utf8/nucleus/libs/ADMIN.php

   1 <?php
   2 /*
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2006 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2006 The Nucleus Group
  17  * @version $Id: ADMIN.php,v 1.12 2007-01-31 10:02:58 kimitake Exp $
  18  * @version $NucleusJP: ADMIN.php,v 1.11 2006/11/13 00:43:07 kimitake Exp $
  19  */
  20
  21 require_once "showlist.php";
  22
  23 /**
  24  * Builds the admin area and executes admin actions
  25  */
  26 class ADMIN {
  27
  28         /**
  29          * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)
  30          */
  31         var $action;
  32
  33         /**
  34          * Class constructor
  35          */
  36         function ADMIN() {
  37
  38         }
  39
  40         /**
  41          * Executes an action
  42          *
  43          * @param string $action action to be performed
  44          */
  45         function action($action) {
  46                 global $CONF, $manager;
  47
  48                 // list of action aliases
  49                 $alias = array(
  50                         'login' => 'overview',
  51                         '' => 'overview'
  52                 );
  53
  54                 if (isset($alias[$action]))
  55                         $action = $alias[$action];
  56
  57                 $methodName = 'action_' . $action;
  58
  59                 $this->action = strtolower($action);
  60
  61                 // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action
  62                 // is an action that requires user interaction before something is actually done)
  63                 // all safe actions are in this array:
  64                 $aActionsNotToCheck = array('showlogin', 'login', 'overview', 'itemlist', 'blogcommentlist', 'bookmarklet', 'blogsettings', 'banlist', 'deleteblog', 'editmembersettings', 'browseownitems', 'browseowncomments', 'createitem', 'itemedit', 'itemmove', 'categoryedit', 'categorydelete', 'manage', 'actionlog', 'settingsedit', 'backupoverview', 'pluginlist', 'createnewlog', 'usermanagement', 'skinoverview', 'templateoverview', 'skinieoverview', 'itemcommentlist', 'commentedit', 'commentdelete', 'banlistnewfromitem', 'banlistdelete', 'itemdelete', 'manageteam', 'teamdelete', 'banlistnew', 'memberedit', 'memberdelete', 'pluginhelp', 'pluginoptions', 'plugindelete', 'skinedittype', 'skinremovetype', 'skindelete', 'skinedit', 'templateedit', 'templatedelete', 'activate');
  65 /*
  66                 // the rest of the actions needs to be checked
  67                 $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'sendping', 'rawping', 'activatesetpwd');
  68 */
  69                 if (!in_array($this->action, $aActionsNotToCheck))
  70                 {
  71                         if (!$manager->checkTicket())
  72                                 $this->error(_ERROR_BADTICKET);
  73                 }
  74
  75                 if (method_exists($this, $methodName))
  76                         call_user_func(array(&$this, $methodName));
  77                 else
  78                         $this->error(_BADACTION . " ($action)");
  79
  80         }
  81
  82         /**
  83          * @todo document this
  84          */
  85         function action_showlogin() {
  86                 global $error;
  87                 $this->action_login($error);
  88         }
  89
  90         /**
  91          * @todo document this
  92          */
  93         function action_login($msg = '', $passvars = 1) {
  94                 global $member;
  95
  96                 // skip to overview when allowed
  97                 if ($member->isLoggedIn() && $member->canLogin()) {
  98                         $this->action_overview();
  99                         exit;
 100                 }
 101
 102                 $this->pagehead();
 103
 104                 echo '<h2>', _LOGIN ,'</h2>';
 105                 if ($msg) echo _MESSAGE , ': ', htmlspecialchars($msg);
 106                 ?>
 107
 108                 <form action="index.php" method="post"><p>
 109                 <?php echo _LOGIN_NAME?>: <br /><input name="login"  tabindex="10" />
 110                 <br />
 111                 <?php echo _LOGIN_PASSWORD?>: <br /><input name="password"  tabindex="20" type="password" />
 112                 <br />
 113                 <input name="action" value="login" type="hidden" />
 114                 <br />
 115                 <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />
 116                 <br />
 117                 <small>
 118                         <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>
 119                         <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>
 120                 </small>
 121                 <?php                   // pass through vars
 122
 123                         $oldaction = postVar('oldaction');
 124                         if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {
 125                                 passRequestVars();
 126                         }
 127
 128
 129                 ?>
 130                 </p></form>
 131                 <?php           $this->pagefoot();
 132         }
 133
 134
 135         /**
 136          * provides a screen with the overview of the actions available
 137          * @todo document parameter
 138          */
 139         function action_overview($msg = '') {
 140                 global $member;
 141
 142                 $this->pagehead();
 143
 144                 if ($msg)
 145                         echo _MESSAGE , ': ', $msg;
 146
 147                 /* ---- add items ---- */
 148                 echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';
 149
 150                 $showAll = requestVar('showall');
 151
 152                 if (($member->isAdmin()) && ($showAll == 'yes')) {
 153                         // Super-Admins have access to all blogs! (no add item support though)
 154                         $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'
 155                                    . ' FROM ' . sql_table('blog')
 156                                    . ' ORDER BY bname';
 157                 } else {
 158                         $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'
 159                                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
 160                                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
 161                                    . ' ORDER BY bname';
 162                 }
 163                 $template['content'] = 'bloglist';
 164                 $template['superadmin'] = $member->isAdmin();
 165                 $amount = showlist($query,'table',$template);
 166
 167                 if (($showAll != 'yes') && ($member->isAdmin())) {
 168                         $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));
 169                         if ($total > $amount)
 170                                 echo '<p><a href="index.php?action=overview&amp;showall=yes">Show all blogs</a></p>';
 171                 }
 172
 173                 if ($amount == 0)
 174                         echo _OVERVIEW_NOBLOGS;
 175
 176                 if ($amount != 0) {
 177                         echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';
 178                         $query =  'SELECT ititle, inumber, bshortname'
 179                                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')
 180                                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';
 181                         $template['content'] = 'draftlist';
 182                         $amountdrafts = showlist($query, 'table', $template);
 183                         if ($amountdrafts == 0)
 184                                 echo _OVERVIEW_NODRAFTS;
 185                 }
 186
 187                 /* ---- user settings ---- */
 188                 echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';
 189                 echo '<ul>';
 190                 echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';
 191                 echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';
 192                 echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';
 193                 echo '</ul>';
 194
 195                 /* ---- general settings ---- */
 196                 if ($member->isAdmin()) {
 197                         echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';
 198                         echo '<ul>';
 199                         echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';
 200                         echo '</ul>';
 201                 }
 202
 203
 204                 $this->pagefoot();
 205         }
 206
 207         /**
 208          * Returns a link to a weblog
 209          * @param object BLOG
 210          */
 211         function bloglink(&$blog) {
 212                 return '<a href="'.htmlspecialchars($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'.$blog->getName() .'</a>';
 213         }
 214
 215         /**
 216          * @todo document this
 217          */
 218         function action_manage($msg = '') {
 219                 global $member;
 220
 221                 $member->isAdmin() or $this->disallow();
 222
 223                 $this->pagehead();
 224
 225                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 226
 227                 if ($msg)
 228                         echo '<p>' , _MESSAGE , ': ', $msg , '</p>';
 229
 230
 231                 echo '<h2>' . _MANAGE_GENERAL. '</h2>';
 232
 233                 echo '<ul>';
 234                 echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';
 235                 echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';
 236                 echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';
 237                 echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';
 238                 echo '</ul>';
 239
 240                 echo '<h2>' . _MANAGE_SKINS . '</h2>';
 241                 echo '<ul>';
 242                 echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';
 243                 echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';
 244                 echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';
 245                 echo '</ul>';
 246
 247                 echo '<h2>' . _MANAGE_EXTRA . '</h2>';
 248                 echo '<ul>';
 249                 echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';
 250                 echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';
 251                 echo '</ul>';
 252
 253                 $this->pagefoot();
 254         }
 255
 256         /**
 257          * @todo document this
 258          */
 259         function action_itemlist($blogid = '') {
 260                 global $member, $manager;
 261
 262                 if ($blogid == '')
 263                         $blogid = intRequestVar('blogid');
 264
 265                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 266
 267                 $this->pagehead();
 268                 $blog =& $manager->getBlog($blogid);
 269
 270                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 271                 echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';
 272
 273                 // start index
 274                 if (postVar('start'))
 275                         $start = intPostVar('start');
 276                 else
 277                         $start = 0;
 278
 279                 if ($start == 0)
 280                         echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';
 281
 282                 // amount of items to show
 283                 if (postVar('amount'))
 284                         $amount = intPostVar('amount');
 285                 else
 286                         $amount = 10;
 287
 288                 $search = postVar('search');    // search through items
 289
 290                 $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'
 291                            . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')
 292                            . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;
 293
 294                 if ($search)
 295                         $query .= ' and ((ititle LIKE "%' . addslashes($search) . '%") or (ibody LIKE "%' . addslashes($search) . '%") or (imore LIKE "%' . addslashes($search) . '%"))';
 296
 297                 // non-blog-admins can only edit/delete their own items
 298                 if (!$member->blogAdminRights($blogid))
 299                         $query .= ' and iauthor=' . $member->getID();
 300
 301
 302                 $query .= ' ORDER BY itime DESC'
 303                                 . " LIMIT $start,$amount";
 304
 305                 $template['content'] = 'itemlist';
 306                 $template['now'] = $blog->getCorrectTime(time());
 307
 308                 $manager->loadClass("ENCAPSULATE");
 309                 $navList =& new NAVLIST('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);
 310                 $navList->showBatchList('item',$query,'table',$template);
 311
 312
 313                 $this->pagefoot();
 314         }
 315
 316         /**
 317          * @todo document this
 318          */
 319         function action_batchitem() {
 320                 global $member, $manager;
 321
 322                 // check if logged in
 323                 $member->isLoggedIn() or $this->disallow();
 324
 325                 // more precise check will be done for each performed operation
 326
 327                 // get array of itemids from request
 328                 $selected = requestIntArray('batch');
 329                 $action = requestVar('batchaction');
 330
 331                 // Show error when no items were selected
 332                 if (!is_array($selected) || sizeof($selected) == 0)
 333                         $this->error(_BATCH_NOSELECTION);
 334
 335                 // On move: when no destination blog/category chosen, show choice now
 336                 $destCatid = intRequestVar('destcatid');
 337                 if (($action == 'move') && (!$manager->existsCategory($destCatid)))
 338                         $this->batchMoveSelectDestination('item',$selected);
 339
 340                 // On delete: check if confirmation has been given
 341                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 342                         $this->batchAskDeleteConfirmation('item',$selected);
 343
 344                 $this->pagehead();
 345
 346                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 347                 echo '<h2>',_BATCH_ITEMS,'</h2>';
 348                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 349                 echo '<ul>';
 350
 351
 352                 // walk over all itemids and perform action
 353                 foreach ($selected as $itemid) {
 354                         $itemid = intval($itemid);
 355                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';
 356
 357                         // perform action, display errors if needed
 358                         switch($action) {
 359                                 case 'delete':
 360                                         $error = $this->deleteOneItem($itemid);
 361                                         break;
 362                                 case 'move':
 363                                         $error = $this->moveOneItem($itemid, $destCatid);
 364                                         break;
 365                                 default:
 366                                         $error = _BATCH_UNKNOWN . $action;
 367                         }
 368
 369                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 370                         echo '</li>';
 371                 }
 372
 373                 echo '</ul>';
 374                 echo '<b>',_BATCH_DONE,'</b>';
 375
 376                 $this->pagefoot();
 377
 378
 379         }
 380
 381         /**
 382          * @todo document this
 383          */
 384         function action_batchcomment() {
 385                 global $member;
 386
 387                 // check if logged in
 388                 $member->isLoggedIn() or $this->disallow();
 389
 390                 // more precise check will be done for each performed operation
 391
 392                 // get array of itemids from request
 393                 $selected = requestIntArray('batch');
 394                 $action = requestVar('batchaction');
 395
 396                 // Show error when no items were selected
 397                 if (!is_array($selected) || sizeof($selected) == 0)
 398                         $this->error(_BATCH_NOSELECTION);
 399
 400                 // On delete: check if confirmation has been given
 401                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 402                         $this->batchAskDeleteConfirmation('comment',$selected);
 403
 404                 $this->pagehead();
 405
 406                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 407                 echo '<h2>',_BATCH_COMMENTS,'</h2>';
 408                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 409                 echo '<ul>';
 410
 411                 // walk over all itemids and perform action
 412                 foreach ($selected as $commentid) {
 413                         $commentid = intval($commentid);
 414                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';
 415
 416                         // perform action, display errors if needed
 417                         switch($action) {
 418                                 case 'delete':
 419                                         $error = $this->deleteOneComment($commentid);
 420                                         break;
 421                                 default:
 422                                         $error = _BATCH_UNKNOWN . $action;
 423                         }
 424
 425                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 426                         echo '</li>';
 427                 }
 428
 429                 echo '</ul>';
 430                 echo '<b>',_BATCH_DONE,'</b>';
 431
 432                 $this->pagefoot();
 433
 434
 435         }
 436
 437         /**
 438          * @todo document this
 439          */
 440         function action_batchmember() {
 441                 global $member;
 442
 443                 // check if logged in and admin
 444                 ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();
 445
 446                 // get array of itemids from request
 447                 $selected = requestIntArray('batch');
 448                 $action = requestVar('batchaction');
 449
 450                 // Show error when no members selected
 451                 if (!is_array($selected) || sizeof($selected) == 0)
 452                         $this->error(_BATCH_NOSELECTION);
 453
 454                 // On delete: check if confirmation has been given
 455                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 456                         $this->batchAskDeleteConfirmation('member',$selected);
 457
 458                 $this->pagehead();
 459
 460                 echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';
 461                 echo '<h2>',_BATCH_MEMBERS,'</h2>';
 462                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 463                 echo '<ul>';
 464
 465                 // walk over all itemids and perform action
 466                 foreach ($selected as $memberid) {
 467                         $memberid = intval($memberid);
 468                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';
 469
 470                         // perform action, display errors if needed
 471                         switch($action) {
 472                                 case 'delete':
 473                                         $error = $this->deleteOneMember($memberid);
 474                                         break;
 475                                 case 'setadmin':
 476                                         // always succeeds
 477                                         sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);
 478                                         $error = '';
 479                                         break;
 480                                 case 'unsetadmin':
 481                                         // there should always remain at least one super-admin
 482                                         $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');
 483                                         if (mysql_num_rows($r) < 2)
 484                                                 $error = _ERROR_ATLEASTONEADMIN;
 485                                         else
 486                                                 sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);
 487                                         break;
 488                                 default:
 489                                         $error = _BATCH_UNKNOWN . $action;
 490                         }
 491
 492                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 493                         echo '</li>';
 494                 }
 495
 496                 echo '</ul>';
 497                 echo '<b>',_BATCH_DONE,'</b>';
 498
 499                 $this->pagefoot();
 500
 501
 502         }
 503
 504         /**
 505          * @todo document this
 506          */
 507         function action_batchteam() {
 508                 global $member;
 509
 510                 $blogid = intRequestVar('blogid');
 511
 512                 // check if logged in and admin
 513                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();
 514
 515                 // get array of itemids from request
 516                 $selected = requestIntArray('batch');
 517                 $action = requestVar('batchaction');
 518
 519                 // Show error when no members selected
 520                 if (!is_array($selected) || sizeof($selected) == 0)
 521                         $this->error(_BATCH_NOSELECTION);
 522
 523                 // On delete: check if confirmation has been given
 524                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 525                         $this->batchAskDeleteConfirmation('team',$selected);
 526
 527                 $this->pagehead();
 528
 529                 echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';
 530
 531                 echo '<h2>',_BATCH_TEAM,'</h2>';
 532                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 533                 echo '<ul>';
 534
 535                 // walk over all itemids and perform action
 536                 foreach ($selected as $memberid) {
 537                         $memberid = intval($memberid);
 538                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';
 539
 540                         // perform action, display errors if needed
 541                         switch($action) {
 542                                 case 'delete':
 543                                         $error = $this->deleteOneTeamMember($blogid, $memberid);
 544                                         break;
 545                                 case 'setadmin':
 546                                         // always succeeds
 547                                         sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);
 548                                         $error = '';
 549                                         break;
 550                                 case 'unsetadmin':
 551                                         // there should always remain at least one admin
 552                                         $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);
 553                                         if (mysql_num_rows($r) < 2)
 554                                                 $error = _ERROR_ATLEASTONEBLOGADMIN;
 555                                         else
 556                                                 sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);
 557                                         break;
 558                                 default:
 559                                         $error = _BATCH_UNKNOWN . $action;
 560                         }
 561
 562                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 563                         echo '</li>';
 564                 }
 565
 566                 echo '</ul>';
 567                 echo '<b>',_BATCH_DONE,'</b>';
 568
 569                 $this->pagefoot();
 570
 571
 572         }
 573
 574         /**
 575          * @todo document this
 576          */
 577         function action_batchcategory() {
 578                 global $member, $manager;
 579
 580                 // check if logged in
 581                 $member->isLoggedIn() or $this->disallow();
 582
 583                 // more precise check will be done for each performed operation
 584
 585                 // get array of itemids from request
 586                 $selected = requestIntArray('batch');
 587                 $action = requestVar('batchaction');
 588
 589                 // Show error when no items were selected
 590                 if (!is_array($selected) || sizeof($selected) == 0)
 591                         $this->error(_BATCH_NOSELECTION);
 592
 593                 // On move: when no destination blog chosen, show choice now
 594                 $destBlogId = intRequestVar('destblogid');
 595                 if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))
 596                         $this->batchMoveCategorySelectDestination('category',$selected);
 597
 598                 // On delete: check if confirmation has been given
 599                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 600                         $this->batchAskDeleteConfirmation('category',$selected);
 601
 602                 $this->pagehead();
 603
 604                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 605                 echo '<h2>',BATCH_CATEGORIES,'</h2>';
 606                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 607                 echo '<ul>';
 608
 609                 // walk over all itemids and perform action
 610                 foreach ($selected as $catid) {
 611                         $catid = intval($catid);
 612                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';
 613
 614                         // perform action, display errors if needed
 615                         switch($action) {
 616                                 case 'delete':
 617                                         $error = $this->deleteOneCategory($catid);
 618                                         break;
 619                                 case 'move':
 620                                         $error = $this->moveOneCategory($catid, $destBlogId);
 621                                         break;
 622                                 default:
 623                                         $error = _BATCH_UNKNOWN . $action;
 624                         }
 625
 626                         echo '<b>',($error ? 'Error: '.$error : _BATCH_SUCCESS),'</b>';
 627                         echo '</li>';
 628                 }
 629
 630                 echo '</ul>';
 631                 echo '<b>',_BATCH_DONE,'</b>';
 632
 633                 $this->pagefoot();
 634
 635         }
 636
 637         /**
 638          * @todo document this
 639          */
 640         function batchMoveSelectDestination($type, $ids) {
 641                 global $manager;
 642                 $this->pagehead();
 643                 ?>
 644                 <h2><?php echo _MOVE_TITLE?></h2>
 645                 <form method="post" action="index.php"><div>
 646
 647                         <input type="hidden" name="action" value="batch<?php echo $type?>" />
 648                         <input type="hidden" name="batchaction" value="move" />
 649                         <?php
 650                                 $manager->addTicketHidden();
 651
 652                                 // insert selected item numbers
 653                                 $idx = 0;
 654                                 foreach ($ids as $id)
 655                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 656
 657                                 // show blog/category selection list
 658                                 $this->selectBlogCategory('destcatid');
 659
 660                         ?>
 661
 662
 663                         <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />
 664
 665                 </div></form>
 666                 <?php           $this->pagefoot();
 667                 exit;
 668         }
 669
 670         /**
 671          * @todo document this
 672          */
 673         function batchMoveCategorySelectDestination($type, $ids) {
 674                 global $manager;
 675                 $this->pagehead();
 676                 ?>
 677                 <h2><?php echo _MOVECAT_TITLE?></h2>
 678                 <form method="post" action="index.php"><div>
 679
 680                         <input type="hidden" name="action" value="batch<?php echo $type?>" />
 681                         <input type="hidden" name="batchaction" value="move" />
 682                         <?php
 683                                 $manager->addTicketHidden();
 684
 685                                 // insert selected item numbers
 686                                 $idx = 0;
 687                                 foreach ($ids as $id)
 688                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 689
 690                                 // show blog/category selection list
 691                                 $this->selectBlog('destblogid');
 692
 693                         ?>
 694
 695
 696                         <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />
 697
 698                 </div></form>
 699                 <?php           $this->pagefoot();
 700                 exit;
 701         }
 702
 703         /**
 704          * @todo document this
 705          */
 706         function batchAskDeleteConfirmation($type, $ids) {
 707                 global $manager;
 708
 709                 $this->pagehead();
 710                 ?>
 711                 <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>
 712                 <form method="post" action="index.php"><div>
 713
 714                         <input type="hidden" name="action" value="batch<?php echo $type?>" />
 715                         <?php $manager->addTicketHidden() ?>
 716                         <input type="hidden" name="batchaction" value="delete" />
 717                         <input type="hidden" name="confirmation" value="yes" />
 718                         <?php                           // insert selected item numbers
 719                                 $idx = 0;
 720                                 foreach ($ids as $id)
 721                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 722
 723                                 // add hidden vars for team & comment
 724                                 if ($type == 'team')
 725                                 {
 726                                         echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';
 727                                 }
 728                                 if ($type == 'comment')
 729                                 {
 730                                         echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';
 731                                 }
 732
 733                         ?>
 734
 735                         <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />
 736
 737                 </div></form>
 738                 <?php           $this->pagefoot();
 739                 exit;
 740         }
 741
 742
 743         /**
 744          * Inserts a HTML select element with choices for all categories to which the current
 745          * member has access
 746          * @see function selectBlog
 747          */
 748         function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 749                 ADMIN::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);
 750         }
 751
 752         /**
 753          * Inserts a HTML select element with choices for all blogs to which the user has access
 754          *              mode = 'blog' => shows blognames and values are blogids
 755          *              mode = 'category' => show category names and values are catids
 756          *
 757          * @param $iForcedBlogInclude
 758          *              ID of a blog that always needs to be included, without checking if the
 759          *              member is on the blog team (-1 = none)
 760          * @todo document parameters
 761          */
 762         function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 763                 global $member, $CONF;
 764
 765                 // 0. get IDs of blogs to which member can post items (+ forced blog)
 766                 $aBlogIds = array();
 767                 if ($iForcedBlogInclude != -1)
 768                         $aBlogIds[] = intval($iForcedBlogInclude);
 769
 770                 if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))
 771                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';
 772                 else
 773                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();
 774                 $rblogids = sql_query($queryBlogs);
 775                 while ($o = mysql_fetch_object($rblogids))
 776                         if ($o->bnumber != $iForcedBlogInclude)
 777                                 $aBlogIds[] = intval($o->bnumber);
 778
 779                 if (count($aBlogIds) == 0)
 780                         return;
 781
 782                 echo '<select name="',$name,'" tabindex="',$tabindex,'">';
 783
 784                 // 1. select blogs (we'll create optiongroups)
 785                 // (only select those blogs that have the user on the team)
 786                 $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';
 787                 $blogs = sql_query($queryBlogs);
 788                 if ($mode == 'category') {
 789                         if (mysql_num_rows($blogs) > 1)
 790                                 $multipleBlogs = 1;
 791
 792                         while ($oBlog = mysql_fetch_object($blogs)) {
 793                                 if ($multipleBlogs)
 794                                         echo '<optgroup label="',htmlspecialchars($oBlog->bname),'">';
 795
 796                                 // show selection to create new category when allowed/wanted
 797                                 if ($showNewCat) {
 798                                         // check if allowed to do so
 799                                         if ($member->blogAdminRights($oBlog->bnumber))
 800                                                 echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';
 801                                 }
 802
 803                                 // 2. for each category in that blog
 804                                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');
 805                                 while ($oCat = mysql_fetch_object($categories)) {
 806                                         if ($oCat->catid == $selected)
 807                                                 $selectText = ' selected="selected" ';
 808                                         else
 809                                                 $selectText = '';
 810                                         echo '<option value="',$oCat->catid,'" ', $selectText,'>',htmlspecialchars($oCat->cname),'</option>';
 811                                 }
 812
 813                                 if ($multipleBlogs)
 814                                         echo '</optgroup>';
 815                         }
 816                 } else {
 817                         // blog mode
 818                         while ($oBlog = mysql_fetch_object($blogs)) {
 819                                 echo '<option value="',$oBlog->bnumber,'"';
 820                                 if ($oBlog->bnumber == $selected)
 821                                         echo ' selected="selected"';
 822                                 echo'>',htmlspecialchars($oBlog->bname),'</option>';
 823                         }
 824                 }
 825                 echo '</select>';
 826
 827         }
 828
 829         /**
 830          * @todo document this
 831          */
 832         function action_browseownitems() {
 833                 global $member, $manager;
 834
 835                 $this->pagehead();
 836
 837                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 838                 echo '<h2>' . _ITEMLIST_YOUR. '</h2>';
 839
 840                 // start index
 841                 if (postVar('start'))
 842                         $start = postVar('start');
 843                 else
 844                         $start = 0;
 845
 846                 // amount of items to show
 847                 if (postVar('amount'))
 848                         $amount = postVar('amount');
 849                 else
 850                         $amount = 10;
 851
 852                 $search = postVar('search');    // search through items
 853
 854                 $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'
 855                            . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')
 856                            . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';
 857
 858                 if ($search)
 859                         $query .= ' and ((ititle LIKE "%' . addslashes($search) . '%") or (ibody LIKE "%' . addslashes($search) . '%") or (imore LIKE "%' . addslashes($search) . '%"))';
 860
 861                 $query .= ' ORDER BY itime DESC'
 862                                 . " LIMIT $start,$amount";
 863
 864                 $template['content'] = 'itemlist';
 865                 $template['now'] = time();
 866
 867                 $manager->loadClass("ENCAPSULATE");
 868                 $navList =& new NAVLIST('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);
 869                 $navList->showBatchList('item',$query,'table',$template);
 870
 871                 $this->pagefoot();
 872
 873         }
 874
 875         /**
 876          * Show all the comments for a given item
 877          * @param int $itemid
 878          */
 879         function action_itemcommentlist($itemid = '') {
 880                 global $member, $manager;
 881
 882                 if ($itemid == '')
 883                         $itemid = intRequestVar('itemid');
 884
 885                 // only allow if user is allowed to alter item
 886                 $member->canAlterItem($itemid) or $this->disallow();
 887
 888                 $blogid = getBlogIdFromItemId($itemid);
 889
 890                 $this->pagehead();
 891
 892                 // start index
 893                 if (postVar('start'))
 894                         $start = postVar('start');
 895                 else
 896                         $start = 0;
 897
 898                 // amount of items to show
 899                 if (postVar('amount'))
 900                         $amount = postVar('amount');
 901                 else
 902                         $amount = 10;
 903
 904                 $search = postVar('search');
 905
 906                 echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';
 907                 echo '<h2>',_COMMENTS,'</h2>';
 908
 909                 $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE citem=' . $itemid;
 910
 911                 if ($search)
 912                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
 913
 914                 $query .= ' ORDER BY ctime ASC'
 915                                 . " LIMIT $start,$amount";
 916
 917                 $template['content'] = 'commentlist';
 918                 $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));
 919
 920                 $manager->loadClass("ENCAPSULATE");
 921                 $navList =& new NAVLIST('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);
 922                 $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);
 923
 924                 $this->pagefoot();
 925         }
 926
 927         /**
 928          * Browse own comments
 929          */
 930         function action_browseowncomments() {
