Browse Source

Merge branch '1.10.x' of https://github.com/chamilo/chamilo-lms into B9070

Conflicts:
	main/course_home/course_home.php
	main/inc/lib/main_api.lib.php
	main/newscorm/learnpath.class.php
	main/newscorm/learnpathItem.class.php
Angel Fernando Quiroz Campos 10 years ago
parent
commit
cdff532cdf
100 changed files with 2117 additions and 1720 deletions
  1. 2 0
      CONTRIBUTING.md
  2. 0 13
      custompages/README
  3. 24 0
      custompages/README.md
  4. 0 0
      custompages/first_login-dist.php
  5. 0 0
      custompages/index-logged-dist.php
  6. 0 0
      custompages/index-unlogged-dist.php
  7. 0 0
      custompages/loggedout-dist.php
  8. 0 0
      custompages/lostpassword-dist.php
  9. 0 0
      custompages/registration-dist.php
  10. 0 0
      custompages/registration-feedback-dist.php
  11. 114 15
      documentation/changelog.html
  12. 5 0
      documentation/credits.html
  13. 1 1
      documentation/index.html
  14. 21 21
      documentation/installation_guide.html
  15. 19 7
      index.php
  16. 3 2
      main/admin/access_url_add_courses_to_url.php
  17. 2 2
      main/admin/access_url_add_users_to_url.php
  18. 1 1
      main/admin/access_url_edit.php
  19. 1 1
      main/admin/access_urls.php
  20. 0 1
      main/admin/add_courses_to_usergroup.php
  21. 0 1
      main/admin/add_sessions_to_promotion.php
  22. 0 1
      main/admin/add_sessions_to_usergroup.php
  23. 0 1
      main/admin/add_users_to_group.php
  24. 2 2
      main/admin/archive_cleanup.php
  25. 15 18
      main/admin/calendar.lib.php
  26. 5 5
      main/admin/class_list.php
  27. 468 432
      main/admin/configure_homepage.php
  28. 1 1
      main/admin/group_list.php
  29. 16 0
      main/admin/index.php
  30. 2 2
      main/admin/languages.php
  31. 1 1
      main/admin/session_course_user_list.php
  32. 1 1
      main/admin/session_import.php
  33. 86 76
      main/admin/settings.lib.php
  34. 138 99
      main/admin/settings.php
  35. 14 10
      main/admin/sub_language.class.php
  36. 2 2
      main/admin/sub_language_add.php
  37. 1 3
      main/admin/user_edit.php
  38. 4 4
      main/admin/user_fields.php
  39. 6 6
      main/admin/user_fields_options.php
  40. 357 355
      main/admin/user_move_stats.php
  41. 5 5
      main/announcements/announcements.inc.php
  42. 40 18
      main/attendance/attendance_controller.php
  43. 2 2
      main/attendance/attendance_list.php
  44. 15 15
      main/attendance/index.php
  45. 5 5
      main/auth/courses.php
  46. 13 13
      main/auth/courses_controller.php
  47. 1 1
      main/auth/inscription.php
  48. 7 7
      main/blog/blog.php
  49. 3 3
      main/blog/blog_admin.php
  50. 25 26
      main/calendar/agenda.inc.php
  51. 3 3
      main/calendar/agenda.lib.php
  52. 3 1
      main/calendar/myagenda.inc.php
  53. 6 5
      main/chat/chat.php
  54. 10 5
      main/chat/chat_message.php
  55. 0 1
      main/course_home/activity.php
  56. 11 15
      main/course_home/course_home.php
  57. 3 5
      main/coursecopy/copy_course_session.php
  58. 13 0
      main/css/base.css
  59. 15 36
      main/css/chamilo/default.css
  60. 2 3
      main/css/responsive.css
  61. 3 1
      main/document/document.php
  62. 1 1
      main/document/document_lite.php
  63. 2 2
      main/document/edit_document.php
  64. 12 2
      main/document/upload.php
  65. 11 11
      main/dropbox/dropbox_class.inc.php
  66. 12 12
      main/dropbox/dropbox_functions.inc.php
  67. 3 3
      main/exercice/addlimits.php
  68. 1 1
      main/exercice/answer.class.php
  69. 1 1
      main/exercice/answer_admin.inc.php
  70. 16 6
      main/exercice/evalmathnotation.php
  71. 35 35
      main/exercice/exercise.class.php
  72. 33 5
      main/exercice/exercise_show.php
  73. 2 2
      main/exercice/hotspot_actionscript.as.php
  74. 2 2
      main/exercice/hotspot_answers.as.php
  75. 1 1
      main/exercice/hotspot_save.inc.php
  76. 5 5
      main/exercice/hotspot_savescore.inc.php
  77. 1 1
      main/exercice/hotspot_updatescore.inc.php
  78. 4 4
      main/exercice/mark_free_answer.php
  79. 19 19
      main/exercice/question.class.php
  80. 26 29
      main/exercice/question_admin.inc.php
  81. 13 14
      main/exercice/question_create.php
  82. 175 172
      main/exercice/question_list_admin.inc.php
  83. 1 1
      main/exercice/savescores.php
  84. 10 10
      main/exercice/testcategory.class.php
  85. 6 9
      main/exercice/testheaderpage.php
  86. 0 1
      main/exercice/unique_answer.class.php
  87. 4 3
      main/exercice/upload_exercise.php
  88. 29 29
      main/forum/forumfunction.inc.php
  89. 12 2
      main/gradebook/gradebook_add_link.php
  90. 3 0
      main/gradebook/gradebook_display_certificate.php
  91. 8 5
      main/gradebook/gradebook_edit_cat.php
  92. 30 10
      main/gradebook/gradebook_edit_link.php
  93. 0 2
      main/gradebook/gradebook_flatview.php
  94. 5 1
      main/gradebook/index.php
  95. 19 8
      main/gradebook/lib/be/abstractlink.class.php
  96. 2 1
      main/gradebook/lib/be/attendancelink.class.php
  97. 49 25
      main/gradebook/lib/be/category.class.php
  98. 3 1
      main/gradebook/lib/be/evallink.class.php
  99. 31 2
      main/gradebook/lib/be/evaluation.class.php
  100. 33 28
      main/gradebook/lib/be/exerciselink.class.php

+ 2 - 0
CONTRIBUTING.md

@@ -9,6 +9,8 @@ If you'd like to contribute, please read the following document:
 * [PSR-1][2]: PSR-1 are standard conventions rules we use as a base (conversion of old code still in progress)
 * [PSR-2][3]: PSR-2 are more detailed standard conventions rules we use as base (conversion of old code still in progress)
 
+We expect contributions to be sent through Pull Requests, a special feature of Github. We recommend you follow this guide to understand a little more about the way it works: https://guides.github.com/activities/contributing-to-open-source/
+
 [1]: https://support.chamilo.org/projects/chamilo-18/wiki/Coding_conventions
 [2]: https://github.com/php-fig/fig-standards/blob/master/accepted/PSR-1-basic-coding-standard.md
 [3]: https://github.com/php-fig/fig-standards/blob/master/accepted/PSR-2-coding-style-guide.md

+ 0 - 13
custompages/README

@@ -1,13 +0,0 @@
-CustomPages looks for alternatives in this directory, and displays them if present. The user-provided custom pages must exactly be named as such :
-
-- index-logged.php for the general landing page before login
-- index-unlogged.php for the general landing page when already logged-in
-- registration.php for the registration form
-- registration-feedback.php for the registration success feedback
-- lostpassword.php for the password recovery form
-- lostpassword-feedback.php for the password recovery feedback page
-
-Important note :
-Enable the use_custom_pages setting
-
-If you pull this feature from a repo, not through an upgrade or install process, you have to exectute the following SQL statements in the main database or this option won't appear in the admin interface :

+ 24 - 0
custompages/README.md

@@ -0,0 +1,24 @@
+Custom pages
+=============
+
+CustomPages looks for alternatives in this directory, and displays them if present.
+The user-provided custom pages must exactly be named as such :
+
+- index-logged.php for the general landing page before login
+- index-unlogged.php for the general landing page when already logged-in
+- registration.php for the registration form
+- registration-feedback.php for the registration success feedback
+- lostpassword.php for the password recovery form
+
+
+### Installation
+
+- Enable the use_custom_pages setting
+- Create your own modifications based in the files with the suffix "-dist.php"
+
+### Important notes
+
+- Do not replace the images in the images/ directory.
+  Instead, create new images, as the current ones will be overwritten
+  by each Chamilo upgrade.
+

+ 0 - 0
custompages/first_login.php → custompages/first_login-dist.php


+ 0 - 0
custompages/index-logged.php → custompages/index-logged-dist.php


+ 0 - 0
custompages/index-unlogged.php → custompages/index-unlogged-dist.php


+ 0 - 0
custompages/loggedout.php → custompages/loggedout-dist.php


+ 0 - 0
custompages/lostpassword.php → custompages/lostpassword-dist.php


+ 0 - 0
custompages/registration.php → custompages/registration-dist.php


+ 0 - 0
custompages/registration-feedback.php → custompages/registration-feedback-dist.php


+ 114 - 15
documentation/changelog.html

@@ -44,9 +44,22 @@
 <p><i>Note: most #wxyz references are issue numbers you can find in <a href="http://support.chamilo.org/projects/chamilo-18/issues" target="_blank">our public bug tracking system</a>. Some references marked BT#xyz are developments made externally for BeezNest customers and integrated into Chamilo. The details of these tasks cannot be seen for confidentiality reasons, but the code change is public and can be reviewed by anyone.</i></p>
 <p>&nbsp;</p>
 
-<h1>Chamilo 1.9.10 - Huánuco, 10th of November, 2014</h1>
+<h1>Chamilo 1.10.0 - ???, ??? 2015</h1>
 <h3>Release notes - summary</h3>
-<p>Chamilo 1.9.10 is a patch version with a few minor bugfixes and a new packaging. This will be packaged and promoted as 1.9.8, but the folder inside the 1.9.8 will be called 1.9.10, with a few changes to this changelog file and a few fixes throughout the code (as such, you can just overwrite previous files to upgrade from 1.9.8, 1.9.8.1 or 1.9.8.2 to 1.9.10).</p>
+<p>Chamilo 1.10.0 is a major version of the 1.10.x branch, with new features and bugfixes on top of 1.9.10. As a major version, it requires the use of the upgrade script in order to upgrade an existing Chamilo portal. See install instructions</p>
+<h3>Release name</h3>
+<h3>Security fixes</h3>
+<h3>Possibly breaking changes</h3>
+<h3>Notable new Features</h3>
+<h3>Improvements (minor features) and debug</h3>
+<h3>Stylesheets and theming</h3>
+<h3>Web services</h3>
+<h3>Removals</h3>
+
+
+<h1>Chamilo 1.9.10 - Huánuco, 25th of January, 2015</h1>
+<h3>Release notes - summary</h3>
+<p>Chamilo 1.9.10 is a new minor version of the 1.9.x branch, with many bugfixes and a few interesting new features (as such, you can just overwrite previous files to upgrade from 1.9.8, 1.9.8.1 or 1.9.8.2 to 1.9.10).</p>
 <h3>Release name</h3>
 <p><a href="http://es.wikipedia.org/wiki/Departamento_de_Huánuco">Huánuco</a> is
   a small city in the Peruvian Andes, Northeast of Lima. This is a special
@@ -63,36 +76,48 @@
   platform, that will serve its purpose, helping making education better and
   more widely available, better than ever before.</p>
 
-<h3>Possibly breaking changes</h3>
-<p>Two changes have been made to the forum tool code, which might make some of your forums disappear and require a direct database intervention.<br />
-First case: If you use forums with sessions and have placed a session forum inside a base-course forum category, the forum category will now no longer appear in any session, and as such, the session forums contained in that category will disappear. You can easily fix that by checking the c_forum_forum table for any record with session_id != 0 that points to a forum category that has session_id == 0. This is related to issue #7264.<br />
-Second case: if you use group forums and have had issues with posts appearing twice, then this release will fix this bug, but might also make some forum posts disappear. Although we could not reproduce the error, you should be able to fix it by changing the group_id column inside the c_forum_thread table. This is related to issue #7267<br />
-This is an exceptional event in the history of Chamilo, and we believe it should only affect very few portals, but we prefer to take precautionnary measures and warn you upfront.<br />
-</p>
-
-<h3>Security</h3>
+<h3>Security fixes</h3>
 All security issues are published and patches are attached on <a href="https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues">our security issues page</a>. If you think you found an additional security issue you'd like to report, please check our procedure there.
 <ul>
   <li>(8a75f65 - #7242) Fix SQL injection in mySpace/users.php</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/d64a02c156c7adf3983807be860a7848311dbfb3">d64a02c1</a> - <a href="https://support.chamilo.org/issues/7272">#7272</a>) Fix SQL injection threats and replace SESSION variable with api_get_user_id</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/587961662a8f9d035e52f14cd0aa4fee3aee68d8">58796166</a> - <a href="https://support.chamilo.org/issues/7275">#7275</a>) Add security token to course copy tool</li>
+  <li>(<a href="https://support.chamilo.org/issues/7440">#7440</a>) Fix a series of SQL injection vulnerabilities due to integer filtering</li>
 </ul>
 
+<h3>Possibly breaking changes</h3>
+<p>Two changes have been made to the forum tool code, which might make some of your forums disappear and require a direct database intervention.<br />
+    First case: If you use forums with sessions and have placed a session forum inside a base-course forum category, the forum category will now no longer appear in any session, and as such, the session forums contained in that category will disappear. You can easily fix that by checking the c_forum_forum table for any record with session_id != 0 that points to a forum category that has session_id == 0. This is related to issue #7264.<br />
+    Second case: In very rare occasions, if you use group forums and have had issues with posts appearing twice, then this release will fix this bug, but might also make some forum posts disappear. Although we could not reproduce the error, you should be able to fix it by changing the group_id column inside the c_forum_thread table. This is related to issue #7267<br />
+    This is an exceptional event in the history of Chamilo, and we believe it should only affect very few portals, but we prefer to take precautionnary measures and warn you upfront.<br />
+</p>
+
 <h3>Notable new Features</h3>
 <ul>
-  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/57750c212909bb4d74fb7b4bbba93b836c69979e">57750c21</a> - <a href="https://task.beeznest.com/issues/8900">BT#8900</a>) Adding progress in learning paths report</li>
-  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/903436eadfd7bc4cb8b20136301ceaba165b4ae1">903436ea</a> - <a href="https://task.beeznest.com/issues/8902">BT#8902</a>) Adding learning paths reduced report</li><li>(<a href="https://github.com/chamilo/chamilo-lms/commit/1a6a4a927eaf9aa919e47852a5ea7d6698063fac">1a6a4a92</a> - <a href="https://support.chamilo.org/issues/7272">#7272</a>) Add possibility for plugins to define main tabs</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/7e67dd29ccd7198ffb26e06847b48409895bc161">7e67dd29</a> - <a href="https://task.beeznest.com/issues/9018">BT#9018</a>) Add PDF export for student publications list</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/5e8ae687fd8a303e707a6a4fa677313056eb87c7">5e8ae687</a> - <a href="https://support.chamilo.org/issues/7478">#7478</a>) Add cookie warning message to comply with new European legislation</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/e637608c553c1041ae0c7f217d74f748f48bd789">e637608c</a> - <a href="https://task.beeznest.com/issues/8814">BT#8814</a>) Add "Auto attendance" based on course login</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/960899a6b227e1547751fcade680a696dffdcb1e">960899a6</a>) Add possibility to hide previous videoconferences even if recording is not enabled</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/3bc8fd6fad15e6d92e8c1fd32e28d531c8c07d1d">3bc8fd6f</a>) Add $_configuration['document_if_file_exists_option']</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/73e381620438970423d371e717ad0bb8d5667a29">73e38162</a> - <a href="https://task.beeznest.com/issues/9247">BT#9247</a>) Adding exercise_max_fckeditors_in_page setting</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/b14bcb36ad2145721205145561ae9a2d024a3a36">b14bcb36</a>) Add option $_configuration['certificate_pdf_orientation']</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/6bd4b5df0db53da2e586f1dac514873aca11ba7b">6bd4b5df</a> - <a href="https://task.beeznest.com/issues/8814">BT#8814</a>) Add auto attendance</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/7dbed8004f3a7da69a187df1de1cf7034097dfd7">7dbed800</a> - <a href="https://task.beeznest.com/issues/8703">BT#8703</a>) Add hosting total size checker</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/218dc6a4d7f27026b51df142a4b41d944bf44423">218dc6a4</a> - <a href="https://task.beeznest.com/issues/9175">BT#9175</a>) Add hosting_limit_active_courses setting</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/1d68db47b2dcb00a36e5b2d90e5be3cd6494cd56">1d68db47</a> - <a href="https://support.chamilo.org/issues/398">#398</a>) Support Opale/Scenarii by adding variable to better support SCORM 1.2 by watching over the definition, by the SCO, of the lesson_status and the call to LMSFinish() or the move to another element</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/57750c212909bb4d74fb7b4bbba93b836c69979e">57750c21</a> - <a href="https://task.beeznest.com/issues/8900">BT#8900</a>) Add progress in learning paths report</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/903436eadfd7bc4cb8b20136301ceaba165b4ae1">903436ea</a> - <a href="https://task.beeznest.com/issues/8902">BT#8902</a>) Add learning paths reduced report</li><li>(<a href="https://github.com/chamilo/chamilo-lms/commit/1a6a4a927eaf9aa919e47852a5ea7d6698063fac">1a6a4a92</a> - <a href="https://support.chamilo.org/issues/7272">#7272</a>) Add possibility for plugins to define main tabs</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/ef242abd937637ec96973ecd7ad7b431949eab87">ef242abd</a> - <a href="https://support.chamilo.org/issues/7255">#7255</a>) Add multiple file upload in forum, and show list of attachment files from view threads</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/c8f940be4aa4587e57fb36bab800b3e90a4f8762">c8f940be</a> - <a href="https://support.chamilo.org/issues/7338">#7338</a>) Add REST web service to get personal messages (from inbox)</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/2db9057d7b589e1d91554f5f39df415c810aeb95">2db9057d</a> - <a href="https://support.chamilo.org/issues/7328">#7328</a>) Add theme_backup and default_template settings</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/8d9a82535e9a1f6e11832f8217809d6e8cae9b36">8d9a8253</a>) Add script to check users data in CSV file</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/f52df87bded7b10787bec5516124024b5ad4edea">f52df87b</a> - <a href="https://task.beeznest.com/issues/8845">BT#8845</a>) Add script to move users from one course to another depending on them having passed an exam or not</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/27493b32acc9d6cde3e95b5a34e4c03dcc004589">27493b32</a> - <a href="https://support.chamilo.org/issues/7324">#7324</a>) Add possibility to hide recordings to students in conferences list in BBB plugin</li>
-  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/c24c758f7469fd73646892f2d37636d158c9fd8a">c24c758f</a> - <a href="https://task.beeznest.com/issues/8840">BT#8840</a>) Adding $_configuration['auto_detect_language_custom_pages'] to detect the language in custom pages</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/c24c758f7469fd73646892f2d37636d158c9fd8a">c24c758f</a> - <a href="https://task.beeznest.com/issues/8840">BT#8840</a>) Add $_configuration['auto_detect_language_custom_pages'] to detect the language in custom pages</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/a2ff44cf6978393a3b5577afd408f11d58694c3c">a2ff44cf</a> - <a href="https://support.chamilo.org/issues/7212">#7212</a>) Add calculated answers feature (in beta test)</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/25cd7ddc4928c76591dd983b05abf6a7cf929654">25cd7ddc</a>) Use .gitattributes file to enable special Github features for versions packaging</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/002a0ab5a3901e8f8ef277ba06d841598c7ea93d">002a0ab5</a> - <a href="https://support.chamilo.org/issues/7309">#7309</a>) New icons for questions types</li>
-  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/0d131f9e4ee054d8099cbe470130aaa4e5ac01bc">0d131f9e</a> - <a href="https://task.beeznest.com/issues/8746">BT#8746</a>) Adding option "include all users" to export</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/0d131f9e4ee054d8099cbe470130aaa4e5ac01bc">0d131f9e</a> - <a href="https://task.beeznest.com/issues/8746">BT#8746</a>) Add option "include all users" to export</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/88126fe2e20114c0a62dcf282b37624ac6837965">88126fe2</a> - <a href="https://task.beeznest.com/issues/8796">BT#8796</a>) Add option to prevent multiple simultaneous login option ($_configuration['multiple_connection_not_allowed'])</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/58334f81813bf4f98fd29c1c0b39e8510fb7de2e">58334f81</a> - <a href="https://task.beeznest.com/issues/8746">BT#8746</a>) Add OnlyBestAttempts option to show only the best attempts in exercise results list</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/8ad728a6637a44570712e7c14e66b3b7bcea5f33">8ad728a6</a> - <a href="https://support.chamilo.org/issues/7279">#7279</a>) Add tour plugin</li>
@@ -122,6 +147,80 @@ All security issues are published and patches are attached on <a href="https://s
 
 <h3>Improvements (minor features) and debug</h3>
 <ul>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/110060be24244a8f8cfb9837bf9500aaddf2bc3a">110060be</a> - <a href="https://support.chamilo.org/issues/7462">#7462</a>) Fix pages blocked due to course restriction</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/299ba994390549c0193348c498760e727236609c">299ba994</a> - <a href="https://support.chamilo.org/issues/7477">#7477</a>) Restore admin view in reports (was lost in 1.9.8)</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/7f55f83751bd8d0e641afb85f05093f5e42c8bd6">7f55f837</a>) Rename the custompages php files in order to avoid overwrites</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/306c7b08d9a89cdde94e76cb47c1054eb01688fd">306c7b08</a>) Fix possible error when there are a lot of certicates to load.</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/bc07d715730d3035c2282a9de0ee8a2aba8b9f24">bc07d715</a> - <a href="https://task.beeznest.com/issues/9289">BT#9289</a>) Adds set_time_limit(0) in the certificate generation page</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/f1c9210c4dce32a7b8dca9c3b545bd1e515f3c2b">f1c9210c</a> - <a href="https://task.beeznest.com/issues/9287">BT#9287</a>) Add name_order_conventions configuration option</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/7820985bdda730332f7a0432b53611f904bce811">7820985b</a> - <a href="https://task.beeznest.com/issues/9280">BT#9280</a>) Fix homepage edition</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/e57d9a668f0f8824350e56be4ba6dca9e481b065">e57d9a66</a>) Fix category link now forcing the registration in itemproperty table</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/c303f2392ddcf944e3c8afa62fd6db4e5dc5eea9">c303f239</a>) Add id_session in gradebook links</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/94ff182d7f46739afa9dfcb06b2a92d8b23f2efe">94ff182d</a>) Deprecate get_statistic_table() in favour of get_main_table()</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/a4a4118afbeeea1c20b9c5cedf776b7a07ab7832">a4a4118a</a>) Fix gradebook form link</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/4c70421ccf99006f0019805a2f83e4f69fe46f2c">4c70421c</a> - <a href="https://task.beeznest.com/issues/9200">BT#9200</a>) Fix link categories (no visibility is used)</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/57e2ffbed22849e1848cf4dd79bfb4d83e5de636">57e2ffbe</a>) Fix comments in student publication list</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/699f26c5ff54c70b18ae0381a26b43c1188c0f07">699f26c5</a> - <a href="https://support.chamilo.org/issues/7441">#7441</a>) Fix default user list order</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/533b0385015281818a0a8fbfac6171d11f1432e7">533b0385</a> - <a href="https://support.chamilo.org/issues/7457">#7457</a>) Fix deletion of personal files in documents</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/28c6e5e610e294f167c0f687e8de7a4c0746f3fc">28c6e5e6</a> - <a href="https://support.chamilo.org/issues/7447">#7447</a>) Fix api_mail_html (adding error log, adding return)</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/8cb2d42f7d391e47a7ff07675ea4a24ca9480523">8cb2d42f</a> - <a href="https://support.chamilo.org/issues/7455">#7455</a>) Using strict mode when cleaning files</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/4a17ad6ba29c4c6c8a1b52ce00131cefddbd6fb7">4a17ad6b</a> - <a href="https://task.beeznest.com/issues/8897">BT#8897</a>) Fix chapter status when saving sub elements in learning paths</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/4f2ac346557fba49def05489f32afccdc5ea062e">4f2ac346</a> - <a href="https://support.chamilo.org/issues/6064">#6064</a>) Fix language list</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/a667212d82788c6676fa9be76a245c48ba5ce99d">a667212d</a> - <a href="https://support.chamilo.org/issues/398">#398</a>) Fix query bug in learnpathItem::write_to_db()</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/4f2ac346557fba49def05489f32afccdc5ea062e">4f2ac346</a> - <a href="https://support.chamilo.org/issues/6064">#6064</a>) Fixing language list in portal homepage edition</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/d36c633267b4ec66dec8e04054be2c1db0aae55f">d36c6332</a> - <a href="https://task.beeznest.com/issues/9250">BT#9250</a>) Add certificate_filter_by_official_code</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/ef1dc064ea934ad27f4972d223de8420c3c42854">ef1dc064</a> - <a href="https://support.chamilo.org/issues/9250">#9250</a>) Add export certificates by user list</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/d9a6fc7d5a02858e5a5dc0469ed219ee18b0521c">d9a6fc7d</a> - <a href="https://task.beeznest.com/issues/9235">BT#9235</a>) If user selects overwrite then we overwrite the file</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/74c25067aa05e139ab84ab3730d3b1a267fe0730">74c25067</a> - <a href="https://task.beeznest.com/issues/9233">BT#9233</a>) Coach can download files if session is read only</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/5d74663bae828477d30211af5cf51ab65b9302f0">5d74663b</a>) Fixing session list when session is read only and inside a category.</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/52c806a671d8f782f128edeefe8f42977e4c1907">52c806a6</a>) Fix possible issue checking the courses directory during installation on a host with default IP</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/c916b21c1cf7291a0099caadfa97bd91bda387e4">c916b21c</a>) Add reporting icon for DRH see 7064</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/e316005a56a9dea6f51697a7f5f7a0a15eddcdc7">e316005a</a> - <a href="https://support.chamilo.org/issues/7064">#7064</a>) Drh can see wiki</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/0a64437eed2aceb4d4dbae766236409cc9ae88ac">0a64437e</a> - <a href="https://support.chamilo.org/issues/7064">#7064</a>) Add DRH support for the survey tool</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/3adf5c2d5761498fe51242821e342b8010c96498">3adf5c2d</a> - <a href="https://support.chamilo.org/issues/7064">#7064</a>) Add DRH support in Assignments</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/1d2626f2f264012e3a071f2e6931210bc61c6ff1">1d2626f2</a> - <a href="https://task.beeznest.com/issues/6986">BT#6986</a>) Fixing hotpotatoe bug while saving inside a LP</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/5e410a7ffed94a7402360f01ee59c87be2f36c53">5e410a7f</a> - <a href="https://task.beeznest.com/issues/6986">BT#6986</a>) Deleting LP objects in course homepage just in case</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/dc784cfe99e7e87ec0c026cd7d2c896e13b26e60">dc784cfe</a> - <a href="https://task.beeznest.com/issues/7802">BT#7802</a>) Add calendar event extra fields</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/3684281a884a3f7702d268e2f676f165b19350e9">3684281a</a> - <a href="https://task.beeznest.com/issues/7064">BT#7064</a>) DRH user can see exercise results</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/c6209ec7accc6cbf03ed63f550420f310532d71e">c6209ec7</a> - <a href="https://task.beeznest.com/issues/8816">BT#8816</a>) Adding "student_publication_to_take_in_gradebook" setting</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/601f44fe751ec172e1d3aed18c4e2bc2232f91e3">601f44fe</a> - <a href="https://task.beeznest.com/issues/8816">BT#8816</a>) Showing feedback if exists</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/4ad8b8b764a7317e25829b15ae966fc9c8a79709">4ad8b8b7</a> - <a href="https://task.beeznest.com/issues/9183">BT#9183</a>) Showing course icon instead of classic green course icon</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/b9668733c5f6d0627b22b37c101729443d0ec04f">b9668733</a> - <a href="https://task.beeznest.com/issues/8852">BT#8852</a>) Fixing upload + unzip</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/ac3d7525f008adc98c7747e3633849224e8d4927">ac3d7525</a>) Getting extra fields that have the filter option "on" in the user list</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/5a427a88bb8a4c1f0e2596ec0dbe035678b4c0e1">5a427a88</a>) Adding "detect_deleted_visible_documents.php" script.</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/3ae83db63526db27e3bf3f214ef242e3e5323024">3ae83db6</a>) Adding COURSE_REQUEST_* constants.</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/dc2745c191f9927074e9b72bf125722c759657c0">dc2745c1</a> - <a href="https://task.beeznest.com/issues/9121">BT#9121</a>) Subscribe users with no course to a selected course</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/0056481a9231ee2c5905542395307595a05043e3">0056481a</a> - <a href="https://task.beeznest.com/issues/9113">BT#9113</a>) Fixing work assigned to users in a course-session</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/1bc9f0abb77e5c911550ff4834a97b3275f00dff">1bc9f0ab</a> - <a href="https://support.chamilo.org/issues/7426">#7426</a>) Use new variable for signature formula in emails</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/b9d48abcec84df3cc328341859b855d2c850a309">b9d48abc</a> - <a href="https://task.beeznest.com/issues/9104">BT#9104</a>) Add script to update extra field in batch</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/7bdf7db2420dcc98209dfc22db0fc3f035e1553c">7bdf7db2</a> - <a href="https://support.chamilo.org/issues/7338">#7338</a>) Add CORS and content type headers to JSON response</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/3e500c8e58dbfd0b4ad0db276b687624f695fb92">3e500c8e</a> - <a href="https://support.chamilo.org/issues/7338">#7338</a>) Add sent date to message</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/5eb945a5893413f78c5bacb5611acb7ab01b9d94">5eb945a5</a> - <a href="https://support.chamilo.org/issues/7338">#7338</a>) Sort messages by recent date</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/4f9b1911f62906d464975ea9d6dd78cb845455a3">4f9b1911</a> - <a href="https://task.beeznest.com/issues/8897">BT#8897</a>) Fix issue updating next SCO element instead of current</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/ce6314e89db71d9098ce794ff8c40182118b51f6">ce6314e8</a> - <a href="https://support.chamilo.org/issues/7439">#7439</a>) Fix issue with progress bar not updating percentage</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/17f1e0e925daef72519e7bbae212915fd4816fe0">17f1e0e9</a> - <a href="https://task.beeznest.com/issues/8274">BT#8274</a>) Add condition that ppt2lp must be local before enabling converter icon - remote support not implemented yet</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/8493d094299a85f318fc3c0349a42f8f1c43b0b5">8493d094</a> - <a href="https://task.beeznest.com/issues/9101">BT#9101</a>) Showing only visible/invisible exercises</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/d78fa9c1944ec98221985f94f5f7023807d60e4c">d78fa9c1</a>) Adding DRH users in user list.</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/0d5a86cdec9a03450f32d3df078d3bb068b4f2f3">0d5a86cd</a> - <a href="https://support.chamilo.org/issues/7418">#7418</a>) Fix show hide course progress details</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/28cbdc2c6afdaccfab5febe35449903d39a876ed">28cbdc2c</a> - <a href="https://support.chamilo.org/issues/7406">#7406</a>) Enable viewerJS for ODF</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/f9f53d152a83befb7c5337925d70c4f205637769">f9f53d15</a> - <a href="https://support.chamilo.org/issues/7415">#7415</a>) css update list course fix CT#7415</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/fd6d32de6c5f82c1977e97791f22a49c5b5dd47c">fd6d32de</a> - <a href="https://support.chamilo.org/issues/7414">#7414</a>) Redirect admin to the admin page on first login</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/d3c39e1213675bb5ae33a8f6138a0301183a2d15">d3c39e12</a> - <a href="https://task.beeznest.com/issues/8986">BT#8986</a>) Build and restore base course content or session content</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/94604584aaa1d53a1a800eb79d72d9a0b7e2186a">94604584</a> - <a href="https://task.beeznest.com/issues/9021">BT#9021</a>) Allow profile edition through SSO</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/6ac9959a3176cdf3d8f350e4f91bf93333cc0bb0">6ac9959a</a> - <a href="https://support.chamilo.org/issues/7383">#7383</a>) Fix for graph labels and block evaluation height graph</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/3587db2180ba30b30834f0dda51f443fa067051d">3587db21</a> - <a href="https://support.chamilo.org/issues/7388">#7388</a>) Adding aspell settings</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/36bf8746204afcad3f60dad5cc54437bc346fd85">36bf8746</a> - <a href="https://task.beeznest.com/issues/9046">BT#9046</a>) Don't show links if the category was deleted</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/3bc102535d72a83c43e6bd2ad3889efa576b56da">3bc10253</a> - <a href="https://task.beeznest.com/issues/7355">BT#7355</a>) Removing $_COOKIE['TestCookie'] validation</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/97fda734b5e5f4c29a7afd1dd9a386d358277092">97fda734</a> - <a href="https://task.beeznest.com/issues/9017">BT#9017</a>) Adding feedback notifications</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/e058fd58838161bd6c2210fce4df631d39d9ca07">e058fd58</a>) Only look for completed attempts status = '' in Learning paths</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/7f85cac35a4439b9875d19f80bfcdbea0d32631e">7f85cac3</a> - <a href="https://task.beeznest.com/issues/9016">BT#9016</a>) Adding flash messages</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/d180448e3c1cf0b675494db26832534e66e8493e">d180448e</a> - <a href="https://support.chamilo.org/issues/7395">#7395</a>) Fix bug gradebook category action  missing cidReq param</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/b3a0d4ed94fd313348e72b35e49376514980c07e">b3a0d4ed</a> - <a href="https://support.chamilo.org/issues/7381">#7381</a>) Fix bug in visibility change action from personal agenda</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/3d8a33bafab63eb3481cc677ac97f5f1c0a167cd">3d8a33ba</a> - <a href="https://task.beeznest.com/issues/9029">BT#9029</a>) Hide the Logout button</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/008e7ffa3ed0217c1503135079679e10a7f1d722">008e7ffa</a> - <a href="https://support.chamilo.org/issues/398">#398</a>) Add quotes filter to suspend_data, lesson_location and launch_data to avoid issues with SCORM strings, as suggested by Stéphane Poinsart</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/b3862ee36fd916c89ae662f7f566a2e0ddd718c2">b3862ee3</a> - <a href="https://support.chamilo.org/issues/398">#398</a>) Add scorm_failed style and fix section style</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/693ff8e34d960a0543a3e77ba10cffb8c16fb8fe">693ff8e3</a> - <a href="https://support.chamilo.org/issues/7356">#7356</a>) add icons 128 64 48 32 new poll _na refs CT#7356</li>
+  <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/dfcc4f8235387ced19cfccf44b8240d59b2ecd58">dfcc4f82</a> - <a href="https://support.chamilo.org/issues/7356">#7356</a>) Fix issue with disappearing icons in survey questions (partial)</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/b83d51176db338399328b2b6d559bdee153c21e0">b83d5117</a> - <a href="https://support.chamilo.org/issues/7325">#7325</a>) Fix issue with the version number not being extracted correctly from version.chamilo.org/version.php by an fread() on a HTTP socket</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/7d658aedf48ad8a3a540b417eb82766b2c78477c">7d658aed</a>) If course is not set then fire api_not_allowed() even if I'm admin.</li>
   <li>(<a href="https://github.com/chamilo/chamilo-lms/commit/20f981bcb7bb80f41a165d75002cf981a0cd4c23">20f981bc</a>) Adding script that helps to synchronize exercise score with lp score</li>
@@ -291,7 +390,7 @@ All security issues are published and patches are attached on <a href="https://s
 <h3>Stylesheets and theming</h3>
 <ul>
   <li>No major style changes in this version, but a lot of visual improvements</li>
-  <li>The possibility to select a template (from main/template/) through the configuration.php file has been added, although no new template is available yet</li>
+  <li>The possibility to select a template (from main/template/) through the configuration.php file has been added, although no new template is available yet (at least now you can create your own and use it)</li>
   <li>Old question types icons were replaced by new icons</li>
   <li>Old session "window" icon was replaced by a new icon</li>
 </ul>

+ 5 - 0
documentation/credits.html

@@ -58,6 +58,11 @@ In the following credits, when possible, we tried to put the latest contributors
 <a name="core-developers"></a>
 <h1>Core contributors / Core team</h1>
 <p>The core contributors are the people who contributed most to the Chamilo software. We are eternally thankful to them for having demonstrated a very high level of commitment, contributing their time and ideas to the project. Since version 1.9, we also include non-developer contributors as we consider their help is essential to the success of our project. This list is updated with each version.</p>
+<h2>Chamilo LMS 1.10.*</h2>
+<ul>
+  <li>Yannick Warnier (yannick.warnier@beeznest.com) - Technical coordinator, Project Leader - BeezNest, Belgium/Peru</li>
+  <li>Julio Allen Montoya Armas (gugli100@gmail.com) - Lead developer - BeezNest, France</li>
+</ul>
 <h2>Chamilo LMS 1.9.*</h2>
 <ul>
   <li>Yannick Warnier (yannick.warnier@beeznest.com) - Technical coordinator, Project Leader - BeezNest, Belgium/Peru</li>

+ 1 - 1
documentation/index.html

@@ -33,7 +33,7 @@
 <div class="container">
     <div class="row">
         <div class="hero-unit">
-            <h1>Chamilo 1.9 - Documentation</h1>
+            <h1>Chamilo 1.10 - Documentation</h1>
             <br />
 
             <a class="btn btn-primary btn-large" href="installation_guide.html">English installation guide</a>

+ 21 - 21
documentation/installation_guide.html

@@ -326,7 +326,7 @@ previous version of Chamilo LMS (1.*) or Dok€os (&lt;2.0)</h2>
 Before upgrading, we <b>heavily</b> recommend you do a full backup of the previous
 Chamilo or Dok€os directories and databases. If you are unsure how to achieve this
 please ask your hosting provider for advice.<br />
-<em>Chamilo LMS 1.9 comes with a new database structure in comparison to 1.8. 
+<em>Chamilo LMS 1.10 comes with a new database structure in comparison to 1.9, and so between 1.9 and 1.8. 
 Although the upgrade script takes the migration in charge, it might be generating
 a very heavy load on your server during the upgrade, and will change your 
 database completely, preserving the data as well as possible (we have tested 
@@ -346,30 +346,30 @@ please contact one of the Chamilo Association's official providers &lt;providers
 
 <p></p>
 
-<h3>3.1 Upgrading from Chamilo 1.9.x (minor upgrade)</h3>
-As this is only a minor version change from previous 1.9.* versions of Chamilo, the only thing you need to do is:
+<h3>3.1 Upgrading from Chamilo 1.10.x (minor upgrade)</h3>
+As this is only a minor version change from previous 1.10.* versions of Chamilo, the only thing you need to do is:
 <ul>
   <li> check that you haven't left any customised stylesheet or image <span class="muted">(if you have, make sure you keep a copy on the side*)</span></li>
-  <li> download the Chamilo 1.9 install package from the <a href="http://www.chamilo.org/download">Chamilo download page</a></li>
-  <li> unzip the new files of Chamilo 1.9 over the files of the older version
+  <li> download the Chamilo 1.10 install package from the <a href="http://www.chamilo.org/download">Chamilo download page</a></li>
+  <li> unzip the new files of Chamilo 1.10 over the files of the older version
     (or unzip the files in one folder and then copy the files from there to the
     older version's directory). Note that you should remove the "home" and
     "searchdb" directories from the package before you overwrite the previous
     files.</li>
-  <li> edit the main/inc/conf/configuration.php file: at the en of the file, locate the previous version number (e.g. '1.9.4') and change it to this new version (e.g. '1.9.8')</li>
+  <li> edit the main/inc/conf/configuration.php file: at the en of the file, locate the previous version number (e.g. '1.10.4') and change it to this new version (e.g. '1.10.8')</li>
   <li> you're done! No other upgrade procedure is required</li>
 </ul>
 
