Moodle 1.5.4 - yay!

change list items integrated into the other stuff.

It's not pretty but it's probably getting close to complete.

admin/auth.php

@@ -32,7 +32,6 @@
         }
 
         if (count($err) == 0) {
-            print_header();
             foreach ($config as $name => $value) {
                 if (preg_match('/^pluginconfig_(.+?)$/', $name, $matches)) {
                     $plugin = "auth/$auth";

admin/backup.php

@@ -54,7 +54,6 @@
         $config = (object)$a_config;
         //weekdays conversions done. Continue
 
-        print_header();
         foreach ($config as $name => $value) {
             backup_set_config($name, $value);
         }

admin/block.php

@@ -47,7 +47,6 @@
             unset($config->$item);
         }
         $block->config_save($config);
-        print_header();
         redirect("$CFG->wwwroot/$CFG->admin/blocks.php", get_string("changessaved"), 1);
         exit;
     }

admin/config.php

@@ -30,7 +30,6 @@
         validate_form($config, $err);
 
         if (count($err) == 0) {
-            print_header();
             foreach ($config as $name => $value) {
                 if ($name == "sessioncookie") {
                     $value = eregi_replace("[^a-zA-Z]", "", $value);

admin/configvars.php

@@ -74,6 +74,9 @@ class configvar {
     $misc['debug'] = new configvar (get_string('configdebug', 'admin'),
         choose_from_menu ($options, 'debug', $config->debug, '', '', '', true) );
 
+    $misc['perfdebug'] = new configvar (get_string('configperfdebug', 'admin'),
+        choose_from_menu ($options, 'perfdebug', $config->perfdebug, '', '', '', true) );
+
 /// enablerssfeeds
 class configvarrss extends configvar {
     function display_warning() {
@@ -135,6 +138,9 @@ class configvarrss extends configvar {
     $operatingsystem['unzip'] = new configvar (get_string('configunzip', 'admin'),
         '<input name="unzip" type="text" size="30" value="'.s($config->unzip).'" alt="unzip" />' );
 
+    $operatingsystem['pathtodu'] = new configvar(get_string('configpathtodu', 'admin'),
+        '<input name="pathtodu" type="text" size="30" value="'.s($config->pathtodu).'" alt="pathtodu" />');                                                
+
 /// slasharguments
     unset($options);
     $options[0] = "file.php?file=/pic.jpg";

admin/editor.php

@@ -178,7 +178,7 @@ function editor_get_dictionaries () {
     $dictionaries = array();
     $dicts        = array();
 
-    if(!($handle = @popen($cmd .' dump dicts', 'r'))) {
+    if(!($handle = @popen(escapeshellarg($cmd) .' dump dicts', 'r'))) {
         return $strerror = "Couldn't create handle!";
         exit;
     }

admin/environment.php

@@ -96,7 +96,7 @@
     }
 
 /// Print form and popup menu
-    echo '<center><form method="post" action="'.$CFG->wwwroot.'/admin/environment.php">';
+    echo '<center><form method="post" action="environment.php">';
     echo $strmoodleversion.' ';
     choose_from_menu ($versions, 'version', $version, null, 'this.form.submit();' );
     echo '<input type="hidden" name="sesskey" value="'.$USER->sesskey.'" />';
@@ -107,22 +107,6 @@
 /// Gather and show results
     $status = check_moodle_environment($version, $environment_results);
 
-
-
-/// Process action
-    if ($form = data_submitted()) {
-        if (confirm_sesskey()) {
-            if ($form->action == "disable") {
-
-            } else {
-
-            }
-        }
-    }
-
-/// Default action, show explanation and popup menu
-
-
 /// Print footer
     print_footer();
 ?>

admin/environment.xml

@@ -12,13 +12,26 @@
   </MOODLE>
   <MOODLE version="1.6">
     <DATABASE level="required">
-      <VENDOR name="mysql" version="4.1.12" />
+      <VENDOR name="mysql" version="4.1.16">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
+      </VENDOR>
       <VENDOR name="postgres" version="7.4" />
     </DATABASE>
     <PHP version="4.3.0" level="required" />
     <PHP_EXTENSIONS>
-      <PHP_EXTENSION name="iconv" level="optional" />
-      <PHP_EXTENSION name="mbstring" level="optional" />
+      <PHP_EXTENSION name="iconv" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
     </PHP_EXTENSIONS>
   </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/handlevirus.php

@@ -1,4 +1,4 @@
-<?
+<?php // $Id$
 /** This expects the output from a command like
  * clamscan -r --infected --no-summary <files> 2>&1 | php -d error_log=/path/to/log thisfile.php 
  * also it's important that the output of clamscan prints the FULL PATH to each infected file, so use absolute paths for area to scan

admin/index.php

@@ -18,6 +18,13 @@
         die;
     }
 
+/// This is a Moodle 1.5 hack ONLY to fix accidental bad versions from version.php
+/// Do not copy this code into HEAD
+  
+    if ($CFG->version == '2005072100') {
+        set_config('version', 2005060221);
+    }
+
 
 /// Check some PHP server settings
 
@@ -312,6 +319,11 @@
         print_spacer(10,10);
     }
 
+    if (ini_get_bool('register_globals') && !ini_get_bool('magic_quotes_gpc')) {
+        print_simple_box(get_string('globalsquoteswarning', 'admin'), 'center');
+    }
+
+
 /// If no recently cron run
     $lastcron = get_field_sql('SELECT max(lastcron) FROM ' . $CFG->prefix . 'modules');
     if (time() - $lastcron > 3600 * 24) {
@@ -403,8 +415,12 @@
                            "<font size=\"+1\">&nbsp;</font>".get_string("adminhelpcourses"));
     $table->data[] = array("<font size=\"+1\"><b><a href=\"../course/log.php?id=$site->id\">".get_string("logs")."</a></b></font>",
                            "<font size=\"+1\">&nbsp;</font>".get_string("adminhelplogs"));
+
     $table->data[] = array("<font size=\"+1\"><b><a href=\"../files/index.php?id=$site->id\">".get_string("sitefiles")."</a></b></font>",
                            "<font size=\"+1\">&nbsp;</font>".get_string("adminhelpsitefiles"));
+
+    $table->data[] = array('<font size="+1"><b><a href="environment.php">'.get_string('environment','admin').'</a></b></font>',
+                           "<font size=\"+1\">&nbsp;</font>".get_string('adminhelpenvironment'));
     if (file_exists("$CFG->dirroot/$CFG->admin/$CFG->dbtype")) {
         $table->data[] = array("<font size=\"+1\"><b><a href=\"$CFG->dbtype/frame.php\">".get_string("managedatabase")."</a></b></font>",
                                "<font size=\"+1\">&nbsp;</font>".get_string("adminhelpmanagedatabase"));
@@ -416,7 +432,7 @@
     ////  IT IS ILLEGAL AND A VIOLATION OF THE GPL TO REMOVE OR MODIFY THE COPYRIGHT NOTICE BELOW ////
     $copyrighttext = "<a href=\"http://moodle.org/\">Moodle</a> ".
                      "<a href=\"../doc/?frame=release.html\">$CFG->release</a> ($CFG->version)<br />".
-                     "Copyright &copy; 1999-2005 Martin Dougiamas<br />".
+                     "Copyright &copy; 1999 onwards by Martin Dougiamas<br />".
                      "<a href=\"../doc/?frame=licence.html\">GNU Public License</a>";
     echo "<center><p><font size=\"1\">$copyrighttext</font></p></center>";
     //////////////////////////////////////////////////////////////////////////////////////////////////

admin/module.php

@@ -37,8 +37,6 @@
             $moduleprefix = '';
         }
 
-        print_header();
-
         foreach ($config as $name => $value) {
             set_config($moduleprefix.$name, $value);
         }

admin/oacleanup.php

@@ -29,7 +29,20 @@ function online_assignment_cleanup($output=false) {
         echo '<center>';
     }
 
-    // get the module id for assignments from db
+
+    /// We don't want to run this code if we are doing an upgrade from an assignment
+    /// version earlier than 2005041400
+    /// because the assignment type field will not exist
+    $amv = get_field('modules', 'version', 'name', 'assignment');
+    if ((int)$amv < 2005041400) {
+        if ($output) {
+            echo '</center>';
+        }
+        return;
+    }
+
+
+    /// get the module id for assignments from db
     $arecord = get_record('modules', 'name', 'assignment');
     $aid = $arecord->id;
 
@@ -44,7 +57,7 @@ function online_assignment_cleanup($output=false) {
         if ($output) print_heading($fullname);
 
         /// retrieve a list of sections beyond what is currently being shown
-        $sql = 'SELECT * FROM '.$CFG->prefix.'course_sections WHERE `course`='.$course->id.' AND `section`>'.$course->numsections.' ORDER BY `section` ASC';
+        $sql = 'SELECT * FROM '.$CFG->prefix.'course_sections WHERE course='.$course->id.' AND section>'.$course->numsections.' ORDER BY section ASC';
         if (!($xsections = get_records_sql($sql))) {
             if ($output) echo 'No extra sections<br />';
             continue;

admin/phpinfo.php

@@ -3,32 +3,37 @@
 
     require_once("../config.php");
 
+    $topframe    = optional_param('topframe', false, PARAM_BOOL);
+    $bottomframe = optional_param('bottomframe', false, PARAM_BOOL);
+
     require_login();
 
     if (!isadmin()) {
         error("Only the admin can use this page");
     }
 
-    if (isset($topframe)) {
+    if (!$topframe && !$bottomframe) {
+        ?>
+
+        <head>
+        <title>PHP info</title>
+        </head>
+
+        <frameset rows="80,*">
+           <frame src="phpinfo.php?topframe=true&amp;sesskey=<?php echo $USER->sesskey ?>">
+           <frame src="phpinfo.php?bottomframe=true&amp;sesskey=<?php echo $USER->sesskey ?>">
+        </frameset>
+
+        <?php
+    } else if ($topframe && confirm_sesskey()) {
         $stradministration = get_string("administration");
         $site = get_site();
-    
-        print_header("$site->shortname: phpinfo", "$site->fullname", 
+
+        print_header("$site->shortname: phpinfo", "$site->fullname",
                      "<a target=\"$CFG->framename\" href=\"index.php\">$stradministration</a> -> PHP info");
         exit;
-    }
-
-    if (isset($bottomframe)) {
+    } else if ($bottomframe && confirm_sesskey()) {
         phpinfo();
         exit;
     }
-
 ?>
-<head>
-<title>PHP info</title>
-</head>
-
-<frameset rows="80,*">
-   <frame src="phpinfo.php?topframe=true">
-   <frame src="phpinfo.php?bottomframe=true">
-</frameset>

admin/process_email.php

@@ -1,5 +1,5 @@
 #!/usr/bin/php -f
-<?
+<?php // $Id$
 define('FULLME','cron'); // prevent warnings
 //error_reporting(0);
 //ini_set('display_errors',0);

admin/unchecked_vars.php

@@ -0,0 +1,35 @@
+<?php
+
+    include("../config.php");
+
+    $action = optional_param('action','LIST',PARAM_ALPHA);
+    $url    = optional_param('url');
+    $info   = optional_param('info');
+
+    if (!isadmin()) {
+        error("Only the admin can use this page");
+    }
+
+    print_header('Admin : Unchecked Vars' );
+
+    if ($action == 'DELETE') {
+        delete_records('log', 'url', $url, 'info', $info);
+    }
+
+    if ($errors = get_records_sql("SELECT DISTINCT url, info 
+                                   FROM {$CFG->prefix}log
+                                   WHERE module = 'dev' AND
+                                         action = 'unchecked vars'")) {
+        echo '<table border="1" cellpadding="5">';
+        foreach ($errors as $error) {
+            echo '<tr>';
+            echo '<td>'.$error->url.'</td>';
+            echo '<td>'.$error->info.'</td>';
+            echo '<td><a href="unchecked_vars.php?action=DELETE&amp;url='.$error->url.'&amp;info='.$error->info.'">Delete this</a></td>';
+            echo '</tr>';
+        }
+        echo '</table>';
+    } else {
+        echo "No unchecked vars were detected";
+    }
+?>

admin/uploaduser.php

@@ -5,7 +5,7 @@
 
     require_once("../config.php");
 
-    optional_variable($numusers, 0);
+    $numusers = optional_param('numusers', 0, PARAM_INT);
 
     require_login();
 
@@ -141,7 +141,7 @@
             }
             if ($record[$header[0]]) {
                 // add a new user to the database
-                optional_variable($newuser, ""); 
+                $newuser = optional_param('newuser', "", PARAM_CLEAN); 
 
                 // add fields to object $user
                 foreach ($record as $name => $value) {

auth/cas/config.html

@@ -1,13 +1,27 @@
 <?php
     require_once('languages.php');
     // Initialize vars
-    optional_variable($config->cas_hostname,"");
-    optional_variable($config->cas_port,"");
-    optional_variable($config->cas_version,"");
-    optional_variable($config->cas_baseuri,"");
-    optional_variable($config->cas_language,"");
-    optional_variable($config->cas_use_cas,"");
-    optional_variable($config->cas_create_user,"0");
+    if (!isset ($config->cas_hostname)) {
+        $config->cas_hostname = "";
+    }
+    if (!isset ($config->cas_port)) {
+        $config->cas_port = "";
+    }
+    if (!isset ($config->cas_version)) {
+        $config->cas_version = "";
+    }
+    if (!isset ($config->cas_baseuri)) {
+        $config->cas_baseuri = "";
+    }
+    if (!isset ($config->cas_language)) {
+        $config->cas_language = "";
+    }
+    if (!isset ($config->cas_use_cas)) {
+        $config->cas_use_cas = "";
+    }
+    if (!isset ($config->cas_create_user)) {
+        $config->cas_create_user = "0";
+    }
 ?>
 
