minor bug fix to add the missing string definition 'remove' back to the /lang/zh_tw/moodle.php

Authorize.net / SSL Config Bug prevents display of options from enrol/authorize/enrol.php

README.txt

@@ -1,6 +1,15 @@
 README     $Id$
 ------
 
+NOTE!
+=====
+
+Moodle 1.5 is no longer officially supported by Moodle developers.
+
+You would be much better off moving to a more recent version of Moodle.
+
+
+
 QUICK INSTALL
 =============
 

admin/auth.php

@@ -32,7 +32,6 @@
         }
 
         if (count($err) == 0) {
-            print_header();
             foreach ($config as $name => $value) {
                 if (preg_match('/^pluginconfig_(.+?)$/', $name, $matches)) {
                     $plugin = "auth/$auth";

admin/backup.php

@@ -54,7 +54,6 @@
         $config = (object)$a_config;
         //weekdays conversions done. Continue
 
-        print_header();
         foreach ($config as $name => $value) {
             backup_set_config($name, $value);
         }

admin/block.php

@@ -47,7 +47,6 @@
             unset($config->$item);
         }
         $block->config_save($config);
-        print_header();
         redirect("$CFG->wwwroot/$CFG->admin/blocks.php", get_string("changessaved"), 1);
         exit;
     }

admin/config.php

@@ -30,10 +30,9 @@
         validate_form($config, $err);
 
         if (count($err) == 0) {
-            print_header();
             foreach ($config as $name => $value) {
                 if ($name == "sessioncookie") {
-                    $value = eregi_replace("[^a-zA-Z]", "", $value);
+                    $value = eregi_replace("[^a-zA-Z0-9_]", "", $value);
                 }
                 unset($conf);
                 $conf->name  = $name;

admin/configvars.php

@@ -74,6 +74,9 @@ class configvar {
     $misc['debug'] = new configvar (get_string('configdebug', 'admin'),
         choose_from_menu ($options, 'debug', $config->debug, '', '', '', true) );
 
+    $misc['perfdebug'] = new configvar (get_string('configperfdebug', 'admin'),
+        choose_from_menu ($options, 'perfdebug', $config->perfdebug, '', '', '', true) );
+
 /// enablerssfeeds
 class configvarrss extends configvar {
     function display_warning() {
@@ -135,6 +138,9 @@ class configvarrss extends configvar {
     $operatingsystem['unzip'] = new configvar (get_string('configunzip', 'admin'),
         '<input name="unzip" type="text" size="30" value="'.s($config->unzip).'" alt="unzip" />' );
 
+    $operatingsystem['pathtodu'] = new configvar(get_string('configpathtodu', 'admin'),
+        '<input name="pathtodu" type="text" size="30" value="'.s($config->pathtodu).'" alt="pathtodu" />');                                                
+
 /// slasharguments
     unset($options);
     $options[0] = "file.php?file=/pic.jpg";

admin/editor.php

@@ -178,7 +178,7 @@ function editor_get_dictionaries () {
     $dictionaries = array();
     $dicts        = array();
 
-    if(!($handle = @popen($cmd .' dump dicts', 'r'))) {
+    if(!($handle = @popen(escapeshellarg($cmd) .' dump dicts', 'r'))) {
         return $strerror = "Couldn't create handle!";
         exit;
     }

admin/environment.php

@@ -96,7 +96,7 @@
     }
 
 /// Print form and popup menu
-    echo '<center><form method="post" action="'.$CFG->wwwroot.'/admin/environment.php">';
+    echo '<center><form method="post" action="environment.php">';
     echo $strmoodleversion.' ';
     choose_from_menu ($versions, 'version', $version, null, 'this.form.submit();' );
     echo '<input type="hidden" name="sesskey" value="'.$USER->sesskey.'" />';
@@ -107,22 +107,6 @@
 /// Gather and show results
     $status = check_moodle_environment($version, $environment_results);
 
-
-
-/// Process action
-    if ($form = data_submitted()) {
-        if (confirm_sesskey()) {
-            if ($form->action == "disable") {
-
-            } else {
-
-            }
-        }
-    }
-
-/// Default action, show explanation and popup menu
-
-
 /// Print footer
     print_footer();
 ?>

admin/environment.xml

@@ -12,13 +12,54 @@
   </MOODLE>
   <MOODLE version="1.6">
     <DATABASE level="required">
-      <VENDOR name="mysql" version="4.1.12" />
+      <VENDOR name="mysql" version="4.1.16">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
+      </VENDOR>
       <VENDOR name="postgres" version="7.4" />
     </DATABASE>
     <PHP version="4.3.0" level="required" />
     <PHP_EXTENSIONS>
-      <PHP_EXTENSION name="iconv" level="optional" />
-      <PHP_EXTENSION name="mbstring" level="optional" />
+      <PHP_EXTENSION name="iconv" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+  </MOODLE>
+  <MOODLE version="1.7">
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="4.1.16">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
+      </VENDOR>
+      <VENDOR name="postgres" version="7.4" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="oracle" version="9.0" />
+    </DATABASE>
+    <PHP version="4.3.0" level="required">
+       <RESTRICT function="restrict_php50_version" message="php50restricted" />
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
     </PHP_EXTENSIONS>
   </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/handlevirus.php

@@ -1,4 +1,4 @@
-<?
+<?php // $Id$
 /** This expects the output from a command like
  * clamscan -r --infected --no-summary <files> 2>&1 | php -d error_log=/path/to/log thisfile.php 
  * also it's important that the output of clamscan prints the FULL PATH to each infected file, so use absolute paths for area to scan

admin/index.php

@@ -18,6 +18,13 @@
         die;
     }
 
+/// This is a Moodle 1.5 hack ONLY to fix accidental bad versions from version.php
+/// Do not copy this code into HEAD
+  
+    if ($CFG->version == '2005072100') {
+        set_config('version', 2005060221);
+    }
+
 
 /// Check some PHP server settings
 
@@ -258,7 +265,7 @@
 
 /// Define the unique site ID code if it isn't already
     if (empty($CFG->siteidentifier)) {    // Unique site identification code
-        set_config('siteidentifier', random_string(32));
+        set_config('siteidentifier', random_string(32).$_SERVER['HTTP_HOST']);
     }
 
 /// Check if the guest user exists.  If not, create one.
@@ -312,6 +319,11 @@
         print_spacer(10,10);
     }
 
+    if (ini_get_bool('register_globals') && !ini_get_bool('magic_quotes_gpc')) {
+        print_simple_box(get_string('globalsquoteswarning', 'admin'), 'center');
+    }
+
+
 /// If no recently cron run
     $lastcron = get_field_sql('SELECT max(lastcron) FROM ' . $CFG->prefix . 'modules');
     if (time() - $lastcron > 3600 * 24) {
@@ -403,8 +415,12 @@
                            "<font size=\"+1\">&nbsp;</font>".get_string("adminhelpcourses"));
     $table->data[] = array("<font size=\"+1\"><b><a href=\"../course/log.php?id=$site->id\">".get_string("logs")."</a></b></font>",
                            "<font size=\"+1\">&nbsp;</font>".get_string("adminhelplogs"));
+
     $table->data[] = array("<font size=\"+1\"><b><a href=\"../files/index.php?id=$site->id\">".get_string("sitefiles")."</a></b></font>",
                            "<font size=\"+1\">&nbsp;</font>".get_string("adminhelpsitefiles"));
+
+    $table->data[] = array('<font size="+1"><b><a href="environment.php">'.get_string('environment','admin').'</a></b></font>',
+                           "<font size=\"+1\">&nbsp;</font>".get_string('adminhelpenvironment'));
     if (file_exists("$CFG->dirroot/$CFG->admin/$CFG->dbtype")) {
         $table->data[] = array("<font size=\"+1\"><b><a href=\"$CFG->dbtype/frame.php\">".get_string("managedatabase")."</a></b></font>",
                                "<font size=\"+1\">&nbsp;</font>".get_string("adminhelpmanagedatabase"));
@@ -416,7 +432,7 @@
     ////  IT IS ILLEGAL AND A VIOLATION OF THE GPL TO REMOVE OR MODIFY THE COPYRIGHT NOTICE BELOW ////
     $copyrighttext = "<a href=\"http://moodle.org/\">Moodle</a> ".
                      "<a href=\"../doc/?frame=release.html\">$CFG->release</a> ($CFG->version)<br />".
-                     "Copyright &copy; 1999-2005 Martin Dougiamas<br />".
+                     "Copyright &copy; 1999 onwards by Martin Dougiamas<br />".
                      "<a href=\"../doc/?frame=licence.html\">GNU Public License</a>";
     echo "<center><p><font size=\"1\">$copyrighttext</font></p></center>";
     //////////////////////////////////////////////////////////////////////////////////////////////////

admin/lang.php

@@ -2,8 +2,8 @@
 
     require_once("../config.php");
 
-    optional_variable($mode, "");
-    optional_variable($currentfile, "moodle.php");
+    $mode = optional_param('mode', '', PARAM_ALPHA);
+    $currentfile = optional_param('currentfile', 'moodle.php', PARAM_FILE);
 
     require_login();
 
@@ -90,23 +90,22 @@
         // For each file, check that a counterpart exists, then check all the strings
     
         foreach ($stringfiles as $file) {
-            if (!file_exists("$langdir/$file")) {
-                if (!touch("$langdir/$file")) {
-                    echo "<p><font color=\"red\">".get_string("filemissing", "", "$langdir/$file")."</font></p>";
-                    continue;
-                }
-            }
-    
             unset($string);
             include("$enlangdir/$file");
             $enstring = $string;  
-    
+            
             unset($string);
-            include("$langdir/$file");
+
+            if (file_exists("$langdir/$file")) {
+                include("$langdir/$file");
+            } else {
+                notify(get_string("filemissing", "", "$langdir/$file"));
+                $string = array();
+            }
     
             $first = true;
             foreach ($enstring as $key => $value) {
-                if (!isset($string[$key]) or $string[$key] == "") {
+                if (empty($string[$key])) {
                     $value = htmlspecialchars($value);
                     $value = str_replace("$"."a", "\\$"."a", $value);
                     $value = str_replace("%%","%",$value);

admin/module.php

@@ -37,8 +37,6 @@
             $moduleprefix = '';
         }
 
-        print_header();
-
         foreach ($config as $name => $value) {
             set_config($moduleprefix.$name, $value);
         }

admin/oacleanup.php

@@ -29,7 +29,20 @@ function online_assignment_cleanup($output=false) {
         echo '<center>';
     }
 
-    // get the module id for assignments from db
+
+    /// We don't want to run this code if we are doing an upgrade from an assignment
+    /// version earlier than 2005041400
+    /// because the assignment type field will not exist
+    $amv = get_field('modules', 'version', 'name', 'assignment');
+    if ((int)$amv < 2005041400) {
+        if ($output) {
+            echo '</center>';
+        }
+        return;
+    }
+
+
+    /// get the module id for assignments from db
     $arecord = get_record('modules', 'name', 'assignment');
     $aid = $arecord->id;
 
@@ -44,7 +57,7 @@ function online_assignment_cleanup($output=false) {
         if ($output) print_heading($fullname);
 
         /// retrieve a list of sections beyond what is currently being shown
-        $sql = 'SELECT * FROM '.$CFG->prefix.'course_sections WHERE `course`='.$course->id.' AND `section`>'.$course->numsections.' ORDER BY `section` ASC';
+        $sql = 'SELECT * FROM '.$CFG->prefix.'course_sections WHERE course='.$course->id.' AND section>'.$course->numsections.' ORDER BY section ASC';
         if (!($xsections = get_records_sql($sql))) {
             if ($output) echo 'No extra sections<br />';
             continue;

admin/phpinfo.php

@@ -3,32 +3,37 @@
 
     require_once("../config.php");
 
+    $topframe    = optional_param('topframe', false, PARAM_BOOL);
+    $bottomframe = optional_param('bottomframe', false, PARAM_BOOL);
+
     require_login();
 
     if (!isadmin()) {
         error("Only the admin can use this page");
     }
 
-    if (isset($topframe)) {
+    if (!$topframe && !$bottomframe) {
+        ?>
+
+        <head>
+        <title>PHP info</title>
+        </head>
+
+        <frameset rows="80,*">
+           <frame src="phpinfo.php?topframe=true&amp;sesskey=<?php echo $USER->sesskey ?>">
+           <frame src="phpinfo.php?bottomframe=true&amp;sesskey=<?php echo $USER->sesskey ?>">
+        </frameset>
+
+        <?php
+    } else if ($topframe && confirm_sesskey()) {
         $stradministration = get_string("administration");
         $site = get_site();
-    
-        print_header("$site->shortname: phpinfo", "$site->fullname", 
+
+        print_header("$site->shortname: phpinfo", "$site->fullname",
                      "<a target=\"$CFG->framename\" href=\"index.php\">$stradministration</a> -> PHP info");
         exit;
-    }
-
-    if (isset($bottomframe)) {
+    } else if ($bottomframe && confirm_sesskey()) {
         phpinfo();
         exit;
     }
-
 ?>
-<head>
-<title>PHP info</title>
-</head>
-
-<frameset rows="80,*">
-   <frame src="phpinfo.php?topframe=true">
-   <frame src="phpinfo.php?bottomframe=true">
-</frameset>

admin/process_email.php

@@ -1,5 +1,5 @@
 #!/usr/bin/php -f
-<?
+<?php // $Id$
 define('FULLME','cron'); // prevent warnings
 //error_reporting(0);
 //ini_set('display_errors',0);

admin/register.php

@@ -26,7 +26,7 @@
     }
 
     if (empty($CFG->siteidentifier)) {    // Unique site identification code
-        set_config('siteidentifier', random_string(32));
+        set_config('siteidentifier', random_string(32).$_SERVER['HTTP_HOST']);
     }
 
 

admin/unchecked_vars.php

@@ -0,0 +1,35 @@
+<?php
+
+    include("../config.php");
+
+    $action = optional_param('action','LIST',PARAM_ALPHA);
+    $url    = optional_param('url');
+    $info   = optional_param('info');
+
+    if (!isadmin()) {
+        error("Only the admin can use this page");
+    }
+
+    print_header('Admin : Unchecked Vars' );
+
+    if ($action == 'DELETE') {
+        delete_records('log', 'url', $url, 'info', $info);
+    }
+
+    if ($errors = get_records_sql("SELECT DISTINCT url, info 
+                                   FROM {$CFG->prefix}log
+                                   WHERE module = 'dev' AND
+                                         action = 'unchecked vars'")) {
+        echo '<table border="1" cellpadding="5">';
+        foreach ($errors as $error) {
+            echo '<tr>';
+            echo '<td>'.$error->url.'</td>';
+            echo '<td>'.$error->info.'</td>';
+            echo '<td><a href="unchecked_vars.php?action=DELETE&amp;url='.$error->url.'&amp;info='.$error->info.'">Delete this</a></td>';
+            echo '</tr>';
+        }
+        echo '</table>';
+    } else {
+        echo "No unchecked vars were detected";
+    }
+?>

admin/uploaduser.php

@@ -5,7 +5,7 @@
 
     require_once("../config.php");
 
-    optional_variable($numusers, 0);
+    $numusers = optional_param('numusers', 0, PARAM_INT);
 
     require_login();
 
@@ -141,7 +141,7 @@
             }
             if ($record[$header[0]]) {
                 // add a new user to the database
-                optional_variable($newuser, ""); 
+                $newuser = optional_param('newuser', "", PARAM_CLEAN); 
 
                 // add fields to object $user
                 foreach ($record as $name => $value) {

auth/cas/config.html

@@ -1,13 +1,27 @@
 <?php
     require_once('languages.php');
     // Initialize vars
-    optional_variable($config->cas_hostname,"");
-    optional_variable($config->cas_port,"");
-    optional_variable($config->cas_version,"");
-    optional_variable($config->cas_baseuri,"");
-    optional_variable($config->cas_language,"");
-    optional_variable($config->cas_use_cas,"");
-    optional_variable($config->cas_create_user,"0");
+    if (!isset ($config->cas_hostname)) {
+        $config->cas_hostname = "";
+    }
+    if (!isset ($config->cas_port)) {
+        $config->cas_port = "";
+    }
+    if (!isset ($config->cas_version)) {
+        $config->cas_version = "";
+    }
+    if (!isset ($config->cas_baseuri)) {
+        $config->cas_baseuri = "";
+    }
+    if (!isset ($config->cas_language)) {
+        $config->cas_language = "";
+    }
+    if (!isset ($config->cas_use_cas)) {
+        $config->cas_use_cas = "";
+    }
+    if (!isset ($config->cas_create_user)) {
+        $config->cas_create_user = "0";
+    }
 ?>
 
 

auth/cas/lib.php

@@ -100,7 +100,7 @@ function cas_authenticate_user_login ($username, $password) {
    global $CFG;
    $cas_validate=true;
 
-   phpCAS::client($CFG->cas_version,$CFG->cas_hostname,(Integer)$CFG->cas_port,$CFG->cas_baseuri);
+   phpCAS::client($CFG->cas_version,$CFG->cas_hostname,(integer)$CFG->cas_port,$CFG->cas_baseuri);
    phpCAS::setLang($CFG->cas_language);
    if (!phpCAS::isAuthenticated()){
       phpCAS::authenticateIfNeeded();
@@ -136,7 +136,7 @@ function cas_automatic_authenticate ($user="") {
    global $CFG;
    if (!$cas_validate){
         $cas_validate=true;
-        phpCAS::client($CFG->cas_version,$CFG->cas_hostname,(Integer)$CFG->cas_port,$CFG->cas_baseuri);
+        phpCAS::client($CFG->cas_version,$CFG->cas_hostname,(int)$CFG->cas_port,$CFG->cas_baseuri);
         phpCAS::setLang($CFG->cas_language);
         if (!phpCAS::isAuthenticated() && !$CFG->guestloginbutton){
            phpCAS::authenticateIfNeeded();

auth/cas/logout.php

@@ -4,7 +4,7 @@
 defined('MOODLE_INTERNAL') or die('Direct access to this script is forbidden.');
 
        include_once($CFG->dirroot.'/lib/cas/CAS.php');
-       phpCAS::client($CFG->cas_version,$CFG->cas_hostname,(Integer)$CFG->cas_port,$CFG->cas_baseuri);
+       phpCAS::client($CFG->cas_version,$CFG->cas_hostname,(integer)$CFG->cas_port,$CFG->cas_baseuri);
        $backurl = $CFG->wwwroot;
        phpCAS::logout($backurl);
 

auth/db/lib.php

@@ -76,7 +76,7 @@ function auth_get_userinfo($username){
             if ($rs = $authdb->Execute("SELECT ".$pcfg["field_map_$field"]." FROM $CFG->auth_dbtable
                                         WHERE $CFG->auth_dbfielduser = '$username'")) {
                 if ( $rs->RecordCount() == 1 ) {
-                    $result["$field"] = $rs->fields[0];
+                    $result["$field"] = addslashes(stripslashes(utf8_decode($rs->fields[0])));
                 }
             }
         }

auth/fc/fcFPP.php

@@ -111,7 +111,8 @@ class fcFPP
 		$this->_user = $userid;
 		$this->_pwd  = $passwd; 
 		return TRUE;		
-	    } elseif (preg_match ("/^\Sorry/",$line)){	//Denied access but a valid user and password
+        } elseif (strpos($line, 'You are not allowed')){ // Denied access but a valid user and password
+                                                         // "Sorry. You are not allowed to login with the FPP interface"
 	    	return TRUE;
 	    } else {					//Invalid user or password
 		return FALSE;
@@ -215,4 +216,4 @@ class fcFPP
 }
    
 
-?>
+?>

auth/ldap/config.html

@@ -1,28 +1,71 @@
 <?php
     // Initialize vars
-    optional_variable($config->ldap_host_url,             "");
-    optional_variable($config->ldap_contexts,             "");
-    optional_variable($config->ldap_user_type,    "");
-    optional_variable($config->ldap_user_attribute,    "");
-    optional_variable($config->ldap_search_sub,         "");
-    optional_variable($config->ldap_opt_deref,         "");
-    optional_variable($config->ldap_bind_dn,             "");
-    optional_variable($config->ldap_bind_pw,             "");
-    optional_variable($config->ldap_version,             "2");
-    optional_variable($config->ldap_objectclass,         "");
-    optional_variable($config->ldap_memberattribute,    "");
-    optional_variable($config->ldap_creators,             "");
-    optional_variable($config->ldap_create_context,     "");
-    optional_variable($config->ldap_expiration,         "");
-    optional_variable($config->ldap_expiration_warning,         "10");
-    optional_variable($config->ldap_expireattr,         "");
-    optional_variable($config->ldap_gracelogins,         "");
-    optional_variable($config->ldap_graceattr,         "");
-    optional_variable($config->auth_user_create,         "");
-    optional_variable($config->auth_user_create,         "");
-    optional_variable($config->auth_ldap_forcechangepassword,         "");
-    
-    optional_variable($config->auth_ldap_stdchangepassword,        false); 
+    if (!isset ($config->ldap_host_url)) {
+        $config->ldap_host_url = "";
+    }
+    if (!isset ($config->ldap_contexts)) {
+        $config->ldap_contexts = "";
+    }
+    if (!isset ($config->ldap_user_attribute)) {
+        $config->ldap_user_attribute = "";
+    }
+    if (!isset ($config->ldap_user_type)) {
+        $config->ldap_user_type = "";
+    }
+    if (!isset ($config->ldap_search_sub)) {
+        $config->ldap_search_sub = "";
+    }
+    if (!isset ($config->ldap_opt_deref)) {
+        $config->ldap_opt_deref = "";
+    }
+    if (!isset ($config->ldap_preventpassindb)) {
+        $config->ldap_preventpassindb = 0;
+    }
+    if (!isset ($config->ldap_bind_dn)) {
+        $config->ldap_bind_dn = "";
+    }
+    if (!isset ($config->ldap_bind_pw)) {
+        $config->ldap_bind_pw = "";
+    }
+    if (!isset ($config->ldap_version)) {
+        $config->ldap_version = "2";
+    }
+    if (!isset ($config->ldap_objectclass)) {
+        $config->ldap_objectclass = "";
+    }
+    if (!isset ($config->ldap_memberattribute)) {
+        $config->ldap_memberattribute = "";
+    }
+    if (!isset ($config->ldap_creators)) {
+        $config->ldap_creators = "";
+    }
+    if (!isset ($config->ldap_create_context)) {
+        $config->ldap_create_context = "";
+    }
+    if (!isset ($config->ldap_expiration)) {
+        $config->ldap_expiration = "";
+    }
+    if (!isset ($config->ldap_expiration_warning)) {
+        $config->ldap_expiration_warning = "10";
+    }
+    if (!isset ($config->ldap_expireattr)) {
+        $config->ldap_expireattr = "";
+    }
+    if (!isset ($config->ldap_gracelogins)) {
+        $config->ldap_gracelogins = "";
+    }
+    if (!isset ($config->ldap_graceattr)) {
+        $config->ldap_graceattr = "";
+    }
+    if (!isset ($config->auth_user_create)) {
+        $config->auth_user_create = "";
+    }
+    if (!isset ($config->auth_ldap_forcechangepassword)) {
+        $config->auth_ldap_forcechangepassword = "";
+    }
+    if (!isset ($config->auth_ldap_stdchangepassword)) {
+        $config->auth_ldap_stdchangepassword = false;
+    }
     
 if (!function_exists('ldap_connect')){ // Is php4-ldap really there?
     print '<tr><td><p align="center"><font color="red"><strong>Warning:
@@ -37,7 +80,7 @@ if (!function_exists('ldap_connect')){ // Is php4-ldap really there?
    </td>
 </tr>
 
