blog.php 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * BLOG HOMEPAGE
  5. * This file takes care of all blog navigation and displaying.
  6. * @package chamilo.blogs
  7. */
  8. /**
  9. * INIT
  10. */
  11. // name of the language file that needs to be included
  12. $language_file = "blog";
  13. $blog_id = intval($_GET['blog_id']);
  14. require_once '../inc/global.inc.php';
  15. $this_section=SECTION_COURSES;
  16. /* ACCESS RIGHTS */
  17. // notice for unauthorized people.
  18. api_protect_course_script(true);
  19. //session
  20. if(isset($_GET['id_session'])) {
  21. $_SESSION['id_session'] = intval($_GET['id_session']);
  22. }
  23. $lib_path = api_get_path(LIBRARY_PATH);
  24. require_once $lib_path.'blog.lib.php';
  25. require_once $lib_path.'fckeditor/fckeditor.php';
  26. $blog_table_attachment = Database::get_course_table(TABLE_BLOGS_ATTACHMENT);
  27. $nameTools = get_lang('Blogs');
  28. $DaysShort = api_get_week_days_short();
  29. $DaysLong = api_get_week_days_long();
  30. $MonthsLong = api_get_months_long();
  31. $current_page = $_GET['action'];
  32. /*
  33. PROCESSING
  34. */
  35. $safe_post_title = Security::remove_XSS($_POST['post_title']);
  36. $safe_post_file_comment = Security::remove_XSS($_POST['post_file_comment']);
  37. $safe_post_full_text = Security::remove_XSS(stripslashes(api_html_entity_decode($_POST['post_full_text'])), COURSEMANAGERLOWSECURITY);
  38. $safe_comment_text = Security::remove_XSS(stripslashes(api_html_entity_decode($_POST['comment_text'])), COURSEMANAGERLOWSECURITY);
  39. $safe_comment_title = Security::remove_XSS($_POST['comment_title']);
  40. $safe_task_name = Security::remove_XSS($_POST['task_name']);
  41. $safe_task_description = Security::remove_XSS($_POST['task_description']);
  42. if (!empty($_POST['new_post_submit']) AND !empty($_POST['post_title']))
  43. {
  44. Blog :: create_post($safe_post_title, $safe_post_full_text, $safe_post_file_comment,$blog_id);
  45. $return_message = array('type' => 'confirmation', 'message' => get_lang('BlogAdded'));
  46. }
  47. if (!empty($_POST['edit_post_submit']))
  48. {
  49. $safe_post_title = Security::remove_XSS($_POST['post_title']);
  50. Blog :: edit_post($_POST['post_id'], $safe_post_title, $safe_post_full_text, $blog_id);
  51. $return_message = array('type' => 'confirmation', 'message' => get_lang('BlogEdited'));
  52. }
  53. if (!empty($_POST['new_comment_submit']))
  54. {
  55. Blog :: create_comment($safe_comment_title, $safe_comment_text, $safe_post_file_comment,$blog_id, (int)$_GET['post_id'], $_POST['comment_parent_id']);
  56. $return_message = array('type' => 'confirmation', 'message' => get_lang('CommentAdded'));
  57. }
  58. if (!empty($_POST['new_task_submit']))
  59. {
  60. Blog :: create_task($blog_id, $safe_task_name, $safe_task_description, $_POST['chkArticleDelete'], $_POST['chkArticleEdit'], $_POST['chkCommentsDelete'], $_POST['task_color']);
  61. $return_message = array('type' => 'confirmation', 'message' => get_lang('TaskCreated'));
  62. }
  63. if (isset($_POST['edit_task_submit']))
  64. {
  65. Blog :: edit_task($_POST['blog_id'], $_POST['task_id'], $safe_task_name, $safe_task_description, $_POST['chkArticleDelete'], $_POST['chkArticleEdit'],$_POST['chkCommentsDelete'], $_POST['task_color']);
  66. $return_message = array('type' => 'confirmation', 'message' => get_lang('TaskEdited'));
  67. }
  68. if (!empty($_POST['assign_task_submit']))
  69. {
  70. Blog :: assign_task($blog_id, $_POST['task_user_id'], $_POST['task_task_id'], $_POST['task_year']."-".$_POST['task_month']."-".$_POST['task_day']);