 <br />
 
 
-<h3>3.2 Upgrading from Chamilo 1.8.x</h3>
+<h3>3.2 Upgrading from Chamilo 1.8.x or 1.9.x</h3>
 <ul>
   <li> check that you haven't left any customised stylesheet or image <span class="muted">(if you have, make sure you keep a copy on the side*)</span></li>
-  <li> download the Chamilo 1.9 install package from the <a href="http://www.chamilo.org/download">Chamilo download page</a></li>
-  <li> unzip the new files of Chamilo 1.9 over the files of the older version (or unzip the files in one folder and then copy the files from there to the older version's directory)</li>
+  <li> download the Chamilo 1.10 install package from the <a href="http://www.chamilo.org/download">Chamilo download page</a></li>
+  <li> unzip the new files of Chamilo 1.10 over the files of the older version (or unzip the files in one folder and then copy the files from there to the older version's directory)</li>
   <li> point your browser on your portal URL + main/install/</li>
-  <li> choose your language and click&nbsp;<span style="font-style: italic;">Upgrade from 1.8.x</span></li>
+  <li> choose your language and click&nbsp;<span style="font-style: italic;">Upgrade from 1.8.x/1.9.x</span></li>
 </ul>
 
 <br />
@@ -379,10 +379,10 @@ As this is only a minor version change from previous 1.9.* versions of Chamilo,
 <em>If you upgrade from Dok€os 1.8.x</em> :&nbsp;
 <ul>
   <li> check that you haven't left any customised stylesheet or image <span class="muted">(if you have, make sure you keep a copy on the side*)</span></li>
-  <li> download the Chamilo 1.9 install package from the <a href="http://www.chamilo.org/download">Chamilo download page</a></li>
-  <li> unzip the new files of Chamilo 1.9 over the files of the older version (or unzip the files in one folder and then copy the files from there to the older version's directory)</li>
+  <li> download the Chamilo 1.10 install package from the <a href="http://www.chamilo.org/download">Chamilo download page</a></li>
+  <li> unzip the new files of Chamilo 1.10 over the files of the older version (or unzip the files in one folder and then copy the files from there to the older version's directory)</li>
   <li> point your browser on your portal URL + main/install/</li>
-  <li> choose your language and click&nbsp;<span style="font-style: italic;">Upgrade from 1.8.x</span></li>
+  <li> choose your language and click&nbsp;<span style="font-style: italic;">Upgrade from 1.8.x/1.9.x</span></li>
 </ul>
 A bunch of Chamilo administrators have reported minor issues with the migration between versions considerably apart (like from Dok€os to Chamilo).
 This might include loosing some assignments or forum posts. To avoid any ugly effect on your users, we recommend you first establish a checklist
@@ -425,9 +425,9 @@ The complete process is as follow:
     <em>old_version</em> and make it writeable by the web server. This
 is important to allow the move of the courses/ and upload/ directories
 to the new install</li>
-  <li> download the Chamilo 1.9 install package from the
+  <li> download the Chamilo 1.10 install package from the
     <a href="http://www.chamilo.org/download">Chamilo download page</a></li>
-  <li> unzip the new files of Chamilo 1.9 in the main Chamilo/Dok€os directory. The
+  <li> unzip the new files of Chamilo 1.10 in the main Chamilo/Dok€os directory. The
 new directory <em>main</em> should be located directly inside your
 Chamilo/Dok€os root folder</li>
   <li> point your browser on your portal URL</li>
@@ -477,7 +477,7 @@ On Linux, Mac OS X and BSD operating systems you can quick-fix this using the
 your own OS on <a href="http://www.chamilo.org/forum">our forum</a>.
 In Windows, you may need to check the properties of the folders.
 <p></p>
-<h3>3.6 Quick-upgrade from 1.8.x guide for Linux</h3>
+<h3>3.6 Quick-upgrade from 1.9.x guide for Linux</h3>
 
 
 The following quick-upgrade guide assumes that:
@@ -498,11 +498,11 @@ On the command-line, type:
   <li>mkdir /var/www/chamilo/old_version</li>
   <li>mv /var/www/chamilo/* /var/www/chamilo/old_version/</li>
   <li>chmod -R 0777 /var/www/chamilo/old_version/</li>
-  <li>wget http://chamilo.googlecode.com/files/chamilo-1.9.10.tar.gz</li>
-  <li>tar zxvf chamilo-1.9.10.tar.gz</li>
-  <li>sudo cp -ra chamilo-1.9.10/* /var/www/chamilo/</li>
-  <li>rm chamilo-1.9.10.tar.gz</li>
-  <li>sudo rm -r chamilo-1.9.10/</li>
+  <li>wget https://github.com/chamilo/chamilo-lms/archive/v1.9.10.tar.gz</li>
+  <li>tar zxvf chamilo-lms-1.9.10.tar.gz</li>
+  <li>sudo cp -ra chamilo-lms-1.9.10/* /var/www/chamilo/</li>
+  <li>rm chamilo-lms-1.9.10.tar.gz</li>
+  <li>sudo rm -r chamilo-lms-1.9.10/</li>
 </ul>
 
 <br />

+ 19 - 7
index.php

@@ -118,8 +118,7 @@ if (!empty($_POST['submitAuth'])) {
         }
     }
     // End login -- if ($_POST['submitAuth'])
-}
-else {
+} else {
     // Only if login form was not sent because if the form is sent the user was already on the page.
     event_open();
 }
@@ -142,8 +141,7 @@ if (!api_is_anonymous()) {
 
     if (api_is_platform_admin()) {
         $controller->tpl->assign('course_block', $controller->return_course_block());
-    }
-    else {
+    } else {
         $controller->tpl->assign('teacher_block', $controller->return_teacher_link());
     }
 }
@@ -151,6 +149,22 @@ if (!api_is_anonymous()) {
 $hot_courses = null;
 $announcements_block = null;
 
+
+// Display the Site Use Cookie Warning Validation
+$useCookieValidation = api_get_configuration_value('cookie_warning');
+if ($useCookieValidation) {
+    if (isset($_POST['acceptCookies'])) {
+        api_set_site_use_cookie_warning_cookie();
+    } else if (!api_site_use_cookie_warning_cookie_exist()) {
+        if (Template::isToolBarDisplayedForUser()) {
+            $controller->tpl->assign('toolBarDisplayed', true);
+        } else {
+            $controller->tpl->assign('toolBarDisplayed', false);
+        }
+        $controller->tpl->assign('displayCookieUsageWarning', true);
+    }
+}
+
 // When loading a chamilo page do not include the hot courses and news
 
 if (!isset($_REQUEST['include'])) {
@@ -163,9 +177,7 @@ if (!isset($_REQUEST['include'])) {
 $controller->tpl->assign('hot_courses', $hot_courses);
 $controller->tpl->assign('announcements_block', $announcements_block);
 $controller->tpl->assign('home_page_block', $controller->return_home_page());
-
 $controller->tpl->assign('navigation_course_links', $controller->return_navigation_links());
-
 $controller->tpl->assign('notice_block', $controller->return_notice());
 $controller->tpl->assign('main_navigation_block', $controller->return_navigation_links());
 $controller->tpl->assign('help_block', $controller->return_help());
@@ -183,7 +195,7 @@ if (isset($_GET['firstpage'])) {
     api_set_firstpage_parameter($_GET['firstpage']);
     // if we are already logged, go directly to course
     if (api_user_is_login()) {
-        echo "<script type='text/javascript'>self.location.href='index.php?firstpage=".$_GET['firstpage']."'</script>";
+        echo "<script type='text/javascript'>self.location.href='index.php?firstpage=".Security::remove_XSS($_GET['firstpage'])."'</script>";
     }
 } else {
     api_delete_firstpage_parameter();

+ 3 - 2
main/admin/access_url_add_courses_to_url.php

@@ -82,9 +82,10 @@ if (empty($first_letter_user)) {
     unset($result);
 }
 
-$first_letter_course = Database::escape_string($first_letter_course);
+$first_letter_course_lower = Database::escape_string(api_strtolower($first_letter_course));
+
 $sql = "SELECT code, title FROM $tbl_course
-		WHERE title LIKE '".$first_letter_course."%' OR title LIKE '".api_strtolower($first_letter_course)."%'
+		WHERE title LIKE '".$first_letter_course_lower."%' OR title LIKE '".$first_letter_course_lower."%'
 		ORDER BY title, code DESC ";
 
 $result = Database::query($sql);

+ 2 - 2
main/admin/access_url_add_users_to_url.php

@@ -79,12 +79,12 @@ if (empty($first_letter_user)) {
     }
 	unset($result);
 }
-$first_letter_user = Database::escape_string($first_letter_user);
+$first_letter_user_lower = Database::escape_string(api_strtolower($first_letter_user));
 
 $target_name = api_sort_by_first_name() ? 'firstname' : 'lastname';
 $target_name = 'lastname';
 $sql = "SELECT user_id,lastname,firstname,username FROM $tbl_user
-	    WHERE ".$target_name." LIKE '".$first_letter_user."%' OR ".$target_name." LIKE '".api_strtolower($first_letter_user)."%'
+	    WHERE ".$target_name." LIKE '".$first_letter_user_lower."%' OR ".$target_name." LIKE '".$first_letter_user_lower."%'
 		ORDER BY ". (count($users) > 0 ? "(user_id IN(".implode(',', $users).")) DESC," : "")." ".$target_name;
 $result     = Database::query($sql);
 $db_users   = Database::store_result($result);

+ 1 - 1
main/admin/access_url_edit.php

@@ -120,7 +120,7 @@ $form->setDefaults($defaults);
 
 $submit_name = get_lang('AddUrl');
 if (isset($_GET['url_id'])) {
-	$url_id = Database::escape_string($_GET['url_id']);
+	$url_id = intval($_GET['url_id']);
 	$num_url_id = UrlManager::url_id_exist($url_id);
 	if($num_url_id != 1) {
 		header('Location: access_urls.php');

+ 1 - 1
main/admin/access_urls.php

@@ -40,7 +40,7 @@ if (isset ($_GET['action'])) {
 
     $check = Security::check_token('get');
     if ($check) {
-		$url_id = Database::escape_string($_GET['url_id']);
+		$url_id = intval($_GET['url_id']);
 
         switch ($_GET['action']) {
             case 'delete_url':

+ 0 - 1
main/admin/add_courses_to_usergroup.php

@@ -156,7 +156,6 @@ function search($needle,$type)
 
         // xajax send utf8 datas... datas in db can be non-utf8 datas
         $charset = api_get_system_encoding();
-        $needle  = Database::escape_string($needle);
         $needle  = api_convert_encoding($needle, $charset, 'utf-8');
 
         if ($type == 'single') {

+ 0 - 1
main/admin/add_sessions_to_promotion.php

@@ -123,7 +123,6 @@ function search_sessions($needle, $type)
 
         // xajax send utf8 datas... datas in db can be non-utf8 datas
         $charset = api_get_system_encoding();
-        $needle = Database::escape_string($needle);
         $needle = api_convert_encoding($needle, $charset, 'utf-8');
 
         $session_list = SessionManager::get_sessions_list(

+ 0 - 1
main/admin/add_sessions_to_usergroup.php

@@ -133,7 +133,6 @@ function search_sessions($needle,$type) {
 
         // xajax send utf8 datas... datas in db can be non-utf8 datas
         $charset = api_get_system_encoding();
-        $needle  = Database::escape_string($needle);
         $needle  = api_convert_encoding($needle, $charset, 'utf-8');
 
         if ($type == 'single') {

+ 0 - 1
main/admin/add_users_to_group.php

@@ -107,7 +107,6 @@ function search_users($needle, $type, $relation_type)
 
         // xajax send utf8 datas... datas in db can be non-utf8 datas
         $charset = api_get_system_encoding();
-        $needle = Database::escape_string($needle);
         $needle = api_convert_encoding($needle, $charset, 'utf-8');
         $user_anonymous = api_get_anonymous_id();
         $order_clause = api_sort_by_first_name() ? ' ORDER BY firstname, lastname, username' : ' ORDER BY lastname, firstname, username';

+ 2 - 2
main/admin/archive_cleanup.php

@@ -28,8 +28,8 @@ $message = null;
 
 if ($form->validate()) {
 	$archive_path = api_get_path(SYS_ARCHIVE_PATH);
-	$htaccess 	  = @file_get_contents($archive_path.'.htaccess');
-	$result 	  = rmdirr($archive_path, true);
+	$htaccess = @file_get_contents($archive_path.'.htaccess');
+	$result = rmdirr($archive_path, true, true);
 
 	if (!empty($htaccess)) {
 		@file_put_contents($archive_path.'/.htaccess', $htaccess);

+ 15 - 18
main/admin/calendar.lib.php

@@ -539,7 +539,7 @@ function store_edited_agenda_item() {
 function save_edit_agenda_item($id, $title, $content, $start_date, $end_date) {
 	$TABLEAGENDA = Database::get_main_table(TABLE_MAIN_SYSTEM_CALENDAR);
 
-	$id=Database::escape_string($id);
+	$id=intval($id);
 	$title=Database::escape_string($title);
 	$content=Database::escape_string($content);
 
@@ -902,7 +902,7 @@ function display_one_agenda_item($agenda_id)
 	$TABLEAGENDA = Database::get_main_table(TABLE_MAIN_SYSTEM_CALENDAR);
 	$TABLE_ITEM_PROPERTY = Database::get_course_table(TABLE_ITEM_PROPERTY);
 
-	$agenda_id=Database::escape_string($agenda_id);
+	$agenda_id = intval($agenda_id);
 	//echo "displaying agenda items";
 
 	// getting the name of the groups
@@ -2642,7 +2642,7 @@ function is_repeated_event($id,$course=null)
         $course = $course_info['dbName'];
     }
     $id = (int) $id;
-	//$t_agenda_repeat = Database::get_course_table(TABLE_AGENDA_REPEAT,$course);
+    $t_agenda_repeat = Database::get_course_table(TABLE_AGENDA_REPEAT);
     $sql = "SELECT * FROM $t_agenda_repeat WHERE cal_id = $id";
     $res = Database::query($sql);
     if(Database::num_rows($res)>0)
@@ -2733,24 +2733,21 @@ function agenda_add_item($title, $content, $db_start_date, $db_end_date) {
     return $last_id;
 }
 /**
- * Adds a repetitive item to the database
- * @param   array   Course info
- * @param   int     The original event's id
- * @param   string  Type of repetition
- * @param   int     Timestamp of end of repetition (repeating until that date)
- * @param   array   Original event's destination
- * @return  boolean False if error, True otherwise
+ * Gets calendar items
+ * @param   int     Month
+ * @param   int     Year
+ * @return  array   Array of events
  */
- function get_calendar_items($month, $year) {
-	global $_user, $_course;
-	global $is_allowed_to_edit;
+function get_calendar_items($month, $year)
+{
+    global $_user, $_course;
+    global $is_allowed_to_edit;
 
-	$month=Database::escape_string($month);
-	$year=Database::escape_string($year);
+    $month = intval($month);
+    $year = intval($year);
 
-	// database variables
-	$TABLEAGENDA = Database::get_main_table(TABLE_MAIN_SYSTEM_CALENDAR);
-	//$TABLE_ITEM_PROPERTY=Database::get_course_table(TABLE_ITEM_PROPERTY);
+    // database variables
+    $TABLEAGENDA = Database::get_main_table(TABLE_MAIN_SYSTEM_CALENDAR);
 
     $month_first_day = mktime(0,0,0,$month,1,$year);
     $month_last_day  = mktime(0,0,0,$month+1,1,$year)-1;

+ 5 - 5
main/admin/class_list.php

@@ -34,13 +34,13 @@ function get_number_of_classes() {
  * @param int $number_of_items
  * @param string $direction
  */
-function get_class_data($from, $number_of_items, $column, $direction) {
+function get_class_data($from, $number_of_items, $column, $direction = 'ASC') {
     $tbl_class_user = Database::get_main_table(TABLE_MAIN_CLASS_USER);
     $tbl_class = Database :: get_main_table(TABLE_MAIN_CLASS);
-    $from 				= Database::escape_string($from);
-    $number_of_items 	= Database::escape_string($number_of_items);
-    $column 			= Database::escape_string($column);
-    $direction 			= Database::escape_string($direction);
+    $from 				= intval($from);
+    $number_of_items 	= intval($number_of_items);
+    $column 			= intval($column);
+    $direction 			= ($direction == 'ASC'?'ASC':'DESC');
 
     $sql = "SELECT 	id AS col0, name AS col1, COUNT(user_id) AS col2, id AS col3
         FROM $tbl_class

+ 468 - 432
main/admin/configure_homepage.php

@@ -1,9 +1,11 @@
 <?php
 /* For licensing terms, see /license.txt */
+
 /**
  * Configure the portal homepage (manages multi-urls and languages)
  * @package chamilo.admin
  */
+
 /**
  * Creates menu tabs for logged and anonymous users
  *
@@ -15,36 +17,36 @@
  */
 function home_tabs($file_logged_in)
 {
-    $post = strpos($file_logged_in, "_logged_in");
-    if ($post !== false) {
-        $file_logged_out = str_replace('_logged_in','', $file_logged_in);
-        //variables initialization
-        $data_logged_out = array();
-        $data_logged_in  = array();
-
-        //we read the file with all links
-        $file = file($file_logged_in);
-        foreach ($file as $line) {
-            $line = str_replace("\n", '',$line);
-            //not logged user only sees public links
-            if (!preg_match('/::private/',$line)) {
-                $data_logged_out[] = $line;
-            }
-            //logged user only sees all links
-            $data_logged_in[] = $line;
-        }
-        //tabs file for logged out users
-        $fp = fopen($file_logged_out, 'w');
-        fputs($fp, implode("\n", $data_logged_out));
-        fclose($fp);
-        //tabs file for logged in users
-        $fp = fopen($file_logged_in, 'w');
-        fputs($fp, implode("\n", $data_logged_in));
-        fclose($fp);
-    }
+	$post = strpos($file_logged_in, "_logged_in");
+	if ($post !== false) {
+		$file_logged_out = str_replace('_logged_in','', $file_logged_in);
+		//variables initialization
+		$data_logged_out = array();
+		$data_logged_in  = array();
+
+		//we read the file with all links
+		$file = file($file_logged_in);
+		foreach ($file as $line) {
+			$line = str_replace("\n", '',$line);
+			//not logged user only sees public links
+			if (!preg_match('/::private/',$line)) {
+				$data_logged_out[] = $line;
+			}
+			//logged user only sees all links
+			$data_logged_in[] = $line;
+		}
+		//tabs file for logged out users
+		$fp = fopen($file_logged_out, 'w');
+		fputs($fp, implode("\n", $data_logged_out));
+		fclose($fp);
+		//tabs file for logged in users
+		$fp = fopen($file_logged_in, 'w');
+		fputs($fp, implode("\n", $data_logged_in));
+		fclose($fp);
+	}
 }
 
-$language_file = array('index','admin', 'accessibility');
+$language_file = array('index', 'admin', 'accessibility');
 $cidReset = true;
 require_once '../inc/global.inc.php';
 
@@ -78,10 +80,17 @@ $tbl_category = Database::get_main_table(TABLE_MAIN_CATEGORY);
 $tool_name = get_lang('ConfigureHomePage');
 $_languages = api_get_languages();
 
-$interbreadcrumb[] = array('url' => 'index.php', 'name' => get_lang('PlatformAdmin'));
+$interbreadcrumb[] = array(
+	'url' => 'index.php',
+	'name' => get_lang('PlatformAdmin')
+);
 
 if (!empty($action)) {
-	$interbreadcrumb[] = array('url' => 'configure_homepage.php', 'name' => get_lang('ConfigureHomePage'));
+	$interbreadcrumb[] = array(
+		'url' => 'configure_homepage.php',
+		'name' => get_lang('ConfigureHomePage')
+	);
+
 	switch ($action) {
 		case 'edit_top':
 			$tool_name = get_lang('EditHomePage');
@@ -134,6 +143,8 @@ if (!empty($_SESSION['user_language_choice'])) {
 	$lang = api_get_setting('platformLanguage');
 }
 
+$languageGet = isset($_GET['language']) ? Security::remove_XSS($_GET['language']) : $lang;
+
 // Ensuring availability of main files in the corresponding language
 
 if (api_is_multiple_url_enabled()) {
@@ -165,29 +176,30 @@ $noticef = 'home_notice'; //noticef for Notice File
 $menutabs= 'home_tabs'; //menutabs for tabs Menu
 $mtloggedin= 'home_tabs_logged_in'; //menutabs for tabs Menu
 $ext 	 = '.html'; //ext for HTML Extension - when used frequently, variables are
-				// faster than hardcoded strings
+// faster than hardcoded strings
 $homef = array($menuf, $newsf, $topf, $noticef, $menutabs, $mtloggedin);
 
 // If language-specific file does not exist, create it by copying default file
 foreach ($homef as $my_file) {
-    if (api_is_multiple_url_enabled()) {
-        if (!file_exists($homep_new.$my_file.'_'.$lang.$ext)) {
-            if (!file_exists($homep.$my_file.$ext)) {
-                touch($homep.$my_file.$ext);
-            }
-            @copy($homep.$my_file.$ext, $homep_new.$my_file.'_'.$lang.$ext);
-        }
-    } else {
-        if (!file_exists($homep.$my_file.'_'.$lang.$ext)) {
-            if (!file_exists($homep.$my_file.$ext)) {
-                touch($homep.$my_file.$ext);
-            }
-            @copy($homep.$my_file.$ext, $homep.$my_file.'_'.$lang.$ext);
-        }
-    }
+	if (api_is_multiple_url_enabled()) {
+		if (!file_exists($homep_new.$my_file.'_'.$lang.$ext)) {
+			if (!file_exists($homep.$my_file.$ext)) {
+				touch($homep.$my_file.$ext);
+			}
+			@copy($homep.$my_file.$ext, $homep_new.$my_file.'_'.$lang.$ext);
+		}
+	} else {
+		if (!file_exists($homep.$my_file.'_'.$lang.$ext)) {
+			if (!file_exists($homep.$my_file.$ext)) {
+				touch($homep.$my_file.$ext);
+			}
+			@copy($homep.$my_file.$ext, $homep.$my_file.'_'.$lang.$ext);
+		}
+	}
 }
+
 if (api_is_multiple_url_enabled()) {
-    $homep = $homep_new;
+	$homep = $homep_new;
 }
 
 // Check WCAG settings and prepare edition using WCAG
@@ -224,25 +236,22 @@ if (!empty($action)) {
 				}
 
 				// Write
-				if (file_exists($homep.$topf.'_'.$lang.$ext)) {
+				if (is_writable($homep)) {
+					// Default
 					if (is_writable($homep.$topf.'_'.$lang.$ext)) {
 						$fp = fopen($homep.$topf.'_'.$lang.$ext, 'w');
 						fputs($fp, $home_top);
 						fclose($fp);
 
-                    foreach ($_languages['name'] as $key => $value) {
-                        $lang_name = $_languages['folder'][$key];
-                        if (isset($_POST[$lang_name])) {
-                            if (file_exists($homep.$topf.'_'.$lang_name.$ext)) {
-                                if (is_writable($homep.$topf.'_'.$lang_name.$ext)) {
-                                    $fp = fopen($homep.$topf.'_'.$lang_name.$ext, 'w');
-                                    fputs($fp, $home_top);
-                                    fclose($fp);
-                                }
-                            }
-                        }
-                    }
-
+						// Language
+						foreach ($_languages['name'] as $key => $value) {
+							$lang_name = $_languages['folder'][$key];
+							if (isset($_POST[$lang_name])) {
+								$fp = fopen($homep.$topf.'_'.$lang_name.$ext, 'w');
+								fputs($fp, $home_top);
+								fclose($fp);
+							}
+						}
 					} else {
 						$errorMsg = get_lang('HomePageFilesNotWritable');
 					}
@@ -252,22 +261,28 @@ if (!empty($action)) {
 					fputs($fp, $home_top);
 					fclose($fp);
 
-                    foreach ($_languages['name'] as $key => $value) {
-                        $lang_name = $_languages['folder'][$key];
-                        if (isset($_POST[$lang_name])) {
-                            if (file_exists($homep.$topf.'_'.$lang_name.$ext)) {
-                                $fp = fopen($homep.$topf.'_'.$lang_name.$ext, 'w');
-                                fputs($fp, $home_top);
-                                fclose($fp);
-                            }
-                        }
-                    }
-                }
-
-                if (EventsMail::check_if_using_class('portal_homepage_edited')) {
-                    EventsDispatcher::events('portal_homepage_edited',array('about_user' => api_get_user_id()));
-                }
-                event_system(LOG_HOMEPAGE_CHANGED, 'edit_top', cut(strip_tags($home_top), 254), api_get_utc_datetime(), api_get_user_id());
+					foreach ($_languages['name'] as $key => $value) {
+						$lang_name = $_languages['folder'][$key];
+						if (isset($_POST[$lang_name])) {
+							if (file_exists($homep.$topf.'_'.$lang_name.$ext)) {
+								$fp = fopen($homep.$topf.'_'.$lang_name.$ext, 'w');
+								fputs($fp, $home_top);
+								fclose($fp);
+							}
+						}
+					}
+				}
+
+				if (EventsMail::check_if_using_class('portal_homepage_edited')) {
+					EventsDispatcher::events('portal_homepage_edited',array('about_user' => api_get_user_id()));
+				}
+				event_system(
+					LOG_HOMEPAGE_CHANGED,
+					'edit_top',
+					cut(strip_tags($home_top), 254),
+					api_get_utc_datetime(),
+					api_get_user_id()
+				);
 				break;
 			case 'edit_notice':
 				// Filter
@@ -283,32 +298,32 @@ if (!empty($action)) {
 						if ($errorMsg == '') {
 							fputs($fp, "<b>$notice_title</b><br />\n$notice_text");
 
-                            foreach ($_languages['name'] as $key => $value) {
-                                $lang_name = $_languages['folder'][$key];
-                                if (isset($_POST[$lang_name])) {
-                                    if (file_exists($homep.$noticef.'_'.$lang_name.$ext)) {
-                                        if (is_writable($homep.$noticef.'_'.$lang_name.$ext)) {
-                                            $fp = fopen($homep.$noticef.'_'.$lang_name.$ext, 'w');
-                                            fputs($fp, "<b>$notice_title</b><br />\n$notice_text");
-                                            fclose($fp);
-                                        }
-                                    }
-                                }
-                            }
-                        } else {
+							foreach ($_languages['name'] as $key => $value) {
+								$lang_name = $_languages['folder'][$key];
+								if (isset($_POST[$lang_name])) {
+									if (file_exists($homep.$noticef.'_'.$lang_name.$ext)) {
+										if (is_writable($homep.$noticef.'_'.$lang_name.$ext)) {
+											$fp = fopen($homep.$noticef.'_'.$lang_name.$ext, 'w');
+											fputs($fp, "<b>$notice_title</b><br />\n$notice_text");
+											fclose($fp);
+										}
+									}
+								}
+							}
+						} else {
 							fputs($fp, '');
 
-                            foreach ($_languages['name'] as $key => $value) {
-                                $lang_name = $_languages['folder'][$key];
-                                if (isset($_POST[$lang_name])) {
-                                    if (file_exists($homep.$noticef.'_'.$lang_name.$ext)) {
-                                        $fp1 = fopen($homep.$noticef.'_'.$lang_name.$ext, 'w');
-                                        fputs($fp1, '');
-                                        fclose($fp1);
-                                    }
-                                }
-                            }
-                        }
+							foreach ($_languages['name'] as $key => $value) {
+								$lang_name = $_languages['folder'][$key];
+								if (isset($_POST[$lang_name])) {
+									if (file_exists($homep.$noticef.'_'.$lang_name.$ext)) {
+										$fp1 = fopen($homep.$noticef.'_'.$lang_name.$ext, 'w');
+										fputs($fp1, '');
+										fclose($fp1);
+									}
+								}
+							}
+						}
 						fclose($fp);
 					} else {
 						$errorMsg .= "<br/>\n".get_lang('HomePageFilesNotWritable');
@@ -319,7 +334,7 @@ if (!empty($action)) {
 					fputs($fp, "<b>$notice_title</b><br />\n$notice_text");
 					fclose($fp);
 				}
-                event_system(LOG_HOMEPAGE_CHANGED, 'edit_notice', cut(strip_tags($notice_title), 254), api_get_utc_datetime(), api_get_user_id());
+				event_system(LOG_HOMEPAGE_CHANGED, 'edit_notice', cut(strip_tags($notice_title), 254), api_get_utc_datetime(), api_get_user_id());
 				break;
 			case 'edit_news':
 				//Filter
@@ -365,7 +380,7 @@ if (!empty($action)) {
 						}
 					}
 				}
-                event_system(LOG_HOMEPAGE_CHANGED, 'edit_news', strip_tags(cut($home_news, 254)), api_get_utc_datetime(), api_get_user_id());
+				event_system(LOG_HOMEPAGE_CHANGED, 'edit_news', strip_tags(cut($home_news, 254)), api_get_utc_datetime(), api_get_user_id());
 				break;
 			case 'insert_tabs':
 			case 'edit_tabs':
@@ -375,7 +390,7 @@ if (!empty($action)) {
 				$insert_where   = intval($_POST['insert_where']);
 				$link_name      = trim(stripslashes($_POST['link_name']));
 				$link_url       = trim(stripslashes($_POST['link_url']));
-                $add_in_tab     = intval($_POST['add_in_tab']);
+				$add_in_tab     = intval($_POST['add_in_tab']);
 
 				// WCAG
 				if (api_get_setting('wcag_anysurfer_public_pages') == 'true') {
@@ -437,33 +452,33 @@ if (!empty($action)) {
 						// If the file doesn't exist, then create it and
 						// fill it with default text
 
-                        $fp = @fopen($homep.$filename, 'w');
-                        if ($fp) {
-                            if (empty($link_html)) {
-                                fputs($fp, get_lang('MyTextHere'));
-                                home_tabs($homep.$filename);
-                            } else {
-                            	fputs($fp, $link_html);
-                            	home_tabs($homep.$filename);
-                            }
-                            fclose($fp);
-                        }
+						$fp = @fopen($homep.$filename, 'w');
+						if ($fp) {
+							if (empty($link_html)) {
+								fputs($fp, get_lang('MyTextHere'));
+								home_tabs($homep.$filename);
+							} else {
+								fputs($fp, $link_html);
+								home_tabs($homep.$filename);
+							}
+							fclose($fp);
+						}
 					}
 					// If the requested action is to edit a link, open the file and
 					// write to it (if the file doesn't exist, create it)
 					if (in_array($action, array('edit_link'))  && !empty($link_html)) {
-						  $fp = @fopen($homep.$filename, 'w');
-						  if ($fp) {
-							 fputs($fp, $link_html);
-							 home_tabs($homep.$filename);
-							 fclose($fp);
-						  }
+						$fp = @fopen($homep.$filename, 'w');
+						if ($fp) {
+							fputs($fp, $link_html);
+							home_tabs($homep.$filename);
+							fclose($fp);
+						}
 					}
 
-                    $class_add_in_tab = 'class="show_menu"';
-                    if (!$add_in_tab) {
-                        $class_add_in_tab = 'class="hide_menu"';
-                    }
+					$class_add_in_tab = 'class="show_menu"';
+					if (!$add_in_tab) {
+						$class_add_in_tab = 'class="hide_menu"';
+					}
 
 					// If the requested action is to create a link, make some room
 					// for the new link in the home_menu array at the requested place
@@ -491,15 +506,15 @@ if (!empty($action)) {
 							home_tabs($homep.$menuf.'_'.$lang.$ext);
 							fclose($fp);
 
-                            foreach ($_languages['name'] as $key => $value) {
-                                $lang_name = $_languages['folder'][$key];
-                                if (isset($_POST[$lang_name])) {
-                                    $fp = fopen($homep.$menuf.'_'.$lang_name.$ext, 'w');
-                                    fputs($fp, $home_menu);
-                                    home_tabs($homep.$menuf.'_'.$lang_name.$ext);
-                                    fclose($fp);
-                                }
-                            }
+							foreach ($_languages['name'] as $key => $value) {
+								$lang_name = $_languages['folder'][$key];
+								if (isset($_POST[$lang_name])) {
+									$fp = fopen($homep.$menuf.'_'.$lang_name.$ext, 'w');
+									fputs($fp, $home_menu);
+									home_tabs($homep.$menuf.'_'.$lang_name.$ext);
+									fclose($fp);
+								}
+							}
 
 							if (file_exists($homep.$menuf.$ext)) {
 								if (is_writable($homep.$menuf.$ext)) {
@@ -519,23 +534,29 @@ if (!empty($action)) {
 						home_tabs($homep.$menuf.'_'.$lang.$ext);
 						fclose($fp);
 
-                        foreach ($_languages['name'] as $key => $value) {
-                            $lang_name = $_languages['folder'][$key];
-                            if (isset($_POST[$lang_name])) {
-                                $fp = fopen($homep.$menuf.'_'.$lang_name.$ext, 'w');
-                                fputs($fp, $home_menu);
-                                home_tabs($homep.$menuf.'_'.$lang_name.$ext);
-                                fclose($fp);
-                            }
-                        }
-                    }
+						foreach ($_languages['name'] as $key => $value) {
+							$lang_name = $_languages['folder'][$key];
+							if (isset($_POST[$lang_name])) {
+								$fp = fopen($homep.$menuf.'_'.$lang_name.$ext, 'w');
+								fputs($fp, $home_menu);
+								home_tabs($homep.$menuf.'_'.$lang_name.$ext);
+								fclose($fp);
+							}
+						}
+					}
 				}
-                event_system(LOG_HOMEPAGE_CHANGED, $action, cut($link_name.':'.$link_url, 254), api_get_utc_datetime(), api_get_user_id());
+			event_system(
+				LOG_HOMEPAGE_CHANGED,
+				$action,
+				cut($link_name . ':' . $link_url, 254),
+				api_get_utc_datetime(),
+				api_get_user_id()
+			);
 				break;
 		} //end of switch($action)
 
 		if (empty($errorMsg)) {
-			header('Location: '.api_get_self());
+			header('Location: '.api_get_self().'?language='.$languageGet);
 			exit();
 		}
 	} else {
@@ -651,7 +672,7 @@ if (!empty($action)) {
 				} elseif (is_file($homep.$mtloggedin.$lang.$ext) && is_readable($homep.$mtloggedin.$lang.$ext)) {
 					$home_menu = @file($homep.$mtloggedin.$lang.$ext);
 				} elseif (touch($homep.$mtloggedin.'_'.$lang.$ext)) {
-                    $home_menu = @file($homep.$mtloggedin.'_'.$lang.$ext);
+					$home_menu = @file($homep.$mtloggedin.'_'.$lang.$ext);
 				} else {
 					$errorMsg = get_lang('HomePageFilesNotReadable');
 				}
@@ -678,11 +699,11 @@ if (!empty($action)) {
 					$errorMsg = get_lang('HomePageFilesNotReadable');
 				}
 
-                if (empty($home_menu)) {
-                    if (file_exists($homep.$menutabs.'_'.$lang.$ext)) {
-                        $home_menu = @file($homep.$menutabs.'_'.$lang.$ext);
-                    }
-                }
+				if (empty($home_menu)) {
+					if (file_exists($homep.$menutabs.'_'.$lang.$ext)) {
+						$home_menu = @file($homep.$menutabs.'_'.$lang.$ext);
+					}
+				}
 
 				if (empty($home_menu)) {
 					$home_menu = array();
@@ -723,11 +744,11 @@ if (!empty($action)) {
 							$target_blank = true;
 						}
 
-                        if (strstr($enreg, 'hide_menu')) {
+						if (strstr($enreg, 'hide_menu')) {
 							$add_in_tab = false;
 						} else {
-                            $add_in_tab = true;
-                        }
+							$add_in_tab = true;
+						}
 
 						// Remove dangerous HTML tags from the link itself (this is an
 						// additional measure in case a link previously contained
@@ -782,32 +803,32 @@ switch ($action) {
 		// Display for edit_notice case
 		?>
 		<form action="<?php echo api_get_self(); ?>?action=<?php echo $action; ?>" method="post" style="margin:0px;">
-		<legend><?php echo $tool_name; ?></legend>
-		<input type="hidden" name="formSent" value="1"/>
-		<?php
-		if (!empty($errorMsg)) {
-			Display::display_normal_message($errorMsg);
-		}
-		?>
-		<table border="0" cellpadding="5" cellspacing="0">
-		<tr><td colspan="2"><?php echo '<span style="font-style: italic;">'.get_lang('LetThoseFieldsEmptyToHideTheNotice').'</span>'; ?></tr>
-		<tr>
-		  <td nowrap="nowrap"><?php echo get_lang('NoticeTitle'); ?> :</td>
-		  <td><input type="text" name="notice_title" size="30" maxlength="50" value="<?php echo $notice_title; ?>" style="width: 350px;"/></td>
-		</tr>
-		<tr>
-		  <td nowrap="nowrap" valign="top"><?php echo get_lang('NoticeText'); ?> :</td>
-		  <td><textarea name="notice_text" cols="30" rows="5" wrap="virtual" style="width: 350px;"><?php echo $notice_text; ?></textarea></td>
-		</tr>
-        <tr>
-          <td><label><?php echo get_lang('ApplyAllLanguages'); ?></label>
-          <td><input type="checkbox" name="all_langs" value="<?php echo get_lang('ApplyAllLanguages'); ?>"/></td>
-        </tr>
-		<tr>
-		  <td>&nbsp;</td>
-		  <td><button class="save" type="submit" value="<?php echo get_lang('Ok'); ?>"><?php echo get_lang('Ok'); ?></button></td>
-		</tr>
-		</table>
+			<legend><?php echo $tool_name; ?></legend>
+			<input type="hidden" name="formSent" value="1"/>
+			<?php
+			if (!empty($errorMsg)) {
+				Display::display_normal_message($errorMsg);
+			}
+			?>
+			<table border="0" cellpadding="5" cellspacing="0">
+				<tr><td colspan="2"><?php echo '<span style="font-style: italic;">'.get_lang('LetThoseFieldsEmptyToHideTheNotice').'</span>'; ?></tr>
+				<tr>
+					<td nowrap="nowrap"><?php echo get_lang('NoticeTitle'); ?> :</td>
+					<td><input type="text" name="notice_title" size="30" maxlength="50" value="<?php echo $notice_title; ?>" style="width: 350px;"/></td>
+				</tr>
+				<tr>
+					<td nowrap="nowrap" valign="top"><?php echo get_lang('NoticeText'); ?> :</td>
+					<td><textarea name="notice_text" cols="30" rows="5" wrap="virtual" style="width: 350px;"><?php echo $notice_text; ?></textarea></td>
+				</tr>
+				<tr>
+					<td><label><?php echo get_lang('ApplyAllLanguages'); ?></label>
+					<td><input type="checkbox" name="all_langs" value="<?php echo get_lang('ApplyAllLanguages'); ?>"/></td>
+				</tr>
+				<tr>
+					<td>&nbsp;</td>
+					<td><button class="save" type="submit" value="<?php echo get_lang('Ok'); ?>"><?php echo get_lang('Ok'); ?></button></td>
+				</tr>
+			</table>
 		</form>
 		<?php
 		break;
@@ -815,7 +836,7 @@ switch ($action) {
 	case 'edit_tabs':
 	case 'insert_link':
 	case 'edit_link':
-       $menuf = ($action == 'insert_tabs' || $action == 'edit_tabs') ? $mtloggedin : $menuf;
+		$menuf = ($action == 'insert_tabs' || $action == 'edit_tabs') ? $mtloggedin : $menuf;
 		if (!empty($errorMsg)) {
 			Display::display_normal_message($errorMsg);
 		}
@@ -830,37 +851,37 @@ switch ($action) {
 
