Browse Source

Merge branch '1.9.x' of ssh://github.com/chamilo/chamilo-lms into chamilo19

Julio Montoya 10 years ago
parent
commit
c579444322

+ 5 - 2
documentation/dependencies.html

@@ -69,12 +69,15 @@ We recommend using HTML5-compatible technology.
 <h2>Dependencies - server-side</h2>
 <ul>
   <li>Apache 2+</li>
-  <li>PHP 5.3 or higher with recent MySQL bindings and php-gd extension to allow Chamilo to resize pictures. The
-  new components we have included from the Symfony framework highly depend on namespaces, a feature that appeared in PHP 5.3.0+</li>
+  <li> PHP 5.3 or higher with MySQL bindings (mysqlnd is recommended) and php-gd extension to allow Chamilo to resize pictures. The 
   <li>MySQL 5.1+ or any version of MariaDB database server</li>
+  new components we have included from the Symfony framework highly depend on namespaces, a feature that appeared in PHP 5.3.0</li>
   <li>php5-intl package (for international behaviour support)</li>
+  <li>php5-imagick</li>
   <li>php5-curl (only required for a feature in the links tool and an optional installer check)</li>
   <li>php5-mcrypt (only required for a feature in the survey tool)</li>
+  <li>php5-ldap (only required for connection to a LDAP server)</li>
+  <li>php5-xapian (only required for full-text indexing and search)</li>
 </ul><br />
 <a name="included_dependencies"></a>
 <h2>Included Dependencies</h2>

+ 1 - 1
documentation/installation_guide.html

@@ -119,7 +119,7 @@ and a deprecated single-database mode.</span><br />
 <h2><a name="2._Installation_of_Chamilo_LMS"></a><span style="font-weight: bold;">2. Installation of Chamilo LMS</span></h2>
 
 <ol>
-  <li><a href="http://www.chamilo.org/download">Download Chamilo LMS</a></li>
+  <li><a href="http://www.chamilo.org/en/download">Download Chamilo LMS</a></li>
   <li>Unzip it</li>
   <li>Copy the Chamilo directory in your Apache web directory. This can be
     <span style="font-weight: bold;">C:\xampp\htdocs\</span> on a Windows server or <span style="font-weight: bold;">/var/www/html/</span> (or /var/www/chamilo/) on a Linux server</li>

+ 1 - 0
documentation/optimization.html

@@ -254,6 +254,7 @@ To solve this performance issue, you can execute the following queries manually
 <pre>
 ALTER TABLE lp_item ADD INDEX idx_c_lp_item_cid_lp_id (c_id, lp_id);
 ALTER TABLE lp_item_view ADD INDEX  idx_c_lp_item_view_cid_lp_view_id_lp_item_id (c_id, lp_view_id, lp_item_id);
+ALTER TABLE user_rel_tag ADD INDEX idx_user_rel_tag_user (user_id);
 </pre>
 In Chamilo 1.9.8, we use the c_item_property table more actively. This causes issues with the reporting pages for the assignments. You can reduce the impact by adding the following index:
 <pre>

+ 56 - 25
main/auth/sso/sso.class.php

@@ -25,7 +25,8 @@ class sso {
     /**
      * Instanciates the object, initializing all relevant URL strings
      */
-    public function __construct() {
+    public function __construct()
+    {
         $this->protocol   = api_get_setting('sso_authentication_protocol');
         // There can be multiple domains, so make sure to take only the first
         // This might be later extended with a decision process
@@ -43,7 +44,8 @@ class sso {
     /**
      * Unlogs the user from the remote server 
      */
-    public function logout() {
+    public function logout()
+    {
         header('Location: '.$this->deauth_url);
         exit;
     }
@@ -51,8 +53,13 @@ class sso {
     /**
      * Sends the user to the master URL for a check of active connection
      */
-    public function ask_master() {
-        $params = 'sso_referer='.urlencode($this->referer).'&sso_target='.urlencode($this->target);
+    public function ask_master()
+    {
+        $tempKey = api_generate_password(32);
+        $params = 'sso_referer='.urlencode($this->referer).
+            '&sso_target='.urlencode($this->target).
+            '&sso_challenge='.$tempKey;
+        Session::write('tempkey', $tempKey);
         if (strpos($this->master_url, "?") === false) {
             $params = "?$params";
         } else {
@@ -66,7 +73,8 @@ class sso {
      * Validates the received active connection data with the database
      * @return	bool	Return the loginFailed variable value to local.inc.php
      */
-    public function check_user() {
+    public function check_user()
+    {
         global $_user;
         $loginFailed = false;
         //change the way we recover the cookie depending on how it is formed
@@ -86,8 +94,7 @@ class sso {
             $uData = Database::fetch_array($result);
             //Check the user's password
             if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE) {
-             
-                //the authentification of this user is managed by Chamilo itself
+                //This user's authentification is managed by Chamilo itself
                 // check the user's password
                 // password hash comes already parsed in sha1, md5 or none
                 
