><a href="index.php?action=pluginlist">(<?php echo _PLUGS_BACK?>)</a></p>
6104
6105                         <h2>Options for <?php echo htmlspecialchars(getPluginNameFromPid($pid))?></h2>
6106
6107                         <?php if  ($message) echo $message?>
6108
6109                         <form action="index.php" method="post">
6110                         <div>
6111                                 <input type="hidden" name="action" value="pluginoptionsupdate" />
6112                                 <input type="hidden" name="plugid" value="<?php echo $pid?>" />
6113
6114                 <?php
6115
6116                 $manager->addTicketHidden();
6117
6118                 $aOptions = array();
6119                 $aOIDs = array();
6120                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ' WHERE ocontext=\'global\' and opid=' . $pid . ' ORDER BY oid ASC';
6121                 $r = sql_query($query);
6122                 while ($o = mysql_fetch_object($r)) {
6123                         array_push($aOIDs, $o->oid);
6124                         $aOptions[$o->oid] = array(
6125                                                 'oid' => $o->oid,
6126                                                 'value' => $o->odef,
6127                                                 'name' => $o->oname,
6128                                                 'description' => $o->odesc,
6129                                                 'type' => $o->otype,
6130                                                 'typeinfo' => $o->oextra,
6131                                                 'contextid' => 0
6132                         );
6133                 }
6134                 // fill out actual values
6135                 if (count($aOIDs) > 0) {
6136                         $r = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE oid in ('.implode(',',$aOIDs).')');
6137                         while ($o = mysql_fetch_object($r))
6138                                 $aOptions[$o->oid]['value'] = $o->ovalue;
6139                 }
6140
6141                 // call plugins
6142                 $manager->notify('PrePluginOptionsEdit',array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions));
6143
6144                 $template['content'] = 'plugoptionlist';
6145                 $amount = showlist($aOptions,'table',$template);
6146                 if ($amount == 0)
6147                         echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';
6148
6149                 ?>
6150                         </div>
6151                         </form>
6152                 <?php           $this->pagefoot();
6153
6154
6155
6156         }
6157
6158         /**
6159          * @todo document this
6160          */
6161         function action_pluginoptionsupdate() {
6162                 global $member, $manager;
6163
6164                 // check if allowed
6165                 $member->isAdmin() or $this->disallow();
6166
6167                 $pid = intRequestVar('plugid');
6168                 if (!$manager->pidInstalled($pid))
6169                         $this->error(_ERROR_NOSUCHPLUGIN);
6170
6171                 $aOptions = requestArray('plugoption');
6172                 NucleusPlugin::_applyPluginOptions($aOptions);
6173
6174                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));
6175
6176                 $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
6177         }
6178
6179         /**
6180          * @static
6181          * @todo document this
6182          */
6183         function _insertPluginOptions($context, $contextid = 0) {
6184                 // get all current values for this contextid
6185                 // (note: this might contain doubles for overlapping contextids)
6186                 $aIdToValue = array();
6187                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));
6188                 while ($o = mysql_fetch_object($res)) {
6189                         $aIdToValue[$o->oid] = $o->ovalue;
6190                 }
6191
6192                 // get list of oids per pid
6193                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')
6194                            . ' WHERE opid=pid and ocontext=\''.addslashes($context).'\' ORDER BY porder, oid ASC';
6195                 $res = sql_query($query);
6196                 $aOptions = array();
6197                 while ($o = mysql_fetch_object($res)) {
6198                         if (in_array($o->oid, array_keys($aIdToValue)))
6199                                 $value = $aIdToValue[$o->oid];
6200                         else
6201                                 $value = $o->odef;
6202
6203                         array_push($aOptions, array(
6204                                 'pid' => $o->pid,
6205                                 'pfile' => $o->pfile,
6206                                 'oid' => $o->oid,
6207                                 'value' => $value,
6208                                 'name' => $o->oname,
6209                                 'description' => $o->odesc,
6210                                 'type' => $o->otype,
6211                                 'typeinfo' => $o->oextra,
6212                                 'contextid' => $contextid,
6213                                 'extra' => ''
6214                         ));
6215                 }
6216
6217                 global $manager;
6218                 $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));
6219
6220
6221                 $iPrevPid = -1;
6222                 foreach ($aOptions as $aOption) {
6223
6224                         // new plugin?
6225                         if ($iPrevPid != $aOption['pid']) {
6226                                 $iPrevPid = $aOption['pid'];
6227
6228                                 echo '<tr><th colspan="2">Options for ', htmlspecialchars($aOption['pfile']),'</th></tr>';
6229                         }
6230
6231                         echo '<tr>';
6232                         listplug_plugOptionRow($aOption);
6233                         echo '</tr>';
6234
6235                 }
6236
6237
6238         }
6239
6240         /**
6241          * Helper functions to create option forms etc.
6242          * @todo document parameters
6243          */
6244         function input_yesno($name, $checkedval,$tabindex = 0, $value1 = 1, $value2 = 0, $yesval = _YES, $noval = _NO, $isAdmin = 0) {
6245                 $id = htmlspecialchars($name);
6246                 $id = str_replace('[','-',$id);
6247                 $id = str_replace(']','-',$id);
6248                 $id1 = $id . htmlspecialchars($value1);
6249                 $id2 = $id . htmlspecialchars($value2);
6250
6251                 if ($name=="admin") {
6252                         echo '<input onclick="selectCanLogin(true);" type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value1),'" ';
6253                 } else {
6254                         echo '<input type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value1),'" ';
6255                 }
6256
6257                         if ($checkedval == $value1)
6258                                 echo "tabindex='$tabindex' checked='checked'";
6259                         echo ' id="'.$id1.'" /><label for="'.$id1.'">' . $yesval . '</label>';
6260                 echo ' ';
6261                 if ($name=="admin") {
6262                         echo '<input onclick="selectCanLogin(false);" type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value2),'" ';
6263                 } else {
6264                         echo '<input type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value2),'" ';
6265                 }
6266                         if ($checkedval != $value1)
6267                                 echo "tabindex='$tabindex' checked='checked'";
6268                         if ($isAdmin && $name=="canlogin")
6269                                 echo " disabled='true'";
6270                         echo ' id="'.$id2.'" /><label for="'.$id2.'">' . $noval . '</label>';
6271         }
6272
6273 } // class ADMIN
6274
6275 ?>