 

auth/cas/lib.php

@@ -136,7 +136,7 @@ function cas_automatic_authenticate ($user="") {
    global $CFG;
    if (!$cas_validate){
         $cas_validate=true;
-        phpCAS::client($CFG->cas_version,$CFG->cas_hostname,(Integer)$CFG->cas_port,$CFG->cas_baseuri);
+        phpCAS::client($CFG->cas_version,$CFG->cas_hostname,(int)$CFG->cas_port,$CFG->cas_baseuri);
         phpCAS::setLang($CFG->cas_language);
         if (!phpCAS::isAuthenticated() && !$CFG->guestloginbutton){
            phpCAS::authenticateIfNeeded();

auth/db/lib.php

@@ -76,7 +76,7 @@ function auth_get_userinfo($username){
             if ($rs = $authdb->Execute("SELECT ".$pcfg["field_map_$field"]." FROM $CFG->auth_dbtable
                                         WHERE $CFG->auth_dbfielduser = '$username'")) {
                 if ( $rs->RecordCount() == 1 ) {
-                    $result["$field"] = $rs->fields[0];
+                    $result["$field"] = addslashes(stripslashes(utf8_decode($rs->fields[0])));
                 }
             }
         }

auth/ldap/config.html

@@ -1,29 +1,71 @@
 <?php
     // Initialize vars
-    optional_variable($config->ldap_host_url,             "");
-    optional_variable($config->ldap_contexts,             "");
-    optional_variable($config->ldap_user_type,    "");
-    optional_variable($config->ldap_user_attribute,    "");
-    optional_variable($config->ldap_search_sub,         "");
-    optional_variable($config->ldap_opt_deref,         "");
-    optional_variable($config->ldap_preventpassindb,       0); 
-    optional_variable($config->ldap_bind_dn,             "");
-    optional_variable($config->ldap_bind_pw,             "");
-    optional_variable($config->ldap_version,             "2");
-    optional_variable($config->ldap_objectclass,         "");
-    optional_variable($config->ldap_memberattribute,    "");
-    optional_variable($config->ldap_creators,             "");
-    optional_variable($config->ldap_create_context,     "");
-    optional_variable($config->ldap_expiration,         "");
-    optional_variable($config->ldap_expiration_warning,         "10");
-    optional_variable($config->ldap_expireattr,         "");
-    optional_variable($config->ldap_gracelogins,         "");
-    optional_variable($config->ldap_graceattr,         "");
-    optional_variable($config->auth_user_create,         "");
-    optional_variable($config->auth_user_create,         "");
-    optional_variable($config->auth_ldap_forcechangepassword,         "");
-    
-    optional_variable($config->auth_ldap_stdchangepassword,        false); 
+    if (!isset ($config->ldap_host_url)) {
+        $config->ldap_host_url = "";
+    }
+    if (!isset ($config->ldap_contexts)) {
+        $config->ldap_contexts = "";
+    }
+    if (!isset ($config->ldap_user_attribute)) {
+        $config->ldap_user_attribute = "";
+    }
+    if (!isset ($config->ldap_user_type)) {
+        $config->ldap_user_type = "";
+    }
+    if (!isset ($config->ldap_search_sub)) {
+        $config->ldap_search_sub = "";
+    }
+    if (!isset ($config->ldap_opt_deref)) {
+        $config->ldap_opt_deref = "";
+    }
+    if (!isset ($config->ldap_preventpassindb)) {
+        $config->ldap_preventpassindb = 0;
+    }
+    if (!isset ($config->ldap_bind_dn)) {
+        $config->ldap_bind_dn = "";
+    }
+    if (!isset ($config->ldap_bind_pw)) {
+        $config->ldap_bind_pw = "";
+    }
+    if (!isset ($config->ldap_version)) {
+        $config->ldap_version = "2";
+    }
+    if (!isset ($config->ldap_objectclass)) {
+        $config->ldap_objectclass = "";
+    }
+    if (!isset ($config->ldap_memberattribute)) {
+        $config->ldap_memberattribute = "";
+    }
+    if (!isset ($config->ldap_creators)) {
+        $config->ldap_creators = "";
+    }
+    if (!isset ($config->ldap_create_context)) {
+        $config->ldap_create_context = "";
+    }
+    if (!isset ($config->ldap_expiration)) {
+        $config->ldap_expiration = "";
+    }
+    if (!isset ($config->ldap_expiration_warning)) {
+        $config->ldap_expiration_warning = "10";
+    }
+    if (!isset ($config->ldap_expireattr)) {
+        $config->ldap_expireattr = "";
+    }
+    if (!isset ($config->ldap_gracelogins)) {
+        $config->ldap_gracelogins = "";
+    }
+    if (!isset ($config->ldap_graceattr)) {
+        $config->ldap_graceattr = "";
+    }
+    if (!isset ($config->auth_user_create)) {
+        $config->auth_user_create = "";
+    }
+    if (!isset ($config->auth_ldap_forcechangepassword)) {
+        $config->auth_ldap_forcechangepassword = "";
+    }
+    if (!isset ($config->auth_ldap_stdchangepassword)) {
+        $config->auth_ldap_stdchangepassword = false;
+    }
     
 if (!function_exists('ldap_connect')){ // Is php4-ldap really there?
     print '<tr><td><p align="center"><font color="red"><strong>Warning:
@@ -38,7 +80,7 @@ if (!function_exists('ldap_connect')){ // Is php4-ldap really there?
    </td>
 </tr>
 
-<tr valign="top" class="required">
+                <tr valign="top" class="required">
     <td align="right">ldap_host_url:</td>
     <td>
         <input name="ldap_host_url" type="text" size="30" value="<?php echo $config->ldap_host_url?>">

auth/ldap/lib.php

@@ -68,7 +68,7 @@ function auth_user_login ($username, $password) {
         }
 
         // Try to bind with current username and password
-        $ldap_login = @ldap_bind($ldapconnection, $ldap_user_dn, $password);
+        $ldap_login = @ldap_bind($ldapconnection, $ldap_user_dn, stripslashes($password));
         ldap_close($ldapconnection);
         if ($ldap_login) {
             return true;
@@ -124,11 +124,19 @@ function auth_get_userinfo($username){
             if (!is_array($values)) {
                 $values = array($values);
             }
+            $ldapval = NULL;
             foreach ($values as $value) {
-                if(isset($user_entry[0][strtolower($value)][0])){
-                    $result[$key]=addslashes(stripslashes(utf8_decode($user_entry[0][strtolower($value)][0])));
+                if(is_array($user_entry[0][strtolower($value)])) {
+                    $newval = addslashes(stripslashes(utf8_decode($user_entry[0][strtolower($value)][0])));
                 }
+                else {
+                    $newval = addslashes(stripslashes(utf8_decode($user_entry[0][strtolower($value)])));
+                }
+                if (!empty($newval)) { // favour ldap entries that are set
+                    $ldapval = $newval;
+                } 
             }
+            $result[$key] = $ldapval;
         }
     }
 
@@ -210,14 +218,14 @@ function auth_user_create ($userobject,$plainpass) {
 
     switch ($CFG->ldap_user_type)  {
         case 'edir':
-    $newuser['objectClass']= array("inetOrgPerson","organizationalPerson","person","top");
-    $newuser['uniqueId']= $userobject->username;
-    $newuser['logindisabled']="TRUE";
-    $newuser['userpassword']=$plainpass;
+            $newuser['objectClass']= array("inetOrgPerson","organizationalPerson","person","top");
+            $newuser['uniqueId']= $userobject->username;
+            $newuser['logindisabled']="TRUE";
+            $newuser['userpassword']=$plainpass;
+            break;
         default:
-           error('auth: ldap auth_user_create() does not support selected usertype (..yet)');
+           error('auth: ldap auth_user_create() does not support selected usertype:"'.$CFG->ldap_user_type.'" (..yet)');
     }
-        
     $uadd = ldap_add($ldapconnection, $CFG->ldap_user_attribute."=$userobject->username,".$CFG->ldap_create_context, $newuser);
 
     ldap_close($ldapconnection);
@@ -379,10 +387,10 @@ function auth_sync_users ($bulk_insert_records = 1000, $do_updates=1) {
     if(strtolower($CFG->dbtype) === 'mysql'){
         // help old mysql versions cope with large temp tables
         execute_sql('SET SQL_BIG_TABLES=1', false); 
-        execute_sql('CREATE TEMPORARY TABLE ' . $CFG->prefix .'extuser (idnumber VARCHAR(12), PRIMARY KEY (idnumber)) TYPE=MyISAM',false); 
+        execute_sql('CREATE TEMPORARY TABLE ' . $CFG->prefix .'extuser (idnumber VARCHAR(64), PRIMARY KEY (idnumber)) TYPE=MyISAM',false); 
     } elseif (strtolower($CFG->dbtype) === 'postgres7'){
         $bulk_insert_records = 1; // no support for multiple sets of values
-        execute_sql('CREATE TEMPORARY TABLE '.$CFG->prefix.'extuser (idnumber VARCHAR(12), PRIMARY KEY (idnumber))',false); 
+        execute_sql('CREATE TEMPORARY TABLE '.$CFG->prefix.'extuser (idnumber VARCHAR(64), PRIMARY KEY (idnumber))',false); 
     }
 
         
@@ -508,7 +516,11 @@ function auth_sync_users ($bulk_insert_records = 1000, $do_updates=1) {
         $updatekeys = array();
         foreach ($all_keys as $key) {
             if (preg_match('/^field_updatelocal_(.+)$/',$key, $match)) {
-                if ($pcfg->{$match[0]}) { // if it has a true value
+                // if we have a field to update it from
+                // and it must be updated 'onlogin' we 
+                // update it on cron
+                if ( !empty($pcfg->{'field_map_'.$match[1]})
+                     && $pcfg->{$match[0]} === 'onlogin') { 
                     array_push($updatekeys, $match[1]); // the actual key name
                 }
             }
@@ -600,7 +612,7 @@ function auth_sync_users ($bulk_insert_records = 1000, $do_updates=1) {
             $CFG->debug=$old_debug;
             $userobj = auth_ldap_update_user_record($user->username);
             if(isset($CFG->{'auth_ldap_forcechangepassword'}) && $CFG->{'auth_ldap_forcechangepassword'}){
-                set_user_preference('auth_forcepasswordchange', 1, $userobj);
+                set_user_preference('auth_forcepasswordchange', 1, $userobj->id);
             }
             
             // update course creators
@@ -614,7 +626,7 @@ function auth_sync_users ($bulk_insert_records = 1000, $do_updates=1) {
                   }
                 } else {
                      if ( record_exists("user_coursecreators", "userid", $user->id)) {
-                          $creator = delete_records("user_coursecreators", "userid", $$user->id);
+                          $creator = delete_records("user_coursecreators", "userid", $user->id);
                           if (! $creator) {
                               error("Cannot remove user from course creators.");
                           }
@@ -703,17 +715,19 @@ function auth_ldap_bulk_insert($users){
  * @return boolen result
  */
 function auth_user_activate ($username) {
-    global $CFG;
-
-    $ldapconnection = auth_ldap_connect();
     
+    global $CFG;
+    
+    $ldapconnection = auth_ldap_connect();
+
     $userdn = auth_ldap_find_userdn($ldapconnection, $username);
     switch ($CFG->ldap_user_type)  {
-         case 'edir':
-    $newinfo['loginDisabled']="FALSE";
-         default;
-            error ('auth: ldap auth_user_activate() does not support selected usertype (..yet)');    
-    }    
+        case 'edir':
+            $newinfo['loginDisabled']="FALSE";
+            break;
+        default:
+            error ('auth: ldap auth_user_activate() does not support selected usertype:"'.$CFG->ldap_user_type.'" (..yet)');    
+    } 
     $result = ldap_modify($ldapconnection, $userdn, $newinfo);
     ldap_close($ldapconnection);
     return $result;
@@ -735,7 +749,8 @@ function auth_user_disable ($username) {
     $userdn = auth_ldap_find_userdn($ldapconnection, $username);
     switch ($CFG->ldap_user_type)  {
         case 'edir':
-    $newinfo['loginDisabled']="TRUE";
+            $newinfo['loginDisabled']="TRUE";
+            break;
         default:
             error ('auth: ldap auth_user_disable() does not support selected usertype (..yet)');    
     }    
@@ -811,10 +826,19 @@ function auth_user_update($olduser, $newuser) {
     if ($user_info_result){
 
         $user_entry = auth_ldap_get_entries($ldapconnection, $user_info_result);
+        if (count($user_entry)) {
+            trigger_error("ldap: Strange! More than one user record found in ldap. Only using the first one.");
+        }
+        $user_entry = $user_entry[0];
+
         //error_log(var_export($user_entry) . 'fpp' );
         
         foreach ($attrmap as $key=>$ldapkeys){
-            if (!empty($pcfg->{'field_updateremote_'. $key})) {
+
+            // only process if the moodle field ($key) has changed and we
+            // are set to update LDAP with it
+            if ($olduser->$key !== $newuser->$key &&
+                !empty($pcfg->{'field_updateremote_'. $key})) {
 
                 // for ldap values that could be in more than one 
                 // ldap key, we will do our best to match 
@@ -822,33 +846,42 @@ function auth_user_update($olduser, $newuser) {
                 $ambiguous = true;
                 $changed   = false;
                 if (!is_array($ldapkeys)) {
-                    $ldapkeys = $array($ldapkeys);
+                    $ldapkeys = array($ldapkeys);
                 }
                 if (count($ldapkeys) < 2) {
                     $ambiguous = false;
                 }
                  
                 foreach ($ldapkeys as $ldapkey) {
+                    $ldapkey   = strtolower($ldapkey);
+                    $ldapvalue = $user_entry[$ldapkey][0];
                     if (!$ambiguous) {
                         // skip update if the values already match
-                        if( !($newuser->$key === $user_entry[0][strtolower($ldapkey)][0]) ){
+                        if( !($newuser->$key === $ldapvalue) ){
                             ldap_modify($ldapconnection, $user_dn, array($ldapkey => $newuser->$key));
                         } else { 
                     error_log("Skip updating field $key for entry $user_dn: it seems to be already same on LDAP. " . 
                                       "  old moodle value: '" . $olduser->$key . 
                                       "' new value '" . $newuser->$key . 
-                                      "' current value in ldap entry " . $user_entry[0][strtolower($ldapkey)][0]);
+                                      "' current value in ldap entry " . $ldapvalue);
                         }
                     } else { // ambiguous
-                        // check the old values match
-                        //error_log("keys $key $ldapkey");
-                        //error_log("olduser " . $olduser->$key);
-                        //error_log("ldapuser " . $user_entry[0][strtolower($ldapkey)][0]);
-                        if (   !empty($olduser->$key) 
-                            && !empty($user_entry[0][strtolower($ldapkey)][0]) 
-                            && $olduser->$key === $user_entry[0][strtolower($ldapkey)][0] ) {
-                            // we found which value to update!
-                            error_log("Matched: ". $olduser->$key . " === " . $user_entry[0][strtolower($ldapkey)][0]);
+                        // value empty before in Moodle (and LDAP) - use 1st ldap candidate field
+                        // no need to guess
+                        if (empty($olduser->$key)) { // value empty before - use 1st ldap candidate
+                            if(ldap_modify($ldapconnection, $user_dn, array($ldapkey => $newuser->$key))){
+                                $changed=true;
+                                last;
+                            } else {
+                                error ('Error updating LDAP record. Error code: ' 
+                                  . ldap_errno($ldapconnection) . '; Error string : '
+                                  . ldap_err2str(ldap_errno($ldapconnection)));                                
+                            }
+                        }
+
+                        // we found which ldap key to update!                            
+                        if ( !empty($ldapvalue) && $olduser->$key === $ldapvalue ) {
+                            // error_log("Matched: ". $olduser->$key . " === " . $ldapvalue);
                             if(ldap_modify($ldapconnection, $user_dn, array($ldapkey => $newuser->$key))){
                                 $changed=true;
                                 last;
@@ -1030,7 +1063,7 @@ function auth_ldap_getdefaults(){
                         'rfc2307' => 'member',
                         'rfc2307bis' => 'member',
                         'samba' => 'member',
-                        'ad' => 'member', //is this right?
+                        'ad' => 'member', 
                         'default' => 'member'
                         );
     $default['ldap_memberattribute_isdn'] = array(
@@ -1038,7 +1071,7 @@ function auth_ldap_getdefaults(){
                         'rfc2307' => '0',
                         'rfc2307bis' => '1',
                         'samba' => '0', //is this right?
-                        'ad' => '0', //is this right?
+                        'ad' => '1',
                         'default' => '0'
                         );
     $default['ldap_expireattr'] = array (
@@ -1213,7 +1246,8 @@ function auth_ldap_isgroupmember ($username='', $groupdns='') {
         }
         //echo "Checking group $group for member $username\n";
         $search = @ldap_read($ldapconnection, $group,  '('.$CFG->ldap_memberattribute.'='.$username.')', array($CFG->ldap_memberattribute));
-        if (ldap_count_entries($ldapconnection, $search)) {$info = auth_ldap_get_entries($ldapconnection, $search);
+
+        if (!empty($search) AND ldap_count_entries($ldapconnection, $search)) {$info = auth_ldap_get_entries($ldapconnection, $search);
         
             if (count($info) > 0 ) {
                 // user is member of group
@@ -1270,7 +1304,8 @@ function auth_ldap_connect($binddn='',$bindpwd=''){
 
         if (!empty($binddn)){
             //bind with search-user
-            $bindresult=@ldap_bind($connresult, $binddn,$bindpwd);
+            //$debuginfo .= 'Using bind user'.$binddn.'and password:'.$bindpwd; 
+            $bindresult=ldap_bind($connresult, $binddn,$bindpwd);
         } else {
             //bind anonymously 
             $bindresult=@ldap_bind($connresult);
@@ -1284,7 +1319,7 @@ function auth_ldap_connect($binddn='',$bindpwd=''){
             return $connresult;
         }
         