@@ -97,21 +104,35 @@ class sso {
                 error_log($sso['username']);
                 error_log($uData['username']);
                 */
-                
-                if ($sso['secret'] === sha1($uData['password']) 
-                    && ($sso['username'] == $uData['username'])) {
-                    error_log('user n password are ok');                    
+                global $_configuration;
+                // Two possible authentication methods here: legacy using password
+                // and new using a temporary, session-fixed, tempkey
+                if (($sso['username'] == $uData['username']
+                        && $sso['secret'] === sha1(
+                            $uData['username'].
+                            Session::read('tempkey').
+                            $_configuration['security_key']
+                        )
+                    )
+                    or (
+                        ($sso['secret'] === sha1($uData['password']))
+                        && ($sso['username'] == $uData['username'])
+                    )
+                ) {
+                    //error_log('user n password are ok');
                     //Check if the account is active (not locked)
                     if ($uData['active']=='1') {
                         // check if the expiration date has not been reached
-                        if ($uData['expiration_date'] > date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00') {                            
+                        if ($uData['expiration_date'] > date('Y-m-d H:i:s')
+                            or $uData['expiration_date']=='0000-00-00 00:00:00') {
                             
                             //If Multiple URL is enabled
                             if (api_get_multiple_access_url()) {
-                                //Check the access_url configuration setting if the user is registered in the access_url_rel_user table
+                                //Check the access_url configuration setting if
+                                // the user is registered in the access_url_rel_user table
                                 //Getting the current access_url_id of the platform
                                 $current_access_url_id = api_get_current_access_url_id();
-                                // my user is subscribed in these 
+                                // my user is subscribed in these
                                 //sites: $my_url_list
                                 $my_url_list = api_get_access_url_from_user($uData['user_id']);
                             } else {
@@ -122,7 +143,7 @@ class sso {
                             $my_user_is_admin = UserManager::is_admin($uData['user_id']);
                             
                             if ($my_user_is_admin === false) {
-                                if (is_array($my_url_list) && count($my_url_list) > 0 ) {
+                                if (is_array($my_url_list) && count($my_url_list) > 0) {
                                     if (in_array($current_access_url_id, $my_url_list)) {
                                         // the user has permission to enter at this site
                                         $_user['user_id'] = $uData['user_id'];
@@ -141,7 +162,7 @@ class sso {
                                         exit;
                                     }
                                 } else {
-                                    // there is no URL in the multiple 
+                                    // there is no URL in the multiple
                                     // urls list for this user
                                     $loginFailed = true;
                                     Session::erase('_uid');
@@ -151,8 +172,8 @@ class sso {
                             } else {
                                 //Only admins of the "main" (first) Chamilo
                                 // portal can login wherever they want
-                                if (in_array(1, $my_url_list)) { 
-                                    //Check if this admin is admin on the  
+                                if (in_array(1, $my_url_list)) {
+                                    //Check if this admin is admin on the
                                     // principal portal
                                     $_user['user_id'] = $uData['user_id'];
                                     $_user = api_get_user_info($_user['user_id']);
@@ -161,26 +182,32 @@ class sso {
                                     Session::write('_user', $_user);
                                     event_login();
                                 } else {
-                                    //Secondary URL admin wants to login 
+                                    //Secondary URL admin wants to login
                                     // so we check as a normal user
                                     if (in_array($current_access_url_id, $my_url_list)) {
                                         $_user['user_id'] = $uData['user_id'];
                                         $_user = api_get_user_info($_user['user_id']);
-                                        Session::write('_user',$_user);
+                                        Session::write('_user', $_user);
                                         event_login();
                                     } else {
                                         $loginFailed = true;
                                         Session::erase('_uid');
-                                        header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
+                                        header(
+                                            'Location: '.api_get_path(WEB_PATH)
+                                            .'index.php?loginFailed=1&error=access_url_inactive'
+                                        );
                                         exit;
                                     }
                                 }
-                            }                       
+                            }
                         } else {
                             // user account expired
                             $loginFailed = true;
                             Session::erase('_uid');
-                            header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_expired');
+                            header(
+                                'Location: '.api_get_path(WEB_PATH)
+                                .'index.php?loginFailed=1&error=account_expired'
+                            );
                             exit;
                         }
                     } else {
@@ -201,7 +228,10 @@ class sso {
                 //Auth_source is wrong
                 $loginFailed = true;
                 Session::erase('_uid');
-                header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=wrong_authentication_source');
+                header(
+                    'Location: '.api_get_path(WEB_PATH)
+                    .'index.php?loginFailed=1&error=wrong_authentication_source'
+                );
                 exit;
             }
         } else {
@@ -220,7 +250,8 @@ class sso {
      * @param	string	Encoded cookie
      * @return  array   Parsed and unencoded cookie
      */
-    private function decode_cookie($cookie) {
+    private function decode_cookie($cookie)
+    {
         return unserialize(base64_decode($cookie));
     }
 }

