blog.php 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * BLOG HOMEPAGE
  5. * This file takes care of all blog navigation and displaying.
  6. * @package chamilo.blogs
  7. */
  8. /**
  9. * INIT
  10. */
  11. // name of the language file that needs to be included
  12. $language_file = "blog";
  13. require_once '../inc/global.inc.php';
  14. $blog_id = intval($_GET['blog_id']);
  15. if (empty($blog_id)) {
  16. api_not_allowed(true);
  17. }
  18. $this_section = SECTION_COURSES;
  19. $current_course_tool = TOOL_BLOGS;
  20. /* ACCESS RIGHTS */
  21. // notice for unauthorized people.
  22. api_protect_course_script(true);
  23. //session
  24. if(isset($_GET['id_session'])) {
  25. $_SESSION['id_session'] = intval($_GET['id_session']);
  26. }
  27. $lib_path = api_get_path(LIBRARY_PATH);
  28. require_once $lib_path.'blog.lib.php';
  29. require_once $lib_path.'fckeditor/fckeditor.php';
  30. $blog_table_attachment = Database::get_course_table(TABLE_BLOGS_ATTACHMENT);
  31. $nameTools = get_lang('Blogs');
  32. $DaysShort = api_get_week_days_short();
  33. $DaysLong = api_get_week_days_long();
  34. $MonthsLong = api_get_months_long();
  35. $current_page = $_GET['action'];
  36. /*
  37. PROCESSING
  38. */
  39. $safe_post_title = Security::remove_XSS($_POST['post_title']);
  40. $safe_post_file_comment = Security::remove_XSS($_POST['post_file_comment']);
  41. $safe_post_full_text = Security::remove_XSS(stripslashes(api_html_entity_decode($_POST['post_full_text'])), COURSEMANAGERLOWSECURITY);
  42. $safe_comment_text = Security::remove_XSS(stripslashes(api_html_entity_decode($_POST['comment_text'])), COURSEMANAGERLOWSECURITY);
  43. $safe_comment_title = Security::remove_XSS($_POST['comment_title']);
  44. $safe_task_name = Security::remove_XSS($_POST['task_name']);
  45. $safe_task_description = Security::remove_XSS($_POST['task_description']);
  46. if (!empty($_POST['new_post_submit']) AND !empty($_POST['post_title'])) {
  47. Blog :: create_post($safe_post_title, $safe_post_full_text, $safe_post_file_comment,$blog_id);
  48. $return_message = array('type' => 'confirmation', 'message' => get_lang('BlogAdded'));
  49. }
  50. if (!empty($_POST['edit_post_submit']))
  51. {
  52. $safe_post_title = Security::remove_XSS($_POST['post_title']);
  53. Blog :: edit_post($_POST['post_id'], $safe_post_title, $safe_post_full_text, $blog_id);
  54. $return_message = array('type' => 'confirmation', 'message' => get_lang('BlogEdited'));
  55. }
  56. if (!empty($_POST['new_comment_submit']))
  57. {
  58. Blog :: create_comment($safe_comment_title, $safe_comment_text, $safe_post_file_comment,$blog_id, (int)$_GET['post_id'], $_POST['comment_parent_id']);
  59. $return_message = array('type' => 'confirmation', 'message' => get_lang('CommentAdded'));
  60. }
  61. if (!empty($_POST['new_task_submit']))
  62. {
  63. Blog :: create_task($blog_id, $safe_task_name, $safe_task_description, $_POST['chkArticleDelete'], $_POST['chkArticleEdit'], $_POST['chkCommentsDelete'], $_POST['task_color']);
  64. $return_message = array('type' => 'confirmation', 'message' => get_lang('TaskCreated'));
  65. }
  66. if (isset($_POST['edit_task_submit']))
  67. {
  68. Blog :: edit_task($_POST['blog_id'], $_POST['task_id'], $safe_task_name, $safe_task_description, $_POST['chkArticleDelete'], $_POST['chkArticleEdit'],$_POST['chkCommentsDelete'], $_POST['task_color']);