 		$form->addElement('text', 'link_name', get_lang('LinkName'), array('size' => '30', 'maxlength' => '50'));
 		if (!empty($link_name)) {
-        $default['link_name'] = $link_name;
-    	}
+			$default['link_name'] = $link_name;
+		}
 		$default['link_url'] = empty($link_url) ? 'http://' : api_htmlentities($link_url, ENT_QUOTES);
-        $linkUrlComment = ($action == 'insert_tabs') ? get_lang('Optional').'<br />'.get_lang('GlobalLinkUseDoubleColumnPrivateToShowPrivately') : '';
-        $form->addElement('text', 'link_url', array(get_lang('LinkURL'), $linkUrlComment), array('size' => '30', 'maxlength' => '100', 'style' => 'width: 350px;'));
-        
-        $options = array('-1' => get_lang('FirstPlace'));
+		$linkUrlComment = ($action == 'insert_tabs') ? get_lang('Optional').'<br />'.get_lang('GlobalLinkUseDoubleColumnPrivateToShowPrivately') : '';
+		$form->addElement('text', 'link_url', array(get_lang('LinkURL'), $linkUrlComment), array('size' => '30', 'maxlength' => '100', 'style' => 'width: 350px;'));
+
+		$options = array('-1' => get_lang('FirstPlace'));
 
 		$selected = '';
 
 		if ($action == 'insert_link' || $action == 'insert_tabs') {
-            $add_in_tab = 1;
+			$add_in_tab = 1;
 			if (is_array($home_menu)){
 				foreach ($home_menu as $key => $enreg) {
 					if (strlen($enreg = trim(strip_tags($enreg))) > 0) {
-                        $options[$key] = get_lang('After').' &quot;'.$enreg.'&quot;';
-                        $formSentCheck = (!empty($_POST['formSent']) ? true : false);
-                        $selected = $formSentCheck && $insert_where == $key ? $key : '';
+						$options[$key] = get_lang('After').' &quot;'.$enreg.'&quot;';
+						$formSentCheck = (!empty($_POST['formSent']) ? true : false);
+						$selected = $formSentCheck && $insert_where == $key ? $key : '';
 					}
 				}
 			}
-            $default['insert_link'] = $selected;
-            $form->addElement('select', 'insert_where', get_lang('InsertThisLink') , $options);
+			$default['insert_link'] = $selected;
+			$form->addElement('select', 'insert_where', get_lang('InsertThisLink') , $options);
 		}
 
 		$target_blank_checkbox = $form->addElement('checkbox', 'target_blank', null, get_lang('OpenInNewWindow'), 1);
 
-        if ($action == 'insert_tabs' || $action == 'edit_tabs') {
-            $form->addElement('checkbox', 'add_in_tab', null, get_lang('AddInMenu'), 1);
-            $default['add_in_tab'] = $add_in_tab;
-        }
+		if ($action == 'insert_tabs' || $action == 'edit_tabs') {
+			$form->addElement('checkbox', 'add_in_tab', null, get_lang('AddInMenu'), 1);
+			$default['add_in_tab'] = $add_in_tab;
+		}
 
 		if (!empty($target_blank)) { $target_blank_checkbox->setChecked(true); }
 
@@ -873,31 +894,31 @@ switch ($action) {
 			}
 			$form->addElement('style_submit_button', null, get_lang('Save'), 'class="save"');
 		} else {
-            if (in_array($action, array('edit_tabs','insert_tabs'))) {
-                if (api_get_setting('wcag_anysurfer_public_pages')=='true') {
-                    $form->addElement('html', get_lang('Content').' ('.get_lang('Optional').')');
-                    $form->addElement('html', WCAG_Rendering::create_xhtml(isset($_POST['link_html'])?$_POST['link_html']:(!empty($link_html) ? $link_html : '')));
-                } else {
-                    $default['link_html'] = isset($_POST['link_html']) ? $_POST['link_html'] : (!empty($link_html) ? $link_html : '');
-                    $form->add_html_editor('link_html', get_lang('Content'), false, false, array('ToolbarSet' => 'PortalHomePage', 'Width' => '100%', 'Height' => '400'));
-                }
-            }
-            $form->addElement('checkbox', 'all_langs', null, get_lang('ApplyAllLanguages'), array('id' => 'all_langs'));
-            $form->addElement('html','<table id="table_langs" style="margin-left:159px;"><tr>');
-            $i = 0;
-            foreach ($_languages['name'] as $key => $value) {
-                $i++;
-                $lang_name = $_languages['folder'][$key];
-                $html_langs = '<td width="300">';
-                $html_langs .= '<label><input type="checkbox" id="lang" name="'.$lang_name.'" />&nbsp;'.$lang_name.'<label/>';
-                $html_langs .= '</td>';
-                if ($i%5 == 0) {
-                $html_langs .= '</tr><tr>';
-                }
-                $form->addElement('html', $html_langs);
-            }
-            $form->addElement('html','</tr></table><br/>');
-      		$form->addElement('style_submit_button', null, get_lang('Save'), 'class="save"');
+			if (in_array($action, array('edit_tabs','insert_tabs'))) {
+				if (api_get_setting('wcag_anysurfer_public_pages')=='true') {
+					$form->addElement('html', get_lang('Content').' ('.get_lang('Optional').')');
+					$form->addElement('html', WCAG_Rendering::create_xhtml(isset($_POST['link_html'])?$_POST['link_html']:(!empty($link_html) ? $link_html : '')));
+				} else {
+					$default['link_html'] = isset($_POST['link_html']) ? $_POST['link_html'] : (!empty($link_html) ? $link_html : '');
+					$form->add_html_editor('link_html', get_lang('Content'), false, false, array('ToolbarSet' => 'PortalHomePage', 'Width' => '100%', 'Height' => '400'));
+				}
+			}
+			$form->addElement('checkbox', 'all_langs', null, get_lang('ApplyAllLanguages'), array('id' => 'all_langs'));
+			$form->addElement('html','<table id="table_langs" style="margin-left:159px;"><tr>');
+			$i = 0;
+			foreach ($_languages['name'] as $key => $value) {
+				$i++;
+				$lang_name = $_languages['folder'][$key];
+				$html_langs = '<td width="300">';
+				$html_langs .= '<label><input type="checkbox" id="lang" name="'.$lang_name.'" />&nbsp;'.$lang_name.'<label/>';
+				$html_langs .= '</td>';
+				if ($i % 5 == 0) {
+					$html_langs .= '</tr><tr>';
+				}
+				$form->addElement('html', $html_langs);
+			}
+			$form->addElement('html','</tr></table><br/>');
+			$form->addElement('style_submit_button', null, get_lang('Save'), 'class="save"');
 		}
 
 		$form->setDefaults($default);
@@ -920,7 +941,13 @@ switch ($action) {
 		}
 
 		$default = array();
-		$form = new FormValidator('configure_homepage_'.$action, 'post', api_get_self().'?action='.$action, '', array('style' => 'margin: 0px;'));
+		$form = new FormValidator(
+			'configure_homepage_'.$action,
+			'post',
+			api_get_self().'?action='.$action,
+			'',
+			array('style' => 'margin: 0px;')
+		);
 		$renderer =& $form->defaultRenderer();
 		$renderer->setHeaderTemplate('');
 		$renderer->setFormTemplate('<form{attributes}><table border="0" cellpadding="5" cellspacing="0" width="100%">{content}</table></form>');
@@ -944,6 +971,7 @@ switch ($action) {
 			$html .= '</select></td></tr>';
 			$form->addElement('html', $html);
 		}
+
 		if (api_get_setting('wcag_anysurfer_public_pages') == 'true') {
 			//TODO: review these lines
 			// Print WCAG-specific HTML editor
@@ -955,23 +983,28 @@ switch ($action) {
 			$default[$name] = str_replace('{rel_path}', api_get_path(REL_PATH), $open);
 			$form->add_html_editor($name, '', true, false, array('ToolbarSet' => 'PortalHomePage', 'Width' => '100%', 'Height' => '400'));
 		}
-        $form->addElement('checkbox', 'all_langs', null, get_lang('ApplyAllLanguages'),array('id' => 'all_langs'));
-        $form->addElement('html','<table id="table_langs" style="margin-left:5px;"><tr>');
-        $i = 0;
-        foreach ($_languages['name'] as $key => $value) {
-            $i++;
-            $lang_name = $_languages['folder'][$key];
-            if (file_exists($homep.$topf.'_'.$lang_name.$ext)) {
-                $html_langs = '<td width="300">';
-                $html_langs .= '<label><input type="checkbox" id="lang" name="'.$lang_name.'" />&nbsp;'.$lang_name.'<label/>';
-                $html_langs .= '</td>';
-                if($i%5 == 0) {
-                    $html_langs .= '</tr><tr>';
-                }
-                $form->addElement('html', $html_langs);
-            }
-        }
-        $form->addElement('html','</tr></table><br/>');
+		$form->addElement('checkbox', 'all_langs', null, get_lang('ApplyAllLanguages'),array('id' => 'all_langs'));
+		$form->addElement('html','<table id="table_langs" style="margin-left:5px;"><tr>');
+
+		$currentLanguage = api_get_interface_language();
+		$i = 0;
+		foreach ($_languages['name'] as $key => $value) {
+			$lang_name = $_languages['folder'][$key];
+			$i++;
+
+			$checked = null;
+			if ($languageGet == $lang_name)  {
+				$checked = "checked";
+			}
+			$html_langs = '<td width="300">';
+			$html_langs .= '<label><input type="checkbox" '.$checked.' id="lang" name="'.$lang_name.'" />&nbsp;'.$value.'<label/>';
+			$html_langs .= '</td>';
+			if ($i % 5 == 0) {
+				$html_langs .= '</tr><tr>';
+			}
+			$form->addElement('html', $html_langs);
+		}
+		$form->addElement('html','</tr></table><br/>');
 		$form->addElement('style_submit_button', null, get_lang('Save'), 'class="save"');
 		$form->setDefaults($default);
 		$form->display();
@@ -980,208 +1013,211 @@ switch ($action) {
 	default: // When no action applies, default page to update campus homepage
 		?>
 		<table border="0" cellpadding="5" cellspacing="0" width="100%">
-		<tr>
-		  <td width="70%" valign="top">
-		  	<div class="actions">
-			<a href="<?php echo api_get_self(); ?>?action=edit_top"><?php Display::display_icon('edit.gif', get_lang('EditHomePage')); ?></a>
-			<a href="<?php echo api_get_self(); ?>?action=edit_top"><?php echo get_lang('EditHomePage'); ?></a>
-		  	</div>
-
-			<table border="0" cellpadding="5" cellspacing="0" width="100%">
 			<tr>
-			  <td colspan="2">
-				<?php
-					//print home_top contents
-					if (file_exists($homep.$topf.'_'.$lang.$ext)) {
-						$home_top_temp = @(string)file_get_contents($homep.$topf.'_'.$lang.$ext);
-					} else {
-						$home_top_temp = @(string)file_get_contents($homep.$topf.$ext);
-					}
-					$open = str_replace('{rel_path}', api_get_path(REL_PATH), $home_top_temp);
-					$open = api_to_system_encoding($open, api_detect_encoding(strip_tags($open)));
-					echo $open;
-				?>
-			  </td>
-			</tr>
-			<tr>
-			<?php
-
-			$access_url_id = 1;
-			// we only show the category options for the main chamilo installation
-			if (api_is_multiple_url_enabled()) {
-				$access_url_id = api_get_current_access_url_id();
-			}
-			echo '<td width="50%">';
-			if ($access_url_id == 1) {
-				echo '<div class="actions">';
-				echo '<a href="course_category.php">'.Display::display_icon('edit.gif', get_lang('Edit')).'</a>
+				<td width="70%" valign="top">
+					<div class="actions">
+						<a href="<?php echo api_get_self(); ?>?action=edit_top&language=<?php echo $languageGet; ?>">
+							<?php Display::display_icon('edit.gif', get_lang('EditHomePage')); ?>
+						</a>
+						<a href="<?php echo api_get_self(); ?>?action=edit_top&language=<?php echo $languageGet; ?>">
+							<?php echo get_lang('EditHomePage'); ?>
+						</a>
+					</div>
+
+					<table border="0" cellpadding="5" cellspacing="0" width="100%">
+						<tr>
+							<td colspan="2">
+								<?php
+								//print home_top contents
+								if (file_exists($homep.$topf.'_'.$lang.$ext)) {
+									$home_top_temp = @(string)file_get_contents($homep.$topf.'_'.$lang.$ext);
+								} else {
+									$home_top_temp = @(string)file_get_contents($homep.$topf.$ext);
+								}
+								$open = str_replace('{rel_path}', api_get_path(REL_PATH), $home_top_temp);
+								$open = api_to_system_encoding($open, api_detect_encoding(strip_tags($open)));
+								echo $open;
+								?>
+							</td>
+						</tr>
+						<tr>
+							<?php
+
+							$access_url_id = 1;
+							// we only show the category options for the main chamilo installation
+							if (api_is_multiple_url_enabled()) {
+								$access_url_id = api_get_current_access_url_id();
+							}
+							echo '<td width="50%">';
+							if ($access_url_id == 1) {
+								echo '<div class="actions">';
+								echo '<a href="course_category.php">'.Display::display_icon('edit.gif', get_lang('Edit')).'</a>
 					  <a href="course_category.php">'.get_lang('EditCategories').'</a>';
-				echo '</div>';
-			}
-			echo '</td>
+								echo '</div>';
+							}
+							echo '</td>
 				  <td width="50%">
 				  <br />';
-			/* <!--<a href="<?php echo api_get_self(); ?>?action=edit_news"><?php Display::display_icon('edit.gif', get_lang('Edit')); ?></a> <a href="<?php echo api_get_self(); ?>?action=edit_news"><?php echo get_lang('EditNews'); ?></a>--> */
-			echo '</td></tr>
+							/* <!--<a href="<?php echo api_get_self(); ?>?action=edit_news"><?php Display::display_icon('edit.gif', get_lang('Edit')); ?></a> <a href="<?php echo api_get_self(); ?>?action=edit_news"><?php echo get_lang('EditNews'); ?></a>--> */
+							echo '</td></tr>
 				<tr>
 				<td width="50%" valign="top">
 				<table border="0" cellpadding="5" cellspacing="0" width="100%">';
-				if ($access_url_id == 1) {
-					if (sizeof($Categories)) {
-						foreach ($Categories as $enreg) {
-							echo '<tr><td>'.Display::return_icon('folder_document.gif', $enreg['name']).'&nbsp;'.$enreg['name'].'</td></tr>';
-						}
-						unset($Categories);
-					} else {
-						echo get_lang('NoCategories');
-					}
-				}
+							if ($access_url_id == 1) {
+								if (sizeof($Categories)) {
+									foreach ($Categories as $enreg) {
+										echo '<tr><td>'.Display::return_icon('folder_document.gif', $enreg['name']).'&nbsp;'.$enreg['name'].'</td></tr>';
+									}
+									unset($Categories);
+								} else {
+									echo get_lang('NoCategories');
+								}
+							}
 
-				echo '</table>';
-				?>
-			  </td>
-			  <!--<td width="50%" valign="top">
+							echo '</table>';
+							?>
+							</td>
+							<!--<td width="50%" valign="top">
 				<?php
-				if (file_exists($homep.$newsf.'_'.$lang.$ext)) {
-					$open = @(string)file_get_contents($homep.$newsf.'_'.$lang.$ext);
-					$open = api_to_system_encoding($open, api_detect_encoding(strip_tags($open)));
-					echo $open;
-				} else {
-					$open = @(string)file_get_contents($homep.$newsf.$ext);
-					$open = api_to_system_encoding($open, api_detect_encoding(strip_tags($open)));
-					echo $open;
-				}
-			?>
+							if (file_exists($homep.$newsf.'_'.$lang.$ext)) {
+								$open = @(string)file_get_contents($homep.$newsf.'_'.$lang.$ext);
+								$open = api_to_system_encoding($open, api_detect_encoding(strip_tags($open)));
+								echo $open;
+							} else {
+								$open = @(string)file_get_contents($homep.$newsf.$ext);
+								$open = api_to_system_encoding($open, api_detect_encoding(strip_tags($open)));
+								echo $open;
+							}
+							?>
 			  </td>-->
-			</tr>
-			</table>
-			<?php
+						</tr>
+					</table>
+					<?php
 
-			// Add new page
-
-			$home_menu = '';
-
-            if (file_exists($homep.$mtloggedin.'_'.$lang.$ext)) {
-                $home_menu = @file($homep.$mtloggedin.'_'.$lang.$ext);
-            } else {
-                $home_menu = @file($homep.$mtloggedin.$ext);
-            }
-
-            if (empty($home_menu)) {
-                if (file_exists($homep.$menutabs.'_'.$lang.$ext)) {
-                    $home_menu = @file($homep.$menutabs.'_'.$lang.$ext);
-                }
-            }
-
-            if (empty($home_menu)) {
-                $home_menu = array();
-            }
-
-            if (!empty($home_menu)) {
-                $home_menu = implode("\n", $home_menu);
-                $home_menu = api_to_system_encoding($home_menu, api_detect_encoding(strip_tags($home_menu)));
-                $home_menu = explode("\n", $home_menu);
-            }
-            $link_list = '';
-            $tab_counter = 0;
-            foreach ($home_menu as $enreg) {
-                $enreg = trim($enreg);
-                if (!empty($enreg)) {
-                    $edit_link   = ' <a href="'.api_get_self().'?action=edit_tabs&amp;link_index='.$tab_counter.'" ><span>'.Display::return_icon('edit.gif', get_lang('Edit')).'</span></a>';
-                    $delete_link = ' <a href="'.api_get_self().'?action=delete_tabs&amp;link_index='.$tab_counter.'"  onclick="javascript: if(!confirm(\''.addslashes(api_htmlentities(get_lang('ConfirmYourChoice'), ENT_QUOTES)).'\')) return false;"><span>'.Display::return_icon('delete.gif', get_lang('Delete')).'</span></a>';
-                    $tab_string = str_replace(array('href="'.api_get_path(WEB_PATH).'index.php?include=', '</li>'),
-                                              array('href="'.api_get_path(WEB_CODE_PATH).'admin/'.basename(api_get_self()).'?action=open_link&link=', $edit_link.$delete_link.'</li>'),
-                                              $enreg);
-                    $tab_string = str_replace(array('<li>', '</li>','class="hide_menu"', 'hide_menu'), '', $tab_string);
-
-                    $link_list .= Display::tag('tr', Display::tag('td', $tab_string));
-                    $tab_counter++;
-                }
-            }
-            ?>
-            <div class="actions">
-                <a href="<?php echo api_get_self(); ?>?action=insert_tabs"><?php Display::display_icon('addd.gif', get_lang('InsertLink')); echo get_lang('InsertLink'); ?></a>
-            </div>
-            <?php
-            echo '<table class="data_table">';
-            echo $link_list;
-            echo '</table>';
-			?>
-		  </td>
-		  <td width="10%" valign="top"></td>
-		  <td width="20%" rowspan="3" valign="top">
-
-		    <div id="login_block" class="well sidebar-nav">
-                <?php echo api_display_language_form(); ?>
-                <form id="formLogin">
-                    <div><label><?php echo get_lang('LoginName'); ?></label></div>
-                    <div><input type="text" id="login" size="15" value="" disabled="disabled" /></div>
-                    <div><label><?php echo get_lang('UserPassword'); ?></label></div>
-                    <div><input type="password" id="password" size="15" value="" disabled="disabled" /></div>
-                    <div><button class="btn" type="button" name="submitAuth" value="<?php echo get_lang('Ok'); ?>" disabled="disabled"><?php echo get_lang('Ok'); ?></button></div>
-                </form>
-			</div>
-
-			<div id="profile_block" class="well sidebar-nav">
-				<h4><?php echo get_lang('MenuUser'); ?></h4>
-				<ul class="nav nav-list">
-				<li><span style="color: #9D9DA1; font-weight: bold;"><?php echo api_ucfirst(get_lang('Registration')); ?></span></li>
-				<li><span style="color: #9D9DA1; font-weight: bold;"><?php echo api_ucfirst(get_lang('LostPassword')); ?></span></li>
-				</ul>
-			</div>
-
-			<div id="notice_block" class="well sidebar-nav">
-                <h4><?php echo get_lang('Notice'); ?>
-                    <a href="<?php echo api_get_self(); ?>?action=edit_notice"><?php Display::display_icon('edit.png', get_lang('Edit'), array(), ICON_SIZE_SMALL); ?></a>
-                </h4>
-            <?php
-            $home_notice = '';
-            if (file_exists($homep.$noticef.'_'.$lang.$ext)) {
-                $home_notice = @(string)file_get_contents($homep.$noticef.'_'.$lang.$ext);
-            } else {
-                $home_notice = @(string)file_get_contents($homep.$noticef.$ext);
-            }
-            $home_notice = api_to_system_encoding($home_notice, api_detect_encoding(strip_tags($home_notice)));
-            echo '<div class="homepage_notice">';
-            echo $home_notice;
-            echo '</div>';
-            ?>
-            </div>
-           	<div class="well sidebar-nav">
-                <a href="<?php echo api_get_self(); ?>?action=insert_link"><?php Display::display_icon('addd.gif', get_lang('InsertLink')); ?></a>
-                <a href="<?php echo api_get_self(); ?>?action=insert_link"><?php echo get_lang('InsertLink'); ?></a>
-    			<h4><?php echo api_ucfirst(get_lang('General')); ?></h4>
-    				<ul class="menulist">
-    				<?php
-    					$home_menu = '';
-    					if (file_exists($homep.$menuf.'_'.$lang.$ext)) {
-    						$home_menu = @file($homep.$menuf.'_'.$lang.$ext);
-    					} else {
-    						$home_menu = @file($homep.$menuf.$ext);
-    					}
-    					if (empty($home_menu)) {
-    						$home_menu = array();
-    					}
-    					if (!empty($home_menu)) {
-    						$home_menu = implode("\n", $home_menu);
-    						$home_menu = api_to_system_encoding($home_menu, api_detect_encoding(strip_tags($home_menu)));
-    						$home_menu = explode("\n", $home_menu);
-    					}
-    					$i = 0;
-    					foreach ($home_menu as $enreg) {
-    						$enreg = trim($enreg);
-    						if (!empty($enreg)) {
-    							$edit_link = '<a href="'.api_get_self().'?action=edit_link&amp;link_index='.$i.'">'.Display::return_icon('edit.gif', get_lang('Edit')).'</a>';
-    							$delete_link = '<a href="'.api_get_self().'?action=delete_link&amp;link_index='.$i.'" onclick="javascript:if(!confirm(\''.addslashes(api_htmlentities(get_lang('ConfirmYourChoice'), ENT_QUOTES)).'\')) return false;">'.Display::return_icon('delete.gif', get_lang('Delete')).'</a>';
-    							echo str_replace(array('href="'.api_get_path(WEB_PATH).'index.php?include=', '</li>'), array('href="'.api_get_path(WEB_CODE_PATH).'admin/'.basename(api_get_self()).'?action=open_link&link=', '<br />'.$edit_link.' '.$delete_link.'</li>'), $enreg);
-    							$i++;
-    						}
-    					}
-    				?>
-    				</ul>
-			     </div>
-		  </td>
-		</tr>
+					// Add new page
+
+					$home_menu = '';
+
+					if (file_exists($homep.$mtloggedin.'_'.$lang.$ext)) {
+						$home_menu = @file($homep.$mtloggedin.'_'.$lang.$ext);
+					} else {
+						$home_menu = @file($homep.$mtloggedin.$ext);
+					}
+
+					if (empty($home_menu)) {
+						if (file_exists($homep.$menutabs.'_'.$lang.$ext)) {
+							$home_menu = @file($homep.$menutabs.'_'.$lang.$ext);
+						}
+					}
+
+					if (empty($home_menu)) {
+						$home_menu = array();
+					}
+
+					if (!empty($home_menu)) {
+						$home_menu = implode("\n", $home_menu);
+						$home_menu = api_to_system_encoding($home_menu, api_detect_encoding(strip_tags($home_menu)));
+						$home_menu = explode("\n", $home_menu);
+					}
+					$link_list = '';
+					$tab_counter = 0;
+					foreach ($home_menu as $enreg) {
+						$enreg = trim($enreg);
+						if (!empty($enreg)) {
+							$edit_link   = ' <a href="'.api_get_self().'?action=edit_tabs&amp;link_index='.$tab_counter.'" ><span>'.Display::return_icon('edit.gif', get_lang('Edit')).'</span></a>';
+							$delete_link = ' <a href="'.api_get_self().'?action=delete_tabs&amp;link_index='.$tab_counter.'"  onclick="javascript: if(!confirm(\''.addslashes(api_htmlentities(get_lang('ConfirmYourChoice'), ENT_QUOTES)).'\')) return false;"><span>'.Display::return_icon('delete.gif', get_lang('Delete')).'</span></a>';
+							$tab_string = str_replace(array('href="'.api_get_path(WEB_PATH).'index.php?include=', '</li>'),
+								array('href="'.api_get_path(WEB_CODE_PATH).'admin/'.basename(api_get_self()).'?action=open_link&link=', $edit_link.$delete_link.'</li>'),
+								$enreg);
+							$tab_string = str_replace(array('<li>', '</li>','class="hide_menu"', 'hide_menu'), '', $tab_string);
+
+							$link_list .= Display::tag('tr', Display::tag('td', $tab_string));
+							$tab_counter++;
+						}
+					}
+					?>
+					<div class="actions">
+						<a href="<?php echo api_get_self(); ?>?action=insert_tabs"><?php Display::display_icon('addd.gif', get_lang('InsertLink')); echo get_lang('InsertLink'); ?></a>
+					</div>
+					<?php
+					echo '<table class="data_table">';
+					echo $link_list;
+					echo '</table>';
+					?>
+				</td>
+				<td width="10%" valign="top"></td>
+				<td width="20%" rowspan="3" valign="top">
+					<div id="login_block" class="well sidebar-nav">
+						<?php echo api_display_language_form(); ?>
+						<form id="formLogin">
+							<div><label><?php echo get_lang('LoginName'); ?></label></div>
+							<div><input type="text" id="login" size="15" value="" disabled="disabled" /></div>
+							<div><label><?php echo get_lang('UserPassword'); ?></label></div>
+							<div><input type="password" id="password" size="15" value="" disabled="disabled" /></div>
+							<div><button class="btn" type="button" name="submitAuth" value="<?php echo get_lang('Ok'); ?>" disabled="disabled"><?php echo get_lang('Ok'); ?></button></div>
+						</form>
+					</div>
+
+					<div id="profile_block" class="well sidebar-nav">
+						<h4><?php echo get_lang('MenuUser'); ?></h4>
+						<ul class="nav nav-list">
+							<li><span style="color: #9D9DA1; font-weight: bold;"><?php echo api_ucfirst(get_lang('Registration')); ?></span></li>
+							<li><span style="color: #9D9DA1; font-weight: bold;"><?php echo api_ucfirst(get_lang('LostPassword')); ?></span></li>
+						</ul>
+					</div>
+
+					<div id="notice_block" class="well sidebar-nav">
+						<h4><?php echo get_lang('Notice'); ?>
+							<a href="<?php echo api_get_self(); ?>?action=edit_notice"><?php Display::display_icon('edit.png', get_lang('Edit'), array(), ICON_SIZE_SMALL); ?></a>
+						</h4>
+						<?php
+						$home_notice = '';
+						if (file_exists($homep.$noticef.'_'.$lang.$ext)) {
+							$home_notice = @(string)file_get_contents($homep.$noticef.'_'.$lang.$ext);
+						} else {
+							$home_notice = @(string)file_get_contents($homep.$noticef.$ext);
+						}
+						$home_notice = api_to_system_encoding($home_notice, api_detect_encoding(strip_tags($home_notice)));
+						echo '<div class="homepage_notice">';
+						echo $home_notice;
+						echo '</div>';
+						?>
+					</div>
+					<div class="well sidebar-nav">
+						<a href="<?php echo api_get_self(); ?>?action=insert_link"><?php Display::display_icon('addd.gif', get_lang('InsertLink')); ?></a>
+						<a href="<?php echo api_get_self(); ?>?action=insert_link"><?php echo get_lang('InsertLink'); ?></a>
+						<h4><?php echo api_ucfirst(get_lang('General')); ?></h4>
+						<ul class="menulist">
+							<?php
+							$home_menu = '';
+							if (file_exists($homep.$menuf.'_'.$lang.$ext)) {
+								$home_menu = @file($homep.$menuf.'_'.$lang.$ext);
+							} else {
+								$home_menu = @file($homep.$menuf.$ext);
+							}
+							if (empty($home_menu)) {
+								$home_menu = array();
+							}
+							if (!empty($home_menu)) {
+								$home_menu = implode("\n", $home_menu);
+								$home_menu = api_to_system_encoding($home_menu, api_detect_encoding(strip_tags($home_menu)));
+								$home_menu = explode("\n", $home_menu);
+							}
+							$i = 0;
+							foreach ($home_menu as $enreg) {
+								$enreg = trim($enreg);
+								if (!empty($enreg)) {
+									$edit_link = '<a href="'.api_get_self().'?action=edit_link&amp;link_index='.$i.'">'.Display::return_icon('edit.gif', get_lang('Edit')).'</a>';
+									$delete_link = '<a href="'.api_get_self().'?action=delete_link&amp;link_index='.$i.'" onclick="javascript:if(!confirm(\''.addslashes(api_htmlentities(get_lang('ConfirmYourChoice'), ENT_QUOTES)).'\')) return false;">'.Display::return_icon('delete.gif', get_lang('Delete')).'</a>';
+									echo str_replace(array('href="'.api_get_path(WEB_PATH).'index.php?include=', '</li>'), array('href="'.api_get_path(WEB_CODE_PATH).'admin/'.basename(api_get_self()).'?action=open_link&link=', '<br />'.$edit_link.' '.$delete_link.'</li>'), $enreg);
+									$i++;
+								}
+							}
+							?>
+						</ul>
+					</div>
+				</td>
+			</tr>
 		</table>
 		<?php
 		break;

+ 1 - 1
main/admin/group_list.php

@@ -231,7 +231,7 @@ function lock_unlock_user($status, $user_id) {
     }
 
     if (($status_db == '1' OR $status_db == '0') AND is_numeric($user_id)) {
-        $sql = "UPDATE $user_table SET active='".Database::escape_string($status_db)."' WHERE user_id='".Database::escape_string($user_id)."'";
+        $sql = "UPDATE $user_table SET active=".intval($status_db)." WHERE user_id=".intval($user_id)."";
         $result = Database::query($sql);
     }
 

+ 16 - 0
main/admin/index.php

@@ -343,6 +343,22 @@ if (api_is_platform_admin()) {
 $admin_ajax_url = api_get_path(WEB_AJAX_PATH).'admin.ajax.php';
 
 $tpl = new Template();
+
+// Display the Site Use Cookie Warning Validation
+$useCookieValidation = api_get_configuration_value('cookie_warning');
+if ($useCookieValidation) {
+    if (isset($_POST['acceptCookies'])) {
+        api_set_site_use_cookie_warning_cookie();
+    } else if (!api_site_use_cookie_warning_cookie_exist()) {
+        if (Template::isToolBarDisplayedForUser()) {
+            $tpl->assign('toolBarDisplayed', true);
+        } else {
+            $tpl->assign('toolBarDisplayed', false);
+        }
+        $tpl->assign('displayCookieUsageWarning', true);
+    }
+}
+
 $tpl->assign('web_admin_ajax_url', $admin_ajax_url);
 $tpl->assign('blocks', $blocks);
 // The template contains the call to the AJAX version checker

+ 2 - 2
main/admin/languages.php

@@ -160,7 +160,7 @@ if (isset($_POST['Submit']) && $_POST['Submit']) {
             if (count($_POST['id']) > 0) {
                 $ids = array();
                 foreach ($_POST['id'] as $index => $id) {
-                    $ids[] = Database::escape_string($id);
+                    $ids[] = intval($id);
                 }
                 $sql = "UPDATE $tbl_admin_languages SET available='1' WHERE id IN ('" . implode("','", $ids) . "')";
                 Database::query($sql);
@@ -170,7 +170,7 @@ if (isset($_POST['Submit']) && $_POST['Submit']) {
             if (count($_POST['id']) > 0) {
                 $ids = array();
                 foreach ($_POST['id'] as $index => $id) {
-                    $ids[] = Database::escape_string($id);
+                    $ids[] = intval($id);
                 }
                 $sql = "UPDATE $tbl_admin_languages SET available='0' WHERE id IN ('" . implode("','", $ids) . "')";
                 Database::query($sql);

+ 1 - 1
main/admin/session_course_user_list.php

@@ -44,7 +44,7 @@ $sql = "SELECT s.name, c.title
         FROM $tbl_session_rel_course src
 		INNER JOIN $tbl_session s ON s.id = src.id_session
 		INNER JOIN $tbl_course c ON c.code = src.course_code
-		WHERE src.id_session='$id_session' AND src.course_code='".Database::escape_string($course_code)."' ";
+		WHERE src.id_session='$id_session' AND src.course_code='$course_code' ";
 
 $result = Database::query($sql);
 if (!list($session_name,$course_title) = Database::fetch_row($result)) {

+ 1 - 1
main/admin/session_import.php

@@ -134,7 +134,7 @@ if (isset($_POST['formSent']) && $_POST['formSent']) {
                                     email = '".Database::escape_string($email)."',
                                     official_code = '".Database::escape_string($official_code)."',
                                     phone = '".Database::escape_string($phone)."',
-                                    status = '".Database::escape_string($status)."'
+                                    status = '".intval($status)."'
                                 WHERE username = '".Database::escape_string($username)."'";
 
                             Database::query($sql);

+ 86 - 76
main/admin/settings.lib.php

@@ -111,18 +111,18 @@ function handle_plugins()
 {
     $plugin_obj = new AppPlugin();
     $token = Security::get_token();
-     if (isset($_POST['submit_plugins'])) {
+    if (isset($_POST['submit_plugins'])) {
         store_plugins();
         // Add event to the system log.
         $user_id = api_get_user_id();
         $category = $_GET['category'];
-         event_system(
-             LOG_CONFIGURATION_SETTINGS_CHANGE,
-             LOG_CONFIGURATION_SETTINGS_CATEGORY,
-             $category,
-             api_get_utc_datetime(),
-             $user_id
-         );
+        event_system(
+            LOG_CONFIGURATION_SETTINGS_CHANGE,
+            LOG_CONFIGURATION_SETTINGS_CATEGORY,
+            $category,
+            api_get_utc_datetime(),
+            $user_id
+        );
         Display :: display_confirmation_message(get_lang('SettingsStored'));
     }
 
@@ -175,12 +175,12 @@ function handle_plugins()
 
             echo '<div class="btn-group">';
             if (in_array($plugin, $installed_plugins)) {
-                 echo Display::url(get_lang('Configure'), 'configure_plugin.php?name='.$plugin, array('class' => 'btn'));
-                 echo Display::url(get_lang('Regions'), 'settings.php?category=Regions&name='.$plugin, array('class' => 'btn'));
+                echo Display::url(get_lang('Configure'), 'configure_plugin.php?name='.$plugin, array('class' => 'btn'));
+                echo Display::url(get_lang('Regions'), 'settings.php?category=Regions&name='.$plugin, array('class' => 'btn'));
             }
 
             if (file_exists(api_get_path(SYS_PLUGIN_PATH).$plugin.'/readme.txt')) {
-                 echo Display::url("readme.txt", api_get_path(WEB_PLUGIN_PATH).$plugin."/readme.txt", array('class' => 'btn ajax', '_target' => '_blank'));
+                echo Display::url("readme.txt", api_get_path(WEB_PLUGIN_PATH).$plugin."/readme.txt", array('class' => 'btn ajax', '_target' => '_blank'));
             }
             echo '</div>';
             echo '</td></tr>';
@@ -198,7 +198,7 @@ function handle_plugins()
  * This function allows the platform admin to choose the default stylesheet
  * @author Patrick Cool <patrick.cool@UGent.be>, Ghent University
  * @author Julio Montoya <gugli100@gmail.com>, Chamilo
-*/
+ */
 function handle_stylesheets()
 {
     global $_configuration;
@@ -219,7 +219,6 @@ function handle_stylesheets()
     }
 
     $form = new FormValidator('stylesheet_upload', 'post', 'settings.php?category=Stylesheets#tabs-2');
-    //$form->addElement('header', get_lang('UploadNewStylesheet'));
     $form->addElement('text', 'name_stylesheet', get_lang('NameStylesheet'), array('size' => '40', 'maxlength' => '40'));
     $form->addRule('name_stylesheet', get_lang('ThisFieldIsRequired'), 'required');
     $form->addElement('file', 'new_stylesheet', get_lang('UploadNewStylesheet'));
@@ -256,7 +255,13 @@ function handle_stylesheets()
             // Add event to the system log.
             $user_id = api_get_user_id();
             $category = $_GET['category'];
-            event_system(LOG_CONFIGURATION_SETTINGS_CHANGE, LOG_CONFIGURATION_SETTINGS_CATEGORY, $category, api_get_utc_datetime(), $user_id);
+            event_system(
+                LOG_CONFIGURATION_SETTINGS_CHANGE,
+                LOG_CONFIGURATION_SETTINGS_CATEGORY,
+                $category,
+                api_get_utc_datetime(),
+                $user_id
+            );
 
             if ($result) {
                 Display::display_confirmation_message(get_lang('StylesheetAdded'));
@@ -467,7 +472,7 @@ function upload_stylesheet($values, $picture)
  */
 function store_regions()
 {
-     $plugin_obj = new AppPlugin();
+    $plugin_obj = new AppPlugin();
 
     // Get a list of all current 'Plugins' settings
     $installed_plugins = $plugin_obj->get_installed_plugins();
@@ -502,7 +507,7 @@ function store_regions()
 /**
  * This function allows easy activating and inactivating of plugins
  * @author Patrick Cool <patrick.cool@UGent.be>, Ghent University
-*/
+ */
 function store_plugins()
 {
     $appPlugin = new AppPlugin();
@@ -533,13 +538,18 @@ function store_plugins()
 /**
  * This function allows the platform admin to choose which should be the default stylesheet
  * @author Patrick Cool <patrick.cool@UGent.be>, Ghent University
-*/
+ */
 function store_stylesheets()
 {
     // Insert the stylesheet.
-    $style = Database::escape_string($_POST['style']);
-    if (is_style($style)) {
-        api_set_setting('stylesheets', $style, null, 'stylesheets', api_get_current_access_url_id());
+    if (is_style($_POST['style'])) {
+        api_set_setting(
+            'stylesheets',
+            $_POST['style'],
+            null,
+            'stylesheets',
+            api_get_current_access_url_id()
+        );
     }
     return true;
 }
@@ -613,7 +623,7 @@ function handle_search()
 
         $sf_values = array();
         foreach ($specific_fields as $sf) {
-           $sf_values[$sf['code']] = $sf['name'];
+            $sf_values[$sf['code']] = $sf['name'];
         }
         $group = array();
         $url =  Display::div(Display::url(get_lang('AddSpecificSearchField'), 'specific_fields.php'), array('class'=>'sectioncomment'));
@@ -901,7 +911,7 @@ function add_edit_template() {
     if ($_GET['action'] == 'edit') {
         // Database table definition.
         $table_system_template = Database :: get_main_table('system_template');
-        $sql = "SELECT * FROM $table_system_template WHERE id = '".Database::escape_string($_GET['id'])."'";
+        $sql = "SELECT * FROM $table_system_template WHERE id = ".intval($_GET['id'])."";
         $result = Database::query($sql);
         $row = Database::fetch_array($result);
 