+ 7 - 2
main/course_description/course_description_controller.php

@@ -41,8 +41,13 @@ class CourseDescriptionController
         $data['messages'] = $messages;
         $browser = api_get_navigator();
 
-        if (strpos($data['descriptions'], '<iframe') !== false && $browser['name'] == 'Chrome') {
-            header("X-XSS-Protection: 0");
+        if (!is_array($data['descriptions'])) {
+            $data['descriptions'] = array($data['descriptions']);
+        }
+        foreach ($data['descriptions'] as $description) {
+            if (strpos($description, '<iframe') !== false && $browser['name'] == 'Chrome') {
+                header("X-XSS-Protection: 0");
+            }
         }
 
         // render to the view

+ 1 - 0
main/inc/lib/document.lib.php

@@ -304,6 +304,7 @@ class DocumentManager
      */
     public static function file_send_for_download($full_file_name, $forced = false, $name = '')
     {
+        session_write_close(); //we do not need write access to session anymore
         if (!is_file($full_file_name)) {
             return false;
         }

+ 11 - 1
main/inc/lib/extra_field_value.lib.php

@@ -499,10 +499,12 @@ class ExtraFieldValue extends Model
      * the given field is defined with the given value
      * @param string Field (type of data) we want to check
      * @param string Data we are looking for in the given field
+     * @param bool Whether to transform the result to a human readable strings
+     * @param bool Whether to return the last element or simply the first one we get
      * @return mixed Give the ID if found, or false on failure or not found
      * @assert (-1,-1) === false
      */
-    public function get_item_id_from_field_variable_and_field_value($field_variable, $field_value, $transform = false)
+    public function get_item_id_from_field_variable_and_field_value($field_variable, $field_value, $transform = false, $last = false)
     {
         $field_value = Database::escape_string($field_value);
         $field_variable = Database::escape_string($field_variable);
@@ -513,8 +515,16 @@ class ExtraFieldValue extends Model
                 WHERE
                     field_value  = '$field_value' AND
                     field_variable = '".$field_variable."'
+                ORDER BY {$this->handler_id}
                 ";
 
+        if ($last) {
+            // If we want the last element instead of the first
+            // This is useful in special cases where there might
+            // (erroneously) be more than one row for an item
+            $sql .= ' DESC';
+        }
+
         $result = Database::query($sql);
         if ($result !== false && Database::num_rows($result)) {
             $result = Database::fetch_array($result, 'ASSOC');

+ 0 - 3
main/inc/lib/userportal.lib.php

@@ -897,9 +897,6 @@ class IndexManager
             }
         }
 
-        $show_course_link = false;
-        $show_create_link = false;
-
         // My account section
         $my_account_content = '<ul class="nav nav-list">';
 

+ 123 - 59
main/inc/local.inc.php

@@ -92,7 +92,7 @@
 * reset, setting correctly $cidReset (for course) and $gidReset (for group).
 *
 * 3. If needed, the script retrieves the other user informations (first name,
-		* last name, ...) and stores them in session.
+*   last name, ...) and stores them in session.
 *
 * 4. If needed, the script retrieves the course information and stores them
 * in session
@@ -109,8 +109,8 @@
 */
 
 /*
-	 INIT SECTION
-	 variables should be initialised here
+     INIT SECTION
+     variables should be initialised here
  */
 
 //require_once api_get_path(LIBRARY_PATH).'conditionallogin.lib.php'; moved to autologin
@@ -119,13 +119,13 @@
 use \ChamiloSession as Session;
 
 //Conditional login
-if (isset($_SESSION['conditional_login']['uid']) && $_SESSION['conditional_login']['can_login']=== true){
+if (isset($_SESSION['conditional_login']['uid']) && $_SESSION['conditional_login']['can_login'] === true) {
     $uData = UserManager::get_user_info_by_id($_SESSION['conditional_login']['uid']);
     ConditionalLogin::check_conditions($uData);
 
     $_user['user_id'] = $_SESSION['conditional_login']['uid'];
     $_user['status']  = $uData['status'];
-    Session::write('_user',$_user);
+    Session::write('_user', $_user);
     Session::erase('conditional_login');
     $uidReset=true;
     event_login();
@@ -144,7 +144,10 @@ $cidReq = isset($_GET["cidReq"]) ? Database::escape_string($_GET["cidReq"]) : $c
 $cidReset = isset($cidReset) ? Database::escape_string($cidReset) : '';
 