 931                 global $member, $manager;
 932
 933                 // start index
 934                 if (postVar('start'))
 935                         $start = postVar('start');
 936                 else
 937                         $start = 0;
 938
 939                 // amount of items to show
 940                 if (postVar('amount'))
 941                         $amount = postVar('amount');
 942                 else
 943                         $amount = 10;
 944
 945                 $search = postVar('search');
 946
 947
 948                 $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();
 949
 950                 if ($search)
 951                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
 952
 953                 $query .= ' ORDER BY ctime DESC'
 954                                 . " LIMIT $start,$amount";
 955
 956                 $this->pagehead();
 957
 958                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 959                 echo '<h2>', _COMMENTS_YOUR ,'</h2>';
 960
 961                 $template['content'] = 'commentlist';
 962                 $template['canAddBan'] = 0;     // doesn't make sense to allow banning yourself
 963
 964                 $manager->loadClass("ENCAPSULATE");
 965                 $navList =& new NAVLIST('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);
 966                 $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);
 967
 968                 $this->pagefoot();
 969         }
 970
 971         /**
 972          * Browse all comments for a weblog
 973          * @param int $blogid
 974          */
 975         function action_blogcommentlist($blogid = '')
 976         {
 977                 global $member, $manager;
 978
 979                 if ($blogid == '')
 980                         $blogid = intRequestVar('blogid');
 981                 else
 982                         $blogid = intval($blogid);
 983
 984                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 985
 986                 // start index
 987                 if (postVar('start'))
 988                         $start = postVar('start');
 989                 else
 990                         $start = 0;
 991
 992                 // amount of items to show
 993                 if (postVar('amount'))
 994                         $amount = postVar('amount');
 995                 else
 996                         $amount = 10;
 997
 998                 $search = postVar('search');            // search through comments
 999
1000
1001                 $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);
1002
1003                 if ($search != '')
1004                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
1005
1006
1007                 $query .= ' ORDER BY ctime DESC'
1008                                 . " LIMIT $start,$amount";
1009
1010
1011                 $blog =& $manager->getBlog($blogid);
1012
1013                 $this->pagehead();
1014
1015                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1016                 echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';
1017
1018                 $template['content'] = 'commentlist';
1019                 $template['canAddBan'] = $member->blogAdminRights($blogid);
1020
1021                 $manager->loadClass("ENCAPSULATE");
1022                 $navList =& new NAVLIST('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);
1023                 $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);
1024
1025                 $this->pagefoot();
1026         }
1027
1028         /**
1029          * Provide a page to item a new item to the given blog
1030          */
1031         function action_createitem() {
1032                 global $member, $manager;
1033
1034                 $blogid = intRequestVar('blogid');
1035
1036                 // check if allowed
1037                 $member->teamRights($blogid) or $this->disallow();
1038
1039                 $memberid = $member->getID();
1040
1041                 $blog =& $manager->getBlog($blogid);
1042
1043                 $this->pagehead();
1044
1045                 // generate the add-item form
1046                 $formfactory =& new PAGEFACTORY($blogid);
1047                 $formfactory->createAddForm('admin');
1048
1049                 $this->pagefoot();
1050         }
1051
1052         /**
1053          * @todo document this
1054          */
1055         function action_itemedit() {
1056                 global $member, $manager;
1057
1058                 $itemid = intRequestVar('itemid');
1059
1060                 // only allow if user is allowed to alter item
1061                 $member->canAlterItem($itemid) or $this->disallow();
1062
1063                 $item =& $manager->getItem($itemid,1,1);
1064                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));
1065
1066                 $manager->notify('PrepareItemForEdit', array('item' => &$item));
1067
1068                 if ($blog->convertBreaks()) {
1069                         $item['body'] = removeBreaks($item['body']);
1070                         $item['more'] = removeBreaks($item['more']);
1071                 }
1072
1073                 // form to edit blog items
1074                 $this->pagehead();
1075                 $formfactory =& new PAGEFACTORY($blog->getID());
1076                 $formfactory->createEditForm('admin',$item);
1077                 $this->pagefoot();
1078         }
1079
1080         /**
1081          * @todo document this
1082          */
1083         function action_itemupdate() {
1084                 global $member, $manager, $CONF;
1085
1086                 $itemid = intRequestVar('itemid');
1087                 $catid = postVar('catid');
1088
1089                 // only allow if user is allowed to alter item
1090                 $member->canUpdateItem($itemid, $catid) or $this->disallow();
1091
1092                 $actiontype = postVar('actiontype');
1093
1094                 // delete actions are handled by itemdelete (which has confirmation)
1095                 if ($actiontype == 'delete') {
1096                         $this->action_itemdelete();
1097                         return;
1098                 }
1099
1100                 $body   = postVar('body');
1101                 $title  = postVar('title');
1102                 $more   = postVar('more');
1103                 $closed = intPostVar('closed');
1104                 $draftid = intPostVar('draftid');
1105
1106                 // default action = add now
1107                 if (!$actiontype)
1108                         $actiontype='addnow';
1109
1110                 // create new category if needed
1111                 if (strstr($catid,'newcat')) {
1112                         // get blogid
1113                         list($blogid) = sscanf($catid,"newcat-%d");
1114
1115                         // create
1116                         $blog =& $manager->getBlog($blogid);
1117                         $catid = $blog->createNewCategory();
1118
1119                         // show error when sth goes wrong
1120                         if (!$catid)
1121                                 $this->doError(_ERROR_CATCREATEFAIL);
1122                 }
1123
1124                 /*
1125                         set some variables based on actiontype
1126
1127                         actiontypes:
1128                                 draft items -> addnow, addfuture, adddraft, delete
1129                                 non-draft items -> edit, changedate, delete
1130
1131                         variables set:
1132                                 $timestamp: set to a nonzero value for future dates or date changes
1133                                 $wasdraft: set to 1 when the item used to be a draft item
1134                                 $publish: set to 1 when the edited item is not a draft
1135                 */
1136                 switch ($actiontype) {
1137                         case 'adddraft':
1138                                 $publish = 0;
1139                                 $wasdraft = 1;
1140                                 $timestamp = 0;
1141                                 break;
1142                         case 'addfuture':
1143                                 $wasdraft = 1;
1144                                 $publish = 1;
1145                                 $timestamp = mktime(postVar('hour'), postVar('minutes'), 0, postVar('month'), postVar('day'), postVar('year'));
1146                                 break;
1147                         case 'addnow':
1148                                 $wasdraft = 1;
1149                                 $publish = 1;
1150                                 $timestamp = 0;
1151                                 break;
1152                         case 'changedate':
1153                                 $timestamp = mktime(postVar('hour'), postVar('minutes'), 0, postVar('month'), postVar('day'), postVar('year'));
1154                                 $publish = 1;
1155                                 $wasdraft = 0;
1156                                 break;
1157                         case 'edit':
1158                         default:
1159                                 $publish = 1;
1160                                 $wasdraft = 0;
1161                                 $timestamp = 0;
1162                 }
1163
1164                 // edit the item for real
1165                 ITEM::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
1166
1167                 if ($draftid > 0) {
1168                         ITEM::delete($draftid);
1169                 }
1170
1171                 $blogid = getBlogIDFromItemID($itemid);
1172                 $blog =& $manager->getBlog($blogid);
1173                 if (!$closed && $publish && $wasdraft && $blog->pingUserland()) {
1174                         $this->action_sendping($blogid);
1175                         return;
1176                 }
1177
1178                 // show category edit window when we created a new category
1179                 // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')
1180                 if ($catid != intPostVar('catid')) {
1181                         $this->action_categoryedit(
1182                                 $catid,
1183                                 $blog->getID(),
1184                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
1185                         );
1186                 } else {
1187                         // TODO: set start item correctly for itemlist
1188                         $this->action_itemlist(getBlogIDFromItemID($itemid));
1189                 }
1190         }
1191
1192         /**
1193          * @todo document this
1194          */
1195         function action_itemdelete() {
1196                 global $member, $manager;
1197
1198                 $itemid = intRequestVar('itemid');
1199
1200                 // only allow if user is allowed to alter item
1201                 $member->canAlterItem($itemid) or $this->disallow();
1202
1203                 if (!$manager->existsItem($itemid,1,1))
1204                         $this->error(_ERROR_NOSUCHITEM);
1205
1206                 $item =& $manager->getItem($itemid,1,1);
1207                 $title = htmlspecialchars(strip_tags($item['title']));
1208                 $body = strip_tags($item['body']);
1209                 $body = htmlspecialchars(shorten($body,300,'...'));
1210
1211                 $this->pagehead();
1212                 ?>
1213                         <h2><?php echo _DELETE_CONFIRM?></h2>
1214
1215                         <p><?php echo _CONFIRMTXT_ITEM?></p>
1216
1217                         <div class="note">
1218                                 <b>"<?php echo  $title ?>"</b>
1219                                 <br />
1220                                 <?php echo $body?>
1221                         </div>
1222
1223                         <form method="post" action="index.php"><div>
1224                                 <input type="hidden" name="action" value="itemdeleteconfirm" />
1225                                 <?php $manager->addTicketHidden() ?>
1226                                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1227                                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>"  tabindex="10" />
1228                         </div></form>
1229                 <?php
1230                 $this->pagefoot();
1231         }
1232
1233         /**
1234          * @todo document this
1235          */
1236         function action_itemdeleteconfirm() {
1237                 global $member;
1238
1239                 $itemid = intRequestVar('itemid');
1240
1241                 // only allow if user is allowed to alter item
1242                 $member->canAlterItem($itemid) or $this->disallow();
1243
1244                 // get blogid first
1245                 $blogid = getBlogIdFromItemId($itemid);
1246
1247                 // delete item (note: some checks will be performed twice)
1248                 $this->deleteOneItem($itemid);
1249
1250                 $this->action_itemlist($blogid);
1251         }
1252
1253         /**
1254          * Deletes one item and returns error if something goes wrong
1255          * @param int $itemid
1256          */
1257         function deleteOneItem($itemid) {
1258                 global $member, $manager;
1259
1260                 // only allow if user is allowed to alter item (also checks if itemid exists)
1261                 if (!$member->canAlterItem($itemid))
1262                         return _ERROR_DISALLOWED;
1263
1264                 $manager->loadClass('ITEM');
1265                 ITEM::delete($itemid);
1266         }
1267
1268         /**
1269          * @todo document this
1270          */
1271         function action_itemmove() {
1272                 global $member, $manager;
1273
1274                 $itemid = intRequestVar('itemid');
1275
1276                 // only allow if user is allowed to alter item
1277                 $member->canAlterItem($itemid) or $this->disallow();
1278
1279                 $item =& $manager->getItem($itemid,1,1);
1280
1281                 $this->pagehead();
1282                 ?>
1283                         <h2><?php echo _MOVE_TITLE?></h2>
1284                         <form method="post" action="index.php"><div>
1285                                 <input type="hidden" name="action" value="itemmoveto" />
1286                                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1287
1288                                 <?php
1289
1290                                         $manager->addTicketHidden();
1291                                         $this->selectBlogCategory('catid',$item['catid'],10,1);
1292                                 ?>
1293
1294                                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />
1295                         </div></form>
1296                 <?php
1297                 $this->pagefoot();
1298         }
1299
1300         /**
1301          * @todo document this
1302          */
1303         function action_itemmoveto() {
1304                 global $member, $manager;
1305
1306                 $itemid = intRequestVar('itemid');
1307                 $catid = requestVar('catid');
1308
1309                 // create new category if needed
1310                 if (strstr($catid,'newcat')) {
1311                         // get blogid
1312                         list($blogid) = sscanf($catid,'newcat-%d');
1313
1314                         // create
1315                         $blog =& $manager->getBlog($blogid);
1316                         $catid = $blog->createNewCategory();
1317
1318                         // show error when sth goes wrong
1319                         if (!$catid)
1320                                 $this->doError(_ERROR_CATCREATEFAIL);
1321                 }
1322
1323                 // only allow if user is allowed to alter item
1324                 $member->canUpdateItem($itemid, $catid) or $this->disallow();
1325
1326                 ITEM::move($itemid, $catid);
1327
1328                 if ($catid != intRequestVar('catid'))
1329                         $this->action_categoryedit($catid, $blog->getID());
1330                 else
1331                         $this->action_itemlist(getBlogIDFromCatID($catid));
1332         }
1333
1334         /**
1335          * Moves one item to a given category (category existance should be checked by caller)
1336          * errors are returned
1337          * @param int $itemid
1338          * @param int $destCatid category ID to which the item will be moved
1339          */
1340         function moveOneItem($itemid, $destCatid) {
1341                 global $member;
1342
1343                 // only allow if user is allowed to move item
1344                 if (!$member->canUpdateItem($itemid, $destCatid))
1345                         return _ERROR_DISALLOWED;
1346
1347                 ITEM::move($itemid, $destCatid);
1348         }
1349
1350         /**
1351          * Adds a item to the chosen blog
1352          */
1353         function action_additem() {
1354                 global $member, $manager, $CONF;
1355
1356                 $manager->loadClass('ITEM');
1357
1358                 $result = ITEM::createFromRequest();
1359
1360                 if ($result['status'] == 'error')
1361                         $this->error($result['message']);
1362
1363                 $blogid = getBlogIDFromItemID($result['itemid']);
1364                 $blog =& $manager->getBlog($blogid);
1365
1366                 $pingUrl = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=sendping&blogid=' . intval($blogid));
1367
1368                 if ($result['status'] == 'newcategory')
1369                         $this->action_categoryedit(
1370                                 $result['catid'],
1371                                 $blogid,
1372                                 $blog->pingUserland() ? $pingUrl : ''
1373                         );
1374                 elseif ((postVar('actiontype') == 'addnow') && $blog->pingUserland())
1375                         $this->action_sendping($blogid);
1376                 else
1377                         $this->action_itemlist($blogid);
1378         }
1379
1380         /**
1381          * Shows a window that says we're about to ping weblogs.com.
1382          * immediately refresh to the real pinging page, which will
1383          * show an error, or redirect to the blog.
1384          *
1385          * @param int $blogid ID of blog for which ping needs to be sent out
1386          */
1387         function action_sendping($blogid = -1) {
1388                 global $member, $manager;
1389
1390                 if ($blogid == -1)
1391                         $blogid = intRequestVar('blogid');
1392
1393                 $member->isLoggedIn() or $this->disallow();
1394
1395                 $rawPingUrl = $manager->addTicketToUrl('index.php?action=rawping&blogid=' . intval($blogid));
1396
1397                 $this->pagehead('<meta http-equiv="refresh" content="1; url='.htmlspecialchars($rawPingUrl).'" />');
1398                 ?>
1399                 <h2>Site Updated, Now pinging weblogs.com</h2>
1400
1401                 <p>
1402                         Pinging weblogs.com! This can a while...
1403                         <br />
1404                         When the ping is complete (and successfull), your weblog will show up in the weblogs.com updates list.
1405                 </p>
1406
1407                 <p>
1408                         If you aren't automatically passed through, <a href="index.php?action=rawping&amp;blogid=<?php echo $blogid?>">try again</a>
1409                 </p>
1410                 <?php           $this->pagefoot();
1411         }
1412
1413         /**
1414          * Ping to Weblogs.com
1415          * Sends the real ping (can take up to 10 seconds!)
1416          */
1417         function action_rawping() {
1418                 global $manager;
1419                 // TODO: checks?
1420
1421                 $blogid = intRequestVar('blogid');
1422                 $blog =& $manager->getBlog($blogid);
1423
1424                 $result = $blog->sendUserlandPing();
1425
1426                 $this->pagehead();
1427
1428                 ?>
1429
1430                 <h2>Ping Results</h2>
1431
1432                 <p>The following message was returned by weblogs.com:</p>
1433
1434                 <div class='note'><?php echo  $result ?></div>
1435
1436                 <ul>
1437                         <li><a href="index.php?action=itemlist&amp;blogid=<?php echo $blog->getID()?>">View list of recent items for <?php echo htmlspecialchars($blog->getName())?></a></li>
1438                         <li><a href="<?php echo $blog->getURL()?>">Visit your own site</a></li>
1439                 </ul>
1440
1441                 <?php           $this->pagefoot();
1442         }
1443
1444         /**
1445          * Allows to edit previously made comments
1446          */
1447         function action_commentedit() {
1448                 global $member, $manager;
1449
1450                 $commentid = intRequestVar('commentid');
1451
1452                 $member->canAlterComment($commentid) or $this->disallow();
1453
1454                 $comment = COMMENT::getComment($commentid);
1455
1456                 $manager->notify('PrepareCommentForEdit',array('comment' => &$comment));
1457
1458                 // change <br /> to \n
1459                 $comment['body'] = str_replace('<br />','',$comment['body']);
1460
1461                 $comment['body'] = eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>","\\1",$comment['body']);
1462
1463                 $this->pagehead();
1464
1465                 ?>
1466                 <h2><?php echo _EDITC_TITLE?></h2>
1467
1468                 <form action="index.php" method="post"><div>
1469
1470                 <input type="hidden" name="action" value="commentupdate" />
1471                 <?php $manager->addTicketHidden(); ?>
1472                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1473                 <table><tr>
1474                         <th colspan="2"><?php echo _EDITC_TITLE?></th>
1475                 </tr><tr>
1476                         <td><?php echo _EDITC_WHO?></td>
1477                         <td>
1478                         <?php                           if ($comment['member'])
1479                                         echo $comment['member'] . " (" . _EDITC_MEMBER . ")";
1480                                 else
1481                                         echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";
1482                         ?>
1483                         </td>
1484                 </tr><tr>
1485                         <td><?php echo _EDITC_WHEN?></td>
1486                         <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>
1487                 </tr><tr>
1488                         <td><?php echo _EDITC_HOST?></td>
1489                         <td><?php echo  $comment['host']; ?></td>
1490                 </tr><tr>
1491                         <td><?php echo _EDITC_TEXT?></td>
1492                         <td>
1493                                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                                   // htmlspecialchars not needed (things should be escaped already)
1494                                         echo $comment['body'];
1495                                 ?></textarea>
1496                         </td>
1497                 </tr><tr>
1498                         <td><?php echo _EDITC_EDIT?></td>
1499                         <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>
1500                 </tr></table>
1501
1502                 </div></form>
1503                 <?php
1504                 $this->pagefoot();
1505         }
1506
1507         /**
1508          * @todo document this
1509          */
1510         function action_commentupdate() {
1511                 global $member, $manager;
1512
1513                 $commentid = intRequestVar('commentid');
1514
1515                 $member->canAlterComment($commentid) or $this->disallow();
1516
1517                 $body = postVar('body');
1518
1519                 // intercept words that are too long
1520                 if (eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}",$body) != false)
1521                         $this->error(_ERROR_COMMENT_LONGWORD);
1522
1523                 // check length
1524                 if (strlen($body)<3)
1525                         $this->error(_ERROR_COMMENT_NOCOMMENT);
1526                 if (strlen($body)>5000)
1527                         $this->error(_ERROR_COMMENT_TOOLONG);
1528
1529
1530                 // prepare body
1531                 $body = COMMENT::prepareBody($body);
1532
1533                 // call plugins
1534                 $manager->notify('PreUpdateComment',array('body' => &$body));
1535
1536                 $query =  'UPDATE '.sql_table('comment')
1537                            . " SET cbody='" .addslashes($body). "'"
1538                            . " WHERE cnumber=" . $commentid;
1539                 sql_query($query);
1540
1541                 // get itemid
1542                 $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);
1543                 $o = mysql_fetch_object($res);
1544                 $itemid = $o->citem;
1545
1546                 if ($member->canAlterItem($itemid))
1547                         $this->action_itemcommentlist($itemid);
1548                 else
1549                         $this->action_browseowncomments();
1550
1551         }
1552
1553         /**
1554          * @todo document this
1555          */
1556         function action_commentdelete() {
1557                 global $member, $manager;
1558
1559                 $commentid = intRequestVar('commentid');
1560
1561                 $member->canAlterComment($commentid) or $this->disallow();
1562
1563                 $comment = COMMENT::getComment($commentid);
1564
1565                 $body = strip_tags($comment['body']);
1566                 $body = htmlspecialchars(shorten($body, 300, '...'));
1567
1568                 if ($comment['member'])
1569                         $author = $comment['member'];
1570                 else
1571                         $author = $comment['user'];
1572
1573                 $this->pagehead();
1574                 ?>
1575
1576                         <h2><?php echo _DELETE_CONFIRM?></h2>
1577
1578                         <p><?php echo _CONFIRMTXT_COMMENT?></p>
1579
1580                         <div class="note">
1581                         <b><?php echo _EDITC_WHO?>:</b> <?php echo  $author ?>
1582                         <br />
1583                         <b><?php echo _EDITC_TEXT?>:</b> <?php echo  $body ?>
1584                         </div>
1585
1586                         <form method="post" action="index.php"><div>
1587                                 <input type="hidden" name="action" value="commentdeleteconfirm" />
1588                                 <?php $manager->addTicketHidden() ?>
1589                                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1590                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
1591                         </div></form>
1592                 <?php
1593                 $this->pagefoot();
1594         }
1595
1596         /**
1597          * @todo document this
1598          */
1599         function action_commentdeleteconfirm() {
1600                 global $member;
1601
1602                 $commentid = intRequestVar('commentid');
1603
1604                 // get item id first
1605                 $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);
1606                 $o = mysql_fetch_object($res);
1607                 $itemid = $o->citem;
1608
1609                 $error = $this->deleteOneComment($commentid);
1610                 if ($error)
1611                         $this->doError($error);
1612
1613                 if ($member->canAlterItem($itemid))
1614                         $this->action_itemcommentlist($itemid);
1615                 else
1616                         $this->action_browseowncomments();
1617         }
1618
1619         /**
1620          * @todo document this
1621          */
1622         function deleteOneComment($commentid) {
1623                 global $member, $manager;
1624
1625                 $commentid = intval($commentid);
1626
1627                 if (!$member->canAlterComment($commentid))
1628                         return _ERROR_DISALLOWED;
1629
1630                 $manager->notify('PreDeleteComment', array('commentid' => $commentid));
1631
1632                 // delete the comments associated with the item
1633                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;
1634                 sql_query($query);
1635
1636                 $manager->notify('PostDeleteComment', array('commentid' => $commentid));
1637
1638                 return '';
1639         }
1640
1641         /**
1642          * Usermanagement main
1643          */
1644         function action_usermanagement() {
1645                 global $member, $manager;
1646
1647                 // check if allowed
1648                 $member->isAdmin() or $this->disallow();
1649
1650                 $this->pagehead();
1651
1652                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
1653
1654                 echo '<h2>' . _MEMBERS_TITLE .'</h2>';
1655
1656                 echo '<h3>' . _MEMBERS_CURRENT .'</h3>';
1657
1658                 // show list of members with actions
1659                 $query =  'SELECT *'
1660                            . ' FROM '.sql_table('member');
1661                 $template['content'] = 'memberlist';
1662                 $template['tabindex'] = 10;
1663
1664                 $manager->loadClass("ENCAPSULATE");
1665                 $batch =& new BATCH('member');
1666                 $batch->showlist($query,'table',$template);
1667
1668                 echo '<h3>' . _MEMBERS_NEW .'</h3>';
1669                 ?>
1670                         <form method="post" action="index.php"><div>
1671
1672                         <input type="hidden" name="action" value="memberadd" />
1673                         <?php $manager->addTicketHidden() ?>
1674
1675                         <table>
1676                         <tr>
1677                                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>
1678                         </tr><tr>
1679                                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1680                                         <br /><small>(This is the name used to logon)</small>
1681                                 </td>
1682                                 <td><input tabindex="10010" name="name" size="16" maxlength="16" /></td>
1683                         </tr><tr>
1684                                 <td><?php echo _MEMBERS_REALNAME?></td>
1685                                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>
1686                         </tr><tr>
1687                                 <td><?php echo _MEMBERS_PWD?></td>
1688                                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>
1689                         </tr><tr>
1690                                 <td><?php echo _MEMBERS_REPPWD?></td>
1691                                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>
1692                         </tr><tr>
1693                                 <td><?php echo _MEMBERS_EMAIL?></td>
1694                                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>
1695                         </tr><tr>
1696                                 <td><?php echo _MEMBERS_URL?></td>
1697                                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>
1698                         </tr><tr>
1699                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1700                                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>
1701                         </tr><tr>
1702                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1703                                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>
1704                         </tr><tr>
1705                                 <td><?php echo _MEMBERS_NOTES?></td>
1706                                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>
1707                         </tr><tr>
1708                                 <td><?php echo _MEMBERS_NEW?></td>
1709                                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>
1710                         </tr></table>
1711
1712                         </div></form>
1713                 <?php
1714                 $this->pagefoot();
1715         }
1716
1717         /**
1718          * Edit member settings
1719          */
1720         function action_memberedit() {
1721                 $this->action_editmembersettings(intRequestVar('memberid'));
1722         }
1723
1724         /**
1725          * @todo document this
1726          */
1727         function action_editmembersettings($memberid = '') {
1728                 global $member, $manager, $CONF;
1729
1730                 if ($memberid == '')
1731                         $memberid = $member->getID();
1732
1733                 // check if allowed
1734                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1735
1736                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
1737                 $this->pagehead($extrahead);
1738
1739                 // show message to go back to member overview (only for admins)
1740                 if ($member->isAdmin())
1741                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';
1742                 else
1743                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';
1744
1745                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';
1746
1747                 $mem = MEMBER::createFromID($memberid);
1748
1749                 ?>
1750                 <form method="post" action="index.php"><div>
1751
1752                 <input type="hidden" name="action" value="changemembersettings" />
1753                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
1754                 <?php $manager->addTicketHidden() ?>
1755
1756                 <table><tr>
1757                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>
1758                 </tr><tr>
1759                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1760                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1761                         </td>
1762                         <td>
1763                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1764                                 <input name="name" tabindex="10" maxlength="16" size="16" value="<?php echo  htmlspecialchars($mem->getDisplayName()); ?>" />
1765                         <?php } else {
1766                                 echo htmlspecialchars($member->getDisplayName());
1767                            }
1768                         ?>
1769                         </td>
1770                 </tr><tr>
1771                         <td><?php echo _MEMBERS_REALNAME?></td>
1772                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  htmlspecialchars($mem->getRealName()); ?>" /></td>
1773                 </tr><tr>
1774                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1775                         <td><?php echo _MEMBERS_PWD?></td>
1776                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>
1777                 </tr><tr>
1778                         <td><?php echo _MEMBERS_REPPWD?></td>
1779                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>
1780                 <?php } ?>
1781                 </tr><tr>
1782                         <td><?php echo _MEMBERS_EMAIL?>
1783                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>
1784                         </td>
1785                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  htmlspecialchars($mem->getEmail()); ?>" /></td>
1786                 </tr><tr>
1787                         <td><?php echo _MEMBERS_URL?></td>
1788                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  htmlspecialchars($mem->getURL()); ?>" /></td>
1789                 <?php // only allow to change this by super-admins
1790                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)
1791                    if ($member->isAdmin()) {
1792                 ?>
1793                         </tr><tr>
1794                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1795                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>
1796                         </tr><tr>
1797                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1798                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70); ?></td>
1799                 <?php } ?>
1800                 </tr><tr>
1801                         <td><?php echo _MEMBERS_NOTES?></td>
1802                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  htmlspecialchars($mem->getNotes()); ?>" /></td>
1803                 </tr><tr>
1804                         <td><?php echo _MEMBERS_DEFLANG?> <?php help('language'); ?>
1805                         </td>
1806                         <td>
1807
1808                                 <select name="deflang" tabindex="85">
1809                                         <option value=""><?php echo _MEMBERS_USESITELANG?></option>
1810                                 <?php                           // show a dropdown list of all available languages
1811                                 global $DIR_LANG;
1812                                 $dirhandle = opendir($DIR_LANG);
1813                                 while ($filename = readdir($dirhandle)) {
1814                                         if (ereg("^(.*)\.php$",$filename,$matches)) {
1815                                                 $name = $matches[1];
1816                                                 echo "<option value='$name'";
1817                                                 if ($name == $mem->getLanguage())
1818                                                         echo " selected='selected'";
1819                                                 echo ">$name</option>";
1820                                         }
1821                                 }
1822                                 closedir($dirhandle);
1823
1824                                 ?>
1825                                 </select>
1826
1827                         </td>
1828                 </tr>
1829                 <?php
1830                         // plugin options
1831                         $this->_insertPluginOptions('member',$memberid);
1832                 ?>
1833                 <tr>
1834                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>
1835                 </tr><tr>
1836                         <td><?php echo _MEMBERS_EDIT?></td>
1837                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>
1838                 </tr></table>
1839
1840                 </div></form>
1841
1842                 <?php
1843                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
1844
1845                         $manager->notify(
1846                                 'MemberSettingsFormExtras',
1847                                 array(
1848                                         'member' => &$mem
1849                                 )
1850                         );
1851
1852                 $this->pagefoot();
1853         }
1854
1855         /**
1856          * @todo document this
1857          */
1858         function action_changemembersettings() {
1859                 global $member, $CONF, $manager;
1860
1861                 $memberid = intRequestVar('memberid');
1862
1863                 // check if allowed
1864                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1865
1866                 $name                   = trim(strip_tags(postVar('name')));
1867                 $realname               = trim(strip_tags(postVar('realname')));
1868                 $password               = postVar('password');
1869                 $repeatpassword = postVar('repeatpassword');
1870                 $email                  = strip_tags(postVar('email'));
1871                 $url                    = strip_tags(postVar('url'));
1872
1873                 // Sometimes user didn't prefix the URL with http://, this cause a malformed URL. Let's fix it.