@@ -970,34 +980,34 @@ function add_edit_template() {
                     }
                     $temp->send_image($upload_dir.$new_file_name);
                 }
-           }
-
-           // Store the information in the database (as insert or as update).
-           $table_system_template = Database :: get_main_table('system_template');
-           if ($_GET['action'] == 'add') {
-               $content_template = '<head>{CSS}<style type="text/css">.text{font-weight: normal;}</style></head><body>'.Database::escape_string($values['template_text']).'</body>';
-               $sql = "INSERT INTO $table_system_template (title, content, image) VALUES ('".Database::escape_string($values['title'])."','".$content_template."','".Database::escape_string($new_file_name)."')";
-               Database::query($sql);
-
-               // Display a feedback message.
-               Display::display_confirmation_message(get_lang('TemplateAdded'));
-               echo '<a href="settings.php?category=Templates&amp;action=add">'.Display::return_icon('new_template.png', get_lang('AddTemplate'),'',ICON_SIZE_MEDIUM).'</a>';
-           } else {
-               $content_template = '<head>{CSS}<style type="text/css">.text{font-weight: normal;}</style></head><body>'.Database::escape_string($values['template_text']).'</body>';
-               $sql = "UPDATE $table_system_template set title = '".Database::escape_string($values['title'])."', content = '".$content_template."'";
-               if (!empty($new_file_name)) {
-                   $sql .= ", image = '".Database::escape_string($new_file_name)."'";
-               }
-               $sql .= " WHERE id='".Database::escape_string($_GET['id'])."'";
-               Database::query($sql);
-
-               // Display a feedback message.
-               Display::display_confirmation_message(get_lang('TemplateEdited'));
-           }
+            }
+
+            // Store the information in the database (as insert or as update).
+            $table_system_template = Database :: get_main_table('system_template');
+            if ($_GET['action'] == 'add') {
+                $content_template = '<head>{CSS}<style type="text/css">.text{font-weight: normal;}</style></head><body>'.Database::escape_string($values['template_text']).'</body>';
+                $sql = "INSERT INTO $table_system_template (title, content, image) VALUES ('".Database::escape_string($values['title'])."','".$content_template."','".Database::escape_string($new_file_name)."')";
+                Database::query($sql);
+
+                // Display a feedback message.
+                Display::display_confirmation_message(get_lang('TemplateAdded'));
+                echo '<a href="settings.php?category=Templates&amp;action=add">'.Display::return_icon('new_template.png', get_lang('AddTemplate'),'',ICON_SIZE_MEDIUM).'</a>';
+            } else {
+                $content_template = '<head>{CSS}<style type="text/css">.text{font-weight: normal;}</style></head><body>'.Database::escape_string($values['template_text']).'</body>';
+                $sql = "UPDATE $table_system_template set title = '".Database::escape_string($values['title'])."', content = '".$content_template."'";
+                if (!empty($new_file_name)) {
+                    $sql .= ", image = '".Database::escape_string($new_file_name)."'";
+                }
+                $sql .= " WHERE id = ".intval($_GET['id'])."";
+                Database::query($sql);
+
+                // Display a feedback message.
+                Display::display_confirmation_message(get_lang('TemplateEdited'));
+            }
 
         }
-       Security::clear_token();
-       display_templates();
+        Security::clear_token();
+        display_templates();
 
     } else {
 
@@ -1021,7 +1031,7 @@ function add_edit_template() {
 function delete_template($id) {
     // First we remove the image.
     $table_system_template = Database :: get_main_table('system_template');
-    $sql = "SELECT * FROM $table_system_template WHERE id = '".Database::escape_string($id)."'";
+    $sql = "SELECT * FROM $table_system_template WHERE id = ".intval($id)."";
     $result = Database::query($sql);
     $row = Database::fetch_array($result);
     if (!empty($row['image'])) {
@@ -1029,7 +1039,7 @@ function delete_template($id) {
     }
 
     // Now we remove it from the database.
-    $sql = "DELETE FROM $table_system_template WHERE id = '".Database::escape_string($id)."'";
+    $sql = "DELETE FROM $table_system_template WHERE id = ".intval($id)."";
     Database::query($sql);
 
     // Display a feedback message.
@@ -1118,7 +1128,7 @@ function generate_settings_form($settings, $settings_by_access_list) {
 
     $i = 0;
     foreach ($settings as $row) {
-    	if (in_array($row['variable'], array_keys($settings_to_avoid))) { continue; }
+        if (in_array($row['variable'], array_keys($settings_to_avoid))) { continue; }
 
         if (!empty($_configuration['multiple_access_urls'])) {
             if (api_is_global_platform_admin()) {
@@ -1126,18 +1136,18 @@ function generate_settings_form($settings, $settings_by_access_list) {
                     if ($url_id == 1) {
                         if ($row['access_url_changeable'] == '1') {
                             $form->addElement('html', '<div style="float: right;"><a class="share_this_setting" data_status = "0"  data_to_send = "'.$row['variable'].'" href="javascript:void(0);">'.
-                                    Display::return_icon('shared_setting.png', get_lang('ChangeSharedSetting')).'</a></div>');
+                                Display::return_icon('shared_setting.png', get_lang('ChangeSharedSetting')).'</a></div>');
                         } else {
                             $form->addElement('html', '<div style="float: right;"><a class="share_this_setting" data_status = "1" data_to_send = "'.$row['variable'].'" href="javascript:void(0);">'.
-                                    Display::return_icon('shared_setting_na.png', get_lang('ChangeSharedSetting')).'</a></div>');
+                                Display::return_icon('shared_setting_na.png', get_lang('ChangeSharedSetting')).'</a></div>');
                         }
                     } else {
                         if ($row['access_url_changeable'] == '1') {
                             $form->addElement('html', '<div style="float: right;">'.
-                                    Display::return_icon('shared_setting.png', get_lang('ChangeSharedSetting')).'</div>');
+                                Display::return_icon('shared_setting.png', get_lang('ChangeSharedSetting')).'</div>');
                         } else {
                             $form->addElement('html', '<div style="float: right;">'.
-                                    Display::return_icon('shared_setting_na.png', get_lang('ChangeSharedSetting')).'</div>');
+                                Display::return_icon('shared_setting_na.png', get_lang('ChangeSharedSetting')).'</div>');
                         }
                     }
                 }
@@ -1216,25 +1226,25 @@ function generate_settings_form($settings, $settings_by_access_list) {
                 break;
             case 'textarea':
                 if ($row['variable'] == 'header_extra_content') {
-      	            $file = api_get_path(SYS_PATH).api_get_home_path().'header_extra_content.txt';
+                    $file = api_get_path(SYS_PATH).api_get_home_path().'header_extra_content.txt';
                     $value = '';
                     if (file_exists($file)) {
                         $value = file_get_contents($file);
                     }
                     $form->addElement('textarea', $row['variable'], array(get_lang($row['title']), get_lang($row['comment'])) , array('class'=>'span6','rows'=>'10'), $hideme);
-            	    $default_values[$row['variable']] = $value;
+                    $default_values[$row['variable']] = $value;
                 } elseif ($row['variable'] == 'footer_extra_content') {
-            		$file = api_get_path(SYS_PATH).api_get_home_path().'footer_extra_content.txt';
-            		$value = '';
-            		if (file_exists($file)) {
-						$value = file_get_contents($file);
-            		}
-            	    $form->addElement('textarea', $row['variable'], array(get_lang($row['title']), get_lang($row['comment'])) , array('rows'=>'10', 'class'=>'span6'), $hideme);
-            	    $default_values[$row['variable']] = $value;
-            	} else {
-                	$form->addElement('textarea', $row['variable'], array(get_lang($row['title']), get_lang($row['comment'])) , array('rows'=>'10','class'=>'span6'), $hideme);
-                	$default_values[$row['variable']] = $row['selected_value'];
-            	}
+                    $file = api_get_path(SYS_PATH).api_get_home_path().'footer_extra_content.txt';
+                    $value = '';
+                    if (file_exists($file)) {
+                        $value = file_get_contents($file);
+                    }
+                    $form->addElement('textarea', $row['variable'], array(get_lang($row['title']), get_lang($row['comment'])) , array('rows'=>'10', 'class'=>'span6'), $hideme);
+                    $default_values[$row['variable']] = $value;
+                } else {
+                    $form->addElement('textarea', $row['variable'], array(get_lang($row['title']), get_lang($row['comment'])) , array('rows'=>'10','class'=>'span6'), $hideme);
+                    $default_values[$row['variable']] = $row['selected_value'];
+                }
                 break;
             case 'radio':
                 $values = api_get_settings_options($row['variable']);
@@ -1258,15 +1268,15 @@ function generate_settings_form($settings, $settings_by_access_list) {
                 $result = Database::query($sql);
                 $group = array ();
                 while ($rowkeys = Database::fetch_array($result)) {
-                     //if ($rowkeys['variable'] == 'course_create_active_tools' && $rowkeys['subkey'] == 'enable_search') { continue; }
+                    //if ($rowkeys['variable'] == 'course_create_active_tools' && $rowkeys['subkey'] == 'enable_search') { continue; }
 
-                     // Profile tab option should be hidden when the social tool is enabled.
-                     if (api_get_setting('allow_social_tool') == 'true') {
-                         if ($rowkeys['variable'] == 'show_tabs' && $rowkeys['subkey'] == 'my_profile') { continue; }
-                     }
+                    // Profile tab option should be hidden when the social tool is enabled.
+                    if (api_get_setting('allow_social_tool') == 'true') {
+                        if ($rowkeys['variable'] == 'show_tabs' && $rowkeys['subkey'] == 'my_profile') { continue; }
+                    }
 
-                     // Hiding the gradebook option.
-                     if ($rowkeys['variable'] == 'show_tabs' && $rowkeys['subkey'] == 'my_gradebook') { continue; }
+                    // Hiding the gradebook option.
+                    if ($rowkeys['variable'] == 'show_tabs' && $rowkeys['subkey'] == 'my_gradebook') { continue; }
 
                     $element = & $form->createElement('checkbox', $rowkeys['subkey'], '', get_lang($rowkeys['subkeytext']));
                     if ($row['access_url_changeable'] == 1) {
@@ -1303,7 +1313,7 @@ function generate_settings_form($settings, $settings_by_access_list) {
                 $default_values[$row['variable']] = $row['selected_value'];
                 break;
             case 'custom':
-            	break;
+                break;
         }
 
         switch ($row['variable']) {

+ 138 - 99
main/admin/settings.php

@@ -10,8 +10,6 @@
  * @package chamilo.admin
  */
 
-/* INIT SECTION */
-
 // Language files that need to be included.
 if (isset($_GET['category']) && $_GET['category'] == 'Templates') {
     $language_file = array('admin', 'document');
@@ -45,7 +43,12 @@ $settings_to_avoid = array(
     'example_material_course_creation'  => 'true' // ON by default - now we have this option when  we create a course
 );
 
-$convert_byte_to_mega_list = array('dropbox_max_filesize', 'message_max_upload_filesize', 'default_document_quotum', 'default_group_quotum');
+$convert_byte_to_mega_list = array(
+    'dropbox_max_filesize',
+    'message_max_upload_filesize',
+    'default_document_quotum',
+    'default_group_quotum'
+);
 
 if (isset($_POST['style'])) {
     Display::$preview_style = $_POST['style'];
@@ -68,8 +71,8 @@ if (isset($_GET['delete_watermark'])) {
 }
 
 if (isset($_GET['action']) &&  $_GET['action'] == 'delete_grading') {
-	$id = intval($_GET['id']);
-	api_delete_setting_option($id);
+    $id = intval($_GET['id']);
+    api_delete_setting_option($id);
 }
 
 $form_search = new FormValidator('search_settings', 'get', api_get_self() , null, array('class'=>'well form-inline'));
@@ -119,11 +122,16 @@ function get_settings($category = null) {
             $settings = search_setting($_REQUEST['search_field']);
         }
     }
-    return array('settings' => $settings, 'settings_by_access_list' => $settings_by_access_list);
+    return array(
+        'settings' => $settings,
+        'settings_by_access_list' => $settings_by_access_list
+    );
 }
 
 // Build the form.
-if (!empty($_GET['category']) && !in_array($_GET['category'], array('Plugins', 'stylesheets', 'Search'))) {
+if (!empty($_GET['category']) &&
+    !in_array($_GET['category'], array('Plugins', 'stylesheets', 'Search'))
+) {
     $my_category = isset($_GET['category']) ? $_GET['category'] : null;
     $settings_array = get_settings($my_category);
     $settings = $settings_array['settings'];
@@ -139,11 +147,15 @@ if (!empty($_GET['category']) && !in_array($_GET['category'], array('Plugins', '
         $un_mark_all = false;
 
         if (api_is_multiple_url_enabled()) {
-            if (isset($values['buttons_in_action_right']) && isset($values['buttons_in_action_right']['mark_all'])) {
+            if (isset($values['buttons_in_action_right']) &&
+                isset($values['buttons_in_action_right']['mark_all'])
+            ) {
                 $mark_all = true;
             }
 
-            if (isset($values['buttons_in_action_right']) && isset($values['buttons_in_action_right']['unmark_all'])) {
+            if (isset($values['buttons_in_action_right']) &&
+                isset($values['buttons_in_action_right']['unmark_all'])
+            ) {
                 $un_mark_all = true;
             }
         }
@@ -174,7 +186,10 @@ if (!empty($_GET['category']) && !in_array($_GET['category'], array('Plugins', '
                 $settings_array = get_settings($my_category);
                 $settings = $settings_array['settings'];
                 $settings_by_access_list = $settings_array['settings_by_access_list'];
-                $form = generate_settings_form($settings, $settings_by_access_list);
+                $form = generate_settings_form(
+                    $settings,
+                    $settings_by_access_list
+                );
             }
         }
         if (!empty($_FILES['pdf_export_watermark_path'])) {
@@ -182,7 +197,10 @@ if (!empty($_GET['category']) && !in_array($_GET['category'], array('Plugins', '
         }
 
         if (isset($pdf_export_watermark_path) && !empty($pdf_export_watermark_path['name'])) {
-            $pdf_export_watermark_path_result = PDF::upload_watermark($pdf_export_watermark_path['name'], $pdf_export_watermark_path['tmp_name']);
+            $pdf_export_watermark_path_result = PDF::upload_watermark(
+                $pdf_export_watermark_path['name'],
+                $pdf_export_watermark_path['tmp_name']
+            );
             if ($pdf_export_watermark_path_result) {
                 $message['confirmation'][] = get_lang('UplUploadSucceeded');
             } else {
@@ -193,16 +211,15 @@ if (!empty($_GET['category']) && !in_array($_GET['category'], array('Plugins', '
 
         // Set true for allow_message_tool variable if social tool is actived
         foreach ($convert_byte_to_mega_list as $item) {
-			if (isset($values[$item])) {
-				$values[$item]        = round($values[$item]*1024*1024);
-			}
-		}
+            if (isset($values[$item])) {
+                $values[$item]        = round($values[$item]*1024*1024);
+            }
+        }
 
         if (isset($values['allow_social_tool']) && $values['allow_social_tool'] == 'true') {
             $values['allow_message_tool'] = 'true';
         }
 
-
         // The first step is to set all the variables that have type=checkbox of the category
         // to false as the checkbox that is unchecked is not in the $_POST data and can
         // therefore not be set to false.
@@ -225,96 +242,115 @@ if (!empty($_GET['category']) && !in_array($_GET['category'], array('Plugins', '
 
         foreach ($settings as $item) {
             $key = $item['variable'];
-            if (in_array($key, $settings_to_avoid)) { continue; }
-            if ($key == 'search_field' or $key == 'submit_fixed_in_bottom') { continue; }
+            if (in_array($key, $settings_to_avoid)) {
+                continue;
+            }
+            if ($key == 'search_field' or $key == 'submit_fixed_in_bottom') {
+                continue;
+            }
             $key = Database::escape_string($key);
-            $sql = "UPDATE $table_settings_current SET selected_value = 'false' WHERE variable = '".$key."' AND access_url = ".intval($url_id)."  AND type IN ('checkbox', 'radio') ";
+            $sql = "UPDATE $table_settings_current
+                    SET selected_value = 'false'
+                    WHERE variable = '".$key."' AND access_url = ".intval($url_id)."  AND type IN ('checkbox', 'radio') ";
             $res = Database::query($sql);
         }
 
-        /*foreach($settings_to_avoid as $key => $value) {
-            api_set_setting($key, $value, null, null, $_configuration['access_url']);
-        }*/
-
         // Save the settings.
         $keys = array();
 
         foreach ($values as $key => $value) {
-            if (strcmp($key,'MAX_FILE_SIZE')===0) { continue; }
-            if (in_array($key, $settings_to_avoid)) { continue; }
+            if (strcmp($key, 'MAX_FILE_SIZE') === 0) {
+                continue;
+            }
+            if (in_array($key, $settings_to_avoid)) {
+                continue;
+            }
             // Avoid form elements which have nothing to do with settings
-            if ($key == 'search_field' or $key == 'submit_fixed_in_bottom') { continue; }
+            if ($key == 'search_field' or $key == 'submit_fixed_in_bottom') {
+                continue;
+            }
 
             // Treat gradebook values in separate function.
             //if (strpos($key, 'gradebook_score_display_custom_values') === false) {
-                if (!is_array($value)) {
-                    $old_value = api_get_setting($key);
-                    switch ($key) {
-                    	case 'header_extra_content':
-                    		file_put_contents(api_get_path(SYS_PATH).api_get_home_path().'/header_extra_content.txt', $value);
-                    		$value = api_get_home_path().'/header_extra_content.txt';
-                    		break;
-                    	case 'footer_extra_content':
-                    		file_put_contents(api_get_path(SYS_PATH).api_get_home_path().'/footer_extra_content.txt', $value);
-                    		$value = api_get_home_path().'/footer_extra_content.txt';
-                    		break;
-                        // URL validation for some settings.
-                        case 'InstitutionUrl':
-                        case 'course_validation_terms_and_conditions_url':
-                            $value = trim(Security::remove_XSS($value));
-                            if ($value != '') {
-                                // Here we accept absolute URLs only.
-                                if (strpos($value, '://') === false) {
-                                    $value = 'http://'.$value;
-                                }
-                                if (!api_valid_url($value, true)) {
-                                    // If the new (non-empty) URL value is invalid, then the old URL value stays.
-                                    $value = $old_value;
-                                }
+            if (!is_array($value)) {
+                $old_value = api_get_setting($key);
+                switch ($key) {
+                    case 'header_extra_content':
+                        file_put_contents(api_get_path(SYS_PATH).api_get_home_path().'/header_extra_content.txt', $value);
+                        $value = api_get_home_path().'/header_extra_content.txt';
+                        break;
+                    case 'footer_extra_content':
+                        file_put_contents(api_get_path(SYS_PATH).api_get_home_path().'/footer_extra_content.txt', $value);
+                        $value = api_get_home_path().'/footer_extra_content.txt';
+                        break;
+                    // URL validation for some settings.
+                    case 'InstitutionUrl':
+                    case 'course_validation_terms_and_conditions_url':
+                        $value = trim(Security::remove_XSS($value));
+                        if ($value != '') {
+                            // Here we accept absolute URLs only.
+                            if (strpos($value, '://') === false) {
+                                $value = 'http://'.$value;
                             }
-                            // If the new URL value is empty, then it will be stored (i.e. the setting will be deleted).
-                            break;
-
-                        // Validation against e-mail address for some settings.
-                        case 'emailAdministrator':
-                            $value = trim(Security::remove_XSS($value));
-                            if ($value != '' && !api_valid_email($value)) {
-                                // If the new (non-empty) e-mail address is invalid, then the old e-mail address stays.
-                                // If the new e-mail address is empty, then it will be stored (i.e. the setting will be deleted).
+                            if (!api_valid_url($value, true)) {
+                                // If the new (non-empty) URL value is invalid, then the old URL value stays.
                                 $value = $old_value;
                             }
-                            break;
-                    }
-                    if ($old_value != $value) $keys[] = $key;
-                    $result = api_set_setting($key, $value, null, null, $url_id);
-                } else {
-                    $sql = "SELECT subkey FROM $table_settings_current WHERE variable = '$key'";
-                    $res = Database::query($sql);
-                    while ($row_subkeys = Database::fetch_array($res)) {
-                        // If subkey is changed:
-                        if ((isset($value[$row_subkeys['subkey']]) && api_get_setting($key, $row_subkeys['subkey']) == 'false') ||
-                            (!isset($value[$row_subkeys['subkey']]) && api_get_setting($key, $row_subkeys['subkey']) == 'true')) {
-                            $keys[] = $key;
-                            break;
                         }
+                        // If the new URL value is empty, then it will be stored (i.e. the setting will be deleted).
+                        break;
+
+                    // Validation against e-mail address for some settings.
+                    case 'emailAdministrator':
+                        $value = trim(Security::remove_XSS($value));
+                        if ($value != '' && !api_valid_email($value)) {
+                            // If the new (non-empty) e-mail address is invalid, then the old e-mail address stays.
+                            // If the new e-mail address is empty, then it will be stored (i.e. the setting will be deleted).
+                            $value = $old_value;
+                        }
+                        break;
+                }
+                if ($old_value != $value) $keys[] = $key;
+                $result = api_set_setting($key, $value, null, null, $url_id);
+            } else {
+                $sql = "SELECT subkey FROM $table_settings_current WHERE variable = '$key'";
+                $res = Database::query($sql);
+                while ($row_subkeys = Database::fetch_array($res)) {
+                    // If subkey is changed:
+                    if ((isset($value[$row_subkeys['subkey']]) && api_get_setting($key, $row_subkeys['subkey']) == 'false') ||
+                        (!isset($value[$row_subkeys['subkey']]) && api_get_setting($key, $row_subkeys['subkey']) == 'true')) {
+                        $keys[] = $key;
+                        break;
                     }
-                    foreach ($value as $subkey => $subvalue) {
-                        $result = api_set_setting($key, 'true', $subkey, null, $url_id);
-                    }
-
                 }
+                foreach ($value as $subkey => $subvalue) {
+                    $result = api_set_setting($key, 'true', $subkey, null, $url_id);
+                }
+            }
         }
 
         // Add event configuration settings category to the system log.
         $user_id = api_get_user_id();
         $category = $_GET['category'];
-        event_system(LOG_CONFIGURATION_SETTINGS_CHANGE, LOG_CONFIGURATION_SETTINGS_CATEGORY, $category, api_get_utc_datetime(), $user_id);
+        event_system(
+            LOG_CONFIGURATION_SETTINGS_CHANGE,
+            LOG_CONFIGURATION_SETTINGS_CATEGORY,
+            $category,
+            api_get_utc_datetime(),
+            $user_id
+        );
 
         // Add event configuration settings variable to the system log.
         if (is_array($keys) && count($keys) > 0) {
             foreach ($keys as $variable) {
                 if (in_array($key, $settings_to_avoid)) { continue; }
-                event_system(LOG_CONFIGURATION_SETTINGS_CHANGE, LOG_CONFIGURATION_SETTINGS_VARIABLE, $variable, api_get_utc_datetime(), $user_id);
+                event_system(
+                    LOG_CONFIGURATION_SETTINGS_CHANGE,
+                    LOG_CONFIGURATION_SETTINGS_VARIABLE,
+                    $variable,
+                    api_get_utc_datetime(),
+                    $user_id
+                );
             }
         }
     }
@@ -401,7 +437,6 @@ $resultcategories[] = array('category' => 'CAS');
 $resultcategories[] = array('category' => 'Shibboleth');
 $resultcategories[] = array('category' => 'Facebook');
 
-
 foreach ($resultcategories as $row) {
     $url = array();
     $url['url'] = api_get_self()."?category=".$row['category'];
@@ -413,9 +448,7 @@ foreach ($resultcategories as $row) {
 }
 
 echo Display::actions($action_array);
-
 echo '<br />';
-
 echo $form_search_html;
 
 if ($watermark_deleted) {
@@ -451,7 +484,13 @@ if (!empty($_GET['category'])) {
                     // add event to system log
                     $user_id = api_get_user_id();
                     $category = $_GET['category'];
-                    event_system(LOG_CONFIGURATION_SETTINGS_CHANGE, LOG_CONFIGURATION_SETTINGS_CATEGORY, $category, api_get_utc_datetime(), $user_id);
+                    event_system(
+                        LOG_CONFIGURATION_SETTINGS_CHANGE,
+                        LOG_CONFIGURATION_SETTINGS_CATEGORY,
+                        $category,
+                        api_get_utc_datetime(),
+                        $user_id
+                    );
                     Display :: display_confirmation_message(get_lang('DashboardPluginsHaveBeenUpdatedSucesslly'));
                 }
             }
@@ -461,23 +500,23 @@ if (!empty($_GET['category'])) {
                 });
                 </script>';
             echo '<div id="tabs">';
-                echo '<ul>';
-                echo '<li><a href="#tabs-1">'.get_lang('Plugins').'</a></li>';
-                echo '<li><a href="#tabs-2">'.get_lang('DashboardPlugins').'</a></li>';
-                echo '<li><a href="#tabs-3">'.get_lang('ConfigureExtensions').'</a></li>';
-                echo '</ul>';
-
-                echo '<div id="tabs-1">';
-                handle_plugins();
-                echo '</div>';
-
-                echo '<div id="tabs-2">';
-                DashboardManager::handle_dashboard_plugins();
-                echo '</div>';
-
-                echo '<div id="tabs-3">';
-                handle_extensions();
-                echo '</div>';
+            echo '<ul>';
+            echo '<li><a href="#tabs-1">'.get_lang('Plugins').'</a></li>';
+            echo '<li><a href="#tabs-2">'.get_lang('DashboardPlugins').'</a></li>';
+            echo '<li><a href="#tabs-3">'.get_lang('ConfigureExtensions').'</a></li>';
+            echo '</ul>';
+
+            echo '<div id="tabs-1">';
+            handle_plugins();
+            echo '</div>';
+
+            echo '<div id="tabs-2">';
+            DashboardManager::handle_dashboard_plugins();
+            echo '</div>';
+
+            echo '<div id="tabs-3">';
+            handle_extensions();
+            echo '</div>';
             echo '</div>';
             break;
         case 'Stylesheets':

+ 14 - 10
main/admin/sub_language.class.php

@@ -53,7 +53,7 @@ class SubLanguageManager
     {
         $tbl_admin_languages = Database :: get_main_table(TABLE_MAIN_LANGUAGE);
         $sql = 'SELECT * FROM ' . $tbl_admin_languages . '
-                WHERE parent_id="' . Database::escape_string($parent_id) . '" AND id="' . Database::escape_string($sub_language_id) . '"';
+                WHERE parent_id= ' . intval($parent_id) . ' AND id= ' . intval($sub_language_id) . '';
         $rs = Database::query($sql);
         $all_information = array();
         while ($row = Database::fetch_array($rs, 'ASSOC')) {
@@ -185,7 +185,7 @@ class SubLanguageManager
             return false;
         } //can't delete dir, so do not delete language record
         $sql = 'DELETE FROM ' . $tbl_admin_languages . '
-                WHERE id="' . Database::escape_string($sub_language_id) . '" ';
+                WHERE id= ' . intval($sub_language_id) . ' ';
         $res = Database::query($sql);
 
         return $res;
@@ -247,7 +247,7 @@ class SubLanguageManager
     public static function get_name_of_language_by_id($language_id)
     {
         $tbl_admin_languages = Database :: get_main_table(TABLE_MAIN_LANGUAGE);
-        $sql = 'SELECT original_name FROM ' . $tbl_admin_languages . ' WHERE id="' . Database::escape_string($language_id) . '"';
+        $sql = 'SELECT original_name FROM ' . $tbl_admin_languages . ' WHERE id= ' . intval($language_id) . '';
         $rs = Database::query($sql);
         if (Database::num_rows($rs) > 0) {
             return Database::result($rs, 0, 'original_name');
@@ -265,7 +265,7 @@ class SubLanguageManager
     {
         $tbl_admin_languages = Database :: get_main_table(TABLE_MAIN_LANGUAGE);
         $sql = 'SELECT count(*) AS count FROM ' . $tbl_admin_languages . '
-                WHERE id="' . Database::escape_string($language_id) . '" AND NOT ISNULL(parent_id)';
+                WHERE id = ' . intval($language_id) . ' AND NOT ISNULL(parent_id)';
         $rs = Database::query($sql);
 
         if (Database::num_rows($rs) > 0 && Database::result($rs, '0', 'count') == 1) {
@@ -302,7 +302,7 @@ class SubLanguageManager
     {
         $tbl_admin_languages = Database :: get_main_table(TABLE_MAIN_LANGUAGE);
         $sql = 'SELECT count(*) AS count FROM ' . $tbl_admin_languages . '
-                WHERE parent_id="' . Database::escape_string($language_id) . '" AND NOT ISNULL(parent_id);';
+                WHERE parent_id= ' . intval($language_id) . ' AND NOT ISNULL(parent_id);';
         $rs = Database::query($sql);
 
         if (Database::num_rows($rs) > 0 && Database::result($rs, '0', 'count') == 1) {
@@ -320,7 +320,7 @@ class SubLanguageManager
     public static function make_unavailable_language($language_id)
     {
         $tbl_admin_languages = Database :: get_main_table(TABLE_MAIN_LANGUAGE);
-        $sql_make_unavailable = "UPDATE $tbl_admin_languages SET available='0' WHERE id='" . Database::escape_string($language_id) . "'";
+        $sql_make_unavailable = "UPDATE $tbl_admin_languages SET available='0' WHERE id = " . intval($language_id) . "";
         $result = Database::query($sql_make_unavailable);
         return $result !== false; //only return false on sql error
     }
@@ -333,7 +333,7 @@ class SubLanguageManager
     public static function make_available_language($language_id)
     {
         $tbl_admin_languages = Database :: get_main_table(TABLE_MAIN_LANGUAGE);
-        $sql_make_available = "UPDATE $tbl_admin_languages SET available='1' WHERE id='" . Database::escape_string($language_id) . "'";
+        $sql_make_available = "UPDATE $tbl_admin_languages SET available='1' WHERE id = " . intval($language_id) . "";
         $result = Database::query($sql_make_available);
         return $result !== false; //only return false on sql error
     }
@@ -350,7 +350,7 @@ class SubLanguageManager
         }
         $tbl_admin_languages = Database :: get_main_table(TABLE_MAIN_LANGUAGE);
         $tbl_settings_current = Database :: get_main_table(TABLE_MAIN_SETTINGS_CURRENT);
-        $sql_update = "SELECT english_name FROM " . $tbl_admin_languages . " WHERE id='" . Database::escape_string($language_id) . "'";
+        $sql_update = "SELECT english_name FROM " . $tbl_admin_languages . " WHERE id= " . intval($language_id) . "";
         $result = Database::query($sql_update);
         $lang = Database::fetch_array($result);
         $sql_update_2 = "UPDATE " . $tbl_settings_current . " SET selected_value='" . $lang['english_name'] . "' WHERE variable='platformLanguage'";
@@ -412,8 +412,9 @@ class SubLanguageManager
         // select language - if case several languages match, get the last (more recent) one
         $sql = "SELECT english_name
                 FROM " . $adminLanguagesTable . "
-                WHERE isocode ='$isocode'
-                    AND available = 1
+                WHERE
+                    isocode ='$isocode' AND
+                    available = 1
                 ORDER BY id
                 DESC LIMIT 1";
         $res = Database::query($sql);
@@ -434,7 +435,9 @@ class SubLanguageManager
         if (empty($preferences)) {
             return false;
         }
+
         $preferencesArray = explode(',', $preferences);
+
         if (count($preferencesArray) > 0) {
             foreach ($preferencesArray as $pref) {
                 $s = strpos($pref, ';');
@@ -444,6 +447,7 @@ class SubLanguageManager
                     $code = $pref;
                 }
                 $name = self::getLanguageFromIsocode($code);
+
                 if ($name !== false) {
                     return $name;
                 }

+ 2 - 2
main/admin/sub_language_add.php

@@ -39,7 +39,7 @@ function add_sub_language ($original_name,$english_name,$isocode,$sublanguage_av
     $english_name           = Database::escape_string($english_name);
     $isocode                = Database::escape_string($isocode);
     $sublanguage_available  = Database::escape_string($sublanguage_available);
-    $parent_id              = Database::escape_string($parent_id);
+    $parent_id              = intval($parent_id);
 
     $sql='INSERT INTO '.$tbl_admin_languages.'(original_name,english_name,isocode,dokeos_folder,available,parent_id) VALUES ("'.$original_name.'","'.$english_name.'","'.$isocode.'","'.$english_name.'","'.$sublanguage_available.'","'.$parent_id.'")';
     $res = Database::query($sql);
@@ -119,7 +119,7 @@ function check_if_exist_language_by_id ($language_id) {
  * @return  bool    True if this language has children, false otherwise
  */
 function ckeck_if_is_parent_of_sub_language ($parent_id) {
-	$sql='SELECT count(*) AS count FROM language WHERE parent_id="'.Database::escape_string($parent_id).'"';
+	$sql='SELECT count(*) AS count FROM language WHERE parent_id= '.intval($parent_id).'';
 	$rs=Database::query($sql);
 	if (Database::num_rows($rs)>0 && Database::result($rs,0,'count')==1) {
 		return true;

+ 1 - 3
main/admin/user_edit.php

@@ -261,7 +261,6 @@ $creatorInfo = api_get_user_info($user_data['creator_id']);
 $date = sprintf(get_lang('CreatedByXYOnZ'), 'user_information.php?user_id='.$user_data['creator_id'], $creatorInfo['username'], $user_data['registration_date']);
 $form->addElement('html', '<div class="control-group"><label class="control-label">'.get_lang('RegistrationDate').'</label><div class="controls">'.$date.'</div></div>');
 
-
 if (!$user_data['platform_admin']) {
 	// Expiration Date
 	$form->addElement('radio', 'radio_expiration_date', get_lang('ExpirationDate'), get_lang('NeverExpires'), 0);
@@ -275,7 +274,6 @@ if (!$user_data['platform_admin']) {
 	$form->addElement('radio', 'active', '', get_lang('Inactive'), 0);
 }
 
-
 // EXTRA FIELDS
 $return_params = UserManager::set_extra_fields_in_form($form, $extra_data, 'user_edit', true, $user_id);
 $jquery_ready_content = $return_params['jquery_ready_content'];
@@ -433,7 +431,7 @@ if ($form->validate()) {
                 } else {
                     UserManager::update_extra_field_value($user_id, substr($key, 6), $value);
                 }
-            } elseif (strpos($key,'remove_extra') !== false) {
+            } elseif (strpos($key, 'remove_extra') !== false) {
                 $extra_value = Security::filter_filename(urldecode(key($value)));
                 // To remove from user_field_value and folder
                 UserManager::update_extra_field_value($user_id, substr($key,13), $extra_value);

+ 4 - 4
main/admin/user_fields.php

@@ -354,16 +354,16 @@ function delete_user_fields($field_id)
 	$table_user_field_values 	= Database::get_main_table(TABLE_MAIN_USER_FIELD_VALUES);
 
 	// delete the fields
-	$sql = "DELETE FROM $table_user_field WHERE id = '".Database::escape_string($field_id)."'";
+	$sql = "DELETE FROM $table_user_field WHERE id =  ".intval($field_id)." ";
 	$result = Database::query($sql);
 	if (Database::affected_rows() == 1)
 	{
 		// delete the field options
-		$sql = "DELETE FROM $table_user_field_options WHERE field_id = '".Database::escape_string($field_id)."'";
+		$sql = "DELETE FROM $table_user_field_options WHERE field_id = ".intval($field_id)."";
 		$result = Database::query($sql);
 
 		// delete the field values
-		$sql = "DELETE FROM $table_user_field_values WHERE field_id = '".Database::escape_string($field_id)."'";
+		$sql = "DELETE FROM $table_user_field_values WHERE field_id = ".intval($field_id)."";
 		$result = Database::query($sql);
 
 		// recalculate the field_order because the value is used to show/hide the up/down icon
@@ -373,7 +373,7 @@ function delete_user_fields($field_id)
 		$i = 1;
 		while($row = Database::fetch_array($result))
 		{
-			$sql_reorder = "UPDATE $table_user_field SET field_order = '".Database::escape_string($i)."' WHERE id = '".Database::escape_string($row['id'])."'";
+			$sql_reorder = "UPDATE $table_user_field SET field_order = '".Database::escape_string($i)."' WHERE id = ".intval($row['id'])."";
 			$result_reorder = Database::query($sql_reorder);
 			$i++;
 		}

+ 6 - 6
main/admin/user_fields_options.php

@@ -105,7 +105,7 @@ function get_options_data($from, $number_of_items, $column, $direction)
 				option_order 		AS col0,
 				option_display_text	AS col1,
 				id 					AS col2
-			FROM $table_userfields_options WHERE field_id='".Database::escape_string($_GET['field_id'])."' ORDER BY option_order ASC";
+			FROM $table_userfields_options WHERE field_id = ".intval($_GET['field_id'])." ORDER BY option_order ASC";
 	$sql .= " LIMIT $from,$number_of_items";
 	$res = Database::query($sql);
 	$return = array ();
@@ -122,7 +122,7 @@ function get_number_of_options($from=null, $number_of_items=null, $column=null,
 	$table_userfields_options 	= Database :: get_main_table(TABLE_MAIN_USER_FIELD_OPTIONS);
 
 	// The sql statement
-	$sql = "SELECT count(id) as total FROM $table_userfields_options WHERE field_id='".Database::escape_string($_GET['field_id'])."' ";
+	$sql = "SELECT count(id) as total FROM $table_userfields_options WHERE field_id= ".intval($_GET['field_id'])." ";
 	$res = Database::query($sql);
 	$row = Database::fetch_row($res);
 	return $row[0];
@@ -131,7 +131,7 @@ function get_number_of_options($from=null, $number_of_items=null, $column=null,
 function actions_filter($option_id,$url_params,$row)
 {
 	global $number_of_options;
-
+    $return = '';
 	if ($row[0]<>1)
 	{
 		$return .= '<a href="'.api_get_self().'?action=moveup&amp;option_id='.$option_id.'&amp;field_id='.Security::remove_XSS($_GET['field_id']).'&amp;sec_token='.$_SESSION['sec_token'].'">'.Display::return_icon('up.gif', get_lang('Up')).'</a>';
@@ -182,7 +182,7 @@ function move_user_field_option($direction,$option_id)
 
 	$found = false;
 
-	$sql = "SELECT id, option_order FROM $table_userfields_options  WHERE field_id='".Database::escape_string($_GET['field_id'])."' ORDER BY option_order $sortdirection";
+	$sql = "SELECT id, option_order FROM $table_userfields_options  WHERE field_id = ".intval($_GET['field_id'])." ORDER BY option_order $sortdirection";
 	$result = Database::query($sql);
 	while($row = Database::fetch_array($result))
 	{
@@ -201,8 +201,8 @@ function move_user_field_option($direction,$option_id)
 		}
 	}
 
-	$sql1 = "UPDATE ".$table_userfields_options." SET option_order = '".Database::escape_string($next_order)."' WHERE id =  '".Database::escape_string($this_id)."'";
-	$sql2 = "UPDATE ".$table_userfields_options." SET option_order = '".Database::escape_string($this_order)."' WHERE id =  '".Database::escape_string($next_id)."'";
+	$sql1 = "UPDATE ".$table_userfields_options." SET option_order = '".Database::escape_string($next_order)."' WHERE id =  ".intval($this_id)."";
+	$sql2 = "UPDATE ".$table_userfields_options." SET option_order = '".Database::escape_string($this_order)."' WHERE id =  ".intval($next_id)."";
 	Database::query($sql1);
 	Database::query($sql2);
 

File diff suppressed because it is too large
+ 357 - 355
main/admin/user_move_stats.php