-        $debuginfo == "<br/>Server: '$server' <br/> Connection: '$connresult'<br/> Bind result: '$bindresult'</br>";
+        $debuginfo .= "<br/>Server: '$server' <br/> Connection: '$connresult'<br/> Bind result: '$bindresult'</br>";
     }
 
     //If any of servers are alive we have already returned connection
@@ -1414,7 +1449,7 @@ function auth_ldap_get_userlist($filter="*") {
                                      $filter,
                                      array($CFG->ldap_user_attribute));
         }
-
+        
         $users = auth_ldap_get_entries($ldapconnection, $ldap_result);
 
         //add found users to list
@@ -1442,7 +1477,7 @@ function auth_ldap_get_entries($conn, $searchresult){
     $fresult=array();
     $entry = ldap_first_entry($conn, $searchresult);
     do {
-        $attributes = ldap_get_attributes($conn, $entry);
+        $attributes = @ldap_get_attributes($conn, $entry);
         for($j=0; $j<$attributes['count']; $j++) {
             $values = ldap_get_values_len($conn, $entry,$attributes[$j]);
             if (is_array($values)) {
@@ -1453,7 +1488,7 @@ function auth_ldap_get_entries($conn, $searchresult){
         }         
         $i++;               
     }
-    while ($entry = ldap_next_entry($conn, $entry));
+    while ($entry = @ldap_next_entry($conn, $entry));
     //were done
     return ($fresult);
 }

auth/shibboleth/config.html

@@ -1,14 +1,17 @@
 <?php
-// Set default values
-$pluginconfig   = get_config('auth/shibboleth');
+    // Set default values
+    $pluginconfig   = get_config('auth/shibboleth');
 
-if (!isset($config->auth_instructions) or empty($pluginconfig->shib_user_attribute)) {
-    $config->auth_instructions = get_string('auth_shib_instructions', 'auth', $CFG->wwwroot.'/auth/shibboleth/shib-protected.php');
-}
-
-optional_variable($pluginconfig->user_attribute, '');
-optional_variable($pluginconfig->convert_data,   '');
+    if (!isset($config->auth_instructions) or empty($pluginconfig->shib_user_attribute)) {
+        $config->auth_instructions = get_string('auth_shib_instructions', 'auth', $CFG->wwwroot.'/auth/shibboleth/shib-protected.php');
+    }
 
+    if (!isset ($pluginconfig->user_attribute)) {
+        $pluginconfig->user_attribute = '';
+    }
+    if (!isset ($pluginconfig->convert_data)) {
+        $pluginconfig->convert_data = '';
+    }
 ?>
 <tr>
     <td colspan="3" align="left">
@@ -42,7 +45,7 @@ optional_variable($pluginconfig->convert_data,   '');
     <td align="right"><?php  print_string("auth_shib_convert_data", "auth") ?>:</td>
     <td>
     <input name="pluginconfig_convert_data" type="text" size="30" value="<?php echo $pluginconfig->convert_data?>"> 
-    <? 
+    <?php 
           if ($pluginconfig->convert_data && $pluginconfig->convert_data != '' && !is_readable($pluginconfig->convert_data)){
               echo '<br><font color="red">';
               print_string("auth_shib_convert_data_warning", "auth");

auth/shibboleth/lib.php

@@ -26,7 +26,6 @@ function auth_get_userinfo($username) {
 // reads user information from shibboleth attributes and return it in array()
     global $CFG;
 
-    $config = (array)$CFG;
     $pluginconfig   = get_config('auth/shibboleth');
 
     // Check whether we have got all the essential attributes
@@ -47,20 +46,20 @@ function auth_get_userinfo($username) {
     foreach ($attrmap as $key=>$value) {
         $result[$key]=utf8_decode($_SERVER[$value]);
     }
-    
-     // Provide an API to modify the information to fit the Moodle internal
+
+    // Provide an API to modify the information to fit the Moodle internal
     // data representation
     if (   
-          $config["shib_convert_data"] 
-          && $config["shib_convert_data"] != ''
-          && is_readable($config["shib_convert_data"])
+          $pluginconfig->convert_data 
+          && $pluginconfig->convert_data != ''
+          && is_readable($pluginconfig->convert_data)
         ){
         
         // Include a custom file outside the Moodle dir to
         // modify the variable $moodleattributes
-        include($config["shib_convert_data"]);
+        include($pluginconfig->convert_data);
     }
-    
+
     return $result;
 }
 

backup/backup_execute.html

@@ -190,7 +190,7 @@
         echo "</ul></li>";
 
         //User info
-        if ($status && $preferences->backup_users) {
+        if ($status) {
             echo "<li>".get_string("writinguserinfo").'</li>';
             if (!$status = backup_user_info($backup_file,$preferences)) {
                 notify("An error occurred while backing up user info");

backup/backuplib.php

@@ -271,7 +271,7 @@
                     $status = execute_sql("INSERT INTO {$CFG->prefix}backup_files
                                                (backup_code, file_type, path, old_id)
                                            VALUES
-                                               ('$backup_unique_code','user','$dir','$userid')",false);
+                                               ('$backup_unique_code','user','".addslashes($dir)."','$userid')",false);
                 }
                 //Do some output
                 backup_flush(30);
@@ -315,7 +315,7 @@
                     $status = execute_sql("INSERT INTO {$CFG->prefix}backup_files
                                                   (backup_code, file_type, path)
                                            VALUES
-                                              ('$backup_unique_code','course','$dir')",false);
+                                              ('$backup_unique_code','course','".addslashes($dir)."')",false);
                 }
             //Do some output
             backup_flush(30);
@@ -435,8 +435,20 @@
     
     //Return the start tag, the contents and the end tag
     function full_tag($tag,$level=0,$endline=true,$content,$to_utf=true) {
+
+        global $CFG;
+
         //Here we encode absolute links
         $content = backup_encode_absolute_links($content);
+
+        //If enabled, we strip all the control chars from the text but tabs, newlines and returns
+        //because they are forbiden in XML 1.0 specs. The expression below seems to be
+        //UTF-8 safe too because it simply ignores the rest of characters.
+        if (!empty($CFG->backup_strip_controlchars)) {
+            $content = preg_replace("/(?(?=[[:cntrl:]])[^\n\r\t])/is","",$content);
+        }
+
+        //Start to build the tag
         $st = start_tag($tag,$level,$endline);
         $co="";
         if ($to_utf) {

backup/bb/restore_bb.php

@@ -1,9 +1,11 @@
-<?php
+<?php // $Id$
 // This file facilitates the conversion of a Blackboard course export
 // into a Moodle course export.  It assumes an unzipped directory and makes in-place alterations.
-  
+
+defined('MOODLE_INTERNAL') or die('Direct access to this script is forbidden.');
+
 // Ziba Scott <ziba@linuxbox.com> 10-25-04
-require_once('xsl_emulate_xslt.inc');
+require_once($CFG->dirroot.'/backup/bb/xsl_emulate_xslt.inc');
   
 function get_subdirs($directory){
     $opendirectory = opendir( $directory );

backup/lib.php

@@ -81,24 +81,6 @@
         return $status;
     }
 
-    //Function to check if a directory exists
-    //and, optionally, create it
-    function check_dir_exists($dir,$create=false) {
-
-        global $CFG; 
-
-        $status = true;
-        if(!is_dir($dir)) {
-            if (!$create) {
-                $status = false;
-            } else {
-                umask(0000);
-                $status = mkdir ($dir,$CFG->directorypermissions);
-            }
-        }
-        return $status;
-    }
-
     //Function to check and create the needed dir to 
     //save all the backup
     function check_and_create_backup_dir($backup_unique_code) {
@@ -289,7 +271,8 @@
             //$perms=fileperms($from_file);
             //return copy($from_file,$to_file) && chmod($to_file,$perms);
             umask(0000);
-            if (copy($from_file,$to_file) && chmod($to_file,$CFG->directorypermissions)) {
+            if (copy($from_file,$to_file)) {
+                chmod($to_file,$CFG->directorypermissions);
                 if (!empty($log_clam)) {
                     clam_log_upload($to_file,null,true);
                 }

backup/restore.php

@@ -112,7 +112,7 @@
     
     //Adjust some php variables to the execution of this script
     @ini_set("max_execution_time","3000");
-    raise_memory_limit("memory_limit","128M");
+    raise_memory_limit("128M");
 
     //Call the form, depending the step we are
 

backup/restore_check.html

@@ -149,11 +149,19 @@
 
     //Now, select the course if needed
     if (($restore->restoreto == 0 or $restore->restoreto == 1) and ($restore->course_id == 0) and (iscreator())) {
-        if ($courses = get_courses("all","c.fullname","c.id,c.fullname,c.shortname")) {
+        if ($courses = get_courses("all","c.fullname","c.id,c.fullname,c.shortname,c.visible")) {
             print_heading(get_string("choosecourse"));
             print_simple_box_start("center");
             foreach ($courses as $course) {
-                echo "<a href=\"restore.php?course_id=$course->id&launch=check&id=$id&file=$file\">$course->fullname ($course->shortname)</a><br />";
+                if (!isteacheredit($course->id)) {
+                    continue;
+                }
+                if (empty($course->visible)) {
+                    $optdimmed = ' class="dimmed" ';
+                } else {
+                    $optdimmed = '';
+                }
+                echo "<a $optdimmed href=\"restore.php?course_id=$course->id&launch=check&id=$id&file=$file\">$course->fullname ($course->shortname)</a><br />";
             }
             print_simple_box_end();
         } else {
@@ -162,6 +170,12 @@
         }
     //Checks everything and execute restore
     } else if ((($restore->restoreto == 0 or $restore->restoreto == 1) and ($restore->course_id != 0)) or ($restore->restoreto == 2)) {
+        //Final access control check
+        if ($restore->course_id == 0 and !iscreator()) {
+            error("You need to be a creator or admin to restore into new course!");
+        } else if ($restore->course_id != 0 and !isteacheredit($restore->course_id)) {
+            error("You need to be an edit teacher or admin to restore into selected course!");
+        }
         $show_continue_button = true;
         //Check if we've selected any mod's user info and restore->users 
         //is set to none. Change it to course and inform.

backup/restorelib.php

@@ -446,9 +446,10 @@
             }
             $currentfullname = $fullname.$suffixfull;
             $currentshortname = $shortname.$suffixshort;
-            $course = get_record("course","fullname",addslashes($currentfullname));
+            $coursefull  = get_record("course","fullname",addslashes($currentfullname));
+            $courseshort = get_record("course","shortname",addslashes($currentshortname));
             $counter++;
-        } while ($course);
+        } while ($coursefull || $courseshort);
 
         //New name = currentname
         $course_header->course_fullname = $currentfullname;
@@ -1015,6 +1016,7 @@
                 $preferencescount = count_records ('backup_ids', 'backup_code', $restore->backup_unique_code, 'table_name', 'grade_preferences');
                 $letterscount = count_records ('backup_ids', 'backup_code', $restore->backup_unique_code, 'table_name', 'grade_letter');
                 $categoriescount = count_records ('backup_ids', 'backup_code', $restore->backup_unique_code, 'table_name', 'grade_category');
+
                 if ($preferencescount || $letterscount || $categoriescount) {
                     //Start ul
                     echo '<ul>';
@@ -1055,7 +1057,7 @@
                                 foreach ($recs as $rec) {
                                     //Get the full record from backup_ids
                                     $data = backup_getid($restore->backup_unique_code,'grade_preferences',$rec->old_id);
-                                   if ($data) {
+                                    if ($data) {
                                         //Now get completed xmlized object
                                         $info = $data->info;
                                         //traverse_xmlize($info);                            //Debug
@@ -1071,16 +1073,16 @@
                                         if (!$prerec = get_record('grade_preferences','courseid',$dbrec->courseid,'preference',$dbrec->preference)) {
                                             $status = insert_record('grade_preferences',$dbrec);
                                         }
-
-                                        //Do some output
-                                        $counter++;
-                                        if ($counter % 1 == 0) {
-                                            echo ".";
-                                            if ($counter % 20 == 0) {
-                                                echo "<br />";
-                                            }
-                                            backup_flush(300);
+                                    }
+                                    //Increment counters
+                                    $counter++;
+                                    //Do some output
+                                    if ($counter % 1 == 0) {
+                                        echo ".";
+                                        if ($counter % 20 == 0) {
+                                            echo "<br />";
                                         }
+                                        backup_flush(300);
                                     }
                                 }
                             }
@@ -1091,7 +1093,7 @@
                     //If destination course has letters, skip restoring letters
                     $hasletters = get_records('grade_letter', 'courseid', $restore->course_id);
 
-                    if ($preferencescount && $continue && !$hasletters) {
+                    if ($letterscount && $continue && !$hasletters) {
                         echo '<li>'.get_string('letters','grades').'</li>';
                         $counter = 0;
                         while ($counter < $letterscount) {
@@ -1105,7 +1107,7 @@
                                 foreach ($recs as $rec) {
                                     //Get the full record from backup_ids
                                     $data = backup_getid($restore->backup_unique_code,'grade_letter',$rec->old_id);
-                                   if ($data) {
+                                    if ($data) {
                                         //Now get completed xmlized object
                                         $info = $data->info;
                                         //traverse_xmlize($info);                            //Debug
@@ -1119,16 +1121,16 @@
 