1874                 if (!eregi("^https?://", $url))
1875                         $url = "http://".$url;
1876
1877                 $admin                  = postVar('admin');
1878                 $canlogin               = postVar('canlogin');
1879                 $notes                  = strip_tags(postVar('notes'));
1880                 $deflang                = postVar('deflang');
1881
1882                 $mem = MEMBER::createFromID($memberid);
1883
1884                 if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1885
1886                         if (!isValidDisplayName($name))
1887                                 $this->error(_ERROR_BADNAME);
1888
1889                         if (($name != $mem->getDisplayName()) && MEMBER::exists($name))
1890                                 $this->error(_ERROR_NICKNAMEINUSE);
1891
1892                         if ($password != $repeatpassword)
1893                                 $this->error(_ERROR_PASSWORDMISMATCH);
1894
1895                         if ($password && (strlen($password) < 6))
1896                                 $this->error(_ERROR_PASSWORDTOOSHORT);
1897                 }
1898
1899                 if (!isValidMailAddress($email))
1900                         $this->error(_ERROR_BADMAILADDRESS);
1901
1902
1903                 if (!$realname)
1904                         $this->error(_ERROR_REALNAMEMISSING);
1905
1906                 if (($deflang != '') && (!checkLanguage($deflang)))
1907                         $this->error(_ERROR_NOSUCHLANGUAGE);
1908
1909                 // check if there will remain at least one site member with both the logon and admin rights
1910                 // (check occurs when taking away one of these rights from such a member)
1911                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
1912                          || (!$canlogin && $mem->isAdmin() && $mem->canLogin())
1913                    )
1914                 {
1915                         $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
1916                         if (mysql_num_rows($r) < 2)
1917                                 $this->error(_ERROR_ATLEASTONEADMIN);
1918                 }
1919
1920                 if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1921                         $mem->setDisplayName($name);
1922                         if ($password)
1923                                 $mem->setPassword($password);
1924                 }
1925
1926                 $oldEmail = $mem->getEmail();
1927
1928                 $mem->setRealName($realname);
1929                 $mem->setEmail($email);
1930                 $mem->setURL($url);
1931                 $mem->setNotes($notes);
1932                 $mem->setLanguage($deflang);
1933
1934
1935                 // only allow super-admins to make changes to the admin status
1936                 if ($member->isAdmin()) {
1937                         $mem->setAdmin($admin);
1938                         $mem->setCanLogin($canlogin);
1939                 }
1940
1941
1942                 $mem->write();
1943
1944                 // store plugin options
1945                 $aOptions = requestArray('plugoption');
1946                 NucleusPlugin::_applyPluginOptions($aOptions);
1947                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));
1948
1949                 // if email changed, generate new password
1950                 if ($oldEmail != $mem->getEmail())
1951                 {
1952                         $mem->sendActivationLink('addresschange', $oldEmail);
1953                         // logout member
1954                         $mem->newCookieKey();
1955
1956                         // only log out if the member being edited is the current member.
1957                         if ($member->getID() == $memberid)
1958                                 $member->logout();
1959                         $this->action_login(_MSG_ACTIVATION_SENT, 0);
1960                         return;
1961                 }
1962
1963
1964                 if (  ( $mem->getID() == $member->getID() )
1965                    && ( $mem->getDisplayName() != $member->getDisplayName() )
1966                    ) {
1967                         $mem->newCookieKey();
1968                         $member->logout();
1969                         $this->action_login(_MSG_LOGINAGAIN, 0);
1970                 } else {
1971                         $this->action_overview(_MSG_SETTINGSCHANGED);
1972                 }
1973         }
1974
1975         /**
1976          * @todo document this
1977          */
1978         function action_memberadd() {
1979                 global $member, $manager;
1980
1981                 // check if allowed
1982                 $member->isAdmin() or $this->disallow();
1983
1984                 if (postVar('password') != postVar('repeatpassword'))
1985                         $this->error(_ERROR_PASSWORDMISMATCH);
1986                 if (strlen(postVar('password')) < 6)
1987                         $this->error(_ERROR_PASSWORDTOOSHORT);
1988
1989                 $res = MEMBER::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));
1990                 if ($res != 1)
1991                         $this->error($res);
1992
1993                 // fire PostRegister event
1994                 $newmem = new MEMBER();
1995                 $newmem->readFromName(postVar('name'));
1996                 $manager->notify('PostRegister',array('member' => &$newmem));
1997
1998                 $this->action_usermanagement();
1999         }
2000
2001         /**
2002          * Account activation
2003          *
2004          * @author dekarma
2005          */
2006         function action_activate() {
2007
2008                 $key = getVar('key');
2009                 $this->_showActivationPage($key);
2010         }
2011
2012         /**
2013          * @todo document this
2014          */
2015         function _showActivationPage($key, $message = '')
2016         {
2017                 global $manager;
2018
2019                 // clean up old activation keys
2020                 MEMBER::cleanupActivationTable();
2021
2022                 // get activation info
2023                 $info = MEMBER::getActivationInfo($key);
2024
2025                 if (!$info)
2026                         $this->error(_ERROR_ACTIVATE);
2027
2028                 $mem = MEMBER::createFromId($info->vmember);
2029
2030                 if (!$mem)
2031                         $this->error(_ERROR_ACTIVATE);
2032
2033                 $text = '';
2034                 $title = '';
2035                 $bNeedsPasswordChange = true;
2036
2037                 switch ($info->vtype)
2038                 {
2039                         case 'forgot':
2040                                 $title = _ACTIVATE_FORGOT_TITLE;
2041                                 $text = _ACTIVATE_FORGOT_TEXT;
2042                                 break;
2043                         case 'register':
2044                                 $title = _ACTIVATE_REGISTER_TITLE;
2045                                 $text = _ACTIVATE_REGISTER_TEXT;
2046                                 break;
2047                         case 'addresschange':
2048                                 $title = _ACTIVATE_CHANGE_TITLE;
2049                                 $text = _ACTIVATE_CHANGE_TEXT;
2050                                 $bNeedsPasswordChange = false;
2051                                 MEMBER::activate($key);
2052                                 break;
2053                 }
2054
2055                 $aVars = array(
2056                         'memberName' => htmlspecialchars($mem->getDisplayName())
2057                 );
2058                 $title = TEMPLATE::fill($title, $aVars);
2059                 $text = TEMPLATE::fill($text, $aVars);
2060
2061                 $this->pagehead();
2062
2063                         echo '<h2>' , $title, '</h2>';
2064                         echo '<p>' , $text, '</p>';
2065
2066                         if ($message != '')
2067                         {
2068                                 echo '<p class="error">',$message,'</p>';
2069                         }
2070
2071                         if ($bNeedsPasswordChange)
2072                         {
2073                                 ?>
2074                                         <div><form action="index.php" method="post">
2075
2076                                                 <input type="hidden" name="action" value="activatesetpwd" />
2077                                                 <?php $manager->addTicketHidden() ?>
2078                                                 <input type="hidden" name="key" value="<?php echo htmlspecialchars($key) ?>" />
2079
2080                                                 <table><tr>
2081                                                         <td><?php echo _MEMBERS_PWD?></td>
2082                                                         <td><input type="password" maxlength="40" size="16" name="password" /></td>
2083                                                 </tr><tr>
2084                                                         <td><?php echo _MEMBERS_REPPWD?></td>
2085                                                         <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>
2086                                                 <?php
2087
2088                                                         global $manager;
2089                                                         $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));
2090
2091                                                 ?>
2092                                                 </tr><tr>
2093                                                         <td><?php echo _MEMBERS_SETPWD ?></td>
2094                                                         <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>
2095                                                 </tr></table>
2096
2097
2098                                         </form></div>
2099
2100                                 <?php
2101
2102                         }
2103
2104                 $this->pagefoot();
2105
2106         }
2107
2108         /**
2109          * Account activation - set password part
2110          *
2111          * @author dekarma
2112          */
2113         function action_activatesetpwd() {
2114
2115                 $key = postVar('key');
2116
2117                 // clean up old activation keys
2118                 MEMBER::cleanupActivationTable();
2119
2120                 // get activation info
2121                 $info = MEMBER::getActivationInfo($key);
2122
2123                 if (!$info || ($info->type == 'addresschange'))
2124                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2125
2126                 $mem = MEMBER::createFromId($info->vmember);
2127
2128                 if (!$mem)
2129                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2130
2131                 $password               = postVar('password');
2132                 $repeatpassword = postVar('repeatpassword');
2133
2134                 if ($password != $repeatpassword)
2135                         return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);
2136
2137                 if ($password && (strlen($password) < 6))
2138                         return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
2139
2140                 $error = '';
2141                 global $manager;
2142                 $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));
2143                 if ($error != '')
2144                         return $this->_showActivationPage($key, $error);
2145
2146
2147                 // set password
2148                 $mem->setPassword($password);
2149                 $mem->write();
2150
2151                 // do the activation
2152                 MEMBER::activate($key);
2153
2154                 $this->pagehead();
2155                         echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';
2156                         echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';
2157                 $this->pagefoot();
2158         }
2159
2160         /**
2161          * Manage team
2162          */
2163         function action_manageteam() {
2164                 global $member, $manager;
2165
2166                 $blogid = intRequestVar('blogid');
2167
2168                 // check if allowed
2169                 $member->blogAdminRights($blogid) or $this->disallow();
2170
2171                 $this->pagehead();
2172
2173                 echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2174
2175                 echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';
2176
2177                 echo '<h3>' . _TEAM_CURRENT . '</h3>';
2178
2179
2180
2181                 $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'
2182                            . ' FROM '.sql_table('member').', '.sql_table('team')
2183                            . ' WHERE tmember=mnumber and tblog=' . $blogid;
2184
2185                 $template['content'] = 'teamlist';
2186                 $template['tabindex'] = 10;
2187
2188                 $manager->loadClass("ENCAPSULATE");
2189                 $batch =& new BATCH('team');
2190                 $batch->showlist($query, 'table', $template);
2191
2192                 ?>
2193                         <h3><?php echo _TEAM_ADDNEW?></h3>
2194
2195                         <form method='post' action='index.php'><div>
2196
2197                         <input type='hidden' name='action' value='teamaddmember' />
2198                         <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />
2199                         <?php $manager->addTicketHidden() ?>
2200
2201                         <table><tr>
2202                                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>
2203                                 <td><?php                                       // TODO: try to make it so only non-team-members are listed
2204                                         $query =  'SELECT mname as text, mnumber as value'
2205                                                    . ' FROM '.sql_table('member');
2206
2207                                         $template['name'] = 'memberid';
2208                                         $template['tabindex'] = 10000;
2209                                         showlist($query,'select',$template);
2210                                 ?></td>
2211                         </tr><tr>
2212                                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>
2213                                 <td><?php $this->input_yesno('admin',0,10020); ?></td>
2214                         </tr><tr>
2215                                 <td><?php echo _TEAM_ADD?></td>
2216                                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>
2217                         </tr></table>
2218
2219                         </div></form>
2220                 <?php
2221                 $this->pagefoot();
2222         }
2223
2224         /**
2225          * Add member to team
2226          */
2227         function action_teamaddmember() {
2228                 global $member, $manager;
2229
2230                 $memberid = intPostVar('memberid');
2231                 $blogid = intPostVar('blogid');
2232                 $admin = intPostVar('admin');
2233
2234                 // check if allowed
2235                 $member->blogAdminRights($blogid) or $this->disallow();
2236
2237                 $blog =& $manager->getBlog($blogid);
2238                 if (!$blog->addTeamMember($memberid, $admin))
2239                         $this->error(_ERROR_ALREADYONTEAM);
2240
2241                 $this->action_manageteam();
2242
2243         }
2244
2245         /**
2246          * @todo document this
2247          */
2248         function action_teamdelete() {
2249                 global $member, $manager;
2250
2251                 $memberid = intRequestVar('memberid');
2252                 $blogid = intRequestVar('blogid');
2253
2254                 // check if allowed
2255                 $member->blogAdminRights($blogid) or $this->disallow();
2256
2257                 $teammem = MEMBER::createFromID($memberid);
2258                 $blog =& $manager->getBlog($blogid);
2259
2260                 $this->pagehead();
2261                 ?>
2262                         <h2><?php echo _DELETE_CONFIRM?></h2>
2263
2264                         <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  $teammem->getDisplayName() ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  htmlspecialchars(strip_tags($blog->getName())) ?></b>
2265                         </p>
2266
2267
2268                         <form method="post" action="index.php"><div>
2269                         <input type="hidden" name="action" value="teamdeleteconfirm" />
2270                         <?php $manager->addTicketHidden() ?>
2271                         <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
2272                         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2273                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2274                         </div></form>
2275                 <?php
2276                 $this->pagefoot();
2277         }
2278
2279         /**
2280          * @todo document this
2281          */
2282         function action_teamdeleteconfirm() {
2283                 global $member;
2284
2285                 $memberid = intRequestVar('memberid');
2286                 $blogid = intRequestVar('blogid');
2287
2288                 $error = $this->deleteOneTeamMember($blogid, $memberid);
2289                 if ($error)
2290                         $this->error($error);
2291
2292
2293                 $this->action_manageteam();
2294         }
2295
2296         /**
2297          * @todo document this
2298          */
2299         function deleteOneTeamMember($blogid, $memberid) {
2300                 global $member, $manager;
2301
2302                 $blogid = intval($blogid);
2303                 $memberid = intval($memberid);
2304
2305                 // check if allowed
2306                 if (!$member->blogAdminRights($blogid))
2307                         return _ERROR_DISALLOWED;
2308
2309                 // check if: - there remains at least one blog admin
2310                 //           - (there remains at least one team member)
2311                 $tmem = MEMBER::createFromID($memberid);
2312
2313                 $manager->notify('PreDeleteTeamMember', array('member' => &$mem, 'blogid' => $blogid));
2314
2315                 if ($tmem->isBlogAdmin($blogid)) {
2316                         // check if there are more blog members left and at least one admin
2317                         // (check for at least two admins before deletion)
2318                         $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';
2319                         $r = sql_query($query);
2320                         if (mysql_num_rows($r) < 2)
2321                                 return _ERROR_ATLEASTONEBLOGADMIN;
2322                 }
2323
2324                 $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";
2325                 sql_query($query);
2326
2327                 $manager->notify('PostDeleteTeamMember', array('member' => &$mem, 'blogid' => $blogid));
2328
2329                 return '';
2330         }
2331
2332         /**
2333          * @todo document this
2334          */
2335         function action_teamchangeadmin() {
2336                 global $member;
2337
2338                 $blogid = intRequestVar('blogid');
2339                 $memberid = intRequestVar('memberid');
2340
2341                 // check if allowed
2342                 $member->blogAdminRights($blogid) or $this->disallow();
2343
2344                 $mem = MEMBER::createFromID($memberid);
2345
2346                 // don't allow when there is only one admin at this moment
2347                 if ($mem->isBlogAdmin($blogid)) {
2348                         $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");
2349                         if (mysql_num_rows($r) == 1)
2350                                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);
2351                 }
2352
2353                 if ($mem->isBlogAdmin($blogid))
2354                         $newval = 0;
2355                 else
2356                         $newval = 1;
2357
2358                 $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";
2359                 sql_query($query);
2360
2361                 // only show manageteam if member did not change its own admin privileges
2362                 if ($member->isBlogAdmin($blogid))
2363                         $this->action_manageteam();
2364                 else
2365                         $this->action_overview(_MSG_ADMINCHANGED);
2366         }
2367
2368         /**
2369          * @todo document this
2370          */
2371         function action_blogsettings() {
2372                 global $member, $manager;
2373
2374                 $blogid = intRequestVar('blogid');
2375
2376                 // check if allowed
2377                 $member->blogAdminRights($blogid) or $this->disallow();
2378
2379                 $blog =& $manager->getBlog($blogid);
2380
2381                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2382                 $this->pagehead($extrahead);
2383
2384                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
2385                 ?>
2386                 <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>
2387
2388                 <h3><?php echo _EBLOG_TEAM_TITLE?></h3>
2389
2390                 <p>Members currently on your team:
2391                 <?php
2392                         $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));
2393                         $aMemberNames = array();
2394                         while ($o = mysql_fetch_object($res))
2395                                 array_push($aMemberNames, htmlspecialchars($o->mname) . ' (' . htmlspecialchars($o->mrealname). ')');
2396                         echo implode(',', $aMemberNames);
2397                 ?>
2398                 </p>
2399
2400
2401
2402                 <p>
2403                 <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>
2404                 </p>
2405
2406                 <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>
2407
2408                 <form method="post" action="index.php"><div>
2409
2410                 <input type="hidden" name="action" value="blogsettingsupdate" />
2411                 <?php $manager->addTicketHidden() ?>
2412                 <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2413                 <table><tr>
2414                         <td><?php echo _EBLOG_NAME?></td>
2415                         <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  htmlspecialchars($blog->getName()) ?>" /></td>
2416                 </tr><tr>
2417                         <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>
2418                                 <?php echo _EBLOG_SHORTNAME_EXTRA?>
2419                         </td>
2420                         <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  htmlspecialchars($blog->getShortName()) ?>" /></td>
2421                 </tr><tr>
2422                         <td><?php echo _EBLOG_DESC?></td>
2423                         <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  htmlspecialchars($blog->getDescription()) ?>" /></td>
2424                 </tr><tr>
2425                         <td><?php echo _EBLOG_URL?></td>
2426                         <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  htmlspecialchars($blog->getURL()) ?>" /></td>
2427                 </tr><tr>
2428                         <td><?php echo _EBLOG_DEFSKIN?>
2429                                 <?php help('blogdefaultskin'); ?>
2430                         </td>
2431                         <td>
2432                                 <?php
2433                                         $query =  'SELECT sdname as text, sdnumber as value'
2434                                                    . ' FROM '.sql_table('skin_desc');
2435                                         $template['name'] = 'defskin';
2436                                         $template['selected'] = $blog->getDefaultSkin();
2437                                         $template['tabindex'] = 50;
2438                                         showlist($query,'select',$template);
2439                                 ?>
2440
2441                         </td>
2442                 </tr><tr>
2443                         <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>
2444                         </td>
2445                         <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>
2446                 </tr><tr>
2447                         <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>
2448                         </td>
2449                         <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>
2450                 </tr><tr>
2451                         <td><?php echo _EBLOG_DISABLECOMMENTS?>
2452                         </td>
2453                         <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>
2454                 </tr><tr>
2455                         <td><?php echo _EBLOG_ANONYMOUS?>
2456                         </td>
2457                         <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>
2458                 </tr><tr>
2459         <td><?php echo _EBLOG_REQUIREDEMAIL?>
2460                  </td>
2461                  <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>
2462           </tr><tr>
2463                         <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>
2464                         <td><input name="notify" tabindex="80" maxlength="60" size="40" value="<?php echo  htmlspecialchars($blog->getNotifyAddress()); ?>" /></td>
2465                 </tr><tr>
2466                         <td><?php echo _EBLOG_NOTIFY_ON?></td>
2467                         <td>
2468                                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"
2469                                         <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>
2470                                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>
2471                                 <br />
2472                                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"
2473                                         <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>
2474                                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>
2475                                 <br />
2476                                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"
2477                                         <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>
2478                                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>
2479                         </td>
2480                 </tr><tr>
2481                         <td><?php echo _EBLOG_PING?> <?php help('pinguserland'); ?></td>
2482                         <td><?php $this->input_yesno('pinguserland',$blog->pingUserland(),85); ?></td>
2483                 </tr><tr>
2484                         <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>
2485                         <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  htmlspecialchars($blog->getMaxComments()); ?>" /></td>
2486                 </tr><tr>
2487                         <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>
2488                         <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  htmlspecialchars($blog->getUpdateFile()) ?>" /></td>
2489                 </tr><tr>
2490                         <td><?php echo _EBLOG_DEFCAT?></td>
2491                         <td>
2492                                 <?php
2493                                         $query =  'SELECT cname as text, catid as value'
2494                                                    . ' FROM '.sql_table('category')
2495                                                    . ' WHERE cblog=' . $blog->getID();
2496                                         $template['name'] = 'defcat';
2497                                         $template['selected'] = $blog->getDefaultCategory();
2498                                         $template['tabindex'] = 110;
2499                                         showlist($query,'select',$template);
2500                                 ?>
2501                         </td>
2502                 </tr><tr>
2503                         <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>
2504                                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  strftime("%H:%M",time()); ?></b>
2505                                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  strftime("%H:%M",$blog->getCorrectTime()); ?></b>
2506                                 </td>
2507                         <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  htmlspecialchars($blog->getTimeOffset()); ?>" /></td>
2508                 </tr><tr>
2509                         <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>
2510                         <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>
2511                 </tr>
2512                 <?php
2513                         // plugin options
2514                         $this->_insertPluginOptions('blog',$blogid);
2515                 ?>
2516                 <tr>
2517                         <th colspan="2"><?php echo _EBLOG_CHANGE?></th>
2518                 </tr><tr>
2519                         <td><?php echo _EBLOG_CHANGE?></td>
2520                         <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
2521                 </tr></table>
2522
2523                 </div></form>
2524
2525                 <h3><?php echo _EBLOG_CAT_TITLE?></h3>
2526
2527
2528                 <?php
2529                 $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';
2530                 $template['content'] = 'categorylist';
2531                 $template['tabindex'] = 200;
2532
2533                 $manager->loadClass("ENCAPSULATE");
2534                 $batch =& new BATCH('category');
2535                 $batch->showlist($query,'table',$template);
2536
2537                 ?>
2538
2539
2540                 <form action="index.php" method="post"><div>
2541                 <input name="action" value="categorynew" type="hidden" />
2542                 <?php $manager->addTicketHidden() ?>
2543                 <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />
2544
2545                 <table><tr>
2546                         <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>
2547                 </tr><tr>
2548                         <td><?php echo _EBLOG_CAT_NAME?></td>
2549                         <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>
2550                 </tr><tr>
2551                         <td><?php echo _EBLOG_CAT_DESC?></td>
2552                         <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>
2553                 </tr><tr>
2554                         <td><?php echo _EBLOG_CAT_CREATE?></td>
2555                         <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>
2556                 </tr></table>
2557
2558                 </div></form>
2559
2560                 <?php
2561
2562                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
2563
2564                         $manager->notify(
2565                                 'BlogSettingsFormExtras',
2566                                 array(
2567                                         'blog' => &$blog
2568                                 )
2569                         );
2570
2571                 $this->pagefoot();
2572         }
2573
2574         /**
2575          * @todo document this
2576          */
2577         function action_categorynew() {
2578                 global $member, $manager;
2579
2580                 $blogid = intRequestVar('blogid');
2581
2582                 $member->blogAdminRights($blogid) or $this->disallow();
2583
2584                 $cname = postVar('cname');
2585                 $cdesc = postVar('cdesc');
2586
2587                 if (!isValidCategoryName($cname))
2588                         $this->error(_ERROR_BADCATEGORYNAME);
2589
2590                 $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . addslashes($cname).'\' and cblog=' . intval($blogid);
2591                 $res = sql_query($query);
2592                 if (mysql_num_rows($res) > 0)
2593                         $this->error(_ERROR_DUPCATEGORYNAME);
2594
2595                 $blog           =& $manager->getBlog($blogid);
2596                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);
2597
2598                 $this->action_blogsettings();
2599         }
2600
2601         /**
2602          * @todo document this
2603          */
2604         function action_categoryedit($catid = '', $blogid = '', $desturl = '') {
2605                 global $member, $manager;
2606
2607                 if ($blogid == '')
2608                         $blogid = intGetVar('blogid');
2609                 else
2610                         $blogid = intval($blogid);
2611                 if ($catid == '')
2612                         $catid = intGetVar('catid');
2613                 else
2614                         $catid = intval($catid);
2615
2616                 $member->blogAdminRights($blogid) or $this->disallow();
2617
2618                 $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");
2619                 $obj = mysql_fetch_object($res);
2620
2621                 $cname = $obj->cname;
2622                 $cdesc = $obj->cdesc;
2623
2624                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2625                 $this->pagehead($extrahead);
2626
2627                 echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2628
2629                 ?>
2630                 <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo htmlspecialchars($cname)?>'</h2>
2631                 <form method='post' action='index.php'><div>
2632                 <input name="blogid" type="hidden" value="<?php echo $blogid?>" />
2633                 <input name="catid" type="hidden" value="<?php echo $catid?>" />
2634                 <input name="desturl" type="hidden" value="<?php echo htmlspecialchars($desturl) ?>" />
2635                 <input name="action" type="hidden" value="categoryupdate" />
2636                 <?php $manager->addTicketHidden(); ?>
2637
2638                 <table><tr>
2639                         <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2640                 </tr><tr>