  69. $return_message = array('type' => 'confirmation', 'message' => get_lang('TaskEdited'));
  70. }
  71. if (!empty($_POST['assign_task_submit']))
  72. {
  73. Blog :: assign_task($blog_id, $_POST['task_user_id'], $_POST['task_task_id'], $_POST['task_year']."-".$_POST['task_month']."-".$_POST['task_day']);
  74. $return_message = array('type' => 'confirmation', 'message' => get_lang('TaskAssigned'));
  75. }
  76. if (isset($_POST['assign_task_edit_submit']))
  77. {
  78. Blog :: edit_assigned_task($blog_id, $_POST['task_user_id'], $_POST['task_task_id'], $_POST['task_year']."-".$_POST['task_month']."-".$_POST['task_day'], $_POST['old_user_id'], $_POST['old_task_id'], $_POST['old_target_date']);
  79. $return_message = array('type' => 'confirmation', 'message' => get_lang('AssignedTaskEdited'));
  80. }
  81. if (!empty($_POST['new_task_execution_submit']))
  82. {
  83. Blog :: create_comment($safe_comment_title, $safe_comment_text, $blog_id, (int)$_GET['post_id'], $_POST['comment_parent_id'], $_POST['task_id']);
  84. $return_message = array('type' => 'confirmation', 'message' => get_lang('CommentCreated'));
  85. }
  86. if (!empty($_POST['register']))
  87. {
  88. if (is_array($_POST['user'])) {
  89. foreach ($_POST['user'] as $index => $user_id)
  90. {
  91. Blog :: set_user_subscribed((int)$_GET['blog_id'], $user_id);
  92. }
  93. }
  94. }
  95. if (!empty($_POST['unregister']))
  96. {
  97. if (is_array($_POST['user'])) {
  98. foreach ($_POST['user'] as $index => $user_id)
  99. {
  100. Blog :: set_user_unsubscribed((int)$_GET['blog_id'], $user_id);
  101. }
  102. }
  103. }
  104. if (!empty($_GET['register']))
  105. {
  106. Blog :: set_user_subscribed((int)$_GET['blog_id'], (int)$_GET['user_id']);
  107. $return_message = array('type' => 'confirmation', 'message' => get_lang('UserRegistered'));
  108. $flag = 1;
  109. }
  110. if (!empty($_GET['unregister']))
  111. {
  112. Blog :: set_user_unsubscribed((int)$_GET['blog_id'], (int)$_GET['user_id']);
  113. }
  114. if (isset($_GET['action']) && $_GET['action'] == 'manage_tasks')
  115. {
  116. if (isset($_GET['do']) && $_GET['do'] == 'delete')
  117. {
  118. Blog :: delete_task($blog_id, (int)$_GET['task_id']);
  119. $return_message = array('type' => 'confirmation', 'message' => get_lang('TaskDeleted'));
  120. }
  121. if (isset($_GET['do']) && $_GET['do'] == 'delete_assignment')
  122. {
  123. Blog :: delete_assigned_task($blog_id, Database::escape_string((int)$_GET['task_id']), Database::escape_string((int)$_GET['user_id']));
  124. $return_message = array('type' => 'confirmation', 'message' => get_lang('TaskAssignmentDeleted'));
  125. }
  126. }
  127. if (isset($_GET['action']) && $_GET['action'] == 'view_post')
  128. {
  129. $task_id = (isset ($_GET['task_id']) && is_numeric($_GET['task_id'])) ? $_GET['task_id'] : 0;
  130. if (isset($_GET['do']) && $_GET['do'] == 'delete_comment')
  131. {
  132. if (api_is_allowed('BLOG_'.$blog_id, 'article_comments_delete', $task_id))
  133. {
  134. Blog :: delete_comment($blog_id, (int)$_GET['post_id'],(int)$_GET['comment_id']);
  135. $return_message = array('type' => 'confirmation', 'message' => get_lang('CommentDeleted'));
  136. }
  137. else
  138. {
  139. $error = true;
  140. $message = get_lang('ActionNotAllowed');
  141. }
  142. }
  143. if (isset($_GET['do']) && $_GET['do'] == 'delete_article')
  144. {
  145. if (api_is_allowed('BLOG_'.$blog_id, 'article_delete', $task_id))