                                         //Structure is equal to db, insert record
                                         $status = insert_record('grade_letter',$dbrec);
-
-                                        //Do some output
-                                        $counter++;
-                                        if ($counter % 1 == 0) {
-                                            echo ".";
-                                            if ($counter % 20 == 0) {
-                                                echo "<br />";
-                                            }
-                                            backup_flush(300);
+                                    }
+                                    //Increment counters
+                                    $counter++;
+                                    //Do some output
+                                    if ($counter % 1 == 0) {
+                                        echo ".";
+                                        if ($counter % 20 == 0) {
+                                            echo "<br />";
                                         }
+                                        backup_flush(300);
                                     }
                                 }
                             }
@@ -1145,13 +1147,13 @@
                             $recs = get_records_select("backup_ids","table_name = 'grade_category' AND backup_code = '$restore->backup_unique_code'",
                                                        "old_id",
                                                        "old_id, old_id",
-                                                       $counter,
+                                                       $countercat,
                                                        $recordset_size);
                             if ($recs) {
                                 foreach ($recs as $rec) {
                                     //Get the full record from backup_ids
                                     $data = backup_getid($restore->backup_unique_code,'grade_category',$rec->old_id);
-                                   if ($data) {
+                                    if ($data) {
                                         //Now get completed xmlized object
                                         $info = $data->info;
                                         //traverse_xmlize($info);                            //Debug
@@ -1252,16 +1254,18 @@
                                                 $order++;
                                             }
                                         }
-                                        //Do some output
-                                        $countercat++;
-                                        if ($countercat % 1 == 0) {
-                                            echo ".";
-                                            if ($countercat % 20 == 0) {
-                                                echo "<br />";
-                                            }
-                                            backup_flush(300);
-                                        }
                                     }
+                                    //Increment counters
+                                    $countercat++;
+                                    //Do some output
+                                    if ($countercat % 1 == 0) {
+                                        echo ".";
+                                        if ($countercat % 20 == 0) {
+                                            echo "<br />";
+                                        }
+                                        backup_flush(300);
+                                    }
+
                                 }
                             }
                         }
@@ -2524,6 +2528,10 @@
             $log->info = $log->course;
             $toinsert = true;
             break;
+        case "guest":
+            $log->url = "view.php?id=".$log->course;
+            $toinsert = true;
+            break;
         case "user report":
             //recode the info field (it's the user id)
             $user = backup_getid($restore->backup_unique_code,"user",$log->info);
@@ -2531,7 +2539,7 @@
                 $log->info = $user->new_id;
                 //Now, extract the mode from the url field
                 $mode = substr(strrchr($log->url,"="),1);
-                $log->url = "user.php?id=".$log->course."&amp;user=".$log->info."&amp;mode=".$mode;
+                $log->url = "user.php?id=".$log->course."&user=".$log->info."&mode=".$mode;
                 $toinsert = true;
             }
             break;
@@ -2657,7 +2665,7 @@
             $user = backup_getid($restore->backup_unique_code,"user",$log->info);
             if ($user) {
                 $log->info = $user->new_id;
-                $log->url = "view.php?id=".$log->info."&amp;course=".$log->course;
+                $log->url = "view.php?id=".$log->info."&course=".$log->course;
                 $toinsert = true;
             }
             break;
@@ -2666,7 +2674,25 @@
             $user = backup_getid($restore->backup_unique_code,"user",$log->info);
             if ($user) {
                 $log->info = $user->new_id;
-                $log->url = "view.php?id=".$log->info."&amp;course=".$log->course;
+                $log->url = "view.php?id=".$log->info."&course=".$log->course;
+                $toinsert = true;
+            }
+            break;
+        case "login":
+            //recode the info field (it's the user id)
+            $user = backup_getid($restore->backup_unique_code,"user",$log->info);
+            if ($user) {
+                $log->info = $user->new_id;
+                $log->url = "view.php?id=".$log->info."&course=".$log->course;
+                $toinsert = true;
+            }
+            break;
+        case "logout":
+            //recode the info field (it's the user id)
+            $user = backup_getid($restore->backup_unique_code,"user",$log->info);
+            if ($user) {
+                $log->info = $user->new_id;
+                $log->url = "view.php?id=".$log->info."&course=".$log->course;
                 $toinsert = true;
             }
             break;
@@ -2683,7 +2709,7 @@
             $user = backup_getid($restore->backup_unique_code,"user",$userid);
             if ($user) {
                 $log->info = "";
-                $log->url = "view.php?id=".$user->new_id."&amp;course=".$log->course;
+                $log->url = "view.php?id=".$user->new_id."&course=".$log->course;
                 $toinsert = true;
             }
             break;
@@ -4564,6 +4590,7 @@
         global $SESSION;
         $restore->backup_unique_code=$backup_unique_code;
         $restore->users = 2; // yuk
+        $restore->course_files = $SESSION->restore->restore_course_files;
         if ($allmods = get_records("modules")) {
             foreach ($allmods as $mod) {
                 $modname = $mod->name;

backup/version.php

@@ -7,4 +7,4 @@
 
 $backup_version = 2005070500;   // The current version is a date (YYYYMMDDXX)
 
-$backup_release = "1.5.1";  // User-friendly version number
+$backup_release = "1.5.3";  // User-friendly version number

blocks/activity_modules/block_activity_modules.php

@@ -3,14 +3,23 @@
 class block_activity_modules extends block_list {
     function init() {
         $this->title = get_string('activities');
-        $this->version = 2004041000;
+        $this->version = 2004041001;
     }
 
     function get_content() {
         global $USER, $CFG;
 
-        // This is really NOT pretty, but let's do it simple for now...
-        global $modnamesused, $modnamesplural;
+        // TODO: FIX: HACK: (any other tags I should add? :P)
+        // Hacker's improvised caching scheme: avoid fetching the mod
+        // data from db if the course format has already fetched them
+        if(!isset($GLOBALS['modnamesplural']) || !isset($GLOBALS['modnamesused'])) {
+            require_once($CFG->dirroot.'/course/lib.php');
+            get_all_mods($this->instance->pageid, $mods, $modnames, $modnamesplural, $modnamesused);
+        }
+        else {
+            $modnamesplural = $GLOBALS['modnamesplural'];
+            $modnamesused   = $GLOBALS['modnamesused'];
+        }
 
         if($this->content !== NULL) {
             return $this->content;

blocks/admin/block_admin.php

@@ -121,7 +121,7 @@ class block_admin extends block_list {
                     $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/users.gif" height="16" width="16" alt="" />';
                 } else {
                     $this->content->items[]='<a href="importstudents.php?id='.$this->instance->pageid.'">'.$course->students.'</a>';
-                    $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/users.gif" height="16" width="16" alt="">';
+                    $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/users.gif" height="16" width="16" alt="" />';
                 }
                 if ($course->groupmode || !$course->groupmodeforce) {
                     $strgroups = get_string('groups');
@@ -182,14 +182,14 @@ class block_admin extends block_list {
             }
             $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/user.gif" height="16" width="16" alt="" />';
 
-            if (is_internal_auth()) {
+            if (is_internal_auth() && !is_restricted_user($USER->username)) {
                 $this->content->items[]='<a href="'.$CFG->wwwroot.'/login/change_password.php?id='.$this->instance->pageid.'">'.get_string('changepassword').'</a>';
                 $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/user.gif" height="16" width="16" alt="" />';
-            } else if ($CFG->changepassword) {
+            } else if ($CFG->changepassword && !is_restricted_user($USER->username)) {
                 $this->content->items[]='<a href="'.$CFG->changepassword.'">'.get_string('changepassword').'</a>';
                 $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/user.gif" height="16" width="16" alt="" />';
             }
-            if ($CFG->allowunenroll) {
+            if ($CFG->allowunenroll && !$course->metacourse) {
                 $this->content->items[]='<a href="unenrol.php?id='.$this->instance->pageid.'">'.get_string('unenrolme', '', $course->shortname).'</a>';
                 $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/user.gif" height="16" width="16" alt="" />';
             }

blocks/course_list/block_course_list.php

@@ -53,7 +53,7 @@ class block_course_list extends block_list {
 
         $categories = get_categories("0");  // Parent = 0   ie top-level categories only
         if ($categories) {   //Check we have categories
-            if (count($categories) > 1) {     // Just print top level category links
+            if (count($categories) > 1 || (count($categories) == 1 && count_records('course') > 200)) {     // Just print top level category links
                 foreach ($categories as $category) {
                     $linkcss = $category->visible ? "" : " class=\"dimmed\" ";
                     $this->content->items[]="<a $linkcss href=\"$CFG->wwwroot/course/category.php?id=$category->id\">$category->name</a>";

blocks/db/mysql.php

@@ -58,7 +58,7 @@ global $CFG;
         if(!empty($records)) {
             foreach($records as $block) {
                 $block->multiple = 0;
-                insert_record('block', $block);
+                insert_record('block', $block, false);
             }
         }
 
@@ -82,7 +82,7 @@ global $CFG;
             return false;
         }
 
-        $records = get_records('course');
+        $records = get_records('course', '','','', 'id, shortname, blockinfo');
         if(!empty($records)) {
             foreach($records as $thiscourse) {
                 // The @ suppresses a notice emitted if there is no : in the string
@@ -98,7 +98,7 @@ global $CFG;
                         $instance->weight     = $weight;
                         $instance->visible    = ($blk > 0) ? 1 : 0;
                         $instance->configdata = '';
-                        insert_record('block_instance', $instance);
+                        insert_record('block_instance', $instance, false);
                     }
                 }
                 if(!empty($right)) {
@@ -112,7 +112,7 @@ global $CFG;
                         $instance->weight     = $weight;
                         $instance->visible    = ($blk > 0) ? 1 : 0;
                         $instance->configdata = '';
-                        insert_record('block_instance', $instance);
+                        insert_record('block_instance', $instance, false);
                     }
                 }
             }
@@ -143,6 +143,11 @@ global $CFG;
         }
     }
 
+    if ($oldversion < 2005022401) {
+        // add an index where we really need it
+        modify_database('','ALTER TABLE prefix_block_instance ADD INDEX pagetype (pagetype);');
+    }
+
     //Finally, return result
     return $result;
 }

blocks/db/mysql.sql

@@ -24,6 +24,7 @@ CREATE TABLE `prefix_block_instance` (
   `visible` tinyint(1) not null default '0',
   `configdata` text not null default '',
   PRIMARY KEY(`id`),
-  INDEX pageid(`pageid`)
+  INDEX pageid(`pageid`),
+  INDEX pagetype(`pagetype`)
 ) TYPE=MyISAM;
 # --------------------------------------------------------

blocks/db/postgres7.php

@@ -59,9 +59,9 @@ global $CFG;
         if(!empty($records)) {
             foreach($records as $block) {
                 $block->multiple = 0;
-                unset($block->id);
-                insert_record('block', $block);
+                insert_record('block', $block, false);
             }
+            execute_sql("SELECT setval('{$CFG->prefix}block_id_seq', (SELECT MAX(id) FROM {$CFG->prefix}block), true)");
         }
 
         execute_sql("DROP TABLE {$CFG->prefix}blocks");
@@ -81,7 +81,7 @@ global $CFG;
             return false;
         }
         
-        $records = get_records('course');
+        $records = get_records('course', '','','', 'id, shortname, blockinfo');
         if(!empty($records)) {
             foreach($records as $thiscourse) {
                 // The @ suppresses a notice emitted if there is no : in the string
@@ -97,7 +97,7 @@ global $CFG;
                         $instance->weight     = $weight;
                         $instance->visible    = ($blk > 0) ? 1 : 0;
                         $instance->configdata = '';
-                        insert_record('block_instance', $instance);
+                        insert_record('block_instance', $instance, false);
                     }
                 }
                 if(!empty($right)) {
@@ -111,7 +111,7 @@ global $CFG;
                         $instance->weight     = $weight;
                         $instance->visible    = ($blk > 0) ? 1 : 0;
                         $instance->configdata = '';
-                        insert_record('block_instance', $instance);
+                        insert_record('block_instance', $instance, false);
                     }
                 }
             }
@@ -138,6 +138,19 @@ global $CFG;
         }
     }
 
+    if ($oldversion < 2005022401 && $result) { // Mass cleanup of bad upgrade scripts
+        execute_sql("CREATE INDEX {$CFG->prefix}block_instance_pageid_idx ON {$CFG->prefix}block_instance (pageid)",false); // this one should be quiet...
+        modify_database('','ALTER TABLE prefix_block_instance ALTER pagetype SET DEFAULT \'\'');
+        modify_database('','ALTER TABLE prefix_block_instance ALTER position SET DEFAULT \'\'');
+        modify_database('','ALTER TABLE prefix_block_instance ALTER pagetype SET NOT NULL');
+        modify_database('','ALTER TABLE prefix_block_instance ALTER position SET NOT NULL');
+    }
+
+    if ($oldversion < 2005022401) {
+        // add an index where we really need it
+        modify_database('','CREATE INDEX prefix_block_instance_pagetype_idx ON prefix_block_instance (pagetype);');
+    }
+
     //Finally, return result
     return $result;
 }

blocks/db/postgres7.sql

@@ -10,7 +10,7 @@ CREATE TABLE prefix_block (
   cron INT8  NOT NULL default '0',
   lastcron INT8  NOT NULL default '0',
   visible int NOT NULL default '1',
-  multiple int NOT NULL default '1'
+  multiple int NOT NULL default '0'
 ) ;
 
 CREATE TABLE prefix_block_instance (
@@ -23,5 +23,8 @@ CREATE TABLE prefix_block_instance (
   visible int not null default '0',
   configdata text not null default ''
 ) ;
+
+CREATE INDEX prefix_block_instance_pageid_idx ON prefix_block_instance (pageid);
+CREATE INDEX prefix_block_instance_pagetype_idx ON prefix_block_instance (pagetype);
       
 # --------------------------------------------------------

blocks/glossary_random/block_glossary_random.php

@@ -118,9 +118,12 @@ class block_glossary_random extends block_base {
 
         // select glossaries to put in dropdown box ...
         $glossaries = get_records_select_menu('glossary', 'course='.$this->course->id,'name','id,name');
+
         //format menu texts to avoid html and to filter multilang values
-        foreach($glossaries as $key => $value) {
-            $glossaries[$key] = strip_tags(format_string($value,true));
+        if(!empty($glossaries)) {
+            foreach($glossaries as $key => $value) {
+                $glossaries[$key] = strip_tags(format_string($value,true));
+            }
         }
 
         // and select quotetypes to put in dropdown box

blocks/login/block_login.php

@@ -27,16 +27,20 @@ class block_login extends block_base {
             $wwwroot = str_replace("http://", "https://", $CFG->wwwroot);
         }
 
-        if (is_internal_auth()) {
+        if ($CFG->auth == 'email') {
             $signup = $wwwroot . '/login/signup.php';
             $forgot = $wwwroot . '/login/forgot_password.php';
         } else {
-            if (!empty($CFG->changepassword)) {
-                $forgot = $CFG->changepassword;
-            } else {
-                $forgot = '';
+            if (!empty($CFG->{'auth_'.$CFG->auth.'_stdchangepassword'})
+                || $CFG->changepassword 
+                || is_internal_auth() ) {
+                if (is_internal_auth() || !empty($CFG->{'auth_'.$CFG->auth.'_stdchangepassword'})) {
+                    $forgot =  $wwwroot . '/login/forgot_password.php';
+                }
+                else {
+                    $forgot = $CFG->changepassword;
+                }
             }
-            $signup = $wwwroot . '/login/index.php';  // to see instructions!
         }
 
         $username = get_moodle_cookie() === 'nobody' ? '' : get_moodle_cookie();

blocks/online_users/block_online_users.php

@@ -61,7 +61,8 @@ class block_online_users extends block_base {
                                           {$CFG->prefix}user_students s
                                           $groupmembers
                                      WHERE u.id = s.userid $courseselect $groupselect $timeselect 
-                                  ORDER BY s.timeaccess DESC")) {
+                                  ORDER BY s.timeaccess DESC ".sql_paging_limit(0,20))) {
+
             foreach ($students as $student) {
                 $student->fullname = fullname($student);
                 $users[$student->id] = $student;
@@ -72,7 +73,7 @@ class block_online_users extends block_base {
             if ($siteusers = get_records_sql("SELECT u.id, u.username, u.firstname, u.lastname, u.picture, u.lastaccess
                                      FROM {$CFG->prefix}user u
                                      WHERE u.lastaccess > $timefrom AND u.username <> 'guest'
-                                  ORDER BY u.lastaccess DESC")) {
+                                  ORDER BY u.lastaccess DESC ".sql_paging_limit(0,20))) {
                 foreach ($siteusers as $siteuser) {
                     $siteuser->fullname = fullname($siteuser);
                     $siteuser->timeaccess = $siteuser->lastaccess;
@@ -81,14 +82,21 @@ class block_online_users extends block_base {
             }
         }
 