2641                         <td><?php echo _EBLOG_CAT_NAME?></td>
2642                         <td><input type="text" name="cname" value="<?php echo htmlspecialchars($cname)?>" size="40" maxlength="40" /></td>
2643                 </tr><tr>
2644                         <td><?php echo _EBLOG_CAT_DESC?></td>
2645                         <td><input type="text" name="cdesc" value="<?php echo htmlspecialchars($cdesc)?>" size="40" maxlength="200" /></td>
2646                 </tr>
2647                 <?php
2648                         // insert plugin options
2649                         $this->_insertPluginOptions('category',$catid);
2650                 ?>
2651                 <tr>
2652                         <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2653                 </tr><tr>
2654                         <td><?php echo _EBLOG_CAT_UPDATE?></td>
2655                         <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>
2656                 </tr></table>
2657
2658                 </div></form>
2659                 <?php
2660                 $this->pagefoot();
2661         }
2662
2663         /**
2664          * @todo document this
2665          */
2666         function action_categoryupdate() {
2667                 global $member, $manager;
2668
2669                 $blogid = intPostVar('blogid');
2670                 $catid = intPostVar('catid');
2671                 $cname = postVar('cname');
2672                 $cdesc = postVar('cdesc');
2673                 $desturl = postVar('desturl');
2674
2675                 $member->blogAdminRights($blogid) or $this->disallow();
2676
2677                 if (!isValidCategoryName($cname))
2678                         $this->error(_ERROR_BADCATEGORYNAME);
2679
2680                 $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . addslashes($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
2681                 $res = sql_query($query);
2682                 if (mysql_num_rows($res) > 0)
2683                         $this->error(_ERROR_DUPCATEGORYNAME);
2684
2685                 $query =  'UPDATE '.sql_table('category').' SET'
2686                            . " cname='" . addslashes($cname) . "',"
2687                            . " cdesc='" . addslashes($cdesc) . "'"
2688                            . " WHERE catid=" . $catid;
2689
2690                 sql_query($query);
2691
2692                 // store plugin options
2693                 $aOptions = requestArray('plugoption');
2694                 NucleusPlugin::_applyPluginOptions($aOptions);
2695                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));
2696
2697
2698                 if ($desturl) {
2699                         redirect($desturl);
2700                         exit;
2701                 } else {
2702                         $this->action_blogsettings();
2703                 }
2704         }
2705
2706         /**
2707          * @todo document this
2708          */
2709         function action_categorydelete() {
2710                 global $member, $manager;
2711
2712                 $blogid = intRequestVar('blogid');
2713                 $catid = intRequestVar('catid');
2714
2715                 $member->blogAdminRights($blogid) or $this->disallow();
2716
2717                 $blog =& $manager->getBlog($blogid);
2718
2719                 // check if the category is valid
2720                 if (!$blog->isValidCategory($catid))
2721                         $this->error(_ERROR_NOSUCHCATEGORY);
2722
2723                 // don't allow deletion of default category
2724                 if ($blog->getDefaultCategory() == $catid)
2725                         $this->error(_ERROR_DELETEDEFCATEGORY);
2726
2727                 // check if catid is the only category left for blogid
2728                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2729                 $res = sql_query($query);
2730                 if (mysql_num_rows($res) == 1)
2731                         $this->error(_ERROR_DELETELASTCATEGORY);
2732
2733
2734                 $this->pagehead();
2735                 ?>
2736                         <h2><?php echo _DELETE_CONFIRM?></h2>
2737
2738                         <div>
2739                         <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  $blog->getCategoryName($catid)?></b>
2740                         </div>
2741
2742                         <form method="post" action="index.php"><div>
2743                         <input type="hidden" name="action" value="categorydeleteconfirm" />
2744                         <?php $manager->addTicketHidden() ?>
2745                         <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
2746                         <input type="hidden" name="catid" value="<?php echo $catid?>" />
2747                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2748                         </div></form>
2749                 <?php
2750                 $this->pagefoot();
2751         }
2752
2753         /**
2754          * @todo document this
2755          */
2756         function action_categorydeleteconfirm() {
2757                 global $member, $manager;
2758
2759                 $blogid = intRequestVar('blogid');
2760                 $catid = intRequestVar('catid');
2761
2762                 $member->blogAdminRights($blogid) or $this->disallow();
2763
2764                 $error = $this->deleteOneCategory($catid);
2765                 if ($error)
2766                         $this->error($error);
2767
2768                 $this->action_blogsettings();
2769         }
2770
2771         /**
2772          * @todo document this
2773          */
2774         function deleteOneCategory($catid) {
2775                 global $manager, $member;
2776
2777                 $catid = intval($catid);
2778
2779                 $manager->notify('PreDeleteCategory', array('catid' => $catid));
2780
2781                 $blogid = getBlogIDFromCatID($catid);
2782
2783                 if (!$member->blogAdminRights($blogid))
2784                         return ERROR_DISALLOWED;
2785
2786                 // get blog
2787                 $blog =& $manager->getBlog($blogid);
2788
2789                 // check if the category is valid
2790                 if (!$blog || !$blog->isValidCategory($catid))
2791                         return _ERROR_NOSUCHCATEGORY;
2792
2793                 $destcatid = $blog->getDefaultCategory();
2794
2795                 // don't allow deletion of default category
2796                 if ($blog->getDefaultCategory() == $catid)
2797                         return _ERROR_DELETEDEFCATEGORY;
2798
2799                 // check if catid is the only category left for blogid
2800                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2801                 $res = sql_query($query);
2802                 if (mysql_num_rows($res) == 1)
2803                         return _ERROR_DELETELASTCATEGORY;
2804
2805                 // change category for all items to the default category
2806                 $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";
2807                 sql_query($query);
2808
2809                 // delete all associated plugin options
2810                 NucleusPlugin::_deleteOptionValues('category', $catid);
2811
2812                 // delete category
2813                 $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;
2814                 sql_query($query);
2815
2816                 $manager->notify('PostDeleteCategory', array('catid' => $catid));
2817
2818         }
2819
2820         /**
2821          * @todo document this
2822          */
2823         function moveOneCategory($catid, $destblogid) {
2824                 global $manager, $member;
2825
2826                 $catid = intval($catid);
2827                 $destblogid = intval($destblogid);
2828
2829                 $blogid = getBlogIDFromCatID($catid);
2830
2831                 // mover should have admin rights on both blogs
2832                 if (!$member->blogAdminRights($blogid))
2833                         return _ERROR_DISALLOWED;
2834                 if (!$member->blogAdminRights($destblogid))
2835                         return _ERROR_DISALLOWED;
2836
2837                 // cannot move to self
2838                 if ($blogid == $destblogid)
2839                         return _ERROR_MOVETOSELF;
2840
2841                 // get blogs
2842                 $blog =& $manager->getBlog($blogid);
2843                 $destblog =& $manager->getBlog($destblogid);
2844
2845                 // check if the category is valid
2846                 if (!$blog || !$blog->isValidCategory($catid))
2847                         return _ERROR_NOSUCHCATEGORY;
2848
2849                 // don't allow default category to be moved
2850                 if ($blog->getDefaultCategory() == $catid)
2851                         return _ERROR_MOVEDEFCATEGORY;
2852
2853                 $manager->notify(
2854                         'PreMoveCategory',
2855                         array(
2856                                 'catid' => &$catid,
2857                                 'sourceblog' => &$blog,
2858                                 'destblog' => &$destblog
2859                         )
2860                 );
2861
2862                 // update comments table (cblog)
2863                 $query = 'SELECT inumber FROM '.sql_table('item').' WHERE icat='.$catid;
2864                 $items = sql_query($query);
2865                 while ($oItem = mysql_fetch_object($items)) {
2866                         sql_query('UPDATE '.sql_table('comment').' SET cblog='.$destblogid.' WHERE citem='.$oItem->inumber);
2867                 }
2868
2869                 // update items (iblog)
2870                 $query = 'UPDATE '.sql_table('item').' SET iblog='.$destblogid.' WHERE icat='.$catid;
2871                 sql_query($query);
2872
2873                 // move category
2874                 $query = 'UPDATE '.sql_table('category').' SET cblog='.$destblogid.' WHERE catid='.$catid;
2875                 sql_query($query);
2876
2877                 $manager->notify(
2878                         'PostMoveCategory',
2879                         array(
2880                                 'catid' => &$catid,
2881                                 'sourceblog' => &$blog,
2882                                 'destblog' => $destblog
2883                         )
2884                 );
2885
2886         }
2887
2888         /**
2889          * @todo document this
2890          */
2891         function action_blogsettingsupdate() {
2892                 global $member, $manager;
2893
2894                 $blogid = intRequestVar('blogid');
2895
2896                 $member->blogAdminRights($blogid) or $this->disallow();
2897
2898                 $blog =& $manager->getBlog($blogid);
2899
2900                 $notify                 = trim(postVar('notify'));
2901                 $shortname              = trim(postVar('shortname'));
2902                 $updatefile             = trim(postVar('update'));
2903
2904                 $notifyComment  = intPostVar('notifyComment');
2905                 $notifyVote             = intPostVar('notifyVote');
2906                 $notifyNewItem  = intPostVar('notifyNewItem');
2907
2908                 if ($notifyComment == 0)        $notifyComment = 1;
2909                 if ($notifyVote == 0)           $notifyVote = 1;
2910                 if ($notifyNewItem == 0)        $notifyNewItem = 1;
2911
2912                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
2913
2914
2915                 if ($notify) {
2916                         $not =& new NOTIFICATION($notify);
2917                         if (!$not->validAddresses())
2918                                 $this->error(_ERROR_BADNOTIFY);
2919
2920                 }
2921
2922                 if (!isValidShortName($shortname))
2923                         $this->error(_ERROR_BADSHORTBLOGNAME);
2924
2925                 if (($blog->getShortName() != $shortname) && $manager->existsBlog($shortname))
2926                         $this->error(_ERROR_DUPSHORTBLOGNAME);
2927
2928                 // check if update file is writable
2929                 if ($updatefile && !is_writeable($updatefile))
2930                         $this->error(_ERROR_UPDATEFILE);
2931
2932                 $blog->setName(trim(postVar('name')));
2933                 $blog->setShortName($shortname);
2934                 $blog->setNotifyAddress($notify);
2935                 $blog->setNotifyType($notifyType);
2936                 $blog->setMaxComments(postVar('maxcomments'));
2937                 $blog->setCommentsEnabled(postVar('comments'));
2938                 $blog->setTimeOffset(postVar('timeoffset'));
2939                 $blog->setUpdateFile($updatefile);
2940                 $blog->setURL(trim(postVar('url')));
2941                 $blog->setDefaultSkin(intPostVar('defskin'));
2942                 $blog->setDescription(trim(postVar('desc')));
2943                 $blog->setPublic(postVar('public'));
2944                 $blog->setPingUserland(postVar('pinguserland'));
2945                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
2946                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
2947                 $blog->setDefaultCategory(intPostVar('defcat'));
2948                 $blog->setSearchable(intPostVar('searchable'));
2949                 $blog->setEmailRequired(intPostVar('reqemail'));
2950
2951                 $blog->writeSettings();
2952
2953                 // store plugin options
2954                 $aOptions = requestArray('plugoption');
2955                 NucleusPlugin::_applyPluginOptions($aOptions);
2956                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));
2957
2958
2959                 $this->action_overview(_MSG_SETTINGSCHANGED);
2960         }
2961
2962         /**
2963          * @todo document this
2964          */
2965         function action_deleteblog() {
2966                 global $member, $CONF, $manager;
2967
2968                 $blogid = intRequestVar('blogid');
2969
2970                 $member->blogAdminRights($blogid) or $this->disallow();
2971
2972                 // check if blog is default blog
2973                 if ($CONF['DefaultBlog'] == $blogid)
2974                         $this->error(_ERROR_DELDEFBLOG);
2975
2976                 $blog =& $manager->getBlog($blogid);
2977
2978                 $this->pagehead();
2979                 ?>
2980                         <h2><?php echo _DELETE_CONFIRM?></h2>
2981
2982                         <p><?php echo _WARNINGTXT_BLOGDEL?>
2983                         </p>
2984
2985                         <div>
2986                         <?php echo _CONFIRMTXT_BLOG?><b><?php echo  htmlspecialchars($blog->getName())?></b>
2987                         </div>
2988
2989                         <form method="post" action="index.php"><div>
2990                         <input type="hidden" name="action" value="deleteblogconfirm" />
2991                         <?php $manager->addTicketHidden() ?>
2992                         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2993                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2994                         </div></form>
2995                 <?php
2996                 $this->pagefoot();
2997         }
2998
2999         /**
3000          * @todo document this
3001          */
3002         function action_deleteblogconfirm() {
3003                 global $member, $CONF, $manager;
3004
3005                 $blogid = intRequestVar('blogid');
3006
3007                 $manager->notify('PreDeleteBlog', array('blogid' => $blogid));
3008
3009                 $member->blogAdminRights($blogid) or $this->disallow();
3010
3011                 // check if blog is default blog
3012                 if ($CONF['DefaultBlog'] == $blogid)
3013                         $this->error(_ERROR_DELDEFBLOG);
3014
3015                 // delete all comments
3016                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;
3017                 sql_query($query);
3018
3019                 // delete all items
3020                 $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;
3021                 sql_query($query);
3022
3023                 // delete all team members
3024                 $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;
3025                 sql_query($query);
3026
3027                 // delete all bans
3028                 $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;
3029                 sql_query($query);
3030
3031                 // delete all categories
3032                 $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;
3033                 sql_query($query);
3034
3035                 // delete all associated plugin options
3036                 NucleusPlugin::_deleteOptionValues('blog', $blogid);
3037
3038                 // delete the blog itself
3039                 $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;
3040                 sql_query($query);
3041
3042                 $manager->notify('PostDeleteBlog', array('blogid' => $blogid));
3043
3044                 $this->action_overview(_DELETED_BLOG);
3045         }
3046
3047         /**
3048          * @todo document this
3049          */
3050         function action_memberdelete() {
3051                 global $member, $manager;
3052
3053                 $memberid = intRequestVar('memberid');
3054
3055                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3056
3057                 $mem = MEMBER::createFromID($memberid);
3058
3059                 $this->pagehead();
3060                 ?>
3061                         <h2><?php echo _DELETE_CONFIRM?></h2>
3062
3063                         <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo  $mem->getDisplayName() ?></b>
3064                         </p>
3065
3066                         <p>
3067                         Please note that media files will <b>NOT</b> be deleted. (At least not in this Nucleus version)
3068                         </p>
3069
3070                         <form method="post" action="index.php"><div>
3071                         <input type="hidden" name="action" value="memberdeleteconfirm" />
3072                         <?php $manager->addTicketHidden() ?>
3073                         <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
3074                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3075                         </div></form>
3076                 <?php
3077                 $this->pagefoot();
3078         }
3079
3080         /**
3081          * @todo document this
3082          */
3083         function action_memberdeleteconfirm() {
3084                 global $member;
3085
3086                 $memberid = intRequestVar('memberid');
3087
3088                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3089
3090                 $error = $this->deleteOneMember($memberid);
3091                 if ($error)
3092                         $this->error($error);
3093
3094                 if ($member->isAdmin())
3095                         $this->action_usermanagement();
3096                 else
3097                         $this->action_overview(_DELETED_MEMBER);
3098         }
3099
3100         /**
3101          * @static
3102          * @todo document this
3103          */
3104         function deleteOneMember($memberid) {
3105                 global $manager;
3106
3107                 $memberid = intval($memberid);
3108                 $mem = MEMBER::createFromID($memberid);
3109
3110                 if (!$mem->canBeDeleted())
3111                         return _ERROR_DELETEMEMBER;
3112
3113                 $manager->notify('PreDeleteMember', array('member' => &$mem));
3114
3115                 /* unlink comments from memberid */
3116                 $query = 'UPDATE ' . sql_table('comment') . ' SET cmember="0", cuser="'. addslashes($mem->getDisplayName())
3117                                         .'" WHERE cmember='.$memberid;
3118                 sql_query($query);
3119
3120                 $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;
3121                 sql_query($query);
3122
3123                 $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;
3124                 sql_query($query);
3125
3126                 $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;
3127                 sql_query($query);
3128
3129                 // delete all associated plugin options
3130                 NucleusPlugin::_deleteOptionValues('member', $memberid);
3131
3132                 $manager->notify('PostDeleteMember', array('member' => &$mem));
3133
3134                 return '';
3135         }
3136
3137         /**
3138          * @todo document this
3139          */
3140         function action_createnewlog() {
3141                 global $member, $CONF, $manager;
3142
3143                 // Only Super-Admins can do this
3144                 $member->isAdmin() or $this->disallow();
3145
3146                 $this->pagehead();
3147
3148                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3149                 ?>
3150                 <h2><?php echo _EBLOG_CREATE_TITLE?></h2>
3151
3152                 <h3>注意事項</h3>
3153
3154                 <p>作成にあたって、下記の<strong>注意事項</strong> をまずお読み下さい</p>
3155
3156                 <p>新しいweblogを作成した後に、このblogにアクセスするための方法を紹介しておきます。方法は2つあります:</p>
3157
3158                 <ol>
3159                         <li><strong>簡単な方法:</strong> <code>index.php</code>の複製を作り、新しいblogを表示するように変更を加えます。 この変更の詳細は、作成後に表示されます。</li>
3160                         <li><strong>高度な方法:</strong> 現在のblogで使用しているスキンに<code>otherblog</code>というコードを使った記述を加えます。この方法では、同じページ内で複数のblogを展開することが可能となります。</li>
3161                 </ol>
3162
3163                 <h3>Weblogの作成</h3>
3164
3165                 <p>
3166                 <?php echo _EBLOG_CREATE_TEXT?>
3167                 </p>
3168
3169                 <form method="post" action="index.php"><div>
3170
3171                 <input type="hidden" name="action" value="addnewlog" />
3172                 <?php $manager->addTicketHidden() ?>
3173
3174
3175                 <table><tr>
3176                         <td><?php echo _EBLOG_NAME?></td>
3177                         <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>
3178                 </tr><tr>
3179                         <td><?php echo _EBLOG_SHORTNAME?>
3180                                 <?php help('shortblogname'); ?>
3181                         </td>
3182                         <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>
3183                 </tr><tr>
3184                         <td><?php echo _EBLOG_DESC?></td>
3185                         <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>
3186                 </tr><tr>
3187                         <td><?php echo _EBLOG_DEFSKIN?>
3188                                 <?php help('blogdefaultskin'); ?>
3189                         </td>
3190                         <td>
3191                                 <?php
3192                                         $query =  'SELECT sdname as text, sdnumber as value'
3193                                                    . ' FROM '.sql_table('skin_desc');
3194                                         $template['name'] = 'defskin';
3195                                         $template['tabindex'] = 50;
3196                                         $template['selected'] = $CONF['BaseSkin'];      // set default selected skin to be globally defined base skin
3197                                         showlist($query,'select',$template);
3198                                 ?>
3199                         </td>
3200                 </tr><tr>
3201                         <td><?php echo _EBLOG_OFFSET?>
3202                                 <?php help('blogtimeoffset'); ?>
3203                                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  strftime("%H:%M",time()); ?></b>
3204                         </td>
3205                         <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>
3206                 </tr><tr>
3207                         <td><?php echo _EBLOG_ADMIN?>
3208                                 <?php help('blogadmin'); ?>
3209                         </td>
3210                         <td><?php echo _EBLOG_ADMIN_MSG?></td>
3211                 </tr><tr>
3212                         <td><?php echo _EBLOG_CREATE?></td>
3213                         <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3214                 </tr></table>
3215
3216                 </div></form>
3217                 <?php
3218                 $this->pagefoot();
3219         }
3220
3221         /**
3222          * @todo document this
3223          */
3224         function action_addnewlog() {
3225                 global $member, $manager, $CONF;
3226
3227                 // Only Super-Admins can do this
3228                 $member->isAdmin() or $this->disallow();
3229
3230                 $bname                  = trim(postVar('name'));
3231                 $bshortname             = trim(postVar('shortname'));
3232                 $btimeoffset    = postVar('timeoffset');
3233                 $bdesc                  = trim(postVar('desc'));
3234                 $bdefskin               = postVar('defskin');
3235
3236                 if (!isValidShortName($bshortname))
3237                         $this->error(_ERROR_BADSHORTBLOGNAME);
3238
3239                 if ($manager->existsBlog($bshortname))
3240                         $this->error(_ERROR_DUPSHORTBLOGNAME);
3241
3242                 $manager->notify(
3243                         'PreAddBlog',
3244                         array(
3245                                 'name' => &$bname,
3246                                 'shortname' => &$bshortname,
3247                                 'timeoffset' => &$btimeoffset,
3248                                 'description' => &$bdescription,
3249                                 'defaultskin' => &$bdefskin
3250                         )
3251                 );
3252
3253
3254                 // add slashes for sql queries
3255                 $bname =                addslashes($bname);
3256                 $bshortname =   addslashes($bshortname);
3257                 $btimeoffset =  addslashes($btimeoffset);
3258                 $bdesc =                addslashes($bdesc);
3259                 $bdefskin =     addslashes($bdefskin);
3260
3261                 // create blog
3262                 $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";
3263                 sql_query($query);
3264                 $blogid = mysql_insert_id();
3265                 $blog   =& $manager->getBlog($blogid);
3266
3267                 // create new category
3268                 sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, 'General','Items that do not fit in other categories')");
3269                 $catid = mysql_insert_id();
3270
3271                 // set as default category
3272                 $blog->setDefaultCategory($catid);
3273                 $blog->writeSettings();
3274
3275                 // create team member
3276                 $memberid = $member->getID();
3277                 $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";
3278                 sql_query($query);
3279
3280
3281                 $blog->additem($blog->getDefaultCategory(),'First Item','これはあなたのweblogにおける最初のアイテムです。自由に削除していただいてかまいません。','',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3282
3283                 $manager->notify(
3284                         'PostAddBlog',
3285                         array(
3286                                 'blog' => &$blog
3287                         )
3288                 );
3289
3290                 $manager->notify(
3291                         'PostAddCategory',
3292                         array(
3293                                 'catid' => $catid
3294                         )
3295                 );
3296
3297                 $this->pagehead();
3298                 ?>
3299                 <h2>新しいweblogが作成されました</h2>
3300
3301                 <p>新しいweblog 「<?php echo htmlspecialchars($bname)?>」が作成されました。続けて、これにアクセスするために以下のどちらかの手順に進んでください。</p>
3302
3303                 <ol>
3304                         <li><a href="#index_php">簡単な方法: 下のコードを貼付けた <code><?php echo htmlspecialchars($bshortname)?>.php</code> というファイルを作成する</a></li>
3305                         <li><a href="#skins">高度な方法: 現在使用しているスキンに新しいweblogを展開させるための記述を加える</a></li>
3306                 </ol>
3307
3308                 <h3><a id="index_php">方法 1: <code><?php echo htmlspecialchars($bshortname)?>.php</code> というファイルを作成</a></h3>
3309
3310                 <p><code><?php echo htmlspecialchars($bshortname)?>.php</code> というファイルを作成して、中身に以下のコードを貼り付ける:</p>
3311 <pre><code>&lt;?php
3312
3313 $CONF['Self'] = '<b><?php echo htmlspecialchars($bshortname)?>.php</b>';
3314
3315 include('<i>./config.php</i>');
3316
3317 selectBlog('<b><?php echo htmlspecialchars($bshortname)?></b>');
3318 selector();
3319
3320 ?&gt;</code></pre>
3321
3322                 <p>すでにある<code>index.php</code>と同じディレクトリにアップロードします。</p>
3323
3324                 <p>新しいweblogの作成を完了するためには、下にこのファイルのURLを入力してください。 (すでに用意した値で合っているとは思いますが保証はしません):</p>
3325
3326                 <form action="index.php" method="post"><div>
3327                         <input type="hidden" name="action" value="addnewlog2" />
3328                         <?php $manager->addTicketHidden() ?>
3329                         <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3330                         <table><tr>
3331                                 <td><?php echo _EBLOG_URL?></td>
3332                                 <td><input name="url" maxlength="100" size="40" value="<?php echo htmlspecialchars($CONF['IndexURL'].$bshortname.'.php')?>" /></td>
3333                         </tr><tr>
3334                                 <td><?php echo _EBLOG_CREATE?></td>
3335                                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3336                         </tr></table>
3337                 </div></form>
3338
3339                 <h3><a id="skins">方法 2: 現在使用しているスキンに新しいweblogを展開する記述を加える</a></h3>
3340
3341                 <p>新しいweblogの作成を完了するためには、下にURLを入力してください。 (大抵は既存blogと同じURL)</p>
3342
3343                 <form action="index.php" method="post"><div>
3344                         <input type="hidden" name="action" value="addnewlog2" />
3345                         <?php $manager->addTicketHidden() ?>
3346                         <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3347                         <table><tr>
3348                                 <td><?php echo _EBLOG_URL?></td>
3349                                 <td><input name="url" maxlength="100" size="40" /></td>
3350                         </tr><tr>
3351                                 <td><?php echo _EBLOG_CREATE?></td>
3352                                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3353                         </tr></table>
3354                 </div></form>
3355
3356                 <?php           $this->pagefoot();
3357
3358         }
3359
3360         /**
3361          * @todo document this
3362          */
3363         function action_addnewlog2() {
3364                 global $member, $manager;
3365
3366                 $member->blogAdminRights($blogid) or $this->disallow();
3367
3368                 $burl   = requestVar('url');
3369                 $blogid = intRequestVar('blogid');
3370
3371                 $blog =& $manager->getBlog($blogid);
3372                 $blog->setURL(trim($burl));
3373                 $blog->writeSettings();
3374
3375                 $this->action_overview(_MSG_NEWBLOG);
3376         }
3377
3378         /**
3379          * @todo document this
3380          */
3381         function action_skinieoverview() {
3382                 global $member, $DIR_LIBS, $manager;
3383
3384                 $member->isAdmin() or $this->disallow();
3385
3386                 // load skinie class
3387                 include_once($DIR_LIBS . 'skinie.php');
3388
3389                 $this->pagehead();
3390
3391                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3392
3393         ?>
3394                 <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>
3395
3396                                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>
3397                                 <?php                                   global $DIR_SKINS;
3398
3399                                         $candidates = SKINIMPORT::searchForCandidates($DIR_SKINS);
3400
3401                                         if (sizeof($candidates) > 0) {
3402                                                 ?>
3403                                                         <form method="post" action="index.php"><div>
3404                                                                 <input type="hidden" name="action" value="skinieimport" />
3405                                                                 <?php $manager->addTicketHidden() ?>
3406                                                                 <input type="hidden" name="mode" value="file" />
3407                                                                 <select name="skinfile" id="skinie_import_local">
3408                                                                 <?php                                                                   foreach ($candidates as $skinname => $skinfile) {
3409                                                                                 $html = htmlspecialchars($skinfile);
3410                                                                                 echo '<option value="',$html,'">',$skinname,'</option>';
3411                                                                         }
3412                                                                 ?>
3413                                                                 </select>
3414                                                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3415                                                         </div></form>
3416                                                 <?php                                   } else {
3417                                                 echo _SKINIE_NOCANDIDATES;
3418                                         }
3419                                 ?>
3420                                 </p>
3421
3422                                 <p><em><?php echo _OR?></em></p>
3423
3424                                 <form method="post" action="index.php"><p>
3425                                         <?php $manager->addTicketHidden() ?>
3426                                         <input type="hidden" name="action" value="skinieimport" />