-<tr valign="top" class="required">
+                <tr valign="top" class="required">
     <td align="right">ldap_host_url:</td>
     <td>
         <input name="ldap_host_url" type="text" size="30" value="<?php echo $config->ldap_host_url?>">
@@ -69,6 +112,20 @@ if (!function_exists('ldap_connect')){ // Is php4-ldap really there?
    </td>
 </tr>
 
+<tr valign="top" class="required">
+    <td align="right">ldap_preventpassindb:</td>
+    <td>
+    <?php
+        $choices = array();
+        $choices["0"] = get_string("no");
+        $choices["1"] = get_string("yes");
+        choose_from_menu ($choices, "ldap_preventpassindb", $config->ldap_preventpassindb, "");
+    ?>
+    </td><td>
+    <?php  print_string("auth_ldap_preventpassindb","auth") ?>
+    </td>
+</tr>
+
 <tr valign="top" class="required">
     <td align="right">ldap_bind_dn:</td>
     <td>
@@ -121,7 +178,7 @@ if (!function_exists('ldap_connect')){ // Is php4-ldap really there?
     <td align="right">ldap_search_sub:</td>
     <td>
 <?php
-    $choices = array();;
+    $choices = array();
     $choices["0"] = get_string("no");
     $choices["1"] = get_string("yes");
     choose_from_menu ($choices, "ldap_search_sub", $config->ldap_search_sub, "");

auth/ldap/lib.php

@@ -68,7 +68,7 @@ function auth_user_login ($username, $password) {
         }
 
         // Try to bind with current username and password
-        $ldap_login = @ldap_bind($ldapconnection, $ldap_user_dn, $password);
+        $ldap_login = @ldap_bind($ldapconnection, $ldap_user_dn, stripslashes($password));
         ldap_close($ldapconnection);
         if ($ldap_login) {
             return true;
@@ -124,11 +124,19 @@ function auth_get_userinfo($username){
             if (!is_array($values)) {
                 $values = array($values);
             }
+            $ldapval = NULL;
             foreach ($values as $value) {
-                if(isset($user_entry[0][strtolower($value)][0])){
-                    $result[$key]=addslashes(stripslashes(utf8_decode($user_entry[0][strtolower($value)][0])));
+                if(is_array($user_entry[0][strtolower($value)])) {
+                    $newval = addslashes(stripslashes(utf8_decode($user_entry[0][strtolower($value)][0])));
                 }
+                else {
+                    $newval = addslashes(stripslashes(utf8_decode($user_entry[0][strtolower($value)])));
+                }
+                if (!empty($newval)) { // favour ldap entries that are set
+                    $ldapval = $newval;
+                } 
             }
+            $result[$key] = $ldapval;
         }
     }
 
@@ -210,14 +218,14 @@ function auth_user_create ($userobject,$plainpass) {
 
     switch ($CFG->ldap_user_type)  {
         case 'edir':
-    $newuser['objectClass']= array("inetOrgPerson","organizationalPerson","person","top");
-    $newuser['uniqueId']= $userobject->username;
-    $newuser['logindisabled']="TRUE";
-    $newuser['userpassword']=$plainpass;
+            $newuser['objectClass']= array("inetOrgPerson","organizationalPerson","person","top");
+            $newuser['uniqueId']= $userobject->username;
+            $newuser['logindisabled']="TRUE";
+            $newuser['userpassword']=$plainpass;
+            break;
         default:
-           error('auth: ldap auth_user_create() does not support selected usertype (..yet)');
+           error('auth: ldap auth_user_create() does not support selected usertype:"'.$CFG->ldap_user_type.'" (..yet)');
     }
-        
     $uadd = ldap_add($ldapconnection, $CFG->ldap_user_attribute."=$userobject->username,".$CFG->ldap_create_context, $newuser);
 
     ldap_close($ldapconnection);
@@ -379,10 +387,10 @@ function auth_sync_users ($bulk_insert_records = 1000, $do_updates=1) {
     if(strtolower($CFG->dbtype) === 'mysql'){
         // help old mysql versions cope with large temp tables
         execute_sql('SET SQL_BIG_TABLES=1', false); 
-        execute_sql('CREATE TEMPORARY TABLE ' . $CFG->prefix .'extuser (idnumber VARCHAR(12), PRIMARY KEY (idnumber)) TYPE=MyISAM',false); 
+        execute_sql('CREATE TEMPORARY TABLE ' . $CFG->prefix .'extuser (idnumber VARCHAR(64), PRIMARY KEY (idnumber)) TYPE=MyISAM',false); 
     } elseif (strtolower($CFG->dbtype) === 'postgres7'){
         $bulk_insert_records = 1; // no support for multiple sets of values
-        execute_sql('CREATE TEMPORARY TABLE '.$CFG->prefix.'extuser (idnumber VARCHAR(12), PRIMARY KEY (idnumber))',false); 
+        execute_sql('CREATE TEMPORARY TABLE '.$CFG->prefix.'extuser (idnumber VARCHAR(64), PRIMARY KEY (idnumber))',false); 
     }
 
         
@@ -508,7 +516,11 @@ function auth_sync_users ($bulk_insert_records = 1000, $do_updates=1) {
         $updatekeys = array();
         foreach ($all_keys as $key) {
             if (preg_match('/^field_updatelocal_(.+)$/',$key, $match)) {
-                if ($pcfg->{$match[0]}) { // if it has a true value
+                // if we have a field to update it from
+                // and it must be updated 'onlogin' we 
+                // update it on cron
+                if ( !empty($pcfg->{'field_map_'.$match[1]})
+                     && $pcfg->{$match[0]} === 'onlogin') { 
                     array_push($updatekeys, $match[1]); // the actual key name
                 }
             }
@@ -600,7 +612,7 @@ function auth_sync_users ($bulk_insert_records = 1000, $do_updates=1) {
             $CFG->debug=$old_debug;
             $userobj = auth_ldap_update_user_record($user->username);
             if(isset($CFG->{'auth_ldap_forcechangepassword'}) && $CFG->{'auth_ldap_forcechangepassword'}){
-                set_user_preference('auth_forcepasswordchange', 1, $userobj);
+                set_user_preference('auth_forcepasswordchange', 1, $userobj->id);
             }
             
             // update course creators
@@ -614,7 +626,7 @@ function auth_sync_users ($bulk_insert_records = 1000, $do_updates=1) {
                   }
                 } else {
                      if ( record_exists("user_coursecreators", "userid", $user->id)) {
-                          $creator = delete_records("user_coursecreators", "userid", $$user->id);
+                          $creator = delete_records("user_coursecreators", "userid", $user->id);
                           if (! $creator) {
                               error("Cannot remove user from course creators.");
                           }
@@ -703,17 +715,19 @@ function auth_ldap_bulk_insert($users){
  * @return boolen result
  */
 function auth_user_activate ($username) {
-    global $CFG;
-
-    $ldapconnection = auth_ldap_connect();
     
+    global $CFG;
+    
+    $ldapconnection = auth_ldap_connect();
+
     $userdn = auth_ldap_find_userdn($ldapconnection, $username);
     switch ($CFG->ldap_user_type)  {
-         case 'edir':
-    $newinfo['loginDisabled']="FALSE";
-         default;
-            error ('auth: ldap auth_user_activate() does not support selected usertype (..yet)');    
-    }    
+        case 'edir':
+            $newinfo['loginDisabled']="FALSE";
+            break;
+        default:
+            error ('auth: ldap auth_user_activate() does not support selected usertype:"'.$CFG->ldap_user_type.'" (..yet)');    
+    } 
     $result = ldap_modify($ldapconnection, $userdn, $newinfo);
     ldap_close($ldapconnection);
     return $result;
@@ -735,7 +749,8 @@ function auth_user_disable ($username) {
     $userdn = auth_ldap_find_userdn($ldapconnection, $username);
     switch ($CFG->ldap_user_type)  {
         case 'edir':
-    $newinfo['loginDisabled']="TRUE";
+            $newinfo['loginDisabled']="TRUE";
+            break;
         default:
             error ('auth: ldap auth_user_disable() does not support selected usertype (..yet)');    
     }    
@@ -811,10 +826,19 @@ function auth_user_update($olduser, $newuser) {
     if ($user_info_result){
 
         $user_entry = auth_ldap_get_entries($ldapconnection, $user_info_result);
+        if (count($user_entry)) {
+            trigger_error("ldap: Strange! More than one user record found in ldap. Only using the first one.");
+        }
+        $user_entry = $user_entry[0];
+
         //error_log(var_export($user_entry) . 'fpp' );
         
         foreach ($attrmap as $key=>$ldapkeys){
-            if (!empty($pcfg->{'field_updateremote_'. $key})) {
+
+            // only process if the moodle field ($key) has changed and we
+            // are set to update LDAP with it
+            if ($olduser->$key !== $newuser->$key &&
+                !empty($pcfg->{'field_updateremote_'. $key})) {
 
                 // for ldap values that could be in more than one 
                 // ldap key, we will do our best to match 
@@ -822,33 +846,42 @@ function auth_user_update($olduser, $newuser) {
                 $ambiguous = true;
                 $changed   = false;
                 if (!is_array($ldapkeys)) {
-                    $ldapkeys = $array($ldapkeys);
+                    $ldapkeys = array($ldapkeys);
                 }
                 if (count($ldapkeys) < 2) {
                     $ambiguous = false;
                 }
                  
                 foreach ($ldapkeys as $ldapkey) {
+                    $ldapkey   = strtolower($ldapkey);
+                    $ldapvalue = $user_entry[$ldapkey][0];
                     if (!$ambiguous) {
                         // skip update if the values already match
-                        if( !($newuser->$key === $user_entry[0][strtolower($ldapkey)][0]) ){
+                        if( !($newuser->$key === $ldapvalue) ){
                             ldap_modify($ldapconnection, $user_dn, array($ldapkey => $newuser->$key));
                         } else { 
                     error_log("Skip updating field $key for entry $user_dn: it seems to be already same on LDAP. " . 
                                       "  old moodle value: '" . $olduser->$key . 
                                       "' new value '" . $newuser->$key . 
-                                      "' current value in ldap entry " . $user_entry[0][strtolower($ldapkey)][0]);
+                                      "' current value in ldap entry " . $ldapvalue);
                         }
                     } else { // ambiguous
-                        // check the old values match
-                        //error_log("keys $key $ldapkey");
-                        //error_log("olduser " . $olduser->$key);
-                        //error_log("ldapuser " . $user_entry[0][strtolower($ldapkey)][0]);
-                        if (   !empty($olduser->$key) 
-                            && !empty($user_entry[0][strtolower($ldapkey)][0]) 
-                            && $olduser->$key === $user_entry[0][strtolower($ldapkey)][0] ) {
-                            // we found which value to update!
-                            error_log("Matched: ". $olduser->$key . " === " . $user_entry[0][strtolower($ldapkey)][0]);
+                        // value empty before in Moodle (and LDAP) - use 1st ldap candidate field
+                        // no need to guess
+                        if (empty($olduser->$key)) { // value empty before - use 1st ldap candidate
+                            if(ldap_modify($ldapconnection, $user_dn, array($ldapkey => $newuser->$key))){
+                                $changed=true;
+                                last;
+                            } else {
+                                error ('Error updating LDAP record. Error code: ' 
+                                  . ldap_errno($ldapconnection) . '; Error string : '
+                                  . ldap_err2str(ldap_errno($ldapconnection)));                                
+                            }
+                        }
+
+                        // we found which ldap key to update!                            
+                        if ( !empty($ldapvalue) && $olduser->$key === $ldapvalue ) {
+                            // error_log("Matched: ". $olduser->$key . " === " . $ldapvalue);
                             if(ldap_modify($ldapconnection, $user_dn, array($ldapkey => $newuser->$key))){
                                 $changed=true;
                                 last;
@@ -1030,7 +1063,7 @@ function auth_ldap_getdefaults(){
                         'rfc2307' => 'member',
                         'rfc2307bis' => 'member',
                         'samba' => 'member',
-                        'ad' => 'member', //is this right?
+                        'ad' => 'member', 
                         'default' => 'member'
                         );
     $default['ldap_memberattribute_isdn'] = array(
@@ -1038,7 +1071,7 @@ function auth_ldap_getdefaults(){
                         'rfc2307' => '0',
                         'rfc2307bis' => '1',
                         'samba' => '0', //is this right?
-                        'ad' => '0', //is this right?
+                        'ad' => '1',
                         'default' => '0'
                         );
     $default['ldap_expireattr'] = array (
@@ -1213,7 +1246,8 @@ function auth_ldap_isgroupmember ($username='', $groupdns='') {
         }
         //echo "Checking group $group for member $username\n";
         $search = @ldap_read($ldapconnection, $group,  '('.$CFG->ldap_memberattribute.'='.$username.')', array($CFG->ldap_memberattribute));
-        if (ldap_count_entries($ldapconnection, $search)) {$info = auth_ldap_get_entries($ldapconnection, $search);
+
+        if (!empty($search) AND ldap_count_entries($ldapconnection, $search)) {$info = auth_ldap_get_entries($ldapconnection, $search);
         
             if (count($info) > 0 ) {
                 // user is member of group
@@ -1270,7 +1304,8 @@ function auth_ldap_connect($binddn='',$bindpwd=''){
 
         if (!empty($binddn)){
             //bind with search-user
-            $bindresult=@ldap_bind($connresult, $binddn,$bindpwd);
+            //$debuginfo .= 'Using bind user'.$binddn.'and password:'.$bindpwd; 
+            $bindresult=ldap_bind($connresult, $binddn,$bindpwd);
         } else {
             //bind anonymously 
             $bindresult=@ldap_bind($connresult);
@@ -1284,7 +1319,7 @@ function auth_ldap_connect($binddn='',$bindpwd=''){
             return $connresult;
         }
         
-        $debuginfo == "<br/>Server: '$server' <br/> Connection: '$connresult'<br/> Bind result: '$bindresult'</br>";
+        $debuginfo .= "<br/>Server: '$server' <br/> Connection: '$connresult'<br/> Bind result: '$bindresult'</br>";
     }
 
     //If any of servers are alive we have already returned connection
@@ -1414,7 +1449,7 @@ function auth_ldap_get_userlist($filter="*") {
                                      $filter,
                                      array($CFG->ldap_user_attribute));
         }
-
+        
         $users = auth_ldap_get_entries($ldapconnection, $ldap_result);
 
         //add found users to list
@@ -1442,7 +1477,7 @@ function auth_ldap_get_entries($conn, $searchresult){
     $fresult=array();
     $entry = ldap_first_entry($conn, $searchresult);
     do {
-        $attributes = ldap_get_attributes($conn, $entry);
+        $attributes = @ldap_get_attributes($conn, $entry);
         for($j=0; $j<$attributes['count']; $j++) {
             $values = ldap_get_values_len($conn, $entry,$attributes[$j]);
             if (is_array($values)) {
@@ -1453,7 +1488,7 @@ function auth_ldap_get_entries($conn, $searchresult){
         }         
         $i++;               
     }
-    while ($entry = ldap_next_entry($conn, $entry));
+    while ($entry = @ldap_next_entry($conn, $entry));
     //were done
     return ($fresult);
 }

auth/shibboleth/config.html

@@ -1,14 +1,17 @@
 <?php
-// Set default values
-$pluginconfig   = get_config('auth/shibboleth');
+    // Set default values
+    $pluginconfig   = get_config('auth/shibboleth');
 
-if (!isset($config->auth_instructions) or empty($pluginconfig->shib_user_attribute)) {
-    $config->auth_instructions = get_string('auth_shib_instructions', 'auth', $CFG->wwwroot.'/auth/shibboleth/shib-protected.php');
-}
-
-optional_variable($pluginconfig->user_attribute, '');
-optional_variable($pluginconfig->convert_data,   '');
+    if (!isset($config->auth_instructions) or empty($pluginconfig->shib_user_attribute)) {
+        $config->auth_instructions = get_string('auth_shib_instructions', 'auth', $CFG->wwwroot.'/auth/shibboleth/shib-protected.php');
+    }
 
+    if (!isset ($pluginconfig->user_attribute)) {
+        $pluginconfig->user_attribute = '';
+    }
+    if (!isset ($pluginconfig->convert_data)) {
+        $pluginconfig->convert_data = '';
+    }
 ?>
 <tr>
     <td colspan="3" align="left">
@@ -42,7 +45,7 @@ optional_variable($pluginconfig->convert_data,   '');
     <td align="right"><?php  print_string("auth_shib_convert_data", "auth") ?>:</td>
     <td>
     <input name="pluginconfig_convert_data" type="text" size="30" value="<?php echo $pluginconfig->convert_data?>"> 
-    <? 
+    <?php 
           if ($pluginconfig->convert_data && $pluginconfig->convert_data != '' && !is_readable($pluginconfig->convert_data)){
               echo '<br><font color="red">';
               print_string("auth_shib_convert_data_warning", "auth");

auth/shibboleth/lib.php

@@ -26,7 +26,6 @@ function auth_get_userinfo($username) {
 // reads user information from shibboleth attributes and return it in array()
     global $CFG;
 
-    $config = (array)$CFG;
     $pluginconfig   = get_config('auth/shibboleth');
 
     // Check whether we have got all the essential attributes
@@ -47,20 +46,20 @@ function auth_get_userinfo($username) {
     foreach ($attrmap as $key=>$value) {
         $result[$key]=utf8_decode($_SERVER[$value]);
     }
-    
-     // Provide an API to modify the information to fit the Moodle internal
+
+    // Provide an API to modify the information to fit the Moodle internal
     // data representation
     if (   
-          $config["shib_convert_data"] 
-          && $config["shib_convert_data"] != ''
-          && is_readable($config["shib_convert_data"])
+          $pluginconfig->convert_data 
+          && $pluginconfig->convert_data != ''
+          && is_readable($pluginconfig->convert_data)
         ){
         
         // Include a custom file outside the Moodle dir to
         // modify the variable $moodleattributes
-        include($config["shib_convert_data"]);
+        include($pluginconfig->convert_data);
     }
-    
+
     return $result;
 }
 

backup/backup_execute.html

@@ -190,7 +190,7 @@
         echo "</ul></li>";
 
         //User info
-        if ($status && $preferences->backup_users) {
+        if ($status) {
             echo "<li>".get_string("writinguserinfo").'</li>';
             if (!$status = backup_user_info($backup_file,$preferences)) {
                 notify("An error occurred while backing up user info");

backup/backup_scheduled.php

@@ -325,7 +325,7 @@ function schedule_backup_course_configure($course,$starttime = 0) {
             $backup_config->backup_sche_coursefiles = 1;
         }
         if (!isset($backup_config->backup_sche_messages)) {
-            $backup_config->backup_sche_messages = 1;
+            $backup_config->backup_sche_messages = 0;
         }
         if (!isset($backup_config->backup_sche_active)) {
             $backup_config->backup_sche_active = 0;
@@ -484,7 +484,13 @@ function schedule_backup_course_configure($course,$starttime = 0) {
     //Now calculate the users
     if ($status) {
         schedule_backup_log($starttime,$course->id,"    calculating users");
-        user_check_backup($course->id,$backup_unique_code,$preferences->backup_users,$preferences->backup_messages);  
+        //Decide about include users with messages, based on SITEID
+        if ($preferences->backup_messages && $preferences->backup_course == SITEID) {
+            $include_message_users = true;
+        } else {
+            $include_message_users = false;
+        }
+        user_check_backup($course->id,$backup_unique_code,$preferences->backup_users,$include_message_users);  
     }
 
     //Now calculate the logs

backup/backuplib.php

@@ -271,7 +271,7 @@
                     $status = execute_sql("INSERT INTO {$CFG->prefix}backup_files
                                                (backup_code, file_type, path, old_id)
                                            VALUES
-                                               ('$backup_unique_code','user','$dir','$userid')",false);
+                                               ('$backup_unique_code','user','".addslashes($dir)."','$userid')",false);
                 }
                 //Do some output
                 backup_flush(30);
@@ -315,7 +315,7 @@
                     $status = execute_sql("INSERT INTO {$CFG->prefix}backup_files
                                                   (backup_code, file_type, path)
                                            VALUES
-                                              ('$backup_unique_code','course','$dir')",false);
+                                              ('$backup_unique_code','course','".addslashes($dir)."')",false);
                 }
             //Do some output
             backup_flush(30);
@@ -435,8 +435,20 @@
     
     //Return the start tag, the contents and the end tag
     function full_tag($tag,$level=0,$endline=true,$content,$to_utf=true) {
+
+        global $CFG;
+
         //Here we encode absolute links
         $content = backup_encode_absolute_links($content);
+
+        //If enabled, we strip all the control chars from the text but tabs, newlines and returns
+        //because they are forbiden in XML 1.0 specs. The expression below seems to be
+        //UTF-8 safe too because it simply ignores the rest of characters.
+        if (!empty($CFG->backup_strip_controlchars)) {
+            $content = preg_replace("/(?(?=[[:cntrl:]])[^\n\r\t])/is","",$content);
+        }
+
+        //Start to build the tag
         $st = start_tag($tag,$level,$endline);
         $co="";
         if ($to_utf) {
@@ -1650,7 +1662,7 @@
         }
 
         if ($result != $content && $CFG->debug>7) {                                  //Debug
-            echo "<br /><hr />".$content."<br />changed to<br />".$result."<hr /><br />";        //Debug
+            echo '<br /><hr />'.htmlentities($content).'<br />changed to<br />'.htmlentities($result).'<hr /><br />';        //Debug
         }                                                                            //Debug
 
         return $result;

backup/bb/restore_bb.php

@@ -1,9 +1,11 @@
-<?php
+<?php // $Id$
 // This file facilitates the conversion of a Blackboard course export
 // into a Moodle course export.  It assumes an unzipped directory and makes in-place alterations.
-  
+
+defined('MOODLE_INTERNAL') or die('Direct access to this script is forbidden.');
+
 // Ziba Scott <ziba@linuxbox.com> 10-25-04
-require_once('xsl_emulate_xslt.inc');
+require_once($CFG->dirroot.'/backup/bb/xsl_emulate_xslt.inc');
   
 function get_subdirs($directory){
     $opendirectory = opendir( $directory );

backup/lib.php

@@ -81,24 +81,6 @@
         return $status;
     }
 
-    //Function to check if a directory exists
-    //and, optionally, create it
-    function check_dir_exists($dir,$create=false) {
-
-        global $CFG; 
-
-        $status = true;
-        if(!is_dir($dir)) {
-            if (!$create) {
-                $status = false;
-            } else {
-                umask(0000);
-                $status = mkdir ($dir,$CFG->directorypermissions);
-            }
-        }
-        return $status;
-    }
-
     //Function to check and create the needed dir to 
     //save all the backup
     function check_and_create_backup_dir($backup_unique_code) {
@@ -289,7 +271,8 @@
             //$perms=fileperms($from_file);
             //return copy($from_file,$to_file) && chmod($to_file,$perms);
             umask(0000);
-            if (copy($from_file,$to_file) && chmod($to_file,$CFG->directorypermissions)) {
+            if (copy($from_file,$to_file)) {
+                chmod($to_file,$CFG->directorypermissions);
                 if (!empty($log_clam)) {
                     clam_log_upload($to_file,null,true);
                 }

backup/restore.php

@@ -112,7 +112,7 @@
     
     //Adjust some php variables to the execution of this script
     @ini_set("max_execution_time","3000");
-    raise_memory_limit("memory_limit","128M");
+    raise_memory_limit("128M");
 