  146. {
  147. Blog :: delete_post($blog_id, (int)$_GET['article_id']);
  148. $current_page = ''; // Article is gone, go to blog home
  149. $return_message = array('type' => 'confirmation', 'message' => get_lang('BlogDeleted'));
  150. }
  151. else
  152. {
  153. $error = true;
  154. $message = get_lang('ActionNotAllowed');
  155. }
  156. }
  157. if (isset($_GET['do']) && $_GET['do'] == 'rate')
  158. {
  159. if (isset($_GET['type']) && $_GET['type'] == 'post')
  160. {
  161. if (api_is_allowed('BLOG_'.$blog_id, 'article_rate'))
  162. {
  163. Blog :: add_rating('post', $blog_id, (int)$_GET['post_id'], (int)$_GET['rating']);
  164. $return_message = array('type' => 'confirmation', 'message' => get_lang('RatingAdded'));
  165. }
  166. }
  167. if (isset($_GET['type']) && $_GET['type'] == 'comment')
  168. {
  169. if (api_is_allowed('BLOG_'.$blog_id, 'article_comments_add'))
  170. {
  171. Blog :: add_rating('comment', $blog_id, (int)$_GET['comment_id'], (int)$_GET['rating']);
  172. $return_message = array('type' => 'confirmation', 'message' => get_lang('RatingAdded'));
  173. }
  174. }
  175. }
  176. }
  177. /*
  178. DISPLAY
  179. */
  180. $htmlHeadXtra[] = '<script src="tbl_change.js" type="text/javascript"></script>';
  181. // Set bredcrumb
  182. switch ($current_page)
  183. {
  184. case 'new_post' :
  185. $nameTools = get_lang('NewPost');
  186. $interbreadcrumb[] = array ('url' => "blog.php?blog_id=$blog_id", "name" => Blog :: get_blog_title($blog_id));
  187. Display :: display_header($nameTools, 'Blogs');
  188. break;
  189. case 'manage_tasks' :
  190. $nameTools = get_lang('TaskManager');
  191. $interbreadcrumb[] = array ('url' => "blog.php?blog_id=$blog_id", "name" => Blog :: get_blog_title($blog_id));
  192. Display :: display_header($nameTools, 'Blogs');
  193. break;
  194. case 'manage_members' :
  195. $nameTools = get_lang('MemberManager');
  196. $interbreadcrumb[] = array ('url' => "blog.php?blog_id=$blog_id", "name" => Blog :: get_blog_title($blog_id));
  197. Display :: display_header($nameTools, 'Blogs');
  198. break;
  199. case 'manage_rights' :
  200. $nameTools = get_lang('RightsManager');
  201. $interbreadcrumb[] = array ('url' => "blog.php?blog_id=$blog_id", 'name' => Blog :: get_blog_title($blog_id));
  202. Display :: display_header($nameTools, 'Blogs');
  203. break;
  204. case 'view_search_result' :
  205. $nameTools = get_lang('SearchResults');
  206. $interbreadcrumb[] = array ('url' => "blog.php?blog_id=$blog_id", 'name' => Blog :: get_blog_title($blog_id));
  207. Display :: display_header($nameTools, 'Blogs');
  208. break;
  209. case 'execute_task' :
  210. $nameTools = get_lang('ExecuteThisTask');
  211. $interbreadcrumb[] = array ('url' => "blog.php?blog_id=$blog_id", 'name' => Blog :: get_blog_title($blog_id));
  212. Display :: display_header($nameTools, 'Blogs');
  213. break;
  214. default :
  215. $nameTools = Blog :: get_blog_title($blog_id);
  216. Display :: display_header($nameTools, 'Blogs');
  217. }
  218. // feedback messages
  219. if (!empty($return_message))
  220. {
  221. if ($return_message['type'] == 'confirmation')
  222. {
  223. Display::display_confirmation_message($return_message['message']);
  224. }
  225. if ($return_message['type'] == 'error')
  226. {
  227. Display::display_error_message($return_message['message']);
  228. }
  229. }
  230. // actions
  231. echo '<div class=actions>';