-        if ($teachers = get_records_sql("SELECT u.id, u.username, u.firstname, u.lastname, u.picture, u.lastaccess, s.timeaccess
+        $findteacherssql = "SELECT u.id, u.username, u.firstname, u.lastname, u.picture, u.lastaccess, s.timeaccess
                                      FROM {$CFG->prefix}user u,
                                           {$CFG->prefix}user_teachers s
                                           $groupmembers
-                                     WHERE u.id = s.userid $courseselect $groupselect $timeselect
-                                  ORDER BY s.timeaccess DESC")) {
+                                     WHERE u.id = s.userid $courseselect $groupselect $timeselect ";
+
+        if (!isteacher($course->id)) {
+            // Hide hidden teachers from students.
+            $findteacherssql .= 'AND s.authority > 0 ';
+        }
+        $findteacherssql .= 'ORDER BY s.timeaccess DESC';
+
+        if ($teachers = get_records_sql($findteacherssql)) {
             foreach ($teachers as $teacher) {
-                $teacher->fullname = '<b>'.fullname($teacher).'</b>';
+                $teacher->fullname = '<strong>'.fullname($teacher).'</strong>';
                 $users[$teacher->id] = $teacher;
             }
         }

blocks/pagedemo.php

@@ -1,5 +1,7 @@
 <?php  // $Id$
 
+    die; //must be fixed before enabling again, see SC#971
+
     // All of this is standard Moodle fixtures
 
     require_once('../config.php');

blocks/quiz_results/block_quiz_results.php

@@ -20,15 +20,15 @@ class block_quiz_results extends block_base {
         if ($this->content !== NULL) {
             return $this->content;
         }
-        if (empty($this->instance)) {
-            $this->content = '';
-            return $this->content;
-        }
 
         $this->content = new stdClass;
         $this->content->text = '';
         $this->content->footer = '';
 
+        if (empty($this->instance)) {
+            return $this->content;
+        }
+
         if($this->instance->pagetype == 'course-view') {
             // We need to see if we are monitoring a quiz 
             $quizid   = empty($this->config->quizid) ? 0 : $this->config->quizid;

blocks/rss_client/block_rss_client.php

@@ -1,20 +1,35 @@
 <?php //$Id$
 
-// Developer's debug assistant - if true then the display string will not cache, only
-// the magpie object's built in caching will be used
-define('BLOCK_RSS_SECONDARY_CACHE_ENABLED', true);
+/*******************************************************************
+* This file contains one class which defines a block for display on
+* any Moodle page. This block can be configured to display the contents
+* of a remote RSS news feed in your web site.
+*
+* @author Daryl Hawes
+* @version  $Id$
+* @license http://www.gnu.org/copyleft/gpl.html GNU Public License
+* @package base
+******************************************************************/
 
-class block_rss_client extends block_base {
+/**
+ * This class is for a block which defines a block for display on
+ * any Moodle page. 
+ */
+ class block_rss_client extends block_base {
 
     function init() {
         $this->title = get_string('feedstitle', 'block_rss_client');
-        $this->version = 2004112000;
+        $this->version = 2004112001;
     }
 
     function preferred_width() {
         return 210;
     }
 
+    function applicable_formats() {
+        return array('all' => true);
+    }
+
     function specialization() {
         // After the block has been loaded we customize the block's title display
         if (!empty($this->config) && !empty($this->config->title)) {
@@ -25,7 +40,7 @@ class block_rss_client extends block_base {
             $this->title = get_string('remotenewsfeed', 'block_rss_client');
         }
     }
-    
+
     function get_content() {
         global $CFG, $editing;
 
@@ -36,11 +51,11 @@ class block_rss_client extends block_base {
         }
 
         $this->content = new stdClass;
+        $this->content->text   = '';
         $this->content->footer = '';
-        
+
         if (empty($this->instance)) {
             // We're being asked for content without an associated instance
-            $this->content->text = '';
             return $this->content;
         }
 
@@ -90,11 +105,11 @@ class block_rss_client extends block_base {
             $page = page_create_object($this->instance->pagetype, $this->instance->pageid);
             if (isset($this->config)) {
                 // this instance is configured - show Add/Edit feeds link
-                $script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'managefeeds'));
+                $script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'managefeeds', 'id' => $this->courseid));
                 $output .= '<div align="center"><a title="'. get_string('feedsaddedit', 'block_rss_client') .'" href="'. $script .'">'. get_string('feedsaddedit', 'block_rss_client') .'</a></div>';
             } else {
                 // this instance has not been configured yet - show configure link
-                $script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'configblock'));
+                $script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'configblock', 'id' => $this->courseid));
                 $output .= '<div align="center"><a title="'. get_string('feedsconfigurenewinstance', 'block_rss_client') .'" href="'. $script.'">'. get_string('feedsconfigurenewinstance', 'block_rss_client') .'</a></div>';
             }
         }
@@ -113,11 +128,11 @@ class block_rss_client extends block_base {
                 $count ++;
             }
         }
-        
+
         $this->content->text = $output;
         return $this->content;
     }
-    
+
     function instance_allow_multiple() {
         return true;
     }
@@ -129,7 +144,7 @@ class block_rss_client extends block_base {
     function instance_allow_config() {
         return true;
     }
-    
+
     /**
      * @param int $rssid The feed to be displayed
      * @param bool $display_description Should the description information from the feed be displayed or simply the title?
@@ -146,20 +161,9 @@ class block_rss_client extends block_base {
         if (!defined('MAGPIE_OUTPUT_ENCODING')) {
             define('MAGPIE_OUTPUT_ENCODING', get_string('thischarset'));  // see bug 3107
         }
-        
-        // Check if there is a cached string which has not timed out.
-        if (BLOCK_RSS_SECONDARY_CACHE_ENABLED &&
-                isset($this->config->{'rssid'. $rssid}) && 
-                    isset($this->config->{'rssid'. $rssid .'timestamp'}) && 
-                        $this->config->{'rssid'. $rssid .'timestamp'} >= $now - $CFG->block_rss_timeout * 60) {
-            // If the cached string is not too stale 
-            // use it rather than going any further
-            return stripslashes_safe($this->config->{'rssid'. $rssid});
-        }
 
         $rss_record = get_record('block_rss_client', 'id', $rssid);
         if (isset($rss_record) && isset($rss_record->id)) {
-                    
             // By capturing the output from fetch_rss this way
             // error messages do not display and clutter up the moodle interface
             // however, we do lose out on seeing helpful messages like "cache hit", etc.
@@ -167,7 +171,7 @@ class block_rss_client extends block_base {
             $rss = fetch_rss($rss_record->url);
             $rsserror = ob_get_contents();
             ob_end_clean();
-            
+
             if ($rss === false) {
                 if ($CFG->debug && !empty($rsserror)) {
                     // There was a failure in loading the rss feed, print link to full error text
@@ -180,9 +184,9 @@ class block_rss_client extends block_base {
             }
 
             if (empty($rss_record->preferredtitle)) {
-                $feedtitle = stripslashes_safe(rss_unhtmlentities($rss->channel['title']));
+                $feedtitle = $this->format_title(stripslashes_safe(rss_unhtmlentities($rss->channel['title'])));
             } else {
-                $feedtitle = stripslashes_safe($rss_record->preferredtitle);
+                $feedtitle = $this->format_title(stripslashes_safe($rss_record->preferredtitle));
             }
 //            print_object($rss);
             if (isset($this->config) && 
@@ -198,6 +202,12 @@ class block_rss_client extends block_base {
 
             $formatoptions->para = false;
 
+            // first we must verify that the rss feed is loaded
+            // by checking $rss and $rss->items exist before using them
+            if (empty($rss) || empty($rss->items)) {
+                return '';
+            }
+
             foreach ($rss->items as $item) {
                 $item['title'] = stripslashes_safe(rss_unhtmlentities($item['title']));
                 $item['description'] = stripslashes_safe(rss_unhtmlentities($item['description']));
@@ -207,7 +217,7 @@ class block_rss_client extends block_base {
                 } else {
                     $item['title'] = break_up_long_words($item['title'], 30);
                 }
-        
+
                 if ($item['link'] == '') {
                     $item['link'] = $item['guid'];
                 }
@@ -216,7 +226,6 @@ class block_rss_client extends block_base {
 
                 $returnstring .= '<div class="link"><a href="'. $item['link'] .'" target="_blank">'. $item['title'] . '</a></div>' ."\n";
 
-                
                 if ($display_description && !empty($item['description'])) {
                     $item['description'] = break_up_long_words($item['description'], 30);
                     $returnstring .= '<div class="description">'.
@@ -243,12 +252,17 @@ class block_rss_client extends block_base {
                 $this->title = $feedtitle;
             }
         }
-        
-        // store config setting for this rssid so we do not need to read from file each time
-        $this->config->{'rssid'. $rssid} = addslashes($returnstring);
-        $this->config->{'rssid'. $rssid .'timestamp'} = $now; 
-        $this->instance_config_save($this->config);
         return $returnstring;
     }
+
+     // just strips the title down and adds ... for excessively long titles.
+     function format_title($title,$max=64) {
+         if (strlen($title) <= $max) {
+             return $title;
+         }
+         else {
+             return substr($title,0,$max-3).'...';
+         }
+     }
 }
 ?>

blocks/rss_client/block_rss_client_action.php

@@ -1,227 +1,248 @@
 <?php //$Id$
 
-    require_once('../../config.php');
-    require_once($CFG->libdir .'/rsslib.php');
-    require_once(MAGPIE_DIR .'rss_fetch.inc');
+/*******************************************************************
+* This file contains no classes. It will display a list of existing feeds
+* defined for the site and allow add/edit/delete of site feeds.
+*
+* @author Daryl Hawes
+* @version  $Id$
+* @license http://www.gnu.org/copyleft/gpl.html GNU Public License
+* @package base
+******************************************************************/
 
-    require_login();
-    global $USER;
-    
-    //ensure that the logged in user is not using the guest account
-    if (isset($_SERVER['HTTP_REFERER'])) {
-        $referrer = $_SERVER['HTTP_REFERER'];
+require_once('../../config.php');
+require_once($CFG->libdir .'/rsslib.php');
+require_once(MAGPIE_DIR .'rss_fetch.inc');
+
+require_login();
+global $USER;
+
+//ensure that the logged in user is not using the guest account
+if (isset($_SERVER['HTTP_REFERER'])) {
+    $referrer = $_SERVER['HTTP_REFERER'];
+} else {
+    $referrer = $CFG->wwwroot;
+}
+if (isguest()) {
+    error(get_string('noguestpost', 'forum'), $referrer);
+}
+
+$act            = optional_param('act', NULL, PARAM_ALPHA);
+$rssid          = optional_param('rssid', NULL, PARAM_INT);
+$id             = optional_param('id', SITEID, PARAM_INT);
+$url            = optional_param('url', NULL, PARAM_URL);
+$preferredtitle = optional_param('preferredtitle', '', PARAM_ALPHA);
+
+if (!defined('MAGPIE_OUTPUT_ENCODING')) {
+    define('MAGPIE_OUTPUT_ENCODING', get_string('thischarset'));  // see bug 3107
+}
+
+if (!empty($id)) {
+    // we get the complete $course object here because print_header assumes this is 
+    // a complete object (needed for proper course theme settings)
+    $course = get_record('course', 'id', $id);
+}
+
+$straddedit = get_string('feedsaddedit', 'block_rss_client');
+if ( isadmin() ) {
+    $navigation = '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/index.php">'.get_string('administration').'</a> -> '.
+        '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/configure.php">'.get_string('configuration').'</a> -> '.$straddedit;
+} else if (!empty($course)) {
+    $navigation = '<a href="'.$CFG->wwwroot.'/course/view.php?id='.$id.'">'.$course->shortname.'</a> -> '.$straddedit;
+} else {
+    $navigation = $straddedit;
+}
+
+print_header($straddedit, $straddedit, $navigation);
+
+//check to make sure that the user is allowed to post new feeds
+$submitters = $CFG->block_rss_client_submitters;
+$isteacher  = empty($course) ? false : isteacher($id);
+
+if ( !isset($act) ) {
+    rss_display_feeds($id);
+    rss_print_form($act, $url, $rssid, $preferredtitle, $id);
+    print_footer();
+    die();
+}
+
+if ( isset($rssid) ) {
+    $rss_record = get_record('block_rss_client', 'id', $rssid);
+}
+
+//if the user is an admin or course teacher then allow the user to
+//assign categories to other uses than personal
+if (isset($rss_record) && !( isadmin() || $submitters == SUBMITTERS_ALL_ACCOUNT_HOLDERS || 
+        ($submitters == SUBMITTERS_ADMIN_AND_TEACHER && $isteacher) || 
+            ( ($act == 'rssedit' || $act == 'delfeed' || $act == 'updfeed') && $USER->id == $rss_record->userid)  ) ) {
+        error(get_string('noguestpost', 'forum').' You are not allowed to make modifications to this RSS feed at this time.', $referrer);
+}
+
+if ($act == 'updfeed') {
+    if (empty($url)) {
+        error( 'url not defined for rss feed' );
+    }
+
+    // By capturing the output from fetch_rss this way
+    // error messages do not display and clutter up the moodle interface
+    // however, we do lose out on seeing helpful messages like "cache hit", etc.
+    $message = '';
+    ob_start();
+    $rss = fetch_rss($url);
+    if ($CFG->debug) {
+        $message .= ob_get_contents();
+    }
+    ob_end_clean();
+
+    $dataobject->id = $rssid;
+    if ($rss === false) {
+        $dataobject->description = '';
+        $dataobject->title = '';
+        $dataobject->preferredtitle = '';
     } else {
-        $referrer = $CFG->wwwroot;
+        $dataobject->description = addslashes(rss_unhtmlentities($rss->channel['description']));
+        $dataobject->title = addslashes(rss_unhtmlentities($rss->channel['title']));
+        $dataobject->preferredtitle = addslashes($preferredtitle);
     }
-    if (isguest()) {
-        error(get_string('noguestpost', 'forum'), $referrer);
+    $dataobject->url = addslashes($url);
+
+    if (!update_record('block_rss_client', $dataobject)) {
+        error('There was an error trying to update rss feed with id:'. $rssid);
     }
 
-    optional_variable($act, 'none');
-    optional_variable($rssid, 'none');
-    $courseid = optional_param('courseid', 0, PARAM_INT);
-    optional_variable($url);
-    optional_variable($preferredtitle, '');
-    optional_variable($item);
+    $message .= '<br />'. get_string('feedupdated', 'block_rss_client');
+    redirect($referrer, $message);
 