     //Call the form, depending the step we are
 

backup/restore_check.html

@@ -149,11 +149,19 @@
 
     //Now, select the course if needed
     if (($restore->restoreto == 0 or $restore->restoreto == 1) and ($restore->course_id == 0) and (iscreator())) {
-        if ($courses = get_courses("all","c.fullname","c.id,c.fullname,c.shortname")) {
+        if ($courses = get_courses("all","c.fullname","c.id,c.fullname,c.shortname,c.visible")) {
             print_heading(get_string("choosecourse"));
             print_simple_box_start("center");
             foreach ($courses as $course) {
-                echo "<a href=\"restore.php?course_id=$course->id&launch=check&id=$id&file=$file\">$course->fullname ($course->shortname)</a><br />";
+                if (!isteacheredit($course->id)) {
+                    continue;
+                }
+                if (empty($course->visible)) {
+                    $optdimmed = ' class="dimmed" ';
+                } else {
+                    $optdimmed = '';
+                }
+                echo "<a $optdimmed href=\"restore.php?course_id=$course->id&launch=check&id=$id&file=$file\">$course->fullname ($course->shortname)</a><br />";
             }
             print_simple_box_end();
         } else {
@@ -162,6 +170,12 @@
         }
     //Checks everything and execute restore
     } else if ((($restore->restoreto == 0 or $restore->restoreto == 1) and ($restore->course_id != 0)) or ($restore->restoreto == 2)) {
+        //Final access control check
+        if ($restore->course_id == 0 and !iscreator()) {
+            error("You need to be a creator or admin to restore into new course!");
+        } else if ($restore->course_id != 0 and !isteacheredit($restore->course_id)) {
+            error("You need to be an edit teacher or admin to restore into selected course!");
+        }
         $show_continue_button = true;
         //Check if we've selected any mod's user info and restore->users 
         //is set to none. Change it to course and inform.

backup/restorelib.php

@@ -446,9 +446,10 @@
             }
             $currentfullname = $fullname.$suffixfull;
             $currentshortname = $shortname.$suffixshort;
-            $course = get_record("course","fullname",addslashes($currentfullname));
+            $coursefull  = get_record("course","fullname",addslashes($currentfullname));
+            $courseshort = get_record("course","shortname",addslashes($currentshortname));
             $counter++;
-        } while ($course);
+        } while ($coursefull || $courseshort);
 
         //New name = currentname
         $course_header->course_fullname = $currentfullname;
@@ -1015,6 +1016,7 @@
                 $preferencescount = count_records ('backup_ids', 'backup_code', $restore->backup_unique_code, 'table_name', 'grade_preferences');
                 $letterscount = count_records ('backup_ids', 'backup_code', $restore->backup_unique_code, 'table_name', 'grade_letter');
                 $categoriescount = count_records ('backup_ids', 'backup_code', $restore->backup_unique_code, 'table_name', 'grade_category');
+
                 if ($preferencescount || $letterscount || $categoriescount) {
                     //Start ul
                     echo '<ul>';
@@ -1055,7 +1057,7 @@
                                 foreach ($recs as $rec) {
                                     //Get the full record from backup_ids
                                     $data = backup_getid($restore->backup_unique_code,'grade_preferences',$rec->old_id);
-                                   if ($data) {
+                                    if ($data) {
                                         //Now get completed xmlized object
                                         $info = $data->info;
                                         //traverse_xmlize($info);                            //Debug
@@ -1071,16 +1073,16 @@
                                         if (!$prerec = get_record('grade_preferences','courseid',$dbrec->courseid,'preference',$dbrec->preference)) {
                                             $status = insert_record('grade_preferences',$dbrec);
                                         }
-
-                                        //Do some output
-                                        $counter++;
-                                        if ($counter % 1 == 0) {
-                                            echo ".";
-                                            if ($counter % 20 == 0) {
-                                                echo "<br />";
-                                            }
-                                            backup_flush(300);
+                                    }
+                                    //Increment counters
+                                    $counter++;
+                                    //Do some output
+                                    if ($counter % 1 == 0) {
+                                        echo ".";
+                                        if ($counter % 20 == 0) {
+                                            echo "<br />";
                                         }
+                                        backup_flush(300);
                                     }
                                 }
                             }
@@ -1091,7 +1093,7 @@
                     //If destination course has letters, skip restoring letters
                     $hasletters = get_records('grade_letter', 'courseid', $restore->course_id);
 
-                    if ($preferencescount && $continue && !$hasletters) {
+                    if ($letterscount && $continue && !$hasletters) {
                         echo '<li>'.get_string('letters','grades').'</li>';
                         $counter = 0;
                         while ($counter < $letterscount) {
@@ -1105,7 +1107,7 @@
                                 foreach ($recs as $rec) {
                                     //Get the full record from backup_ids
                                     $data = backup_getid($restore->backup_unique_code,'grade_letter',$rec->old_id);
-                                   if ($data) {
+                                    if ($data) {
                                         //Now get completed xmlized object
                                         $info = $data->info;
                                         //traverse_xmlize($info);                            //Debug
@@ -1119,16 +1121,16 @@
 
                                         //Structure is equal to db, insert record
                                         $status = insert_record('grade_letter',$dbrec);
-
-                                        //Do some output
-                                        $counter++;
-                                        if ($counter % 1 == 0) {
-                                            echo ".";
-                                            if ($counter % 20 == 0) {
-                                                echo "<br />";
-                                            }
-                                            backup_flush(300);
+                                    }
+                                    //Increment counters
+                                    $counter++;
+                                    //Do some output
+                                    if ($counter % 1 == 0) {
+                                        echo ".";
+                                        if ($counter % 20 == 0) {
+                                            echo "<br />";
                                         }
+                                        backup_flush(300);
                                     }
                                 }
                             }
@@ -1145,13 +1147,13 @@
                             $recs = get_records_select("backup_ids","table_name = 'grade_category' AND backup_code = '$restore->backup_unique_code'",
                                                        "old_id",
                                                        "old_id, old_id",
-                                                       $counter,
+                                                       $countercat,
                                                        $recordset_size);
                             if ($recs) {
                                 foreach ($recs as $rec) {
                                     //Get the full record from backup_ids
                                     $data = backup_getid($restore->backup_unique_code,'grade_category',$rec->old_id);
-                                   if ($data) {
+                                    if ($data) {
                                         //Now get completed xmlized object
                                         $info = $data->info;
                                         //traverse_xmlize($info);                            //Debug
@@ -1252,16 +1254,18 @@
                                                 $order++;
                                             }
                                         }
-                                        //Do some output
-                                        $countercat++;
-                                        if ($countercat % 1 == 0) {
-                                            echo ".";
-                                            if ($countercat % 20 == 0) {
-                                                echo "<br />";
-                                            }
-                                            backup_flush(300);
-                                        }
                                     }
+                                    //Increment counters
+                                    $countercat++;
+                                    //Do some output
+                                    if ($countercat % 1 == 0) {
+                                        echo ".";
+                                        if ($countercat % 20 == 0) {
+                                            echo "<br />";
+                                        }
+                                        backup_flush(300);
+                                    }
+
                                 }
                             }
                         }
@@ -2182,7 +2186,7 @@
         $result = str_replace($search,$replace,$content);
 
         if ($result != $content && $CFG->debug>7) {                                  //Debug
-            echo "<br /><hr />".$content."<br />changed to<br />".$result."<hr /><br />";        //Debug
+            echo '<br /><hr />'.htmlentities($content).'<br />changed to<br />'.htmlentities($result).'<hr /><br />';        //Debug
         }                                                                            //Debug
 
         return $result;
@@ -2524,6 +2528,10 @@
             $log->info = $log->course;
             $toinsert = true;
             break;
+        case "guest":
+            $log->url = "view.php?id=".$log->course;
+            $toinsert = true;
+            break;
         case "user report":
             //recode the info field (it's the user id)
             $user = backup_getid($restore->backup_unique_code,"user",$log->info);
@@ -2531,7 +2539,7 @@
                 $log->info = $user->new_id;
                 //Now, extract the mode from the url field
                 $mode = substr(strrchr($log->url,"="),1);
-                $log->url = "user.php?id=".$log->course."&amp;user=".$log->info."&amp;mode=".$mode;
+                $log->url = "user.php?id=".$log->course."&user=".$log->info."&mode=".$mode;
                 $toinsert = true;
             }
             break;
@@ -2657,7 +2665,7 @@
             $user = backup_getid($restore->backup_unique_code,"user",$log->info);
             if ($user) {
                 $log->info = $user->new_id;
-                $log->url = "view.php?id=".$log->info."&amp;course=".$log->course;
+                $log->url = "view.php?id=".$log->info."&course=".$log->course;
                 $toinsert = true;
             }
             break;
@@ -2666,7 +2674,25 @@
             $user = backup_getid($restore->backup_unique_code,"user",$log->info);
             if ($user) {
                 $log->info = $user->new_id;
-                $log->url = "view.php?id=".$log->info."&amp;course=".$log->course;
+                $log->url = "view.php?id=".$log->info."&course=".$log->course;
+                $toinsert = true;
+            }
+            break;
+        case "login":
+            //recode the info field (it's the user id)
+            $user = backup_getid($restore->backup_unique_code,"user",$log->info);
+            if ($user) {
+                $log->info = $user->new_id;
+                $log->url = "view.php?id=".$log->info."&course=".$log->course;
+                $toinsert = true;
+            }
+            break;
+        case "logout":
+            //recode the info field (it's the user id)
+            $user = backup_getid($restore->backup_unique_code,"user",$log->info);
+            if ($user) {
+                $log->info = $user->new_id;
+                $log->url = "view.php?id=".$log->info."&course=".$log->course;
                 $toinsert = true;
             }
             break;
@@ -2683,7 +2709,7 @@
             $user = backup_getid($restore->backup_unique_code,"user",$userid);
             if ($user) {
                 $log->info = "";
-                $log->url = "view.php?id=".$user->new_id."&amp;course=".$log->course;
+                $log->url = "view.php?id=".$user->new_id."&course=".$log->course;
                 $toinsert = true;
             }
             break;
@@ -4564,6 +4590,7 @@
         global $SESSION;
         $restore->backup_unique_code=$backup_unique_code;
         $restore->users = 2; // yuk
+        $restore->course_files = $SESSION->restore->restore_course_files;
         if ($allmods = get_records("modules")) {
             foreach ($allmods as $mod) {
                 $modname = $mod->name;

backup/version.php

@@ -7,4 +7,6 @@
 
 $backup_version = 2005070500;   // The current version is a date (YYYYMMDDXX)
 
-$backup_release = "1.5.1";  // User-friendly version number
+$backup_release = "1.5.4+";  // User-friendly version number
+
+?>

blocks/activity_modules/block_activity_modules.php

@@ -3,14 +3,23 @@
 class block_activity_modules extends block_list {
     function init() {
         $this->title = get_string('activities');
-        $this->version = 2004041000;
+        $this->version = 2004041001;
     }
 
     function get_content() {
         global $USER, $CFG;
 
-        // This is really NOT pretty, but let's do it simple for now...
-        global $modnamesused, $modnamesplural;
+        // TODO: FIX: HACK: (any other tags I should add? :P)
+        // Hacker's improvised caching scheme: avoid fetching the mod
+        // data from db if the course format has already fetched them
+        if(!isset($GLOBALS['modnamesplural']) || !isset($GLOBALS['modnamesused'])) {
+            require_once($CFG->dirroot.'/course/lib.php');
+            get_all_mods($this->instance->pageid, $mods, $modnames, $modnamesplural, $modnamesused);
+        }
+        else {
+            $modnamesplural = $GLOBALS['modnamesplural'];
+            $modnamesused   = $GLOBALS['modnamesused'];
+        }
 
         if($this->content !== NULL) {
             return $this->content;

blocks/admin/block_admin.php

@@ -121,7 +121,7 @@ class block_admin extends block_list {
                     $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/users.gif" height="16" width="16" alt="" />';
                 } else {
                     $this->content->items[]='<a href="importstudents.php?id='.$this->instance->pageid.'">'.$course->students.'</a>';
-                    $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/users.gif" height="16" width="16" alt="">';
+                    $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/users.gif" height="16" width="16" alt="" />';
                 }
                 if ($course->groupmode || !$course->groupmodeforce) {
                     $strgroups = get_string('groups');
@@ -182,14 +182,14 @@ class block_admin extends block_list {
             }
             $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/user.gif" height="16" width="16" alt="" />';
 
-            if (is_internal_auth()) {
+            if (is_internal_auth() && !is_restricted_user($USER->username)) {
                 $this->content->items[]='<a href="'.$CFG->wwwroot.'/login/change_password.php?id='.$this->instance->pageid.'">'.get_string('changepassword').'</a>';
                 $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/user.gif" height="16" width="16" alt="" />';
-            } else if ($CFG->changepassword) {
+            } else if ($CFG->changepassword && !is_restricted_user($USER->username)) {
                 $this->content->items[]='<a href="'.$CFG->changepassword.'">'.get_string('changepassword').'</a>';
                 $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/user.gif" height="16" width="16" alt="" />';
             }
-            if ($CFG->allowunenroll) {
+            if ($CFG->allowunenroll && !$course->metacourse) {
                 $this->content->items[]='<a href="unenrol.php?id='.$this->instance->pageid.'">'.get_string('unenrolme', '', $course->shortname).'</a>';
                 $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/user.gif" height="16" width="16" alt="" />';
             }

blocks/course_list/block_course_list.php

@@ -32,7 +32,7 @@ class block_course_list extends block_list {
            }
         }
 
-        if (isset($USER->id) and !(isadmin() and $adminseesall)) {    // Just print My Courses
+        if (empty($CFG->disablemycourses) and isset($USER->id) and !(isadmin() and $adminseesall)) {    // Just print My Courses
             if ($courses = get_my_courses($USER->id)) {
                 foreach ($courses as $course) {
                     if ($course->id == SITEID) {
@@ -53,7 +53,7 @@ class block_course_list extends block_list {
 
         $categories = get_categories("0");  // Parent = 0   ie top-level categories only
         if ($categories) {   //Check we have categories
-            if (count($categories) > 1) {     // Just print top level category links
+            if (count($categories) > 1 || (count($categories) == 1 && count_records('course') > 200)) {     // Just print top level category links
                 foreach ($categories as $category) {
                     $linkcss = $category->visible ? "" : " class=\"dimmed\" ";
                     $this->content->items[]="<a $linkcss href=\"$CFG->wwwroot/course/category.php?id=$category->id\">$category->name</a>";

blocks/db/mysql.php

@@ -58,7 +58,7 @@ global $CFG;
         if(!empty($records)) {
             foreach($records as $block) {
                 $block->multiple = 0;
-                insert_record('block', $block);
+                insert_record('block', $block, false);
             }
         }
 
@@ -82,7 +82,7 @@ global $CFG;
             return false;
         }
 
-        $records = get_records('course');
+        $records = get_records('course', '','','', 'id, shortname, blockinfo');
         if(!empty($records)) {
             foreach($records as $thiscourse) {
                 // The @ suppresses a notice emitted if there is no : in the string
@@ -98,7 +98,7 @@ global $CFG;
                         $instance->weight     = $weight;
                         $instance->visible    = ($blk > 0) ? 1 : 0;
                         $instance->configdata = '';
-                        insert_record('block_instance', $instance);
+                        insert_record('block_instance', $instance, false);
                     }
                 }
                 if(!empty($right)) {
@@ -112,7 +112,7 @@ global $CFG;
                         $instance->weight     = $weight;
                         $instance->visible    = ($blk > 0) ? 1 : 0;
                         $instance->configdata = '';
-                        insert_record('block_instance', $instance);
+                        insert_record('block_instance', $instance, false);
                     }
                 }
             }
@@ -143,6 +143,11 @@ global $CFG;
         }
     }
 
+    if ($oldversion < 2005022401) {
+        // add an index where we really need it
+        modify_database('','ALTER TABLE prefix_block_instance ADD INDEX pagetype (pagetype);');
+    }
+
     //Finally, return result
     return $result;
 }

blocks/db/mysql.sql

@@ -24,6 +24,7 @@ CREATE TABLE `prefix_block_instance` (
   `visible` tinyint(1) not null default '0',
   `configdata` text not null default '',
   PRIMARY KEY(`id`),
-  INDEX pageid(`pageid`)
+  INDEX pageid(`pageid`),
+  INDEX pagetype(`pagetype`)
 ) TYPE=MyISAM;
 # --------------------------------------------------------

blocks/db/postgres7.php

@@ -59,9 +59,9 @@ global $CFG;
         if(!empty($records)) {
             foreach($records as $block) {
                 $block->multiple = 0;
-                unset($block->id);
-                insert_record('block', $block);
+                insert_record('block', $block, false);
             }
+            execute_sql("SELECT setval('{$CFG->prefix}block_id_seq', (SELECT MAX(id) FROM {$CFG->prefix}block), true)");
         }
 
         execute_sql("DROP TABLE {$CFG->prefix}blocks");
@@ -81,7 +81,7 @@ global $CFG;
             return false;
         }
         
-        $records = get_records('course');
+        $records = get_records('course', '','','', 'id, shortname, blockinfo');
         if(!empty($records)) {
             foreach($records as $thiscourse) {
                 // The @ suppresses a notice emitted if there is no : in the string
@@ -97,7 +97,7 @@ global $CFG;
                         $instance->weight     = $weight;
                         $instance->visible    = ($blk > 0) ? 1 : 0;
                         $instance->configdata = '';
-                        insert_record('block_instance', $instance);
+                        insert_record('block_instance', $instance, false);
                     }
                 }
                 if(!empty($right)) {
@@ -111,7 +111,7 @@ global $CFG;
                         $instance->weight     = $weight;
                         $instance->visible    = ($blk > 0) ? 1 : 0;
                         $instance->configdata = '';
-                        insert_record('block_instance', $instance);
+                        insert_record('block_instance', $instance, false);
                     }
                 }
             }
@@ -138,6 +138,19 @@ global $CFG;
         }
     }
 
+    if ($oldversion < 2005022401 && $result) { // Mass cleanup of bad upgrade scripts
+        execute_sql("CREATE INDEX {$CFG->prefix}block_instance_pageid_idx ON {$CFG->prefix}block_instance (pageid)",false); // this one should be quiet...
+        modify_database('','ALTER TABLE prefix_block_instance ALTER pagetype SET DEFAULT \'\'');
+        modify_database('','ALTER TABLE prefix_block_instance ALTER position SET DEFAULT \'\'');
+        modify_database('','ALTER TABLE prefix_block_instance ALTER pagetype SET NOT NULL');
+        modify_database('','ALTER TABLE prefix_block_instance ALTER position SET NOT NULL');
+    }
+
+    if ($oldversion < 2005022401) {
+        // add an index where we really need it
+        modify_database('','CREATE INDEX prefix_block_instance_pagetype_idx ON prefix_block_instance (pagetype);');
+    }
+
     //Finally, return result
     return $result;
 }

blocks/db/postgres7.sql

@@ -10,7 +10,7 @@ CREATE TABLE prefix_block (
   cron INT8  NOT NULL default '0',
   lastcron INT8  NOT NULL default '0',
   visible int NOT NULL default '1',
-  multiple int NOT NULL default '1'
+  multiple int NOT NULL default '0'
 ) ;
 
 CREATE TABLE prefix_block_instance (
@@ -23,5 +23,8 @@ CREATE TABLE prefix_block_instance (
   visible int not null default '0',
   configdata text not null default ''
 ) ;
+
+CREATE INDEX prefix_block_instance_pageid_idx ON prefix_block_instance (pageid);
+CREATE INDEX prefix_block_instance_pagetype_idx ON prefix_block_instance (pagetype);
       
 # --------------------------------------------------------

blocks/glossary_random/block_glossary_random.php

@@ -118,9 +118,12 @@ class block_glossary_random extends block_base {
 
         // select glossaries to put in dropdown box ...
         $glossaries = get_records_select_menu('glossary', 'course='.$this->course->id,'name','id,name');
+
         //format menu texts to avoid html and to filter multilang values
-        foreach($glossaries as $key => $value) {
-            $glossaries[$key] = strip_tags(format_string($value,true));
+        if(!empty($glossaries)) {
+            foreach($glossaries as $key => $value) {
+                $glossaries[$key] = strip_tags(format_string($value,true));
+            }
         }
 
         // and select quotetypes to put in dropdown box

blocks/login/block_login.php

@@ -27,16 +27,20 @@ class block_login extends block_base {
             $wwwroot = str_replace("http://", "https://", $CFG->wwwroot);
         }
 
-        if (is_internal_auth()) {
+        if ($CFG->auth == 'email') {
             $signup = $wwwroot . '/login/signup.php';
             $forgot = $wwwroot . '/login/forgot_password.php';
         } else {
-            if (!empty($CFG->changepassword)) {
-                $forgot = $CFG->changepassword;
-            } else {
-                $forgot = '';
+            if (!empty($CFG->{'auth_'.$CFG->auth.'_stdchangepassword'})
+                || $CFG->changepassword 
+                || is_internal_auth() ) {
+                if (is_internal_auth() || !empty($CFG->{'auth_'.$CFG->auth.'_stdchangepassword'})) {
+                    $forgot =  $wwwroot . '/login/forgot_password.php';
+                }
+                else {
+                    $forgot = $CFG->changepassword;
+                }
             }
-            $signup = $wwwroot . '/login/index.php';  // to see instructions!
         }
 