  71. $return_message = array('type' => 'confirmation', 'message' => get_lang('TaskAssigned'));
  72. }
  73. if (isset($_POST['assign_task_edit_submit']))
  74. {
  75. Blog :: edit_assigned_task($blog_id, $_POST['task_user_id'], $_POST['task_task_id'], $_POST['task_year']."-".$_POST['task_month']."-".$_POST['task_day'], $_POST['old_user_id'], $_POST['old_task_id'], $_POST['old_target_date']);
  76. $return_message = array('type' => 'confirmation', 'message' => get_lang('AssignedTaskEdited'));
  77. }
  78. if (!empty($_POST['new_task_execution_submit']))
  79. {
  80. Blog :: create_comment($safe_comment_title, $safe_comment_text, $blog_id, (int)$_GET['post_id'], $_POST['comment_parent_id'], $_POST['task_id']);
  81. $return_message = array('type' => 'confirmation', 'message' => get_lang('CommentCreated'));
  82. }
  83. if (!empty($_POST['register']))
  84. {
  85. if (is_array($_POST['user'])) {
  86. foreach ($_POST['user'] as $index => $user_id)
  87. {
  88. Blog :: set_user_subscribed((int)$_GET['blog_id'], $user_id);
  89. }
  90. }
  91. }
  92. if (!empty($_POST['unregister']))
  93. {
  94. if (is_array($_POST['user'])) {
  95. foreach ($_POST['user'] as $index => $user_id)
  96. {
  97. Blog :: set_user_unsubscribed((int)$_GET['blog_id'], $user_id);
  98. }
  99. }
  100. }
  101. if (!empty($_GET['register']))
  102. {
  103. Blog :: set_user_subscribed((int)$_GET['blog_id'], (int)$_GET['user_id']);
  104. $return_message = array('type' => 'confirmation', 'message' => get_lang('UserRegistered'));
  105. $flag = 1;
  106. }
  107. if (!empty($_GET['unregister']))
  108. {
  109. Blog :: set_user_unsubscribed((int)$_GET['blog_id'], (int)$_GET['user_id']);
  110. }
  111. if (isset($_GET['action']) && $_GET['action'] == 'manage_tasks')
  112. {
  113. if (isset($_GET['do']) && $_GET['do'] == 'delete')
  114. {
  115. Blog :: delete_task($blog_id, (int)$_GET['task_id']);
  116. $return_message = array('type' => 'confirmation', 'message' => get_lang('TaskDeleted'));
  117. }
  118. if (isset($_GET['do']) && $_GET['do'] == 'delete_assignment')
  119. {
  120. Blog :: delete_assigned_task($blog_id, Database::escape_string((int)$_GET['task_id']), Database::escape_string((int)$_GET['user_id']));
  121. $return_message = array('type' => 'confirmation', 'message' => get_lang('TaskAssignmentDeleted'));
  122. }
  123. }
  124. if (isset($_GET['action']) && $_GET['action'] == 'view_post')
  125. {
  126. $task_id = (isset ($_GET['task_id']) && is_numeric($_GET['task_id'])) ? $_GET['task_id'] : 0;
  127. if (isset($_GET['do']) && $_GET['do'] == 'delete_comment')
  128. {
  129. if (api_is_allowed('BLOG_'.$blog_id, 'article_comments_delete', $task_id))
  130. {
  131. Blog :: delete_comment($blog_id, (int)$_GET['post_id'],(int)$_GET['comment_id']);
  132. $return_message = array('type' => 'confirmation', 'message' => get_lang('CommentDeleted'));
  133. }
  134. else
  135. {
  136. $error = true;
  137. $message = get_lang('ActionNotAllowed');
  138. }
  139. }
  140. if (isset($_GET['do']) && $_GET['do'] == 'delete_article')
  141. {
  142. if (api_is_allowed('BLOG_'.$blog_id, 'article_delete', $task_id))
  143. {
  144. Blog :: delete_post($blog_id, (int)$_GET['article_id']);
  145. $current_page = ''; // Article is gone, go to blog home
  146. $return_message = array('type' => 'confirmation', 'message' => get_lang('BlogDeleted'));
  147. }
  148. else
  149. {
  150. $error = true;
  151. $message = get_lang('ActionNotAllowed');
  152. }
  153. }
