rrodriguez 15 years ago
parent
commit
2adfbb9fc5
3 changed files with 55 additions and 132 deletions
  1. 2 20
      main/blog/blog.php
  2. 40 72
      main/blog/blog_admin.php
  3. 13 40
      main/inc/lib/blog.lib.php

+ 2 - 20
main/blog/blog.php

@@ -1,26 +1,8 @@
 <?php //$Id: announcements.php 16702 2008-11-10 13:02:30Z elixir_inter $
 /*
-==============================================================================
-	Dokeos - elearning and course management software
-
-	Copyright (c) 2004-2008 Dokeos SPRL
-	Copyright (c) 2003 Ghent University (UGent)
-	Copyright (c) 2001 Universite catholique de Louvain (UCL)
-	Copyright (c) various contributors
-
-	For a full list of contributors, see "credits.txt".
-	The full license can be read in "license.txt".
-
-	This program is free software; you can redistribute it and/or
-	modify it under the terms of the GNU General Public License
-	as published by the Free Software Foundation; either version 2
-	of the License, or (at your option) any later version.
-
-	See the GNU General Public License for more details.
-
-	Contact address: Dokeos, rue du Corbeau, 108, B-1030 Brussels, Belgium
-	info@dokeos.com
+/* For licensing terms, see /chamilo_license.txt */
 
+/**
 ==============================================================================
 
     BLOG HOMEPAGE

+ 40 - 72
main/blog/blog_admin.php

@@ -1,32 +1,10 @@
 <?php //$Id: announcements.php 16702 2008-11-10 13:02:30Z elixir_inter $
 /*
+/* For licensing terms, see /chamilo_license.txt */
+/**
 ==============================================================================
-	Dokeos - elearning and course management software
-
-	Copyright (c) 2004-2008 Dokeos SPRL
-	Copyright (c) 2003 Ghent University (UGent)
-	Copyright (c) 2001 Universite catholique de Louvain (UCL)
-	Copyright (c) various contributors
-
-	For a full list of contributors, see "credits.txt".
-	The full license can be read in "license.txt".
-
-	This program is free software; you can redistribute it and/or
-	modify it under the terms of the GNU General Public License
-	as published by the Free Software Foundation; either version 2
-	of the License, or (at your option) any later version.
-
-	See the GNU General Public License for more details.
-
-	Contact address: Dokeos, rue du Corbeau, 108, B-1030 Brussels, Belgium
-	info@dokeos.com
-
-==============================================================================
-
     BLOG HOMEPAGE
-
 	This file takes care of all blog navigation and displaying.
-
 	@package dokeos.blogs
 ==============================================================================
 */
@@ -34,7 +12,7 @@
 // name of the language file that needs to be included
 $language_file = "blog";
 
-require_once('../inc/global.inc.php');
+require_once '../inc/global.inc.php';
 $this_section=SECTION_COURSES;
 
 $blog_table_attachment 	= Database::get_course_table(TABLE_BLOGS_ATTACHMENT);
@@ -49,10 +27,7 @@ if((!$is_allowed_in_course || !$is_courseMember) && !api_is_allowed_to_edit())
 	api_not_allowed(true);//print headers/footers
 }
 
-
-if (api_is_allowed_to_edit())
-{
-
+if (api_is_allowed_to_edit()) {
 	require_once(api_get_path(LIBRARY_PATH) . "blog.lib.php");
 	$nameTools = get_lang("blog_management");
 
@@ -80,6 +55,11 @@ if (api_is_allowed_to_edit())
 	} else {
 		echo "<link rel=\"stylesheet\" type=\"text/css\" href=\"".$clarolineRepositoryWeb."css/default.css\"/>";
 	}
+	
+	echo '<div class="actions">';
+	echo "<a href='".api_get_self()."?".api_get_cidreq()."&action=add'>",Display::return_icon('blog_new.gif',get_lang('AddBlog')),get_lang('AddBlog')."</a>";
+	echo '</div>';
+
 	/*
 	==============================================================================
 		PROCESSING..
@@ -120,56 +100,44 @@ if (api_is_allowed_to_edit())
 	//api_introductionsection(TOOL_BLOG);
 