 // $cidReset can be set in URL-parameter
-$cidReset = (isset($_GET['cidReq']) && ((isset($_SESSION['_cid']) && $_GET['cidReq']!=$_SESSION['_cid']) || (!isset($_SESSION['_cid'])))) ? Database::escape_string($_GET["cidReq"]) : $cidReset;
+$cidReset = (
+        isset($_GET['cidReq']) && ((isset($_SESSION['_cid'])
+        && $_GET['cidReq']!=$_SESSION['_cid']) || (!isset($_SESSION['_cid'])))
+    ) ? Database::escape_string($_GET["cidReq"]) : $cidReset;
 
 // $cDir is a special url param sent by courses/.htaccess
 $cDir = (!empty($_GET['cDir']) ? $_GET['cDir'] : null);
@@ -199,11 +202,11 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
             }
 
             if (isset($_POST['legal_accept_type']) && $legal_option===true) {
-                $cond_array = explode(':',$_POST['legal_accept_type']);
-                if (!empty($cond_array[0]) && !empty($cond_array[1])){
+                $cond_array = explode(':', $_POST['legal_accept_type']);
+                if (!empty($cond_array[0]) && !empty($cond_array[1])) {
                     $time = time();
                     $condition_to_save = intval($cond_array[0]).':'.intval($cond_array[1]).':'.$time;
-                    UserManager::update_extra_field_value($user_id,'legal_accept',$condition_to_save);
+                    UserManager::update_extra_field_value($user_id, 'legal_accept', $condition_to_save);
                 }
             }
         }
@@ -217,14 +220,14 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
     }
 
     $cas_login = false;
-    if ($cas_activated  AND !isset($_user['user_id']) and !isset($_POST['login'])  && !$logout) {
+    if ($cas_activated  and !isset($_user['user_id']) and !isset($_POST['login']) && !$logout) {
         require_once(api_get_path(SYS_PATH).'main/auth/cas/authcas.php');
         $cas_login = cas_is_authenticated();
     }
-    if ((isset($_POST['login']) AND  isset($_POST['password']) ) OR ($cas_login) )  {
+    if ((isset($_POST['login']) and isset($_POST['password'])) or ($cas_login)) {
 
         // $login && $password are given to log in
-        if ( $cas_login  && empty($_POST['login']) ) {
+        if ($cas_login && empty($_POST['login'])) {
             $login = $cas_login;
         } else {
             $login      = $_POST['login'];
@@ -299,10 +302,12 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
                 $password = api_get_encrypted_password(trim(stripslashes($password)));
 
                 // Check the user's password
-                if (($password == $uData['password'] OR $cas_login) AND (trim($login) == $uData['username'])) {
+                if (($password == $uData['password'] or $cas_login) and (trim($login) == $uData['username'])) {
                     $update_type = UserManager::get_extra_user_data_by_field($uData['user_id'], 'update_type');
                     $update_type= $update_type['update_type'];
-                    if (!empty($extAuthSource[$update_type]['updateUser']) && file_exists($extAuthSource[$update_type]['updateUser'])) {
+                    if (!empty($extAuthSource[$update_type]['updateUser'])
+                        && file_exists($extAuthSource[$update_type]['updateUser'])
+                    ) {
                         include_once $extAuthSource[$update_type]['updateUser'];
                     }
 
@@ -310,17 +315,24 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
                     if ($uData['active'] == '1') {
 
                         // Check if the expiration date has not been reached
-                        if ($uData['expiration_date'] > date('Y-m-d H:i:s') OR $uData['expiration_date'] == '0000-00-00 00:00:00') {
+                        if ($uData['expiration_date'] > date('Y-m-d H:i:s')
+                            or $uData['expiration_date'] == '0000-00-00 00:00:00'
+                        ) {
+
                             global $_configuration;
 
-                            if (isset($_configuration['multiple_access_urls']) && $_configuration['multiple_access_urls']) {
+                            if (isset($_configuration['multiple_access_urls'])
+                                && $_configuration['multiple_access_urls']
+                            ) {
+
                                 //Check if user is an admin
                                 $my_user_is_admin = UserManager::is_admin($uData['user_id']);
 
                                 // This user is subscribed in these sites => $my_url_list
                                 $my_url_list = api_get_access_url_from_user($uData['user_id']);
 
-                                //Check the access_url configuration setting if the user is registered in the access_url_rel_user table
+                                //Check the access_url configuration setting if
+                                // the user is registered in the access_url_rel_user table
                                 //Getting the current access_url_id of the platform
                                 $current_access_url_id = api_get_current_access_url_id();
 