  154. if (isset($_GET['do']) && $_GET['do'] == 'rate')
  155. {
  156. if (isset($_GET['type']) && $_GET['type'] == 'post')
  157. {
  158. if (api_is_allowed('BLOG_'.$blog_id, 'article_rate'))
  159. {
  160. Blog :: add_rating('post', $blog_id, (int)$_GET['post_id'], (int)$_GET['rating']);
  161. $return_message = array('type' => 'confirmation', 'message' => get_lang('RatingAdded'));
  162. }
  163. }
  164. if (isset($_GET['type']) && $_GET['type'] == 'comment')
  165. {
  166. if (api_is_allowed('BLOG_'.$blog_id, 'article_comments_add'))
  167. {
  168. Blog :: add_rating('comment', $blog_id, (int)$_GET['comment_id'], (int)$_GET['rating']);
  169. $return_message = array('type' => 'confirmation', 'message' => get_lang('RatingAdded'));
  170. }
  171. }
  172. }
  173. }
  174. /*
  175. DISPLAY
  176. */
  177. $htmlHeadXtra[] = '<script src="tbl_change.js" type="text/javascript" language="javascript"></script>';
  178. // Set bredcrumb
  179. switch ($current_page)
  180. {
  181. case 'new_post' :
  182. $nameTools = get_lang('NewPost');
  183. $interbreadcrumb[] = array ('url' => "blog.php?blog_id=$blog_id", "name" => Blog :: get_blog_title($blog_id));
  184. Display :: display_header($nameTools, 'Blogs');
  185. break;
  186. case 'manage_tasks' :
  187. $nameTools = get_lang('TaskManager');
  188. $interbreadcrumb[] = array ('url' => "blog.php?blog_id=$blog_id", "name" => Blog :: get_blog_title($blog_id));
  189. Display :: display_header($nameTools, 'Blogs');
  190. break;
  191. case 'manage_members' :
  192. $nameTools = get_lang('MemberManager');
  193. $interbreadcrumb[] = array ('url' => "blog.php?blog_id=$blog_id", "name" => Blog :: get_blog_title($blog_id));
  194. Display :: display_header($nameTools, 'Blogs');
  195. break;
  196. case 'manage_rights' :
  197. $nameTools = get_lang('RightsManager');
  198. $interbreadcrumb[] = array ('url' => "blog.php?blog_id=$blog_id", 'name' => Blog :: get_blog_title($blog_id));
  199. Display :: display_header($nameTools, 'Blogs');
  200. break;
  201. case 'view_search_result' :
  202. $nameTools = get_lang('SearchResults');
  203. $interbreadcrumb[] = array ('url' => "blog.php?blog_id=$blog_id", 'name' => Blog :: get_blog_title($blog_id));
  204. Display :: display_header($nameTools, 'Blogs');
  205. break;
  206. case 'execute_task' :
  207. $nameTools = get_lang('ExecuteThisTask');
  208. $interbreadcrumb[] = array ('url' => "blog.php?blog_id=$blog_id", 'name' => Blog :: get_blog_title($blog_id));
  209. Display :: display_header($nameTools, 'Blogs');
  210. break;
  211. default :
  212. $nameTools = Blog :: get_blog_title($blog_id);
  213. Display :: display_header($nameTools, 'Blogs');
  214. }
  215. // feedback messages
  216. if (!empty($return_message))
  217. {
  218. if ($return_message['type'] == 'confirmation')
  219. {
  220. Display::display_confirmation_message($return_message['message']);
  221. }
  222. if ($return_message['type'] == 'error')
  223. {
  224. Display::display_error_message($return_message['message']);
  225. }
  226. }
  227. // actions
  228. echo '<div class=actions>';
  229. ?>
  230. <a href="<?php echo api_get_self(); ?>?blog_id=<?php echo $blog_id ?>" title="<?php echo get_lang('Home') ?>"><?php echo Display::return_icon('blog.png', get_lang('Home'),'','32'); ?></a>
  231. <?php if(api_is_allowed('BLOG_'.$blog_id, 'article_add')) { ?><a href="<?php echo api_get_self(); ?>?action=new_post&amp;blog_id=<?php echo $blog_id ?>" title="<?php echo get_lang('NewPost') ?>"><?php echo Display::return_icon('new_article.png', get_lang('NewPost'),'','32'); ?></a><?php } ?>