         $username = get_moodle_cookie() === 'nobody' ? '' : get_moodle_cookie();
@@ -49,7 +53,7 @@ class block_login extends block_base {
             $this->content->text .= '<table align="center" cellpadding="2" cellspacing="0" class="logintable">';
 
             $this->content->text .= '<tr><td class="c0 r0" align="right">'.get_string('username').':</td>';
-            $this->content->text .= '<td class="c1 r0"><input type="text" name="username" size="10" value="'.$username.'" /></td></tr>';
+            $this->content->text .= '<td class="c1 r0"><input type="text" name="username" size="10" value="'.s($username).'" /></td></tr>';
 
             $this->content->text .= '<tr><td class="c0 r1" align="right">'.get_string('password').':</td>';
             $this->content->text .= '<td class="c1 r1"><input type="password" name="password" size="10" value="" /></td></tr>';

blocks/online_users/block_online_users.php

@@ -61,7 +61,8 @@ class block_online_users extends block_base {
                                           {$CFG->prefix}user_students s
                                           $groupmembers
                                      WHERE u.id = s.userid $courseselect $groupselect $timeselect 
-                                  ORDER BY s.timeaccess DESC")) {
+                                  ORDER BY s.timeaccess DESC ".sql_paging_limit(0,20))) {
+
             foreach ($students as $student) {
                 $student->fullname = fullname($student);
                 $users[$student->id] = $student;
@@ -72,7 +73,7 @@ class block_online_users extends block_base {
             if ($siteusers = get_records_sql("SELECT u.id, u.username, u.firstname, u.lastname, u.picture, u.lastaccess
                                      FROM {$CFG->prefix}user u
                                      WHERE u.lastaccess > $timefrom AND u.username <> 'guest'
-                                  ORDER BY u.lastaccess DESC")) {
+                                  ORDER BY u.lastaccess DESC ".sql_paging_limit(0,20))) {
                 foreach ($siteusers as $siteuser) {
                     $siteuser->fullname = fullname($siteuser);
                     $siteuser->timeaccess = $siteuser->lastaccess;
@@ -81,14 +82,21 @@ class block_online_users extends block_base {
             }
         }
 
-        if ($teachers = get_records_sql("SELECT u.id, u.username, u.firstname, u.lastname, u.picture, u.lastaccess, s.timeaccess
+        $findteacherssql = "SELECT u.id, u.username, u.firstname, u.lastname, u.picture, u.lastaccess, s.timeaccess
                                      FROM {$CFG->prefix}user u,
                                           {$CFG->prefix}user_teachers s
                                           $groupmembers
-                                     WHERE u.id = s.userid $courseselect $groupselect $timeselect
-                                  ORDER BY s.timeaccess DESC")) {
+                                     WHERE u.id = s.userid $courseselect $groupselect $timeselect ";
+
+        if (!isteacher($course->id)) {
+            // Hide hidden teachers from students.
+            $findteacherssql .= 'AND s.authority > 0 ';
+        }
+        $findteacherssql .= 'ORDER BY s.timeaccess DESC';
+
+        if ($teachers = get_records_sql($findteacherssql)) {
             foreach ($teachers as $teacher) {
-                $teacher->fullname = '<b>'.fullname($teacher).'</b>';
+                $teacher->fullname = '<strong>'.fullname($teacher).'</strong>';
                 $users[$teacher->id] = $teacher;
             }
         }

blocks/pagedemo.php

@@ -1,5 +1,7 @@
 <?php  // $Id$
 
+    die; //must be fixed before enabling again, see SC#971
+
     // All of this is standard Moodle fixtures
 
     require_once('../config.php');

blocks/quiz_results/block_quiz_results.php

@@ -20,15 +20,15 @@ class block_quiz_results extends block_base {
         if ($this->content !== NULL) {
             return $this->content;
         }
-        if (empty($this->instance)) {
-            $this->content = '';
-            return $this->content;
-        }
 
         $this->content = new stdClass;
         $this->content->text = '';
         $this->content->footer = '';
 
+        if (empty($this->instance)) {
+            return $this->content;
+        }
+
         if($this->instance->pagetype == 'course-view') {
             // We need to see if we are monitoring a quiz 
             $quizid   = empty($this->config->quizid) ? 0 : $this->config->quizid;

blocks/rss_client/block_rss_client.php

@@ -1,20 +1,35 @@
 <?php //$Id$
 
-// Developer's debug assistant - if true then the display string will not cache, only
-// the magpie object's built in caching will be used
-define('BLOCK_RSS_SECONDARY_CACHE_ENABLED', true);
+/*******************************************************************
+* This file contains one class which defines a block for display on
+* any Moodle page. This block can be configured to display the contents
+* of a remote RSS news feed in your web site.
+*
+* @author Daryl Hawes
+* @version  $Id$
+* @license http://www.gnu.org/copyleft/gpl.html GNU Public License
+* @package base
+******************************************************************/
 
-class block_rss_client extends block_base {
+/**
+ * This class is for a block which defines a block for display on
+ * any Moodle page. 
+ */
+ class block_rss_client extends block_base {
 
     function init() {
         $this->title = get_string('feedstitle', 'block_rss_client');
-        $this->version = 2004112000;
+        $this->version = 2004112001;
     }
 
     function preferred_width() {
         return 210;
     }
 
+    function applicable_formats() {
+        return array('all' => true);
+    }
+
     function specialization() {
         // After the block has been loaded we customize the block's title display
         if (!empty($this->config) && !empty($this->config->title)) {
@@ -25,7 +40,7 @@ class block_rss_client extends block_base {
             $this->title = get_string('remotenewsfeed', 'block_rss_client');
         }
     }
-    
+
     function get_content() {
         global $CFG, $editing;
 
@@ -36,11 +51,11 @@ class block_rss_client extends block_base {
         }
 
         $this->content = new stdClass;
+        $this->content->text   = '';
         $this->content->footer = '';
-        
+
         if (empty($this->instance)) {
             // We're being asked for content without an associated instance
-            $this->content->text = '';
             return $this->content;
         }
 
@@ -90,11 +105,11 @@ class block_rss_client extends block_base {
             $page = page_create_object($this->instance->pagetype, $this->instance->pageid);
             if (isset($this->config)) {
                 // this instance is configured - show Add/Edit feeds link
-                $script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'managefeeds'));
+                $script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'managefeeds', 'id' => $this->courseid));
                 $output .= '<div align="center"><a title="'. get_string('feedsaddedit', 'block_rss_client') .'" href="'. $script .'">'. get_string('feedsaddedit', 'block_rss_client') .'</a></div>';
             } else {
                 // this instance has not been configured yet - show configure link
-                $script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'configblock'));
+                $script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'configblock', 'id' => $this->courseid));
                 $output .= '<div align="center"><a title="'. get_string('feedsconfigurenewinstance', 'block_rss_client') .'" href="'. $script.'">'. get_string('feedsconfigurenewinstance', 'block_rss_client') .'</a></div>';
             }
         }
@@ -113,11 +128,11 @@ class block_rss_client extends block_base {
                 $count ++;
             }
         }
-        
+
         $this->content->text = $output;
         return $this->content;
     }
-    
+
     function instance_allow_multiple() {
         return true;
     }
@@ -129,7 +144,7 @@ class block_rss_client extends block_base {
     function instance_allow_config() {
         return true;
     }
-    
+
     /**
      * @param int $rssid The feed to be displayed
      * @param bool $display_description Should the description information from the feed be displayed or simply the title?
@@ -146,20 +161,9 @@ class block_rss_client extends block_base {
         if (!defined('MAGPIE_OUTPUT_ENCODING')) {
             define('MAGPIE_OUTPUT_ENCODING', get_string('thischarset'));  // see bug 3107
         }
-        
-        // Check if there is a cached string which has not timed out.
-        if (BLOCK_RSS_SECONDARY_CACHE_ENABLED &&
-                isset($this->config->{'rssid'. $rssid}) && 
-                    isset($this->config->{'rssid'. $rssid .'timestamp'}) && 
-                        $this->config->{'rssid'. $rssid .'timestamp'} >= $now - $CFG->block_rss_timeout * 60) {
-            // If the cached string is not too stale 
-            // use it rather than going any further
-            return stripslashes_safe($this->config->{'rssid'. $rssid});
-        }
 
         $rss_record = get_record('block_rss_client', 'id', $rssid);
         if (isset($rss_record) && isset($rss_record->id)) {
-                    
             // By capturing the output from fetch_rss this way
             // error messages do not display and clutter up the moodle interface
             // however, we do lose out on seeing helpful messages like "cache hit", etc.
@@ -167,7 +171,7 @@ class block_rss_client extends block_base {
             $rss = fetch_rss($rss_record->url);
             $rsserror = ob_get_contents();
             ob_end_clean();
-            
+
             if ($rss === false) {
                 if ($CFG->debug && !empty($rsserror)) {
                     // There was a failure in loading the rss feed, print link to full error text
@@ -180,9 +184,9 @@ class block_rss_client extends block_base {
             }
 
             if (empty($rss_record->preferredtitle)) {
-                $feedtitle = stripslashes_safe(rss_unhtmlentities($rss->channel['title']));
+                $feedtitle = $this->format_title(stripslashes_safe(rss_unhtmlentities($rss->channel['title'])));
             } else {
-                $feedtitle = stripslashes_safe($rss_record->preferredtitle);
+                $feedtitle = $this->format_title(stripslashes_safe($rss_record->preferredtitle));
             }
 //            print_object($rss);
             if (isset($this->config) && 
@@ -198,6 +202,12 @@ class block_rss_client extends block_base {
 
             $formatoptions->para = false;
 
+            // first we must verify that the rss feed is loaded
+            // by checking $rss and $rss->items exist before using them
+            if (empty($rss) || empty($rss->items)) {
+                return '';
+            }
+
             foreach ($rss->items as $item) {
                 $item['title'] = stripslashes_safe(rss_unhtmlentities($item['title']));
                 $item['description'] = stripslashes_safe(rss_unhtmlentities($item['description']));
@@ -207,7 +217,7 @@ class block_rss_client extends block_base {
                 } else {
                     $item['title'] = break_up_long_words($item['title'], 30);
                 }
-        
+
                 if ($item['link'] == '') {
                     $item['link'] = $item['guid'];
                 }
@@ -216,7 +226,6 @@ class block_rss_client extends block_base {
 
                 $returnstring .= '<div class="link"><a href="'. $item['link'] .'" target="_blank">'. $item['title'] . '</a></div>' ."\n";
 
-                
                 if ($display_description && !empty($item['description'])) {
                     $item['description'] = break_up_long_words($item['description'], 30);
                     $returnstring .= '<div class="description">'.
@@ -243,12 +252,17 @@ class block_rss_client extends block_base {
                 $this->title = $feedtitle;
             }
         }
-        
-        // store config setting for this rssid so we do not need to read from file each time
-        $this->config->{'rssid'. $rssid} = addslashes($returnstring);
-        $this->config->{'rssid'. $rssid .'timestamp'} = $now; 
-        $this->instance_config_save($this->config);
         return $returnstring;
     }
+
+     // just strips the title down and adds ... for excessively long titles.
+     function format_title($title,$max=64) {
+         if (strlen($title) <= $max) {
+             return $title;
+         }
+         else {
+             return substr($title,0,$max-3).'...';
+         }
+     }
 }
 ?>

blocks/rss_client/block_rss_client_action.php

@@ -1,227 +1,248 @@
 <?php //$Id$
 
-    require_once('../../config.php');
-    require_once($CFG->libdir .'/rsslib.php');
-    require_once(MAGPIE_DIR .'rss_fetch.inc');
+/*******************************************************************
+* This file contains no classes. It will display a list of existing feeds
+* defined for the site and allow add/edit/delete of site feeds.
+*
+* @author Daryl Hawes
+* @version  $Id$
+* @license http://www.gnu.org/copyleft/gpl.html GNU Public License
+* @package base
+******************************************************************/
 
-    require_login();
-    global $USER;
-    
-    //ensure that the logged in user is not using the guest account
-    if (isset($_SERVER['HTTP_REFERER'])) {
-        $referrer = $_SERVER['HTTP_REFERER'];
+require_once('../../config.php');
+require_once($CFG->libdir .'/rsslib.php');
+require_once(MAGPIE_DIR .'rss_fetch.inc');
+
+require_login();
+global $USER;
+
+//ensure that the logged in user is not using the guest account
+if (isset($_SERVER['HTTP_REFERER'])) {
+    $referrer = $_SERVER['HTTP_REFERER'];
+} else {
+    $referrer = $CFG->wwwroot;
+}
+if (isguest()) {
+    error(get_string('noguestpost', 'forum'), $referrer);
+}
+
+$act            = optional_param('act', NULL, PARAM_ALPHA);
+$rssid          = optional_param('rssid', NULL, PARAM_INT);
+$id             = optional_param('id', SITEID, PARAM_INT);
+$url            = optional_param('url', NULL, PARAM_URL);
+$preferredtitle = optional_param('preferredtitle', '', PARAM_ALPHA);
+
+if (!defined('MAGPIE_OUTPUT_ENCODING')) {
+    define('MAGPIE_OUTPUT_ENCODING', get_string('thischarset'));  // see bug 3107
+}
+
+if (!empty($id)) {
+    // we get the complete $course object here because print_header assumes this is 
+    // a complete object (needed for proper course theme settings)
+    $course = get_record('course', 'id', $id);
+}
+
+$straddedit = get_string('feedsaddedit', 'block_rss_client');
+if ( isadmin() ) {
+    $navigation = '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/index.php">'.get_string('administration').'</a> -> '.
+        '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/configure.php">'.get_string('configuration').'</a> -> '.$straddedit;
+} else if (!empty($course)) {
+    $navigation = '<a href="'.$CFG->wwwroot.'/course/view.php?id='.$id.'">'.$course->shortname.'</a> -> '.$straddedit;
+} else {
+    $navigation = $straddedit;
+}
+
+print_header($straddedit, $straddedit, $navigation);
+
+//check to make sure that the user is allowed to post new feeds
+$submitters = $CFG->block_rss_client_submitters;
+$isteacher  = empty($course) ? false : isteacher($id);
+
+if ( !isset($act) ) {
+    rss_display_feeds($id);
+    rss_print_form($act, $url, $rssid, $preferredtitle, $id);
+    print_footer();
+    die();
+}
+
+if ( isset($rssid) ) {
+    $rss_record = get_record('block_rss_client', 'id', $rssid);
+}
+
+//if the user is an admin or course teacher then allow the user to
+//assign categories to other uses than personal
+if (isset($rss_record) && !( isadmin() || $submitters == SUBMITTERS_ALL_ACCOUNT_HOLDERS || 
+        ($submitters == SUBMITTERS_ADMIN_AND_TEACHER && $isteacher) || 
+            ( ($act == 'rssedit' || $act == 'delfeed' || $act == 'updfeed') && $USER->id == $rss_record->userid)  ) ) {
+        error(get_string('noguestpost', 'forum').' You are not allowed to make modifications to this RSS feed at this time.', $referrer);
+}
+
+if ($act == 'updfeed') {
+    if (empty($url)) {
+        error( 'url not defined for rss feed' );
+    }
+
+    // By capturing the output from fetch_rss this way
+    // error messages do not display and clutter up the moodle interface
+    // however, we do lose out on seeing helpful messages like "cache hit", etc.
+    $message = '';
+    ob_start();
+    $rss = fetch_rss($url);
+    if ($CFG->debug) {
+        $message .= ob_get_contents();
+    }
+    ob_end_clean();
+
+    $dataobject->id = $rssid;
+    if ($rss === false) {
+        $dataobject->description = '';
+        $dataobject->title = '';
+        $dataobject->preferredtitle = '';
     } else {
-        $referrer = $CFG->wwwroot;
+        $dataobject->description = addslashes(rss_unhtmlentities($rss->channel['description']));
+        $dataobject->title = addslashes(rss_unhtmlentities($rss->channel['title']));
+        $dataobject->preferredtitle = addslashes($preferredtitle);
     }
-    if (isguest()) {
-        error(get_string('noguestpost', 'forum'), $referrer);
+    $dataobject->url = addslashes($url);
+
+    if (!update_record('block_rss_client', $dataobject)) {
+        error('There was an error trying to update rss feed with id:'. $rssid);
     }
 
-    optional_variable($act, 'none');
-    optional_variable($rssid, 'none');
-    $courseid = optional_param('courseid', 0, PARAM_INT);
-    optional_variable($url);
-    optional_variable($preferredtitle, '');
-    optional_variable($item);
+    $message .= '<br />'. get_string('feedupdated', 'block_rss_client');
+    redirect($referrer, $message);
 
-    if (!defined('MAGPIE_OUTPUT_ENCODING')) {
-        define('MAGPIE_OUTPUT_ENCODING', get_string('thischarset'));  // see bug 3107
+} else if ($act == 'addfeed' ) {
+
+    if (empty($url)) {
+        error('url not defined for rss feed');
+    }
+    $dataobject->userid = $USER->id;
+    $dataobject->description = '';
+    $dataobject->title = '';
+
+    // attempting to replace feed and rss url types with http
+    // it appears that the rss feed validator will validate these url types but magpie will not load them
+    $url = str_replace ("feed://", "http://", "$url");
+    $url = str_replace ("FEED://", "http://", "$url");
+    $url = str_replace ("rss://", "http://", "$url");
+    $url = str_replace ("RSS://", "http://", "$url");
+
+    $dataobject->url = addslashes($url);
+    $dataobject->preferredtitle = addslashes($preferredtitle);
+
+    $rssid = insert_record('block_rss_client', $dataobject);
+    if (!$rssid) {
+        error('There was an error trying to add a new rss feed:'. $url);
     }
 
-    if (!empty($courseid)) {
-        $course = get_record('course', 'id', $courseid, '', '', '', '', 'shortname');
+    // By capturing the output from fetch_rss this way
+    // error messages do not display and clutter up the moodle interface
+    // however, we do lose out on seeing helpful messages like "cache hit", etc.
+    $message = '';
+    ob_start();
+    $rss = fetch_rss($url);
+    if ($CFG->debug) {
+        $message .= ob_get_contents();
     }
+    ob_end_clean();
 
-    $straddedit = get_string('feedsaddedit', 'block_rss_client');
-    if ( isadmin() ) {
-        $stradmin = get_string('administration');
-        $strconfiguration = get_string('configuration');
-        $navigation = "<a href=\"$CFG->wwwroot/$CFG->admin/index.php\">$stradmin</a> -> ".
-        "<a href=\"$CFG->wwwroot/$CFG->admin/configure.php\">$strconfiguration</a> -> $straddedit";
-    } else if (!empty($course)) {
-        $navigation = "<a href=\"$CFG->wwwroot/course/view.php?id=$courseid\">$course->shortname</a> -> $straddedit";
+    if ($rss === false) {
+        $message .= '<br /><br />There was an error loading this rss feed. You may want to verify the url you have specified before using it.'; //Daryl Hawes note: localize this line
     } else {
-        $navigation = $straddedit;
-    }
-    
-    print_header(get_string('feedsaddedit', 'block_rss_client'), 
-                 get_string('feedsaddedit', 'block_rss_client'), 
-                 $navigation );
 
-    //check to make sure that the user is allowed to post new feeds
-    $submitters = $CFG->block_rss_client_submitters;
-    $isteacher = false;
-    if (!empty($course)) {
-        $isteacher = isteacher($course->id);
-    }
-
-    //if the user is an admin or course teacher then allow the user to
-    //assign categories to other uses than personal
-    if (!( isadmin() || $submitters == SUBMITTERS_ALL_ACCOUNT_HOLDERS || ($submitters == SUBMITTERS_ADMIN_AND_TEACHER && $isteacher) ) ) {
-        error(get_string('noguestpost', 'forum'), $referrer);
-    }
-
-    if ($act == 'none') {
-        rss_display_feeds();
-        rss_get_form($act, $url, $rssid, $preferredtitle);
-
-    } else if ($act == 'updfeed') {
-        require_variable($url);
-        
-        // By capturing the output from fetch_rss this way
-        // error messages do not display and clutter up the moodle interface
-        // however, we do lose out on seeing helpful messages like "cache hit", etc.
-        ob_start();
-        $rss = fetch_rss($url);
-        $rsserror = ob_get_contents();
-        ob_end_clean();
-        
         $dataobject->id = $rssid;
-        if ($rss === false) {
-            $dataobject->description = '';
-            $dataobject->title = '';
-            $dataobject->preferredtitle = '';
-        } else {
+        if (!empty($rss->channel['description'])) {
             $dataobject->description = addslashes(rss_unhtmlentities($rss->channel['description']));
-            $dataobject->title = addslashes(rss_unhtmlentities($rss->channel['title']));
-            $dataobject->preferredtitle = addslashes($preferredtitle);
         }
-        $dataobject->url = addslashes($url);
-
+        if (!empty($rss->channel['title'])) {
+            $dataobject->title = addslashes(rss_unhtmlentities($rss->channel['title']));
+        } 
         if (!update_record('block_rss_client', $dataobject)) {
             error('There was an error trying to update rss feed with id:'. $rssid);
         }
-
-        redirect($referrer, get_string('feedupdated', 'block_rss_client'));
-/*        rss_display_feeds();
-        rss_get_form($act, $dataobject->url, $rssid, $dataobject->preferredtitle);
+        $message .= '<br />'. get_string('feedadded', 'block_rss_client');
+    }
+    redirect($referrer, $message);
+/*
+        rss_display_feeds($id);
+        rss_print_form($act, $dataobject->url, $dataobject->id, $dataobject->preferredtitle, $id);
 */
-    } else if ($act == 'addfeed' ) {
+} else if ( isset($rss_record) && $act == 'rssedit' ) {
 
-        require_variable($url);            
-        $dataobject->userid = $USER->id;
-        $dataobject->description = '';
-        $dataobject->title = '';
-        $dataobject->url = addslashes($url);
-        $dataobject->preferredtitle = addslashes($preferredtitle);
+    $preferredtitle = stripslashes_safe($rss_record->preferredtitle);
+    if (empty($preferredtitle)) {
+        $preferredtitle = stripslashes_safe($rss_record->title);
+    }
+    $url = stripslashes_safe($rss_record->url);
+    rss_display_feeds($id, '', $rssid);
+    rss_print_form($act, $url, $rssid, $preferredtitle, $id);
 
-        $rssid = insert_record('block_rss_client', $dataobject);
-        if (!$rssid) {
-            error('There was an error trying to add a new rss feed:'. $url);
-        }
+} else if ($act == 'delfeed') {
 