3427                                         <input type="hidden" name="mode" value="url" />
3428                                         <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>
3429                                         <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />
3430                                         <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3431                                 </p></form>
3432
3433
3434                 <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>
3435                 <form method="post" action="index.php"><div>
3436                         <input type="hidden" name="action" value="skinieexport" />
3437                         <?php $manager->addTicketHidden() ?>
3438
3439                         <p><?php echo _SKINIE_EXPORT_INTRO?></p>
3440
3441                         <table><tr>
3442                                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>
3443                         </tr><tr>
3444         <?php           // show list of skins
3445                 $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));
3446                 while ($skinObj = mysql_fetch_object($res)) {
3447                         $id = 'skinexp' . $skinObj->sdnumber;
3448                         echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';
3449                         echo '<label for="',$id,'">',htmlspecialchars($skinObj->sdname),'</label></td>';
3450                         echo '<td>',htmlspecialchars($skinObj->sddesc),'</td>';
3451                         echo '</tr><tr>';
3452                 }
3453
3454                 echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';
3455
3456                 // show list of templates
3457                 $res = sql_query('SELECT * FROM '.sql_table('template_desc'));
3458                 while ($templateObj = mysql_fetch_object($res)) {
3459                         $id = 'templateexp' . $templateObj->tdnumber;
3460                         echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';
3461                         echo '<label for="',$id,'">',htmlspecialchars($templateObj->tdname),'</label></td>';
3462                         echo '<td>',htmlspecialchars($templateObj->tddesc),'</td>';
3463                         echo '</tr><tr>';
3464                 }
3465
3466         ?>
3467                                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>
3468                         </tr><tr>
3469                                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>
3470                         </tr><tr>
3471                                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>
3472                         </tr><tr>
3473                                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>
3474                         </tr></table>
3475                 </div></form>
3476
3477         <?php
3478                 $this->pagefoot();
3479
3480         }
3481
3482         /**
3483          * @todo document this
3484          */
3485         function action_skinieimport() {
3486                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;
3487
3488                 $member->isAdmin() or $this->disallow();
3489
3490                 // load skinie class
3491                 include_once($DIR_LIBS . 'skinie.php');
3492
3493                 $skinFileRaw= postVar('skinfile');
3494                 $mode           = postVar('mode');
3495
3496                 $importer =& new SKINIMPORT();
3497
3498                 // get full filename
3499                 if ($mode == 'file')
3500                 {
3501                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3502
3503                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3504                         if (!file_exists($skinFile))
3505                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3506                 } else {
3507                         $skinFile = $skinFileRaw;
3508                 }
3509
3510                 // read only metadata
3511                 $error = $importer->readFile($skinFile, 1);
3512
3513                 // clashes
3514                 $skinNameClashes = $importer->checkSkinNameClashes();
3515                 $templateNameClashes = $importer->checkTemplateNameClashes();
3516                 $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
3517
3518                 if ($error) $this->error($error);
3519
3520                 $this->pagehead();
3521
3522                 echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';
3523                 ?>
3524                 <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>
3525
3526                 <ul>
3527                         <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo htmlspecialchars($importer->getInfo())?></p></li>
3528                         <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3529                         <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3530                         <?php
3531                                 if ($hasNameClashes)
3532                                 {
3533                         ?>
3534                         <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>
3535                         <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>
3536                         <?php
3537                                 } // if (hasNameClashes)
3538                         ?>
3539                 </ul>
3540
3541                 <form method="post" action="index.php"><div>
3542                         <input type="hidden" name="action" value="skiniedoimport" />
3543                         <?php $manager->addTicketHidden() ?>
3544                         <input type="hidden" name="skinfile" value="<?php echo htmlspecialchars(postVar('skinfile'))?>" />
3545                         <input type="hidden" name="mode" value="<?php echo htmlspecialchars($mode)?>" />
3546                         <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />
3547                         <?php
3548                                 if ($hasNameClashes)
3549                                 {
3550                         ?>
3551                         <br />
3552                         <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>
3553                         <?php
3554                                 } // if (hasNameClashes)
3555                         ?>
3556                 </div></form>
3557
3558
3559                 <?php
3560                 $this->pagefoot();
3561         }
3562
3563         /**
3564          * @todo document this
3565          */
3566         function action_skiniedoimport() {
3567                 global $member, $DIR_LIBS, $DIR_SKINS;
3568
3569                 $member->isAdmin() or $this->disallow();
3570
3571                 // load skinie class
3572                 include_once($DIR_LIBS . 'skinie.php');
3573
3574                 $skinFileRaw= postVar('skinfile');
3575                 $mode           = postVar('mode');
3576
3577                 $allowOverwrite = intPostVar('overwrite');
3578
3579                 // get full filename
3580                 if ($mode == 'file')
3581                 {
3582                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3583
3584                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3585                         if (!file_exists($skinFile))
3586                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3587
3588                 } else {
3589                         $skinFile = $skinFileRaw;
3590                 }
3591
3592                 $importer =& new SKINIMPORT();
3593
3594                 $error = $importer->readFile($skinFile);
3595
3596                 if ($error)
3597                         $this->error($error);
3598
3599                 $error = $importer->writeToDatabase($allowOverwrite);
3600
3601                 if ($error)
3602                         $this->error($error);
3603
3604                 $this->pagehead();
3605
3606                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3607         ?>
3608                 <h2><?php echo _SKINIE_DONE?></h2>
3609
3610                 <ul>
3611                         <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo htmlspecialchars($importer->getInfo())?></p></li>
3612                         <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3613                         <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3614                 </ul>
3615
3616         <?php           $this->pagefoot();
3617
3618         }
3619
3620         /**
3621          * @todo document this
3622          */
3623         function action_skinieexport() {
3624                 global $member, $DIR_LIBS;
3625
3626                 $member->isAdmin() or $this->disallow();
3627
3628                 // load skinie class
3629                 include_once($DIR_LIBS . 'skinie.php');
3630
3631                 $aSkins = requestIntArray('skin');
3632                 $aTemplates = requestIntArray('template');
3633
3634                 if (!is_array($aTemplates)) $aTemplates = array();
3635                 if (!is_array($aSkins)) $aSkins = array();
3636
3637                 $skinList = array_keys($aSkins);
3638                 $templateList = array_keys($aTemplates);
3639
3640                 $info = postVar('info');
3641
3642                 $exporter =& new SKINEXPORT();
3643                 foreach ($skinList as $skinId) {
3644                         $exporter->addSkin($skinId);
3645                 }
3646                 foreach ($templateList as $templateId) {
3647                         $exporter->addTemplate($templateId);
3648                 }
3649                 $exporter->setInfo($info);
3650
3651                 $exporter->export();
3652         }
3653
3654         /**
3655          * @todo document this
3656          */
3657         function action_templateoverview() {
3658                 global $member, $manager;
3659
3660                 $member->isAdmin() or $this->disallow();
3661
3662                 $this->pagehead();
3663
3664                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3665
3666                 echo '<h2>' . _TEMPLATE_TITLE . '</h2>';
3667                 echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';
3668
3669                 $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';
3670                 $template['content'] = 'templatelist';
3671                 $template['tabindex'] = 10;
3672                 showlist($query,'table',$template);
3673
3674                 echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';
3675
3676                 ?>
3677                 <form method="post" action="index.php"><div>
3678
3679                 <input name="action" value="templatenew" type="hidden" />
3680                 <?php $manager->addTicketHidden() ?>
3681                 <table><tr>
3682                         <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3683                         <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
3684                 </tr><tr>
3685                         <td><?php echo _TEMPLATE_DESC?></td>
3686                         <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
3687                 </tr><tr>
3688                         <td><?php echo _TEMPLATE_CREATE?></td>
3689                         <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3690                 </tr></table>
3691
3692                 </div></form>
3693
3694                 <?php
3695                 $this->pagefoot();
3696         }
3697
3698         /**
3699          * @todo document this
3700          */
3701         function action_templateedit($msg = '') {
3702                 global $member, $manager;
3703
3704                 $templateid = intRequestVar('templateid');
3705
3706                 $member->isAdmin() or $this->disallow();
3707
3708                 $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';
3709                 $extrahead .= '<script type="text/javascript">setTemplateEditText("'.addslashes(_EDITTEMPLATE_EMPTY).'");</script>';
3710
3711                 $this->pagehead($extrahead);
3712
3713                 $templatename = TEMPLATE::getNameFromId($templateid);
3714                 $templatedescription = TEMPLATE::getDesc($templateid);
3715                 $template =& $manager->getTemplate($templatename);
3716
3717                 ?>
3718                 <p>
3719                 <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>
3720                 </p>
3721
3722                 <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  $templatename; ?>'</h2>
3723
3724                 <?php                                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
3725                 ?>
3726
3727                 <p><?php echo _TEMPLATE_EDIT_MSG?></p>
3728
3729                 <form method="post" action="index.php">
3730                 <div>
3731
3732                 <input type="hidden" name="action" value="templateupdate" />
3733                 <?php $manager->addTicketHidden() ?>
3734                 <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />
3735
3736                 <table><tr>
3737                         <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>
3738                 </tr><tr>
3739                         <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3740                         <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  htmlspecialchars($templatename) ?>" /></td>
3741                 </tr><tr>
3742                         <td><?php echo _TEMPLATE_DESC?></td>
3743                         <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  htmlspecialchars($templatedescription) ?>" /></td>
3744                 </tr><tr>
3745                         <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3746                 </tr><tr>
3747                         <td><?php echo _TEMPLATE_UPDATE?></td>
3748                         <td>
3749                                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3750                                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3751                         </td>
3752                 </tr><tr>
3753                         <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>
3754 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);
3755         $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);
3756         $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);
3757         $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);
3758         $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);
3759         $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);
3760 ?>
3761                 </tr><tr>
3762                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>
3763 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);
3764         $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);
3765         $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);
3766         $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);
3767         $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);
3768         $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);
3769         $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);
3770 ?>
3771                 </tr><tr>
3772                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>
3773 <?php
3774         $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);
3775 ?>
3776                 </tr><tr>
3777                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>
3778 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);
3779 ?>
3780                 </tr><tr>
3781                         <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>
3782 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);
3783         $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);
3784         $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);
3785 ?>
3786                 </tr><tr>
3787                         <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>
3788 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 160);
3789         $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 170);
3790         $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 180);
3791 ?>
3792                 </tr><tr>
3793                         <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>
3794 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 190);
3795         $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 200);
3796         $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 210);
3797         $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 220);
3798         $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 230);
3799 ?>
3800                 </tr><tr>
3801                         <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>
3802 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 240);
3803         $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 250);
3804         $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 260);
3805 ?>
3806                 </tr><tr>
3807                         <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>
3808 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',270);
3809         $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',280);
3810 ?>
3811                 </tr><tr>
3812                         <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3813                 </tr><tr>
3814                         <td><?php echo _TEMPLATE_UPDATE?></td>
3815                         <td>
3816                                 <input type="submit" tabindex="290" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3817                                 <input type="reset" tabindex="300" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3818                         </td>
3819                 </tr></table>
3820
3821                 </div>
3822                 </form>
3823                 <?php
3824                 $this->pagefoot();
3825         }
3826
3827         /**
3828          * @todo document this
3829          */
3830         function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {
3831                 static $count = 1;
3832         ?>
3833                 </tr><tr>
3834                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>
3835                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  htmlspecialchars($template[$name]); ?></textarea></td>
3836         <?php           $count++;
3837         }
3838
3839         /**
3840          * @todo document this
3841          */
3842         function action_templateupdate() {
3843                 global $member;
3844
3845                 $templateid = intRequestVar('templateid');
3846
3847                 $member->isAdmin() or $this->disallow();
3848
3849                 $name = postVar('tname');
3850                 $desc = postVar('tdesc');
3851
3852                 if (!isValidTemplateName($name))
3853                         $this->error(_ERROR_BADTEMPLATENAME);
3854
3855                 if ((TEMPLATE::getNameFromId($templateid) != $name) && TEMPLATE::exists($name))
3856                         $this->error(_ERROR_DUPTEMPLATENAME);
3857
3858
3859                 $name = addslashes($name);
3860                 $desc = addslashes($desc);
3861
3862                 // 1. Remove all template parts
3863                 $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;
3864                 sql_query($query);
3865
3866                 // 2. Update description
3867                 $query =  'UPDATE '.sql_table('template_desc').' SET'
3868                            . " tdname='" . $name . "',"
3869                            . " tddesc='" . $desc . "'"
3870                            . " WHERE tdnumber=" . $templateid;
3871                 sql_query($query);
3872
3873                 // 3. Add non-empty template parts
3874                 $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));
3875                 $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));
3876                 $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));
3877                 $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));
3878                 $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));
3879                 $this->addToTemplate($templateid, 'NEW', postVar('NEW'));
3880                 $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));
3881                 $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));
3882                 $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));
3883                 $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));
3884                 $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));
3885                 $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));
3886                 $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));
3887                 $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));
3888                 $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));
3889                 $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));
3890                 $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
3891                 $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));
3892                 $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));
3893                 $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));
3894                 $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));
3895                 $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));
3896                 $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));
3897                 $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));
3898                 $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));
3899                 $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));
3900                 $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));
3901                 $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
3902                 $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));
3903                 $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));
3904                 $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));
3905
3906
3907                 // jump back to template edit
3908                 $this->action_templateedit(_TEMPLATE_UPDATED);
3909
3910         }
3911
3912         /**
3913          * @todo document this
3914          */
3915         function addToTemplate($id, $partname, $content) {
3916                 $partname = addslashes($partname);
3917                 $content = addslashes($content);
3918
3919                 $id = intval($id);
3920
3921                 // don't add empty parts:
3922                 if (!trim($content)) return -1;
3923
3924                 $query = 'INSERT INTO '.sql_table('template')." (tdesc, tpartname, tcontent) "
3925                            . "VALUES ($id, '$partname', '$content')";
3926                 sql_query($query) or die("Query error: " . mysql_error());
3927                 return mysql_insert_id();
3928         }
3929
3930         /**
3931          * @todo document this
3932          */
3933         function action_templatedelete() {
3934                 global $member, $manager;
3935
3936                 $member->isAdmin() or $this->disallow();
3937
3938                 $templateid = intRequestVar('templateid');
3939                 // TODO: check if template can be deleted
3940
3941                 $this->pagehead();
3942
3943                 $name = TEMPLATE::getNameFromId($templateid);
3944                 $desc = TEMPLATE::getDesc($templateid);
3945
3946                 ?>
3947                         <h2><?php echo _DELETE_CONFIRM?></h2>
3948
3949                         <p>
3950                         <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo $name?></b> (<?php echo  htmlspecialchars($desc) ?>)
3951                         </p>
3952
3953                         <form method="post" action="index.php"><div>
3954                                 <input type="hidden" name="action" value="templatedeleteconfirm" />
3955                                 <?php $manager->addTicketHidden() ?>
3956                                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />
3957                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3958                         </div></form>
3959                 <?php
3960                 $this->pagefoot();
3961         }
3962
3963         /**
3964          * @todo document this
3965          */
3966         function action_templatedeleteconfirm() {
3967                 global $member, $manager;
3968
3969                 $templateid = intRequestVar('templateid');
3970
3971                 $member->isAdmin() or $this->disallow();
3972
3973                 $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));
3974
3975                 // 1. delete description
3976                 sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);
3977
3978                 // 2. delete parts
3979                 sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
3980
3981                 $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));
3982
3983                 $this->action_templateoverview();
3984         }
3985
3986         /**
3987          * @todo document this
3988          */
3989         function action_templatenew() {
3990                 global $member;
3991
3992                 $member->isAdmin() or $this->disallow();
3993
3994                 $name = postVar('name');
3995                 $desc = postVar('desc');
3996
3997                 if (!isValidTemplateName($name))
3998                         $this->error(_ERROR_BADTEMPLATENAME);
3999
4000                 if (TEMPLATE::exists($name))
4001                         $this->error(_ERROR_DUPTEMPLATENAME);
4002
4003                 $newTemplateId = TEMPLATE::createNew($name, $desc);
4004
4005                 $this->action_templateoverview();
4006         }
4007
4008         /**
4009          * @todo document this
4010          */
4011         function action_templateclone() {
4012                 global $member;
4013
4014                 $templateid = intRequestVar('templateid');
4015
4016                 $member->isAdmin() or $this->disallow();
4017
4018                 // 1. read old template
4019                 $name = TEMPLATE::getNameFromId($templateid);
4020                 $desc = TEMPLATE::getDesc($templateid);
4021
4022                 // 2. create desc thing
4023                 $name = "cloned" . $name;
4024
4025                 // if a template with that name already exists:
4026                 if (TEMPLATE::exists($name)) {
4027                         $i = 1;
4028                         while (TEMPLATE::exists($name . $i))
4029                                 $i++;
4030                         $name .= $i;
4031                 }
4032
4033                 $newid = TEMPLATE::createNew($name, $desc);
4034
4035                 // 3. create clone
4036                 // go through parts of old template and add them to the new one
4037                 $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4038                 while ($o = mysql_fetch_object($res)) {
4039                         $this->addToTemplate($newid, $o->tpartname, $o->tcontent);
4040                 }
4041
4042                 $this->action_templateoverview();
4043         }
4044
4045         /**
4046          * @todo document this
4047          */
4048         function action_skinoverview() {
4049                 global $member, $manager;
4050
4051                 $member->isAdmin() or $this->disallow();
4052
4053                 $this->pagehead();
4054
4055                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4056
4057                 echo '<h2>' . _SKIN_EDIT_TITLE . '</h2>';
4058
4059                 echo '<h3>' . _SKIN_AVAILABLE_TITLE . '</h3>';
4060
4061                 $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname';
4062                 $template['content'] = 'skinlist';
4063                 $template['tabindex'] = 10;
4064                 showlist($query,'table',$template);
4065
4066                 echo '<h3>' . _SKIN_NEW_TITLE . '</h3>';
4067
4068                 ?>
4069                 <form method="post" action="index.php">
4070                 <div>
4071
4072                 <input name="action" value="skinnew" type="hidden" />
4073                 <?php $manager->addTicketHidden() ?>
4074                 <table><tr>
4075                         <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4076                         <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
4077                 </tr><tr>
4078                         <td><?php echo _SKIN_DESC?></td>
4079                         <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
4080                 </tr><tr>
4081                         <td><?php echo _SKIN_CREATE?></td>
4082                         <td><input type="submit" tabindex="10030" value="<?php echo _SKIN_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
4083                 </tr></table>
4084
4085                 </div>
4086                 </form>
4087
4088                 <?php
4089                 $this->pagefoot();
4090         }
4091
4092         /**
4093          * @todo document this
4094          */
4095         function action_skinnew() {
4096                 global $member;
4097
4098                 $member->isAdmin() or $this->disallow();
4099
4100                 $name = trim(postVar('name'));
4101                 $desc = trim(postVar('desc'));
4102
4103                 if (!isValidSkinName($name))
4104                         $this->error(_ERROR_BADSKINNAME);
4105
4106                 if (SKIN::exists($name))
4107                         $this->error(_ERROR_DUPSKINNAME);
4108
4109                 $newId = SKIN::createNew($name, $desc);
4110
4111                 $this->action_skinoverview();
4112         }
4113
4114         /**
4115          * @todo document this
4116          */
4117         function action_skinedit() {
4118                 global $member, $manager;
4119
4120                 $skinid = intRequestVar('skinid');
4121
4122                 $member->isAdmin() or $this->disallow();
4123
4124                 $skin =& new SKIN($skinid);
4125
4126                 $this->pagehead();
4127                 ?>
4128                 <p>
4129                         <a href="index.php?action=skinoverview">(<?php echo _SKIN_BACK?>)</a>
4130                 </p>
4131                 <h2><?php echo _SKIN_EDITONE_TITLE?> '<?php echo  $skin->getName() ?>'</h2>
4132
4133                 <h3><?php echo _SKIN_PARTS_TITLE?></h3>
4134                 <?php echo _SKIN_PARTS_MSG?>
4135                 <ul>
4136                         <li><a tabindex="10" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=index"><?php echo _SKIN_PART_MAIN?></a> <?php help('skinpartindex')?></li>
4137                         <li><a tabindex="20" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=item"><?php echo _SKIN_PART_ITEM?></a> <?php help('skinpartitem')?></li>
4138                         <li><a tabindex="30" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archivelist"><?php echo _SKIN_PART_ALIST?></a> <?php help('skinpartarchivelist')?></li>
4139                         <li><a tabindex="40" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archive"><?php echo _SKIN_PART_ARCHIVE?></a> <?php help('skinpartarchive')?></li>
4140                         <li><a tabindex="50" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=search"><?php echo _SKIN_PART_SEARCH?></a> <?php help('skinpartsearch')?></li>
4141                         <li><a tabindex="60" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=error"><?php echo _SKIN_PART_ERROR?></a> <?php help('skinparterror')?></li>
4142                         <li><a tabindex="70" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=member"><?php echo _SKIN_PART_MEMBER?></a> <?php help('skinpartmember')?></li>
4143                         <li><a tabindex="75" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=imagepopup"><?php echo _SKIN_PART_POPUP?></a> <?php help('skinpartimagepopup')?></li>
4144                 </ul>
4145
4146                 <?php
4147
4148                 $query = "SELECT stype FROM " . sql_table('skin') . " WHERE stype NOT IN ('index', 'item', 'error', 'search', 'archive', 'archivelist', 'imagepopup', 'member') and sdesc = " . $skinid;
4149                 $res = sql_query($query);
4150
4151                 echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';
4152                 echo '<form method="get" action="index.php">' . "\r\n";
4153                 echo '<input type="hidden" name="action" value="skinedittype" />' . "\r\n";
4154                 echo '<input type="hidden" name="skinid" value="' . $skinid . '" />' . "\r\n";
4155                 echo '<input name="type" tabindex="89" size="20" maxlength="20" />' . "\r\n";
4156                 echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . '" onclick="return checkSubmit();" />' . "\r\n";
4157                 echo '</form>' . "\r\n";
4158
4159                 if ($res && mysql_num_rows($res) > 0) {
4160                         echo '<ul>';
4161                         $tabstart = 75;
4162
4163                         while ($row = mysql_fetch_assoc($res)) {
4164                                 echo '<li><a tabindex="' . ($tabstart++) . '" href="index.php?action=skinedittype&amp;skinid=' . $skinid . '&amp;type=' . strtolower($row['stype']) . '">' . ucfirst($row['stype']) . '</a> (<a tabindex="' . ($tabstart++) . '" href="index.php?action=skinremovetype&amp;skinid=' . $skinid . '&amp;type=' . strtolower($row['stype']) . '">remove</a>)</li>';
4165                         }
4166
4167                         echo '</ul>';
4168                 }
4169
4170                 ?>
4171
4172                 <h3><?php echo _SKIN_GENSETTINGS_TITLE; ?></h3>
4173                 <form method="post" action="index.php">
4174                 <div>
4175
4176                 <input type="hidden" name="action" value="skineditgeneral" />
4177                 <?php $manager->addTicketHidden() ?>
4178                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4179                 <table><tr>
4180                         <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4181                         <td><input name="name" tabindex="90" value="<?php echo  htmlspecialchars($skin->getName()) ?>" maxlength="20" size="20" /></td>
4182                 </tr><tr>
4183                         <td><?php echo _SKIN_DESC?></td>