  232. <?php if(api_is_allowed('BLOG_'.$blog_id, 'task_management')) { ?><a href="<?php echo api_get_self(); ?>?action=manage_tasks&amp;blog_id=<?php echo $blog_id ?>" title="<?php echo get_lang('ManageTasks') ?>"><?php echo Display::return_icon('blog_tasks.png', get_lang('TaskManager'),'','32'); ?></a><?php } ?>
  233. <?php if(api_is_allowed('BLOG_'.$blog_id, 'member_management')) { ?><a href="<?php echo api_get_self(); ?>?action=manage_members&amp;blog_id=<?php echo $blog_id ?>" title="<?php echo get_lang('ManageMembers') ?>"><?php echo Display::return_icon('blog_admin_users.png', get_lang('MemberManager'),'','32'); ?></a><?php } ?>
  234. <?php
  235. echo '</div>';
  236. // Tool introduction
  237. Display::display_introduction_section(TOOL_BLOG);
  238. //Display::display_header($nameTools,'Blogs');
  239. ?>
  240. <div class="sectiontitle"><?php echo Blog::get_blog_title($blog_id); ?></div>
  241. <div class="sectioncomment"><?php echo Blog::get_blog_subtitle($blog_id); ?></div>
  242. <table width="100%">
  243. <tr>
  244. <td width="10%" style="float;left;" class="blog_left" valign="top">
  245. <?php
  246. $month = (int)$_GET['month'] ? (int)$_GET['month'] : (int) date('m');
  247. $year = (int)$_GET['year'] ? (int)$_GET['year'] : date('Y');
  248. Blog :: display_minimonthcalendar($month, $year, $blog_id);
  249. ?>
  250. <br />
  251. <br />
  252. <table width="100%">
  253. <tr>
  254. <td class="sectiontitle"><?php echo get_lang('Search') ?></td>
  255. </tr>
  256. <tr>
  257. <td class="blog_menu">
  258. <form action="blog.php" method="get" enctype="multipart/form-data">
  259. <input type="hidden" name="blog_id" value="<?php echo $blog_id ?>" />
  260. <input type="hidden" name="action" value="view_search_result" />
  261. <input type="text" size="20" name="q" value="<?php echo (isset($_GET['q']) ? $_GET['q'] : ''); ?>" /><button class="search" type="submit"><?php echo get_lang('Search'); ?></button>
  262. </form>
  263. </td>
  264. </tr>
  265. </table>
  266. <br />
  267. <table width="100%">
  268. <tr>
  269. <td class="sectiontitle"><?php echo get_lang('MyTasks') ?></td>
  270. </tr>
  271. <tr>
  272. <td class="blog_menu">
  273. <?php Blog::get_personal_task_list(); ?>
  274. </td>
  275. </tr>
  276. </table>
  277. <!--
  278. <br />
  279. <table width="100%">
  280. <tr>
  281. <td class="blog_menu_title"><?php echo get_lang('FavoriteBlogs') ?></td>
  282. </tr>
  283. <tr>
  284. <td class="blog_menu">
  285. <ul>
  286. <li>Favorite 1</li>
  287. <li>Favorite 2</li>
  288. <li>Favorite 3</li>
  289. </ul>
  290. </td>
  291. </tr>
  292. </table>
  293. <br />
  294. <table width="100%">
  295. <tr>
  296. <td class="blog_menu_title"><?php echo get_lang('TopTen') ?></td>
  297. </tr>
  298. <tr>
  299. <td class="blog_menu">
  300. <ul>
  301. <li>Blog 1</li>
  302. <li>Blog 2</li>
  303. <li>Blog 3</li>
  304. </ul>
  305. </td>
  306. </tr>
  307. </table>
  308. -->
  309. </td>
  310. <td valign="top" class="blog_right">
  311. <?php
  312. if ($error)
  313. Display :: display_error_message($message);
  314. if ($flag == '1')
  315. {
  316. $current_page = "manage_tasks";
  317. Blog :: display_assign_task_form($blog_id);
  318. }
  319. $user_task = false;
  320. if (isset ($_GET['task_id']) && is_numeric($_GET['task_id'])) {
  321. $task_id = (int)$_GET['task_id'];
  322. } else {
  323. $task_id = 0;
  324. $tbl_blogs_tasks_rel_user = Database :: get_course_table(TABLE_BLOGS_TASKS_REL_USER);