+    $file = $CFG->dataroot .'/cache/rsscache/'. $rssid .'.xml';
+    if (file_exists($file)) {
+        unlink($file);
+    }
+
+    // echo "DEBUG: act = delfeed"; //debug
+    delete_records('block_rss_client', 'id', $rssid);
+
+    redirect($referrer, get_string('feeddeleted', 'block_rss_client') );
+
+} else if ( isset($rss_record) && $act == 'view' ) {
+    //              echo $sql; //debug
+    //              print_object($res); //debug
+    if (!$rss_record->id) {
+        print '<strong>'. get_string('couldnotfindfeed', 'block_rss_client') .': '. $rssid .'</strong>';
+    } else {
         // By capturing the output from fetch_rss this way
         // error messages do not display and clutter up the moodle interface
         // however, we do lose out on seeing helpful messages like "cache hit", etc.
         ob_start();
-        $rss = fetch_rss($url);
-        $rsserror = ob_get_contents();
+        $rss = fetch_rss($rss_record->url);
         ob_end_clean();
-        
-        if ($rss === false) {
-            $message = 'There was an error loading this rss feed. You may want to verify the url you have specified before using it.'; //Daryl Hawes note: localize this line
+
+        if (empty($rss_record->preferredtitle)) {
+            $feedtitle = stripslashes_safe($rss_record->preferredtitle);
         } else {
-
-            $dataobject->id = $rssid;
-            if (!empty($rss->channel['description'])) {
-                $dataobject->description = addslashes(rss_unhtmlentities($rss->channel['description']));
+            $feedtitle =  stripslashes_safe(rss_unhtmlentities($rss->channel['title']));
+        }
+        print '<table align="center" width="50%" cellspacing="1">'."\n";
+        print '<tr><td colspan="2"><strong>'. $feedtitle .'</strong></td></tr>'."\n";
+        for($y=0; $y < count($rss->items); $y++) {
+            $rss->items[$y]['title'] = stripslashes_safe(rss_unhtmlentities($rss->items[$y]['title']));
+            $rss->items[$y]['description'] = stripslashes_safe(rss_unhtmlentities($rss->items[$y]['description']));
+            if ($rss->items[$y]['link'] == '') {
+                $rss->items[$y]['link'] = $rss->items[$y]['guid'];
             }
-            if (!empty($rss->channel['title'])) {
-                $dataobject->title = addslashes(rss_unhtmlentities($rss->channel['title']));
-            } 
-            if (!update_record('block_rss_client', $dataobject)) {
-                error('There was an error trying to update rss feed with id:'. $rssid);
+
+            if ($rss->items[$y]['title'] == '') {
+                $rss->items[$y]['title'] = '&gt;&gt;';
             }
-            $message = get_string('feedadded', 'block_rss_client');
-        }
-        redirect($referrer, $message);
-/*
-        rss_display_feeds();
-        rss_get_form($act, $dataobject->url, $dataobject->id, $dataobject->preferredtitle);
-*/
-    } else if ( $act == 'rss_edit') {
-        
-        $rss_record = get_record('block_rss_client', 'id', $rssid);
-        $preferredtitle = stripslashes_safe($rss_record->preferredtitle);
-        if (empty($preferredtitle)) {
-            $preferredtitle = stripslashes_safe($rss_record->title);
-        }
-        $url = stripslashes_safe($rss_record->url);
-        rss_display_feeds('', $rssid);
-        rss_get_form($act, $url, $rssid, $preferredtitle);
 
-    } else if ($act == 'delfeed') {
-        
-        $file = $CFG->dataroot .'/cache/rsscache/'. $rssid .'.xml';
-        if (file_exists($file)) {
-            unlink($file);
-        }
-
-        // echo "DEBUG: act = delfeed"; //debug
-        //Daryl Hawes note: convert this sql statement to a moodle function call
-        $sql = 'DELETE FROM '. $CFG->prefix .'block_rss_client WHERE id='. $rssid;
-        $res= $db->Execute($sql);
-
-        redirect($referrer, get_string('feeddeleted', 'block_rss_client') );
-
-/*        rss_display_feeds();
-        rss_get_form($act, $url, $rssid, $preferredtitle);
-*/
-    } else if ($act == 'view') {
-        //              echo $sql; //debug
-        //              print_object($res); //debug
-        $rss_record = get_record('block_rss_client', 'id', $rssid);
-        if (!$rss_record->id) {
-            print '<strong>'. get_string('couldnotfindfeed', 'block_rss_client') .': '. $rssid .'</strong>';
-        } else {
-            // By capturing the output from fetch_rss this way
-            // error messages do not display and clutter up the moodle interface
-            // however, we do lose out on seeing helpful messages like "cache hit", etc.
-            ob_start();
-            $rss = fetch_rss($rss_record->url);
-            $rsserror = ob_get_contents();
-            ob_end_clean();
-            
-            if (empty($rss_record->preferredtitle)) {
-                $feedtitle = stripslashes_safe($rss_record->preferredtitle);
+            print '<tr><td valign="middle">'."\n";
+            print '<a href="'. $rss->items[$y]['link'] .'" target="_blank"><strong>'. $rss->items[$y]['title'];
+            print '</strong></a>'."\n";
+            print '</td>'."\n";
+            if (file_exists($CFG->dirroot .'/blog/lib.php')) {
+                //Blog module is installed - provide "blog this" link
+                print '<td align="right">'."\n";
+                print '<img src="'. $CFG->pixpath .'/blog/blog.gif" alt="'. get_string('blogthis', 'blog').'" title="'. get_string('blogthis', 'blog') .'" border="0" align="middle" />'."\n";
+                print '<a href="'. $CFG->wwwroot .'/blog/blogthis.php?userid='. $userid .'&act=use&item='. $y .'&rssid='. $rssid .'"><small><strong>'. get_string('blogthis', 'blog') .'</strong></small></a>'."\n";
             } else {
-               $feedtitle =  stripslashes_safe(rss_unhtmlentities($rss->channel['title']));
+                print '<td>&nbsp;';
             }
-            print '<table align="center" width="50%" cellspacing="1">'."\n";
-            print '<tr><td colspan="2"><strong>'. $feedtitle .'</strong></td></tr>'."\n";
-            for($y=0; $y < count($rss->items); $y++) {
-                $rss->items[$y]['title'] = stripslashes_safe(rss_unhtmlentities($rss->items[$y]['title']));
-                $rss->items[$y]['description'] = stripslashes_safe(rss_unhtmlentities($rss->items[$y]['description']));
-                if ($rss->items[$y]['link'] == '') {
-                    $rss->items[$y]['link'] = $rss->items[$y]['guid'];
-                }
-
-                if ($rss->items[$y]['title'] == '') {
-                    $rss->items[$y]['title'] = '&gt;&gt;';
-                }
-
-                print '<tr><td valign="middle">'."\n";
-                print '<a href="'. $rss->items[$y]['link'] .'" target="_blank"><strong>'. $rss->items[$y]['title'];
-                print '</strong></a>'."\n";
-                print '</td>'."\n";
-                if (file_exists($CFG->dirroot .'/blog/lib.php')) {
-                    //Blog module is installed - provide "blog this" link
-                    print '<td align="right">'."\n";
-                    print '<img src="'. $CFG->pixpath .'/blog/blog.gif" alt="'. get_string('blogthis', 'blog').'" title="'. get_string('blogthis', 'blog') .'" border="0" align="middle" />'."\n";
-                    print '<a href="'. $CFG->wwwroot .'/blog/blogthis.php?blogid='. $blogid .'&act=use&item='. $y .'&rssid='. $rssid .'"><small><strong>'. get_string('blogthis', 'blog') .'</strong></small></a>'."\n";
-                } else {
-                    print '<td>&nbsp;';
-                }
-                print '</td></tr>'."\n";
-                print '<tr><td colspan=2><small>';
-                print $rss->items[$y]['description'] .'</small></td></tr>'."\n";
-            }
-            print '</table>'."\n";
+            print '</td></tr>'."\n";
+            print '<tr><td colspan=2><small>';
+            print $rss->items[$y]['description'] .'</small></td></tr>'."\n";
         }
-    } else {
-        rss_display_feeds();
-        rss_get_form($act, $url, $rssid, $preferredtitle);
+        print '</table>'."\n";
     }
-
-    print_footer();
-?>
+} else {
+    rss_display_feeds($id);
+    rss_print_form($act, $url, $rssid, $preferredtitle, $id);
+}
+print_footer();
+?>

blocks/rss_client/block_rss_client_error.php

@@ -1,14 +1,14 @@
 <?php //$Id$
+// Print an error page condition
+require_once('../../config.php');
 
-    require_once('../../config.php');
+$error = required_param('error', PARAM_CLEAN);
 
-    require_variable($error);
+print_header(get_string('error'), 
+              get_string('error'), 
+              get_string('error') );
 
-    print_header(get_string('error'), 
-                 get_string('error'), 
-                 get_string('error') );
+print clean_text(urldecode($error));
 
-    print clean_text(urldecode($error));
-
-    print_footer();
-?>
+print_footer();
+?>

blocks/rss_client/config_global.html

@@ -17,6 +17,7 @@
         <?php print_string('clientnumentries', 'block_rss_client') ?>
     </td>
 </tr>
+
 <tr valign="top">
     <td align="right">block_rss_timeout:</td>
     <td>
@@ -31,6 +32,7 @@
         <?php print_string('timeout', 'block_rss_client') ?>
     </td>
 </tr>
+
 <tr valign="top">
     <td align="right">block_rss_client_submitters:</td>
     <td>
@@ -56,13 +58,16 @@
     </td>
 </tr>
 
-
 <tr>
     <td colspan="3" align="center">
     <input type="submit" value="<?php print_string('savechanges') ?>"></td>
 </tr>
 <tr>
-    
-    <td colspan="3" align="center"><a href=" <?php echo $CFG->wwwroot; ?>/blocks/rss_client/block_rss_client_action.php?courseid=<?php echo $courseid; ?>"><?php print_string('feedsaddedit', 'block_rss_client')?></a></center><br /><br />
+    <td colspan="3" align="center"><a href=" <?php echo $CFG->wwwroot; ?>/blocks/rss_client/block_rss_client_action.php?id=<?php 
+    if (!isset($id)) {
+        $id = '';
+    }
+    echo $id; ?>"><?php print_string('feedsaddedit', 'block_rss_client')?></a></center><br /><br />
     </td>
-</table>
+    </tr>
+</table>

blocks/rss_client/config_instance.html

@@ -1,11 +1,13 @@
-<?php 
+<?php // $Id$ //
 require_once($CFG->libdir .'/rsslib.php');
 
+$id       = optional_param('id', SITEID, PARAM_INT);
+
 //create a page object for url_get_full()
 $page = page_create_object($this->instance->pagetype, $this->instance->pageid);
 
 /// Print tabs at top
-global $currentaction;
+$currentaction = optional_param('currentaction', '', PARAM_ALPHA);
 if (empty($currentaction) || $currentaction == 'configblock') {
     $currentaction = 'configblock';
 } else {
@@ -36,6 +38,7 @@ if ($currentaction == 'configblock') {
             ?>
     </td>
 </tr>
+
 <tr valign="top">
     <td align="right" width="50%">
         <?php print_string('shownumentrieslabel', 'block_rss_client') ?>
@@ -54,6 +57,7 @@ if ($currentaction == 'configblock') {
         ?>" />
     </td>
 </tr>
+
 <tr valign="top">
     <td align="right" width="50%">
         <?php print_string('choosefeedlabel', 'block_rss_client') ?>
@@ -87,12 +91,13 @@ if ($currentaction == 'configblock') {
             } else {
                 print_string('nofeeds', 'block_rss_client');
                 if ( isadmin() ) {
-                    print '&nbsp;<a href="'. $CFG->wwwroot .'/blocks/rss_client/block_rss_client_action.php"> '. get_string('editnewsfeeds', 'block_rss_client') .'</a><br />';
+                    print '&nbsp;<a href="'. $CFG->wwwroot .'/blocks/rss_client/block_rss_client_action.php?id='. $id .'"> '. get_string('editnewsfeeds', 'block_rss_client') .'</a><br />';
                 }
             }
         ?>
     </td>
 </tr>
+
 <tr valign="top">
     <td align="right" width="50%"><?php print_string('uploadlabel'); ?></td>
     <?php 
@@ -104,6 +109,7 @@ if ($currentaction == 'configblock') {
     <td width="50%"><input type="text" name="title" size="30" value="<?php echo $title; ?>" />
     </td>
 </tr>
+
 <tr valign="top">
     <td align="right" width="50%"><?php print_string('clientshowchannellinklabel', 'block_rss_client'); ?></td>
     <td width="50%">
@@ -120,6 +126,7 @@ if ($currentaction == 'configblock') {
         ?>
     </td>
 </tr>
+
 <tr valign="top">
     <td align="right" width="50%"><?php print_string('clientshowimagelabel', 'block_rss_client'); ?></td>
     <td width="50%">
@@ -136,6 +143,7 @@ if ($currentaction == 'configblock') {
         ?>
     </td>
 </tr>
+
 <tr>
     <td colspan="2" align="center">
         <input type="submit" value="<?php print_string('savechanges') ?>">
@@ -147,8 +155,8 @@ if ($currentaction == 'configblock') {
     global $act, $url, $rssid, $preferredtitle;
     print '<table cellpadding="9" cellspacing="0" class="blockconfigtable">';
     print '<tr valign="top"><td>';
-    rss_display_feeds();
+    rss_display_feeds($id);
     print '</form>'; //not sure that this is needed
-    rss_get_form($act, $url, $rssid, $preferredtitle); 
+    rss_print_form($act, $url, $rssid, $preferredtitle, $id);
     print '</td></tr></table>';
-} ?>
+} ?>

blocks/rss_client/config_instance_tabs.php

@@ -2,21 +2,21 @@
 /// This file to be included so we can assume config.php has already been included.
 /// We also assume that $inactive, $activetab and $currentaction have been set
 
-    global $USER;
-    $tabs = $row = array();
+global $USER;
+$tabs = $row = array();
 
-    $script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'configblock'));
-    $row[] = new tabobject('configblock', $script, 
-                get_string('configblock', 'block_rss_client'));
+$script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'configblock', 'id' => $id));
+$row[] = new tabobject('configblock', $script, 
+            get_string('configblock', 'block_rss_client'));
 
-    $script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'managefeeds'));
-    $row[] = new tabobject('managefeeds', $script, 
-                get_string('managefeeds', 'block_rss_client'));
+$script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'managefeeds', 'id' => $id));
+$row[] = new tabobject('managefeeds', $script, 
+            get_string('managefeeds', 'block_rss_client'));
 
-    $tabs[] = $row;
+$tabs[] = $row;
 
-    /// Print out the tabs and continue!
-    print '<div align="center">';
-    print_tabs($tabs, $currentaction);
-    print '</div>';
+/// Print out the tabs and continue!
+print '<div align="center">';
+print_tabs($tabs, $currentaction);
+print '</div>';
 ?>

blocks/rss_client/db/mysql.php

@@ -1,6 +1,6 @@
 <?php //$Id$
 
-function block_rss_client_upgrade($oldversion) {
+function rss_client_upgrade($oldversion) {
 /// This function does anything necessary to upgrade 
 /// older versions to match current functionality 
 
@@ -10,6 +10,12 @@ function block_rss_client_upgrade($oldversion) {
        # Do something ...
     }
 
+    if ($oldversion < 2004112001) {
+        // title and description should be TEXT as we don't have control over their length.
+        table_column('block_rss_client','title','title','text',10,'unsigned','');
+        table_column('block_rss_client','description','description','text',10,'unsigned','');
+    }
+
     return true;
 }
 

blocks/rss_client/db/mysql.sql

@@ -13,9 +13,9 @@
 CREATE TABLE prefix_block_rss_client (
  `id` int(11) NOT NULL auto_increment,
  `userid` int(11) NOT NULL default '0',
- `title` varchar(64) NOT NULL default '',
+ `title` text NOT NULL default '',
  `preferredtitle` varchar(64) NOT NULL default '',
- `description` varchar(128) NOT NULL default '',
+ `description` text NOT NULL default '',
  `url` varchar(255) NOT NULL default '',
 PRIMARY KEY  (`id`)
 ) TYPE=MyISAM  COMMENT='Remote news feed information. Contains the news feed id, the userid of the user who added the feed, the title of the feed itself and a description of the feed contents along with the url used to access the remote feed. Preferredtitle is a field for future use - intended to allow for custom titles rather than those found in the feed.';

blocks/rss_client/db/postgres7.php

@@ -1,11 +1,16 @@
 <?php
 
-function block_rss_client_upgrade($oldversion) {
+function rss_client_upgrade($oldversion) {
 /// This function does anything necessary to upgrade 
 /// older versions to match current functionality 
 
     global $CFG;
 
+    if ($oldversion < 2004112001) {
+        // title and description should be TEXT as we don't have control over their length.
+        table_column('block_rss_client','title','title','text');
+        table_column('block_rss_client','description','description','text');
+    }
 
     return true;
 }

blocks/rss_client/db/postgres7.sql

@@ -11,8 +11,8 @@
 CREATE TABLE prefix_block_rss_client (
  id SERIAL PRIMARY KEY,
  userid INTEGER NOT NULL default '0',
- title varchar(64) NOT NULL default '',
+ title text NOT NULL default '',
  preferredtitle varchar(64) NOT NULL default '',
- description varchar(128) NOT NULL default '',
+ description text NOT NULL default '',
  url varchar(255) NOT NULL default ''
 );

blocks/section_links/block_section_links.php

@@ -22,7 +22,7 @@ class block_section_links extends block_base {
     }
 
     function applicable_formats() {
-        return (array('course-view-weeks' => true, 'course-view-topics' => true));
+        return (array('course-view-weeks' => true, 'course-view-topics' => true, 'course-edit-weeks' => true, 'course-edit-topics' => true));
     }
 
     function get_content() {

blocks/social_activities/block_social_activities.php

@@ -51,7 +51,7 @@ class block_social_activities extends block_list {
 
         if ($ismoving) {
             $this->content->icons[] = '&nbsp;<img align="bottom" src="'.$CFG->pixpath.'/t/move.gif" height="11" width="11" alt=\"\" />';
-            $this->content->items[] = $USER->activitycopyname.'&nbsp;(<a href="'.$CFG->wwwroot.'/course/mod.php?cancelcopy=true">'.$strcancel.'</a>)';
+            $this->content->items[] = $USER->activitycopyname.'&nbsp;(<a href="'.$CFG->wwwroot.'/course/mod.php?cancelcopy=true&amp;sesskey='.$USER->sesskey.'">'.$strcancel.'</a>)';
         }
 
         if (!empty($section->sequence)) {

blocks/version.php

@@ -5,4 +5,4 @@
 // database (blocks_version) to determine whether upgrades should
 // be performed (see db/backup_*.php)
 
-$blocks_version = 2005022400;   // The current version is a date (YYYYMMDDXX)
+$blocks_version = 2005022401;   // The current version is a date (YYYYMMDDXX)

calendar/event.php

@@ -54,6 +54,11 @@
     $eventid   = optional_param('id', 0, PARAM_INT);
     $eventtype = optional_param('type', 'select', PARAM_ALPHA);
     $urlcourse = optional_param('course', 0, PARAM_INT);
+    $cal_y = optional_param('cal_y');
+    $cal_m = optional_param('cal_m');
+    $cal_d = optional_param('cal_d');
+    
+    $focus = '';
 
     if(!$site = get_site()) {
         redirect($CFG->wwwroot.'/'.$CFG->admin.'/index.php');
@@ -62,7 +67,7 @@
     $strcalendar = get_string('calendar', 'calendar');
 
     $now = usergetdate(time());
-    $nav = calendar_get_link_tag($strcalendar, CALENDAR_URL.'view.php?view=upcoming&', $now['mday'], $now['mon'], $now['year']);
+    $nav = calendar_get_link_tag($strcalendar, CALENDAR_URL.'view.php?view=upcoming&course='.$urlcourse.'&', $now['mday'], $now['mon'], $now['year']);
     $day = intval($now['mday']);
     $mon = intval($now['mon']);
     $yr = intval($now['year']);
@@ -113,7 +118,7 @@
 
             if($form = data_submitted()) {
 
-                $form->name = strip_tags($form->name,'<lang>');  // Strip all tags, but <lang>
+                $form->name = clean_text(strip_tags($form->name,'<lang><span>'));
 
                 $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin);
                 if($form->duration == 1) {
@@ -165,7 +170,7 @@
                     }
 
                     // OK, now redirect to day view
-                    redirect(CALENDAR_URL.'view.php?view=day&cal_d='.$form->startday.'&cal_m='.$form->startmon.'&cal_y='.$form->startyr);
+                    redirect(CALENDAR_URL.'view.php?view=day&amp;course='.$urlcourse.'&cal_d='.$form->startday.'&cal_m='.$form->startmon.'&cal_y='.$form->startyr);
                 }
                 else {
                     foreach ($err as $key => $value) {
@@ -178,7 +183,9 @@
         case 'new':
             $title = get_string('newevent', 'calendar');
             $form = data_submitted();
-            if(!empty($form) && $form->type == 'defined') {
+            // new if criteria
+            // if(!empty($form) && $form->type == 'defined') {
+            if(!empty($form) && !empty($form->name)) {
 
                 $form->name = strip_tags($form->name, '<lang>');  // Strip all tags but <lang>
 
@@ -211,24 +218,28 @@
                     $eventid = insert_record('event', $form, true);
 
                     /// Log the event entry.
-                    $form->name = stripslashes($form->name);  //To avoid double-slashes
-                    add_to_log($form->courseid, 'calendar', 'add', 'event.php?action=edit&amp;id='.$eventid, $form->name);
+                    add_to_log($form->courseid, 'calendar', 'add', 'event.php?action=edit&amp;id='.$eventid, stripslashes($form->name));
 
                     if ($form->repeat) {
                         for($i = 1; $i < $form->repeats; $i++) {
-                            // [pj]
-                            // This will not necessarily work correctly because of DST
-                            $form->timestart += 604800;  // add one week
+                            // What's the DST offset for the previous repeat?
+                            $dst_offset_prev = dst_offset_on($form->timestart);
+
+                            $form->timestart += WEEKSECS;
+
+                            // If the offset has changed in the meantime, update this repeat accordingly
+                            $form->timestart += $dst_offset_prev - dst_offset_on($form->timestart);
+
                             /// Get the event id for the log record.
                             $eventid = insert_record('event', $form, true);
+
                             /// Log the event entry.
-                            $form->name = stripslashes($form->name);  //To avoid double-slashes
-                            add_to_log($form->courseid, 'calendar', 'add', 'event.php?action=edit&amp;id='.$eventid, $form->name);
+                            add_to_log($form->courseid, 'calendar', 'add', 'event.php?action=edit&amp;id='.$eventid, stripslashes($form->name));
                         }
                     }
 