4184                         <td><input name="desc" tabindex="100" value="<?php echo  htmlspecialchars($skin->getDescription()) ?>" maxlength="200" size="50" /></td>
4185                 </tr><tr>
4186                         <td><?php echo _SKIN_TYPE?></td>
4187                         <td><input name="type" tabindex="110" value="<?php echo  htmlspecialchars($skin->getContentType()) ?>" maxlength="40" size="20" /></td>
4188                 </tr><tr>
4189                         <td><?php echo _SKIN_INCLUDE_MODE?> <?php help('includemode')?></td>
4190                         <td><?php $this->input_yesno('inc_mode',$skin->getIncludeMode(),120,'skindir','normal',_PARSER_INCMODE_SKINDIR,_PARSER_INCMODE_NORMAL);?></td>
4191                 </tr><tr>
4192                         <td><?php echo _SKIN_INCLUDE_PREFIX?> <?php help('includeprefix')?></td>
4193                         <td><input name="inc_prefix" tabindex="130" value="<?php echo  htmlspecialchars($skin->getIncludePrefix()) ?>" maxlength="40" size="20" /></td>
4194                 </tr><tr>
4195                         <td><?php echo _SKIN_CHANGE?></td>
4196                         <td><input type="submit" tabindex="140" value="<?php echo _SKIN_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
4197                 </tr></table>
4198
4199                 </div>
4200                 </form>
4201
4202
4203                 <?php           $this->pagefoot();
4204         }
4205
4206         /**
4207          * @todo document this
4208          */
4209         function action_skineditgeneral() {
4210                 global $member;
4211
4212                 $skinid = intRequestVar('skinid');
4213
4214                 $member->isAdmin() or $this->disallow();
4215
4216                 $name = postVar('name');
4217                 $desc = postVar('desc');
4218                 $type = postVar('type');
4219                 $inc_mode = postVar('inc_mode');
4220                 $inc_prefix = postVar('inc_prefix');
4221
4222                 $skin =& new SKIN($skinid);
4223
4224                 // 1. Some checks
4225                 if (!isValidSkinName($name))
4226                         $this->error(_ERROR_BADSKINNAME);
4227
4228                 if (($skin->getName() != $name) && SKIN::exists($name))
4229                         $this->error(_ERROR_DUPSKINNAME);
4230
4231                 if (!$type) $type = 'text/html';
4232                 if (!$inc_mode) $inc_mode = 'normal';
4233
4234                 // 2. Update description
4235                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
4236
4237                 $this->action_skinedit();
4238
4239         }
4240
4241         /**
4242          * @todo document this
4243          */
4244         function action_skinedittype($msg = '') {
4245                 global $member, $manager;
4246
4247                 $skinid = intRequestVar('skinid');
4248                 $type = requestVar('type');
4249
4250                 $member->isAdmin() or $this->disallow();
4251
4252                 $type = trim($type);
4253                 $type = strtolower($type);
4254
4255                 if (!isValidShortName($type)) {
4256                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
4257                 }
4258
4259                 $skin =& new SKIN($skinid);
4260
4261                 $friendlyNames = SKIN::getFriendlyNames();
4262
4263                 $this->pagehead();
4264                 ?>
4265                 <p>(<a href="index.php?action=skinoverview"><?php echo _SKIN_GOBACK?></a>)</p>
4266
4267                 <h2><?php echo _SKIN_EDITPART_TITLE?> '<?php echo  $skin->getName() ?>': <?php echo (isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?></h2>
4268
4269                 <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
4270                 ?>
4271
4272
4273                 <form method="post" action="index.php">
4274                 <div>
4275
4276                 <input type="hidden" name="action" value="skinupdate" />
4277                 <?php $manager->addTicketHidden() ?>
4278                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4279                 <input type="hidden" name="type" value="<?php echo  $type ?>" />
4280
4281                 <input type="submit" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4282                 <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4283                 (skin type: <?php echo (isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4284                 <?php help('skinpart' . $type);?>
4285                 <br />
4286
4287                 <textarea class="skinedit" tabindex="10" rows="20" cols="80" name="content"><?php echo  htmlspecialchars($skin->getContent($type)) ?></textarea>
4288
4289                 <br />
4290                 <input type="submit" tabindex="20" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4291                 <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4292                 (skin type: <?php echo (isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4293
4294                 <br /><br />
4295                 <?php echo _SKIN_ALLOWEDVARS?>
4296                 <?php                   $actions = SKIN::getAllowedActionsForType($type);
4297
4298                         sort($actions);
4299
4300                         while ($current = array_shift($actions)) {
4301                                 // skip deprecated vars
4302                                 if ($current == 'ifcat') continue;
4303                                 if ($current == 'imagetext') continue;
4304                                 if ($current == 'vars') continue;
4305
4306                                 echo helplink('skinvar-' . $current) . "$current</a>";
4307                                 if (count($actions) != 0) echo ", ";
4308                         }
4309                 ?>
4310                 <br /><br />
4311                 Short blog names:
4312                 <?php                   $query = 'SELECT bshortname, bname FROM '.sql_table('blog');
4313                         showlist($query,'table',array('content'=>'shortblognames'));
4314                 ?>
4315
4316                 <br />
4317                 Template names:
4318                 <?php                   $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');
4319                         showlist($query,'table',array('content'=>'shortnames'));
4320                 ?>
4321
4322
4323                 </div>
4324                 </form>
4325
4326
4327                 <?php           $this->pagefoot();
4328         }
4329
4330         /**
4331          * @todo document this
4332          */
4333         function action_skinupdate() {
4334                 global $member;
4335
4336                 $skinid = intRequestVar('skinid');
4337                 $content = trim(postVar('content'));
4338                 $type = postVar('type');
4339
4340                 $member->isAdmin() or $this->disallow();
4341
4342                 $skin =& new SKIN($skinid);
4343                 $skin->update($type, $content);
4344
4345                 $this->action_skinedittype(_SKIN_UPDATED);
4346         }
4347
4348         /**
4349          * @todo document this
4350          */
4351         function action_skindelete() {
4352                 global $member, $manager, $CONF;
4353
4354                 $skinid = intRequestVar('skinid');
4355
4356                 $member->isAdmin() or $this->disallow();
4357
4358                 // don't allow default skin to be deleted
4359                 if ($skinid == $CONF['BaseSkin'])
4360                         $this->error(_ERROR_DEFAULTSKIN);
4361
4362                 // don't allow deletion of default skins for blogs
4363                 $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4364                 $r = sql_query($query);
4365                 if ($o = mysql_fetch_object($r))
4366                         $this->error(_ERROR_SKINDEFDELETE . $o->bname);
4367
4368                 $this->pagehead();
4369
4370                 $skin =& new SKIN($skinid);
4371                 $name = $skin->getName();
4372                 $desc = $skin->getDescription();
4373
4374                 ?>
4375                         <h2><?php echo _DELETE_CONFIRM?></h2>
4376
4377                         <p>
4378                                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo  $name ?></b> (<?php echo  htmlspecialchars($desc)?>)
4379                         </p>
4380
4381                         <form method="post" action="index.php"><div>
4382                                 <input type="hidden" name="action" value="skindeleteconfirm" />
4383                                 <?php $manager->addTicketHidden() ?>
4384                                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4385                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4386                         </div></form>
4387                 <?php
4388                 $this->pagefoot();
4389         }
4390
4391         /**
4392          * @todo document this
4393          */
4394         function action_skindeleteconfirm() {
4395                 global $member, $CONF, $manager;
4396
4397                 $skinid = intRequestVar('skinid');
4398
4399                 $member->isAdmin() or $this->disallow();
4400
4401                 // don't allow default skin to be deleted
4402                 if ($skinid == $CONF['BaseSkin'])
4403                         $this->error(_ERROR_DEFAULTSKIN);
4404
4405                 // don't allow deletion of default skins for blogs
4406                 $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4407                 $r = sql_query($query);
4408                 if ($o = mysql_fetch_object($r))
4409                         $this->error(_ERROR_SKINDEFDELETE .$o->bname);
4410
4411                 $manager->notify('PreDeleteSkin', array('skinid' => $skinid));
4412
4413                 // 1. delete description
4414                 sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);
4415
4416                 // 2. delete parts
4417                 sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);
4418
4419                 $manager->notify('PostDeleteSkin', array('skinid' => $skinid));
4420
4421                 $this->action_skinoverview();
4422         }
4423
4424         /**
4425          * @todo document this
4426          */
4427         function action_skinremovetype() {
4428                 global $member, $manager, $CONF;
4429
4430                 $skinid = intRequestVar('skinid');
4431                 $skintype = requestVar('type');
4432
4433                 if (!isValidShortName($skintype)) {
4434                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4435                 }
4436
4437                 $member->isAdmin() or $this->disallow();
4438
4439                 // don't allow default skinparts to be deleted
4440                 if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4441                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4442                 }
4443
4444                 $this->pagehead();
4445
4446                 $skin =& new SKIN($skinid);
4447                 $name = $skin->getName();
4448                 $desc = $skin->getDescription();
4449
4450                 ?>
4451                         <h2><?php echo _DELETE_CONFIRM?></h2>
4452
4453                         <p>
4454                                 <?php echo _CONFIRMTXT_SKIN_PARTS_SPECIAL; ?> <b><?php echo $skintype; ?> (<?php echo $name; ?>)</b> (<?php echo  htmlspecialchars($desc)?>)
4455                         </p>
4456
4457                         <form method="post" action="index.php"><div>
4458                                 <input type="hidden" name="action" value="skinremovetypeconfirm" />
4459                                 <?php $manager->addTicketHidden() ?>
4460                                 <input type="hidden" name="skinid" value="<?php echo $skinid; ?>" />
4461                                 <input type="hidden" name="type" value="<?php echo $skintype; ?>" />
4462                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4463                         </div></form>
4464                 <?php
4465                 $this->pagefoot();
4466         }
4467
4468         /**
4469          * @todo document this
4470          */
4471         function action_skinremovetypeconfirm() {
4472                 global $member, $CONF, $manager;
4473
4474                 $skinid = intRequestVar('skinid');
4475                 $skintype = requestVar('type');
4476
4477                 if (!isValidShortName($skintype)) {
4478                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4479                 }
4480
4481                 $member->isAdmin() or $this->disallow();
4482
4483                 // don't allow default skinparts to be deleted
4484                 if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4485                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4486                 }
4487
4488                 $manager->notify('PreDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4489
4490                 // delete part
4491                 sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid . ' AND stype=\'' . $skintype . '\'');
4492
4493                 $manager->notify('PostDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4494
4495                 $this->action_skinedit();
4496         }
4497
4498         /**
4499          * @todo document this
4500          */
4501         function action_skinclone() {
4502                 global $member;
4503
4504                 $skinid = intRequestVar('skinid');
4505
4506                 $member->isAdmin() or $this->disallow();
4507
4508                 // 1. read skin to clone
4509                 $skin =& new SKIN($skinid);
4510
4511                 $name = "clone_" . $skin->getName();
4512
4513                 // if a skin with that name already exists:
4514                 if (SKIN::exists($name)) {
4515                         $i = 1;
4516                         while (SKIN::exists($name . $i))
4517                                 $i++;
4518                         $name .= $i;
4519                 }
4520
4521                 // 2. create skin desc
4522                 $newid = SKIN::createNew(
4523                         $name,
4524                         $skin->getDescription(),
4525                         $skin->getContentType(),
4526                         $skin->getIncludeMode(),
4527                         $skin->getIncludePrefix()
4528                 );
4529
4530
4531                 // 3. clone
4532                 /*
4533                 $this->skinclonetype($skin, $newid, 'index');
4534                 $this->skinclonetype($skin, $newid, 'item');
4535                 $this->skinclonetype($skin, $newid, 'archivelist');
4536                 $this->skinclonetype($skin, $newid, 'archive');
4537                 $this->skinclonetype($skin, $newid, 'search');
4538                 $this->skinclonetype($skin, $newid, 'error');
4539                 $this->skinclonetype($skin, $newid, 'member');
4540                 $this->skinclonetype($skin, $newid, 'imagepopup');
4541                 */
4542
4543                 $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;
4544                 $res = sql_query($query);
4545                 while ($row = mysql_fetch_assoc($res)) {
4546                         $this->skinclonetype($skin, $newid, $row['stype']);
4547                 }
4548
4549                 $this->action_skinoverview();
4550
4551         }
4552
4553         /**
4554          * @todo document this
4555          */
4556         function skinclonetype($skin, $newid, $type) {
4557                 $newid = intval($newid);
4558                 $content = $skin->getContent($type);
4559                 if ($content) {
4560                         $query = 'INSERT INTO '.sql_table('skin')." (sdesc, scontent, stype) VALUES ($newid,'". addslashes($content)."', '". addslashes($type)."')";
4561                         sql_query($query);
4562                 }
4563         }
4564
4565         /**
4566          * @todo document this
4567          */
4568         function action_settingsedit() {
4569                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4570
4571                 $member->isAdmin() or $this->disallow();
4572
4573                 $this->pagehead();
4574
4575                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4576                 ?>
4577
4578                 <h2><?php echo _SETTINGS_TITLE?></h2>
4579
4580                 <form action="index.php" method="post">
4581                 <div>
4582
4583                 <input type="hidden" name="action" value="settingsupdate" />
4584                 <?php $manager->addTicketHidden() ?>
4585
4586                 <table><tr>
4587                         <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>
4588                 </tr><tr>
4589                         <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>
4590                         <td>
4591                                 <?php
4592                                         $query =  'SELECT bname as text, bnumber as value'
4593                                                    . ' FROM '.sql_table('blog');
4594                                         $template['name'] = 'DefaultBlog';
4595                                         $template['selected'] = $CONF['DefaultBlog'];
4596                                         $template['tabindex'] = 10;
4597                                         showlist($query,'select',$template);
4598                                 ?>
4599                         </td>
4600                 </tr><tr>
4601                         <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>
4602                         <td>
4603                                 <?php
4604                                         $query =  'SELECT sdname as text, sdnumber as value'
4605                                                    . ' FROM '.sql_table('skin_desc');
4606                                         $template['name'] = 'BaseSkin';
4607                                         $template['selected'] = $CONF['BaseSkin'];
4608                                         $template['tabindex'] = 1;
4609                                         showlist($query,'select',$template);
4610                                 ?>
4611                         </td>
4612                 </tr><tr>
4613                         <td><?php echo _SETTINGS_ADMINMAIL?></td>
4614                         <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  htmlspecialchars($CONF['AdminEmail']) ?>" /></td>
4615                 </tr><tr>
4616                         <td><?php echo _SETTINGS_SITENAME?></td>
4617                         <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  htmlspecialchars($CONF['SiteName']) ?>" /></td>
4618                 </tr><tr>
4619                         <td><?php echo _SETTINGS_SITEURL?></td>
4620                         <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  htmlspecialchars($CONF['IndexURL']) ?>" /></td>
4621                 </tr><tr>
4622                         <td><?php echo _SETTINGS_ADMINURL?></td>
4623                         <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  htmlspecialchars($CONF['AdminURL']) ?>" /></td>
4624                 </tr><tr>
4625                         <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>
4626                         <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  htmlspecialchars($CONF['PluginURL']) ?>" /></td>
4627                 </tr><tr>
4628                         <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>
4629                         <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  htmlspecialchars($CONF['SkinsURL']) ?>" /></td>
4630                 </tr><tr>
4631                         <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>
4632                         <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  htmlspecialchars($CONF['ActionURL']) ?>" /></td>
4633                 </tr><tr>
4634                         <td><?php echo _SETTINGS_LANGUAGE?> <?php help('language'); ?>
4635                         </td>
4636                         <td>
4637
4638                                 <select name="Language" tabindex="10050">
4639                                 <?php                           // show a dropdown list of all available languages
4640                                 global $DIR_LANG;
4641                                 $dirhandle = opendir($DIR_LANG);
4642                                 while ($filename = readdir($dirhandle)) {
4643                                         if (ereg("^(.*)\.php$",$filename,$matches)) {
4644                                                 $name = $matches[1];
4645                                                 echo "<option value='$name'";
4646                                                 if ($name == $CONF['Language'])
4647                                                         echo " selected='selected'";
4648                                                 echo ">$name</option>";
4649                                         }
4650                                 }
4651                                 closedir($dirhandle);
4652
4653                                 ?>
4654                                 </select>
4655
4656                         </td>
4657                 </tr><tr>
4658                         <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>
4659                         </td>
4660                         <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>
4661                                         <br />
4662                                 URL: <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  htmlspecialchars($CONF['DisableSiteURL'])?>" />
4663                         </td>
4664                 </tr><tr>
4665                         <td><?php echo _SETTINGS_DIRS?></td>
4666                         <td><?php echo  htmlspecialchars($DIR_NUCLEUS) ?>
4667                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4668                 </tr><tr>
4669                         <td><?php echo _SETTINGS_DBLOGIN?></td>
4670                         <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4671                 </tr><tr>
4672                         <td>
4673                         <?php
4674                                 echo _SETTINGS_JSTOOLBAR
4675                                 /* =_SETTINGS_DISABLEJS
4676
4677                                         I temporary changed the meaning of DisableJsTools, until I can find a good
4678                                         way to select the javascript version to use
4679
4680                                         now, its:
4681                                                 0 : IE
4682                                                 1 : all javascript disabled
4683                                                 2 : 'simpler' javascript (for mozilla/opera/mac)
4684                                 */
4685                            ?>
4686                         </td>
4687                         <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>
4688                                 <select name="DisableJsTools" tabindex="10075">
4689                         <?php                                   $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';
4690                                         echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";
4691                                         $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';
4692                                         echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";
4693                                         $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';
4694                                         echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";
4695                         ?>
4696                                 </select>
4697                         </td>
4698                 </tr><tr>
4699                         <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>
4700                                            <td><?php
4701
4702                                            $this->input_yesno('URLMode',$CONF['URLMode'],10077,
4703                                                           'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);
4704
4705                                            echo ' ', _SETTINGS_URLMODE_HELP;
4706
4707                                                          ?>
4708
4709                                            </td>
4710                 </tr><tr>
4711                         <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>
4712                 </tr><tr>
4713                         <td><?php echo _SETTINGS_MEDIADIR?></td>
4714                         <td><?php echo  htmlspecialchars($DIR_MEDIA) ?>
4715                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>
4716                                 <?php                           if (!is_dir($DIR_MEDIA))
4717                                                 echo "<br /><b>" . _WARNING_NOTADIR . "</b>";
4718                                         if (!is_readable($DIR_MEDIA))
4719                                                 echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";
4720                                         if (!is_writeable($DIR_MEDIA))
4721                                                 echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";
4722                                 ?>
4723                         </td>
4724                 </tr><tr>
4725                         <td><?php echo _SETTINGS_MEDIAURL?></td>
4726                         <td>
4727                                 <input name="MediaURL" tabindex="10080" size="40" value="<?php echo  htmlspecialchars($CONF['MediaURL']) ?>" />
4728                         </td>
4729                 </tr><tr>
4730                         <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>
4731                         <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>
4732                 </tr><tr>
4733                         <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>
4734                         <td>
4735                                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  htmlspecialchars($CONF['AllowedTypes']) ?>" />
4736                         </td>
4737                 </tr><tr>
4738                         <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>
4739                         <td>
4740                                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  htmlspecialchars($CONF['MaxUploadSize']) ?>" />
4741                         </td>
4742                 </tr><tr>
4743                         <td><?php echo _SETTINGS_MEDIAPREFIX?></td>
4744                         <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>
4745
4746                 </tr><tr>
4747                         <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>
4748                 </tr><tr>
4749                         <td><?php echo _SETTINGS_CHANGELOGIN?></td>
4750                         <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>
4751                 </tr><tr>
4752                         <td><?php echo _SETTINGS_ALLOWCREATE?>
4753                                 <?php help('allowaccountcreation'); ?>
4754                         </td>
4755                         <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>
4756                         </td>
4757                 </tr><tr>
4758                         <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>
4759                                 <br /><?php echo _SETTINGS_NEWLOGIN2?>
4760                         </td>
4761                         <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>
4762                         </td>
4763                 </tr><tr>
4764                         <td><?php echo _SETTINGS_MEMBERMSGS?>
4765                                 <?php help('messageservice'); ?>
4766                         </td>
4767                         <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>
4768                         </td>
4769                 </tr><tr>
4770                         <td><?php echo _SETTINGS_NONMEMBERMSGS?>
4771                                 <?php help('messageservice'); ?>
4772                         </td>
4773                         <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>
4774                         </td>
4775                 </tr><tr>
4776                         <td><?php echo _SETTINGS_PROTECTMEMNAMES?>
4777                                 <?php help('protectmemnames'); ?>
4778                         </td>
4779                         <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>
4780                         </td>
4781
4782
4783
4784                 </tr><tr>
4785                         <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>
4786                 </tr><tr>
4787                         <td><?php echo _SETTINGS_COOKIEPREFIX?></td>
4788                         <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  htmlspecialchars($CONF['CookiePrefix'])?>" /></td>
4789                 </tr><tr>
4790                         <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>
4791                         <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  htmlspecialchars($CONF['CookieDomain'])?>" /></td>
4792                 </tr><tr>
4793                         <td><?php echo _SETTINGS_COOKIEPATH?></td>
4794                         <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  htmlspecialchars($CONF['CookiePath'])?>" /></td>
4795                 </tr><tr>
4796                         <td><?php echo _SETTINGS_COOKIESECURE?></td>
4797                         <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>
4798                 </tr><tr>
4799                         <td><?php echo _SETTINGS_COOKIELIFE?></td>
4800                         <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,
4801                                                           1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>
4802                         </td>
4803                 </tr><tr>
4804                         <td><?php echo _SETTINGS_LASTVISIT?></td>
4805                         <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>
4806
4807
4808
4809                 </tr><tr>
4810                         <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>
4811                 </tr><tr>
4812                         <td><?php echo _SETTINGS_UPDATE?></td>
4813                         <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>
4814                 </tr></table>
4815
4816                 </div>
4817                 </form>
4818
4819                 <?php
4820                         echo '<h2>',_PLUGINS_EXTRA,'</h2>';
4821
4822                         $manager->notify(
4823                                 'GeneralSettingsFormExtras',
4824                                 array()
4825                         );
4826
4827                 $this->pagefoot();
4828         }
4829
4830         /**
4831          * @todo document this
4832          */
4833         function action_settingsupdate() {
4834                 global $member, $CONF;
4835
4836                 $member->isAdmin() or $this->disallow();
4837
4838                 // check if email address for admin is valid
4839                 if (!isValidMailAddress(postVar('AdminEmail')))
4840                         $this->error(_ERROR_BADMAILADDRESS);
4841
4842
4843                 // save settings
4844                 $this->updateConfig('DefaultBlog',              postVar('DefaultBlog'));
4845                 $this->updateConfig('BaseSkin',                 postVar('BaseSkin'));
4846                 $this->updateConfig('IndexURL',                 postVar('IndexURL'));
4847                 $this->updateConfig('AdminURL',                 postVar('AdminURL'));
4848                 $this->updateConfig('PluginURL',                postVar('PluginURL'));
4849                 $this->updateConfig('SkinsURL',                 postVar('SkinsURL'));
4850                 $this->updateConfig('ActionURL',                postVar('ActionURL'));
4851                 $this->updateConfig('Language',                 postVar('Language'));
4852                 $this->updateConfig('AdminEmail',               postVar('AdminEmail'));
4853                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));
4854                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));
4855                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));
4856                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));
4857                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));
4858                 $this->updateConfig('SiteName',                 postVar('SiteName'));
4859                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));
4860                 $this->updateConfig('DisableSite',              postVar('DisableSite'));
4861                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));
4862                 $this->updateConfig('LastVisit',                postVar('LastVisit'));
4863                 $this->updateConfig('MediaURL',                 postVar('MediaURL'));
4864                 $this->updateConfig('AllowedTypes',             postVar('AllowedTypes'));
4865                 $this->updateConfig('AllowUpload',              postVar('AllowUpload'));
4866                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));
4867                 $this->updateConfig('MediaPrefix',              postVar('MediaPrefix'));
4868                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));
4869                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));
4870                 $this->updateConfig('CookieDomain',             postVar('CookieDomain'));
4871                 $this->updateConfig('CookiePath',               postVar('CookiePath'));
4872                 $this->updateConfig('CookieSecure',             postVar('CookieSecure'));
4873                 $this->updateConfig('URLMode',                  postVar('URLMode'));
4874                 $this->updateConfig('CookiePrefix',             postVar('CookiePrefix'));
4875
4876                 // load new config and redirect (this way, the new language will be used is necessary)
4877                 // note that when changing cookie settings, this redirect might cause the user
4878                 // to have to log in again.