  325. $sql = "SELECT COUNT(*) as number
  326. FROM ".$tbl_blogs_tasks_rel_user."
  327. WHERE
  328. blog_id = ".$blog_id." AND
  329. user_id = ".api_get_user_id()." AND
  330. task_id = ".$task_id;
  331. $result = Database::query($sql);
  332. $row = Database::fetch_array($result);
  333. if ($row['number'] == 1)
  334. $user_task = true;
  335. }
  336. switch ($current_page) {
  337. case 'new_post' :
  338. if (api_is_allowed('BLOG_'.$blog_id, 'article_add', $user_task ? $task_id : 0))
  339. {
  340. // we show the form if
  341. // 1. no post data
  342. // 2. there is post data and the required field is empty
  343. if (!$_POST OR (!empty($_POST) AND empty($_POST['post_title'])))
  344. {
  345. // if there is post data there is certainly an error in the form
  346. if ($_POST)
  347. {
  348. Display::display_error_message(get_lang('FormHasErrorsPleaseComplete'));
  349. }
  350. Blog :: display_form_new_post($blog_id);
  351. }
  352. else
  353. {
  354. if (isset ($_GET['filter']) && !empty ($_GET['filter']))
  355. {
  356. Blog :: display_day_results($blog_id, Database::escape_string($_GET['filter']));
  357. }
  358. else
  359. {
  360. Blog :: display_blog_posts($blog_id);
  361. }
  362. }
  363. }
  364. else
  365. {
  366. api_not_allowed();
  367. }
  368. break;
  369. case 'view_post' :
  370. Blog :: display_post($blog_id, Database::escape_string((int)$_GET['post_id']));
  371. break;
  372. case 'edit_post' :
  373. $task_id = (isset ($_GET['task_id']) && is_numeric($_GET['task_id'])) ? $_GET['task_id'] : 0;
  374. if (api_is_allowed('BLOG_'.$blog_id, 'article_edit', $task_id))
  375. {
  376. // we show the form if
  377. // 1. no post data
  378. // 2. there is post data and the required field is empty
  379. if (!$_POST OR (!empty($_POST) AND empty($_POST['post_title'])))
  380. {
  381. // if there is post data there is certainly an error in the form
  382. if ($_POST)
  383. {
  384. Display::display_error_message(get_lang('FormHasErrorsPleaseComplete'));
  385. }
  386. Blog :: display_form_edit_post($blog_id, Database::escape_string((int)$_GET['post_id']));
  387. }
  388. else
  389. {
  390. if (isset ($_GET['filter']) && !empty ($_GET['filter']))
  391. {
  392. Blog :: display_day_results($blog_id, Database::escape_string($_GET['filter']));
  393. }
  394. else
  395. {
  396. Blog :: display_blog_posts($blog_id);
  397. }
  398. }
  399. }
  400. else
  401. {
  402. api_not_allowed();
  403. }
  404. break;
  405. case 'manage_members' :
  406. if (api_is_allowed('BLOG_'.$blog_id, 'member_management'))
  407. {
  408. Blog :: display_form_user_subscribe($blog_id);
  409. echo '<br /><br />';
  410. Blog :: display_form_user_unsubscribe($blog_id);
  411. }
  412. else
  413. api_not_allowed();
  414. break;
  415. case 'manage_rights' :
  416. Blog :: display_form_user_rights($blog_id);
  417. break;
  418. case 'manage_tasks' :
  419. if (api_is_allowed('BLOG_'.$blog_id, 'task_management'))
  420. {
  421. if (isset($_GET['do']) && $_GET['do'] == 'add')
  422. {
  423. Blog :: display_new_task_form($blog_id);
  424. }
  425. if (isset($_GET['do']) && $_GET['do'] == 'assign')
  426. {
  427. Blog :: display_assign_task_form($blog_id);
  428. }
  429. if (isset($_GET['do']) && $_GET['do'] == 'edit')
  430. {
  431. Blog :: display_edit_task_form($blog_id, Database::escape_string($_GET['task_id']));
  432. }
  433. if (isset($_GET['do']) && $_GET['do'] == 'edit_assignment')
  434. {
  435. Blog :: display_edit_assigned_task_form($blog_id, Database::escape_string((int)$_GET['task_id']), Database::escape_string((int)$_GET['user_id']));
  436. }
  437. Blog :: display_task_list($blog_id);
  438. echo '<br /><br />';
  439. Blog :: display_assigned_task_list($blog_id);
  440. echo '<br /><br />';
  441. }
  442. else
  443. api_not_allowed();
  444. break;
  445. case 'execute_task' :
  446. if (isset ($_GET['post_id']))
  447. Blog :: display_post($blog_id, Database::escape_string((int)$_GET['post_id']));
  448. else
  449. Blog :: display_select_task_post($blog_id, Database::escape_string((int)$_GET['task_id']));
  450. break;
  451. case 'view_search_result' :
  452. Blog :: display_search_results($blog_id, Database::escape_string($_GET['q']));
  453. break;
  454. case '' :
  455. default :
  456. if (isset ($_GET['filter']) && !empty ($_GET['filter']))
  457. {
  458. Blog :: display_day_results($blog_id, Database::escape_string($_GET['filter']));
  459. }
  460. else
  461. {
  462. Blog :: display_blog_posts($blog_id);
  463. }
  464. }
  465. ?>
  466. </td>
  467. </tr>
  468. </table>
  469. <?php
  470. // Display the footer
  471. Display::display_footer();