                     // OK, now redirect to day view
-                    redirect(CALENDAR_URL.'view.php?view=day&cal_d='.$form->startday.'&cal_m='.$form->startmon.'&cal_y='.$form->startyr);
+                    redirect(CALENDAR_URL.'view.php?view=day&amp;course='.$urlcourse.'&cal_d='.$form->startday.'&cal_m='.$form->startmon.'&cal_y='.$form->startyr);
                 }
                 else {
                     foreach ($err as $key => $value) {
@@ -237,6 +248,9 @@
                 }
             }
         break;
+        default: // no action
+            $title='';
+        break;
     }
     if(empty($focus)) $focus = '';
 
@@ -281,7 +295,7 @@
                     }
                 }
 
-                redirect(CALENDAR_URL.'view.php?view=day&cal_d='.$_REQUEST['d'].'&cal_m='.$_REQUEST['m'].'&cal_y='.$_REQUEST['y']);
+                redirect(CALENDAR_URL.'view.php?view=day&amp;course='.$urlcourse.'&cal_d='.$_REQUEST['d'].'&cal_m='.$_REQUEST['m'].'&cal_y='.$_REQUEST['y']);
 
             }
             else {
@@ -455,7 +469,7 @@
                 case 'site':
                     $form->name = '';
                     $form->description = '';
-                    $form->courseid = 1;
+                    $form->courseid = SITEID;
                     $form->groupid = 0;
                     $form->userid = $USER->id;
                     $form->modulename = '';
@@ -511,7 +525,12 @@
     // START: Last column (3-month display)
 
     $defaultcourses = calendar_get_default_courses();
-    calendar_set_filters($courses, $groups, $users, $defaultcourses, $defaultcourses);
+    //calendar_set_filters($courses, $groups, $users, $defaultcourses, $defaultcourses);
+    
+    // when adding an event you can not be a guest, so I think it's reasonalbe to ignore defaultcourses
+    // MDL-10353
+    calendar_set_filters($courses, $groups, $users);
+
     list($prevmon, $prevyr) = calendar_sub_month($mon, $yr);
     list($nextmon, $nextyr) = calendar_add_month($mon, $yr);
     
@@ -522,13 +541,13 @@
     echo '</div>';
     
     echo '<div class="minicalendarblock">';
-    echo calendar_top_controls('display', array('m' => $prevmon, 'y' => $prevyr));
+    echo calendar_top_controls('display', array('id' => $urlcourse, 'm' => $prevmon, 'y' => $prevyr));
     echo calendar_get_mini($courses, $groups, $users, $prevmon, $prevyr);
     echo '</div><div class="minicalendarblock">';
-    echo calendar_top_controls('display', array('m' => $mon, 'y' => $yr));
+    echo calendar_top_controls('display', array('id' => $urlcourse, 'm' => $mon, 'y' => $yr));
     echo calendar_get_mini($courses, $groups, $users, $mon, $yr);
     echo '</div><div class="minicalendarblock">';
-    echo calendar_top_controls('display', array('m' => $nextmon, 'y' => $nextyr));
+    echo calendar_top_controls('display', array('id' => $urlcourse, 'm' => $nextmon, 'y' => $nextyr));
     echo calendar_get_mini($courses, $groups, $users, $nextmon, $nextyr);
     echo '</div>';
 

calendar/event_delete.html

@@ -1,7 +1,7 @@
 <table style="margin: auto;">
   <tr>
     <td>
-      <form method="get" action="event.php" name="delete">
+      <form method="get" action="event.php" id="delete">
       <p>
       &nbsp;
       <input type="submit" value=" <?php print_string('delete') ?> " />
@@ -12,13 +12,14 @@
       <input type="hidden" name="y" value="<?php echo $y; ?>" />
       <input type="hidden" name="confirm" value="1" />
       <input type="hidden" name="repeats" value="0" />
+      <input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
       &nbsp;
       </p>
       </form>
     </td>
     <?php if($repeatcount > 1) { ?>
     <td>
-      <form method="get" action="event.php" name="delete">
+      <form method="get" action="event.php" id="delete">
       <p>
       &nbsp;
       <input type="submit" value=" <?php print_string('deleteall') ?> " />
@@ -29,13 +30,14 @@
       <input type="hidden" name="y" value="<?php echo $y; ?>" />
       <input type="hidden" name="confirm" value="1" />
       <input type="hidden" name="repeats" value="1" />
+      <input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
       &nbsp;
       </p>
       </form>
     </td>
     <?php } ?>
     <td>
-      <form method="get" action="view.php" name="cancel">
+      <form method="get" action="view.php" id="cancel">
       <p>
       &nbsp;
       <input type="submit" value=" <?php print_string('cancel') ?> ">
@@ -43,6 +45,7 @@
       <input type="hidden" name="cal_m" value="<?php echo $m; ?>" />
       <input type="hidden" name="cal_d" value="<?php echo $d; ?>" />
       <input type="hidden" name="cal_y" value="<?php echo $y; ?>" />
+      <input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
       &nbsp;
       </p>
       </form>

calendar/event_edit.html

@@ -1,4 +1,4 @@
-<form method="post" action="event.php" name="edit">
+<form method="post" action="event.php" id="eventform">
 <table cellpadding="5" cellspacing="0">
   <tr>
     <td style="vertical-align: top; text-align: right;">
@@ -88,6 +88,7 @@
 <input type="hidden" name="courseid" value="<?php echo $form->courseid; ?>" />
 <input type="hidden" name="format" value="<?php echo $form->format; ?>" />
 <input type="hidden" name="action" value="edit" />
+<input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
 </p>
 </form>
 

calendar/event_new.html

@@ -2,7 +2,7 @@
     // The following is a hack to fix bug 1488
     $course = get_record('course', 'id', ($form->courseid) ? $form->courseid : $site->id);
 ?>
-<form method="post" action="event.php" name="new">
+<form method="post" action="event.php" id="eventform">
 <table cellpadding="5">
   <tr>
     <td style="vertical-align: top; text-align: right;">
@@ -29,9 +29,9 @@
       <?php print_string('eventdate', 'calendar'); ?>:
     </td>
     <td>
-      <?php print_date_selector('startday', 'startmon', 'startyr', $form->timestart);?>
+      <?php print_date_selector('startday', 'startmon', 'startyr', (int)$form->timestart);?>
       <?php print_string('eventtime', 'calendar');?>
-      <?php print_time_selector('starthr', 'startmin', $form->timestart) ?>
+      <?php print_time_selector('starthr', 'startmin', (int)$form->timestart) ?>
       <?php if (isset($err['timestart'])) formerr($err['timestart']); ?>
     </td>
   </tr>
@@ -97,7 +97,8 @@
 <input type="hidden" name="instance" value="<?php echo $form->instance?>" />
 <input type="hidden" name="format" value="<?php echo $form->format; ?>" />
 <input type="hidden" name="action" value="new" />
-<input type="hidden" name="type" value="defined" />
+<input type="hidden" name="type" value="<?php echo $form->type; ?>" />
+<input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
 </p>
 </form>
 

calendar/event_select.html

@@ -31,5 +31,6 @@
 <p>
 <input type="hidden" name="action" value="new" />
 <input type="hidden" name="timestart" value="<?php echo $form->timestart; ?>" />
+<input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
 </p>
 </form>

calendar/lib.php

@@ -104,6 +104,7 @@ function calendar_get_mini($courses, $groups, $users, $cal_month = false, $cal_y
     list($d, $m, $y) = array($date['mday'], $date['mon'], $date['year']); // This is what we want to display
     $display->maxdays = calendar_days_in_month($m, $y);
 
+    // mdl 1.8 added a extra IF here to check get_user_timezone_offset() < 99
     // We 'll keep these values as GMT here, and offset them when the time comes to query the db
     $display->tstart = gmmktime(0, 0, 0, $m, 1, $y); // This is GMT
     $display->tend = gmmktime(23, 59, 59, $m, $display->maxdays, $y); // GMT
@@ -421,9 +422,16 @@ function calendar_print_event($event) {
     echo format_text($event->description, FORMAT_HTML);
     if (calendar_edit_event_allowed($event)) {
         echo '<div class="commands">';
+        
+        // Wen: added the following three lines to include courseid
+        $calendarcourseid = '';
+        if (!empty($event->calendarcourseid)) {
+            $calendarcourseid = '&amp;course='.$event->calendarcourseid;
+        }
+        
         if (empty($event->cmid)) {
-            $editlink   = CALENDAR_URL.'event.php?action=edit&amp;id='.$event->id;
-            $deletelink = CALENDAR_URL.'event.php?action=delete&amp;id='.$event->id;
+            $editlink   = CALENDAR_URL.'event.php?action=edit&amp;id='.$event->id.$calendarcourseid;
+            $deletelink = CALENDAR_URL.'event.php?action=delete&amp;id='.$event->id.$calendarcourseid;
         } else {
             $editlink   = $CFG->wwwroot.'/course/mod.php?update='.$event->cmid.'&amp;return=true&amp;sesskey='.$USER->sesskey;
             $deletelink = $CFG->wwwroot.'/course/mod.php?delete='.$event->cmid.'&amp;sesskey='.$USER->sesskey;;
@@ -544,6 +552,13 @@ function calendar_top_controls($type, $data) {
         $data['d'] = 1;
     }
 
+    // Wen: Ensure course id passed if relevant
+    // Required due to changes in view/lib.php mainly (calendar_session_vars())
+    $courseid = '';
+    if (!empty($data['id'])) {
+        $courseid = '&amp;course='.$data['id'];
+    }
+    
     if(!checkdate($data['m'], $data['d'], $data['y'])) {
         $time = time();
     }
@@ -563,7 +578,7 @@ function calendar_top_controls($type, $data) {
             $prevlink = calendar_get_link_tag('&lt;&lt;', 'index.php?', 0, $prevmonth, $prevyear);
             $content .= '<table class="calendar-controls"><tr>';
             $content .= '<td class="previous">'.$prevlink."</td>\n";
-            $content .= '<td class="current"><a href="'.calendar_get_link_href(CALENDAR_URL.'view.php?view=month&amp;', 1, $data['m'], $data['y']).'">'.userdate($time, get_string('strftimemonthyear')).'</a></td>';
+            $content .= '<td class="current"><a href="'.calendar_get_link_href(CALENDAR_URL.'view.php?view=month'.$courseid.'&amp;', 1, $data['m'], $data['y']).'">'.userdate($time, get_string('strftimemonthyear')).'</a></td>';
             $content .= '<td class="next">'.$nextlink."</td>\n";
             $content .= '</tr></table>';
         break;
@@ -574,15 +589,15 @@ function calendar_top_controls($type, $data) {
             $prevlink = calendar_get_link_tag('&lt;&lt;', 'view.php?id='.$data['id'].'&amp;', 0, $prevmonth, $prevyear);
             $content .= '<table class="calendar-controls"><tr>';
             $content .= '<td class="previous">'.$prevlink."</td>\n";
-            $content .= '<td class="current"><a href="'.calendar_get_link_href(CALENDAR_URL.'view.php?view=month&amp;course='.$data['id'].'&amp;', 1, $data['m'], $data['y']).'">'.userdate($time, get_string('strftimemonthyear')).'</a></td>';
+            $content .= '<td class="current"><a href="'.calendar_get_link_href(CALENDAR_URL.'view.php?view=month'.$courseid.'&amp;course='.$data['id'].'&amp;', 1, $data['m'], $data['y']).'">'.userdate($time, get_string('strftimemonthyear')).'</a></td>';
             $content .= '<td class="next">'.$nextlink."</td>\n";
             $content .= '</tr></table>';
         break;
         case 'upcoming':
-            $content .= '<div style="text-align: center;"><a href="'.CALENDAR_URL.'view.php?view=upcoming">'.userdate($time, get_string('strftimemonthyear'))."</a></div>\n";
+            $content .= '<div style="text-align: center;"><a href="'.CALENDAR_URL.'view.php?view=upcoming"'.$courseid.'>'.userdate($time, get_string('strftimemonthyear'))."</a></div>\n";
         break;
         case 'display':
-            $content .= '<div style="text-align: center;"><a href="'.calendar_get_link_href(CALENDAR_URL.'view.php?view=month&amp;', 1, $data['m'], $data['y']).'">'.userdate($time, get_string('strftimemonthyear'))."</a></div>\n";
+            $content .= '<div style="text-align: center;"><a href="'.calendar_get_link_href(CALENDAR_URL.'view.php?view=month'.$courseid.'&amp;', 1, $data['m'], $data['y']).'">'.userdate($time, get_string('strftimemonthyear'))."</a></div>\n";
         break;
         case 'month':
             list($prevmonth, $prevyear) = calendar_sub_month($data['m'], $data['y']);
@@ -590,9 +605,9 @@ function calendar_top_controls($type, $data) {
             $prevdate = make_timestamp($prevyear, $prevmonth, 1);
             $nextdate = make_timestamp($nextyear, $nextmonth, 1);
             $content .= '<table class="calendar-controls"><tr>';
-            $content .= '<td class="previous"><a href="'.calendar_get_link_href('view.php?view=month&amp;', 1, $prevmonth, $prevyear).'">&lt;&lt; '.userdate($prevdate, get_string('strftimemonthyear')).'</a></td>';
+            $content .= '<td class="previous"><a href="'.calendar_get_link_href('view.php?view=month'.$courseid.'&amp;', 1, $prevmonth, $prevyear).'">&lt;&lt; '.userdate($prevdate, get_string('strftimemonthyear')).'</a></td>';
             $content .= '<td class="current">'.userdate($time, get_string('strftimemonthyear'))."</td>\n";
-            $content .= '<td class="next"><a href="'.calendar_get_link_href('view.php?view=month&amp;', 1, $nextmonth, $nextyear).'">'.userdate($nextdate, get_string('strftimemonthyear'))." &gt;&gt;</a></td>\n";
+            $content .= '<td class="next"><a href="'.calendar_get_link_href('view.php?view=month'.$courseid.'&amp;', 1, $nextmonth, $nextyear).'">'.userdate($nextdate, get_string('strftimemonthyear'))." &gt;&gt;</a></td>\n";
             $content .= "</tr></table>\n";
         break;
         case 'day':
@@ -602,7 +617,7 @@ function calendar_top_controls($type, $data) {
             $prevname = calendar_wday_name($CALENDARDAYS[$prevdate['wday']]);
             $nextname = calendar_wday_name($CALENDARDAYS[$nextdate['wday']]);
             $content .= '<table class="calendar-controls"><tr>';
-            $content .= '<td class="previous"><a href="'.calendar_get_link_href('view.php?view=day&amp;', $prevdate['mday'], $prevdate['mon'], $prevdate['year']).'">&lt;&lt; '.$prevname."</a></td>\n";
+            $content .= '<td class="previous"><a href="'.calendar_get_link_href('view.php?view=day'.$courseid.'&amp;', $prevdate['mday'], $prevdate['mon'], $prevdate['year']).'">&lt;&lt; '.$prevname."</a></td>\n";
 
             // Get the format string
             $text = get_string('strftimedaydate');
@@ -616,7 +631,7 @@ function calendar_top_controls($type, $data) {
             // Print the actual thing
             $content .= '<td class="current">'.$text.'</td>';
 
-            $content .= '<td class="next"><a href="'.calendar_get_link_href('view.php?view=day&amp;', $nextdate['mday'], $nextdate['mon'], $nextdate['year']).'">'.$nextname." &gt;&gt;</a></td>\n";
+            $content .= '<td class="next"><a href="'.calendar_get_link_href('view.php?view=day'.$courseid.'&amp;', $nextdate['mday'], $nextdate['mon'], $nextdate['year']).'">'.$nextname." &gt;&gt;</a></td>\n";
             $content .= '</tr></table>';
         break;
     }
@@ -1128,10 +1143,10 @@ function calendar_get_default_courses($ignoreref = false) {
         }
     }
     if(isset($USER->student) && is_array($USER->student)) {
-        $courses = $USER->student;
+        $courses = $courses + $USER->student;
     }
     if(isset($USER->teacher) && is_array($USER->teacher)) {
-        $courses = $USER->teacher;
+        $courses = $courses + $USER->teacher;
     }
     return $courses;
 }

calendar/preferences.php

@@ -17,7 +17,6 @@
 /// If data submitted, then process and store.
 
     if ($form = data_submitted()) {
-        print_header();
         foreach ($form as $preference => $value) {
             switch ($preference) {
                 case 'timeformat':
@@ -59,9 +58,9 @@
 
     if ($course->category) {
         $navigation = "<a href=\"$CFG->wwwroot/course/view.php?id=$course->id\">$course->shortname</a> ->
-                       <a href=\"view.php\">$strcalendar</a> -> $strpreferences";
+                       <a href=\"view.php?course=$course->id\">$strcalendar</a> -> $strpreferences";
     } else {
-        $navigation = "<a href=\"view.php\">$strcalendar</a> -> $strpreferences";
+        $navigation = "<a href=\"view.php?course=$course->id\">$strcalendar</a> -> $strpreferences";
     }
 
 

calendar/set.php

@@ -9,14 +9,14 @@
 // Copyright (C) 2003-2004  Greek School Network            www.sch.gr     //
 //                                                                         //
 // Designed by:                                                            //
-//     Avgoustos Tsinakos (tsinakos@uom.gr)                                //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Avgoustos Tsinakos (tsinakos@teikav.edu.gr)                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // Programming and development:                                            //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // For bugs, suggestions, etc contact:                                     //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // The current module was developed at the University of Macedonia         //
 // (www.uom.gr) under the funding of the Greek School Network (www.sch.gr) //
@@ -41,20 +41,30 @@
     require_once('../config.php');
     require_once($CFG->dirroot.'/calendar/lib.php');
 
-    require_variable($_GET['from']);
-    require_variable($_GET['var']);
-    optional_variable($_GET['value']);
-    optional_variable($_GET['id']);
-    optional_variable($_GET['cal_d']);
-    optional_variable($_GET['cal_m']);
-    optional_variable($_GET['cal_y']);
+    $from = required_param('from');
+    $var = required_param('var');
+    $value = optional_param('value');
+    $id = optional_param('id');
+    $cal_d = optional_param('cal_d');
+    $cal_m = optional_param('cal_m');
+    $cal_y = optional_param('cal_y');
 
-    switch($_GET['var']) {
+    // Initialize the session variables
+    calendar_session_vars();
+
+    // Ensure course id passed if relevant
+    // Required due to changes in view/lib.php mainly (calendar_session_vars())
+    $courseid = '';
+    if (!empty($id)) {
+        $courseid = '&course='.$id;
+    }
+    
+    switch($var) {
         case 'setuser':
             // Not implemented yet (or possibly at all)
         break;
         case 'setcourse':
-            $id = intval($_GET['id']);
+            $id = intval($id);
             if($id == 0) {
                 $SESSION->cal_courses_shown = array();
                 calendar_set_referring_course(0);
@@ -64,7 +74,6 @@
                 calendar_set_referring_course(0);
             }
             else {
-                // We don't check for membership anymore: if(isstudent($id, $USER->id) || isteacher($id, $USER->id)) {
                 if(get_record('course', 'id', $id) === false) {
                     // There is no such course
                     $SESSION->cal_courses_shown = array();
@@ -94,21 +103,21 @@
         break;
     }
 
-    switch($_GET['from']) {
+    switch($from) {
         case 'event':
-            redirect(CALENDAR_URL.'event.php?action='.$_GET['action'].'&type='.$_GET['type'].'&id='.intval($_GET['id']));
+            redirect(CALENDAR_URL.'event.php?action='.$action.'&type='.$type.'&id='.intval($id));
         break;
         case 'month':
-            redirect(CALENDAR_URL.'view.php?view=month&cal_d='.$_GET['cal_d'].'&cal_m='.$_GET['cal_m'].'&cal_y='.$_GET['cal_y']);
+            redirect(CALENDAR_URL.'view.php?view=month'.$courseid.'&cal_d='.$cal_d.'&cal_m='.$cal_m.'&cal_y='.$cal_y);
         break;
         case 'upcoming':
-            redirect(CALENDAR_URL.'view.php?view=upcoming');
+            redirect(CALENDAR_URL.'view.php?view=upcoming'.$courseid);
         break;
         case 'day':
-            redirect(CALENDAR_URL.'view.php?view=day&cal_d='.$_GET['cal_d'].'&cal_m='.$_GET['cal_m'].'&cal_y='.$_GET['cal_y']);
+            redirect(CALENDAR_URL.'view.php?view=day'.$courseid.'&cal_d='.$cal_d.'&cal_m='.$cal_m.'&cal_y='.$cal_y);
         break;
         case 'course':
-            redirect($CFG->wwwroot.'/course/view.php?id='.intval($_GET['id']));
+            redirect($CFG->wwwroot.'/course/view.php?id='.intval($id));
         break;
         default:
 

calendar/view.php

@@ -43,19 +43,36 @@
     require_once('../config.php');
     require_once($CFG->dirroot.'/course/lib.php');
     require_once($CFG->dirroot.'/calendar/lib.php');
-
-    optional_variable($_GET['course'], 0);
+    
+    //commented out the following line and added 5 lines
+    //optional_variable($_GET['course'], 0);
+    $courseid = optional_param('course', 0, PARAM_INT);
+    $view = optional_param('view', 'upcoming', PARAM_ALPHA);
+    $day  = optional_param('cal_d', 0, PARAM_INT);
+    $mon  = optional_param('cal_m', 0, PARAM_INT);
+    $yr   = optional_param('cal_y', 0, PARAM_INT);
 
     if(!$site = get_site()) {
         redirect($CFG->wwwroot.'/'.$CFG->admin.'/index.php');
     }
 
+    //added the following if statement for courseid
+    if ($courseid) {
+        require_login($courseid);
+    } else if ($CFG->forcelogin) {
+        require_login();
+    }
+    
+    // Initialize the session variables
+    calendar_session_vars();
+    
     //add_to_log($course->id, "course", "view", "view.php?id=$course->id", "$course->id");
     $now = usergetdate(time());
     $pagetitle = '';
 
-    $nav = calendar_get_link_tag(get_string('calendar', 'calendar'), CALENDAR_URL.'view.php?view=upcoming&', $now['mday'], $now['mon'], $now['year']);
+    $nav = calendar_get_link_tag(get_string('calendar', 'calendar'), CALENDAR_URL.'view.php?view=upcoming&course='.$courseid.'&', $now['mday'], $now['mon'], $now['year']);
 
+    //mdl 1.8 got rid of the following 4 lines
     $view = optional_param('view', 'upcoming');
     $day  = optional_param('cal_d', 0, PARAM_INT);
     $mon  = optional_param('cal_m', 0, PARAM_INT);
@@ -84,8 +101,8 @@
 
     // If a course has been supplied in the URL, change the filters to show that one
     if (!empty($_GET['course'])) {
-        if ($course = get_record('course', 'id', $_GET['course'])) {
-            if ($course->id == 1) {
+        if ($course = get_record('course', 'id', intval($_GET['course']))) {
+            if ($course->id == SITEID) {
                 // If coming from the home page, show all courses
                 $SESSION->cal_courses_shown = calendar_get_default_courses(true);
                 calendar_set_referring_course(0);
@@ -108,7 +125,7 @@
 