@@ -342,7 +354,8 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
 
                                         // Fix cas redirection loop
                                         // https://support.chamilo.org/issues/6124
-                                        $location = api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive';
+                                        $location = api_get_path(WEB_PATH)
+                                            .'index.php?loginFailed=1&error=access_url_inactive';
                                         if ($cas_login) {
                                             cas_logout(null, $location);
                                         } else {
@@ -350,25 +363,30 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
                                         }
                                         exit;
                                     }
-                                } else { //Only admins of the "main" (first) Chamilo portal can login wherever they want
-                                    if (in_array(1, $my_url_list)) { //Check if this admin have the access_url_id = 1 which means the principal
+                                } else {
+                                    //Only admins of the "main" (first) Chamilo portal can login wherever they want
+                                    if (in_array(1, $my_url_list)) {
+                                        //Check if this admin have the access_url_id = 1 which means the principal
                                         ConditionalLogin::check_conditions($uData);
                                         $_user['user_id'] = $uData['user_id'];
                                         $_user['status']  = $uData['status'];
-                                        Session::write('_user',$_user);
+                                        Session::write('_user', $_user);
                                         event_login();
                                     } else {
                                         //This means a secondary admin wants to login so we check as he's a normal user
                                         if (in_array($current_access_url_id, $my_url_list)) {
                                             $_user['user_id'] = $uData['user_id'];
                                             $_user['status']  = $uData['status'];
-                                            Session::write('_user',$_user);
+                                            Session::write('_user', $_user);
                                             event_login();
                                         } else {
                                             $loginFailed = true;
                                             Session::erase('_uid');
                                             Session::write('loginFailed', '1');
-                                            header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
+                                            header(
+                                                'Location: '.api_get_path(WEB_PATH)
+                                                .'index.php?loginFailed=1&error=access_url_inactive'
+                                            );
                                             exit;
                                         }
                                     }
@@ -378,7 +396,7 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
                                 $_user['user_id'] = $uData['user_id'];
                                 $_user['status']  = $uData['status'];
 
-                                Session::write('_user',$_user);
+                                Session::write('_user', $_user);
                                 event_login();
                                 $logging_in = true;
                             }
@@ -386,14 +404,20 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
                             $loginFailed = true;
                             Session::erase('_uid');
                             Session::write('loginFailed', '1');
-                            header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_expired');
+                            header(
+                                'Location: '.api_get_path(WEB_PATH)
+                                .'index.php?loginFailed=1&error=account_expired'
+                            );
                             exit;
                         }
                     } else {
                         $loginFailed = true;
                         Session::erase('_uid');
                         Session::write('loginFailed', '1');
-                        header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
+                        header(
+                            'Location: '.api_get_path(WEB_PATH)
+                            .'index.php?loginFailed=1&error=account_inactive'
+                        );
                         exit;
                     }
                 } else {
@@ -419,7 +443,10 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
                         }
                     }
 
-                    header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=user_password_incorrect');
+                    header(
+                        'Location: '.api_get_path(WEB_PATH)
+                        .'index.php?loginFailed=1&error=user_password_incorrect'
+                    );
                     exit;
                 }
 
@@ -428,7 +455,9 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
                     //e.g. registered by a teacher
                     //do nothing (code may be added later)
                 }
-            } elseif (!empty($extAuthSource[$uData['auth_source']]['login']) && file_exists($extAuthSource[$uData['auth_source']]['login'])) {
+            } elseif (!empty($extAuthSource[$uData['auth_source']]['login'])
+                && file_exists($extAuthSource[$uData['auth_source']]['login'])
+                ) {
                 /*
                  * Process external authentication
                  * on the basis of the given login name
@@ -442,7 +471,13 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
                 /* >>>>>>>> External authentication modules <<<<<<<<< */
             } else { // no standard Chamilo login - try external authentification
                 //huh... nothing to do... we shouldn't get here
-                error_log('Chamilo Authentication file defined in $extAuthSource could not be found - this might prevent your system from doing the corresponding authentication process',0);
+                error_log(
+                    'Chamilo Authentication file defined in'.
+                    ' $extAuthSource could not be found - this might prevent'.
+                    ' your system from doing the corresponding authentication'.
+                    ' process',
+                    0
+                );
             }
         } else {
             // login failed, Database::num_rows($result) <= 0
@@ -467,21 +502,31 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
              */
 