  232. ?>
  233. <a href="<?php echo api_get_self(); ?>?blog_id=<?php echo $blog_id ?>" title="<?php echo get_lang('Home') ?>"><?php echo Display::return_icon('blog.png', get_lang('Home'),'',ICON_SIZE_MEDIUM); ?></a>
  234. <?php if(api_is_allowed('BLOG_'.$blog_id, 'article_add')) { ?><a href="<?php echo api_get_self(); ?>?action=new_post&amp;blog_id=<?php echo $blog_id ?>" title="<?php echo get_lang('NewPost') ?>"><?php echo Display::return_icon('new_article.png', get_lang('NewPost'),'',ICON_SIZE_MEDIUM); ?></a><?php } ?>
  235. <?php if(api_is_allowed('BLOG_'.$blog_id, 'task_management')) { ?><a href="<?php echo api_get_self(); ?>?action=manage_tasks&amp;blog_id=<?php echo $blog_id ?>" title="<?php echo get_lang('ManageTasks') ?>"><?php echo Display::return_icon('blog_tasks.png', get_lang('TaskManager'),'',ICON_SIZE_MEDIUM); ?></a><?php } ?>
  236. <?php if(api_is_allowed('BLOG_'.$blog_id, 'member_management')) { ?><a href="<?php echo api_get_self(); ?>?action=manage_members&amp;blog_id=<?php echo $blog_id ?>" title="<?php echo get_lang('ManageMembers') ?>"><?php echo Display::return_icon('blog_admin_users.png', get_lang('MemberManager'),'',ICON_SIZE_MEDIUM); ?></a><?php } ?>
  237. <?php
  238. echo '</div>';
  239. // Tool introduction
  240. Display::display_introduction_section(TOOL_BLOG);
  241. //Display::display_header($nameTools,'Blogs');
  242. ?>
  243. <div class="sectiontitle"><?php echo Blog::get_blog_title($blog_id); ?></div>
  244. <div class="sectioncomment"><?php echo Blog::get_blog_subtitle($blog_id); ?></div>
  245. <table width="100%">
  246. <tr>
  247. <td width="10%" style="float;left;" class="blog_left" valign="top">
  248. <?php
  249. $month = (int)$_GET['month'] ? (int)$_GET['month'] : (int) date('m');
  250. $year = (int)$_GET['year'] ? (int)$_GET['year'] : date('Y');
  251. Blog :: display_minimonthcalendar($month, $year, $blog_id);
  252. ?>
  253. <br />
  254. <br />
  255. <table width="100%">
  256. <tr>
  257. <td class="sectiontitle"><?php echo get_lang('Search') ?></td>
  258. </tr>
  259. <tr>
  260. <td class="blog_menu">
  261. <form action="blog.php" method="get" enctype="multipart/form-data">
  262. <input type="hidden" name="blog_id" value="<?php echo $blog_id ?>" />
  263. <input type="hidden" name="action" value="view_search_result" />
  264. <input type="text" size="20" name="q" value="<?php echo isset($_GET['q']) ? Security::remove_XSS($_GET['q']) : ''; ?>" /><button class="btn search" type="submit"><?php echo get_lang('Search'); ?></button>
  265. </form>
  266. </td>
  267. </tr>
  268. </table>
  269. <br />
  270. <table width="100%">
  271. <tr>
  272. <td class="sectiontitle"><?php echo get_lang('MyTasks') ?></td>
  273. </tr>
  274. <tr>
  275. <td class="blog_menu">
  276. <?php Blog::get_personal_task_list(); ?>
  277. </td>
  278. </tr>
  279. </table>
  280. </td>
  281. <td valign="top" class="blog_right">
  282. <?php
  283. if ($error)
  284. Display :: display_error_message($message);
  285. if ($flag == '1')
  286. {
  287. $current_page = "manage_tasks";
  288. Blog :: display_assign_task_form($blog_id);
  289. }
  290. $user_task = false;
  291. $course_id = api_get_course_int_id();
  292. if (isset ($_GET['task_id']) && is_numeric($_GET['task_id'])) {
  293. $task_id = (int)$_GET['task_id'];
  294. } else {
  295. $task_id = 0;
  296. $tbl_blogs_tasks_rel_user = Database :: get_course_table(TABLE_BLOGS_TASKS_REL_USER);