+ 5 - 5
main/announcements/announcements.inc.php

@@ -566,10 +566,10 @@ class AnnouncementManager
         if ($insert_id != strval(intval($insert_id))) {
             return false;
         }
-        $insert_id = Database::escape_string($insert_id);
+        $insert_id = intval($insert_id);
         $course_id = api_get_course_int_id();
         // store the modifications in the table tbl_annoucement
-        $sql = "UPDATE $tbl_announcement SET email_sent='1' WHERE c_id = $course_id AND id='$insert_id'";
+        $sql = "UPDATE $tbl_announcement SET email_sent='1' WHERE c_id = $course_id AND id = $insert_id";
         Database::query($sql);
     }
 
@@ -793,7 +793,7 @@ class AnnouncementManager
                 // adding the individual users to the select form
                 foreach ($ref_array_users as $this_user) {
                     if (!is_array($to_already_selected) || !in_array("USER:" . $this_user['user_id'], $to_already_selected)) { // $to_already_selected is the array containing the users (and groups) that are already selected
-                        echo "<option value=\"USER:", $this_user['user_id'], "\"  title='" . sprintf(get_lang('LoginX'), $user['username']) . "'>",
+                        echo "<option value=\"USER:", $this_user['user_id'], "\"  title='" . sprintf(get_lang('LoginX'), $this_user['username']) . "'>",
                         "", api_get_person_name($this_user['firstname'], $this_user['lastname']),
                         "</option>";
                     }
@@ -873,10 +873,10 @@ class AnnouncementManager
     {
         $tbl_item_property = Database::get_course_table(TABLE_ITEM_PROPERTY);
         $tool = Database::escape_string($tool);
-        $id = Database::escape_string($id);
+        $id = intval($id);
         $course_id = api_get_course_int_id();
 
-        $sql = "SELECT * FROM $tbl_item_property WHERE c_id = $course_id AND tool='$tool' AND ref='$id'";
+        $sql = "SELECT * FROM $tbl_item_property WHERE c_id = $course_id AND tool='$tool' AND ref = $id";
         $result = Database::query($sql);
         while ($row = Database::fetch_array($result)) {
             $to_group = $row['to_group_id'];

+ 40 - 18
main/attendance/attendance_controller.php

@@ -544,33 +544,55 @@ class AttendanceController
     }
 
     /**
-     * Gets attendace base in the table:
+     * Gets attendance base in the table:
      * TABLE_STATISTIC_TRACK_E_COURSE_ACCESS
+     * @param bool $showForm
      * @throws ViewException
      */
-    public function calendarLogins()
+    public function getAttendanceBaseInLogin($showForm = false, $exportToPdf = true)
     {
-        $form = new FormValidator(
-            'search',
-            'post',
-            api_get_self().'?'.api_get_cidreq().'&action=calendar_logins'
-        );
-        $form->addDateRangePicker('range', get_lang('Range'));
-        $form->add_button('submit', get_lang('submit'));
         $table = null;
+        $formToDisplay = null;
+        $startDate = null;
+        $endDate = null;
+
+        $sessionId = api_get_session_id();
+        if ($showForm) {
+            $form = new FormValidator(
+                'search',
+                'post',
+                api_get_self() . '?' . api_get_cidreq(
+                ) . '&action=calendar_logins'
+            );
+            $form->addDateRangePicker('range', get_lang('Range'));
+            $form->add_button('submit', get_lang('submit'));
+
+            if ($form->validate()) {
+                $values = $form->getSubmitValues();
+
+                $startDate = api_get_utc_datetime($values['range_start']);
+                $endDate = api_get_utc_datetime($values['range_end']);
+            }
+            $formToDisplay = $form->return_form();
+        } else {
+           if (!empty($sessionId)) {
+               $sessionInfo = api_get_session_info($sessionId);
+               $startDate = $sessionInfo['date_start'];
+               $endDate = $sessionInfo['date_end'];
+           }
+        }
 
-        if ($form->validate()) {
-            $values = $form->getSubmitValues();
-
-            $startDate = api_get_utc_datetime($values['range_start']);
-            $endDate = api_get_utc_datetime($values['range_end']);
+        $attendance = new Attendance();
 
-            $attendance = new Attendance();
-            $table = $attendance->getAttendanceLogins($startDate, $endDate);
+        if ($exportToPdf) {
+            $result = $attendance->exportAttendanceLogin($startDate, $endDate);
+            if (empty($result)) {
+                api_not_allowed(true, get_lang('NoDataAvailable'));
+            }
         }
-
+        $table = $attendance->getAttendanceLoginTable($startDate, $endDate);
         $data = array(
-            'form' => $form->return_form(),
+            'form' => $formToDisplay,
             'table' => $table
         );
         $this->view->set_data($data);

+ 2 - 2
main/attendance/attendance_list.php

@@ -19,8 +19,8 @@ if (api_is_allowed_to_edit(null, true)) {
     echo '<a href="index.php?'.api_get_cidreq().$param_gradebook.'&action=attendance_add">'.
         Display::return_icon('new_attendance_list.png',get_lang('CreateANewAttendance'),'',ICON_SIZE_MEDIUM).'</a>';
 
-    echo '<a href="index.php?'.api_get_cidreq().$param_gradebook.'&action=calendar_logins">'.
-        Display::return_icon('attendance_list.png',get_lang('Logins'),'',ICON_SIZE_MEDIUM).'</a>';
+    /*echo '<a href="index.php?'.api_get_cidreq().$param_gradebook.'&action=calendar_logins">'.
+        Display::return_icon('attendance_list.png',get_lang('Logins'),'',ICON_SIZE_MEDIUM).'</a>';*/
 
     echo '</div>';
 }

+ 15 - 15
main/attendance/index.php

@@ -92,7 +92,7 @@ if (isset($_GET['calendar_id'])) {
 $attendance = new Attendance();
 
 // attendance controller object
-$attendance_controller = new AttendanceController();
+$attendanceController = new AttendanceController();
 $attendance_data = array();
 // get attendance data
 if (!empty($attendance_id)) {
@@ -235,53 +235,53 @@ if ($action == 'calendar_add') {
 
 // delete selected attendance
 if (isset($_POST['action']) && $_POST['action'] == 'attendance_delete_select') {
-    $attendance_controller->attendance_delete($_POST['id']);
+    $attendanceController->attendance_delete($_POST['id']);
 }
 // distpacher actions to controller
 switch ($action) {
     case 'attendance_list':
-        $attendance_controller->attendance_list();
+        $attendanceController->attendance_list();
         break;
     case 'attendance_add':
         if (api_is_allowed_to_edit(null, true)) {
-            $attendance_controller->attendance_add();
+            $attendanceController->attendance_add();
         } else {
             api_not_allowed();
         }
         break;
     case 'attendance_edit' :
         if (api_is_allowed_to_edit(null, true)) {
-            $attendance_controller->attendance_edit($attendance_id);
+            $attendanceController->attendance_edit($attendance_id);
         } else {
             api_not_allowed();
         }
         break;
     case 'attendance_delete' :
         if (api_is_allowed_to_edit(null, true)) {
-            $attendance_controller->attendance_delete($attendance_id);
+            $attendanceController->attendance_delete($attendance_id);
         } else {
             api_not_allowed();
         }
         break;
     case 'attendance_restore':
         if (api_is_allowed_to_edit(null, true)) {
-            $attendance_controller->attendance_restore($attendance_id);
+            $attendanceController->attendance_restore($attendance_id);
         } else {
             api_not_allowed();
         }
         break;
     case 'attendance_sheet_list':
-        $attendance_controller->attendance_sheet($action, $attendance_id, $student_id, true);
+        $attendanceController->attendance_sheet($action, $attendance_id, $student_id, true);
         break;
     case 'attendance_sheet_list_no_edit':
-        $attendance_controller->attendance_sheet($action, $attendance_id, $student_id, false);
+        $attendanceController->attendance_sheet($action, $attendance_id, $student_id, false);
         break;
     case 'attendance_sheet_export_to_pdf':
-        $attendance_controller->attendance_sheet_export_to_pdf($action, $attendance_id, $student_id, $course_id);
+        $attendanceController->attendance_sheet_export_to_pdf($action, $attendance_id, $student_id, $course_id);
         break;
     case 'attendance_sheet_add' :
         if (api_is_allowed_to_edit(null, true)) {
-            $attendance_controller->attendance_sheet($action, $attendance_id);
+            $attendanceController->attendance_sheet($action, $attendance_id);
         } else {
             api_not_allowed();
         }
@@ -289,7 +289,7 @@ switch ($action) {
     case 'lock_attendance' :
     case 'unlock_attendance' :
         if (api_is_allowed_to_edit(null, true)) {
-            $attendance_controller->lock_attendance($action, $attendance_id);
+            $attendanceController->lock_attendance($action, $attendance_id);
         } else {
             api_not_allowed();
         }
@@ -302,13 +302,13 @@ switch ($action) {
             api_not_allowed();
         }
     case 'calendar_list' :
-        $attendance_controller->attendance_calendar($action, $attendance_id, $calendar_id);
+        $attendanceController->attendance_calendar($action, $attendance_id, $calendar_id);
         break;
     case 'calendar_logins':
         if (api_is_allowed_to_edit(null, true)) {
-            $attendance_controller->calendarLogins();
+            $attendanceController->getAttendanceBaseInLogin(false, true);
         }
         break;
     default :
-        $attendance_controller->attendance_list();
+        $attendanceController->attendance_list();
 }

+ 5 - 5
main/auth/courses.php

@@ -1,13 +1,13 @@
 <?php
 /* For licensing terms, see /license.txt */
+
 /**
-* Template (front controller in MVC pattern) used for distpaching to the controllers depend on the current action
+* Template (front controller in MVC pattern) used for distpaching
+ * to the controllers depend on the current action
 * @author Christian Fasanando <christian1827@gmail.com> - Beeznest
 * @package chamilo.auth
 */
-/**
- * Code
- */
+
 // Names of the language file that needs to be included.
 $language_file = array ('courses', 'registration');
 
@@ -17,7 +17,7 @@ $cidReset = true; // Flag forcing the 'current course' reset
 // including files
 require_once '../inc/global.inc.php';
 
-$ctok = $_SESSION['sec_token'];
+$ctok = Security::get_existing_token();
 
 require_once api_get_path(LIBRARY_PATH).'auth.lib.php';
 require_once api_get_path(LIBRARY_PATH).'app_view.php';

+ 13 - 13
main/auth/courses_controller.php

@@ -1,11 +1,12 @@
 <?php
 /* For licensing terms, see /license.txt */
+
 /**
+ * Class CoursesController
+ *
  * This file contains class used like controller, it should be included inside a dispatcher file (e.g: index.php)
  * @author Christian Fasanando <christian1827@gmail.com> - BeezNest
  * @package chamilo.auth
- *
- * Class CoursesController
  */
 class CoursesController
 {
@@ -47,15 +48,14 @@ class CoursesController
         $this->view->set_layout('layout');
         $this->view->set_template('courses_list');
         $this->view->render();
-
     }
 
     /**
      * It's used for listing categories,
      * render to categories_list view
-     * @param string   	action
-     * @param string    confirmation message(optional)
-     * @param string    error message(optional)
+     * @param string   	$action
+     * @param string   $message confirmation message(optional)
+     * @param string   $error error message(optional)
      */
     public function categories_list($action, $message='', $error='')
     {
@@ -132,9 +132,9 @@ class CoursesController
         $data['message']          = $message;
         $data['content']          = $content;
         $data['error']            = $error;
-        
+
         $data['catalogShowCoursesSessions'] = 0;
-        
+
         if (isset($_configuration['catalog_show_courses_sessions'])) {
             $data['catalogShowCoursesSessions'] = $_configuration['catalog_show_courses_sessions'];
         }
@@ -178,10 +178,10 @@ class CoursesController
         }
 
         $data['user_coursecodes'] = $user_coursecodes;
-        $data['message']    = $message;
-        $data['content']    = $content;
-        $data['error']      = $error;
-        $data['action']     = 'display_courses';
+        $data['message'] = $message;
+        $data['content'] = $content;
+        $data['error'] = $error;
+        $data['action'] = 'display_courses';
 
         // render to the view
         $this->view->set_data($data);
@@ -493,7 +493,7 @@ class CoursesController
         $url = api_get_path(WEB_PATH) . "main/inc/email_editor.php?action=subscribe_me_to_session&session=$sessionName";
 
         return Display::url(get_lang('Subscribe'), $url, array(
-                    'class' => 'btn btn-large btn-primary',
+            'class' => 'btn btn-large btn-primary',
         ));
     }
 

+ 1 - 1
main/auth/inscription.php

@@ -482,7 +482,7 @@ if ($form->validate()) {
             }
             if ($store_extended) {
                 $sql .= implode(',', $sql_set);
-                $sql .= " WHERE user_id = '".Database::escape_string($user_id)."'";
+                $sql .= " WHERE user_id = ".intval($user_id)."";
                 Database::query($sql);
             }
 

+ 7 - 7
main/blog/blog.php

@@ -136,7 +136,7 @@ if (isset($_GET['action']) && $_GET['action'] == 'manage_tasks') {
 	}
 
 	if (isset($_GET['do']) && $_GET['do'] == 'delete_assignment') {
-		Blog :: delete_assigned_task($blog_id, Database::escape_string((int)$_GET['task_id']), Database::escape_string((int)$_GET['user_id']));
+		Blog :: delete_assigned_task($blog_id, intval($_GET['task_id']), intval($_GET['user_id']));
 		$return_message = array('type' => 'confirmation', 'message' => get_lang('TaskAssignmentDeleted'));
 	}
 
@@ -363,7 +363,7 @@ switch ($current_page) {
 		}
 		break;
 	case 'view_post' :
-		Blog :: display_post($blog_id, Database::escape_string((int)$_GET['post_id']));
+		Blog :: display_post($blog_id, intval($_GET['post_id']));
 		break;
 	case 'edit_post' :
 		$task_id = (isset ($_GET['task_id']) && is_numeric($_GET['task_id'])) ? $_GET['task_id'] : 0;
@@ -377,7 +377,7 @@ switch ($current_page) {
 				if ($_POST) {
 					Display::display_error_message(get_lang('FormHasErrorsPleaseComplete'));
 				}
-                Blog :: display_form_edit_post($blog_id, Database::escape_string((int)$_GET['post_id']));
+                Blog :: display_form_edit_post($blog_id, intval($_GET['post_id']));
 			} else {
 				if (isset ($_GET['filter']) && !empty ($_GET['filter'])) {
 					Blog :: display_day_results($blog_id, Database::escape_string($_GET['filter']));
@@ -415,11 +415,11 @@ switch ($current_page) {
 			}
 			if (isset($_GET['do']) && $_GET['do'] == 'edit')
 			{
-				Blog :: display_edit_task_form($blog_id, Database::escape_string($_GET['task_id']));
+				Blog :: display_edit_task_form($blog_id, intval($_GET['task_id']));
 			}
 			if (isset($_GET['do']) && $_GET['do'] == 'edit_assignment')
 			{
-				Blog :: display_edit_assigned_task_form($blog_id, Database::escape_string((int)$_GET['task_id']), Database::escape_string((int)$_GET['user_id']));
+				Blog :: display_edit_assigned_task_form($blog_id, intval($_GET['task_id']), intval($_GET['user_id']));
 			}
 			Blog :: display_task_list($blog_id);
 			echo '<br /><br />';
@@ -432,9 +432,9 @@ switch ($current_page) {
 		break;
 	case 'execute_task' :
 		if (isset ($_GET['post_id']))
-			Blog :: display_post($blog_id, Database::escape_string((int)$_GET['post_id']));
+			Blog :: display_post($blog_id, intval($_GET['post_id']));
 		else
-			Blog :: display_select_task_post($blog_id, Database::escape_string((int)$_GET['task_id']));
+			Blog :: display_select_task_post($blog_id, intval($_GET['task_id']));
 
 		break;
 	case 'view_search_result' :

+ 3 - 3
main/blog/blog_admin.php

@@ -75,11 +75,11 @@ if (api_is_allowed_to_edit()) {
 		}
 	}
 	if (isset($_GET['action']) && $_GET['action'] == 'visibility') {
-		Blog::change_blog_visibility(Database::escape_string((int)$_GET['blog_id']));
+		Blog::change_blog_visibility(intval($_GET['blog_id']));
 		Display::display_confirmation_message(get_lang('VisibilityChanged'));
 	}
 	if (isset($_GET['action']) && $_GET['action'] == 'delete') {
-		Blog::delete_blog(Database::escape_string((int)$_GET['blog_id']));
+		Blog::delete_blog(intval($_GET['blog_id']));
 		Display::display_confirmation_message(get_lang('BlogDeleted'));
 	}
 
@@ -115,7 +115,7 @@ if (api_is_allowed_to_edit()) {
 			if ($_POST) {
 				Display::display_error_message(get_lang('FormHasErrorsPleaseComplete'));
 			}
-            Blog::display_edit_blog_form(Database::escape_string((int)$_GET['blog_id']));
+            Blog::display_edit_blog_form(intval($_GET['blog_id']));
 		}
 	}
 	Blog::display_blog_list();

+ 25 - 26
main/calendar/agenda.inc.php

@@ -166,8 +166,7 @@ function get_calendar_items($select_month, $select_year, $select_day = false)
                     AND ip.tool='".TOOL_CALENDAR_EVENT."'
                     AND ip.visibility='1'
                     $session_condition
-                    GROUP BY ip.ref
-                    ORDER $sort_item $sort";
+                    GROUP BY ip.ref";
             }
             // A.3.b you are a course admin or a student
             else {
@@ -1139,7 +1138,7 @@ function store_agenda_item_as_announcement($item_id)
     }
     //get the agenda item
 
-    $item_id = Database::escape_string($item_id);
+    $item_id = intval($item_id);
     $sql = "SELECT * FROM $table_agenda WHERE id = ".$item_id;
     $res = Database::query($sql);
     $course_id = api_get_course_int_id();
@@ -1244,9 +1243,9 @@ function sent_to($tool, $id)
 {
     $TABLE_ITEM_PROPERTY = Database::get_course_table(TABLE_ITEM_PROPERTY);
     $tool = Database::escape_string($tool);
-    $id = Database::escape_string($id);
+    $id = intval($id);
 
-    $sql = "SELECT * FROM $TABLE_ITEM_PROPERTY WHERE tool='".$tool."' AND ref='".$id."'";
+    $sql = "SELECT * FROM $TABLE_ITEM_PROPERTY WHERE tool='".$tool."' AND ref= ".$id."";
     $result = Database::query($sql);
     while ($row = Database::fetch_array($result)) {
         // if to_group_id is null then it is sent to a specific user
@@ -1310,7 +1309,7 @@ function sent_to_form($sent_to_array)
         if (isset($sent_to_array['users'])) {
             if (is_array($sent_to_array['users'])) {
                 foreach ($sent_to_array['users'] as $user_id) {
-                    // @todo add username as tooltip - is this fucntion still used ?
+                    // @todo add username as tooltip - is this function still used ?
                     // $user_info= api_get_user_info($user_id);
                     // $username = api_htmlentities(sprintf(get_lang('LoginX'), $user_info['username']), ENT_QUOTES);
                     $output[] = api_get_person_name($user_info['firstName'], $user_info['lastName']);
@@ -1443,12 +1442,12 @@ function show_user_group_filter_form()
 function load_edit_users($tool, $id)
 {
     $tool = Database::escape_string($tool);
-    $id = Database::escape_string($id);
+    $id = intval($id);
     $TABLE_ITEM_PROPERTY = Database::get_course_table(TABLE_ITEM_PROPERTY);
     $course_id = api_get_course_int_id();
 
     $sql = "SELECT * FROM $TABLE_ITEM_PROPERTY
-            WHERE c_id = $course_id AND tool='$tool' AND ref='$id'";
+            WHERE c_id = $course_id AND tool='$tool' AND ref= $id ";
     $result = Database::query($sql);
 
     $to = array();
@@ -1480,13 +1479,13 @@ function change_visibility($tool, $id, $visibility)
     $_course = api_get_course_info();
     $TABLE_ITEM_PROPERTY = Database::get_course_table(TABLE_ITEM_PROPERTY);
     $tool = Database::escape_string($tool);
-    $id = Database::escape_string($id);
+    $id = intval($id);
 
     if ($visibility == 0) {
-        $sql_visibility = "UPDATE $TABLE_ITEM_PROPERTY SET visibility='0' WHERE tool='$tool' AND ref='$id'";
+        $sql_visibility = "UPDATE $TABLE_ITEM_PROPERTY SET visibility='0' WHERE tool='$tool' AND ref= $id ";
         api_item_property_update($_course, TOOL_CALENDAR_EVENT, $id, "invisible", api_get_user_id());
     } else {
-        $sql_visibility = "UPDATE $TABLE_ITEM_PROPERTY SET visibility='1' WHERE tool='$tool' AND ref='$id'";
+        $sql_visibility = "UPDATE $TABLE_ITEM_PROPERTY SET visibility='1' WHERE tool='$tool' AND ref= $id ";
         api_item_property_update($_course, TOOL_CALENDAR_EVENT, $id, "visible", api_get_user_id());
     }
 }
@@ -1553,18 +1552,18 @@ function get_agenda_item($id)
     global $TABLEAGENDA;
 
     $t_agenda_repeat = Database::get_course_table(TABLE_AGENDA_REPEAT);
-    $id = Database::escape_string($id);
+    $id = intval($id);
     $item = array();
     if (empty($id)) {
-        $id = intval(Database::escape_string(($_GET['id'])));
+        $id = intval($_GET['id']);
     } else {
-        $id = (int) $id;
+        $id = intval($id);
     }
     $course_id = api_get_course_int_id();
     if (empty($id)) {
         return $item;
     }
-    $sql = "SELECT * FROM ".$TABLEAGENDA." WHERE id='".$id."' AND c_id = $course_id ";
+    $sql = "SELECT * FROM ".$TABLEAGENDA." WHERE id = ".$id." AND c_id = $course_id ";
     $result = Database::query($sql);
     $entry_to_edit = Database::fetch_array($result);
     $item['title'] = $entry_to_edit["title"];
@@ -1665,7 +1664,7 @@ function store_edited_agenda_item($event_id, $id_attach, $file_comment)
 function save_edit_agenda_item($id, $title, $content, $start_date, $end_date)
 {
     $TABLEAGENDA = Database::get_course_table(TABLE_AGENDA);
-    $id = Database::escape_string($id);
+    $id = intval($id);
     $title = Database::escape_string($title);
     $content = Database::escape_string($content);
     $start_date = Database::escape_string($start_date);
@@ -1694,7 +1693,7 @@ function save_edit_agenda_item($id, $title, $content, $start_date, $end_date)
 function delete_agenda_item($id)
 {
     $_course = api_get_course_info();
-    $id = Database::escape_string($id);
+    $id = intval($id);
     if (api_is_allowed_to_edit(false, true) OR (api_get_course_setting('allow_user_edit_agenda') && !api_is_anonymous())) {
         if (!empty($_GET['id']) && isset($_GET['action']) && $_GET['action'] == "delete") {
             $t_agenda = Database::get_course_table(TABLE_AGENDA);
@@ -1949,9 +1948,9 @@ function get_attachment($agenda_id, $course_id = null)
     } else {
         $course_id = intval($course_id);
     }
-    $agenda_id = Database::escape_string($agenda_id);
+    $agenda_id = intval($agenda_id);
     $row = array();
-    $sql = 'SELECT id,path, filename,comment FROM '.$agenda_table_attachment.' WHERE c_id = '.$course_id.' AND agenda_id = '.(int) $agenda_id.'';
+    $sql = 'SELECT id,path, filename,comment FROM '.$agenda_table_attachment.' WHERE c_id = '.$course_id.' AND agenda_id = '.$agenda_id.'';
     $result = Database::query($sql);
     if (Database::num_rows($result) != 0) {
         $row = Database::fetch_array($result);
@@ -3417,8 +3416,8 @@ function show_add_form($id = '', $type = null)
                 $safe_file_comment = Database::escape_string($file_comment);
                 $safe_file_name = Database::escape_string($file_name);
                 $safe_new_file_name = Database::escape_string($new_file_name);
-                $safe_agenda_id = (int) $agenda_id;
-                $safe_id_attach = (int) $id_attach;
+                $safe_agenda_id = intval($agenda_id);
+                $safe_id_attach = intval($id_attach);
                 // Storing the attachments if any
                 if ($result) {
                     $sql = "UPDATE $agenda_table_attachment SET filename = '$safe_file_name', comment = '$safe_file_comment', path = '$safe_new_file_name', agenda_id = '$safe_agenda_id', size ='".intval($_FILES['user_upload']['size'])."'
@@ -3737,17 +3736,17 @@ function show_add_form($id = '', $type = null)
     function get_global_agenda_items($agendaitems, $day = "", $month = "", $year = "", $week = "", $type)
     {
         $tbl_global_agenda = Database::get_main_table(TABLE_MAIN_SYSTEM_CALENDAR);
-        $month = Database::escape_string($month);
-        $year = Database::escape_string($year);
-        $week = Database::escape_string($week);
-        $day = Database::escape_string($day);
+        $month = intval($month);
+        $year = intval($year);
+        $week = intval($week);
+        $day = intval($day);
         // 1. creating the SQL statement for getting the personal agenda items in MONTH view
 
         $current_access_url_id = api_get_current_access_url_id();
 
         if ($type == "month_view" or $type == "") {
             // We are in month view
-            $sql = "SELECT * FROM ".$tbl_global_agenda." WHERE MONTH(start_date)='".$month."' AND YEAR(start_date) = '".$year."'  AND access_url_id = $current_access_url_id ORDER BY start_date ASC";
+            $sql = "SELECT * FROM ".$tbl_global_agenda." WHERE MONTH(start_date) = ".$month." AND YEAR(start_date) = ".$year."  AND access_url_id = $current_access_url_id ORDER BY start_date ASC";
         }
         // 2. creating the SQL statement for getting the personal agenda items in WEEK view
         if ($type == "week_view") { // we are in week view

+ 3 - 3
main/calendar/agenda.lib.php

@@ -497,7 +497,7 @@ class Agenda
         }
 
         // Get the agenda item.
-        $item_id = Database::escape_string($item_id);
+        $item_id = intval($item_id);
         $sql = "SELECT * FROM $table_agenda WHERE c_id = $course_id AND id = ".$item_id;
         $res = Database::query($sql);
 
@@ -1913,7 +1913,7 @@ class Agenda
      */
     public static function changeVisibility($id, $visibility, $courseInfo, $userId = null)
     {
-        $id = Database::escape_string($id);
+        $id = intval($id);
         if (empty($userId)) {
             $userId = api_get_user_id();
         } else {
@@ -1953,7 +1953,7 @@ class Agenda
     {
         $tableAttachment = Database::get_course_table(TABLE_AGENDA_ATTACHMENT);
         $courseId = intval($courseInfo['real_id']);
-        $eventId = Database::escape_string($eventId);
+        $eventId = intval($eventId);
         $row = array();
         $sql = "SELECT id, path, filename, comment
                 FROM $tableAttachment

+ 3 - 1
main/calendar/myagenda.inc.php

@@ -709,7 +709,7 @@ function get_personal_agenda_items($user_id, $agendaitems, $day = "", $month = "
  */
 function get_personal_agenda_item($id) {
 	$tbl_personal_agenda = Database :: get_user_personal_table(TABLE_PERSONAL_AGENDA);
-	$id = Database::escape_string($id);
+	$id = intval($id);
 	// make sure events of the personal agenda can only be seen by the user himself
 	$user = api_get_user_id();
 	$sql = " SELECT * FROM ".$tbl_personal_agenda." WHERE id=".$id." AND user = ".$user;
@@ -983,6 +983,8 @@ function get_personal_agenda_items_between_dates($user_id, $date_start='', $date
 		$result = Database::query($sqlquery);
 		while ($item = Database::fetch_array($result)) {
 			$agendaday = date("j",strtotime($item['start_date']));
+			$month = date("n",strtotime($item['start_date']));
+			$year = date("Y",strtotime($item['start_date']));
 			$URL = api_get_path(WEB_PATH)."main/calendar/agenda.php?cidReq=".urlencode($course["code"])."&amp;day=$agendaday&amp;month=$month&amp;year=$year#$agendaday";
 			list($year,$month,$day,$hour,$min,$sec) = split('[-: ]',$item['start_date']);
 			$start_date = $year.$month.$day.$hour.$min;

+ 6 - 5
main/chat/chat.php

@@ -39,7 +39,7 @@ if (!empty($mycourseid) && $mycourseid != -1) {
 	$open_chat_window = api_get_course_setting('allow_open_chat_window');
 }
 
-$cidreq = Security::remove_XSS($_GET['cidReq']);
+$courseCode = Security::remove_XSS($_GET['cidReq']);
 
 ?>
 <!DOCTYPE html>
@@ -76,12 +76,13 @@ if (empty($open_chat_window)) {
 }
 
 $url = api_get_path(WEB_CODE_PATH).'chat/';
+$params = "cidReq=".$courseCode.'&id_session='.api_get_session_id();
 
 echo '<div class="page-chat">';
-echo '<iframe src="'.$url.'chat_whoisonline.php?cidReq='.$cidreq.'" name="chat_whoisonline" scrolling="no" style="height:550px; width:35%; border: 0px none; float:left"></iframe>';
-echo '<iframe src="'.$url.'chat_chat.php?origin='.$origin.'&target='.$target.'&amp;cidReq='.$cidreq.'" name="chat_chat" id="chat_chat" scrolling="auto" height="380" style="width:65%; border: 0px none; float:right"></iframe>';
-echo '<iframe src="'.$url.'chat_message.php?cidReq='.$cidreq.'" name="chat_message" scrolling="no" height="182px" style="width:65%; border: 0px none; float:right"></iframe>';
-echo '<iframe src="'.$url.'chat_hidden.php?cidReq='.$cidreq.'" name="chat_hidden" height="0" style="border: 0px none"></iframe>';
+echo '<iframe src="'.$url.'chat_whoisonline.php?'.$params.'" name="chat_whoisonline" scrolling="no" style="height:550px; width:35%; border: 0px none; float:left"></iframe>';
+echo '<iframe src="'.$url.'chat_chat.php?origin='.$origin.'&target='.$target.'&'.$params.'" name="chat_chat" id="chat_chat" scrolling="auto" height="380" style="width:65%; border: 0px none; float:right"></iframe>';
+echo '<iframe src="'.$url.'chat_message.php?'.$params.'" name="chat_message" scrolling="no" height="182px" style="width:65%; border: 0px none; float:right"></iframe>';
+echo '<iframe src="'.$url.'chat_hidden.php?'.$params.'" name="chat_hidden" height="0" style="border: 0px none"></iframe>';
 echo '</div>';
 
 if (empty($open_chat_window)) {

+ 10 - 5
main/chat/chat_message.php

@@ -77,13 +77,19 @@ if ($sent) {
         <div class="tabbable">
             <ul class="nav nav-tabs">
                 <li class="active">
-                    <a href="#tab1" data-toggle="tab"><?php echo get_lang('Write'); ?></a>
+                    <a href="#tab1" data-toggle="tab">
+                        <?php echo get_lang('Write'); ?>
+                    </a>
                 </li>
                 <li>
-                    <a href="#tab2" id="preview" data-toggle="tab"><?php echo get_lang('Preview'); ?></a>
+                    <a href="#tab2" id="preview" data-toggle="tab">
+                        <?php echo get_lang('Preview'); ?>
+                    </a>
                 </li>
                 <li>
-                    <a href="#tab3" id="emojis" data-toggle="tab"><?php echo get_lang('Emojis'); ?></a>
+                    <a href="#tab3" id="emojis" data-toggle="tab">
+                        <?php echo Emojione\Emojione::toImage(':smile:'); ?>
+                    </a>
                 </li>
             </ul>
             <div class="tab-content">
@@ -92,8 +98,7 @@ if ($sent) {
                         <tr>
                             <td width="320" valign="middle">
                                 <?php
-                                $talkboxsize=(api_get_course_setting('allow_open_chat_window')) ? 'width: 350px; height: 80px' : 'width: 450px; height: 35px';
-                                //onkeydown="send_message(event);"
+                                $talkboxsize = (api_get_course_setting('allow_open_chat_window')) ? 'width: 350px; height: 80px' : 'width: 450px; height: 35px';
                                 ?>
                                 <textarea id="message" class="message-text" name="message" style=" <?php echo $talkboxsize; ?>"></textarea>
                             </td>

+ 0 - 1
main/course_home/activity.php

@@ -65,7 +65,6 @@ if ($enabled == 'true') {
 //	COURSE ADMIN ONLY VIEW
 
 // Start of tools for CourseAdmins (teachers/tutors)
-
 if ($session_id == 0 && api_is_course_admin() && api_is_allowed_to_edit(null, true)) {
     $content .=  '<div class="courseadminview" style="border:0px; margin-top: 0px;padding:0px;">
 		<div class="normal-message" id="id_normal_message" style="display:none">';

+ 11 - 15
main/course_home/course_home.php

@@ -28,13 +28,10 @@
 *	@package chamilo.course_home
 */
 
-/* 		INIT SECTION		*/
-
-
 use \ChamiloSession as Session;
 
 // Name of the language file that needs to be included.
-$language_file = array('course_home','courses');
+$language_file = array('course_home', 'courses');
 $use_anonymous = true;
 
 // Inlcuding the global initialization file.
@@ -48,9 +45,7 @@ require_once dirname(__FILE__).'/../inc/global.inc.php';
 //unset($_SESSION['lpobject']);
 
 $htmlHeadXtra[] ='<script>
-
 /* option show/hide thematic-block */
-
 $(document).ready(function(){
     $("#thematic-show").click(function(){
         $(".btn-hide-thematic").hide();
@@ -64,7 +59,6 @@ $(document).ready(function(){
     });
 });
 
-
 $(document).ready(function() {
 	$(".make_visible_and_invisible").attr("href", "javascript:void(0);");
 	$(".make_visible_and_invisible > img").click(function () {
@@ -119,7 +113,6 @@ $(document).ready(function() {
 	});
 });
 
-
 </script>';
 
 // The section for the tabs
@@ -140,9 +133,9 @@ define('TOOL_DRH', 'tool_drh');
 define('TOOL_STUDENT_VIEW', 'toolstudentview');
 define('TOOL_ADMIN_VISIBLE', 'tooladminvisible');
 
-$user_id 		= api_get_user_id();
-$course_code 	= api_get_course_id();
-$sessionId      = api_get_session_id();
+$user_id = api_get_user_id();
+$course_code = api_get_course_id();
+$sessionId = api_get_session_id();
 $show_message = '';
 
 if (apiIsInvitedUser()) {
@@ -265,12 +258,15 @@ $content = Display::return_introduction_section(TOOL_COURSE_HOMEPAGE, array(
 	the setting homepage_view is adjustable through
 	the platform administration section */
 
-//require_once api_get_path(LIBRARY_PATH).'course_home.lib.php';
-
 if ($show_autolunch_lp_warning) {
-    $show_message .= Display::return_message(get_lang('TheLPAutoLaunchSettingIsONStudentsWillBeRedirectToAnSpecificLP'),'warning');
+    $show_message .= Display::return_message(
+        get_lang('TheLPAutoLaunchSettingIsONStudentsWillBeRedirectToAnSpecificLP'),
+        'warning'
+    );
 }
-if (api_get_setting('homepage_view') == 'activity' || api_get_setting('homepage_view') == 'activity_big') {
+if (api_get_setting('homepage_view') == 'activity' ||
+    api_get_setting('homepage_view') == 'activity_big'
+) {
 	require 'activity.php';
 } elseif (api_get_setting('homepage_view') == '2column') {
 	require '2column.php';

+ 3 - 5
main/coursecopy/copy_course_session.php

@@ -1,5 +1,6 @@
 <?php
 /* For licensing terms, see /license.txt */
+
 /**
  * Copy resources from one course in a session to another one.
  *
@@ -7,10 +8,6 @@
  * @author Julio Montoya <gugli100@gmail.com> Lots of bug fixes/improvements
  * @package chamilo.backup
  */
-/**
- * Code
- */
-/*  INIT SECTION  */
 
 // Language files that need to be included
 $language_file = array('coursebackup', 'admin');
@@ -18,7 +15,8 @@ $language_file = array('coursebackup', 'admin');
 $cidReset = true;
 require_once '../inc/global.inc.php';
 $current_course_tool  = TOOL_COURSE_MAINTENANCE;
-api_protect_course_script(true, true);
+
+api_protect_global_admin_script();
 
 require_once api_get_path(LIBRARY_PATH).'fileManage.lib.php';
 require_once api_get_path(LIBRARY_PATH).'xajax/xajax.inc.php';

+ 13 - 0
main/css/base.css

@@ -5291,3 +5291,16 @@ i.size-32.icon-new-work{
     margin-right: auto;
     max-width: 100%;
 }
+
+/* display the cookie usage warning validation */
+.cookieUsageValidation {
+    padding: 5px;
+    background-color: #333333;
+    color:#E0E0E0;
+    text-align:center;
+}
+
+.displayUnderToolbar
+{
+    height: 52px;
+}

+ 15 - 36
main/css/chamilo/default.css

@@ -35,18 +35,11 @@ a:active {
     color: #FFFFFF;
 }
 .subnav .navbar-inner {
-    -webkit-border-radius: 2px;
-    -moz-border-radius: 2px;
-    border-radius: 2px;
-    border: 1px solid #178ACC;
-    background: #4fb2ea; /* Old browsers */
-    background: -moz-linear-gradient(top, #4fb2ea 0%, #0191c7 100%); /* FF3.6+ */
-    background: -webkit-gradient(linear, left top, left bottom, color-stop(0%,#4fb2ea), color-stop(100%,#0191c7)); /* Chrome,Safari4+ */
-    background: -webkit-linear-gradient(top, #4fb2ea 0%,#0191c7 100%); /* Chrome10+,Safari5.1+ */
-    background: -o-linear-gradient(top, #4fb2ea 0%,#0191c7 100%); /* Opera 11.10+ */
-    background: -ms-linear-gradient(top, #4fb2ea 0%,#0191c7 100%); /* IE10+ */
-    background: linear-gradient(to bottom, #4fb2ea 0%,#0191c7 100%); /* W3C */
-    filter: progid:DXImageTransform.Microsoft.gradient( startColorstr='#4fb2ea', endColorstr='#0191c7',GradientType=0 ); /* IE6-9 */    
+    -webkit-border-radius: 0px;
+    -moz-border-radius: 02px;
+    border-radius: 0px;
+    border: none;
+    background: #00a9e0; /* Old browsers */
 }
 