-    if (!defined('MAGPIE_OUTPUT_ENCODING')) {
-        define('MAGPIE_OUTPUT_ENCODING', get_string('thischarset'));  // see bug 3107
+} else if ($act == 'addfeed' ) {
+
+    if (empty($url)) {
+        error('url not defined for rss feed');
+    }
+    $dataobject->userid = $USER->id;
+    $dataobject->description = '';
+    $dataobject->title = '';
+
+    // attempting to replace feed and rss url types with http
+    // it appears that the rss feed validator will validate these url types but magpie will not load them
+    $url = str_replace ("feed://", "http://", "$url");
+    $url = str_replace ("FEED://", "http://", "$url");
+    $url = str_replace ("rss://", "http://", "$url");
+    $url = str_replace ("RSS://", "http://", "$url");
+
+    $dataobject->url = addslashes($url);
+    $dataobject->preferredtitle = addslashes($preferredtitle);
+
+    $rssid = insert_record('block_rss_client', $dataobject);
+    if (!$rssid) {
+        error('There was an error trying to add a new rss feed:'. $url);
     }
 
-    if (!empty($courseid)) {
-        $course = get_record('course', 'id', $courseid, '', '', '', '', 'shortname');
+    // By capturing the output from fetch_rss this way
+    // error messages do not display and clutter up the moodle interface
+    // however, we do lose out on seeing helpful messages like "cache hit", etc.
+    $message = '';
+    ob_start();
+    $rss = fetch_rss($url);
+    if ($CFG->debug) {
+        $message .= ob_get_contents();
     }
+    ob_end_clean();
 
-    $straddedit = get_string('feedsaddedit', 'block_rss_client');
-    if ( isadmin() ) {
-        $stradmin = get_string('administration');
-        $strconfiguration = get_string('configuration');
-        $navigation = "<a href=\"$CFG->wwwroot/$CFG->admin/index.php\">$stradmin</a> -> ".
-        "<a href=\"$CFG->wwwroot/$CFG->admin/configure.php\">$strconfiguration</a> -> $straddedit";
-    } else if (!empty($course)) {
-        $navigation = "<a href=\"$CFG->wwwroot/course/view.php?id=$courseid\">$course->shortname</a> -> $straddedit";
+    if ($rss === false) {
+        $message .= '<br /><br />There was an error loading this rss feed. You may want to verify the url you have specified before using it.'; //Daryl Hawes note: localize this line
     } else {
-        $navigation = $straddedit;
-    }
-    
-    print_header(get_string('feedsaddedit', 'block_rss_client'), 
-                 get_string('feedsaddedit', 'block_rss_client'), 
-                 $navigation );
 
-    //check to make sure that the user is allowed to post new feeds
-    $submitters = $CFG->block_rss_client_submitters;
-    $isteacher = false;
-    if (!empty($course)) {
-        $isteacher = isteacher($course->id);
-    }
-
-    //if the user is an admin or course teacher then allow the user to
-    //assign categories to other uses than personal
-    if (!( isadmin() || $submitters == SUBMITTERS_ALL_ACCOUNT_HOLDERS || ($submitters == SUBMITTERS_ADMIN_AND_TEACHER && $isteacher) ) ) {
-        error(get_string('noguestpost', 'forum'), $referrer);
-    }
-
-    if ($act == 'none') {
-        rss_display_feeds();
-        rss_get_form($act, $url, $rssid, $preferredtitle);
-
-    } else if ($act == 'updfeed') {
-        require_variable($url);
-        
-        // By capturing the output from fetch_rss this way
-        // error messages do not display and clutter up the moodle interface
-        // however, we do lose out on seeing helpful messages like "cache hit", etc.
-        ob_start();
-        $rss = fetch_rss($url);
-        $rsserror = ob_get_contents();
-        ob_end_clean();
-        
         $dataobject->id = $rssid;
-        if ($rss === false) {
-            $dataobject->description = '';
-            $dataobject->title = '';
-            $dataobject->preferredtitle = '';
-        } else {
+        if (!empty($rss->channel['description'])) {
             $dataobject->description = addslashes(rss_unhtmlentities($rss->channel['description']));
-            $dataobject->title = addslashes(rss_unhtmlentities($rss->channel['title']));
-            $dataobject->preferredtitle = addslashes($preferredtitle);
         }
-        $dataobject->url = addslashes($url);
-
+        if (!empty($rss->channel['title'])) {
+            $dataobject->title = addslashes(rss_unhtmlentities($rss->channel['title']));
+        } 
         if (!update_record('block_rss_client', $dataobject)) {
             error('There was an error trying to update rss feed with id:'. $rssid);
         }
-
-        redirect($referrer, get_string('feedupdated', 'block_rss_client'));
-/*        rss_display_feeds();
-        rss_get_form($act, $dataobject->url, $rssid, $dataobject->preferredtitle);
+        $message .= '<br />'. get_string('feedadded', 'block_rss_client');
+    }
+    redirect($referrer, $message);
+/*
+        rss_display_feeds($id);
+        rss_print_form($act, $dataobject->url, $dataobject->id, $dataobject->preferredtitle, $id);
 */
-    } else if ($act == 'addfeed' ) {
+} else if ( isset($rss_record) && $act == 'rssedit' ) {
 
-        require_variable($url);            
-        $dataobject->userid = $USER->id;
-        $dataobject->description = '';
-        $dataobject->title = '';
-        $dataobject->url = addslashes($url);
-        $dataobject->preferredtitle = addslashes($preferredtitle);
+    $preferredtitle = stripslashes_safe($rss_record->preferredtitle);
+    if (empty($preferredtitle)) {
+        $preferredtitle = stripslashes_safe($rss_record->title);
+    }
+    $url = stripslashes_safe($rss_record->url);
+    rss_display_feeds($id, '', $rssid);
+    rss_print_form($act, $url, $rssid, $preferredtitle, $id);
 
-        $rssid = insert_record('block_rss_client', $dataobject);
-        if (!$rssid) {
-            error('There was an error trying to add a new rss feed:'. $url);
-        }
+} else if ($act == 'delfeed') {
 
+    $file = $CFG->dataroot .'/cache/rsscache/'. $rssid .'.xml';
+    if (file_exists($file)) {
+        unlink($file);
+    }
+
+    // echo "DEBUG: act = delfeed"; //debug
+    delete_records('block_rss_client', 'id', $rssid);
+
+    redirect($referrer, get_string('feeddeleted', 'block_rss_client') );
+
+} else if ( isset($rss_record) && $act == 'view' ) {
+    //              echo $sql; //debug
+    //              print_object($res); //debug
+    if (!$rss_record->id) {
+        print '<strong>'. get_string('couldnotfindfeed', 'block_rss_client') .': '. $rssid .'</strong>';
+    } else {
         // By capturing the output from fetch_rss this way
         // error messages do not display and clutter up the moodle interface
         // however, we do lose out on seeing helpful messages like "cache hit", etc.
         ob_start();
-        $rss = fetch_rss($url);
-        $rsserror = ob_get_contents();
+        $rss = fetch_rss($rss_record->url);
         ob_end_clean();
-        
-        if ($rss === false) {
-            $message = 'There was an error loading this rss feed. You may want to verify the url you have specified before using it.'; //Daryl Hawes note: localize this line
+
+        if (empty($rss_record->preferredtitle)) {
+            $feedtitle = stripslashes_safe($rss_record->preferredtitle);
         } else {
-
-            $dataobject->id = $rssid;
-            if (!empty($rss->channel['description'])) {
-                $dataobject->description = addslashes(rss_unhtmlentities($rss->channel['description']));
+            $feedtitle =  stripslashes_safe(rss_unhtmlentities($rss->channel['title']));
+        }
+        print '<table align="center" width="50%" cellspacing="1">'."\n";
+        print '<tr><td colspan="2"><strong>'. $feedtitle .'</strong></td></tr>'."\n";
+        for($y=0; $y < count($rss->items); $y++) {
+            $rss->items[$y]['title'] = stripslashes_safe(rss_unhtmlentities($rss->items[$y]['title']));
+            $rss->items[$y]['description'] = stripslashes_safe(rss_unhtmlentities($rss->items[$y]['description']));
+            if ($rss->items[$y]['link'] == '') {
+                $rss->items[$y]['link'] = $rss->items[$y]['guid'];
             }
-            if (!empty($rss->channel['title'])) {
-                $dataobject->title = addslashes(rss_unhtmlentities($rss->channel['title']));
-            } 
-            if (!update_record('block_rss_client', $dataobject)) {
-                error('There was an error trying to update rss feed with id:'. $rssid);
+
+            if ($rss->items[$y]['title'] == '') {
+                $rss->items[$y]['title'] = '&gt;&gt;';
             }
-            $message = get_string('feedadded', 'block_rss_client');
-        }
-        redirect($referrer, $message);
-/*
-        rss_display_feeds();
-        rss_get_form($act, $dataobject->url, $dataobject->id, $dataobject->preferredtitle);
-*/
-    } else if ( $act == 'rss_edit') {
-        
-        $rss_record = get_record('block_rss_client', 'id', $rssid);
-        $preferredtitle = stripslashes_safe($rss_record->preferredtitle);
-        if (empty($preferredtitle)) {
-            $preferredtitle = stripslashes_safe($rss_record->title);
-        }
-        $url = stripslashes_safe($rss_record->url);
-        rss_display_feeds('', $rssid);
-        rss_get_form($act, $url, $rssid, $preferredtitle);
 
-    } else if ($act == 'delfeed') {
-        
-        $file = $CFG->dataroot .'/cache/rsscache/'. $rssid .'.xml';
-        if (file_exists($file)) {
-            unlink($file);
-        }
-
-        // echo "DEBUG: act = delfeed"; //debug
-        //Daryl Hawes note: convert this sql statement to a moodle function call
-        $sql = 'DELETE FROM '. $CFG->prefix .'block_rss_client WHERE id='. $rssid;
-        $res= $db->Execute($sql);
-
-        redirect($referrer, get_string('feeddeleted', 'block_rss_client') );
-
-/*        rss_display_feeds();
-        rss_get_form($act, $url, $rssid, $preferredtitle);
-*/
-    } else if ($act == 'view') {
-        //              echo $sql; //debug
-        //              print_object($res); //debug
-        $rss_record = get_record('block_rss_client', 'id', $rssid);
-        if (!$rss_record->id) {
-            print '<strong>'. get_string('couldnotfindfeed', 'block_rss_client') .': '. $rssid .'</strong>';
-        } else {
-            // By capturing the output from fetch_rss this way
-            // error messages do not display and clutter up the moodle interface
-            // however, we do lose out on seeing helpful messages like "cache hit", etc.
-            ob_start();
-            $rss = fetch_rss($rss_record->url);
-            $rsserror = ob_get_contents();
-            ob_end_clean();
-            
-            if (empty($rss_record->preferredtitle)) {
-                $feedtitle = stripslashes_safe($rss_record->preferredtitle);
+            print '<tr><td valign="middle">'."\n";
+            print '<a href="'. $rss->items[$y]['link'] .'" target="_blank"><strong>'. $rss->items[$y]['title'];
+            print '</strong></a>'."\n";
+            print '</td>'."\n";
+            if (file_exists($CFG->dirroot .'/blog/lib.php')) {
+                //Blog module is installed - provide "blog this" link
+                print '<td align="right">'."\n";
+                print '<img src="'. $CFG->pixpath .'/blog/blog.gif" alt="'. get_string('blogthis', 'blog').'" title="'. get_string('blogthis', 'blog') .'" border="0" align="middle" />'."\n";
+                print '<a href="'. $CFG->wwwroot .'/blog/blogthis.php?userid='. $userid .'&act=use&item='. $y .'&rssid='. $rssid .'"><small><strong>'. get_string('blogthis', 'blog') .'</strong></small></a>'."\n";
             } else {
-               $feedtitle =  stripslashes_safe(rss_unhtmlentities($rss->channel['title']));
+                print '<td>&nbsp;';
             }
-            print '<table align="center" width="50%" cellspacing="1">'."\n";
-            print '<tr><td colspan="2"><strong>'. $feedtitle .'</strong></td></tr>'."\n";
-            for($y=0; $y < count($rss->items); $y++) {
-                $rss->items[$y]['title'] = stripslashes_safe(rss_unhtmlentities($rss->items[$y]['title']));
-                $rss->items[$y]['description'] = stripslashes_safe(rss_unhtmlentities($rss->items[$y]['description']));
-                if ($rss->items[$y]['link'] == '') {
-                    $rss->items[$y]['link'] = $rss->items[$y]['guid'];
-                }
-
-                if ($rss->items[$y]['title'] == '') {
-                    $rss->items[$y]['title'] = '&gt;&gt;';
-                }
-
-                print '<tr><td valign="middle">'."\n";
-                print '<a href="'. $rss->items[$y]['link'] .'" target="_blank"><strong>'. $rss->items[$y]['title'];
-                print '</strong></a>'."\n";
-                print '</td>'."\n";
-                if (file_exists($CFG->dirroot .'/blog/lib.php')) {
-                    //Blog module is installed - provide "blog this" link
-                    print '<td align="right">'."\n";
-                    print '<img src="'. $CFG->pixpath .'/blog/blog.gif" alt="'. get_string('blogthis', 'blog').'" title="'. get_string('blogthis', 'blog') .'" border="0" align="middle" />'."\n";
-                    print '<a href="'. $CFG->wwwroot .'/blog/blogthis.php?blogid='. $blogid .'&act=use&item='. $y .'&rssid='. $rssid .'"><small><strong>'. get_string('blogthis', 'blog') .'</strong></small></a>'."\n";
-                } else {
-                    print '<td>&nbsp;';
-                }
-                print '</td></tr>'."\n";
-                print '<tr><td colspan=2><small>';
-                print $rss->items[$y]['description'] .'</small></td></tr>'."\n";
-            }
-            print '</table>'."\n";
+            print '</td></tr>'."\n";
+            print '<tr><td colspan=2><small>';
+            print $rss->items[$y]['description'] .'</small></td></tr>'."\n";
         }
-    } else {
-        rss_display_feeds();
-        rss_get_form($act, $url, $rssid, $preferredtitle);
+        print '</table>'."\n";
     }
-
-    print_footer();
-?>
+} else {
+    rss_display_feeds($id);
+    rss_print_form($act, $url, $rssid, $preferredtitle, $id);
+}
+print_footer();
+?>

blocks/rss_client/block_rss_client_error.php

@@ -1,14 +1,14 @@
 <?php //$Id$
+// Print an error page condition
+require_once('../../config.php');
 
-    require_once('../../config.php');
+$error = required_param('error', PARAM_CLEAN);
 
-    require_variable($error);
+print_header(get_string('error'), 
+              get_string('error'), 
+              get_string('error') );
 
-    print_header(get_string('error'), 
-                 get_string('error'), 
-                 get_string('error') );
+print clean_text(urldecode($error));
 
-    print clean_text(urldecode($error));
-
-    print_footer();
-?>
+print_footer();
+?>

blocks/rss_client/config_global.html

@@ -17,6 +17,7 @@
         <?php print_string('clientnumentries', 'block_rss_client') ?>
     </td>
 </tr>
+
 <tr valign="top">
     <td align="right">block_rss_timeout:</td>
     <td>
@@ -31,6 +32,7 @@
         <?php print_string('timeout', 'block_rss_client') ?>
     </td>
 </tr>
+
 <tr valign="top">
     <td align="right">block_rss_client_submitters:</td>
     <td>
@@ -56,13 +58,16 @@
     </td>
 </tr>
 