 
-		if (isset($_GET['action']) && $_GET['action'] == 'add') {
-			// we show the form if
-			// 1. no post data
-			// 2. there is post data and one of the required form elements is empty
-			if (!$_POST OR (!empty($_POST) AND (empty($_POST['new_blog_submit']) OR empty($_POST['blog_name'])))) {
-				// if there is post data there is certainly an error in the form
-				/*if ($_POST){
-					Display::display_error_message(get_lang('FormHasErrorsPleaseComplete'));
-				}*/
-				if (strlen($_POST['blog_name'])==0) {
-				if (count($_POST)>0) {
-					Display::display_error_message(get_lang('FormHasErrorsPleaseComplete'));
-				}
+	if (isset($_GET['action']) && $_GET['action'] == 'add') {
+		// we show the form if
+		// 1. no post data
+		// 2. there is post data and one of the required form elements is empty
+		if (!$_POST OR (!empty($_POST) AND (empty($_POST['new_blog_submit']) OR empty($_POST['blog_name'])))) {
+			// if there is post data there is certainly an error in the form
+			/*if ($_POST){
+				Display::display_error_message(get_lang('FormHasErrorsPleaseComplete'));
+			}*/
+			if (strlen($_POST['blog_name'])==0) {
+			if (count($_POST)>0) {
+				Display::display_error_message(get_lang('FormHasErrorsPleaseComplete'));
+			}
 
 
-			}
-			Blog::display_new_blog_form();
-		}
 		}
+		Blog::display_new_blog_form();
+	}
+	}
 
-		if (isset($_GET['action']) && $_GET['action'] == 'edit') {
-			// we show the form if
-			// 1. no post data
-			// 2. there is post data and one of the three form elements is empty
-			if (!$_POST OR (!empty($_POST) AND (empty($_POST['edit_blog_submit']) OR empty($_POST['blog_name']) )))
-			{
-				// if there is post data there is certainly an error in the form
-				if ($_POST) {
-					Display::display_error_message(get_lang('FormHasErrorsPleaseComplete'));
-				}
-			Blog::display_edit_blog_form(Database::escape_string((int)$_GET['blog_id']));
+	if (isset($_GET['action']) && $_GET['action'] == 'edit') {
+		// we show the form if
+		// 1. no post data
+		// 2. there is post data and one of the three form elements is empty
+		if (!$_POST OR (!empty($_POST) AND (empty($_POST['edit_blog_submit']) OR empty($_POST['blog_name']) )))
+		{
+			// if there is post data there is certainly an error in the form
+			if ($_POST) {
+				Display::display_error_message(get_lang('FormHasErrorsPleaseComplete'));
 			}
+		Blog::display_edit_blog_form(Database::escape_string((int)$_GET['blog_id']));
 		}
-
-		echo '<div class="actions">';
-		echo "<a href='".api_get_self()."?".api_get_cidreq()."&action=add'>",Display::return_icon('blog_new.gif',get_lang('AddBlog')),get_lang('AddBlog')."</a>";
-		echo '</div>';
-		/*echo "<table width=\"100%\" border=\"0\" cellspacing=\"2\" class='data_table'>";
-		echo	"<tr>",
-					 "<th>",get_lang('Title'),"</th>\n",
-					 "<th>",get_lang('Subtitle'),"</th>\n",
-					 "<th>",get_lang('Modify'),"</th>\n",
-				"</tr>\n";
-
-		echo "</table>";*/
-		Blog::display_blog_list();
-
-	} else {
-		api_not_allowed(true);
 	}
+	Blog::display_blog_list();
+
+} else {
+	api_not_allowed(true);
+}
 
 // Display the footer
 Display::display_footer();

+ 13 - 40
main/inc/lib/blog.lib.php

@@ -1,28 +1,5 @@
 <?php // $Id: document.php 16494 2008-10-10 22:07:36Z yannoo $
-
-/*
-==============================================================================
-	Dokeos - elearning and course management software
-
-	Copyright (c) 2004-2009 Dokeos SPRL
-	Copyright (c) 2003 Ghent University (UGent)
-	Copyright (c) 2001 Universite catholique de Louvain (UCL)
-	Copyright (c) various contributors
-
-	For a full list of contributors, see "credits.txt".
-	The full license can be read in "license.txt".
-
-	This program is free software; you can redistribute it and/or
-	modify it under the terms of the GNU General Public License
-	as published by the Free Software Foundation; either version 2
-	of the License, or (at your option) any later version.
-
-	See the GNU General Public License for more details.
-
-	Contact address: Dokeos, rue du Corbeau, 108, B-1030 Brussels, Belgium
-	Mail: info@dokeos.com
-==============================================================================
-*/
+/* For licensing terms, see /chamilo_license.txt */
 
 /**
  * Blog class
@@ -253,15 +230,13 @@ class Blog {
 		$has_attachment=false;
 		$current_date=date('Y-m-d H:i:s',time());
 
-		if(!empty($_FILES['user_upload']['name']))
-		{
+		if(!empty($_FILES['user_upload']['name'])) {
 			require_once('fileUpload.lib.php');
 			$upload_ok = process_uploaded_file($_FILES['user_upload']);
 			$has_attachment=true;
 		}
 