 .subnav .nav > li > a {
@@ -314,10 +307,10 @@ a.thumbnail:hover{
 }
 
 .well {
-  background-color: rgba(96,165,209, 0.1);
-  border: 1px solid rgba(96,165,209, 0.1);
+  background-color: rgba(255,255,255, 0.1);
+  border: 1px solid #EAEAEA;
   border-radius: 8px;
-  box-shadow: 0 1px 1px rgba(0, 0, 0, 0.05) inset;
+  box-shadow: 0 1px 1px rgba(0, 0, 0, 0.09) inset;
   margin-bottom: 20px;
   min-height: 20px;
   padding: 20px 10px;
@@ -361,8 +354,8 @@ a.thumbnail:hover{
   padding-bottom: 0px;
 }
 .well_border{
-  background-color: rgba(96,165,209, 0.1);
-  border: 1px solid rgba(96,165,209, 0.1);
+  background-color: rgba(255,255,255, 0.1);
+  border: 1px solid #EAEAEA;
   border-radius: 8px;
   box-shadow: 0 1px 1px rgba(0, 0, 0, 0.05) inset;
   margin-bottom: 20px;
@@ -633,16 +626,9 @@ a.thumbnail:hover{
  *****************************************************/
 footer {
     height: 7em;
-    background: #4fb2ea; /* Old browsers */
-    background: -moz-linear-gradient(top, #4fb2ea 0%, #0191c7 100%); /* FF3.6+ */
-    background: -webkit-gradient(linear, left top, left bottom, color-stop(0%,#4fb2ea), color-stop(100%,#0191c7)); /* Chrome,Safari4+ */
-    background: -webkit-linear-gradient(top, #4fb2ea 0%,#0191c7 100%); /* Chrome10+,Safari5.1+ */
-    background: -o-linear-gradient(top, #4fb2ea 0%,#0191c7 100%); /* Opera 11.10+ */
-    background: -ms-linear-gradient(top, #4fb2ea 0%,#0191c7 100%); /* IE10+ */
-    background: linear-gradient(to bottom, #4fb2ea 0%,#0191c7 100%); /* W3C */
-    filter: progid:DXImageTransform.Microsoft.gradient( startColorstr='#4fb2ea', endColorstr='#0191c7',GradientType=0 ); /* IE6-9 */
+    background: #00a9e0; /* Old browsers */
     color:#ffffff;
-    border-top: 1px solid #0191C7;
+    border-top: none;
 }
 footer .container .row {
   padding-top: 5px;
@@ -997,14 +983,7 @@ RESPONSIVE CSS
   color: #FFFFFF;
 }
 .navbar-inner{
-  background: #2bb8ef; /* Old browsers */
-  background: -moz-linear-gradient(top, #2bb8ef 0%, #0191c7 100%); /* FF3.6+ */
-  background: -webkit-gradient(linear, left top, left bottom, color-stop(0%,#2bb8ef), color-stop(100%,#0191c7)); /* Chrome,Safari4+ */
-  background: -webkit-linear-gradient(top, #2bb8ef 0%,#0191c7 100%); /* Chrome10+,Safari5.1+ */
-  background: -o-linear-gradient(top, #2bb8ef 0%,#0191c7 100%); /* Opera 11.10+ */
-  background: -ms-linear-gradient(top, #2bb8ef 0%,#0191c7 100%); /* IE10+ */
-  background: linear-gradient(to bottom, #2bb8ef 0%,#0191c7 100%); /* W3C */
-  filter: progid:DXImageTransform.Microsoft.gradient( startColorstr='#2bb8ef', endColorstr='#0191c7',GradientType=0 ); /* IE6-9 */
+  background: #00A9E0; /* Old browsers */
 }
 
 .dropdown-menu li > a:hover, .dropdown-menu .active > a, .dropdown-menu .active > a:hover {
@@ -1036,8 +1015,8 @@ RESPONSIVE CSS
         padding-top: 10px;
     }
     #profile_block .nav-list li, #course_block .nav-list li{
-        padding-bottom: 5px;
-        padding-top: 5px;
+        padding-bottom: 10px;
+        padding-top: 10px;
     }
     #top_main_content .menu-column #user_image_block{
       box-shadow: none;

+ 2 - 3
main/css/responsive.css

@@ -228,8 +228,8 @@ The more frequent ones have been marked with *
       width: auto;
     }
     #profile_block .nav-list li, #course_block .nav-list li {
-        padding-bottom: 3px;
-        padding-top: 3px;
+        padding-bottom: 10px;
+        padding-top: 10px;
     }
     .well_border .row .span2 .thumbnail {
     background-color: #FFFFFF;
@@ -731,7 +731,6 @@ The more frequent ones have been marked with *
       box-shadow: none;
     }
     #top_main_content .menu-column .block_user_info {
-        float: left;
         width: 280px;
     }
     .section-mycampus .hot-course-box, .section-mycourses .course-box {

+ 3 - 1
main/document/document.php

@@ -180,6 +180,8 @@ if (Portfolio::controller()->accept()) {
     Portfolio::controller()->run();
 }
 
+$curdirpath = isset($_GET['curdirpath']) ? Security::remove_XSS($_GET['curdirpath']) : null;
+
 switch ($action) {
     case 'delete_item':
         if ($is_allowed_to_edit ||
@@ -1367,7 +1369,7 @@ if ($is_allowed_to_edit ||
         $templateForm .= '</form>';
     } elseif (isset($_GET['add_as_template']) && isset($_POST['create_template'])) {
 
-        $document_id_for_template = intval(Database::escape_string($_GET['add_as_template']));
+        $document_id_for_template = intval($_GET['add_as_template']);
 
         $title = Security::remove_XSS($_POST['template_title']);
         //$description = Security::remove_XSS($_POST['template_description']);

+ 1 - 1
main/document/document_lite.php

@@ -619,7 +619,7 @@ if ($is_allowed_to_edit || $group_member_with_upload_rights || is_my_shared_fold
 
     } elseif (isset($_GET['add_as_template']) && isset($_POST['create_template'])) {
 
-        $document_id_for_template = intval(Database::escape_string($_GET['add_as_template']));
+        $document_id_for_template = intval($_GET['add_as_template']);
 
         $title = Security::remove_XSS($_POST['template_title']);
         //$description = Security::remove_XSS($_POST['template_description']);

+ 2 - 2
main/document/edit_document.php

@@ -223,8 +223,8 @@ if (!is_allowed_to_edit()) {
 
 if (isset($_POST['comment'])) {
 	// Fixing the path if it is wrong
-	$comment 	     = trim(Database::escape_string($_POST['comment']));
-	$title 		     = trim(Database::escape_string($_POST['title']));
+	$comment 	     = Database::escape_string(trim($_POST['comment']));
+	$title 		     = Database::escape_string(trim($_POST['title']));
     //Just in case see BT#3525
     if (empty($title)) {
 		$title = $documen_data['title'];

+ 12 - 2
main/document/upload.php

@@ -284,7 +284,7 @@ if (api_get_setting('search_enabled') == 'true') {
 
 $form->addElement('radio', 'if_exists', get_lang('UplWhatIfFileExists'), get_lang('UplDoNothing'), 'nothing');
 $form->addElement('radio', 'if_exists', '', get_lang('UplOverwriteLong'), 'overwrite');
-$form->addElement('radio', 'if_exists', '', get_lang('UplRenameLong'), 'rename', array('checked="checked"'));
+$form->addElement('radio', 'if_exists', '', get_lang('UplRenameLong'), 'rename');
 // Close the java script and avoid the footer up
 $form->addElement('html', '</div>');
 
@@ -292,7 +292,17 @@ $form->addElement('html', '</div>');
 $form->addElement('style_submit_button', 'submitDocument', get_lang('SendDocument'), 'class="upload"');
 $form->add_real_progress_bar('DocumentUpload', 'file');
 
-$defaults = array('index_document' => 'checked="checked"');
+$fileExistsOption = api_get_configuration_value('document_if_file_exists_option');
+
+$defaultFileExistsOption = 'rename';
+if (!empty($fileExistsOption)) {
+    $defaultFileExistsOption = $fileExistsOption;
+}
+
+$defaults = array(
+    'index_document' => 'checked="checked"',
+    'if_exists' => $defaultFileExistsOption
+);
 
 $form->setDefaults($defaults);
 

+ 11 - 11
main/dropbox/dropbox_class.inc.php

@@ -121,20 +121,20 @@ class Dropbox_Work
 			$this->id = $res['id'];
 			$this->upload_date = $res['upload_date'];
 		    $sql = "UPDATE ".$dropbox_cnf["tbl_file"]." SET
-					filesize			= '".Database::escape_string($this->filesize)."' ,
+					filesize			= '".intval($this->filesize)."' ,
 					title 				= '".Database::escape_string($this->title)."',
 					description 		= '".Database::escape_string($this->description)."',
 					author 				= '".Database::escape_string($this->author)."',
 					last_upload_date 	= '".Database::escape_string($this->last_upload_date)."'
-					WHERE c_id = $course_id AND id='".Database::escape_string($this->id)."'";
+					WHERE c_id = $course_id AND id = ".intval($this->id)."";
 			Database::query($sql);
 		} else {
 			$this->upload_date = $this->last_upload_date;
 			$sql = "INSERT INTO ".$dropbox_cnf['tbl_file']." (c_id, uploader_id, filename, filesize, title, description, author, upload_date, last_upload_date, session_id)
 				VALUES ( $course_id,
-						'".Database::escape_string($this->uploader_id)."'
+						'".intval($this->uploader_id)."'
 						, '".Database::escape_string($this->filename)."'
-						, '".Database::escape_string($this->filesize)."'
+						, '".intval($this->filesize)."'
 						, '".Database::escape_string($this->title)."'
 						, '".Database::escape_string($this->description)."'
 						, '".Database::escape_string($this->author)."'
@@ -148,7 +148,7 @@ class Dropbox_Work
 		}
 
         $sql = "SELECT count(file_id) as count FROM ".$dropbox_cnf['tbl_person']."
-				WHERE c_id = $course_id AND file_id = '".Database::escape_string($this->id)."' AND user_id = ".$this->uploader_id;
+				WHERE c_id = $course_id AND file_id = ".intval($this->id)." AND user_id = ".$this->uploader_id;
         $result = Database::query($sql);
         $row = Database::fetch_array($result);
         if ($row['count'] == 0) {
@@ -156,8 +156,8 @@ class Dropbox_Work
             // Insert entries into person table
             $sql = "INSERT INTO ".$dropbox_cnf['tbl_person']." (c_id, file_id, user_id)
                     VALUES ($course_id,
-                            '".Database::escape_string($this->id)."'
-                            , '".Database::escape_string($this->uploader_id)."'
+                            ".intval($this->id)."
+                            , ".intval($this->uploader_id)."
                             )";
             Database::query($sql);
         }
@@ -181,7 +181,7 @@ class Dropbox_Work
 		// Get the data from DB
 		$sql = "SELECT uploader_id, filename, filesize, title, description, author, upload_date, last_upload_date, cat_id
 				FROM ".$dropbox_cnf['tbl_file']."
-				WHERE c_id = $course_id AND id = '".Database::escape_string($id)."'";
+				WHERE c_id = $course_id AND id = ".intval($id)."";
         $result = Database::query($sql);
 		$res = Database::fetch_array($result, 'ASSOC');
 
@@ -351,7 +351,7 @@ class Dropbox_SentWork extends Dropbox_Work
 		$this->recipients = array();
 		$sql = "SELECT dest_user_id, feedback_date, feedback
 				FROM ".$dropbox_cnf['tbl_post']."
-				WHERE c_id = $course_id AND file_id='".Database::escape_string($id)."'";
+				WHERE c_id = $course_id AND file_id = ".intval($id)."";
         $result = Database::query($sql);
 		while ($res = Database::fetch_array($result, 'ASSOC')) {
 
@@ -430,8 +430,8 @@ class Dropbox_Person
 				FROM $file_tbl f INNER JOIN $person_tbl p
 				ON (f.id = p.file_id AND f.c_id = $course_id AND p.c_id = $course_id)
                 WHERE
-                    f.uploader_id 	= '".Database::escape_string($this->userId)."' AND
-                    p.user_id       = '".Database::escape_string($this->userId)."'
+                    f.uploader_id   = ".intval($this->userId)." AND
+                    p.user_id       = ".intval($this->userId)."
                     $condition_session
                 ";
         $result = Database::query($sql);

+ 12 - 12
main/dropbox/dropbox_functions.inc.php

@@ -221,16 +221,16 @@ function store_move($id, $target, $part)
     if ((isset($id) AND $id != '') AND (isset($target) AND $target != '') AND (isset($part) AND $part != '')) {
 
         if ($part == 'received') {
-            $sql = "UPDATE ".$dropbox_cnf["tbl_post"]." SET cat_id='".Database::escape_string($target)."'
-                        WHERE c_id = $course_id AND dest_user_id='".Database::escape_string($_user['user_id'])."'
-                        AND file_id='".Database::escape_string($id)."'";
+            $sql = "UPDATE ".$dropbox_cnf["tbl_post"]." SET cat_id = ".intval($target)."
+                        WHERE c_id = $course_id AND dest_user_id = ".intval($_user['user_id'])."
+                        AND file_id = ".intval($id)."";
             Database::query($sql);
             $return_message = get_lang('ReceivedFileMoved');
         }
         if ($part == 'sent') {
-            $sql = "UPDATE ".$dropbox_cnf["tbl_file"]." SET cat_id='".Database::escape_string($target)."'
-                        WHERE c_id = $course_id AND uploader_id='".Database::escape_string($_user['user_id'])."'
-                        AND id='".Database::escape_string($id)."'";
+            $sql = "UPDATE ".$dropbox_cnf["tbl_file"]." SET cat_id = ".intval($target)."
+                        WHERE c_id = $course_id AND uploader_id = ".intval($_user['user_id'])."
+                        AND id = ".intval($id)."";
             Database::query($sql);
             $return_message = get_lang('SentFileMoved');
         }
@@ -386,7 +386,7 @@ function store_addcategory()
         // step 3b, we add the category if it does not exist yet.
         if (Database::num_rows($result) == 0) {
             $sql = "INSERT INTO ".$dropbox_cnf['tbl_category']." (c_id, cat_name, received, sent, user_id, session_id)
-                    VALUES ($course_id, '".Database::escape_string($_POST['category_name'])."', '".Database::escape_string($received)."', '".Database::escape_string($sent)."', '".Database::escape_string($_user['user_id'])."',$session_id)";
+                    VALUES ($course_id, '".Database::escape_string($_POST['category_name'])."', '".Database::escape_string($received)."', '".Database::escape_string($sent)."', ".intval($_user['user_id']).", $session_id)";
             Database::query($sql);
             return array('type' => 'confirmation', 'message' => get_lang('CategoryStored'));
         } else {
@@ -394,8 +394,8 @@ function store_addcategory()
         }
     } else {
         $sql = "UPDATE ".$dropbox_cnf['tbl_category']." SET cat_name='".Database::escape_string($_POST['category_name'])."', received='".Database::escape_string($received)."' , sent='".Database::escape_string($sent)."'
-                WHERE c_id = $course_id AND user_id='".Database::escape_string($_user['user_id'])."'
-                AND cat_id='".Database::escape_string($_POST['edit_id'])."'";
+                WHERE c_id = $course_id AND user_id = ".intval($_user['user_id'])."
+                AND cat_id = ".intval($_POST['edit_id'])."";
         Database::query($sql);
         return array('type' => 'confirmation', 'message' => get_lang('CategoryModified'));
     }
@@ -420,7 +420,7 @@ function display_addcategory_form($category_name = '', $id = '', $action)
 
     if (isset($id) AND $id != '') {
         // retrieve the category we are editing
-        $sql = "SELECT * FROM ".$dropbox_cnf['tbl_category']." WHERE c_id = $course_id AND cat_id='".Database::escape_string($id)."'";
+        $sql = "SELECT * FROM ".$dropbox_cnf['tbl_category']." WHERE c_id = $course_id AND cat_id = ".intval($id)."";
         $result = Database::query($sql);
         $row = Database::fetch_array($result);
 
@@ -938,7 +938,7 @@ function display_user_link_work($user_id, $name = '') {
     if ($user_id != 0) {
         if (empty($name)) {
             $table_user = Database::get_main_table(TABLE_MAIN_USER);
-            $sql = "SELECT * FROM $table_user WHERE user_id='".Database::escape_string($user_id)."'";
+            $sql = "SELECT * FROM $table_user WHERE user_id = ".intval($user_id)."";
             $result = Database::query($sql);
             $row = Database::fetch_array($result);
             return '<a href="../user/userInfo.php?uInfo='.$row['user_id'].'">'.api_get_person_name($row['firstname'], $row['lastname']).'</a>';
@@ -1264,7 +1264,7 @@ function get_last_tool_access($tool, $course_code = '', $user_id='')
 
     $sql = "SELECT access_date FROM $table_last_access
             WHERE
-                access_user_id='".Database::escape_string($user_id)."' AND
+                access_user_id = ".intval($user_id)." AND
                 access_cours_code='".Database::escape_string($course_code)."' AND
                 access_tool='".Database::escape_string($tool)."'
                 ORDER BY access_date DESC

+ 3 - 3
main/exercice/addlimits.php

@@ -169,9 +169,9 @@ Time :
  * @todo shouldn't this be moved to the part above (around line 111: action handling)
  */
 if (isset($_POST['ok'])) {
-	$exercise_id = Database::escape_string($_POST['exe_id']);
+	$exercise_id = intval($_POST['exe_id']);
 	if ($_POST['limit']==1) {
-		$minutes = Database::escape_string($_POST['minutes']);
+		$minutes = intval($_POST['minutes']);
 		$query = "UPDATE ".$TBL_EXERCICES." SET ques_time_limit= $minutes WHERE id= $exercise_id";
 		Database::query($query);
 	} else {
@@ -180,7 +180,7 @@ if (isset($_POST['ok'])) {
 	}
 
 	if ($_POST['attempt']==1) {
-		$attempts = Database::escape_string($_POST['attempts']);
+		$attempts = intval($_POST['attempts']);
 		$query = "UPDATE ".$TBL_EXERCICES." SET num_attempts = $attempts WHERE id= $exercise_id";
 		Database::query($query);
 	} else {

+ 1 - 1
main/exercice/answer.class.php

@@ -495,7 +495,7 @@ class Answer
 				hotspot_coordinates = '".Database::escape_string($hotspot_coordinates)."',
         hotspot_type = '".Database::escape_string($hotspot_type)."'
 				WHERE c_id = {$this->course_id} AND id = '$id'
-				AND question_id = '".Database::escape_string($questionId)."'";
+				AND question_id = ".intval($questionId)."";
         Database::query($sql);
 	}
 

+ 1 - 1
main/exercice/answer_admin.inc.php

@@ -1013,7 +1013,7 @@ if ($modifyAnswers) {
             ?>
             <h3>
             <?php echo $questionName; ?></h3><?php
-            $sql = "select description from " . $TBL_QUESTIONS . " WHERE id = '" . Database::escape_string($questionId) . "'";
+            $sql = "select description from " . $TBL_QUESTIONS . " WHERE id = " . intval($questionId) . "";
             $res = Database::query($sql, _FILE_, _LINE_);
             ?>
             &nbsp; &nbsp; &nbsp;

+ 16 - 6
main/exercice/evalmathnotation.php

@@ -18,21 +18,31 @@ get_lang('PiNumberPi')."\n".
 get_lang('SineSin')."\n".
 get_lang('HyperbolicSineSinh')."\n".
 get_lang('ArcsineArcsin')."\n".
-get_lang('InverseSineAsin')."\n".
 get_lang('HyperbolicArcsineArcsinh')."\n".
-get_lang('InverseHyperbolicSineAsinh')."\n".
 "\n".
 get_lang('CosineCos')."\n".
 get_lang('HyperbolicCosineCosh')."\n".
 get_lang('ArccosineArccos')."\n".
-get_lang('InverseCosineAcos')."\n".
 get_lang('HyperbolicArccosineArccosh')."\n".
-get_lang('InverseHyperbolicCosineAcosh')."\n".
 "\n".
 get_lang('TangentTan')."\n".
 get_lang('HyperbolicTangentTanh')."\n".
 get_lang('ArctangentArctan')."\n".
-get_lang('InverseTangentAtan')."\n".
 get_lang('HyperbolicArctangentArctanh')."\n".
-get_lang('InverseHyperbolicTangentAtanh').
+"\n".
+get_lang('CotangentCot')."\n".
+get_lang('HyperbolicCotangentCoth')."\n".
+get_lang('ArccotangentArccot')."\n".
+get_lang('HyperbolicArccotangentArccoth')."\n".
+"\n".
+get_lang('SecantSec')."\n".
+get_lang('HyperbolicSecantSech')."\n".
+get_lang('ArcsecantArcsec')."\n".
+get_lang('HyperbolicArcsecantArcsech')."\n".
+"\n".
+get_lang('CosecantCsc')."\n".
+get_lang('HyperbolicCosecantCsch')."\n".
+get_lang('ArccosecantArccsc')."\n".
+get_lang('HyperbolicArccosecantArccsch')."\n".
+"\n".
 "</pre>";

+ 35 - 35
main/exercice/exercise.class.php

@@ -446,7 +446,7 @@ class Exercise
             $sql = "SELECT DISTINCT e.question_order
                     FROM $TBL_EXERCICE_QUESTION e INNER JOIN $TBL_QUESTIONS  q
                         ON (e.question_id = q.id AND e.c_id = ".$this->course_id." AND q.c_id = ".$this->course_id.")
-					WHERE e.exercice_id	= '".Database::escape_string($this->id)."'";
+					WHERE e.exercice_id	= ".intval($this->id)."";
             $result = Database::query($sql);
 
             $count_question_orders = Database::num_rows($result);
@@ -454,7 +454,7 @@ class Exercise
             $sql = "SELECT e.question_id, e.question_order
                     FROM $TBL_EXERCICE_QUESTION e INNER JOIN $TBL_QUESTIONS  q
                         ON (e.question_id= q.id AND e.c_id = ".$this->course_id." AND q.c_id = ".$this->course_id.")
-					WHERE e.exercice_id	= '".Database::escape_string($this->id)."'
+					WHERE e.exercice_id	= ".intval($this->id)."
 					ORDER BY question_order";
             $result = Database::query($sql);
 
@@ -816,28 +816,28 @@ class Exercise
 
             if ($type_e != 'simple') {
                 $sql .= ",sound='".Database::escape_string($sound)."',
-					type           ='".Database::escape_string($type)."',
-					random         ='".Database::escape_string($random)."',
-					random_answers ='".Database::escape_string($random_answers)."',
-					active         ='".Database::escape_string($active)."',
-					feedback_type  ='".Database::escape_string($feedback_type)."',
+					type           = ".intval($type).",
+					random         = ".intval($random).",
+					random_answers = ".intval($random_answers).",
+					active         = ".intval($active).",
+					feedback_type  = ".intval($feedback_type).",
 					start_time     = '$start_time',
 					end_time       = '$end_time',
-					max_attempt    ='".Database::escape_string($attempts)."',
-     			    expired_time   ='".Database::escape_string($expired_time)."',
-         			propagate_neg  ='".Database::escape_string($propagate_neg)."',
-         			review_answers  ='".Database::escape_string($review_answers)."',
-        	        random_by_category='".Database::escape_string($randomByCat)."',
+					max_attempt    = ".intval($attempts).",
+     			    expired_time   = ".intval($expired_time).",
+         			propagate_neg  = ".intval($propagate_neg).",
+         			review_answers = ".intval($review_answers).",
+        	        random_by_category= ".intval($randomByCat).",
         	        text_when_finished = '".Database::escape_string($text_when_finished)."',
-        	        display_category_name = '".Database::escape_string($display_category_name)."',
-                    pass_percentage = '".Database::escape_string($pass_percentage)."',
-					results_disabled='".Database::escape_string($results_disabled)."'";
+        	        display_category_name = ".intval($display_category_name).",
+                    pass_percentage = ".intval($pass_percentage).",
+					results_disabled= ".intval($results_disabled)."";
             }
-            $sql .= " WHERE c_id = ".$this->course_id." AND id='".Database::escape_string($id)."'";
+            $sql .= " WHERE c_id = ".$this->course_id." AND id = ".intval($id)."";
             Database::query($sql);
 
             // update into the item_property table
-            api_item_property_update($_course, TOOL_QUIZ, $id,'QuizUpdated',api_get_user_id());
+            api_item_property_update($_course, TOOL_QUIZ, $id, 'QuizUpdated', api_get_user_id());
 
             if (api_get_setting('search_enabled')=='true') {
                 $this->search_engine_edit();
@@ -871,20 +871,20 @@ class Exercise
 						'".Database::escape_string($exercise)."',
 						'".Database::escape_string($description)."',
 						'".Database::escape_string($sound)."',
-						'".Database::escape_string($type)."',
-						'".Database::escape_string($random)."',
-						'".Database::escape_string($random_answers)."',
-						'".Database::escape_string($active)."',
-						'".Database::escape_string($results_disabled)."',
-						'".Database::escape_string($attempts)."',
-						'".Database::escape_string($feedback_type)."',
-						'".Database::escape_string($expired_time)."',
-						'".Database::escape_string($session_id)."',
-						'".Database::escape_string($review_answers)."',
-						'".Database::escape_string($randomByCat)."',
+						".intval($type).",
+						".intval($random).",
+						".intval($random_answers).",
+						".intval($active).",
+						".intval($results_disabled).",
+						".intval($attempts).",
+						".intval($feedback_type).",
+						".intval($expired_time).",
+						".intval($session_id).",
+						".intval($review_answers).",
+						".intval($randomByCat).",
 						'".Database::escape_string($text_when_finished)."',
-						'".Database::escape_string($display_category_name)."',
-                        '".Database::escape_string($pass_percentage)."'
+						".intval($display_category_name).",
+                        ".intval($pass_percentage)."
 						)";
             Database::query($sql);
             $this->id = Database::insert_id();
@@ -986,7 +986,7 @@ class Exercise
     {
         $TBL_EXERCICES = Database::get_course_table(TABLE_QUIZ_TEST);
         $sql = "UPDATE $TBL_EXERCICES SET active='-1'
-                WHERE c_id = ".$this->course_id." AND id='".Database::escape_string($this->id)."'";
+                WHERE c_id = ".$this->course_id." AND id = ".intval($this->id)."";
         Database::query($sql);
         api_item_property_update($this->course, TOOL_QUIZ, $this->id, 'QuizDeleted', api_get_user_id());
         api_item_property_update($this->course, TOOL_QUIZ, $this->id, 'delete', api_get_user_id());
@@ -1914,7 +1914,7 @@ class Exercise
                     buttons: {
                         '".addslashes(get_lang("EndTest"))."': function() {
                             $('#clock_warning').dialog('close');
-                        },
+                        }
                     },
                     close: function() {
                         send_form();
@@ -2515,7 +2515,7 @@ class Exercise
                             $queryfill = "SELECT answer FROM ".$TBL_TRACK_ATTEMPT."
                                           WHERE
                                             exe_id = '".$exeId."' AND
-                                            question_id= '".Database::escape_string($questionId)."'";
+                                            question_id= ".intval($questionId)."";
                             $resfill = Database::query($queryfill);
                             $str = Database::result($resfill, 0, 'answer');
 
@@ -2641,7 +2641,7 @@ class Exercise
                             $queryfill = "SELECT answer FROM ".$TBL_TRACK_ATTEMPT."
                                           WHERE
                                             exe_id = '".$exeId."' AND
-                                            question_id= '".Database::escape_string($questionId)."'";
+                                            question_id= ".intval($questionId)."";
                             $resfill = Database::query($queryfill);
                             $str = Database::result($resfill, 0, 'answer');
                             api_preg_match_all('#\[([^[]*)\]#', $str, $arr);
@@ -2832,7 +2832,7 @@ class Exercise
                                 WHERE
                                     hotspot_exe_id = '".$exeId."' AND
                                     hotspot_question_id= '".$questionId."' AND
-                                    hotspot_answer_id = '".Database::escape_string($answerId)."'";
+                                    hotspot_answer_id = ".intval($answerId)."";
                         $result = Database::query($sql);
                         $studentChoice = Database::result($result, 0, "hotspot_correct");
 

+ 33 - 5
main/exercice/exercise_show.php

@@ -72,6 +72,7 @@ if (api_is_course_session_coach(
     }
 }
 
+$maxEditors = isset($_configuration['exercise_max_fckeditors_in_page']) ? $_configuration['exercise_max_fckeditors_in_page'] : 0;
 $is_allowedToEdit = api_is_allowed_to_edit(null, true) || $is_courseTutor || api_is_session_admin() || api_is_drh();
 
 //Getting results from the exe_id. This variable also contain all the information about the exercise
@@ -132,6 +133,8 @@ if ($origin != 'learnpath') {
 }
 ?>
 <script>
+var maxEditors = '<?php echo intval($maxEditors); ?>';
+
 function showfck(sid,marksid) {
 	document.getElementById(sid).style.display='block';
 	document.getElementById(marksid).style.display='block';
@@ -157,8 +160,12 @@ function getFCK(vals,marksid) {
 		var oHidden = document.createElement("input");
 		oHidden.type = "hidden";
 		oHidden.name = "comments_"+ids[k];
-		oEditor = FCKeditorAPI.GetInstance(oHidden.name) ;
-		oHidden.value = oEditor.GetXHTML(true);
+        if (maxEditors == 0) {
+            oEditor = FCKeditorAPI.GetInstance(oHidden.name) ;
+            oHidden.value = oEditor.GetXHTML(true);
+        } else {
+            oHidden.value = $("textarea[name='" + oHidden.name + "']").val();
+        }
 		f.appendChild(oHidden);
 	}
 }
@@ -240,7 +247,7 @@ $sql = "SELECT attempts.question_id, answer
         ON
             questions.id=quizz_rel_questions.question_id AND
             questions.c_id = ".api_get_course_int_id()."
-        WHERE attempts.exe_id='".Database::escape_string($id)."' $user_restriction
+        WHERE attempts.exe_id = ".intval($id)." $user_restriction
 		GROUP BY quizz_rel_questions.question_order, attempts.question_id";
 
 $result = Database::query($sql);
@@ -287,6 +294,11 @@ $counter = 1;
 $exercise_content = null;
 $category_list = array();
 
+$useAdvancedEditor = true;
+if (count($questionList) > $maxEditors) {
+    $useAdvancedEditor = false;
+}
+
 foreach ($questionList as $questionId) {
 
 	$choice = $exerciseResult[$questionId];
@@ -479,7 +491,7 @@ foreach ($questionList as $questionId) {
             }
 
             //showing the score
-            $queryfree = "select marks from ".$TBL_TRACK_ATTEMPT." WHERE exe_id = '".Database::escape_string($id)."' and question_id= '".Database::escape_string($questionId)."'";
+            $queryfree = "select marks from ".$TBL_TRACK_ATTEMPT." WHERE exe_id = ".intval($id)." and question_id= ".intval($questionId)."";
             $resfree = Database::query($queryfree);
             $questionScore= Database::result($resfree,0,"marks");
             $totalScore+=$questionScore;
@@ -538,7 +550,23 @@ foreach ($questionList as $questionId) {
 			$renderer->setElementTemplate('<div align="left">{element}</div>');
 			$comnt = get_comments($id, $questionId);
 			$default = array('comments_'.$questionId =>  $comnt);
-			$feedback_form->addElement('html_editor', 'comments_'.$questionId, null, null, array('ToolbarSet' => 'TestAnswerFeedback', 'Width' => '100%', 'Height' => '120'));
+
+            if ($useAdvancedEditor) {
+                $feedback_form->addElement(
+                    'html_editor',
+                    'comments_' . $questionId,
+                    null,
+                    null,
+                    array(
+                        'ToolbarSet' => 'TestAnswerFeedback',
+                        'Width' => '100%',
+                        'Height' => '120'
+                    )
+                );
+            } else {
+                $feedback_form->addElement('textarea', 'comments_' . $questionId);
+            }
+
 			$feedback_form->addElement('html','<br>');
 			$feedback_form->setDefaults($default);
 			$feedback_form->display();

+ 2 - 2
main/exercice/hotspot_actionscript.as.php

@@ -37,10 +37,10 @@ $course_id = api_get_course_int_id();
 // Query db for answers
 if ($answer_type==HOT_SPOT_DELINEATION) {
 	$sql = "SELECT id, answer, hotspot_coordinates, hotspot_type, ponderation FROM $TBL_ANSWERS 
-	        WHERE c_id = $course_id AND question_id = '".Database::escape_string($questionId)."' AND hotspot_type = 'delineation' ORDER BY id";		
+	        WHERE c_id = $course_id AND question_id = ".intval($questionId)." AND hotspot_type = 'delineation' ORDER BY id";
 } else {
 	$sql = "SELECT id, answer, hotspot_coordinates, hotspot_type, ponderation FROM $TBL_ANSWERS 
-	        WHERE c_id = $course_id AND question_id = '".Database::escape_string($questionId)."' ORDER BY id";
+	        WHERE c_id = $course_id AND question_id = ".intval($questionId)." ORDER BY id";
 }
 $result = Database::query($sql);
 // Init

+ 2 - 2
main/exercice/hotspot_answers.as.php

@@ -39,10 +39,10 @@ $course_id     = api_get_course_int_id();
 if ($answer_type == HOT_SPOT_DELINEATION) {
 	// Query db for answers
 	$sql = "SELECT id, answer, hotspot_coordinates, hotspot_type FROM $TBL_ANSWERS 
-	        WHERE c_id = $course_id AND question_id = '".Database::escape_string($questionId)."' AND hotspot_type <> 'noerror' ORDER BY id";
+	        WHERE c_id = $course_id AND question_id = ".intval($questionId)." AND hotspot_type <> 'noerror' ORDER BY id";
 } else {
 	$sql = "SELECT id, answer, hotspot_coordinates, hotspot_type FROM $TBL_ANSWERS 
-	        WHERE c_id = $course_id AND question_id = '".Database::escape_string($questionId)."' ORDER BY id";
+	        WHERE c_id = $course_id AND question_id = ".intval($questionId)." ORDER BY id";
 }
 $result = Database::query($sql);
 // Init

+ 1 - 1
main/exercice/hotspot_save.inc.php

@@ -40,6 +40,6 @@ if ($_GET['type'] == "poly" || $_GET['type'] == "delineation" || $_GET['type'] =
 }
 $course_id = api_get_course_int_id();
 $sql = "UPDATE $TBL_ANSWER SET hotspot_coordinates = '".Database::escape_string($hotspot_coordinates)."',hotspot_type = '".Database::escape_string($hotspot_type)."' 
-        WHERE c_id = $course_id AND id = '".Database::escape_string($answerId)."' AND question_id ='".Database::escape_string($questionId)."' LIMIT 1 ;";
+        WHERE c_id = $course_id AND id = ".intval($answerId)." AND question_id = ".intval($questionId)." LIMIT 1 ;";
 $result = Database::query($sql);
 echo "done=done";

+ 5 - 5
main/exercice/hotspot_savescore.inc.php

@@ -45,12 +45,12 @@ $coordinates = substr($coordinates,0,-1);
 $TBL_TRACK_E_HOTSPOT = Database::get_statistic_table(STATISTIC_TRACK_E_HOTSPOTS);
 // Save into db
 $sql = "INSERT INTO $TBL_TRACK_E_HOTSPOT (user_id , course_id , quiz_id , question_id , answer_id , correct , coordinate ) VALUES (
-			'".Database::escape_string($_user['user_id'])."',
+			".intval($_user['user_id']).",
 			'".Database::escape_string($courseCode)."',
-			'".Database::escape_string($exerciseId)."',
-			'".Database::escape_string($questionId)."',
-			'".Database::escape_string($answerId)."',
-			'".Database::escape_string($hit)."',
+			".intval($exerciseId).",
+			".intval($questionId).",
+			".intval($answerId).",
+			".intval($hit)."',
 			'".Database::escape_string($coordinates)."')";
 $result = Database::query($sql);
 // Save insert id into session if users changes answer.