  297. $sql = "SELECT COUNT(*) as number
  298. FROM ".$tbl_blogs_tasks_rel_user."
  299. WHERE
  300. c_id = $course_id AND
  301. blog_id = ".$blog_id." AND
  302. user_id = ".api_get_user_id()." AND
  303. task_id = ".$task_id;
  304. $result = Database::query($sql);
  305. $row = Database::fetch_array($result);
  306. if ($row['number'] == 1)
  307. $user_task = true;
  308. }
  309. switch ($current_page) {
  310. case 'new_post' :
  311. if (api_is_allowed('BLOG_'.$blog_id, 'article_add', $user_task ? $task_id : 0)) {
  312. // we show the form if
  313. // 1. no post data
  314. // 2. there is post data and the required field is empty
  315. if (!$_POST OR (!empty($_POST) AND empty($_POST['post_title']))) {
  316. // if there is post data there is certainly an error in the form
  317. if ($_POST) {
  318. Display::display_error_message(get_lang('FormHasErrorsPleaseComplete'));
  319. }
  320. Blog :: display_form_new_post($blog_id);
  321. }
  322. else
  323. {
  324. if (isset ($_GET['filter']) && !empty ($_GET['filter']))
  325. {
  326. Blog :: display_day_results($blog_id, Database::escape_string($_GET['filter']));
  327. }
  328. else
  329. {
  330. Blog :: display_blog_posts($blog_id);
  331. }
  332. }
  333. }
  334. else
  335. {
  336. api_not_allowed();
  337. }
  338. break;
  339. case 'view_post' :
  340. Blog :: display_post($blog_id, Database::escape_string((int)$_GET['post_id']));
  341. break;
  342. case 'edit_post' :
  343. $task_id = (isset ($_GET['task_id']) && is_numeric($_GET['task_id'])) ? $_GET['task_id'] : 0;
  344. if (api_is_allowed('BLOG_'.$blog_id, 'article_edit', $task_id))
  345. {
  346. // we show the form if
  347. // 1. no post data
  348. // 2. there is post data and the required field is empty
  349. if (!$_POST OR (!empty($_POST) AND empty($_POST['post_title'])))
  350. {
  351. // if there is post data there is certainly an error in the form
  352. if ($_POST)
  353. {
  354. Display::display_error_message(get_lang('FormHasErrorsPleaseComplete'));
  355. }
  356. Blog :: display_form_edit_post($blog_id, Database::escape_string((int)$_GET['post_id']));
  357. }
  358. else
  359. {
  360. if (isset ($_GET['filter']) && !empty ($_GET['filter']))
  361. {
  362. Blog :: display_day_results($blog_id, Database::escape_string($_GET['filter']));
  363. }
  364. else
  365. {
  366. Blog :: display_blog_posts($blog_id);
  367. }
  368. }
  369. }
  370. else
  371. {
  372. api_not_allowed();
  373. }
  374. break;
  375. case 'manage_members' :
  376. if (api_is_allowed('BLOG_'.$blog_id, 'member_management'))
  377. {
  378. Blog :: display_form_user_subscribe($blog_id);
  379. echo '<br /><br />';
  380. Blog :: display_form_user_unsubscribe($blog_id);
  381. }
  382. else
  383. api_not_allowed();
  384. break;
  385. case 'manage_rights' :
  386. Blog :: display_form_user_rights($blog_id);
  387. break;
  388. case 'manage_tasks' :
  389. if (api_is_allowed('BLOG_'.$blog_id, 'task_management'))
  390. {
  391. if (isset($_GET['do']) && $_GET['do'] == 'add')
  392. {
  393. Blog :: display_new_task_form($blog_id);
  394. }
  395. if (isset($_GET['do']) && $_GET['do'] == 'assign')
  396. {
  397. Blog :: display_assign_task_form($blog_id);
  398. }
  399. if (isset($_GET['do']) && $_GET['do'] == 'edit')
  400. {
  401. Blog :: display_edit_task_form($blog_id, Database::escape_string($_GET['task_id']));
  402. }
  403. if (isset($_GET['do']) && $_GET['do'] == 'edit_assignment')
  404. {
  405. Blog :: display_edit_assigned_task_form($blog_id, Database::escape_string((int)$_GET['task_id']), Database::escape_string((int)$_GET['user_id']));
  406. }
  407. Blog :: display_task_list($blog_id);
  408. echo '<br /><br />';
  409. Blog :: display_assigned_task_list($blog_id);
  410. echo '<br /><br />';
  411. }
  412. else
  413. api_not_allowed();
  414. break;
  415. case 'execute_task' :
  416. if (isset ($_GET['post_id']))
  417. Blog :: display_post($blog_id, Database::escape_string((int)$_GET['post_id']));
  418. else
  419. Blog :: display_select_task_post($blog_id, Database::escape_string((int)$_GET['task_id']));
  420. break;
  421. case 'view_search_result' :
  422. Blog :: display_search_results($blog_id, Database::escape_string($_GET['q']));
  423. break;
  424. case '' :
  425. default :
  426. if (isset ($_GET['filter']) && !empty ($_GET['filter']))
  427. {
  428. Blog :: display_day_results($blog_id, Database::escape_string($_GET['filter']));
  429. }
  430. else
  431. {
  432. Blog :: display_blog_posts($blog_id);
  433. }
  434. }
  435. ?>
  436. </td>
  437. </tr>
  438. </table>
  439. <?php
  440. // Display the footer
  441. Display::display_footer();