-
 <tr>
     <td colspan="3" align="center">
     <input type="submit" value="<?php print_string('savechanges') ?>"></td>
 </tr>
 <tr>
-    
-    <td colspan="3" align="center"><a href=" <?php echo $CFG->wwwroot; ?>/blocks/rss_client/block_rss_client_action.php?courseid=<?php echo $courseid; ?>"><?php print_string('feedsaddedit', 'block_rss_client')?></a></center><br /><br />
+    <td colspan="3" align="center"><a href=" <?php echo $CFG->wwwroot; ?>/blocks/rss_client/block_rss_client_action.php?id=<?php 
+    if (!isset($id)) {
+        $id = '';
+    }
+    echo $id; ?>"><?php print_string('feedsaddedit', 'block_rss_client')?></a></center><br /><br />
     </td>
-</table>
+    </tr>
+</table>

blocks/rss_client/config_instance.html

@@ -1,11 +1,13 @@
-<?php 
+<?php // $Id$ //
 require_once($CFG->libdir .'/rsslib.php');
 
+$id       = optional_param('id', SITEID, PARAM_INT);
+
 //create a page object for url_get_full()
 $page = page_create_object($this->instance->pagetype, $this->instance->pageid);
 
 /// Print tabs at top
-global $currentaction;
+$currentaction = optional_param('currentaction', '', PARAM_ALPHA);
 if (empty($currentaction) || $currentaction == 'configblock') {
     $currentaction = 'configblock';
 } else {
@@ -36,6 +38,7 @@ if ($currentaction == 'configblock') {
             ?>
     </td>
 </tr>
+
 <tr valign="top">
     <td align="right" width="50%">
         <?php print_string('shownumentrieslabel', 'block_rss_client') ?>
@@ -54,6 +57,7 @@ if ($currentaction == 'configblock') {
         ?>" />
     </td>
 </tr>
+
 <tr valign="top">
     <td align="right" width="50%">
         <?php print_string('choosefeedlabel', 'block_rss_client') ?>
@@ -87,12 +91,13 @@ if ($currentaction == 'configblock') {
             } else {
                 print_string('nofeeds', 'block_rss_client');
                 if ( isadmin() ) {
-                    print '&nbsp;<a href="'. $CFG->wwwroot .'/blocks/rss_client/block_rss_client_action.php"> '. get_string('editnewsfeeds', 'block_rss_client') .'</a><br />';
+                    print '&nbsp;<a href="'. $CFG->wwwroot .'/blocks/rss_client/block_rss_client_action.php?id='. $id .'"> '. get_string('editnewsfeeds', 'block_rss_client') .'</a><br />';
                 }
             }
         ?>
     </td>
 </tr>
+
 <tr valign="top">
     <td align="right" width="50%"><?php print_string('uploadlabel'); ?></td>
     <?php 
@@ -104,6 +109,7 @@ if ($currentaction == 'configblock') {
     <td width="50%"><input type="text" name="title" size="30" value="<?php echo $title; ?>" />
     </td>
 </tr>
+
 <tr valign="top">
     <td align="right" width="50%"><?php print_string('clientshowchannellinklabel', 'block_rss_client'); ?></td>
     <td width="50%">
@@ -120,6 +126,7 @@ if ($currentaction == 'configblock') {
         ?>
     </td>
 </tr>
+
 <tr valign="top">
     <td align="right" width="50%"><?php print_string('clientshowimagelabel', 'block_rss_client'); ?></td>
     <td width="50%">
@@ -136,6 +143,7 @@ if ($currentaction == 'configblock') {
         ?>
     </td>
 </tr>
+
 <tr>
     <td colspan="2" align="center">
         <input type="submit" value="<?php print_string('savechanges') ?>">
@@ -147,8 +155,8 @@ if ($currentaction == 'configblock') {
     global $act, $url, $rssid, $preferredtitle;
     print '<table cellpadding="9" cellspacing="0" class="blockconfigtable">';
     print '<tr valign="top"><td>';
-    rss_display_feeds();
+    rss_display_feeds($id);
     print '</form>'; //not sure that this is needed
-    rss_get_form($act, $url, $rssid, $preferredtitle); 
+    rss_print_form($act, $url, $rssid, $preferredtitle, $id);
     print '</td></tr></table>';
-} ?>
+} ?>

blocks/rss_client/config_instance_tabs.php

@@ -2,21 +2,21 @@
 /// This file to be included so we can assume config.php has already been included.
 /// We also assume that $inactive, $activetab and $currentaction have been set
 
-    global $USER;
-    $tabs = $row = array();
+global $USER;
+$tabs = $row = array();
 
-    $script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'configblock'));
-    $row[] = new tabobject('configblock', $script, 
-                get_string('configblock', 'block_rss_client'));
+$script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'configblock', 'id' => $id));
+$row[] = new tabobject('configblock', $script, 
+            get_string('configblock', 'block_rss_client'));
 
-    $script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'managefeeds'));
-    $row[] = new tabobject('managefeeds', $script, 
-                get_string('managefeeds', 'block_rss_client'));
+$script = $page->url_get_full(array('instanceid' => $this->instance->id, 'sesskey' => $USER->sesskey, 'blockaction' => 'config', 'currentaction' => 'managefeeds', 'id' => $id));
+$row[] = new tabobject('managefeeds', $script, 
+            get_string('managefeeds', 'block_rss_client'));
 
-    $tabs[] = $row;
+$tabs[] = $row;
 
-    /// Print out the tabs and continue!
-    print '<div align="center">';
-    print_tabs($tabs, $currentaction);
-    print '</div>';
+/// Print out the tabs and continue!
+print '<div align="center">';
+print_tabs($tabs, $currentaction);
+print '</div>';
 ?>

blocks/rss_client/db/mysql.php

@@ -1,6 +1,6 @@
 <?php //$Id$
 
-function block_rss_client_upgrade($oldversion) {
+function rss_client_upgrade($oldversion) {
 /// This function does anything necessary to upgrade 
 /// older versions to match current functionality 
 
@@ -10,6 +10,12 @@ function block_rss_client_upgrade($oldversion) {
        # Do something ...
     }
 
+    if ($oldversion < 2004112001) {
+        // title and description should be TEXT as we don't have control over their length.
+        table_column('block_rss_client','title','title','text',10,'unsigned','');
+        table_column('block_rss_client','description','description','text',10,'unsigned','');
+    }
+
     return true;
 }
 

blocks/rss_client/db/mysql.sql

@@ -13,9 +13,9 @@
 CREATE TABLE prefix_block_rss_client (
  `id` int(11) NOT NULL auto_increment,
  `userid` int(11) NOT NULL default '0',
- `title` varchar(64) NOT NULL default '',
+ `title` text NOT NULL default '',
  `preferredtitle` varchar(64) NOT NULL default '',
- `description` varchar(128) NOT NULL default '',
+ `description` text NOT NULL default '',
  `url` varchar(255) NOT NULL default '',
 PRIMARY KEY  (`id`)
 ) TYPE=MyISAM  COMMENT='Remote news feed information. Contains the news feed id, the userid of the user who added the feed, the title of the feed itself and a description of the feed contents along with the url used to access the remote feed. Preferredtitle is a field for future use - intended to allow for custom titles rather than those found in the feed.';

blocks/rss_client/db/postgres7.php

@@ -1,11 +1,16 @@
 <?php
 
-function block_rss_client_upgrade($oldversion) {
+function rss_client_upgrade($oldversion) {
 /// This function does anything necessary to upgrade 
 /// older versions to match current functionality 
 
     global $CFG;
 
+    if ($oldversion < 2004112001) {
+        // title and description should be TEXT as we don't have control over their length.
+        table_column('block_rss_client','title','title','text');
+        table_column('block_rss_client','description','description','text');
+    }
 
     return true;
 }

blocks/rss_client/db/postgres7.sql

@@ -11,8 +11,8 @@
 CREATE TABLE prefix_block_rss_client (
  id SERIAL PRIMARY KEY,
  userid INTEGER NOT NULL default '0',
- title varchar(64) NOT NULL default '',
+ title text NOT NULL default '',
  preferredtitle varchar(64) NOT NULL default '',
- description varchar(128) NOT NULL default '',
+ description text NOT NULL default '',
  url varchar(255) NOT NULL default ''
 );

blocks/social_activities/block_social_activities.php

@@ -51,7 +51,7 @@ class block_social_activities extends block_list {
 
         if ($ismoving) {
             $this->content->icons[] = '&nbsp;<img align="bottom" src="'.$CFG->pixpath.'/t/move.gif" height="11" width="11" alt=\"\" />';
-            $this->content->items[] = $USER->activitycopyname.'&nbsp;(<a href="'.$CFG->wwwroot.'/course/mod.php?cancelcopy=true">'.$strcancel.'</a>)';
+            $this->content->items[] = $USER->activitycopyname.'&nbsp;(<a href="'.$CFG->wwwroot.'/course/mod.php?cancelcopy=true&amp;sesskey='.$USER->sesskey.'">'.$strcancel.'</a>)';
         }
 
         if (!empty($section->sequence)) {

blocks/version.php

@@ -5,4 +5,4 @@
 // database (blocks_version) to determine whether upgrades should
 // be performed (see db/backup_*.php)
 
-$blocks_version = 2005022400;   // The current version is a date (YYYYMMDDXX)
+$blocks_version = 2005022401;   // The current version is a date (YYYYMMDDXX)

calendar/event.php

@@ -113,7 +113,7 @@
 
             if($form = data_submitted()) {
 
-                $form->name = strip_tags($form->name,'<lang>');  // Strip all tags, but <lang>
+                $form->name = clean_text(strip_tags($form->name,'<lang><span>'));
 
                 $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin);
                 if($form->duration == 1) {
@@ -211,19 +211,23 @@
                     $eventid = insert_record('event', $form, true);
 
                     /// Log the event entry.
-                    $form->name = stripslashes($form->name);  //To avoid double-slashes
-                    add_to_log($form->courseid, 'calendar', 'add', 'event.php?action=edit&amp;id='.$eventid, $form->name);
+                    add_to_log($form->courseid, 'calendar', 'add', 'event.php?action=edit&amp;id='.$eventid, stripslashes($form->name));
 
                     if ($form->repeat) {
                         for($i = 1; $i < $form->repeats; $i++) {
-                            // [pj]
-                            // This will not necessarily work correctly because of DST
-                            $form->timestart += 604800;  // add one week
+                            // What's the DST offset for the previous repeat?
+                            $dst_offset_prev = dst_offset_on($form->timestart);
+
+                            $form->timestart += WEEKSECS;
+
+                            // If the offset has changed in the meantime, update this repeat accordingly
+                            $form->timestart += $dst_offset_prev - dst_offset_on($form->timestart);
+
                             /// Get the event id for the log record.
                             $eventid = insert_record('event', $form, true);
+
                             /// Log the event entry.
-                            $form->name = stripslashes($form->name);  //To avoid double-slashes
-                            add_to_log($form->courseid, 'calendar', 'add', 'event.php?action=edit&amp;id='.$eventid, $form->name);
+                            add_to_log($form->courseid, 'calendar', 'add', 'event.php?action=edit&amp;id='.$eventid, stripslashes($form->name));
                         }
                     }
 
@@ -455,7 +459,7 @@
                 case 'site':
                     $form->name = '';
                     $form->description = '';
-                    $form->courseid = 1;
+                    $form->courseid = SITEID;
                     $form->groupid = 0;
                     $form->userid = $USER->id;
                     $form->modulename = '';

calendar/lib.php

@@ -1128,10 +1128,10 @@ function calendar_get_default_courses($ignoreref = false) {
         }
     }
     if(isset($USER->student) && is_array($USER->student)) {
-        $courses = $USER->student;
+        $courses = $courses + $USER->student;
     }
     if(isset($USER->teacher) && is_array($USER->teacher)) {
-        $courses = $USER->teacher;
+        $courses = $courses + $USER->teacher;
     }
     return $courses;
 }

calendar/preferences.php

@@ -17,7 +17,6 @@
 /// If data submitted, then process and store.
 
     if ($form = data_submitted()) {
-        print_header();
         foreach ($form as $preference => $value) {
             switch ($preference) {
                 case 'timeformat':

calendar/view.php

@@ -84,8 +84,8 @@
 
     // If a course has been supplied in the URL, change the filters to show that one
     if (!empty($_GET['course'])) {
-        if ($course = get_record('course', 'id', $_GET['course'])) {
-            if ($course->id == 1) {
+        if ($course = get_record('course', 'id', intval($_GET['course']))) {
+            if ($course->id == SITEID) {
                 // If coming from the home page, show all courses
                 $SESSION->cal_courses_shown = calendar_get_default_courses(true);
                 calendar_set_referring_course(0);
@@ -108,7 +108,7 @@
 
     // Let's see if we are supposed to provide a referring course link
     // but NOT for the "main page" course
-    if ($SESSION->cal_course_referer > 1 &&
+    if ($SESSION->cal_course_referer != SITEID &&
        ($shortname = get_field('course', 'shortname', 'id', $SESSION->cal_course_referer)) !== false) {
         // If we know about the referring course, show a return link and ALSO require login!
         require_login();
@@ -558,7 +558,7 @@ function calendar_course_filter_selector($getvars = '') {
 
     unset($courses[SITEID]);
 
-    $courseoptions[1] = get_string('fulllistofcourses');
+    $courseoptions[SITEID] = get_string('fulllistofcourses');
     foreach ($courses as $course) {
         $courseoptions[$course->id] = $course->shortname;
     }

config-dist.php

@@ -196,7 +196,7 @@ $CFG->admin = 'admin';
 // mailprefix must be EXACTLY four characters.
 // Uncomment and customise this block for Postfix 
 //      $CFG->mailprefix = 'mdl+'; // + is the separator for Exim and Postfix.
-//      $CFG->mailprefix = 'mdl-'l // - is the separator for qmail 
+//      $CFG->mailprefix = 'mdl-'; // - is the separator for qmail 
 //      $CFG->maildomain = 'youremaildomain.com';
 //
 // The following setting will tell Moodle to respect your PHP session 
@@ -264,6 +264,12 @@ $CFG->admin = 'admin';
 // If you are going to publish your log, or the output of your web stats analyzer
 // this will weaken the security of your website.
 // 
+// Email database connection errors to someone.  If Moodle cannot connect to the 
+// database, then email this address with a notice.
+//
+//     $CFG->emailconnectionerrorsto = 'your@emailaddress.com';
+// 
+// 
 
 
 //=========================================================================

course/category.php

@@ -6,9 +6,9 @@
     require_once("../config.php");
     require_once("lib.php");
 
-    require_variable($id);    // Category id
-    optional_variable($page, "0");     // which page to show
-    optional_variable($perpage, "20"); // how many per page
+    $id      = required_param('id', PARAM_INT);          // Category id
+    $page    = optional_param('page', 0, PARAM_INT);     // which page to show
+    $perpage = optional_param('perpage', 20, PARAM_INT); // how many per page
 
     if (!$site = get_site()) {
         error("Site isn't defined!");
@@ -138,7 +138,15 @@
                     } else {
                         // figure out a sortorder that we can use in the destination category
                         $sortorder = get_field_sql('SELECT MIN(sortorder)-1 AS min
-                                                    FROM ' . $CFG->prefix . 'course WHERE category=' . $destcategory->id) || 1000;
+                                                    FROM ' . $CFG->prefix . 'course WHERE category=' . $destcategory->id);
+                        if ($sortorder === false) {
+                            // the category is empty
+                            // rather than let the db default to 0
+                            // set it to > 100 and avoid extra work in fix_coursesortorder()                        
+                            $sortorder = 200;
+                        } else if ($sortorder < 10) {
+                            fix_course_sortorder($categoryid);
+                        }
 