     // Let's see if we are supposed to provide a referring course link
     // but NOT for the "main page" course
-    if ($SESSION->cal_course_referer > 1 &&
+    if ($SESSION->cal_course_referer != SITEID &&
        ($shortname = get_field('course', 'shortname', 'id', $SESSION->cal_course_referer)) !== false) {
         // If we know about the referring course, show a return link and ALSO require login!
         require_login();
@@ -137,13 +154,13 @@
 
     switch($view) {
         case 'day':
-            calendar_show_day($day, $mon, $yr, $courses, $groups, $users);
+            calendar_show_day($day, $mon, $yr, $courses, $groups, $users, $courseid);
         break;
         case 'month':
-            calendar_show_month_detailed($mon, $yr, $courses, $groups, $users);
+            calendar_show_month_detailed($mon, $yr, $courses, $groups, $users, $courseid);
         break;
         case 'upcoming':
-            calendar_show_upcoming_events($courses, $groups, $users, get_user_preferences('calendar_lookahead', CALENDAR_UPCOMING_DAYS), get_user_preferences('calendar_maxevents', CALENDAR_UPCOMING_MAXEVENTS));
+            calendar_show_upcoming_events($courses, $groups, $users, get_user_preferences('calendar_lookahead', CALENDAR_UPCOMING_DAYS), get_user_preferences('calendar_maxevents', CALENDAR_UPCOMING_MAXEVENTS), $courseid);
         break;
     }
 
@@ -157,20 +174,22 @@
 
     list($prevmon, $prevyr) = calendar_sub_month($mon, $yr);
     list($nextmon, $nextyr) = calendar_add_month($mon, $yr);
-    $getvars = 'cal_d='.$day.'&cal_m='.$mon.'&cal_y='.$yr; // For filtering
+    //changed the $getvars
+    //$getvars = 'cal_d='.$day.'&cal_m='.$mon.'&cal_y='.$yr; // For filtering
+    $getvars = 'id='.$courseid.'&cal_d='.$day.'&cal_m='.$mon.'&cal_y='.$yr; // For filtering
 
     echo '<div class="filters">';
     echo calendar_filter_controls($view, $getvars);
     echo '</div>';
 
     echo '<div class="minicalendarblock">';
-    echo calendar_top_controls('display', array('m' => $prevmon, 'y' => $prevyr));
+    echo calendar_top_controls('display', array('id' => $courseid, 'm' => $prevmon, 'y' => $prevyr));
     echo calendar_get_mini($courses, $groups, $users, $prevmon, $prevyr);
     echo '</div><div class="minicalendarblock">';
-    echo calendar_top_controls('display', array('m' => $mon, 'y' => $yr));
+    echo calendar_top_controls('display', array('id' => $courseid, 'm' => $mon, 'y' => $yr));
     echo calendar_get_mini($courses, $groups, $users, $mon, $yr);
     echo '</div><div class="minicalendarblock">';
-    echo calendar_top_controls('display', array('m' => $nextmon, 'y' => $nextyr));
+    echo calendar_top_controls('display', array('id' => $courseid, 'm' => $nextmon, 'y' => $nextyr));
     echo calendar_get_mini($courses, $groups, $users, $nextmon, $nextyr);
     echo '</div>';
 
@@ -182,7 +201,7 @@
 
 
 
-function calendar_show_day($d, $m, $y, $courses, $groups, $users) {
+function calendar_show_day($d, $m, $y, $courses, $groups, $users, $courseid) {
     global $CFG, $USER;
 
     if (!checkdate($m, $d, $y)) {
@@ -202,6 +221,7 @@ function calendar_show_day($d, $m, $y, $courses, $groups, $users) {
         $text.= '<div class="buttons">';
         $text.= '<form action="'.CALENDAR_URL.'event.php" method="get">';
         $text.= '<input type="hidden" name="action" value="new" />';
+	      $text.= '<input type="hidden" name="course" value="'.$courseid.'" />';
         $text.= '<input type="hidden" name="cal_d" value="'.$d.'" />';
         $text.= '<input type="hidden" name="cal_m" value="'.$m.'" />';
         $text.= '<input type="hidden" name="cal_y" value="'.$y.'" />';
@@ -213,7 +233,7 @@ function calendar_show_day($d, $m, $y, $courses, $groups, $users) {
 
     echo '<div class="header">'.$text.'</div>';
 
-    echo '<div class="controls">'.calendar_top_controls('day', array('d' => $d, 'm' => $m, 'y' => $y)).'</div>';
+    echo '<div class="controls">'.calendar_top_controls('day', array('id' => $courseid, 'd' => $d, 'm' => $m, 'y' => $y)).'</div>';
 
     if (empty($events)) {
         // There is nothing to display today.
@@ -227,6 +247,7 @@ function calendar_show_day($d, $m, $y, $courses, $groups, $users) {
 
         // First, print details about events that start today
         foreach ($events as $event) {
+        
             if ($event->timestart >= $starttime && $event->timestart <= $endtime) {  // Print it now
 
 
@@ -260,7 +281,7 @@ function calendar_show_day($d, $m, $y, $courses, $groups, $users) {
     }
 }
 
-function calendar_show_month_detailed($m, $y, $courses, $groups, $users) {
+function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $courseid) {
     global $CFG, $SESSION, $USER, $CALENDARDAYS;
     global $day, $mon, $yr;
 
@@ -325,6 +346,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users) {
     if(!isguest() && !empty($USER->id)) {
         $text.= '<div class="buttons"><form action="'.CALENDAR_URL.'event.php" method="get">';
         $text.= '<input type="hidden" name="action" value="new" />';
+	      $text.= '<input type="hidden" name="course" value="'.$courseid.'" />';
         $text.= '<input type="hidden" name="cal_m" value="'.$m.'" />';
         $text.= '<input type="hidden" name="cal_y" value="'.$y.'" />';
         $text.= '<input type="submit" value="'.get_string('newevent', 'calendar').'" />';
@@ -336,7 +358,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users) {
     echo '<div class="header">'.$text.'</div>';
 
     echo '<div class="controls">';
-    echo calendar_top_controls('month', array('m' => $m, 'y' => $y));
+    echo calendar_top_controls('month', array('id' => $courseid, 'm' => $m, 'y' => $y));
     echo '</div>';
 
     // Start calendar display
@@ -371,7 +393,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users) {
 
         // Reset vars
         $cell = '';
-        $dayhref = calendar_get_link_href(CALENDAR_URL.'view.php?view=day&amp;', $day, $m, $y);
+        $dayhref = calendar_get_link_href(CALENDAR_URL.'view.php?view=day&amp;course='.$courseid.'&amp;', $day, $m, $y);
 
         if(CALENDAR_WEEKEND & (1 << ($dayweek % 7))) {
             // Weekend. This is true no matter what the exact range is.
@@ -509,7 +531,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users) {
     echo '</table></div>';
 }
 
-function calendar_show_upcoming_events($courses, $groups, $users, $futuredays, $maxevents) {
+function calendar_show_upcoming_events($courses, $groups, $users, $futuredays, $maxevents, $courseid) {
     global $USER;
 
     $events = calendar_get_upcoming($courses, $groups, $users, $futuredays, $maxevents);
@@ -520,6 +542,7 @@ function calendar_show_upcoming_events($courses, $groups, $users, $futuredays, $
         $text.= '<div class="buttons">';
         $text.= '<form action="'.CALENDAR_URL.'event.php" method="get">';
         $text.= '<input type="hidden" name="action" value="new" />';
+        $text.= '<input type="hidden" name="course" value="'.$courseid.'" />';
         /*
         $text.= '<input type="hidden" name="cal_m" value="'.$m.'" />';
         $text.= '<input type="hidden" name="cal_y" value="'.$y.'" />';
@@ -558,7 +581,7 @@ function calendar_course_filter_selector($getvars = '') {
 
     unset($courses[SITEID]);
 
-    $courseoptions[1] = get_string('fulllistofcourses');
+    $courseoptions[SITEID] = get_string('fulllistofcourses');
     foreach ($courses as $course) {
         $courseoptions[$course->id] = $course->shortname;
     }

config-dist.php

@@ -196,7 +196,7 @@ $CFG->admin = 'admin';
 // mailprefix must be EXACTLY four characters.
 // Uncomment and customise this block for Postfix 
 //      $CFG->mailprefix = 'mdl+'; // + is the separator for Exim and Postfix.
-//      $CFG->mailprefix = 'mdl-'l // - is the separator for qmail 
+//      $CFG->mailprefix = 'mdl-'; // - is the separator for qmail 
 //      $CFG->maildomain = 'youremaildomain.com';
 //
 // The following setting will tell Moodle to respect your PHP session 
@@ -264,6 +264,12 @@ $CFG->admin = 'admin';
 // If you are going to publish your log, or the output of your web stats analyzer
 // this will weaken the security of your website.
 // 
+// Email database connection errors to someone.  If Moodle cannot connect to the 
+// database, then email this address with a notice.
+//
+//     $CFG->emailconnectionerrorsto = 'your@emailaddress.com';
+// 
+// 
 
 
 //=========================================================================

course/category.php

@@ -6,9 +6,9 @@
     require_once("../config.php");
     require_once("lib.php");
 
-    require_variable($id);    // Category id
-    optional_variable($page, "0");     // which page to show
-    optional_variable($perpage, "20"); // how many per page
+    $id      = required_param('id', PARAM_INT);          // Category id
+    $page    = optional_param('page', 0, PARAM_INT);     // which page to show
+    $perpage = optional_param('perpage', 20, PARAM_INT); // how many per page
 
     if (!$site = get_site()) {
         error("Site isn't defined!");
@@ -138,7 +138,15 @@
                     } else {
                         // figure out a sortorder that we can use in the destination category
                         $sortorder = get_field_sql('SELECT MIN(sortorder)-1 AS min
-                                                    FROM ' . $CFG->prefix . 'course WHERE category=' . $destcategory->id) || 1000;
+                                                    FROM ' . $CFG->prefix . 'course WHERE category=' . $destcategory->id);
+                        if ($sortorder === false) {
+                            // the category is empty
+                            // rather than let the db default to 0
+                            // set it to > 100 and avoid extra work in fix_coursesortorder()                        
+                            $sortorder = 200;
+                        } else if ($sortorder < 10) {
+                            fix_course_sortorder($categoryid);
+                        }
 
                         $newcourse = new stdClass;
                         $newcourse->id        = $courseid;
@@ -295,10 +303,20 @@
         $count = 0;
         $abletomovecourses = false;  // for now
 
+        // Checking if we are at the first or at the last page, to allow courses to
+        // be moved up and down beyond the paging border
+        if ($totalcount > $perpage) {
+            $atfirstpage = ($page == 0);
+            $atlastpage = (($page + 1) == ceil($totalcount / $perpage));
+        } else {
+            $atfirstpage = true;
+            $atlastpage = true;
+        }
+
         foreach ($courses as $acourse) {
             $count++;
-            $up = ($count == 1) ? false : true;
-            $down = ($count == $numcourses) ? false : true;
+            $up = ($count > 1 || !$atfirstpage);
+            $down = ($count < $numcourses || !$atlastpage);
 
             $linkcss = $acourse->visible ? "" : ' class="dimmed" ';
             echo '<tr>';
@@ -316,11 +334,11 @@
                          '<img src="'.$CFG->pixpath.'/t/delete.gif" height="11" width="11" border="0" alt="" /></a> ';
                     if (!empty($acourse->visible)) {
                         echo '<a title="'.$strhide.'" href="category.php?id='.$category->id.'&amp;page='.$page.
-                             '&amp;hide='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
+                             '&amp;perpage='.$perpage.'&amp;hide='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
                              '<img src="'.$CFG->pixpath.'/t/hide.gif" height="11" width="11" border="0" alt="" /></a> ';
                     } else {
                         echo '<a title="'.$strshow.'" href="category.php?id='.$category->id.'&amp;page='.$page.
-                             '&amp;show='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
+                             '&amp;perpage='.$perpage.'&amp;show='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
                              '<img src="'.$CFG->pixpath.'/t/show.gif" height="11" width="11" border="0" alt="" /></a> ';
                     }
 
@@ -333,7 +351,7 @@
 
                     if ($up) {
                         echo '<a title="'.$strmoveup.'" href="category.php?id='.$category->id.'&amp;page='.$page.
-                             '&amp;moveup='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
+                             '&amp;perpage='.$perpage.'&amp;moveup='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
                              '<img src="'.$CFG->pixpath.'/t/up.gif" height="11" width="11" border="0" alt="" /></a> ';
                     } else {
                         echo '<img src="'.$CFG->wwwroot.'/pix/spacer.gif" height="11" width="11" border="0" alt="" /> ';
@@ -341,7 +359,7 @@
 
                     if ($down) {
                         echo '<a title="'.$strmovedown.'" href="category.php?id='.$category->id.'&amp;page='.$page.
-                             '&amp;movedown='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
+                             '&amp;perpage='.$perpage.'&amp;movedown='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
                              '<img src="'.$CFG->pixpath.'/t/down.gif" height="11" width="11" border="0" alt="" /></a> ';
                     } else {
                         echo '<img src="'.$CFG->wwwroot.'/pix/spacer.gif" height="11" width="11" border="0" alt="" /> ';

course/delete.php

@@ -40,6 +40,8 @@
         notice_yesno("$strdeletecoursecheck<br /><br />$course->fullname ($course->shortname)", 
                      "delete.php?id=$course->id&amp;delete=".md5($course->timemodified)."&amp;sesskey=$USER->sesskey", 
                      "category.php?id=$course->category");
+
+        print_footer($course);
         exit;
     }
 

course/edit.html

@@ -287,7 +287,8 @@
       } else {
           echo ((empty($form->metacourse)) ? get_string("no") : get_string("yes"));
           echo " - $disable_meta ";
-      } ?>
+      }
+      helpbutton("metacourse", get_string("metacourse")); ?>
     </td>
 </tr>
 <tr>

course/edit.php

@@ -11,6 +11,7 @@
     require_login();
    
     $disable_meta = false;
+    $focus = "";
 
     if ($id) {
         if (! $course = get_record("course", "id", $id)) {
@@ -59,7 +60,7 @@
         }
 
         $form->startdate = make_timestamp($form->startyear, $form->startmonth, $form->startday);
-
+        $form->category = clean_param($form->category, PARAM_INT);
         $form->format = optional_param('format', 'social', PARAM_ALPHA);
 
         validate_form($course, $form, $err);
@@ -179,10 +180,6 @@
         }
     }
 
-    if (empty($focus)) {
-        $focus = "";
-    }
-
     $form->categories = get_records_select_menu("course_categories", "", "name", "id,name");
 
     $courseformats = get_list_of_plugins("course/format");
@@ -215,13 +212,13 @@
     print_simple_box_start("center");
     include("edit.html");
     print_simple_box_end();
-
-    print_footer($course);
-
+    
     if ($usehtmleditor) {
         use_html_editor("summary");
     }
 
+    print_footer($course);
+
     exit;
 
 /// Functions /////////////////////////////////////////////////////////////////

course/editsection.php

@@ -58,9 +58,7 @@
         $strsummaryof = get_string('summaryof', '', " $sectionname $form->section");
     }
 
-    print_header("$course->shortname: $stredit", "$course->fullname", 
-                 "<a href=\"$CFG->wwwroot/course/view.php?id=$course->id\">$course->shortname</a> 
-                  -> $stredit");
+    print_header_simple($stredit, '', $stredit);
 
     print_heading($strsummaryof);
     print_simple_box_start('center');

course/enrol.php

@@ -19,6 +19,12 @@
         error("Could not find a site!");
     }
 
+/// Check if the course is a meta course
+    if ($course->metacourse) {
+        print_header_simple();
+        notice(get_string('coursenotaccessible'), $CFG->wwwroot);
+    }
+
     check_for_restricted_user($USER->username);
 
     $enrol = new enrolment_plugin();

course/format/social/format.php

@@ -10,12 +10,10 @@
     define('BLOCK_R_MIN_WIDTH', 100);
     define('BLOCK_R_MAX_WIDTH', 210);
 
-    optional_variable($preferred_width_left,  blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]));
-    optional_variable($preferred_width_right, blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]));
-    $preferred_width_left = min($preferred_width_left, BLOCK_L_MAX_WIDTH);
-    $preferred_width_left = max($preferred_width_left, BLOCK_L_MIN_WIDTH);
-    $preferred_width_right = min($preferred_width_right, BLOCK_R_MAX_WIDTH);
-    $preferred_width_right = max($preferred_width_right, BLOCK_R_MIN_WIDTH);
+    $preferred_width_left  = bounded_number(BLOCK_L_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]),  
+                                            BLOCK_L_MAX_WIDTH);
+    $preferred_width_right = bounded_number(BLOCK_R_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]), 
+                                            BLOCK_R_MAX_WIDTH);
 
     $strgroups  = get_string('groups');
     $strgroupmy = get_string('groupmy');

course/format/topics/format.php

@@ -14,12 +14,10 @@
     define('BLOCK_R_MIN_WIDTH', 100);
     define('BLOCK_R_MAX_WIDTH', 210);
 
-    optional_variable($preferred_width_left,  blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]));
-    optional_variable($preferred_width_right, blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]));
-    $preferred_width_left = min($preferred_width_left, BLOCK_L_MAX_WIDTH);
-    $preferred_width_left = max($preferred_width_left, BLOCK_L_MIN_WIDTH);
-    $preferred_width_right = min($preferred_width_right, BLOCK_R_MAX_WIDTH);
-    $preferred_width_right = max($preferred_width_right, BLOCK_R_MIN_WIDTH);
+    $preferred_width_left  = bounded_number(BLOCK_L_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]),  
+                                            BLOCK_L_MAX_WIDTH);
+    $preferred_width_right = bounded_number(BLOCK_R_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]), 
+                                            BLOCK_R_MAX_WIDTH);
 
     if (isset($topic)) {
         $displaysection = course_set_display($course->id, $topic);
@@ -148,7 +146,7 @@
 
         if (!empty($displaysection) and $displaysection != $section) {
             if ($showsection) {
-                $strsummary = ' - '.strip_tags($thissection->summary);
+                $strsummary = strip_tags(format_string($thissection->summary,true));
                 if (strlen($strsummary) < 57) {
                     $strsummary = ' - '.$strsummary;
                 } else {

course/format/weeks/format.php

@@ -10,12 +10,10 @@
     define('BLOCK_R_MIN_WIDTH', 100);
     define('BLOCK_R_MAX_WIDTH', 210);
 
-    optional_variable($preferred_width_left,  blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]));
-    optional_variable($preferred_width_right, blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]));
-    $preferred_width_left = min($preferred_width_left, BLOCK_L_MAX_WIDTH);
-    $preferred_width_left = max($preferred_width_left, BLOCK_L_MIN_WIDTH);
-    $preferred_width_right = min($preferred_width_right, BLOCK_R_MAX_WIDTH);
-    $preferred_width_right = max($preferred_width_right, BLOCK_R_MIN_WIDTH);
+    $preferred_width_left  = bounded_number(BLOCK_L_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]),  
+                                            BLOCK_L_MAX_WIDTH);
+    $preferred_width_right = bounded_number(BLOCK_R_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]), 
+                                            BLOCK_R_MAX_WIDTH);
 
     if (isset($week)) {
         $displaysection = course_set_display($course->id, $week);

course/group-edit.html

@@ -18,8 +18,8 @@
 </tr>
 
 <tr valign="top">
-    <td align="right"><?print_string('enrolmentkey') ?>:</td>
-    <td><input type="text" name="password" size="25" value="<?php echo $group->password ?>" alt="<?print_string('enrolmentkey') ?>" /></td>
+    <td align="right"><?php print_string('enrolmentkey') ?>:</td>
+    <td><input type="text" name="password" size="25" value="<?php echo $group->password ?>" alt="<?php print_string('enrolmentkey') ?>" /></td>
 </tr>
 
 <tr valign="top">

course/group.php

@@ -51,11 +51,20 @@
                     $group->picture = 1;
                 }
             }
-            $group->name        = clean_text($form->name);
-            $group->description = clean_text($form->description);
-            $group->hidepicture = $form->hidepicture;
-            $group->password    = $form->password;
-            if (!update_record("groups", $group)) {
+
+            // Setting a new object in order to avoid updating other columns for the record,
+            // which could lead to SQL injection vulnerabilities.
+
+            // Be VERY sure to sanitize all parameters that go into $dataobj!
+
+            $dataobj = new stdClass;
+            $dataobj->id          = $group->id;
+            $dataobj->name        = clean_text($form->name);
+            $dataobj->description = clean_text($form->description);
+            $dataobj->hidepicture = empty($form->hidepicture) ? 0 : 1;
+            $dataobj->password    = required_param('password', PARAM_ALPHANUM);
+
+            if (!update_record('groups', $dataobj)) {
                 notify("A strange error occurred while trying to save");
             } else {
                 notify(get_string('changessaved'));

course/groups-edit.html

@@ -10,7 +10,7 @@
         foreach ($listmember as $userid => $username) {
             $count++;
             $useridstring .= "\"$userid\"";
-            $usernamestring .= "\"$username\"";
+            $usernamestring .= '"'.addslashes($username).'"';
             if ($count < $max) {
                 $useridstring .= ', ';
                 $usernamestring .= ', ';

course/groups.php

@@ -47,6 +47,12 @@
 
     if ($data = data_submitted() and confirm_sesskey()) {
 
+        // Clean ALL incoming parameters which go in SQL queries here for good measure
+        $data->id      = required_param('id', PARAM_INT);
+        $data->groups  = optional_param('groups', 0, PARAM_INT);
+        $data->groupid = optional_param('groupid', 0, PARAM_INT);
+        $data->members = optional_param('members', array(), PARAM_INT);
+
         if (!empty($data->nonmembersadd)) {            /// Add people to a group
             if (!empty($data->nonmembers) and !empty($data->groupid)) {
                 $groupmodified = false;
@@ -76,6 +82,9 @@
 
         } else if (!empty($data->groupsremove)) {      /// Remove a group, all members become nonmembers
             if (!empty($data->groups)) {
+                if(!isset($groups[$data->groups])) {
+                    error("This is not a valid group to remove");
+                }
                 delete_records("groups", "id", $data->groups);
                 delete_records("groups_members", "groupid", $data->groups);
                 unset($groups[$data->groups]);
@@ -102,8 +111,8 @@
             if (!empty($data->members) and !empty($data->groupid)) {
                 foreach ($data->members as $userid) {
                     delete_records('groups_members', 'userid', $userid, "groupid", $data->groupid);
-                    set_field('groups', 'timemodified', time(), 'id', $data->groupid);
                 }
+                set_field('groups', 'timemodified', time(), 'id', $data->groupid);
             }
             $selectedgroup = $data->groupid;
 