+ 1 - 1
main/exercice/hotspot_updatescore.inc.php

@@ -53,5 +53,5 @@ $TBL_TRACK_E_HOTSPOT   = Database::get_statistic_table(STATISTIC_TRACK_E_HOTSPOT
 
 // update db
 $update_id = $_SESSION['exerciseResult'][$questionId]['ids'][$answerId];
-$sql = "UPDATE $TBL_TRACK_E_HOTSPOT SET coordinate = '".Database::escape_string($coordinates)."' WHERE id ='".Database::escape_string($update_id)."' LIMIT 1 ;;";
+$sql = "UPDATE $TBL_TRACK_E_HOTSPOT SET coordinate = '".Database::escape_string($coordinates)."' WHERE id = ".intval($update_id)." LIMIT 1 ;;";
 $result = Database::query($sql);

+ 4 - 4
main/exercice/mark_free_answer.php

@@ -91,7 +91,7 @@ if ($action == 'mark') {
 		$exercise_table = Database::get_statistic_table('track_e_exercices');
 		#global $origin, $tbl_learnpath_user, $learnpath_id, $learnpath_item_id;
 		$sql = "SELECT * FROM $exercise_table
-			    WHERE exe_user_id = '".Database::escape_string($my_usr)."' AND exe_cours_id = '".Database::escape_string($my_cid)."' AND exe_exo_id = '".Database::escape_string($my_exe)."'
+			    WHERE exe_user_id = ".intval($my_usr)." AND exe_cours_id = '".Database::escape_string($my_cid)."' AND exe_exo_id = ".intval($my_exe)."
 			    ORDER BY exe_date DESC";
 		#echo $sql;
 		$res = Database::query($sql);
@@ -116,9 +116,9 @@ if ($action == 'mark') {
 					   exe_weighting,
 					   exe_date
 					  ) VALUES (
-					   '".Database::escape_string($my_usr)."',
+					   ".intval($my_usr).",
 					   '".Database::escape_string($my_cid)."',
-					   '".Database::escape_string($my_exe)."',
+					   ".intval($my_exe).",
 					   '".Database::escape_string($my_score)."',
 					   '".Database::escape_string($obj_question->selectWeighting())."',
 					   FROM_UNIXTIME(".$reallyNow.")
@@ -148,7 +148,7 @@ Display::display_header($nameTools,"Exercise");
 
 // 1a - result of previous marking then exit suggestion
 // 1b - user answer and marking box + submit button
-$objAnswerTmp = new Answer();
+$objAnswerTmp = new Answer($my_qst);
 $objAnswerTmp->selectAnswer($answerId);
 
 if($action == 'mark'){

+ 19 - 19
main/exercice/question.class.php

@@ -366,7 +366,7 @@ abstract class Question
             // update or add category for a question
             foreach ($category_list as $category_id) {
                 $category_id = intval($category_id);
-                $question_id = Database::escape_string($this->id);
+                $question_id = intval($this->id);
                 $sql = "SELECT count(*) AS nb FROM $TBL_QUESTION_REL_CATEGORY
                         WHERE category_id = $category_id AND question_id = $question_id AND c_id=".api_get_course_int_id();
                 $res = Database::query($sql);
@@ -397,8 +397,8 @@ abstract class Question
             // update or add category for a question
 
 			$TBL_QUESTION_REL_CATEGORY = Database::get_course_table(TABLE_QUIZ_QUESTION_REL_CATEGORY);
-			$category_id = Database::escape_string($in_category);
-			$question_id = Database::escape_string($this->id);
+			$category_id = intval($in_category);
+			$question_id = intval($this->id);
 			$sql = "SELECT count(*) AS nb FROM $TBL_QUESTION_REL_CATEGORY
 			        WHERE question_id=$question_id AND c_id=".api_get_course_int_id();
 			$res = Database::query($sql);
@@ -422,7 +422,7 @@ abstract class Question
 	function deleteCategory()
     {
 		$TBL_QUESTION_REL_CATEGORY = Database::get_course_table(TABLE_QUIZ_QUESTION_REL_CATEGORY);
-		$question_id = Database::escape_string($this->id);
+		$question_id = intval($this->id);
 	 	$sql = "DELETE FROM $TBL_QUESTION_REL_CATEGORY
 	 	        WHERE question_id=$question_id AND c_id=".api_get_course_int_id();
 	 	Database::query($sql);
@@ -470,7 +470,7 @@ abstract class Question
 			// if we don't change from "unique answer" to "multiple answers" (or conversely)
 			if(!in_array($this->type,array(UNIQUE_ANSWER,MULTIPLE_ANSWER)) || !in_array($type,array(UNIQUE_ANSWER,MULTIPLE_ANSWER))) {
 				// removes old answers
-				$sql="DELETE FROM $TBL_REPONSES WHERE c_id = $course_id  AND question_id='".Database::escape_string($this->id)."'";
+				$sql="DELETE FROM $TBL_REPONSES WHERE c_id = $course_id  AND question_id = ".intval($this->id)."";
 				Database::query($sql);
 			}
 
@@ -735,7 +735,7 @@ abstract class Question
 					picture		='".Database::escape_string($picture)."',
                     extra       ='".Database::escape_string($extra)."',
 					level		='".Database::escape_string($level)."'
-				WHERE c_id = $c_id  AND id='".Database::escape_string($id)."'";
+				WHERE c_id = $c_id  AND id = ".intval($id)."";
 			Database::query($sql);
 			$this->saveCategory($category);
 			if (!empty($exerciseId)) {
@@ -755,7 +755,7 @@ abstract class Question
 			// creates a new question
 			$sql	= "SELECT max(position) FROM $TBL_QUESTIONS as question, $TBL_EXERCICE_QUESTION as test_question
 					   WHERE 	question.id					= test_question.question_id AND
-								test_question.exercice_id	= '".Database::escape_string($exerciseId)."' AND
+								test_question.exercice_id	= ".intval($exerciseId)." AND
 								question.c_id 				= $c_id AND
 								test_question.c_id 			= $c_id ";
 			$result	= Database::query($sql);
@@ -783,14 +783,14 @@ abstract class Question
 			if ($type == HOT_SPOT || $type == HOT_SPOT_ORDER) {
 				$TBL_ANSWERS = Database::get_course_table(TABLE_QUIZ_ANSWER);
 				$sql = "INSERT INTO $TBL_ANSWERS (c_id, id, question_id , answer , correct , comment , ponderation , position , hotspot_coordinates , hotspot_type )
-					    VALUES (".$c_id.", '1', '".Database::escape_string($this->id)."', '', NULL , '', '10' , '1', '0;0|0|0', 'square')";
+					    VALUES (".$c_id.", '1', ".intval($this->id).", '', NULL , '', '10' , '1', '0;0|0|0', 'square')";
 				Database::query($sql);
             }
 
 			if ($type == HOT_SPOT_DELINEATION ) {
 				$TBL_ANSWERS = Database::get_course_table(TABLE_QUIZ_ANSWER);
 				$sql="INSERT INTO $TBL_ANSWERS (c_id, id, question_id , answer , correct , comment , ponderation , position , hotspot_coordinates , hotspot_type )
-					  VALUES (".$c_id.", '1', '".Database::escape_string($this->id)."', '', NULL , '', '10' , '1', '0;0|0|0', 'delineation')";
+					  VALUES (".$c_id.", '1', ".intval($this->id).", '', NULL , '', '10' , '1', '0;0|0|0', 'delineation')";
 				Database::query($sql);
 			}
 
@@ -944,7 +944,7 @@ abstract class Question
             $count = $new_exercise->selectNbrQuestions();
             $count++;
 		    $sql="INSERT INTO $TBL_EXERCICE_QUESTION (c_id, question_id, exercice_id, question_order) VALUES
-			     ({$this->course['real_id']}, '".Database::escape_string($id)."','".Database::escape_string($exerciseId)."', '$count' )";
+			     ({$this->course['real_id']}, ".intval($id).", ".intval($exerciseId).", '$count' )";
 		    Database::query($sql);
 
             // we do not want to reindex if we had just saved adnd indexed the question
@@ -979,18 +979,18 @@ abstract class Question
 			// deletes the position in the array containing the wanted exercise ID
 			unset($this->exerciseList[$pos]);
             //update order of other elements
-            $sql = "SELECT question_order FROM $TBL_EXERCICE_QUESTION WHERE c_id = $course_id AND question_id='".Database::escape_string($id)."' AND exercice_id='".Database::escape_string($exerciseId)."'";
+            $sql = "SELECT question_order FROM $TBL_EXERCICE_QUESTION WHERE c_id = $course_id AND question_id = ".intval($id)." AND exercice_id = ".intval($exerciseId)."";
             $res = Database::query($sql);
             if (Database::num_rows($res)>0) {
                 $row = Database::fetch_array($res);
                 if (!empty($row['question_order'])) {
                     $sql = "UPDATE $TBL_EXERCICE_QUESTION SET question_order = question_order-1
-                            WHERE c_id = $course_id AND exercice_id='".Database::escape_string($exerciseId)."' AND question_order > ".$row['question_order'];
+                            WHERE c_id = $course_id AND exercice_id = ".intval($exerciseId)." AND question_order > ".$row['question_order'];
                     $res = Database::query($sql);
                 }
             }
 
-			$sql="DELETE FROM $TBL_EXERCICE_QUESTION WHERE c_id = $course_id AND question_id='".Database::escape_string($id)."' AND exercice_id='".Database::escape_string($exerciseId)."'";
+			$sql="DELETE FROM $TBL_EXERCICE_QUESTION WHERE c_id = $course_id AND question_id = ".intval($id)." AND exercice_id = ".intval($exerciseId)."";
 			Database::query($sql);
 
 			return true;
@@ -1019,7 +1019,7 @@ abstract class Question
 		// if the question must be removed from all exercises
 		if (!$deleteFromEx) {
             //update the question_order of each question to avoid inconsistencies
-            $sql = "SELECT exercice_id, question_order FROM $TBL_EXERCICE_QUESTION WHERE c_id = $course_id AND question_id='".Database::escape_string($id)."'";
+            $sql = "SELECT exercice_id, question_order FROM $TBL_EXERCICE_QUESTION WHERE c_id = $course_id AND question_id = ".intval($id)."";
 
             $res = Database::query($sql);
             if (Database::num_rows($res) > 0) {
@@ -1027,23 +1027,23 @@ abstract class Question
                     if (!empty($row['question_order'])) {
                         $sql = "UPDATE $TBL_EXERCICE_QUESTION
                                 SET question_order = question_order-1
-                                WHERE c_id = $course_id AND exercice_id='".Database::escape_string($row['exercice_id'])."' AND question_order > ".$row['question_order'];
+                                WHERE c_id = $course_id AND exercice_id = ".intval($row['exercice_id'])." AND question_order > ".$row['question_order'];
                         Database::query($sql);
                     }
                 }
             }
 
-			$sql = "DELETE FROM $TBL_EXERCICE_QUESTION WHERE c_id = $course_id AND question_id='".Database::escape_string($id)."'";
+			$sql = "DELETE FROM $TBL_EXERCICE_QUESTION WHERE c_id = $course_id AND question_id = ".intval($id)."";
 			Database::query($sql);
 
-			$sql = "DELETE FROM $TBL_QUESTIONS WHERE c_id = $course_id AND id='".Database::escape_string($id)."'";
+			$sql = "DELETE FROM $TBL_QUESTIONS WHERE c_id = $course_id AND id = ".intval($id)."";
 			Database::query($sql);
 
-			$sql = "DELETE FROM $TBL_REPONSES WHERE c_id = $course_id AND question_id='".Database::escape_string($id)."'";
+			$sql = "DELETE FROM $TBL_REPONSES WHERE c_id = $course_id AND question_id = ".intval($id)."";
 			Database::query($sql);
 
 			// remove the category of this question in the question_rel_category table
-			$sql = "DELETE FROM $TBL_QUIZ_QUESTION_REL_CATEGORY WHERE c_id = $course_id AND question_id='".Database::escape_string($id)."' AND c_id=".api_get_course_int_id();
+			$sql = "DELETE FROM $TBL_QUIZ_QUESTION_REL_CATEGORY WHERE c_id = $course_id AND question_id = ".intval($id)." AND c_id=".api_get_course_int_id();
 			Database::query($sql);
 
 			api_item_property_update($this->course, TOOL_QUIZ, $id,'QuizQuestionDeleted',api_get_user_id());

+ 26 - 29
main/exercice/question_admin.inc.php

@@ -1,15 +1,13 @@
 <?php
 /* For licensing terms, see /license.txt */
+
 /**
-*	Statement (?) administration
-*	This script allows to manage the statements of questions.
-* 	It is included from the script admin.php
-*	@package chamilo.exercise
-* 	@author Olivier Brouckaert
-* 	@version $Id: question_admin.inc.php 22126 2009-07-15 22:38:39Z juliomontoya $
-*/
-/**
- * Code
+ *	Statement (?) administration
+ *	This script allows to manage the statements of questions.
+ * 	It is included from the script admin.php
+ *	@package chamilo.exercise
+ * 	@author Olivier Brouckaert
+ * 	@version $Id: question_admin.inc.php 22126 2009-07-15 22:38:39Z juliomontoya $
  */
 
 // INIT QUESTION
@@ -44,7 +42,6 @@ if (is_object($objQuestion)) {
 	$objQuestion->createForm($form);
 
 	// answer form elements
-
 	$objQuestion->createAnswersForm($form);
 
 	// this variable  $show_quiz_edition comes from admin.php blocks the exercise/quiz modifications
@@ -56,29 +53,29 @@ if (is_object($objQuestion)) {
 	if (isset($_POST['submitQuestion']) && $form->validate()) {
 
 		// question
-	    $objQuestion->processCreation($form, $objExercise);
+		$objQuestion->processCreation($form, $objExercise);
 
-	    // answers
-	    $nb_answers = isset($nb_answers) ? $nb_answers : 0;
-	    $objQuestion->processAnswersCreation($form, $nb_answers);
+		// answers
+		$nb_answers = isset($nb_answers) ? $nb_answers : 0;
+		$objQuestion->processAnswersCreation($form, $nb_answers);
 
-        // TODO: maybe here is the better place to index this tool, including answers text
+		// TODO: maybe here is the better place to index this tool, including answers text
 
-	    // redirect
-	    if ($objQuestion->type != HOT_SPOT && $objQuestion->type != HOT_SPOT_DELINEATION) {
-	    	if(isset($_GET['editQuestion'])) {
-	    		echo '<script type="text/javascript">window.location.href="admin.php?exerciseId='.$exerciseId.'&message=ItemUpdated"</script>';
-	    	} else {
-	    		//New question
-	    		echo '<script type="text/javascript">window.location.href="admin.php?exerciseId='.$exerciseId.'&message=ItemAdded"</script>';
-	    	}
-	    } else {
-	    	echo '<script type="text/javascript">window.location.href="admin.php?exerciseId='.$exerciseId.'&hotspotadmin='.$objQuestion->id.'"</script>';
-	    }
+		// redirect
+		if ($objQuestion->type != HOT_SPOT && $objQuestion->type != HOT_SPOT_DELINEATION) {
+			if(isset($_GET['editQuestion'])) {
+				echo '<script type="text/javascript">window.location.href="admin.php?exerciseId='.$exerciseId.'&message=ItemUpdated"</script>';
+			} else {
+				//New question
+				echo '<script type="text/javascript">window.location.href="admin.php?exerciseId='.$exerciseId.'&message=ItemAdded"</script>';
+			}
+		} else {
+			echo '<script type="text/javascript">window.location.href="admin.php?exerciseId='.$exerciseId.'&hotspotadmin='.$objQuestion->id.'"</script>';
+		}
 	} else {
-        if (isset($questionName)) {
-		    echo '<h3>'.$questionName.'</h3>';
-        }
+		if (isset($questionName)) {
+			echo '<h3>'.$questionName.'</h3>';
+		}
 		if (!empty($pictureName)) {
 			echo '<img src="../document/download.php?doc_url=%2Fimages%2F'.$pictureName.'" border="0">';
 		}

+ 13 - 14
main/exercice/question_create.php

@@ -1,12 +1,11 @@
 <?php
 /* For licensing terms, see /license.txt */
+
 /**
  * Exercise
  * @package chamilo.exercise
  */
-/**
- * Code
- */
+
 // name of the language file that needs to be included
 $language_file='exercice';
 
@@ -36,7 +35,7 @@ $form->addElement('header','',get_lang('AddQuestionToExercise'));
 
 $question_list = Question::get_question_type_list();
 $question_list_options = array();
-foreach ($question_list as $key=> $value) {    
+foreach ($question_list as $key=> $value) {
     $question_list_options[$key] = addslashes(get_lang($value[1]));
 }
 $form->addElement('select', 'question_type_hidden', get_lang('QuestionType'), $question_list_options, array('id' => 'question_type_hidden'));
@@ -72,26 +71,26 @@ $form->addRule('question_type_hidden', get_lang('InvalidQuestionType'), 'validqu
 if ($form->validate()) {
 	$values = $form->exportValues();
     $answer_type = $values['question_type_hidden'];
-    
+
 	// check feedback_type from current exercise for type of question delineation
-	$exercise_id = intval($values['exercice']);	
+	$exercise_id = intval($values['exercice']);
 	$sql = "SELECT feedback_type FROM $tbl_exercices WHERE c_id = $course_id AND id = '$exercise_id'";
 	$rs_feedback_type = Database::query($sql);
 	$row_feedback_type = Database::fetch_row($rs_feedback_type);
 	$feedback_type = $row_feedback_type[0];
-	
+
 	// if question type does not belong to self-evaluation (immediate feedback) it'll send an error
-	if (($answer_type == HOT_SPOT_DELINEATION && $feedback_type != 1) || 
+	if (($answer_type == HOT_SPOT_DELINEATION && $feedback_type != 1) ||
 		($feedback_type == 1 && ($answer_type != HOT_SPOT_DELINEATION && $answer_type != UNIQUE_ANSWER))) {
 		header('Location: question_create.php?'.api_get_cidreq().'&error=true');
-		exit;		
-	}	
+		exit;
+	}
 	header('Location: admin.php?exerciseId='.$values['exercice'].'&newQuestion=yes&isContent='.$values['is_content'].'&answerType='.$answer_type);
 	exit;
 } else {
 	// header
 	Display::display_header($nameTools);
-	
+
 	echo '<div class="actions">';
 	echo '<a href="exercice.php?show=test">'.Display :: return_icon('back.png', get_lang('BackToExercisesList'),'',ICON_SIZE_MEDIUM).'</a>';
 	echo '</div>';
@@ -104,13 +103,13 @@ if ($form->validate()) {
 }
 
 function check_question_type($parameter) {
-    $question_list = Question::get_question_type_list();    
+    $question_list = Question::get_question_type_list();
 	foreach ($question_list as $key => $value) {
 		$valid_question_types[] = $key;
-	}    
+	}
 	if (in_array($parameter, $valid_question_types)) {
 		return true;
 	} else {
 		return false;
 	}
-}
+}

+ 175 - 172
main/exercice/question_list_admin.inc.php

@@ -1,128 +1,127 @@
 <?php
 /* For licensing terms, see /license.txt */
+
 /**
-*	Code library for HotPotatoes integration.
-*	@package chamilo.exercise
-*	@author Olivier Brouckaert & Julio Montoya & Hubert Borderiou 21-10-2011 (Question by category)
+ *	Code library for HotPotatoes integration.
+ *	@package chamilo.exercise
+ *	@author Olivier Brouckaert & Julio Montoya & Hubert Borderiou 21-10-2011 (Question by category)
 
-*	QUESTION LIST ADMINISTRATION
-*
-*	This script allows to manage the question list
-*	It is included from the script admin.php
-*/
+ *	QUESTION LIST ADMINISTRATION
+ *
+ *	This script allows to manage the question list
+ *	It is included from the script admin.php
+ */
 
 // deletes a question from the exercise (not from the data base)
 if ($deleteQuestion) {
-	// if the question exists
-	if ($objQuestionTmp = Question::read($deleteQuestion)) {
-		$objQuestionTmp->delete($exerciseId);
+    // if the question exists
+    if ($objQuestionTmp = Question::read($deleteQuestion)) {
+        $objQuestionTmp->delete($exerciseId);
 
-		// if the question has been removed from the exercise
-		if ($objExercise->removeFromList($deleteQuestion)) {
-			$nbrQuestions--;
-		}
-	}
-	// destruction of the Question object
-	unset($objQuestionTmp);
+        // if the question has been removed from the exercise
+        if ($objExercise->removeFromList($deleteQuestion)) {
+            $nbrQuestions--;
+        }
+    }
+    // destruction of the Question object
+    unset($objQuestionTmp);
 }
 $ajax_url = api_get_path(WEB_AJAX_PATH)."exercise.ajax.php?".api_get_cidreq()."&exercise_id=".intval($exerciseId);
 ?>
-<style>
-    .ui-state-highlight { height: 30px; line-height: 1.2em; }
-    /*Fixes edition buttons*/
-    .ui-accordion-icons .ui-accordion-header .edition a {
-        padding-left:4px;
-    }
-</style>
+    <style>
+        .ui-state-highlight { height: 30px; line-height: 1.2em; }
+        /*Fixes edition buttons*/
+        .ui-accordion-icons .ui-accordion-header .edition a {
+            padding-left:4px;
+        }
+    </style>
 
-<div id="dialog-confirm" title="<?php echo get_lang("ConfirmYourChoice"); ?>" style="display:none;">
-    <p>
+    <div id="dialog-confirm" title="<?php echo get_lang("ConfirmYourChoice"); ?>" style="display:none;">
+        <p>
         <span class="ui-icon ui-icon-alert" style="float:left; margin:0 7px 20px 0; display:none;">
         </span>
-        <?php echo get_lang("AreYouSureToDelete"); ?>
-    </p>
-</div>
-
-<script>
-$(function() {
-    $( "#dialog:ui-dialog" ).dialog( "destroy" );
-    $( "#dialog-confirm" ).dialog({
-            autoOpen: false,
-            show: "blind",
-            resizable: false,
-            height:150,
-            modal: false
-     });
+            <?php echo get_lang("AreYouSureToDelete"); ?>
+        </p>
+    </div>
 
-    $(".opener").click(function() {
-        var targetUrl = $(this).attr("href");
-        $( "#dialog-confirm" ).dialog({
-        	modal: true,
-            buttons: {
-                "<?php echo get_lang("Yes"); ?>": function() {
-                    location.href = targetUrl;
-                    $( this ).dialog( "close" );
-
-                },
-                "<?php echo get_lang("No"); ?>": function() {
-                    $( this ).dialog( "close" );
-                }
-            }
-        });
-        $( "#dialog-confirm" ).dialog("open");
-        return false;
-    });
+    <script>
+        $(function() {
+            $( "#dialog:ui-dialog" ).dialog( "destroy" );
+            $( "#dialog-confirm" ).dialog({
+                autoOpen: false,
+                show: "blind",
+                resizable: false,
+                height:150,
+                modal: false
+            });
 
-    var stop = false;
-    $( "#question_list h3" ).click(function( event ) {
-        if ( stop ) {
-            event.stopImmediatePropagation();
-            event.preventDefault();
-            stop = false;
-        }
-    });
+            $(".opener").click(function() {
+                var targetUrl = $(this).attr("href");
+                $( "#dialog-confirm" ).dialog({
+                    modal: true,
+                    buttons: {
+                        "<?php echo get_lang("Yes"); ?>": function() {
+                            location.href = targetUrl;
+                            $( this ).dialog( "close" );
 
-    var icons = {
-            header: "ui-icon-circle-arrow-e",
-            headerSelected: "ui-icon-circle-arrow-s"
-    };
+                        },
+                        "<?php echo get_lang("No"); ?>": function() {
+                            $( this ).dialog( "close" );
+                        }
+                    }
+                });
+                $( "#dialog-confirm" ).dialog("open");
+                return false;
+            });
 
+            var stop = false;
+            $( "#question_list h3" ).click(function( event ) {
+                if ( stop ) {
+                    event.stopImmediatePropagation();
+                    event.preventDefault();
+                    stop = false;
+                }
+            });
 
-    /* We can add links in the accordion header */
-    $("div > div > div > .edition > div > a").click(function() {
-        //Avoid the redirecto when selecting the delete button
-        if (this.id.indexOf('delete') == -1) {
-            newWind = window.open(this.href,"_self");
-            newWind.focus();
-            return false;
-        }
-    });
+            var icons = {
+                header: "ui-icon-circle-arrow-e",
+                headerSelected: "ui-icon-circle-arrow-s"
+            };
 
-    $( "#question_list" ).accordion({
-        icons: icons,
-        autoHeight: false,
-        active: false, // all items closed by default
-        collapsible: true,
-        header: ".header_operations"
-    })
+            /* We can add links in the accordion header */
+            $("div > div > div > .edition > div > a").click(function() {
+                //Avoid the redirecto when selecting the delete button
+                if (this.id.indexOf('delete') == -1) {
+                    newWind = window.open(this.href,"_self");
+                    newWind.focus();
+                    return false;
+                }
+            });
 
-    .sortable({
-        cursor: "move", // works?
-        update: function(event, ui) {
-            var order = $(this).sortable("serialize") + "&a=update_question_order&exercise_id=<?php echo intval($_GET['exerciseId']);?>";
-            $.post("<?php echo $ajax_url ?>", order, function(reponse){
-                $("#message").html(reponse);
+            $( "#question_list" ).accordion({
+                icons: icons,
+                autoHeight: false,
+                active: false, // all items closed by default
+                collapsible: true,
+                header: ".header_operations"
+            })
+            .sortable({
+                cursor: "move", // works?
+                update: function(event, ui) {
+                    var order = $(this).sortable("serialize") + "&a=update_question_order&exercise_id=<?php echo intval($_GET['exerciseId']);?>";
+                    $.post("<?php echo $ajax_url ?>", order, function(reponse){
+                        $("#message").html(reponse);
+                    });
+                },
+                axis: "y",
+                placeholder: "ui-state-highlight", //defines the yellow highlight
+                handle: ".moved", //only the class "moved"
+                stop: function() {
+                    stop = true;
+                }
             });
-        },
-        axis: "y",
-        placeholder: "ui-state-highlight", //defines the yellow highlight
-        handle: ".moved", //only the class "moved"
-        stop: function() {
-            stop = true;
-        }
-    });
-});
-</script>
+        });
+    </script>
 <?php
 
 //we filter the type of questions we can add
@@ -136,7 +135,7 @@ unset($_SESSION['less_answer']);
 // If we are in a test
 $inATest = isset($exerciseId) && $exerciseId > 0;
 if (!$inATest) {
-	echo "<p class='warning-message'>".get_lang("ChoiceQuestionType")."</p>";
+    echo "<p class='warning-message'>".get_lang("ChoiceQuestionType")."</p>";
 } else {
     // Title line
     echo "<div>";
@@ -149,7 +148,7 @@ if (!$inATest) {
     echo "<div style='clear:both'>&nbsp;</div>";
 
     echo '<div id="question_list">';
-	if ($nbrQuestions) {
+    if ($nbrQuestions) {
         //Always getting list from DB
         $questionList = $objExercise->selectQuestionList(true);
 
@@ -161,65 +160,69 @@ if (!$inATest) {
         $styleScore = "width:4%; float:left; padding-top:8px; text-align:center;";
 
         if (is_array($questionList)) {
-			foreach ($questionList as $id) {
-				//To avoid warning messages
-				if (!is_numeric($id)) {
-					continue;
-				}
-				$objQuestionTmp = Question::read($id);
-				$question_class = get_class($objQuestionTmp);
+            foreach ($questionList as $id) {
+                //To avoid warning messages
+                if (!is_numeric($id)) {
+                    continue;
+                }
+                $objQuestionTmp = Question::read($id);
+                $question_class = get_class($objQuestionTmp);
 
-				$clone_link = '<a href="'.api_get_self().'?'.api_get_cidreq().'&clone_question='.$id.'">'.Display::return_icon('cd.gif',get_lang('Copy'), array(), ICON_SIZE_SMALL).'</a>';
-				/*$edit_link  = '<a href="'.api_get_self().'?'.api_get_cidreq().'&type='.$objQuestionTmp->selectType().'&myid=1&editQuestion='.$id.'">'.Display::return_icon('edit.png',get_lang('Modify'), array(), ICON_SIZE_SMALL).'</a>';
+                $clone_link = '<a href="'.api_get_self().'?'.api_get_cidreq().'&clone_question='.$id.'">'.Display::return_icon('cd.gif',get_lang('Copy'), array(), ICON_SIZE_SMALL).'</a>';
+                /*$edit_link  = '<a href="'.api_get_self().'?'.api_get_cidreq().'&type='.$objQuestionTmp->selectType().'&myid=1&editQuestion='.$id.'">'.Display::return_icon('edit.png',get_lang('Modify'), array(), ICON_SIZE_SMALL).'</a>';
 
                 if ($objQuestionTmp->type == CALCULATED_ANSWER && $objQuestionTmp->isAnswered()) {
                     $edit_link  = '<a>'.Display::return_icon('edit_na.png',get_lang('Modify'), array(), ICON_SIZE_SMALL).'</a>';
                 }*/
 
                 $edit_link = ($objQuestionTmp->type == CALCULATED_ANSWER && $objQuestionTmp->isAnswered()) ?
-                '<a>'.Display::return_icon(
-                    'edit_na.png',
-                    get_lang('QuestionEditionNotAvailableBecauseItIsAlreadyAnsweredHoweverYouCanCopyItAndModifyTheCopy'),
-                    array(),
-                    ICON_SIZE_SMALL
-                ).'</a>' :
-                '<a href="'.api_get_self().'?'.api_get_cidreq().'&type='.
-                $objQuestionTmp->selectType().'&myid=1&editQuestion='.$id.'">'.
-                Display::return_icon(
-                    'edit.png',
-                    get_lang('Modify'),
-                    array(),
-                    ICON_SIZE_SMALL
-                ).'</a>';
+                    '<a>'.Display::return_icon(
+                        'edit_na.png',
+                        get_lang('QuestionEditionNotAvailableBecauseItIsAlreadyAnsweredHoweverYouCanCopyItAndModifyTheCopy'),
+                        array(),
+                        ICON_SIZE_SMALL
+                    ).'</a>' :
+                    '<a href="'.api_get_self().'?'.api_get_cidreq().'&type='.
+                    $objQuestionTmp->selectType().'&myid=1&editQuestion='.$id.'">'.
+                    Display::return_icon(
+                        'edit.png',
+                        get_lang('Modify'),
+                        array(),
+                        ICON_SIZE_SMALL
+                    ).'</a>';
                 $delete_link = null;
-				if ($objExercise->edit_exercise_in_lp == true) {
-				     $delete_link = '<a id="delete_'.$id.'" class="opener"  href="'.api_get_self().'?'.api_get_cidreq().'&exerciseId='.$exerciseId.'&deleteQuestion='.$id.'" >'.Display::return_icon('delete.png',get_lang('RemoveFromTest'), array(), ICON_SIZE_SMALL).'</a>';
-				}
+                if ($objExercise->edit_exercise_in_lp == true) {
+                    $delete_link = '<a id="delete_'.$id.'" class="opener"  href="'.api_get_self().'?'.api_get_cidreq().'&exerciseId='.$exerciseId.'&deleteQuestion='.$id.'" >'.Display::return_icon('delete.png',get_lang('RemoveFromTest'), array(), ICON_SIZE_SMALL).'</a>';
+                }
 
-				$edit_link   = Display::tag('div', $edit_link,   array('style'=>'float:left; padding:0px; margin:0px'));
-				$clone_link  = Display::tag('div', $clone_link,  array('style'=>'float:left; padding:0px; margin:0px'));
-				$delete_link = Display::tag('div', $delete_link, array('style'=>'float:left; padding:0px; margin:0px'));
-				$actions     = Display::tag('div', $edit_link.$clone_link.$delete_link, array('class'=>'edition','style'=>'width:100px; right:10px; margin-top: 0px; position: absolute; top: 10%;'));
+                $edit_link   = Display::tag('div', $edit_link,   array('style'=>'float:left; padding:0px; margin:0px'));
+                $clone_link  = Display::tag('div', $clone_link,  array('style'=>'float:left; padding:0px; margin:0px'));
+                $delete_link = Display::tag('div', $delete_link, array('style'=>'float:left; padding:0px; margin:0px'));
+                $actions     = Display::tag('div', $edit_link.$clone_link.$delete_link, array('class'=>'edition','style'=>'width:100px; right:10px; margin-top: 0px; position: absolute; top: 10%;'));
 
                 $title = Security::remove_XSS($objQuestionTmp->selectTitle());
                 $move = Display::return_icon('all_directions.png',get_lang('Move'), array('class'=>'moved', 'style'=>'margin-bottom:-0.5em;'));
 
                 // Question name
-                $questionName = Display::tag('div', '<a href="#" title = "'.htmlentities($title).'">'.$move.' '.cut($title, 42).'</a>', array('style'=>$styleQuestion));
+                $questionName = Display::tag(
+                    'div',
+                    '<a href="#" title = "'.Security::remove_XSS($title).'">'.$move.' '.cut($title, 42).'</a>',
+                    array('style'=>$styleQuestion)
+                );
 
-				// Question type
-				list($typeImg, $typeExpl) = $objQuestionTmp->get_type_icon_html();
-				$questionType = Display::tag('div', Display::return_icon($typeImg, $typeExpl, array(), ICON_SIZE_MEDIUM), array('style'=>$styleType));
+                // Question type
+                list($typeImg, $typeExpl) = $objQuestionTmp->get_type_icon_html();
+                $questionType = Display::tag('div', Display::return_icon($typeImg, $typeExpl, array(), ICON_SIZE_MEDIUM), array('style'=>$styleType));
 
-				// Question category
-				$txtQuestionCat = Security::remove_XSS(Testcategory::getCategoryNameForQuestion($objQuestionTmp->id));
-				if (empty($txtQuestionCat)) {
-					$txtQuestionCat = "-";
-				}
-				$questionCategory = Display::tag('div', '<a href="#" style="padding:0px; margin:0px;" title="'.$txtQuestionCat.'">'.cut($txtQuestionCat, 42).'</a>', array('style'=>$styleCat));
+                // Question category
+                $txtQuestionCat = Security::remove_XSS(Testcategory::getCategoryNameForQuestion($objQuestionTmp->id));
+                if (empty($txtQuestionCat)) {
+                    $txtQuestionCat = "-";
+                }
+                $questionCategory = Display::tag('div', '<a href="#" style="padding:0px; margin:0px;" title="'.$txtQuestionCat.'">'.cut($txtQuestionCat, 42).'</a>', array('style'=>$styleCat));
 
-				// Question level
-				$txtQuestionLevel = $objQuestionTmp->level;
+                // Question level
+                $txtQuestionLevel = $objQuestionTmp->level;
                 if (empty($objQuestionTmp->level)) {
                     $txtQuestionLevel = '-';
                 }
@@ -229,32 +232,32 @@ if (!$inATest) {
                 $questionScore = Display::tag('div', $objQuestionTmp->selectWeighting(), array('style'=>$styleScore));
 
                 echo '<div id="question_id_list_'.$id.'" >';
-                    echo '<div class="header_operations">';
-                        echo $questionName;
-                        echo $questionType;
-                        echo $questionCategory;
-                        echo $questionLevel;
-                        echo $questionScore;
-                        echo $actions;
-                    echo '</div>';
-                    echo '<div class="question-list-description-block">';
-                        echo '<p>';
-                        //echo get_lang($question_class.$label);
-                        echo get_lang($question_class);
-                        echo '<br />';
-                        //echo get_lang('Level').': '.$objQuestionTmp->selectLevel();
-                        echo '<br />';
-                        showQuestion($id, false, null, null, false, true, false, true, $objExercise->feedback_type, true);
-                        echo '</p>';
-                    echo '</div>';
+                echo '<div class="header_operations">';
+                echo $questionName;
+                echo $questionType;
+                echo $questionCategory;
+                echo $questionLevel;
+                echo $questionScore;
+                echo $actions;
+                echo '</div>';
+                echo '<div class="question-list-description-block">';
+                echo '<p>';
+                //echo get_lang($question_class.$label);
+                echo get_lang($question_class);
+                echo '<br />';
+                //echo get_lang('Level').': '.$objQuestionTmp->selectLevel();
+                echo '<br />';
+                showQuestion($id, false, null, null, false, true, false, true, $objExercise->feedback_type, true);
+                echo '</p>';
+                echo '</div>';
                 echo '</div>';
                 unset($objQuestionTmp);
-			}
-		}
-	}
+            }
+        }
+    }
 
-	if (!$nbrQuestions) {
-	  	echo Display::display_warning_message(get_lang('NoQuestion'));
-	}
-	echo '</div>'; //question list div
+    if (!$nbrQuestions) {
+        echo Display::display_warning_message(get_lang('NoQuestion'));
+    }
+    echo '</div>'; //question list div
 }

+ 1 - 1
main/exercice/savescores.php

@@ -67,7 +67,7 @@ function save_scores($file, $score)
     }
     $sql = "INSERT INTO $TABLETRACK_HOTPOTATOES (exe_name, exe_user_id, exe_date, exe_cours_id, exe_result, exe_weighting) VALUES (
 			'".Database::escape_string($file)."',
-			'".Database::escape_string($user_id)."',
+			".intval($user_id).",
 			'".Database::escape_string($date)."',
 			'".Database::escape_string($_cid)."',
 			'".Database::escape_string($score)."',

+ 10 - 10
main/exercice/testcategory.class.php

@@ -45,8 +45,8 @@ class Testcategory
     public function getCategory($in_id)
     {
 		$t_cattable = Database::get_course_table(TABLE_QUIZ_QUESTION_CATEGORY);
-		$in_id = Database::escape_string($in_id);
-		$sql = "SELECT * FROM $t_cattable WHERE id=$in_id AND c_id=".api_get_course_int_id();
+		$in_id = intval($in_id);
+		$sql = "SELECT * FROM $t_cattable WHERE id = $in_id AND c_id=".api_get_course_int_id();
 		$res = Database::query($sql);
 		$numrows = Database::num_rows($res);
 		if ($numrows > 0) {
@@ -104,7 +104,7 @@ class Testcategory
     {
 		$t_cattable = Database :: get_course_table(TABLE_QUIZ_QUESTION_CATEGORY);
         $tbl_question_rel_cat = Database::get_course_table(TABLE_QUIZ_QUESTION_REL_CATEGORY);
-		$v_id = Database::escape_string($this->id);
+		$v_id = intval($this->id);
 		$sql = "DELETE FROM $t_cattable WHERE id=$v_id AND c_id=".api_get_course_int_id();
 		Database::query($sql);
 		if (Database::affected_rows() <= 0) {
@@ -127,11 +127,11 @@ class Testcategory
     public function modifyCategory()
     {
 		$t_cattable = Database :: get_course_table(TABLE_QUIZ_QUESTION_CATEGORY);
-		$v_id = Database::escape_string($this->id);
+		$v_id = intval($this->id);
 		$v_name = Database::escape_string($this->name);
 		$v_description = Database::escape_string($this->description);
 		$sql = "UPDATE $t_cattable SET title='$v_name', description='$v_description'
-		        WHERE id='$v_id' AND c_id=".api_get_course_int_id();
+		        WHERE id = $v_id AND c_id=".api_get_course_int_id();
 		Database::query($sql);
 		if (Database::affected_rows() <= 0) {
 			return false;
@@ -156,7 +156,7 @@ class Testcategory
     public function getCategoryQuestionsNumber()
     {
 		$t_reltable = Database::get_course_table(TABLE_QUIZ_QUESTION_REL_CATEGORY);
-		$in_id = Database::escape_string($this->id);
+		$in_id = intval($this->id);
 		$sql = "SELECT count(*) AS nb FROM $t_reltable
 		        WHERE category_id=$in_id AND c_id=".api_get_course_int_id();
 		$res = Database::query($sql);
@@ -221,9 +221,9 @@ class Testcategory
             $courseId = api_get_course_int_id();
 		}
 		$table = Database::get_course_table(TABLE_QUIZ_QUESTION_REL_CATEGORY);
-        $questionId = Database::escape_string($questionId);
+        $questionId = intval($questionId);
 		$sql = "SELECT category_id FROM $table
-		        WHERE question_id='$questionId' AND c_id = $courseId";
+		        WHERE question_id = $questionId AND c_id = $courseId";
 		$res = Database::query($sql);
 		if (Database::num_rows($res) > 0) {
             $data = Database::fetch_array($res);
@@ -256,8 +256,8 @@ class Testcategory
 		$catid = Testcategory::getCategoryForQuestion($in_questionid, $in_courseid);
 		$result = "";	// result
 		$t_cattable = Database::get_course_table(TABLE_QUIZ_QUESTION_CATEGORY);
-		$catid = Database::escape_string($catid);
-		$sql = "SELECT title FROM $t_cattable WHERE id='$catid' AND c_id=$in_courseid";
+		$catid = intval($catid);
+		$sql = "SELECT title FROM $t_cattable WHERE id = $catid  AND c_id = $in_courseid";
 		$res = Database::query($sql);
 		$data = Database::fetch_array($res);
 		if (Database::num_rows($res) > 0) {

+ 6 - 9
main/exercice/testheaderpage.php

@@ -1,13 +1,12 @@
-<?php //$id: $
+<?php
 /* For licensing terms, see /license.txt */
+
 /**
 *	Code library for HotPotatoes integration.
 *	@package chamilo.exercise
 * 	@author Istvan Mandak
 */
-/**
- * Code
- */
+
 // name of the language file that needs to be included
 $language_file='exercice';
 
@@ -16,9 +15,7 @@ require '../inc/global.inc.php';
 require_once(api_get_path(SYS_CODE_PATH).'exercice/hotpotatoes.lib.php');
 $documentPath= api_get_path(SYS_COURSE_PATH).$_course['path']."/document";
 $my_file = Security::remove_XSS($_GET['file']);
-
 $my_file=str_replace(array('../','\\..','\\0','..\\'),array('','','',''),urldecode($my_file));
-
 $title = GetQuizName($my_file,$documentPath);
 if ($title =='') {
 	$title = basename($my_file);
@@ -31,9 +28,9 @@ if (isset($_SESSION['gradebook'])){
 
 if (!empty($gradebook) && $gradebook=='view') {
 	$interbreadcrumb[]= array (
-			'url' => '../gradebook/'.$_SESSION['gradebook_dest'],
-			'name' => get_lang('ToolGradebook')
-		);
+		'url' => '../gradebook/'.$_SESSION['gradebook_dest'],
+		'name' => get_lang('ToolGradebook')
+	);
 }
 $interbreadcrumb[]= array ("url"=>"./exercice.php", "name"=> get_lang('Exercices'));
 Display::display_header($nameTools,"Exercise");

+ 0 - 1
main/exercice/unique_answer.class.php

@@ -12,7 +12,6 @@
  * @author Julio Montoya
  * @package chamilo.exercise
  **/
-
 class UniqueAnswer extends Question
 {
     static $typePicture = 'mcua.png';

+ 4 - 3
main/exercice/upload_exercise.php

@@ -1,5 +1,6 @@
 <?php
 /* For licensing terms, see /license.txt */
+
 /**
  * 	Upload quiz: This script shows the upload quiz feature
  *  Initial work by Isaac flores on Nov 4 of 2010
@@ -327,15 +328,15 @@ function lp_upload_quiz_action_handling() {
                     $globalScore = null;
                     $objAnswer = new Answer($question_id, $courseId);
                     $globalScore = $score_list[$i][3];
-                    
-                    // Calculate the number of correct answers to divide the 
+
+                    // Calculate the number of correct answers to divide the
                     // score between them when importing from CSV
                     $numberRightAnswers = 0;
                     foreach ($answers_data as $answer_data) {
                         if (strtolower($answer_data[3]) == 'x') {
                             $numberRightAnswers++;
                         }
-                    }                    
+                    }
                     foreach ($answers_data as $answer_data) {
                         $answerValue = $answer_data[2];
                         $correct = 0;

+ 29 - 29
main/forum/forumfunction.inc.php

@@ -542,7 +542,7 @@ function store_forumcategory($values)
         $sql = "UPDATE ".$table_categories." SET
                 cat_title='".$clean_cat_title."',
                 cat_comment='".Database::escape_string($values['forum_category_comment'])."'
-                WHERE c_id = $course_id AND cat_id='".Database::escape_string($values['forum_category_id'])."'";
+                WHERE c_id = $course_id AND cat_id= ".intval($values['forum_category_id'])."";
         Database::query($sql);
         Database::insert_id();
         api_item_property_update(
@@ -676,7 +676,7 @@ function store_forum($values)
                 forum_group_public_private='".Database::escape_string($values['public_private_group_forum_group']['public_private_group_forum'])."',
                 default_view='".Database::escape_string($values['default_view_type_group']['default_view_type'])."',
                 forum_of_group='".Database::escape_string($values['group_forum'])."'
-            WHERE c_id = $course_id AND forum_id='".Database::escape_string($values['forum_id'])."'";
+            WHERE c_id = $course_id AND forum_id = ".intval($values['forum_id'])."";
         Database::query($sql);
 
         api_item_property_update(
@@ -845,7 +845,7 @@ function delete_post($post_id)
 