4879                 getConfig();
4880                 redirect($CONF['AdminURL'] . '?action=manage');
4881                 exit;
4882
4883         }
4884
4885         /**
4886          * @todo document this
4887          */
4888         function updateConfig($name, $val) {
4889                 $name = addslashes($name);
4890                 $val = trim(addslashes($val));
4891
4892                 $query = 'UPDATE '.sql_table('config')
4893                            . " SET value='$val'"
4894                            . " WHERE name='$name'";
4895
4896                 sql_query($query) or die("Query error: " . mysql_error());
4897                 return mysql_insert_id();
4898         }
4899
4900         /**
4901          * Error message
4902          * @param string $msg message that will be shown
4903          */
4904         function error($msg) {
4905                 $this->pagehead();
4906                 ?>
4907                 <h2>Error!</h2>
4908                 <?php           echo $msg;
4909                 echo "<br />";
4910                 echo "<a href='index.php' onclick='history.back()'>"._BACK."</a>";
4911                 $this->pagefoot();
4912                 exit;
4913         }
4914
4915         /**
4916          * @todo document this
4917          */
4918         function disallow() {
4919                 ACTIONLOG::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
4920
4921                 $this->error(_ERROR_DISALLOWED);
4922         }
4923
4924         /**
4925          * @todo document this
4926          */
4927         function pagehead($extrahead = '') {
4928                 global $member, $nucleus, $CONF, $manager;
4929
4930                 $manager->notify(
4931                         'AdminPrePageHead',
4932                         array(
4933                                 'extrahead' => &$extrahead,
4934                                 'action' => $this->action
4935                         )
4936                 );
4937
4938                 $baseUrl = htmlspecialchars($CONF['AdminURL']);
4939
4940                 ?>
4941                 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4942                 <html xmlns="http://www.w3.org/1999/xhtml">
4943                 <head>
4944                         <meta http-equiv="Content-Type" content="text/html; charset=<?php echo _CHARSET ?>" />
4945                         <title><?php echo htmlspecialchars($CONF['SiteName'])?> - Admin</title>
4946                         <link rel="stylesheet" title="Nucleus Admin Default" type="text/css" href="<?php echo $baseUrl?>styles/admin.css" />
4947                         <link rel="stylesheet" title="Nucleus Admin Default" type="text/css"
4948                         href="<?php echo $baseUrl?>styles/addedit.css" />
4949
4950                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/edit.js"></script>
4951                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/admin.js"></script>
4952                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/compatibility.js"></script>
4953
4954           <meta http-equiv='Pragma' content='no-cache' />
4955           <meta http-equiv='Cache-Control' content='no-cache, must-revalidate' />
4956           <meta http-equiv='Expires' content='-1' />
4957
4958                         <?php echo $extrahead?>
4959                 </head>
4960                 <body>
4961                 <div class="header">
4962                 <h1><?php echo htmlspecialchars($CONF['SiteName'])?></h1>
4963                 </div>
4964                 <div id="container">
4965                 <div id="content">
4966                 <div class="loginname">
4967                 <?php                   if ($member->isLoggedIn())
4968                                 echo _LOGGEDINAS . ' ' . $member->getDisplayName()
4969                                         ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a>"
4970                                         . "<br /><a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";
4971                         else
4972                                 echo '<a href="index.php?action=showlogin" title="Log in">' , _NOTLOGGEDIN , '</a> <br />';
4973
4974                         echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a>";
4975
4976                         echo '<br />(';
4977
4978                         // Note(JP): disabled code name description
4979 /*
4980                         if ($member->isLoggedIn() && $member->isAdmin())
4981                                 echo '<a href="http://nucleuscms.org/version.php?v=',getNucleusVersion(),'&amp;pl=',getNucleusPatchLevel(),'" title="Check for upgrade">Nucleus CMS ', $nucleus['version'], ' &quot;', $nucleus['codename'], '&quot;</a>';
4982                         else
4983                                 echo 'Nucleus CMS ', $nucleus['version'], ' &quot;', $nucleus['codename'], '&quot;';
4984 */
4985                         if ($member->isLoggedIn() && $member->isAdmin())
4986                                 echo '<a href="http://nucleuscms.org/version.php?v=',getNucleusVersion(),'&amp;pl=',getNucleusPatchLevel(),'" title="Check for upgrade">Nucleus CMS ', $nucleus['version'], ' </a>';
4987                         else
4988                                 echo 'Nucleus CMS ', $nucleus['version'];
4989                         echo ')';
4990                 echo '</div>';
4991         }
4992
4993         /**
4994          * @todo document this
4995          */
4996         function pagefoot() {
4997                 global $action, $member, $manager;
4998
4999                 $manager->notify(
5000                         'AdminPrePageFoot',
5001                         array(
5002                                 'action' => $this->action
5003                         )
5004                 );
5005
5006                 if ($member->isLoggedIn() && ($action != 'showlogin')) {
5007                         ?>
5008                         <h2><?php echo  _LOGOUT ?></h2>
5009                         <ul>
5010                                 <li><a href="index.php?action=overview"><?php echo  _BACKHOME?></a></li>
5011                                 <li><a href='index.php?action=logout'><?php echo  _LOGOUT?></a></li>
5012                         </ul>
5013                         <?php           }
5014                 ?>
5015                         <div class="foot">
5016                                 <a href="http://nucleuscms.org/">Nucleus CMS</a> &copy; 2002-<?php echo date('Y'); ?> The Nucleus Group
5017                                 -
5018                                 <a href="http://nucleuscms.org/donate.php">Donate!</a>
5019                         </div>
5020
5021                         </div><!-- content -->
5022
5023                         <div id="quickmenu">
5024
5025                                 <?php                           // ---- user settings ----
5026                                 if (($action != 'showlogin') && ($member->isLoggedIn())) {
5027                                         echo '<ul>';
5028                                         echo '<li><a href="index.php?action=overview">',_QMENU_HOME,'</a></li>';
5029                                         echo '</ul>';
5030
5031                                         echo '<h2>',_QMENU_ADD,'</h2>';
5032                                         echo '<form method="get" action="index.php"><div>';
5033                                         echo '<input type="hidden" name="action" value="createitem" />';
5034
5035                                                 $showAll = requestVar('showall');
5036                                                 if (($member->isAdmin()) && ($showAll == 'yes')) {
5037                                                         // Super-Admins have access to all blogs! (no add item support though)
5038                                                         $query =  'SELECT bnumber as value, bname as text'
5039                                                                    . ' FROM ' . sql_table('blog')
5040                                                                    . ' ORDER BY bname';
5041                                                 } else {
5042                                                         $query =  'SELECT bnumber as value, bname as text'
5043                                                                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
5044                                                                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
5045                                                                    . ' ORDER BY bname';
5046                                                 }
5047                                                 $template['name'] = 'blogid';
5048                                                 $template['tabindex'] = 15000;
5049                                                 $template['extra'] = _QMENU_ADD_SELECT;
5050                                                 $template['selected'] = -1;
5051                                                 $template['shorten'] = 10;
5052                                                 $template['shortenel'] = '';
5053                                                 $template['javascript'] = 'onchange="return form.submit()"';
5054                                                 showlist($query,'select',$template);
5055
5056                                         echo '</div></form>';
5057
5058                                         echo '<h2>' . $member->getDisplayName(). '</h2>';
5059                                         echo '<ul>';
5060                                         echo '<li><a href="index.php?action=editmembersettings">',_QMENU_USER_SETTINGS,'</a></li>';
5061                                         echo '<li><a href="index.php?action=browseownitems">',_QMENU_USER_ITEMS,'</a></li>';
5062                                         echo '<li><a href="index.php?action=browseowncomments">',_QMENU_USER_COMMENTS,'</a></li>';
5063                                         echo '</ul>';
5064
5065
5066
5067
5068                                         // ---- general settings ----
5069                                         if ($member->isAdmin()) {
5070
5071                                                 echo '<h2>',_QMENU_MANAGE,'</h2>';
5072
5073                                                 echo '<ul>';
5074                                                 echo '<li><a href="index.php?action=actionlog">',_QMENU_MANAGE_LOG,'</a></li>';
5075                                                 echo '<li><a href="index.php?action=settingsedit">',_QMENU_MANAGE_SETTINGS,'</a></li>';
5076                                                 echo '<li><a href="index.php?action=usermanagement">',_QMENU_MANAGE_MEMBERS,'</a></li>';
5077                                                 echo '<li><a href="index.php?action=createnewlog">',_QMENU_MANAGE_NEWBLOG,'</a></li>';
5078                                                 echo '<li><a href="index.php?action=backupoverview">',_QMENU_MANAGE_BACKUPS,'</a></li>';
5079                                                 echo '<li><a href="index.php?action=pluginlist">',_QMENU_MANAGE_PLUGINS,'</a></li>';
5080                                                 echo '</ul>';
5081
5082                                                 echo '<h2>',_QMENU_LAYOUT,'</h2>';
5083                                                 echo '<ul>';
5084                                                 echo '<li><a href="index.php?action=skinoverview">',_QMENU_LAYOUT_SKINS,'</a></li>';
5085                                                 echo '<li><a href="index.php?action=templateoverview">',_QMENU_LAYOUT_TEMPL,'</a></li>';
5086                                                 echo '<li><a href="index.php?action=skinieoverview">',_QMENU_LAYOUT_IEXPORT,'</a></li>';
5087                                                 echo '</ul>';
5088
5089                                         }
5090
5091                                         $aPluginExtras = array();
5092                                         $manager->notify(
5093                                                 'QuickMenu',
5094                                                 array(
5095                                                         'options' => &$aPluginExtras
5096                                                 )
5097                                         );
5098                                         if (count($aPluginExtras) > 0)
5099                                         {
5100                                                 echo '<h2>', _QMENU_PLUGINS, '</h2>';
5101                                                 echo '<ul>';
5102                                                 foreach ($aPluginExtras as $aInfo)
5103                                                 {
5104                                                         echo '<li><a href="'.htmlspecialchars($aInfo['url']).'" title="'.htmlspecialchars($aInfo['tooltip']).'">'.htmlspecialchars($aInfo['title']).'</a></li>';
5105                                                 }
5106                                                 echo '</ul>';
5107                                         }
5108
5109                                 } else if (($action == 'activate') || ($action == 'activatesetpwd')) {
5110
5111                                         echo '<h2>', _QMENU_ACTIVATE, '</h2>', _QMENU_ACTIVATE_TEXT;
5112                                 } else {
5113                                         // introduction text on login screen
5114                                         echo '<h2>', _QMENU_INTRO, '</h2>', _QMENU_INTRO_TEXT;
5115                                 }
5116                                 ?>
5117                         </div>
5118
5119                         <!-- content / quickmenu container -->
5120                         </div>
5121
5122
5123                         </body>
5124                         </html>
5125                 <?php   }
5126
5127         /**
5128          * @todo document this
5129          */
5130         function action_regfile() {
5131                 global $member, $CONF;
5132
5133                 $blogid = intRequestVar('blogid');
5134
5135                 $member->teamRights($blogid) or $this->disallow();
5136
5137                 // header-code stolen from phpMyAdmin
5138                 // REGEDIT and bookmarklet code stolen from GreyMatter
5139
5140                 $sjisBlogName = getBlogNameFromID($blogid);
5141                 $sjisBlogName = mb_convert_encoding($sjisBlogName, "SJIS", "auto");
5142
5143                 header('Content-Type: application/octetstream');
5144                 header('Content-Disposition: filename="nucleus.reg"');
5145                 header('Pragma: no-cache');
5146                 header('Expires: 0');
5147
5148                 echo "REGEDIT4\n";
5149                 echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\Post To &Nucleus (".$sjisBlogName.")]\n";
5150                 echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";
5151                 echo '"contexts"=hex:31';
5152         }
5153
5154         /**
5155          * @todo document this
5156          */
5157         function action_bookmarklet() {
5158                 global $member, $manager;
5159
5160                 $blogid = intRequestVar('blogid');
5161
5162                 $member->teamRights($blogid) or $this->disallow();
5163
5164                 $blog =& $manager->getBlog($blogid);
5165                 $bm = getBookmarklet($blogid);
5166
5167                 $this->pagehead();
5168
5169                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5170
5171                 ?>
5172
5173                 <h2>Bookmarklet<!-- and Right Click Menu --></h2>
5174
5175                 <p>
5176                 Bookmarklet とは、クリック1回で記事の投稿ができるシステムです。 この Bookmarklet をインストールすると、ブラウザのツールバーの'add to weblog'ボタンが利用可能となり、Nucleusの新規アイテムの追加ウィンドウがポップアップします。任意のWebページを開いた状態でこのボタンを押せば、そのWebページのタイトルと、そのページへのリンクタグがすでに埋め込まれた状態でアイテム追加ウィンドウが開き、さらに、そのページ内に引用したい文を選択した状態であればその引用文も自動的に引用します。
5177                 </p>
5178
5179                 <h3>Bookmarklet</h3>
5180                 <p>
5181                         下のリンク部分を「お気に入り」もしくはツールバーにドラッグできます。<small>(その前にテストしてみたい場合は単純に下のリンクをクリックしてみてください)</small>
5182                         <br />
5183                         <br />
5184                         <a href="<?php echo htmlspecialchars($bm)?>">Add to <?php echo $blog->getShortName()?></a> (ほとんどのブラウザで動作します)
5185                 </p>
5186
5187                 <h3>右クリックメニューにインストール (WindowsでIE使用時)</h3>
5188                 <p>
5189                         <?php
5190                                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);
5191                                 $url = $manager->addTicketToUrl($url);
5192                         ?>
5193                         あるいは<a href="<?php echo htmlspecialchars($url) ?>">右クリックメニュー</a>にインストールすることもできます (「開く」を選択すれば直接レジストリに登録します)
5194                 </p>
5195
5196                 <p>
5197                         このインストールした右クリックメニューを表示するためにはIEの再起動が必要です。
5198                 </p>
5199
5200                 <h3>アンインストール</h3>
5201                 <p>
5202                         「お気に入り」もしくはツールバーから消すには、単に削除するだけです。
5203                 </p>
5204
5205                 <p>
5206                         右クリックメニューから消したい時は、以下の手順を踏んでください:
5207                 </p>
5208
5209                 <ol>
5210                         <li>スタートメニューから「ファイルを指定して実行...」を選択</li>
5211                         <li>"regedit" と入力</li>
5212                         <li>"OK" ボタンを押す</li>
5213                         <li>"\HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt" をツリーの中から検索</li>
5214                         <li>"add to weblog" エントリを削除</li>
5215                 </ol>
5216
5217                 <?php
5218                 $this->pagefoot();
5219
5220         }
5221
5222         /**
5223          * @todo document this
5224          */
5225         function action_actionlog() {
5226                 global $member, $manager;
5227
5228                 $member->isAdmin() or $this->disallow();
5229
5230                 $this->pagehead();
5231
5232                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5233
5234                 $url = $manager->addTicketToUrl('index.php?action=clearactionlog');
5235
5236                 ?>
5237                         <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>
5238                         <p><a href="<?php echo htmlspecialchars($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>
5239                 <?php
5240                 echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';
5241
5242                 $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';
5243                 $template['content'] = 'actionlist';
5244                 $amount = showlist($query,'table',$template);
5245
5246                 $this->pagefoot();
5247
5248         }
5249
5250         /**
5251          * @todo document this
5252          */
5253         function action_banlist() {
5254                 global $member, $manager;
5255
5256                 $blogid = intRequestVar('blogid');
5257
5258                 $member->blogAdminRights($blogid) or $this->disallow();
5259
5260                 $blog =& $manager->getBlog($blogid);
5261
5262                 $this->pagehead();
5263
5264                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5265
5266                 echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";
5267
5268                 $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';
5269                 $template['content'] = 'banlist';
5270                 $amount = showlist($query,'table',$template);
5271
5272                 if ($amount == 0)
5273                         echo _BAN_NONE;
5274
5275                 echo '<h2>'._BAN_NEW_TITLE.'</h2>';
5276                 echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";
5277
5278
5279                 $this->pagefoot();
5280
5281         }
5282
5283         /**
5284          * @todo document this
5285          */
5286         function action_banlistdelete() {
5287                 global $member, $manager;
5288
5289                 $blogid = intRequestVar('blogid');
5290                 $iprange = requestVar('iprange');
5291
5292                 $member->blogAdminRights($blogid) or $this->disallow();
5293
5294                 $blog =& $manager->getBlog($blogid);
5295
5296                 $this->pagehead();
5297                 ?>
5298                         <h2><?php echo _BAN_REMOVE_TITLE?></h2>
5299
5300                         <form method="post" action="index.php">
5301
5302                         <h3><?php echo _BAN_IPRANGE?></h3>
5303
5304                         <p>
5305                                 <?php echo _CONFIRMTXT_BAN?> <?php echo htmlspecialchars($iprange) ?>
5306                                 <input name="iprange" type="hidden" value="<?php echo htmlspecialchars($iprange)?>" />
5307                         </p>
5308
5309                         <h3><?php echo _BAN_BLOGS?></h3>
5310
5311                         <div>
5312                                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5313                                 <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">Only blog '<?php echo htmlspecialchars($blog->getName())?>'</label>
5314                                 <br />
5315                                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5316                         </div>
5317
5318                         <h3><?php echo _BAN_DELETE_TITLE?></h3>
5319
5320                         <div>
5321                                 <?php $manager->addTicketHidden() ?>
5322                                 <input type="hidden" name="action" value="banlistdeleteconfirm" />
5323                                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5324                         </div>
5325
5326                         </form>
5327                 <?php
5328                 $this->pagefoot();
5329         }
5330
5331         /**
5332          * @todo document this
5333          */
5334         function action_banlistdeleteconfirm() {
5335                 global $member, $manager;
5336
5337                 $blogid = intPostVar('blogid');
5338                 $allblogs = postVar('allblogs');
5339                 $iprange = postVar('iprange');
5340
5341                 $member->blogAdminRights($blogid) or $this->disallow();
5342
5343                 $deleted = array();
5344
5345                 if (!$allblogs) {
5346                         if (BAN::removeBan($blogid, $iprange))
5347                                 array_push($deleted, $blogid);
5348                 } else {
5349                         // get blogs fot which member has admin rights
5350                         $adminblogs = $member->getAdminBlogs();
5351                         foreach ($adminblogs as $blogje) {
5352                                 if (BAN::removeBan($blogje, $iprange))
5353                                         array_push($deleted, $blogje);
5354                         }
5355                 }
5356
5357                 if (sizeof($deleted) == 0)
5358                         $this->error(_ERROR_DELETEBAN);
5359
5360                 $this->pagehead();
5361
5362                 echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';
5363                 echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';
5364                 echo "<p>"._BAN_REMOVED_TEXT."</p>";
5365
5366                 echo "<ul>";
5367                 foreach ($deleted as $delblog) {
5368                         $b =& $manager->getBlog($delblog);
5369                         echo "<li>" . htmlspecialchars($b->getName()). "</li>";
5370                 }
5371                 echo "</ul>";
5372
5373                 $this->pagefoot();
5374
5375         }
5376
5377         /**
5378          * @todo document this
5379          */
5380         function action_banlistnewfromitem() {
5381                 $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));
5382         }
5383
5384         /**
5385          * @todo document this
5386          */
5387         function action_banlistnew($blogid = '') {
5388                 global $member, $manager;
5389
5390                 if ($blogid == '')
5391                         $blogid = intRequestVar('blogid');
5392
5393                 $ip = requestVar('ip');
5394
5395                 $member->blogAdminRights($blogid) or $this->disallow();
5396
5397                 $blog =& $manager->getBlog($blogid);
5398
5399                 $this->pagehead();
5400                 ?>
5401                 <h2><?php echo _BAN_ADD_TITLE?></h2>
5402
5403
5404                 <form method="post" action="index.php">
5405
5406                 <h3><?php echo _BAN_IPRANGE?></h3>
5407
5408                 <p><?php echo _BAN_IPRANGE_TEXT?></p>
5409
5410                 <div class="note">
5411                 <b>An example</b>: "134.58.253.193" will only block one computer, while "134.58.253" will block 256 IP addresses, including the one from the first example.