@@ -176,7 +185,7 @@
     natcasesort($nonmembers);
 
     if (empty($selectedgroup)) {    // Choose the first group by default
-        if ($selectedgroup = array_shift(array_keys($listgroups))) {
+        if ($selectedgroup = array_shift($temparr = array_keys($listgroups))) {
             $members = $listmembers[$selectedgroup];
         }
     } else {

course/import.php

@@ -24,7 +24,15 @@ optional_variable($filename,0);
         error("You need to be a teacher or an admin to use this page");
     }
 
+    // if we're not a course creator , we can only import from our own courses.
+    if (iscreator()) {
+        $creator = true;
+    }
+
     if ($from = get_record("course","id",$fromcourse)) {
+        if (!isteacheredit($fromcourse)) {
+            error("You need to be a course creator, or a teacher in the course you are importing data from, as well");
+        }
         if (!empty($filename) && file_exists($CFG->dataroot.'/'.$filename) && !empty($SESSION->import_preferences)) {
             $restore = backup_to_restore_array($SESSION->import_preferences);
             $restore->restoreto = 1;
@@ -43,10 +51,30 @@ optional_variable($filename,0);
 
     print_header("$course->fullname: $strimport", "$course->fullname: $strimport", "$course->shortname");
 
-    $taught_courses = get_my_courses($USER->id,"visible DESC,sortorder ASC",0,1);
-    $cat_courses = get_courses($course->category);
     print_heading(get_string("importdatafrom"));
 
+    $tcourseids = '';
+
+    if ($teachers = get_records_select('user_teachers', "userid = $USER->id AND editall = 1",'','id,course')) {
+        foreach ($teachers as $teacher) {
+            if ($teacher->course != $course->id && $teacher->course != $site->id){
+                $tcourseids .= $teacher->course.',';
+            }
+        }
+    }
+
+    $taught_courses = array();
+    if (!empty($tcourseids)) {
+        $tcourseids = substr($tcourseids,0,-1);
+        $taught_courses = get_records_list('course', 'id', $tcourseids);
+    }
+
+    if (!empty($creator)) {
+        $cat_courses = get_courses($course->category);
+    } else {
+        $cat_courses = array();
+    }
+
     $options = array();
     foreach ($taught_courses as $tcourse) {
         if ($tcourse->id != $course->id && $tcourse->id != $site->id){
@@ -54,6 +82,13 @@ optional_variable($filename,0);
         }
     }
 
+    if (empty($options) && empty($creator)) {
+        error(get_string('courseimportnotaught'),$CFG->wwwroot.'/course/view.php?id='.$course->id);
+        print_footer();
+        die();
+    }
+
+
     $fm = '<form method="post" action="'.$CFG->wwwroot.'/course/import.php"><input type="hidden" name="id" value="'.$course->id.'" />';
     $submit = '<input type="submit" value="'.get_string('usethiscourse').'" /></form>';
 
@@ -78,11 +113,14 @@ optional_variable($filename,0);
                                choose_from_menu($options,"fromcourse","","choose","","0",true),
                                $submit);
     }
-    $table->data[] = array($fm.'<b>'.get_string('searchcourses').'</b>',
-                           '<input type="text" name="fromcoursesearch" />',
-                           '<input type="submit" value="'.get_string('searchcourses').'" />');
 
-    if (!empty($fromcoursesearch)) {
+    if (!empty($creator)) {
+        $table->data[] = array($fm.'<b>'.get_string('searchcourses').'</b>',
+                               '<input type="text" name="fromcoursesearch" />',
+                               '<input type="submit" value="'.get_string('searchcourses').'" />');
+    }
+
+    if (!empty($fromcoursesearch) && !empty($creator)) {
         $totalcount = 0;
         $courses = get_courses_search(explode(" ",$fromcoursesearch),"fullname ASC",$page,50,$totalcount);
         if (is_array($courses) and count($courses) > 0) {

course/importstudents.php

@@ -27,8 +27,8 @@
         redirect("$CFG->wwwroot/course/student.php?id=$course->id");
     }
 
-    if (!isadmin()) {
-        error("You must be an admin");
+    if (!isadmin() || !isteacheredit($course->id)) {
+        error("You must be an admin or a teacher of this course");
     }
 
 

course/index.php

@@ -31,7 +31,7 @@
     if (!$adminediting) {
         $countcategories = count_records("course_categories");
 
-        if ($countcategories > 1) {
+        if ($countcategories > 1 || ($countcategories == 1 && count_records('course') > 200)) {
             $strcourses = get_string("courses");
             $strcategories = get_string("categories");
             print_header("$site->shortname: $strcategories", $strcourses, 
@@ -246,7 +246,7 @@
     }
 
 /// Find any orphan courses that don't yet have a valid category and set to default
-    if ($courses = get_courses(NULL,NULL,'c.category,c.id,c.sortorder')) {
+    if ($courses = get_courses(NULL,NULL,'c.id, c.category, c.sortorder')) {
         foreach ($courses as $course) {
             if ($course->category and !isset($categories[$course->category])) {
                 set_field("course", "category", $default, "id", $course->id);

course/info.php

@@ -5,8 +5,8 @@
     require_once("../config.php");
     require_once("lib.php");
 
-    require_variable($id);    // Course id
-    optional_variable($name);
+    $id   = optional_param('id', false, PARAM_INT); // Course id
+    $name = optional_param('name', false, PARAM_RAW); // Course short name
 
     if (!$id and !$name) {
         error("Must specify course id or short name");

course/jumpto.php

@@ -1,18 +1,21 @@
 <?php  // $Id$
-       
+
 /*
- *  Jumps to a given URL.  Mostly used for accessibility.
+ *  Jumps to a given relative or Moodle absolute URL.
+ *  Mostly used for accessibility.
  *
  */
 
     require('../config.php');
 
-    $jump = optional_param('jump', '');
+    $jump = optional_param('jump', '', PARAM_RAW);
 
-    if ($jump) {
+    if (strpos($jump, $CFG->wwwroot) === 0) {            // Anything on this site
+        redirect(urldecode($jump));
+    } else if (preg_match('/^[a-z]+\.php\?/', $jump)) { 
         redirect(urldecode($jump));
     }
 
-    redirect($_SERVER['HTTP_REFERER']);
+    redirect($_SERVER['HTTP_REFERER']);   // Return to sender, just in case
 
 ?>

course/lib.php

@@ -243,25 +243,6 @@ function print_log_selector_form($course, $selecteduser=0, $selecteddate="today"
         $showcourses = 1;
     }
    
-
-    if ($course->category) {
-        if ($selectedgroup) {   // If using a group, only get users in that group.
-            $courseusers = get_group_users($selectedgroup, 'u.lastname ASC', '', 'u.id');
-        } else {
-            $courseusers = get_course_users($course->id, '', '', 'u.id');
-        }
-    } else {
-        $courseusers = get_site_users('u.lastaccess DESC', 'u.id');
-    }
-
-    $numusers = count((array)$courseusers);
-
-
-    if ($numusers < COURSE_MAX_USERS_PER_DROPDOWN && !$showusers) {
-        $showusers = 1;
-    }
-    
-
     /// Setup for group handling.
     $isteacher = isteacher($course->id);
     $isteacheredit = isteacheredit($course->id);
@@ -281,17 +262,21 @@ function print_log_selector_form($course, $selecteduser=0, $selecteddate="today"
     // Get all the possible users
     $users = array();
 
-    if ($showusers) {
-        if ($course->category) {
-            if ($selectedgroup) {   // If using a group, only get users in that group.
-                $courseusers = get_group_users($selectedgroup, 'u.lastname ASC', '', 'u.id, u.firstname, u.lastname');
-            } else {
-                $courseusers = get_course_users($course->id, '', '', 'u.id, u.firstname, u.lastname');
-            }
+    if ($course->category) {
+        if ($selectedgroup) {   // If using a group, only get users in that group.
+            $courseusers = get_group_users($selectedgroup, 'u.lastname ASC', '', 'u.id, u.firstname, u.lastname, u.idnumber');
         } else {
-            $courseusers = get_site_users("u.lastaccess DESC", "u.id, u.firstname, u.lastname");
+            $courseusers = get_course_users($course->id, '', '', 'u.id, u.firstname, u.lastname, u.idnumber');
         }
+    } else {
+        $courseusers = get_site_users("u.lastaccess DESC", "u.id, u.firstname, u.lastname, u.idnumber");
+    }
+    
+    if (count($courseusers) < COURSE_MAX_USERS_PER_DROPDOWN && !$showusers) {
+        $showusers = 1;
+    }
 
+    if ($showusers) {
         if ($courseusers) {
             foreach ($courseusers as $courseuser) {
                 $users[$courseuser->id] = fullname($courseuser, $isteacher);
@@ -1144,6 +1129,14 @@ function make_categories_list(&$list, &$parents, $category=NULL, $path="") {
 /// categories, building up a nice list for display.  It also makes
 /// an array that list all the parents for each category.
 
+    // initialize the arrays if needed
+    if (!is_array($list)) {
+        $list = array(); 
+    }
+    if (!is_array($parents)) {
+        $parents = array(); 
+    }
+
     if ($category) {
         if ($path) {
             $path = $path.' / '.$category->name;
@@ -1231,7 +1224,7 @@ function print_category_info($category, $depth) {
     if ($CFG->frontpage == FRONTPAGECOURSELIST) {
         $catimage = '<img src="'.$CFG->pixpath.'/i/course.gif" width="16" height="16" border="0" alt="" />';
     } else {
-        $catimage = "&nbsp";
+        $catimage = "&nbsp;";
     }
 
     echo "\n\n".'<table border="0" cellpadding="3" cellspacing="0" width="100%">';
@@ -1440,20 +1433,20 @@ function print_course_search($value="", $return=false, $format="plain") {
     if ($format == 'plain') {
         $output  = '<form name="coursesearch" action="'.$CFG->wwwroot.'/course/search.php" method="get">';
         $output .= '<center><p align="center" class="coursesearchbox">';
-        $output .= '<input type="text" size="30" name="search" alt="'.$strsearchcourses.'" value="'.$value.'" />';
-        $output .= '<input type="submit" value="'.$strsearchcourses.'" />';
+        $output .= '<input type="text" size="30" name="search" alt="'.s($strsearchcourses).'" value="'.s($value).'" />';
+        $output .= '<input type="submit" value="'.s($strsearchcourses).'" />';
         $output .= '</p></center></form>';
     } else if ($format == 'short') {
         $output  = '<form name="coursesearch" action="'.$CFG->wwwroot.'/course/search.php" method="get">';
         $output .= '<center><p align="center" class="coursesearchbox">';
-        $output .= '<input type="text" size="12" name="search" alt="'.$strsearchcourses.'" value="'.$value.'" />';
-        $output .= '<input type="submit" value="'.$strsearchcourses.'" />';
+        $output .= '<input type="text" size="12" name="search" alt="'.s($strsearchcourses).'" value="'.s($value).'" />';
+        $output .= '<input type="submit" value="'.s($strsearchcourses).'" />';
         $output .= '</p></center></form>';
     } else if ($format == 'navbar') {
         $output  = '<form name="coursesearch" action="'.$CFG->wwwroot.'/course/search.php" method="get">';
         $output .= '<table border="0" cellpadding="0" cellspacing="0"><tr><td nowrap="nowrap">';
-        $output .= '<input type="text" size="20" name="search" alt="'.$strsearchcourses.'" value="'.$value.'" />';
-        $output .= '<input type="submit" value="'.$strsearchcourses.'" />';
+        $output .= '<input type="text" size="20" name="search" alt="'.s($strsearchcourses).'" value="'.s($value).'" />';
+        $output .= '<input type="submit" value="'.s($strsearchcourses).'" />';
         $output .= '</td></tr></table>';
         $output .= '</form>';
     }
@@ -1607,6 +1600,22 @@ function move_section($course, $section, $move) {
     if (isset($USER->display[$course->id]) and ($USER->display[$course->id] == $section)) {
         course_set_display($course->id, $sectiondest);
     }
+
+    // Check for duplicates.
+    // There is a very rare case that some sections in the same course have the same section id.
+    if (($count_section = count_records('course_sections', 'course', $course->id) - 1) != $course->numsections) {
+        $sections = get_records_select('course_sections', "course = $course->id AND section > 0", 'section ASC');
+        $n = 1;
+        foreach ($sections as $section) {
+            if (!set_field('course_sections', 'section', $n, 'id', $section->id)) {
+                return false;
+            }
+            $n++;
+        }
+        if (!set_field('course', 'numsections', $count_section, 'id', $course->id)) {
+            return false;
+        }
+    }
     return true;
 }
 

course/loginas.php

@@ -77,9 +77,8 @@
     $strloginas    = get_string("loginas");
     $strloggedinas = get_string("loggedinas", "", $student_name);
 
-    print_header("$course->fullname: $strloginas $student_name", "$course->fullname", 
-                 "<a href=\"$CFG->wwwroot/course/view.php?id=$course->id\">$course->shortname</a> -> 
-                  $strloginas $student_name");
+    print_header_simple("$strloginas $student_name", '', "$strloginas $student_name", '', '', 
+                       true, '&nbsp;', navmenu($course));
     notice($strloggedinas, "$CFG->wwwroot/course/view.php?id=$course->id");
 
 

course/loglive.php

@@ -4,7 +4,8 @@
     require_once("../config.php");
     require_once("lib.php");
 
-    require_variable($id);
+    $id   = required_param('id', PARAM_INT);
+    $page = optional_param('page', 0, PARAM_INT);     // which page to show
 
     require_login();
 
@@ -28,12 +29,12 @@
     $strupdatesevery = get_string("updatesevery", "moodle", COURSE_LIVELOG_REFRESH);
 
     print_header("$strlivelogs ($strupdatesevery)", "$strlivelogs", "", "", 
-                 '<meta http-equiv="Refresh" content="'.COURSE_LIVELOG_REFRESH.'; url=loglive.php?id='.$id.'" />');
+                 '<meta http-equiv="Refresh" content="'.COURSE_LIVELOG_REFRESH.'; url=loglive.php?id='.$course->id.'" />');
 
     $user=0;
     $date=time() - 3600;
 
-    print_log($course, $user, $date, "l.time DESC", 0, 500, 
+    print_log($course, $user, $date, "l.time DESC", $page, 500,
               "loglive.php?id=$course->id&amp;user=$user&amp;date=$date");
 
     print_footer($course);

course/mod.php

@@ -29,14 +29,29 @@
 
     if (isset($_POST["course"]) and confirm_sesskey()) {    // add or update form submitted
 
-        if (!$course = get_record("course", "id", $mod->course)) {
-            error("This course doesn't exist");
+        if (empty($mod->coursemodule)) { //add
+            if (! $course = get_record("course", "id", $mod->course)) {
+                error("This course doesn't exist");
+            }
+            $mod->instance = '';
+            $mod->coursemodule = '';
+        } else { //delete and update
+            if (! $cm = get_record("course_modules", "id", $mod->coursemodule)) {
+                error("This course module doesn't exist");
+            }
+
+            if (! $course = get_record("course", "id", $cm->course)) {
+                error("This course doesn't exist");
+            }
+            $mod->instance = $cm->instance;
+            $mod->coursemodule = $cm->id;
         }
 
         if (!isteacheredit($course->id)) {
             error("You can't modify this course!");
         }
-
+        
+        $mod->course = $course->id;
         $mod->modulename = clean_filename($mod->modulename);  // For safety
         $modlib = "$CFG->dirroot/mod/$mod->modulename/lib.php";
 
@@ -239,6 +254,10 @@
             error("This course module doesn't exist");
         }
 
+        if (!isteacheredit($cm->course)) {
+            error("You can't modify this course!");
+        }
+
         $cm->indent += $_GET['indent'];
 
         if ($cm->indent < 0) {
@@ -603,10 +622,10 @@
             $defaultformat = FORMAT_MOODLE;
         }
 
-        $icon = "<img align=\"middle\" height=\"16\" width=\"16\" src=\"$CFG->modpixpath/$module->name/icon.gif\" alt=\"\" />&nbsp;";
+        $icon = '<img align="middle" height="16" width="16" src="'.$CFG->modpixpath.'/'.$module->name.'/icon.gif" alt="" style="vertical-align: middle;" />&nbsp;';
 
         print_heading_with_help($pageheading, "mods", $module->name, $icon);
-        print_simple_box_start("center");
+        print_simple_box_start('center', '', '', 5, 'generalbox', $module->name);
         include_once($modform);
         print_simple_box_end();
 

course/recent.php

@@ -8,7 +8,7 @@
     require_variable($id);
 
     $user          = optional_param('user', '0', PARAM_INT);
-    $sortby        = optional_param('user', 'default');
+    $sortby        = optional_param('sortby', 'default', PARAM_ALPHA);
     $selectedgroup = optional_param('selectedgroup', '');
 
     if (! $course = get_record("course", "id", $id) ) {

course/search.php

@@ -5,11 +5,11 @@
     require_once("../config.php");
     require_once("lib.php");
 
-    optional_variable($search, "");    // search words
-    optional_variable($page, "0");     // which page to show
-    optional_variable($perpage, "10"); // how many per page
+    $search  = optional_param('search', '', PARAM_RAW);  // search words
+    $page    = optional_param('page', 0, PARAM_INT);     // which page to show
+    $perpage = optional_param('perpage', 10, PARAM_INT); // how many per page
 
-    $search = trim(strip_tags($search));
+    $search = trim(strip_tags($search)); // trim & clean raw searched string
 
     if ($search) {
         $searchterms = explode(" ", $search);    // Search for words independently
@@ -55,7 +55,7 @@
     $searchform = print_course_search($search, true, "navbar");
 
     print_header("$site->fullname : $strsearchresults", $site->fullname, 
-                 "<a href=\"index.php\">$strcourses</a> -> <a href=\"search.php\">$strsearch</a> -> '$search'", "", "", "", $searchform);
+                 "<a href=\"index.php\">$strcourses</a> -> <a href=\"search.php\">$strsearch</a> -> '".s($search)."'", "", "", "", $searchform);
 
 
     $lastcategory = -1;
@@ -64,7 +64,8 @@
 
         print_heading("$strsearchresults: $totalcount");
 
-        print_paging_bar($totalcount, $page, $perpage, "search.php?search=$search&amp;perpage=$perpage&");
+        $encodedsearch = urlencode(stripslashes($search));
+        print_paging_bar($totalcount, $page, $perpage, "search.php?search=$encodedsearch&amp;perpage=$perpage&");
 
         foreach ($courses as $course) {
             $course->fullname = highlight("$search", $course->fullname);
@@ -77,10 +78,10 @@
             print_spacer(5,5);
         }
 
-        print_paging_bar($totalcount, $page, $perpage, "search.php?search=$search&amp;perpage=$perpage&");
+        print_paging_bar($totalcount, $page, $perpage, "search.php?search=$encodedsearch&amp;perpage=$perpage&");
 
     } else {
-        print_heading(get_string("nocoursesfound", "", $search));
+        print_heading(get_string("nocoursesfound", "", s($search)));
     }
 
     echo "<br /><br />";

course/student.html

@@ -2,7 +2,7 @@
 <form name="studentform" id="studentform" method="post" action="student.php">
 <input type="hidden" name="previoussearch" value="<?php echo $previoussearch ?>" />
 <input type="hidden" name="sesskey" value="<?php echo $sesskey ?>" />
-<input type="hidden" name="id" value="<?php echo $id?>" />
+<input type="hidden" name="id" value="<?php echo $course->id ?>" />
   <table align="center" border="0" cellpadding="5" cellspacing="0">
     <tr>
       <td valign="top">
@@ -63,16 +63,18 @@
                           .'<optgroup label="'.get_string('trysearching').'"><option></option></optgroup>'."\n";
                   }
                   else {
-                      foreach ($users as $user) {
-                          $fullname = fullname($user, true);
-                          echo "<option value=\"$user->id\">".$fullname.", ".$user->email."</option>\n";
+                      if ($usercount > 0) {    //fix for bug#4455
+                          foreach ($users as $user) {
+                              $fullname = fullname($user, true);
+                              echo "<option value=\"$user->id\">".$fullname.", ".$user->email."</option>\n";
+                          }
                       }
                   }
               }
           ?>
          </select>
          <br />
-         <input type="text" name="searchtext" size="30" value="<?php echo $searchtext ?>" 
+         <input type="text" name="searchtext" size="30" value="<?php p($searchtext) ?>" 
                   onFocus ="document.studentform.add.disabled=true;
                             document.studentform.remove.disabled=true;
                             document.studentform.removeselect.selectedIndex=-1;

course/teacher.php

@@ -55,16 +55,6 @@
     }
 
 
-
-/// Print headers
-
-    print_header("$course->shortname: $strassignteachers", 
-                 "$course->fullname", 
-                 "<a href=\"index.php\">$strcourses</a> -> ".
-                 "<a href=\"view.php?id=$course->id\">$course->shortname</a> -> ".
-                 "$strassignteachers", "");
-
-
 /// If data submitted, then process and store.
 
     if ($form = data_submitted() and confirm_sesskey()) {
@@ -94,6 +84,14 @@
         redirect("teacher.php?id=$course->id", get_string("changessaved"));
     }
 
+/// Print headers
+
+    print_header("$course->shortname: $strassignteachers", 
+                 "$course->fullname", 
+                 "<a href=\"index.php\">$strcourses</a> -> ".
+                 "<a href=\"view.php?id=$course->id\">$course->shortname</a> -> ".
+                 "$strassignteachers", "");
+
 /// Add a teacher if one is specified
 
     if (!empty($_GET['add']) and confirm_sesskey()) {
@@ -158,7 +156,7 @@
             }
     
             $table->data[] = array ($picture, fullname($teacher, true), $authority,
-                                    "<input type=\"text\" name=\"r$teacher->id\" value=\"$teacher->role\" size=\"30\" />",
+                                    "<input type=\"text\" name=\"r$teacher->id\" value=\"$teacher->role\" size=\"30\" maxlength=\"40\" />",
                                     $editall, $removelink);
         }
         $teacherlist = implode(",",$teacherarray);

course/unenrol.php

@@ -24,7 +24,7 @@
         error("You must be a teacher with editing rights to do this");
     }
 
-    if ($user->id == $USER->id and !$CFG->allowunenroll) {
+    if ($user->id == $USER->id and !$CFG->allowunenroll or $course->metacourse) {
         error("You are not allowed to unenroll");
     }
 

course/user.php

@@ -185,7 +185,7 @@ function print_outline_row($mod, $instance, $result) {
     }
     echo "</td>";
     echo "<td>&nbsp;&nbsp;&nbsp;</td>";
-    if (isset($result->time)) {
+    if (!empty($result->time)) {
         $timeago = format_time(time() - $result->time);
         echo "<td valign=\"top\" nowrap=\"nowrap\">".userdate($result->time)." ($timeago)</td>";
     }