         // Note: This has to be a recursive function that deletes all of the posts in this block.
         $sql = "DELETE FROM $table_posts
-                WHERE c_id = $course_id AND post_id='".Database::escape_string($post_id)."'";
+                WHERE c_id = $course_id AND post_id = ".intval($post_id)."";
         Database::query($sql);
 
         // Delete attachment file about this post id.
@@ -857,16 +857,16 @@ function delete_post($post_id)
     if (is_array($last_post_of_thread)) {
         // Decreasing the number of replies for this thread and also changing the last post information.
         $sql = "UPDATE $table_threads SET thread_replies=thread_replies-1,
-                    thread_last_post='".Database::escape_string($last_post_of_thread['post_id'])."',
+                    thread_last_post = ".intval($last_post_of_thread['post_id']).",
                     thread_date='".Database::escape_string($last_post_of_thread['post_date'])."'
-            WHERE c_id = $course_id AND thread_id='".intval($_GET['thread'])."'";
+            WHERE c_id = $course_id AND thread_id = ".intval($_GET['thread'])."";
         Database::query($sql);
         return 'PostDeleted';
     }
     if (!$last_post_of_thread) {
         // We deleted the very single post of the thread so we need to delete the entry in the thread table also.
         $sql = "DELETE FROM $table_threads
-                WHERE c_id = $course_id AND thread_id='".intval($_GET['thread'])."'";
+                WHERE c_id = $course_id AND thread_id = ".intval($_GET['thread'])."";
         Database::query($sql);
         return 'PostDeletedSpecial';
     }
@@ -887,7 +887,7 @@ function check_if_last_post_of_thread($thread_id)
     $table_posts = Database :: get_course_table(TABLE_FORUM_POST);
     $course_id = api_get_course_int_id();
     $sql = "SELECT * FROM $table_posts
-            WHERE c_id = $course_id AND thread_id='".Database::escape_string($thread_id)."'
+            WHERE c_id = $course_id AND thread_id = ".intval($thread_id)."
             ORDER BY post_date DESC";
     $result = Database::query($sql);
     if (Database::num_rows($result) > 0) {
@@ -1150,7 +1150,7 @@ function move_up_down($content, $direction, $id)
         $sort_column = 'forum_order';
         // We also need the forum_category of this forum.
         $sql = "SELECT forum_category FROM $table_forums
-                WHERE c_id = $course_id AND forum_id=".Database::escape_string($id);
+                WHERE c_id = $course_id AND forum_id = ".intval($id);
         $result = Database::query($sql);
         $row = Database::fetch_array($result);
         $forum_category = $row['forum_category'];
@@ -1283,7 +1283,7 @@ function get_forum_categories($id = '')
                 WHERE
                     forum_categories.cat_id=item_properties.ref AND
                     item_properties.tool='".TOOL_FORUM_CATEGORY."' AND
-                    forum_categories.cat_id='".Database::escape_string($id)."'
+                    forum_categories.cat_id = ".intval($id)."
                     $condition_session
                 ORDER BY forum_categories.cat_order ASC";
     }
@@ -1502,7 +1502,7 @@ function get_forums(
         $sql = "SELECT * FROM $table_forums forum, ".$table_item_property." item_properties
                 WHERE
                     forum.forum_id=item_properties.ref AND
-                    forum_id='".Database::escape_string($id)."' AND
+                    forum_id = ".intval($id)." AND
                     item_properties.visibility<>2 AND
                     item_properties.tool='".TOOL_FORUM."'
                     $condition_session AND
@@ -1514,7 +1514,7 @@ function get_forums(
         $sql2 = "SELECT count(*) AS number_of_threads, forum_id
                 FROM $table_threads
                 WHERE
-                    forum_id=".Database::escape_string($id)." AND
+                    forum_id = ".intval($id)." AND
                     c_id = $course_id
                 GROUP BY forum_id";
 
@@ -1522,7 +1522,7 @@ function get_forums(
         $sql3 = "SELECT count(*) AS number_of_posts, forum_id
                 FROM $table_posts
                 WHERE
-                    forum_id=".Database::escape_string($id)." AND
+                    forum_id = ".intval($id)." AND
                     c_id = $course_id
                 GROUP BY forum_id";
 
@@ -1531,7 +1531,7 @@ function get_forums(
                     post.post_id, post.forum_id, post.poster_id, post.poster_name, post.post_date, users.lastname, users.firstname
                 FROM $table_posts post, $table_users users
                 WHERE
-                    forum_id=".Database::escape_string($id)." AND
+                    forum_id = ".intval($id)." AND
                     post.poster_id=users.user_id AND
                     post.c_id = $course_id
                 GROUP BY post.forum_id
@@ -1666,7 +1666,7 @@ function get_last_post_information($forum_id, $show_invisibles = false, $course_
                 $table_item_property thread_properties,
                 $table_item_property forum_properties
             WHERE
-                post.forum_id=".Database::escape_string($forum_id)."
+                post.forum_id = ".intval($forum_id)."
                 AND post.poster_id=users.user_id
                 AND post.thread_id=thread_properties.ref
                 AND thread_properties.tool='".TOOL_FORUM_THREAD."'
@@ -1751,7 +1751,7 @@ function get_threads($forum_id, $course_code = null)
                 ON thread.thread_poster_id=users.user_id
             WHERE
                 item_properties.visibility='1' AND
-                thread.forum_id='".Database::escape_string($forum_id)."'
+                thread.forum_id = ".intval($forum_id)."
             ORDER BY thread.thread_sticky DESC, thread.thread_date DESC";
 
     if (is_allowed_to_edit()) {
@@ -1778,7 +1778,7 @@ function get_threads($forum_id, $course_code = null)
                     ON thread.thread_poster_id=users.user_id
                 WHERE
                     item_properties.visibility<>2 AND
-                    thread.forum_id='".Database::escape_string($forum_id)."'
+                    thread.forum_id = ".intval($forum_id)."
                 ORDER BY thread.thread_sticky DESC, thread.thread_date DESC";
     }
     $result = Database::query($sql);
@@ -1818,7 +1818,7 @@ function get_posts($thread_id)
                     ON posts.poster_id = users.user_id
                 WHERE
                     posts.c_id = $course_id AND
-                    posts.thread_id='".Database::escape_string($thread_id)."'
+                    posts.thread_id = ".intval($thread_id)."
 
                 ORDER BY posts.post_id ASC";
     } else {
@@ -1828,7 +1828,7 @@ function get_posts($thread_id)
                     ON posts.poster_id=users.user_id
                 WHERE
                     posts.c_id = $course_id AND
-                    posts.thread_id = '".Database::escape_string($thread_id)."' AND
+                    posts.thread_id = ".intval($thread_id)." AND
                     posts.visible='1'
                 ORDER BY posts.post_id ASC";
     }
@@ -1860,7 +1860,7 @@ function get_post_information($post_id)
             WHERE
                 c_id = $course_id AND
                 posts.poster_id=users.user_id AND
-                posts.post_id='".Database::escape_string($post_id)."'";
+                posts.post_id = ".intval($post_id)."";
     $result = Database::query($sql);
     $row = Database::fetch_array($result);
 
@@ -1886,8 +1886,8 @@ function get_thread_information($thread_id)
             WHERE
                 item_properties.tool= '".TOOL_FORUM_THREAD."' AND
                 item_properties.c_id = $course_id AND
-                item_properties.ref = '".Database::escape_string($thread_id)."' AND
-                threads.thread_id   = '".Database::escape_string($thread_id)."' AND
+                item_properties.ref = ".intval($thread_id)." AND
+                threads.thread_id   = ".intval($thread_id)." AND
                 threads.c_id = $course_id
             ";
     $result = Database::query($sql);
@@ -1934,8 +1934,8 @@ function get_thread_users_details($thread_id)
                   user.user_id = session_rel_user_rel_course.id_user AND
                   session_rel_user_rel_course.status<>'2' AND
                   session_rel_user_rel_course.id_user NOT IN ($user_to_avoid) AND
-                  thread_id = '".Database::escape_string($thread_id)."' AND
-                  id_session = '".api_get_session_id()."' AND
+                  thread_id = ".intval($thread_id)." AND
+                  id_session = ".api_get_session_id()." AND
                   c_id = $course_id AND
                   course_code = '".$course_code."' $orderby ";
     } else {
@@ -1944,7 +1944,7 @@ function get_thread_users_details($thread_id)
                   WHERE poster_id = user.user_id
                   AND user.user_id = course_user.user_id
                   AND course_user.relation_type<>".COURSE_RELATION_TYPE_RRHH."
-                  AND thread_id = '".Database::escape_string($thread_id)."'
+                  AND thread_id = ".intval($thread_id)."
                   AND course_user.status NOT IN('1') AND
                   c_id = $course_id AND
                   course_code = '".$course_code."' $orderby";
@@ -3408,7 +3408,7 @@ function handle_mail_cue($content, $id)
     if ($content == 'post') {
         // Getting the information about the post (need the thread_id).
         $post_info = get_post_information($id);
-        $thread_id = Database::escape_string($post_info['thread_id']);
+        $thread_id = intval($post_info['thread_id']);
 
         // Sending the mail to all the users that wanted to be informed for replies on this thread.
         $sql = "SELECT users.firstname, users.lastname, users.user_id, users.email
@@ -3434,9 +3434,9 @@ function handle_mail_cue($content, $id)
                 WHERE
                     posts.c_id = $course_id AND
                     mailcue.c_id = $course_id AND
-                    posts.thread_id='".Database::escape_string($id)."'
+                    posts.thread_id = ".intval($id)."
                     AND posts.post_notification='1'
-                    AND mailcue.thread_id='".Database::escape_string($id)."'
+                    AND mailcue.thread_id = ".intval($id)."
                     AND users.user_id=posts.poster_id
                     AND users.active=1
                 GROUP BY users.email";
@@ -4490,8 +4490,8 @@ function count_number_of_post_for_user_thread($thread_id, $user_id)
     $course_id = api_get_course_int_id();
     $sql = "SELECT count(*) as count FROM $table_posts
             WHERE c_id = $course_id AND
-                  thread_id=".Database::escape_string($thread_id)." AND
-                  poster_id = ".Database::escape_string($user_id)." AND visible = 1 ";
+                  thread_id=".intval($thread_id)." AND
+                  poster_id = ".intval($user_id)." AND visible = 1 ";
     $result = Database::query($sql);
     $count = 0;
     if (Database::num_rows($result) > 0) {

+ 12 - 2
main/gradebook/gradebook_add_link.php

@@ -1,5 +1,6 @@
 <?php
 /* For licensing terms, see /license.txt */
+
 /**
  * Script
  * @package chamilo.gradebook
@@ -35,14 +36,23 @@ if ($session_id == 0) {
 }
 $category = Category :: load($_GET['selectcat']);
 $url = api_get_self().'?selectcat='.Security::remove_XSS($_GET['selectcat']).'&newtypeselected='.$typeSelected.'&course_code='.api_get_course_id().'&'.api_get_cidreq();
-$typeform = new LinkForm(LinkForm :: TYPE_CREATE, $category[0], null, 'create_link', null, $url, $typeSelected);
+$typeform = new LinkForm(
+    LinkForm :: TYPE_CREATE,
+    $category[0],
+    null,
+    'create_link',
+    null,
+    $url,
+    $typeSelected
+);
 
 // if user selected a link type
 if ($typeform->validate() && isset($_GET['newtypeselected'])) {
     // reload page, this time with a parameter indicating the selected type
     header('Location: '.api_get_self().'?selectcat='.Security::remove_XSS($_GET['selectcat'])
         .'&typeselected='.$typeform->exportValue('select_link')
-        .'&course_code='.Security::remove_XSS($_GET['course_code'])).'&'.api_get_cidreq();
+        .'&course_code='.Security::remove_XSS($_GET['course_code']).'&'.api_get_cidreq()
+    );
     exit;
 }
 

+ 3 - 0
main/gradebook/gradebook_display_certificate.php

@@ -13,6 +13,9 @@ $current_course_tool  = TOOL_GRADEBOOK;
 
 api_protect_course_script();
 
+set_time_limit(0);
+ini_set('max_execution_time', 0);
+
 require_once 'lib/gradebook_functions.inc.php';
 require_once 'lib/be.inc.php';
 require_once 'lib/gradebook_data_generator.class.php';

+ 8 - 5
main/gradebook/gradebook_edit_cat.php

@@ -21,7 +21,7 @@ $edit_cat = isset($_REQUEST['editcat']) ? intval($_REQUEST['editcat']) : '';
 $htmlHeadXtra[] = '<script src="'.api_get_path(WEB_LIBRARY_PATH).'javascript/tag/jquery.fcbkcomplete.js" type="text/javascript" language="javascript"></script>';
 $htmlHeadXtra[] = '<link  href="'.api_get_path(WEB_LIBRARY_PATH).'javascript/tag/style.css" rel="stylesheet" type="text/css" />';
 
-$htmlHeadXtra[] = '<script type="text/javascript">
+$htmlHeadXtra[] = '<script>
 $(document).ready(function() {
     $("#skills").fcbkcomplete({
         json_url: "'.api_get_path(WEB_AJAX_PATH).'skill.ajax.php?a=find_skills",
@@ -72,7 +72,7 @@ function check_skills() {
                             }
                         });
                     }
-                },
+                }
             });
         }
     });
@@ -99,7 +99,7 @@ if ($form->validate()) {
 
     if (empty ($values['course_code'])) {
         $cat->set_course_code(null);
-    }else {
+    } else {
         $cat->set_course_code($values['course_code']);
     }
 
@@ -122,11 +122,14 @@ if ($form->validate()) {
 
     $cat->set_visible($visible);
     $cat->save();
-    header('Location: '.Security::remove_XSS($_SESSION['gradebook_dest']).'?editcat=&selectcat=' . $cat->get_parent_id());
+    header('Location: '.Security::remove_XSS($_SESSION['gradebook_dest']).'?editcat=&selectcat=' . $cat->get_parent_id().'&'.api_get_cidreq());
     exit;
 }
 $selectcat = isset($_GET['selectcat']) ? Security::remove_XSS($_GET['selectcat']) : '';
-$interbreadcrumb[] = array ('url' => Security::remove_XSS($_SESSION['gradebook_dest']).'?selectcat='.$selectcat,'name' => get_lang('Gradebook'));
+$interbreadcrumb[] = array(
+    'url' => Security::remove_XSS($_SESSION['gradebook_dest']) . '?selectcat=' . $selectcat . '&' . api_get_cidreq(),
+    'name' => get_lang('Gradebook')
+);
 $this_section = SECTION_COURSES;
 Display :: display_header(get_lang('EditCategory'));
 $form->display();

+ 30 - 10
main/gradebook/gradebook_edit_link.php

@@ -39,7 +39,14 @@ if ($session_id == 0) {
     $cats = Category :: load_session_categories(null, $session_id);
 }
 
-$form = new LinkAddEditForm(LinkAddEditForm :: TYPE_EDIT, $cats, null, $link, 'edit_link_form', api_get_self() . '?selectcat=' . $linkcat. '&editlink=' . $linkedit);
+$form = new LinkAddEditForm(
+    LinkAddEditForm :: TYPE_EDIT,
+    $cats,
+    null,
+    $link,
+    'edit_link_form',
+    api_get_self() . '?selectcat=' . $linkcat. '&editlink=' . $linkedit.'&'.api_get_cidreq()
+);
 if ($form->validate()) {
     $values = $form->exportValues();
     $parent_cat = Category :: load($values['select_gradebook']);
@@ -65,31 +72,44 @@ if ($form->validate()) {
     $link->save();
 
     //Update weight for attendance
-    $sql = 'SELECT ref_id FROM '.$tbl_grade_links.' WHERE id = '.intval($_GET['editlink']).' AND type='.LINK_ATTENDANCE;
+    $sql = 'SELECT ref_id FROM '.$tbl_grade_links.'
+            WHERE id = '.intval($_GET['editlink']).' AND type='.LINK_ATTENDANCE;
     $rs_attendance  = Database::query($sql);
     if (Database::num_rows($rs_attendance) > 0) {
         $row_attendance = Database::fetch_array($rs_attendance);
         $attendance_id  = $row_attendance['ref_id'];
-        $upd_attendance = 'UPDATE '.$tbl_attendance.' SET attendance_weight ='.floatval($final_weight).' WHERE c_id = '.$course_id.' AND  id = '.intval($attendance_id);
-        Database::query($upd_attendance);
+        $sql = 'UPDATE '.$tbl_attendance.' SET
+                    attendance_weight ='.floatval($final_weight).'
+                WHERE c_id = '.$course_id.' AND id = '.intval($attendance_id);
+        Database::query($sql);
     }
 
     //Update weight into forum thread
     $sql_t = 'UPDATE '.$tbl_forum_thread.' SET thread_weight='.$final_weight.'
-			  WHERE c_id = '.$course_id.' AND thread_id=(SELECT ref_id FROM '.$tbl_grade_links.' WHERE id='.intval($_GET['editlink']).' and type=5) ';
-
+			  WHERE c_id = '.$course_id.' AND thread_id=(
+                    SELECT ref_id FROM '.$tbl_grade_links.'
+			        WHERE id='.intval($_GET['editlink']).' and type=5
+              ) ';
     Database::query($sql_t);
 
     //Update weight into student publication(work)
-    $sql_t = 'UPDATE '.$tbl_work.' SET weight='.$final_weight.'
-			  WHERE c_id = '.$course_id.' AND id = (SELECT ref_id FROM '.$tbl_grade_links.' WHERE id='.intval($_GET['editlink'] ).' AND type=3 )';
+    $sql_t = 'UPDATE '.$tbl_work.' SET
+              weight='.$final_weight.'
+			  WHERE c_id = '.$course_id.' AND id = (
+			    SELECT ref_id FROM '.$tbl_grade_links.'
+			    WHERE id='.intval($_GET['editlink'] ).' AND type=3
+              )';
 
     Database::query($sql_t);
-    header('Location: '.$_SESSION['gradebook_dest'].'?linkedited=&selectcat=' . $link->get_category_id());
+    header('Location: '.$_SESSION['gradebook_dest'].'?linkedited=&selectcat=' . $link->get_category_id().'&'.api_get_cidreq());
     exit;
 }
 
-$interbreadcrumb[] = array ('url' => Security::remove_XSS($_SESSION['gradebook_dest']).'?selectcat='.$linkcat,'name' => get_lang('Gradebook'));
+$interbreadcrumb[] = array(
+    'url' => Security::remove_XSS($_SESSION['gradebook_dest']).'?selectcat='.$linkcat,
+    'name' => get_lang('Gradebook')
+);
+
 $htmlHeadXtra[] = '<script type="text/javascript">
 $(document).ready( function() {
     $("#hide_category_id").change(function() {

+ 0 - 2
main/gradebook/gradebook_flatview.php

@@ -99,7 +99,6 @@ if ($simple_search_form->validate() && (empty($keyword))) {
 
 if (!empty($keyword)) {
     $users = find_students($keyword);
-
 } else {
     if (isset($alleval) && isset($alllinks)) {
         $users = get_all_users($alleval, $alllinks);
@@ -107,7 +106,6 @@ if (!empty($keyword)) {
         $users = null;
     }
 }
-
 $offset = isset($_GET['offset']) ? $_GET['offset'] : '0';
 
 // Main course category

+ 5 - 1
main/gradebook/index.php

@@ -1,5 +1,6 @@
 <?php
 /* For licensing terms, see /license.txt */
+
 /**
  * Gradebook controller
  * @package chamilo.gradebook
@@ -126,7 +127,9 @@ if (isset($_GET['isStudentView'])) {
     }
 }
 
-if ((isset($_GET['selectcat']) && $_GET['selectcat']>0) && (isset($_SESSION['studentview']) && $_SESSION['studentview']=='studentview')) {
+if ((isset($_GET['selectcat']) && $_GET['selectcat']>0) &&
+    (isset($_SESSION['studentview']) && $_SESSION['studentview']=='studentview')
+) {
     Display :: display_header();
     //Introduction tool: student view
     Display::display_introduction_section(TOOL_GRADEBOOK, array('ToolbarSet' => 'AssessmentsIntroduction'));
@@ -735,6 +738,7 @@ $no_qualification = false;
 
 // Show certificate link.
 $certificate = array();
+
 if ($category != '0') {
     $cat = new Category();
     $category_id   = intval($_GET['selectcat']);

+ 19 - 8
main/gradebook/lib/be/abstractlink.class.php

@@ -106,7 +106,10 @@ abstract class AbstractLink implements GradebookItem
         $this->user_id = $user_id;
     }
 
-    public function set_course_code ($course_code)
+    /**
+     * @param string $course_code
+     */
+    public function set_course_code($course_code)
     {
         $this->course_code = $course_code;
         $course_info = api_get_course_info($course_code);
@@ -172,13 +175,13 @@ abstract class AbstractLink implements GradebookItem
         $sql = 'SELECT * FROM '.$tbl_grade_links;
         $paramcount = 0;
         if (isset ($id)) {
-            $sql.= ' WHERE id = '.Database::escape_string($id);
+            $sql.= ' WHERE id = '.intval($id);
             $paramcount ++;
         }
         if (isset ($type)) {
             if ($paramcount != 0) $sql .= ' AND';
             else $sql .= ' WHERE';
-            $sql .= ' type = '.Database::escape_string($type);
+            $sql .= ' type = '.intval($type);
             $paramcount ++;
         }
         if (isset ($ref_id)) {
@@ -225,6 +228,7 @@ abstract class AbstractLink implements GradebookItem
 
         $result = Database::query($sql);
         $links = AbstractLink::create_objects_from_sql_result($result);
+
         return $links;
     }
 
@@ -263,8 +267,15 @@ abstract class AbstractLink implements GradebookItem
     public function add()
     {
         $this->add_linked_data();
-        if (isset($this->type) && isset($this->ref_id) && isset($this->user_id) && isset($this->course_code) && isset($this->category) && isset($this->weight) && isset($this->visible)) {
-            $tbl_grade_links = Database :: get_main_table(TABLE_MAIN_GRADEBOOK_LINK);
+        if (isset($this->type) &&
+            isset($this->ref_id) &&
+            isset($this->user_id) &&
+            isset($this->course_code) &&
+            isset($this->category) &&
+            isset($this->weight) &&
+            isset($this->visible)
+        ) {
+            $tbl_grade_links = Database:: get_main_table(TABLE_MAIN_GRADEBOOK_LINK);
             $sql = "SELECT count(*) FROM ".$tbl_grade_links."
                     WHERE
                         ref_id=".$this->get_ref_id()." AND
@@ -275,7 +286,7 @@ abstract class AbstractLink implements GradebookItem
             $result = Database::query($sql);
             $row_testing = Database::fetch_array($result);
 
-            if ($row_testing[0]==0) {
+            if ($row_testing[0] == 0) {
                 $sql = 'INSERT INTO '.$tbl_grade_links.' (type, ref_id, user_id, course_code, category_id, weight, visible, created_at) VALUES ('
                     .intval($this->get_type())
                     .','.intval($this->get_ref_id())
@@ -501,14 +512,14 @@ abstract class AbstractLink implements GradebookItem
     {
     }
 
-    public function get_view_url ($stud_id)
+    public function get_view_url($stud_id)
     {
         return null;
     }
 
     /**
      * Locks a link
-     * @param int locked 1 or unlocked 0
+     * @param int $locked 1 or unlocked 0
      *
      * */
     public function lock($locked)

+ 2 - 1
main/gradebook/lib/be/attendancelink.class.php

@@ -196,7 +196,8 @@ class AttendanceLink extends AbstractLink
 		return false;
 	}
 
-	public function get_name() {
+	public function get_name()
+	{
 		$this->get_attendance_data();
 		$attendance_title = isset($this->attendance_data['name']) ? $this->attendance_data['name'] : '';
 		$attendance_qualify_title = isset($this->attendance_data['attendance_qualify_title']) ? $this->attendance_data['attendance_qualify_title'] : '';

+ 49 - 25
main/gradebook/lib/be/category.class.php

@@ -58,6 +58,9 @@ class Category implements GradebookItem
         }
     }
 
+    /**
+     * @return string
+     */
     public function get_course_code()
     {
         return $this->course_code;
@@ -441,7 +444,7 @@ class Category implements GradebookItem
                 $sql .= ', '.intval($this->get_grade_model_id());
             }
             if (isset($this->certificate_min_score) && !empty($this->certificate_min_score)) {
-                $sql .= ', '.Database::escape_string($this->get_certificate_min_score());
+                $sql .= ', '.intval($this->get_certificate_min_score());
             }
             $sql .= ')';
             Database::query($sql);
@@ -516,15 +519,15 @@ class Category implements GradebookItem
         }
         $sql .= ', certif_min_score = ';
         if (isset($this->certificate_min_score) && !empty($this->certificate_min_score)) {
-            $sql .= Database::escape_string($this->get_certificate_min_score());
+            $sql .= intval($this->get_certificate_min_score());
         } else {
             $sql .= 'null';
         }
         if (isset($this->grade_model_id)) {
             $sql .= ', grade_model_id = '.intval($this->get_grade_model_id());
         }
-        $sql .= ', weight = '.Database::escape_string($this->get_weight())
-            .', visible = '.intval($this->is_visible())
+        $sql .= ', weight = "'.Database::escape_string($this->get_weight())
+            .'", visible = '.intval($this->is_visible())
             .' WHERE id = '.intval($this->id);
 
         Database::query($sql);
@@ -783,14 +786,14 @@ class Category implements GradebookItem
             foreach ($links as $link) {
                 $linkres = $link->calc_score($stud_id);
 
-                if (isset($linkres) && $link->get_weight() != 0) {
-                    $linkweight     = $link->get_weight();
-                    $link_res_denom = ($linkres[1] == 0) ? 1 : $linkres[1];
+                if (!empty($linkres) && $link->get_weight() != 0) {
+                    $linkweight = $link->get_weight();
+                    $link_res_denom = $linkres[1] == 0 ? 1 : $linkres[1];
                     $rescount++;
                     $weightsum += $linkweight;
-                    $ressum += (($linkres[0] / $link_res_denom) * $linkweight);
+                    $ressum += ($linkres[0] / $link_res_denom) * $linkweight;
                 } else {
-                    // Ddding if result does not exists
+                    // Adding if result does not exists
                     if ($link->get_weight() != 0) {
                         $linkweight = $link->get_weight();
                         $weightsum += $linkweight;
@@ -1436,8 +1439,14 @@ class Category implements GradebookItem
                 $sessionId
             );
             if (!empty($subcats)) {
+                /** @var Category $subcat */
                 foreach ($subcats as $subcat) {
-                    $sublinks = $subcat->get_links($stud_id, false, $course_code, $sessionId);
+                    $sublinks = $subcat->get_links(
+                        $stud_id,
+                        false,
+                        $course_code,
+                        $sessionId
+                    );
                     $links = array_merge($links, $sublinks);
                 }
             }
@@ -1564,10 +1573,19 @@ class Category implements GradebookItem
     public static function register_user_certificate($category_id, $user_id)
     {
         // Generating the total score for a course
-        $cats_course = Category::load($category_id, null, null, null, null, api_get_session_id(), false);
-
-        $alleval_course  = $cats_course[0]->get_evaluations($user_id, true);
-        $alllink_course  = $cats_course[0]->get_links($user_id, true);
+        $cats_course = Category::load(
+            $category_id,
+            null,
+            null,
+            null,
+            null,
+            api_get_session_id(),
+            false
+        );
+        /** @var Category $category */
+        $category = $cats_course[0];
+        $alleval_course  = $category->get_evaluations($user_id, true);
+        $alllink_course  = $category->get_links($user_id, true);
         $evals_links = array_merge($alleval_course, $alllink_course);
 
         //@todo move these in a function
@@ -1586,13 +1604,15 @@ class Category implements GradebookItem
         $main_weight = $cats_course[0]->get_weight();
 
         $item_total_value = 0;
-        $item_value = 0;
-
         for ($count=0; $count < count($evals_links); $count++) {
+            /** @var AbstractLink $item */
             $item = $evals_links[$count];
             $score = $item->calc_score($user_id);
-            $divide = ( ($score[1])==0 ) ? 1 : $score[1];
-            $item_value = $score[0]/$divide*$item->get_weight();
+            $item_value = 0;
+            if (!empty($score)) {
+                $divide = $score[1] == 0 ? 1 : $score[1];
+                $item_value = $score[0] / $divide * $item->get_weight();
+            }
             $item_total_value += $item_value;
         }
 
@@ -1631,14 +1651,12 @@ class Category implements GradebookItem
                 if (!empty($fileWasGenerated)) {
                     $url = api_get_path(WEB_PATH) . 'certificates/index.php?id=' . $my_certificate['id'];
                     $certificates = Display::url(
-                        Display::return_icon(
-                            'certificate_download.png',
-                            get_lang('DownloadCertificate'),
-                            array(),
-                            ICON_SIZE_MEDIUM
-                        ).'&nbsp;'.get_lang('DownloadCertificate'),
+                        '&nbsp;'.get_lang('DownloadCertificate'),
                         $url,
-                        array('target' => '_blank')
+                        array(
+                            'target' => '_blank',
+                            'class' => 'btn'
+                        )
                     );
                     $exportToPDF = Display::url(
                         Display::return_icon(
@@ -1682,7 +1700,13 @@ class Category implements GradebookItem
         $catId,
         $userList = array()
     ) {
+        $orientation = api_get_configuration_value('certificate_pdf_orientation');
+
         $params['orientation'] = 'landscape';
+        if (!empty($orientation)) {
+            $params['orientation'] = $orientation;
+        }
+
         $params['left'] = 0;
         $params['right'] = 0;
         $params['top'] = 0;

+ 3 - 1
main/gradebook/lib/be/evallink.class.php

@@ -157,7 +157,8 @@ abstract class EvalLink extends AbstractLink
     /**
      * Lazy load function to get the linked evaluation
      */
-    protected function get_evaluation () {
+    protected function get_evaluation ()
+    {
         if (!isset($this->evaluation)) {
             if (isset($this->ref_id)) {
                 $evalarray = Evaluation::load($this->get_ref_id());
@@ -175,6 +176,7 @@ abstract class EvalLink extends AbstractLink
                 $this->set_ref_id($eval->get_id());
             }
         }
+
         return $this->evaluation;
     }
 }

+ 31 - 2
main/gradebook/lib/be/evaluation.class.php

@@ -17,16 +17,23 @@ class Evaluation implements GradebookItem
 	private $weight;
 	private $eval_max;
 	private $visible;
+	private $sessionId;
 
 	public function __construct()
 	{
 	}
 
+	/**
+	 * @return int
+	 */
 	public function get_id()
 	{
 		return $this->id;
 	}
 
+	/**
+	 * @return string
+	 */
 	public function get_name()
 	{
 		return $this->name;
@@ -47,6 +54,22 @@ class Evaluation implements GradebookItem
 		return $this->course_code;
 	}
 
+	/**
+	 * @return int
+	 */
+	public function getSessionId()
+	{
+		return $this->sessionId;
+	}
+
+	/**
+	 * @param int $sessionId
+	 */
+	public function setSessionId($sessionId)
+	{
+		$this->sessionId = intval($sessionId);
+	}
+
 	public function get_category_id()
 	{
 		return $this->category;
@@ -206,6 +229,10 @@ class Evaluation implements GradebookItem
 		return $alleval;
 	}
 
+	/**
+	 * @param array $result
+	 * @return array
+	 */
 	private static function create_evaluation_objects_from_sql_result($result)
 	{
 		$alleval=array();
@@ -224,10 +251,12 @@ class Evaluation implements GradebookItem
 				$eval->set_visible($data['visible']);
 				$eval->set_type($data['type']);
 				$eval->set_locked($data['locked']);
+				$eval->setSessionId(api_get_session_id());
 
-				$alleval[]=$eval;
+				$alleval[] = $eval;
 			}
 		}
+
 		return $alleval;
 	}
 
@@ -328,7 +357,7 @@ class Evaluation implements GradebookItem
 			$sql .= 'null';
 		}
 		$sql .= ', weight = "'.Database::escape_string($this->get_weight()).'" '
-			.', max = '.Database::escape_string($this->get_max())
+			.', max = '.intval($this->get_max())
 			.', visible = '.intval($this->is_visible())
 			.' WHERE id = '.intval($this->id);
 		//recorded history

+ 33 - 28
main/gradebook/lib/be/exerciselink.class.php

@@ -1,6 +1,8 @@
 <?php
 /* For licensing terms, see /license.txt */
+
 /**
+ * Class ExerciseLink
  * Defines a gradebook ExerciseLink object.
  * @author Bert Steppé
  * @package chamilo.gradebook
@@ -81,15 +83,15 @@ class ExerciseLink extends AbstractLink
 
         $sql2 = "SELECT d.path as path, d.comment as comment, ip.visibility as visibility, d.id
                 FROM $TBL_DOCUMENT d, $TBL_ITEM_PROPERTY ip
-                WHERE d.c_id = $this->course_id AND
-                      ip.c_id = $this->course_id AND
-                d.id = ip.ref AND ip.tool = '".TOOL_DOCUMENT."' AND (d.path LIKE '%htm%')AND (d.path LIKE '%HotPotatoes_files%')
-                AND   d.path  LIKE '".Database :: escape_string($uploadPath)."/%/%' AND ip.visibility='1'";
-
-        /*
-        $sql = 'SELECT id,title from '.$this->get_exercise_table().'
-				WHERE c_id = '.$this->course_id.' AND active=1 AND session_id='.api_get_session_id().'';
-        */
+                WHERE
+                    d.c_id = $this->course_id AND
+                    ip.c_id = $this->course_id AND
+                    d.id = ip.ref AND
+                    ip.tool = '".TOOL_DOCUMENT."' AND
+                    (d.path LIKE '%htm%')AND (d.path LIKE '%HotPotatoes_files%') AND
+                    d.path  LIKE '".Database :: escape_string($uploadPath.'/%/%')."' AND
+                    ip.visibility='1'
+                ";
         require_once api_get_path(SYS_CODE_PATH).'exercice/hotpotatoes.lib.php';
         if (!$this->is_hp) {
             $result = Database::query($sql);
@@ -116,9 +118,7 @@ class ExerciseLink extends AbstractLink
                     $attribute['id'] = $row['id'];
 
                     if (isset($attribute['path']) && is_array($attribute['path'])) {
-                        $hotpotatoes_exist = true;
                         while (list($key, $path) = each($attribute['path'])) {
-                            $item = '';
                             $title = GetQuizName($path, $documentPath);
                             if ($title == '') {
                                 $title = basename($path);
@@ -129,6 +129,7 @@ class ExerciseLink extends AbstractLink
                 }
             }
         }
+
         return $cats;
     }
 
@@ -137,12 +138,13 @@ class ExerciseLink extends AbstractLink
      */
     public function has_results()
     {
-        $tbl_stats = Database::get_statistic_table(TABLE_STATISTIC_TRACK_E_EXERCICES);
+        $tbl_stats = Database::get_main_table(TABLE_STATISTIC_TRACK_E_EXERCICES);
         $session_id = api_get_session_id();
         $sql = 'SELECT count(exe_id) AS number FROM '.$tbl_stats."
-                    WHERE   session_id = $session_id AND
-                            exe_cours_id = '".$this->get_course_code()."'".' AND
-                            exe_exo_id   = '.(int)$this->get_ref_id();
+                WHERE
+                    session_id = $session_id AND
+                    exe_cours_id = '".Database::escape_string($this->get_course_code())."'".' AND
+                    exe_exo_id   = '.(int)$this->get_ref_id();
         $result = Database::query($sql);
         $number=Database::fetch_row($result);
         return ($number[0] != 0);
@@ -150,15 +152,15 @@ class ExerciseLink extends AbstractLink
 
     /**
      * Get the score of this exercise. Only the first attempts are taken into account.
-     * @param $stud_id student id (default: all students who have results - then the average is returned)
+     * @param int $stud_id student id (default: all students who have results - then the average is returned)
      * @return	array (score, max) if student is given
      * 			array (sum of scores, number of scores) otherwise
      * 			or null if no scores available
      */
     public function calc_score($stud_id = null)
     {
-        $tblStats = Database::get_statistic_table(TABLE_STATISTIC_TRACK_E_EXERCICES);
-        $tblHp = Database::get_statistic_table(TABLE_STATISTIC_TRACK_E_HOTPOTATOES);
+        $tblStats = Database::get_main_table(TABLE_STATISTIC_TRACK_E_EXERCICES);
+        $tblHp = Database::get_main_table(TABLE_STATISTIC_TRACK_E_HOTPOTATOES);
         $tblDoc = Database::get_course_table(TABLE_DOCUMENT);
 
         /* the following query should be similar (in conditions) to the one used
@@ -196,7 +198,7 @@ class ExerciseLink extends AbstractLink
         if (isset($stud_id)) {
             // for 1 student
             if ($data = Database::fetch_array($scores)) {
-                return array ($data['exe_result'], $data['exe_weighting']);
+                return array($data['exe_result'], $data['exe_weighting']);
             } else {
                 return null;
             }
@@ -254,12 +256,11 @@ class ExerciseLink extends AbstractLink
         $data = $this->get_exercise_data();
         if ($this->is_hp == 1) {
             if (isset($data['path'])) {
-                $hotpotatoes_exist = true;
-                $item = '';
                 $title = GetQuizName($data['path'], $documentPath);
                 if ($title == '') {
                     $title = basename($data['path']);
                 }
+
                 return $title;
             }
         }
@@ -333,20 +334,23 @@ class ExerciseLink extends AbstractLink
      */
     private function get_exercise_data()
     {
+        $TBL_ITEM_PROPERTY = Database :: get_course_table(TABLE_ITEM_PROPERTY);
         if ($this->is_hp == 1) {
             $tbl_exercise = Database :: get_course_table(TABLE_DOCUMENT);
-            $TBL_ITEM_PROPERTY = Database :: get_course_table(TABLE_ITEM_PROPERTY);
         } else {
             $tbl_exercise = $this->get_exercise_table();
         }
-        if ($tbl_exercise=='') {
+
+        $ref_id = intval($this->get_ref_id());
+
+        if ($tbl_exercise == '') {
             return false;
         } elseif (!isset($this->exercise_data)) {
             if ($this->is_hp == 1) {
-                $ref_id = intval($this->get_ref_id());
-                $sql = "SELECT * FROM $tbl_exercise ex, $TBL_ITEM_PROPERTY ip
+                $sql = "SELECT * FROM $tbl_exercise ex
+                        INNER JOIN $TBL_ITEM_PROPERTY ip
+                        ON (ip.ref = ex.id AND ip.c_id = ex.c_id)
                         WHERE
-                            ip.ref = ex.id AND
                             ip.c_id = $this->course_id AND
                             ex.c_id = $this->course_id AND
                             ip.ref = $ref_id AND
@@ -358,11 +362,12 @@ class ExerciseLink extends AbstractLink
                 $sql = 'SELECT * FROM '.$tbl_exercise.'
                         WHERE
                             c_id = '.$this->course_id.' AND
-                            id = '.(int)$this->get_ref_id().' ';
+                            id = '.$ref_id.' ';
             }
             $result = Database::query($sql);
-            $this->exercise_data=Database::fetch_array($result);
+            $this->exercise_data = Database::fetch_array($result);
         }
+
         return $this->exercise_data;
     }
 

Some files were not shown because too many files changed in this diff