-		if($upload_ok)
-		{
+		if($upload_ok) {
 			// Table Definitions
 			$tbl_blogs_posts = Database::get_course_table(TABLE_BLOGS_POSTS);
 
@@ -272,8 +247,7 @@ class Blog {
 			Database::query($sql, __FILE__, __LINE__);
 			$last_post_id=Database::insert_id();
 
-			if ($has_attachment)
-			{
+			if ($has_attachment) {
 				$courseDir   = $_course['path'].'/upload/blog';
 				$sys_course_path = api_get_path(SYS_COURSE_PATH);
 				$updir = $sys_course_path.$courseDir;
@@ -296,10 +270,9 @@ class Blog {
 					$comment=Database::escape_string($file_comment);
 
 					// Storing the attachments if any
-					if ($result)
-					{
+					if ($result) {
 						$sql='INSERT INTO '.$blog_table_attachment.'(filename,comment, path, post_id,size, blog_id,comment_id) '.
-							 "VALUES ( '".Database::escape_string($file_name)."', '".Database::escape_string($comment)."', '".Database::escape_string($new_file_name)."' , '".$last_post_id."', '".$_FILES['user_upload']['size']."',  '".$blog_id."', '0' )";
+							 "VALUES ( '".Database::escape_string($file_name)."', '".Database::escape_string($comment)."', '".Database::escape_string($new_file_name)."' , '".$last_post_id."', '".intval($_FILES['user_upload']['size'])."',  '".$blog_id."', '0' )";
 						$result=Database::query($sql, __LINE__, __FILE__);
 						$message.=' / '.get_lang('AttachmentUpload');
 					}
@@ -1458,8 +1431,8 @@ class Blog {
 				$delete_confirm = ($task['system_task'] == '1') ? '' : 'onclick="javascript:if(!confirm(\''.addslashes(api_htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES,$charset)). '\')) return false;"';
 
 				echo	'<tr class="' . $css_class . '" valign="top">',
-							 '<td width="240">' . stripslashes($task['title']) . '</td>',
-							 '<td>' . stripslashes($task['description']) . '</td>',
+							 '<td width="240">' . Security::remove_XSS($task['title']) . '</td>',
+							 '<td>' . Security::remove_XSS($task['description']) . '</td>',
 							 '<td><span style="background-color: #' . $task['color'] . '">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></td>',
 							 '<td width="50">',
 							 	'<a href="' .api_get_self(). '?action=manage_tasks&amp;blog_id=' . $task['blog_id'] . '&amp;do=edit&amp;task_id=' . $task['task_id'] . '">',
@@ -1567,7 +1540,7 @@ class Blog {
 						' . get_lang('Description') . '
 					</div>
 					<div class="formw">
-						<input name="task_description" type="text" size="70" />
+						<textarea name="task_description" cols="45"></textarea>
 					</div>
 				</div>';
 
@@ -1650,11 +1623,11 @@ class Blog {
 					<table width="100%" border="0" cellspacing="2">
 						<tr>
 					   <td align="right">' . get_lang('Title') . ':&nbsp;&nbsp;</td>
-					   <td><input name="task_name" type="text" size="70" value="'.stripslashes($task['title']) . '" /></td>
+					   <td><input name="task_name" type="text" size="70" value="'.Security::remove_XSS($task['title']) . '" /></td>
 						</tr>
 						<tr>
 					   <td align="right">' . get_lang('Description') . ':&nbsp;&nbsp;</td>
-					   <td><input name="task_description" type="text" size="70" value="'.stripslashes($task['description']) . '" /></td>
+					   <td><textarea name="task_description" cols="45">'.Security::remove_XSS($task['description']).'</textarea></td>
 						</tr>';
 
 						/* edit by Kevin Van Den Haute (kevin@develop-it.be) */
@@ -2712,7 +2685,7 @@ class Blog {
 						' . get_lang('Subtitle') . '
 					</div>
 					<div class="formw">
-						<input name="blog_subtitle" type="text" size="50" value="'.Security::remove_XSS($_POST['blog_subtitle']).'"/>
+						<textarea name="blog_subtitle" cols="45">'.Security::remove_XSS($_POST['blog_subtitle']).'</textarea>
 					</div>
 				</div>
 
@@ -2770,7 +2743,7 @@ class Blog {
 						' . get_lang('Subtitle') . '
 					</div>
 					<div class="formw">
-						<input name="blog_subtitle" type="text" size="50" value="' . $blog['blog_subtitle'] . '" />
+						<textarea name="blog_subtitle" type="text" cols="45">' . $blog['blog_subtitle'] . '</textarea>
 					</div>
 				</div>