             if (isset($extAuthSource) && is_array($extAuthSource)) {
-                foreach($extAuthSource as $thisAuthSource) {
+                foreach ($extAuthSource as $thisAuthSource) {
                     if (!empty($thisAuthSource['newUser']) && file_exists($thisAuthSource['newUser'])) {
                         include_once($thisAuthSource['newUser']);
                     } else {
-                        error_log('Chamilo Authentication file '. $thisAuthSource['newUser']. ' could not be found - this might prevent your system from using the authentication process in the user creation process',0);
+                        error_log(
+                            'Chamilo Authentication file '. $thisAuthSource['newUser'].
+                            ' could not be found - this might prevent your system from using'.
+                            ' the authentication process in the user creation process',
+                            0
+                        );
                     }
                 }
             } //end if is_array($extAuthSource)
             if ($loginFailed) { //If we are here username given is wrong
                 Session::write('loginFailed', '1');
-                header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=user_password_incorrect');
+                header(
+                    'Location: '.api_get_path(WEB_PATH)
+                    .'index.php?loginFailed=1&error=user_password_incorrect'
+                );
                 exit;
             }
         } //end else login failed
-    } elseif (api_get_setting('sso_authentication') === 'true' && !in_array('webservices', explode('/', $_SERVER['REQUEST_URI']))) {
+    } elseif (api_get_setting('sso_authentication') === 'true'
+        && !in_array('webservices', explode('/', $_SERVER['REQUEST_URI']))
+        ) {
         /**
          * TODO:
          * - Work on a better validation for webservices paths. Current is very poor and exit
@@ -500,7 +545,7 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
                 online_logout($_SESSION['_user']['user_id'], false);
                 $osso->logout(); //redirects and exits
             }
-        } elseif(!$logout) {
+        } elseif (!$logout) {
             // Handle cookie comming from Master Server
             //  Use this first line if you want users to still see the
             //  homepage without connecting
@@ -520,19 +565,29 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
                     $protocol = api_get_setting('sso_authentication_protocol');
                     // sso_authentication_domain can list
                     // several, comma-separated, domains
-                    $master_urls = preg_split('/,/',api_get_setting('sso_authentication_domain'));
+                    $master_urls = preg_split('/,/', api_get_setting('sso_authentication_domain'));
                     if (!empty($master_urls)) {
                         $master_auth_uri = api_get_setting('sso_authentication_auth_uri');
                         foreach ($master_urls as $mu) {
-                            if (empty($mu)) { continue; }
-                            // for each URL, check until we find *one* that matches the $_GET['sso_referer'], then skip the rest
-                            if ($protocol.trim($mu).$master_auth_uri === $_GET['sso_referer']) {
+                            if (empty($mu)) {
+                                continue;
+                            }
+                            // For each URL, check until we find *one* that matches the $_GET['sso_referer'],
+                            //  then skip other possibilities
+                            // Do NOT compare the whole referer, as this might cause confusing errors with friendly urls,
+                            // like in Drupal /?q=user& vs /user?
+                            $referrer = substr($_GET['sso_referer'], 0, strrpos($_GET['sso_referer'], '/'));
+                            if ($protocol.trim($mu) === $referrer) {
                                 $matches_domain = true;
                                 break;
                             }
                         }
                     } else {
-                        error_log('Your sso_authentication_master param is empty. Check the platform configuration, security section. It can be a list of comma-separated domains');
+                        error_log(
+                            'Your sso_authentication_master param is empty. '.
+                            'Check the platform configuration, security section. '.
+                            'It can be a list of comma-separated domains'
+                        );
                     }
                 }
                 if ($matches_domain) {
@@ -563,7 +618,7 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
             if ($res['status'] == 'success') {
                 $id1 = Database::escape_string($res['openid.identity']);
                 //have another id with or without the final '/'
-                $id2 = (substr($id1,-1,1)=='/'?substr($id1,0,-1):$id1.'/');
+                $id2 = (substr($id1, -1, 1)=='/'?substr($id1, 0, -1):$id1.'/');
                 //lookup the user in the main database
                 $user_table = Database::get_main_table(TABLE_MAIN_USER);
                 $sql = "SELECT user_id, username, password, auth_source, active, expiration_date
@@ -582,11 +637,13 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
                             // check if the account is active (not locked)
                             if ($uData['active']=='1') {
                                 // check if the expiration date has not been reached
-                                if ($uData['expiration_date']>date('Y-m-d H:i:s') OR $uData['expiration_date']=='0000-00-00 00:00:00') {
+                                if ($uData['expiration_date']>date('Y-m-d H:i:s')
+                                    or $uData['expiration_date']=='0000-00-00 00:00:00'
+                                ) {
                                     $_user['user_id'] = $uData['user_id'];
                                     $_user['status']  = $uData['status'];
 
-                                    Session::write('_user',$_user);
+                                    Session::write('_user', $_user);
                                     event_login();
                                 } else {
                                     $loginFailed = true;
@@ -610,7 +667,13 @@ if (!empty($_SESSION['_user']['user_id']) && !($login || $logout)) {
                         }
                     } else {
                         //Redirect to the subscription form
-                        header('Location: '.api_get_path(WEB_CODE_PATH).'auth/inscription.php?username='.$res['openid.sreg.nickname'].'&email='.$res['openid.sreg.email'].'&openid='.$res['openid.identity'].'&openid_msg=idnotfound');
+                        header(
+                            'Location: '.api_get_path(WEB_CODE_PATH)
+                            .'auth/inscription.php?username='.$res['openid.sreg.nickname']
+                            .'&email='.$res['openid.sreg.email']
+                            .'&openid='.$res['openid.identity']
+                            .'&openid_msg=idnotfound'
+                        );
                         Session::write('loginFailed', '1');
                         exit;
                         //$loginFailed = true;
@@ -647,7 +710,9 @@ if (isset($use_anonymous) && $use_anonymous) {
 // if there is a cDir parameter in the URL (coming from courses/.htaccess redirection)
 if (!empty($cDir)) {
     $c = CourseManager::get_course_id_from_path($cDir);
-    if ($c) { $cidReq = $c; }
+    if ($c) {
+        $cidReq = $c;
+    }
 }
 