5412                 </div>
5413
5414                 <div>
5415                 <?php                   if ($ip) {
5416                 ?>
5417                         <input name="iprange" type="radio" value="<?php echo htmlspecialchars($ip)?>" checked="checked" id="ip_fixed" /><label for="ip_fixed"><?php echo htmlspecialchars($ip)?></label>
5418                         <br />
5419                         <input name="iprange" type="radio" value="custom" id="ip_custom" /><label for="ip_custom">Custom: </label><input name='customiprange' value='<?php echo htmlspecialchars($ip)?>' maxlength='15' size='15' />
5420                 <?php   } else {
5421                                 echo "<input name='iprange' value='custom' type='hidden' />";
5422                                 echo "<input name='customiprange' value='' maxlength='15' size='15' />";
5423                         }
5424                 ?>
5425                 </div>
5426
5427                 <h3><?php echo _BAN_BLOGS?></h3>
5428
5429                 <p><?php echo _BAN_BLOGS_TEXT?></p>
5430
5431                 <div>
5432                         <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5433                         <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo htmlspecialchars($blog->getName())?>'</label>
5434                         <br />
5435                         <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5436                 </div>
5437
5438                 <h3><?php echo _BAN_REASON_TITLE?></h3>
5439
5440                 <p><?php echo _BAN_REASON_TEXT?></p>
5441
5442                 <div><textarea name="reason" cols="40" rows="5"></textarea></div>
5443
5444                 <h3><?php echo _BAN_ADD_TITLE?></h3>
5445
5446                 <div>
5447                         <input name="action" type="hidden" value="banlistadd" />
5448                         <?php $manager->addTicketHidden() ?>
5449                         <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />
5450                 </div>
5451
5452                 </form>
5453
5454                 <?php           $this->pagefoot();
5455         }
5456
5457         /**
5458          * @todo document this
5459          */
5460         function action_banlistadd() {
5461                 global $member;
5462
5463                 $blogid =               intPostVar('blogid');
5464                 $allblogs =     postVar('allblogs');
5465                 $iprange =              postVar('iprange');
5466                 if ($iprange == "custom")
5467                         $iprange = postVar('customiprange');
5468                 $reason =               postVar('reason');
5469
5470                 $member->blogAdminRights($blogid) or $this->disallow();
5471
5472                 // TODO: check IP range validity
5473
5474                 if (!$allblogs) {
5475                         if (!BAN::addBan($blogid, $iprange, $reason))
5476                                 $this->error(_ERROR_ADDBAN);
5477                 } else {
5478                         // get blogs fot which member has admin rights
5479                         $adminblogs = $member->getAdminBlogs();
5480                         $failed = 0;
5481                         foreach ($adminblogs as $blogje) {
5482                                 if (!BAN::addBan($blogje, $iprange, $reason))
5483                                         $failed = 1;
5484                         }
5485                         if ($failed)
5486                                 $this->error(_ERROR_ADDBAN);
5487                 }
5488
5489                 $this->action_banlist();
5490
5491         }
5492
5493         /**
5494          * @todo document this
5495          */
5496         function action_clearactionlog() {
5497                 global $member;
5498
5499                 $member->isAdmin() or $this->disallow();
5500
5501                 ACTIONLOG::clear();
5502
5503                 $this->action_manage(_MSG_ACTIONLOGCLEARED);
5504         }
5505
5506         /**
5507          * @todo document this
5508          */
5509         function action_backupoverview() {
5510                 global $member, $manager;
5511
5512                 $member->isAdmin() or $this->disallow();
5513
5514                 $this->pagehead();
5515
5516                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5517                 ?>
5518                 <h2><?php echo _BACKUPS_TITLE?></h2>
5519
5520                 <h3><?php echo _BACKUP_TITLE?></h3>
5521
5522                 <p><?php echo _BACKUP_INTRO?></p>
5523
5524                 <form method="post" action="index.php"><p>
5525                 <input type="hidden" name="action" value="backupcreate" />
5526                 <?php $manager->addTicketHidden() ?>
5527
5528                 <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>
5529                 <br />
5530                 <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>
5531                 <br /><br />
5532                 <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />
5533
5534                 </p></form>
5535
5536                 <div class="note"><?php echo _BACKUP_NOTE?></div>
5537
5538
5539                 <h3><?php echo _RESTORE_TITLE?></h3>
5540
5541                 <div class="note"><?php echo _RESTORE_NOTE?></div>
5542
5543                 <p><?php echo _RESTORE_INTRO?></p>
5544
5545                 <form method="post" action="index.php" enctype="multipart/form-data"><p>
5546                         <input type="hidden" name="action" value="backuprestore" />
5547                         <?php $manager->addTicketHidden() ?>
5548                         <input name="backup_file" type="file" tabindex="30" />
5549                         <br /><br />
5550                         <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />
5551                         <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>
5552                         <br /><?php echo _RESTORE_WARNING?>
5553                 </p></form>
5554
5555                 <?php           $this->pagefoot();
5556         }
5557
5558         /**
5559          * @todo document this
5560          */
5561         function action_backupcreate() {
5562                 global $member, $DIR_LIBS;
5563
5564                 $member->isAdmin() or $this->disallow();
5565
5566                 // use compression ?
5567                 $useGzip = intval(postVar('gzip'));
5568
5569                 include($DIR_LIBS . 'backup.php');
5570
5571                 // try to extend time limit
5572                 // (creating/restoring dumps might take a while)
5573                 @set_time_limit(1200);
5574
5575                 do_backup($useGzip);
5576                 exit;
5577         }
5578
5579         /**
5580          * @todo document this
5581          */
5582         function action_backuprestore() {
5583                 global $member, $DIR_LIBS;
5584
5585                 $member->isAdmin() or $this->disallow();
5586
5587                 if (intPostVar('letsgo') != 1)
5588                         $this->error(_ERROR_BACKUP_NOTSURE);
5589
5590                 include($DIR_LIBS . 'backup.php');
5591
5592                 // try to extend time limit
5593                 // (creating/restoring dumps might take a while)
5594                 @set_time_limit(1200);
5595
5596                 $message = do_restore();
5597                 if ($message != '')
5598                         $this->error($message);
5599
5600                 $this->pagehead();
5601                 ?>
5602                 <h2><?php echo _RESTORE_COMPLETE?></h2>
5603                 <?php           $this->pagefoot();
5604
5605         }
5606
5607         /**
5608          * @todo document this
5609          */
5610         function action_pluginlist() {
5611                 global $member, $manager;
5612
5613                 // check if allowed
5614                 $member->isAdmin() or $this->disallow();
5615
5616                 $this->pagehead();
5617
5618                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5619
5620                 echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';
5621
5622                 echo '<h3>' , _PLUGS_TITLE_INSTALLED , '</h3>';
5623
5624
5625                 $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';
5626
5627                 $template['content'] = 'pluginlist';
5628                 $template['tabindex'] = 10;
5629                 showlist($query, 'table', $template);
5630
5631                 ?>
5632                         <h3><?php echo _PLUGS_TITLE_UPDATE?></h3>
5633
5634                         <p><?php echo _PLUGS_TEXT_UPDATE?></p>
5635
5636                         <form method="post" action="index.php"><div>
5637                                 <input type="hidden" name="action" value="pluginupdate" />
5638                                 <?php $manager->addTicketHidden() ?>
5639                                 <input type="submit" value="<?php echo _PLUGS_BTN_UPDATE ?>" tabindex="20" />
5640                         </div></form>
5641
5642                         <h3><?php echo _PLUGS_TITLE_NEW?></h3>
5643
5644                         <?php                           // find a list of possibly non-installed plugins
5645                                 $candidates = array();
5646                                 global $DIR_PLUGINS;
5647                                 $dirhandle = opendir($DIR_PLUGINS);
5648                                 while ($filename = readdir($dirhandle)) {
5649                                         if (ereg('^NP_(.*)\.php$',$filename,$matches)) {
5650                                                 $name = $matches[1];
5651                                                 // only show in list when not yet installed
5652                                                 $res = sql_query('SELECT * FROM '.sql_table('plugin').' WHERE pfile="NP_'.addslashes($name).'"');
5653                                                 if (mysql_num_rows($res) == 0)
5654                                                         array_push($candidates,$name);
5655                                         }
5656                                 }
5657                                 closedir($dirhandle);
5658
5659                                 if (sizeof($candidates) > 0) {
5660                         ?>
5661
5662                         <p><?php echo _PLUGS_ADD_TEXT?></p>
5663
5664
5665                         <form method='post' action='index.php'><div>
5666                                 <input type='hidden' name='action' value='pluginadd' />
5667                                 <?php $manager->addTicketHidden() ?>
5668                                 <select name="filename" tabindex="30">
5669                                 <?php                                   foreach($candidates as $name)
5670                                                 echo '<option value="NP_',$name,'">',htmlspecialchars($name),'</option>';
5671                                 ?>
5672                                 </select>
5673                                 <input type='submit' tabindex="40" value='<?php echo _PLUGS_BTN_INSTALL?>' />
5674                         </div></form>
5675
5676                 <?php                   } else {        // sizeof(candidates) == 0
5677                                 echo '<p>',_PLUGS_NOCANDIDATES,'</p>';
5678                         }
5679
5680                 $this->pagefoot();
5681         }
5682
5683         /**
5684          * @todo document this
5685          */
5686         function action_pluginhelp() {
5687                 global $member, $manager, $DIR_PLUGINS, $CONF;
5688
5689                 // check if allowed
5690                 $member->isAdmin() or $this->disallow();
5691
5692                 $plugid = intGetVar('plugid');
5693
5694                 if (!$manager->pidInstalled($plugid))
5695                         $this->error(_ERROR_NOSUCHPLUGIN);
5696
5697                 $plugName = getPluginNameFromPid($plugid);
5698
5699                 $this->pagehead();
5700
5701                 echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';
5702
5703                 echo '<h2>',_PLUGS_HELP_TITLE,': ',htmlspecialchars($plugName),'</h2>';
5704
5705                 $plug =& $manager->getPlugin($plugName);
5706                 $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';
5707
5708                 if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {
5709                         @readfile($helpFile);
5710                 } else {
5711                         echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';
5712                         echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';
5713                 }
5714
5715
5716                 $this->pagefoot();
5717         }
5718
5719         /**
5720          * @todo document this
5721          */
5722         function action_pluginadd() {
5723                 global $member, $manager, $DIR_PLUGINS;
5724
5725                 // check if allowed
5726                 $member->isAdmin() or $this->disallow();
5727
5728                 $name = postVar('filename');
5729
5730                 if ($manager->pluginInstalled($name))
5731                         $this->error(_ERROR_DUPPLUGIN);
5732                 if (!checkPlugin($name))
5733                         $this->error(_ERROR_PLUGFILEERROR . ' (' . $name . ')');
5734
5735                 // get number of currently installed plugins
5736                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));
5737                 $numCurrent = mysql_num_rows($res);
5738
5739                 // plugin will be added as last one in the list
5740                 $newOrder = $numCurrent + 1;
5741
5742                 $manager->notify(
5743                         'PreAddPlugin',
5744                         array(
5745                                 'file' => &$name
5746                         )
5747                 );
5748
5749                 // do this before calling getPlugin (in case the plugin id is used there)
5750                 $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.addslashes($name).'")';
5751                 sql_query($query);
5752                 $iPid = mysql_insert_id();
5753
5754                 $manager->clearCachedInfo('installedPlugins');
5755
5756                 // Load the plugin for condition checking and instalation
5757                 $plugin =& $manager->getPlugin($name);
5758
5759                 // check if it got loaded (could have failed)
5760                 if (!$plugin)
5761                 {
5762                         sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));
5763                         $manager->clearCachedInfo('installedPlugins');
5764                         $this->error(_ERROR_PLUGIN_LOAD);
5765                 }
5766
5767                 // check if plugin needs a newer Nucleus version
5768                 if (getNucleusVersion() < $plugin->getMinNucleusVersion())
5769                 {
5770                         // uninstall plugin again...
5771                         $this->deleteOnePlugin($plugin->getID());
5772
5773                         // ...and show error
5774                         $this->error(_ERROR_NUCLEUSVERSIONREQ . $plugin->getMinNucleusVersion());
5775                 }
5776
5777                 // check if plugin needs a newer Nucleus version
5778                 if ((getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()))
5779                 {
5780                         // uninstall plugin again...
5781                         $this->deleteOnePlugin($plugin->getID());
5782
5783                         // ...and show error
5784                         $this->error(_ERROR_NUCLEUSVERSIONREQ . $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel());
5785                 }
5786
5787                 $pluginList = $plugin->getPluginDep();
5788                 foreach ($pluginList as $pluginName)
5789                 {
5790
5791                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');
5792                         if (mysql_num_rows($res) == 0)
5793                         {
5794                                 // uninstall plugin again...
5795                                 $this->deleteOnePlugin($plugin->getID());
5796
5797                                 $this->error(_ERROR_INSREQPLUGIN . $pluginName);
5798                         }
5799                 }
5800
5801                 // call the install method of the plugin
5802                 $plugin->install();
5803
5804                 $manager->notify(
5805                         'PostAddPlugin',
5806                         array(
5807                                 'plugin' => &$plugin
5808                         )
5809                 );
5810
5811                 // update all events
5812                 $this->action_pluginupdate();
5813         }
5814
5815         /**
5816          * @todo document this
5817          */
5818         function action_pluginupdate() {
5819                 global $member, $manager;
5820
5821                 // check if allowed
5822                 $member->isAdmin() or $this->disallow();
5823
5824                 // delete everything from plugin_events
5825                 sql_query('DELETE FROM '.sql_table('plugin_event'));
5826
5827                 // loop over all installed plugins
5828                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));
5829                 while($o = mysql_fetch_object($res)) {
5830                         $pid = $o->pid;
5831                         $plug =& $manager->getPlugin($o->pfile);
5832                         if ($plug)
5833                         {
5834                                 $eventList = $plug->getEventList();
5835                                 foreach ($eventList as $eventName)
5836                                         sql_query('INSERT INTO '.sql_table('plugin_event').' (pid, event) VALUES ('.$pid.', \''.addslashes($eventName).'\')');
5837                         }
5838                 }
5839
5840                 $this->action_pluginlist();
5841         }
5842
5843         /**
5844          * @todo document this
5845          */
5846         function action_plugindelete() {
5847                 global $member, $manager;
5848
5849                 // check if allowed
5850                 $member->isAdmin() or $this->disallow();
5851
5852                 $pid = intGetVar('plugid');
5853
5854                 if (!$manager->pidInstalled($pid))
5855                         $this->error(_ERROR_NOSUCHPLUGIN);
5856
5857                 $this->pagehead();
5858                 ?>
5859                         <h2><?php echo _DELETE_CONFIRM?></h2>
5860
5861                         <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>
5862
5863                         <form method="post" action="index.php"><div>
5864                         <?php $manager->addTicketHidden() ?>
5865                         <input type="hidden" name="action" value="plugindeleteconfirm" />
5866                         <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />
5867                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5868                         </div></form>
5869                 <?php           $this->pagefoot();
5870         }
5871
5872         /**
5873          * @todo document this
5874          */
5875         function action_plugindeleteconfirm() {
5876                 global $member, $manager;
5877
5878                 // check if allowed
5879                 $member->isAdmin() or $this->disallow();
5880
5881                 $pid = intPostVar('plugid');
5882
5883                 $error = $this->deleteOnePlugin($pid, 1);
5884                 if ($error) {
5885                         $this->error($error);
5886                 }
5887
5888                 $this->action_pluginlist();
5889         }
5890
5891         /**
5892          * @todo document this
5893          */
5894         function deleteOnePlugin($pid, $callUninstall = 0) {
5895                 global $manager;
5896
5897                 $pid = intval($pid);
5898
5899                 if (!$manager->pidInstalled($pid))
5900                         return _ERROR_NOSUCHPLUGIN;
5901
5902                 $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);
5903
5904                 // call the unInstall method of the plugin
5905                 if ($callUninstall) {
5906                         $plugin =& $manager->getPlugin($name);
5907                         if ($plugin) $plugin->unInstall();
5908                 }
5909
5910                 // check dependency before delete
5911                 $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));
5912                 while($o = mysql_fetch_object($res)) {
5913                         $plug =& $manager->getPlugin($o->pfile);
5914                         if ($plug)
5915                         {
5916                                 $depList = $plug->getPluginDep();
5917                                 foreach ($depList as $depName)
5918                                 {
5919                                         if ($name == $depName)
5920                                         {
5921                                                 return _ERROR_DELREQPLUGIN . $o->pfile;
5922                                         }
5923                                 }
5924                         }
5925                 }
5926
5927                 $manager->notify('PreDeletePlugin', array('plugid' => $pid));
5928
5929                 // delete all subscriptions
5930                 sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);
5931
5932                 // delete all options
5933                 // get OIDs from plugin_option_desc
5934                 $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
5935                 $aOIDs = array();
5936                 while ($o = mysql_fetch_object($res)) {
5937                         array_push($aOIDs, $o->oid);
5938                 }
5939
5940                 // delete from plugin_option and plugin_option_desc
5941                 sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);
5942                 if (count($aOIDs) > 0)
5943                         sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');
5944
5945                 // update order numbers
5946                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);
5947                 $o = mysql_fetch_object($res);
5948                 sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);
5949
5950                 // delete row
5951                 sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);
5952
5953                 $manager->clearCachedInfo('installedPlugins');
5954                 $manager->notify('PostDeletePlugin', array('plugid' => $pid));
5955
5956                 return '';
5957         }
5958
5959         /**
5960          * @todo document this
5961          */
5962         function action_pluginup() {
5963                 global $member, $manager;
5964
5965                 // check if allowed
5966                 $member->isAdmin() or $this->disallow();
5967
5968                 $plugid = intGetVar('plugid');
5969
5970                 if (!$manager->pidInstalled($plugid))
5971                         $this->error(_ERROR_NOSUCHPLUGIN);
5972
5973                 // 1. get old order number
5974                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
5975                 $o = mysql_fetch_object($res);
5976                 $oldOrder = $o->porder;
5977
5978                 // 2. calculate new order number
5979                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
5980
5981                 // 3. update plug numbers
5982                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
5983                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
5984
5985                 $this->action_pluginlist();
5986         }
5987
5988         /**
5989          * @todo document this
5990          */
5991         function action_plugindown() {
5992                 global $member, $manager;
5993
5994                 // check if allowed
5995                 $member->isAdmin() or $this->disallow();
5996
5997                 $plugid = intGetVar('plugid');
5998                 if (!$manager->pidInstalled($plugid))
5999                         $this->error(_ERROR_NOSUCHPLUGIN);
6000
6001                 // 1. get old order number
6002                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6003                 $o = mysql_fetch_object($res);
6004                 $oldOrder = $o->porder;
6005
6006                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6007                 $maxOrder = mysql_num_rows($res);
6008
6009                 // 2. calculate new order number
6010                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
6011
6012                 // 3. update plug numbers
6013                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6014                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6015
6016                 $this->action_pluginlist();
6017         }
6018
6019         /**
6020          * @todo document this
6021          */
6022         function action_pluginoptions($message = '') {
6023                 global $member, $manager;
6024
6025                 // check if allowed
6026                 $member->isAdmin() or $this->disallow();
6027
6028                 $pid = intRequestVar('plugid');
6029                 if (!$manager->pidInstalled($pid))
6030                         $this->error(_ERROR_NOSUCHPLUGIN);
6031
6032                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
6033                 $this->pagehead($extrahead);
6034
6035                 ?>
6036                         <p><a href="index.php?action=pluginlist">(<?php echo _PLUGS_BACK?>)</a></p>
6037
6038                         <h2>Options for <?php echo htmlspecialchars(getPluginNameFromPid($pid))?></h2>
6039
6040                         <?php if  ($message) echo $message?>
6041
6042                         <form action="index.php" method="post">
6043                         <div>
6044                                 <input type="hidden" name="action" value="pluginoptionsupdate" />
6045                                 <input type="hidden" name="plugid" value="<?php echo $pid?>" />
6046
6047                 <?php
6048
6049                 $manager->addTicketHidden();
6050
6051                 $aOptions = array();
6052                 $aOIDs = array();
6053                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ' WHERE ocontext=\'global\' and opid=' . $pid . ' ORDER BY oid ASC';
6054                 $r = sql_query($query);
6055                 while ($o = mysql_fetch_object($r)) {
6056                         array_push($aOIDs, $o->oid);
6057                         $aOptions[$o->oid] = array(
6058                                                 'oid' => $o->oid,
6059                                                 'value' => $o->odef,
6060                                                 'name' => $o->oname,
6061                                                 'description' => $o->odesc,
6062                                                 'type' => $o->otype,
6063                                                 'typeinfo' => $o->oextra,
6064                                                 'contextid' => 0
6065                         );
6066                 }
6067                 // fill out actual values
6068                 if (count($aOIDs) > 0) {
6069                         $r = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE oid in ('.implode(',',$aOIDs).')');
6070                         while ($o = mysql_fetch_object($r))
6071                                 $aOptions[$o->oid]['value'] = $o->ovalue;
6072                 }
6073
6074                 // call plugins
6075                 $manager->notify('PrePluginOptionsEdit',array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions));
6076
6077                 $template['content'] = 'plugoptionlist';
6078                 $amount = showlist($aOptions,'table',$template);
6079                 if ($amount == 0)
6080                         echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';
6081
6082                 ?>
6083                         </div>
6084                         </form>
6085                 <?php           $this->pagefoot();
6086
6087
6088
6089         }
6090
6091         /**
6092          * @todo document this
6093          */
6094         function action_pluginoptionsupdate() {
6095                 global $member, $manager;
6096
6097                 // check if allowed
6098                 $member->isAdmin() or $this->disallow();
6099
6100                 $pid = intRequestVar('plugid');
6101                 if (!$manager->pidInstalled($pid))
6102                         $this->error(_ERROR_NOSUCHPLUGIN);
6103
6104                 $aOptions = requestArray('plugoption');
6105                 NucleusPlugin::_applyPluginOptions($aOptions);
6106
6107                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));
6108
6109                 $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
6110         }
6111
6112         /**
6113          * @static
6114          * @todo document this
6115          */
6116         function _insertPluginOptions($context, $contextid = 0) {
6117                 // get all current values for this contextid
6118                 // (note: this might contain doubles for overlapping contextids)
6119                 $aIdToValue = array();
6120                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));
6121                 while ($o = mysql_fetch_object($res)) {
6122                         $aIdToValue[$o->oid] = $o->ovalue;
6123                 }
6124
6125                 // get list of oids per pid
6126                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')
6127                            . ' WHERE opid=pid and ocontext=\''.addslashes($context).'\' ORDER BY porder, oid ASC';
6128                 $res = sql_query($query);
6129                 $aOptions = array();
6130                 while ($o = mysql_fetch_object($res)) {
6131                         if (in_array($o->oid, array_keys($aIdToValue)))
6132                                 $value = $aIdToValue[$o->oid];
6133                         else
6134                                 $value = $o->odef;
6135
6136                         array_push($aOptions, array(
6137                                 'pid' => $o->pid,
6138                                 'pfile' => $o->pfile,
6139                                 'oid' => $o->oid,
6140                                 'value' => $value,
6141                                 'name' => $o->oname,
6142                                 'description' => $o->odesc,
6143                                 'type' => $o->otype,
6144                                 'typeinfo' => $o->oextra,
6145                                 'contextid' => $contextid,
6146                                 'extra' => ''
6147                         ));
6148                 }
6149
6150                 global $manager;
6151                 $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));
6152
6153
6154                 $iPrevPid = -1;
6155                 foreach ($aOptions as $aOption) {
6156
6157                         // new plugin?
6158                         if ($iPrevPid != $aOption['pid']) {
6159                                 $iPrevPid = $aOption['pid'];
6160
6161                                 echo '<tr><th colspan="2">Options for ', htmlspecialchars($aOption['pfile']),'</th></tr>';
6162                         }
6163
6164                         echo '<tr>';
6165                         listplug_plugOptionRow($aOption);
6166                         echo '</tr>';
6167
6168                 }
6169
6170
6171         }
6172
6173         /**
6174          * Helper functions to create option forms etc.
6175          * @todo document parameters
6176          */
6177         function input_yesno($name, $checkedval,$tabindex = 0, $value1 = 1, $value2 = 0, $yesval = _YES, $noval = _NO) {
6178                 $id = htmlspecialchars($name);
6179                 $id = str_replace('[','-',$id);
6180                 $id = str_replace(']','-',$id);
6181                 $id1 = $id . htmlspecialchars($value1);
6182                 $id2 = $id . htmlspecialchars($value2);
6183
6184                 echo '<input type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value1),'" ';
6185                         if ($checkedval == $value1)
6186                                 echo "tabindex='$tabindex' checked='checked'";
6187                         echo ' id="'.$id1.'" /><label for="'.$id1.'">' . $yesval . '</label>';
6188                 echo ' ';
6189                 echo '<input type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value2),'" ';
6190                         if ($checkedval != $value1)
6191                                 echo "tabindex='$tabindex' checked='checked'";
6192                         echo ' id="'.$id2.'" /><label for="'.$id2.'">' . $noval . '</label>';
6193         }
6194
6195 } // class ADMIN
6196
6197 ?>