 // if the requested course is different from the course in session
@@ -694,14 +759,14 @@ if (isset($uidReset) && $uidReset) {
             $_user =  _api_format_user($uData, false);
             $_user['lastLogin'] = api_strtotime($uData['login_date'], 'UTC');
 
-            $is_platformAdmin = (bool) (! is_null( $uData['is_admin']));
+            $is_platformAdmin = (bool) (! is_null($uData['is_admin']));
             $is_allowedCreateCourse = (bool) (($uData ['status'] == COURSEMANAGER) or (api_get_setting('drhCourseManagerRights') and $uData['status'] == DRH));
             ConditionalLogin::check_conditions($uData);
 
-            Session::write('_user',$_user);
+            Session::write('_user', $_user);
             UserManager::update_extra_field_value($_user['user_id'], 'already_logged_in', 'true');
             Session::write('is_platformAdmin', $is_platformAdmin);
-            Session::write('is_allowedCreateCourse',$is_allowedCreateCourse);
+            Session::write('is_allowedCreateCourse', $is_allowedCreateCourse);
         } else {
             header('location:'.api_get_path(WEB_PATH));
             //exit("WARNING UNDEFINED UID !! ");
@@ -735,8 +800,8 @@ if (isset($cidReset) && $cidReset) {
             $_cid                           = $_course['code'];
 
             Session::write('_real_cid', $_real_cid);
-            Session::write('_cid',      $_cid);
-            Session::write('_course',   $_course);
+            Session::write('_cid', $_cid);
+            Session::write('_course', $_course);
 
             // if a session id has been given in url, we store the session
 
@@ -777,8 +842,8 @@ if (isset($cidReset) && $cidReset) {
         Session::erase('_course');
 
         if (!empty($_SESSION)) {
-            foreach($_SESSION as $key => $session_item) {
-                if (strpos($key,'lp_autolunch_') === false) {
+            foreach ($_SESSION as $key => $session_item) {
+                if (strpos($key, 'lp_autolunch_') === false) {
                     continue;
                 } else {
                     if (isset($_SESSION[$key])) {
@@ -809,12 +874,12 @@ if (isset($cidReset) && $cidReset) {
             $_cid = $_course['code'];
 
             Session::write('_real_cid', $_real_cid);
-            Session::write('_cid',      $_cid);
-            Session::write('_course',   $_course);
+            Session::write('_cid', $_cid);
+            Session::write('_course', $_course);
         }
     }
 
-    if (empty($_SESSION['_course']) OR empty($_SESSION['_cid'])) { //no previous values...
+    if (empty($_SESSION['_course']) or empty($_SESSION['_cid'])) { //no previous values...
         $_cid         = -1;        //set default values that will be caracteristic of being unset
         $_course      = -1;
     } else {
@@ -888,7 +953,7 @@ if (isset($cidReset) && $cidReset) {
                         ORDER BY login_course_date DESC LIMIT 0,1";
                     $result = Database::query($sql);
                     if (Database::num_rows($result) > 0) {
-                        $i_course_access_id = Database::result($result,0,0);
+                        $i_course_access_id = Database::result($result, 0, 0);
                         //We update the course tracking table
                         $sql = "UPDATE $course_tracking_table  SET logout_course_date = '$time', counter = counter+1
                                 WHERE course_access_id = ".intval($i_course_access_id)." AND session_id = ".api_get_session_id();
@@ -923,8 +988,7 @@ $is_courseAdmin     = false;
 $is_courseTutor     = false;
 $is_courseMember    = false;
 
-if ((isset($uidReset) && $uidReset) || (isset($cidReset) && $cidReset))
-{
+if ((isset($uidReset) && $uidReset) || (isset($cidReset) && $cidReset)) {
     if (isset($_cid) && $_cid) {
         $my_user_id = isset($user_id) ? intval($user_id) : 0;
         $variable = 'accept_legal_'.$my_user_id.'_'.$_course['real_id'].'_'.$session_id;
@@ -963,7 +1027,7 @@ if ((isset($uidReset) && $uidReset) || (isset($cidReset) && $cidReset))
             $is_courseMember     = true;
 
             $_courseUser['role'] = $cuData['role'];
-            Session::write('_courseUser',$_courseUser);
+            Session::write('_courseUser', $_courseUser);
         }
 
         // We are in a session course? Check session permissions
@@ -1116,7 +1180,7 @@ if ((isset($uidReset) && $uidReset) || (isset($cidReset) && $cidReset))
             case COURSE_VISIBILITY_OPEN_WORLD: //3
                 $is_allowed_in_course = true;
                 break;
-            case COURSE_VISIBILITY_OPEN_PLATFORM : //2
+            case COURSE_VISIBILITY_OPEN_PLATFORM: //2
                 if (isset($user_id) && !api_is_anonymous($user_id)) {
                     $is_allowed_in_course = true;
                 }

+ 2 - 2
main/newscorm/lp_add.php

@@ -148,7 +148,7 @@ $form->addElement('html','</div>');
 $defaults['activate_start_date_check']  = 1;
 
 $defaults['publicated_on']  = date('Y-m-d 08:00:00');
-$defaults['expired_on']     = date('Y-m-d 08:00:00',time()+84600);
+$defaults['expired_on']     = date('Y-m-d 08:00:00',time()+86400);
 
 $form->setDefaults($defaults);
 $form->addElement('style_submit_button', 'Submit',get_lang('CreateLearningPath'),'class="save"');
@@ -156,4 +156,4 @@ $form->addElement('style_submit_button', 'Submit',get_lang('CreateLearningPath')
 
 $form->display();
 // Footer
-Display::display_footer();
+Display::display_footer();

+ 28 - 1
main/search/INSTALL

@@ -36,4 +36,31 @@ Chamilo 1.8.8 + XAPIAN in Ubuntu 10.10
 8. Restart Apache
 9. Create a course and 2 *new* Learning paths for testing
 10.Edit the LPs created and add/edit the specific fields (i.e. Author, Body part, Technology, Topic)
-11.Go to the 
+11.Go to the
+
+On Ubuntu 12.04
+
+Chamilo 1.9.4 + Xapian in Ubuntu 12.04
+Since php5-xapian bindings are not available due to license inconsistencies, you have to build the php5-xapian package yourself.
+you can follow the instrucions on the xapian.org wiki: http://trac.xapian.org/wiki/FAQ/PHP%20Bindings%20Package
+build packages:
+	sudo apt-get build-dep xapian-bindings
+	sudo apt-get install php5-dev php5-cli devscripts
+	apt-get source xapian-bindings
+	cd xapian-bindings-1.2.*
+	rm -f debian/control debian/*-stamp
+	env PHP_VERSIONS=5 debian/rules maint
+	sed -i 's!include_path=php5$!include_path=$(srcdir)/php5!' php/Makefile.in
+	echo auto-commit >> debian/source/options
+	debuild -e PHP_VERSIONS=5 -us -uc 
+	cd ..
+
+ If you're using PHP 5.4, then subclassing Xapian classes in PHP doesn't currently work properly and the testsuite will fail with
+ a segmentation fault. The wrappers work otherwise, so if that's all you need, you can build the package without running the testsuite
+ by changing the penultimate command above to:
+
+env DEB_BUILD_OPTIONS=nocheck debuild -e PHP_VERSIONS=5 -us -uc 
+
+Then you can install the built package:
+
+sudo dpkg -i php5-xapian_*.deb

+ 5 - 5
main/webservices/courses_list.soap.php

@@ -90,13 +90,13 @@ function WSCourseList($username, $signature, $visibilities = 'public') {
 
     $local_key = $username.$key;
 
-    if (!api_is_valid_secret_key($signature, $local_key)) {
+    if (!api_is_valid_secret_key($signature, $local_key) && !api_is_valid_secret_key($signature, $username.$_configuration['security_key'])) {
         return -1; // The secret key is incorrect.
     }
-        //public-registered = open
-	$vis = array('public' => '3', 'public-registered' => '2', 'private' => '1', 'closed' => '0');
+    //public-registered = open
+    $vis = array('public' => '3', 'public-registered' => '2', 'private' => '1', 'closed' => '0');
 
-	$courses_list = array();
+    $courses_list = array();
 
 	if (!is_array($visibilities)) {
 		$visibilities = split(',', $visibilities);
@@ -111,7 +111,7 @@ function WSCourseList($username, $signature, $visibilities = 'public') {
 			$courses_list[] = array('code' => $course['code'], 'title' => api_utf8_encode($course_info['title']), 'url' => api_get_path(WEB_COURSE_PATH).$course_info['directory'].'/', 'teacher' => api_utf8_encode($course_info['tutor_name']), 'language' => $course_info['course_language']);
 		}
 	}
-	return $courses_list;
+    return $courses_list;
 }
 
 // Use the request to (try to) invoke the service.