                         $newcourse = new stdClass;
                         $newcourse->id        = $courseid;
@@ -295,10 +303,20 @@
         $count = 0;
         $abletomovecourses = false;  // for now
 
+        // Checking if we are at the first or at the last page, to allow courses to
+        // be moved up and down beyond the paging border
+        if ($totalcount > $perpage) {
+            $atfirstpage = ($page == 0);
+            $atlastpage = (($page + 1) == ceil($totalcount / $perpage));
+        } else {
+            $atfirstpage = true;
+            $atlastpage = true;
+        }
+
         foreach ($courses as $acourse) {
             $count++;
-            $up = ($count == 1) ? false : true;
-            $down = ($count == $numcourses) ? false : true;
+            $up = ($count > 1 || !$atfirstpage);
+            $down = ($count < $numcourses || !$atlastpage);
 
             $linkcss = $acourse->visible ? "" : ' class="dimmed" ';
             echo '<tr>';
@@ -316,11 +334,11 @@
                          '<img src="'.$CFG->pixpath.'/t/delete.gif" height="11" width="11" border="0" alt="" /></a> ';
                     if (!empty($acourse->visible)) {
                         echo '<a title="'.$strhide.'" href="category.php?id='.$category->id.'&amp;page='.$page.
-                             '&amp;hide='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
+                             '&amp;perpage='.$perpage.'&amp;hide='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
                              '<img src="'.$CFG->pixpath.'/t/hide.gif" height="11" width="11" border="0" alt="" /></a> ';
                     } else {
                         echo '<a title="'.$strshow.'" href="category.php?id='.$category->id.'&amp;page='.$page.
-                             '&amp;show='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
+                             '&amp;perpage='.$perpage.'&amp;show='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
                              '<img src="'.$CFG->pixpath.'/t/show.gif" height="11" width="11" border="0" alt="" /></a> ';
                     }
 
@@ -333,7 +351,7 @@
 
                     if ($up) {
                         echo '<a title="'.$strmoveup.'" href="category.php?id='.$category->id.'&amp;page='.$page.
-                             '&amp;moveup='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
+                             '&amp;perpage='.$perpage.'&amp;moveup='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
                              '<img src="'.$CFG->pixpath.'/t/up.gif" height="11" width="11" border="0" alt="" /></a> ';
                     } else {
                         echo '<img src="'.$CFG->wwwroot.'/pix/spacer.gif" height="11" width="11" border="0" alt="" /> ';
@@ -341,7 +359,7 @@
 
                     if ($down) {
                         echo '<a title="'.$strmovedown.'" href="category.php?id='.$category->id.'&amp;page='.$page.
-                             '&amp;movedown='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
+                             '&amp;perpage='.$perpage.'&amp;movedown='.$acourse->id.'&amp;sesskey='.$USER->sesskey.'">'.
                              '<img src="'.$CFG->pixpath.'/t/down.gif" height="11" width="11" border="0" alt="" /></a> ';
                     } else {
                         echo '<img src="'.$CFG->wwwroot.'/pix/spacer.gif" height="11" width="11" border="0" alt="" /> ';

course/delete.php

@@ -40,6 +40,8 @@
         notice_yesno("$strdeletecoursecheck<br /><br />$course->fullname ($course->shortname)", 
                      "delete.php?id=$course->id&amp;delete=".md5($course->timemodified)."&amp;sesskey=$USER->sesskey", 
                      "category.php?id=$course->category");
+
+        print_footer($course);
         exit;
     }
 

course/edit.html

@@ -287,7 +287,8 @@
       } else {
           echo ((empty($form->metacourse)) ? get_string("no") : get_string("yes"));
           echo " - $disable_meta ";
-      } ?>
+      }
+      helpbutton("metacourse", get_string("metacourse")); ?>
     </td>
 </tr>
 <tr>

course/edit.php

@@ -11,6 +11,7 @@
     require_login();
    
     $disable_meta = false;
+    $focus = "";
 
     if ($id) {
         if (! $course = get_record("course", "id", $id)) {
@@ -59,7 +60,7 @@
         }
 
         $form->startdate = make_timestamp($form->startyear, $form->startmonth, $form->startday);
-
+        $form->category = clean_param($form->category, PARAM_INT);
         $form->format = optional_param('format', 'social', PARAM_ALPHA);
 
         validate_form($course, $form, $err);
@@ -179,10 +180,6 @@
         }
     }
 
-    if (empty($focus)) {
-        $focus = "";
-    }
-
     $form->categories = get_records_select_menu("course_categories", "", "name", "id,name");
 
     $courseformats = get_list_of_plugins("course/format");
@@ -215,13 +212,13 @@
     print_simple_box_start("center");
     include("edit.html");
     print_simple_box_end();
-
-    print_footer($course);
-
+    
     if ($usehtmleditor) {
         use_html_editor("summary");
     }
 
+    print_footer($course);
+
     exit;
 
 /// Functions /////////////////////////////////////////////////////////////////

course/editsection.php

@@ -58,9 +58,7 @@
         $strsummaryof = get_string('summaryof', '', " $sectionname $form->section");
     }
 
-    print_header("$course->shortname: $stredit", "$course->fullname", 
-                 "<a href=\"$CFG->wwwroot/course/view.php?id=$course->id\">$course->shortname</a> 
-                  -> $stredit");
+    print_header_simple($stredit, '', $stredit);
 
     print_heading($strsummaryof);
     print_simple_box_start('center');

course/enrol.php

@@ -19,6 +19,12 @@
         error("Could not find a site!");
     }
 
+/// Check if the course is a meta course
+    if ($course->metacourse) {
+        print_header_simple();
+        notice(get_string('coursenotaccessible'), $CFG->wwwroot);
+    }
+
     check_for_restricted_user($USER->username);
 
     $enrol = new enrolment_plugin();

course/format/social/format.php

@@ -10,12 +10,10 @@
     define('BLOCK_R_MIN_WIDTH', 100);
     define('BLOCK_R_MAX_WIDTH', 210);
 
-    optional_variable($preferred_width_left,  blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]));
-    optional_variable($preferred_width_right, blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]));
-    $preferred_width_left = min($preferred_width_left, BLOCK_L_MAX_WIDTH);
-    $preferred_width_left = max($preferred_width_left, BLOCK_L_MIN_WIDTH);
-    $preferred_width_right = min($preferred_width_right, BLOCK_R_MAX_WIDTH);
-    $preferred_width_right = max($preferred_width_right, BLOCK_R_MIN_WIDTH);
+    $preferred_width_left  = bounded_number(BLOCK_L_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]),  
+                                            BLOCK_L_MAX_WIDTH);
+    $preferred_width_right = bounded_number(BLOCK_R_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]), 
+                                            BLOCK_R_MAX_WIDTH);
 
     $strgroups  = get_string('groups');
     $strgroupmy = get_string('groupmy');

course/format/topics/format.php

@@ -14,12 +14,10 @@
     define('BLOCK_R_MIN_WIDTH', 100);
     define('BLOCK_R_MAX_WIDTH', 210);
 
-    optional_variable($preferred_width_left,  blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]));
-    optional_variable($preferred_width_right, blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]));
-    $preferred_width_left = min($preferred_width_left, BLOCK_L_MAX_WIDTH);
-    $preferred_width_left = max($preferred_width_left, BLOCK_L_MIN_WIDTH);
-    $preferred_width_right = min($preferred_width_right, BLOCK_R_MAX_WIDTH);
-    $preferred_width_right = max($preferred_width_right, BLOCK_R_MIN_WIDTH);
+    $preferred_width_left  = bounded_number(BLOCK_L_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]),  
+                                            BLOCK_L_MAX_WIDTH);
+    $preferred_width_right = bounded_number(BLOCK_R_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]), 
+                                            BLOCK_R_MAX_WIDTH);
 
     if (isset($topic)) {
         $displaysection = course_set_display($course->id, $topic);
@@ -148,7 +146,7 @@
 
         if (!empty($displaysection) and $displaysection != $section) {
             if ($showsection) {
-                $strsummary = ' - '.strip_tags($thissection->summary);
+                $strsummary = strip_tags(format_string($thissection->summary,true));
                 if (strlen($strsummary) < 57) {
                     $strsummary = ' - '.$strsummary;
                 } else {

course/format/weeks/format.php

@@ -10,12 +10,10 @@
     define('BLOCK_R_MIN_WIDTH', 100);
     define('BLOCK_R_MAX_WIDTH', 210);
 
-    optional_variable($preferred_width_left,  blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]));
-    optional_variable($preferred_width_right, blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]));
-    $preferred_width_left = min($preferred_width_left, BLOCK_L_MAX_WIDTH);
-    $preferred_width_left = max($preferred_width_left, BLOCK_L_MIN_WIDTH);
-    $preferred_width_right = min($preferred_width_right, BLOCK_R_MAX_WIDTH);
-    $preferred_width_right = max($preferred_width_right, BLOCK_R_MIN_WIDTH);
+    $preferred_width_left  = bounded_number(BLOCK_L_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_LEFT]),  
+                                            BLOCK_L_MAX_WIDTH);
+    $preferred_width_right = bounded_number(BLOCK_R_MIN_WIDTH, blocks_preferred_width($pageblocks[BLOCK_POS_RIGHT]), 
+                                            BLOCK_R_MAX_WIDTH);
 
     if (isset($week)) {
         $displaysection = course_set_display($course->id, $week);

course/group.php

@@ -51,11 +51,20 @@
                     $group->picture = 1;
                 }
             }
-            $group->name        = clean_text($form->name);
-            $group->description = clean_text($form->description);
-            $group->hidepicture = $form->hidepicture;
-            $group->password    = $form->password;
-            if (!update_record("groups", $group)) {
+
+            // Setting a new object in order to avoid updating other columns for the record,
+            // which could lead to SQL injection vulnerabilities.
+
+            // Be VERY sure to sanitize all parameters that go into $dataobj!
+
+            $dataobj = new stdClass;
+            $dataobj->id          = $group->id;
+            $dataobj->name        = clean_text($form->name);
+            $dataobj->description = clean_text($form->description);
+            $dataobj->hidepicture = empty($form->hidepicture) ? 0 : 1;
+            $dataobj->password    = required_param('password', PARAM_ALPHANUM);
+
+            if (!update_record('groups', $dataobj)) {
                 notify("A strange error occurred while trying to save");
             } else {
                 notify(get_string('changessaved'));

course/groups-edit.html

@@ -10,7 +10,7 @@
         foreach ($listmember as $userid => $username) {
             $count++;
             $useridstring .= "\"$userid\"";
-            $usernamestring .= "\"$username\"";
+            $usernamestring .= '"'.addslashes($username).'"';
             if ($count < $max) {
                 $useridstring .= ', ';
                 $usernamestring .= ', ';

course/groups.php

@@ -47,6 +47,12 @@
 
     if ($data = data_submitted() and confirm_sesskey()) {
 
+        // Clean ALL incoming parameters which go in SQL queries here for good measure
+        $data->id      = required_param('id', PARAM_INT);
+        $data->groups  = optional_param('groups', 0, PARAM_INT);
+        $data->groupid = optional_param('groupid', 0, PARAM_INT);
+        $data->members = optional_param('members', array(), PARAM_INT);
+
         if (!empty($data->nonmembersadd)) {            /// Add people to a group
             if (!empty($data->nonmembers) and !empty($data->groupid)) {
                 $groupmodified = false;
@@ -76,6 +82,9 @@
 
         } else if (!empty($data->groupsremove)) {      /// Remove a group, all members become nonmembers
             if (!empty($data->groups)) {
+                if(!isset($groups[$data->groups])) {
+                    error("This is not a valid group to remove");
+                }
                 delete_records("groups", "id", $data->groups);
                 delete_records("groups_members", "groupid", $data->groups);
                 unset($groups[$data->groups]);
@@ -102,8 +111,8 @@
             if (!empty($data->members) and !empty($data->groupid)) {
                 foreach ($data->members as $userid) {
                     delete_records('groups_members', 'userid', $userid, "groupid", $data->groupid);
-                    set_field('groups', 'timemodified', time(), 'id', $data->groupid);
                 }
+                set_field('groups', 'timemodified', time(), 'id', $data->groupid);
             }
             $selectedgroup = $data->groupid;
 
@@ -176,7 +185,7 @@
     natcasesort($nonmembers);
 
     if (empty($selectedgroup)) {    // Choose the first group by default
-        if ($selectedgroup = array_shift(array_keys($listgroups))) {
+        if ($selectedgroup = array_shift($temparr = array_keys($listgroups))) {
             $members = $listmembers[$selectedgroup];
         }
     } else {

course/import.php

@@ -24,7 +24,15 @@ optional_variable($filename,0);
         error("You need to be a teacher or an admin to use this page");
     }
 
+    // if we're not a course creator , we can only import from our own courses.
+    if (iscreator()) {
+        $creator = true;
+    }
+
     if ($from = get_record("course","id",$fromcourse)) {
+        if (!isteacheredit($fromcourse)) {
+            error("You need to be a course creator, or a teacher in the course you are importing data from, as well");
+        }
         if (!empty($filename) && file_exists($CFG->dataroot.'/'.$filename) && !empty($SESSION->import_preferences)) {
             $restore = backup_to_restore_array($SESSION->import_preferences);
             $restore->restoreto = 1;
@@ -43,10 +51,30 @@ optional_variable($filename,0);
 
     print_header("$course->fullname: $strimport", "$course->fullname: $strimport", "$course->shortname");
 
-    $taught_courses = get_my_courses($USER->id,"visible DESC,sortorder ASC",0,1);
-    $cat_courses = get_courses($course->category);
     print_heading(get_string("importdatafrom"));
 
+    $tcourseids = '';
+
+    if ($teachers = get_records_select('user_teachers', "userid = $USER->id AND editall = 1",'','id,course')) {
+        foreach ($teachers as $teacher) {
+            if ($teacher->course != $course->id && $teacher->course != $site->id){
+                $tcourseids .= $teacher->course.',';
+            }
+        }
+    }
+
+    $taught_courses = array();
+    if (!empty($tcourseids)) {
+        $tcourseids = substr($tcourseids,0,-1);
+        $taught_courses = get_records_list('course', 'id', $tcourseids);
+    }
+
+    if (!empty($creator)) {
+        $cat_courses = get_courses($course->category);
+    } else {
+        $cat_courses = array();
+    }
+
     $options = array();
     foreach ($taught_courses as $tcourse) {
         if ($tcourse->id != $course->id && $tcourse->id != $site->id){
@@ -54,6 +82,13 @@ optional_variable($filename,0);
         }
     }
 
+    if (empty($options) && empty($creator)) {
+        error(get_string('courseimportnotaught'),$CFG->wwwroot.'/course/view.php?id='.$course->id);
+        print_footer();
+        die();
+    }
+
+
     $fm = '<form method="post" action="'.$CFG->wwwroot.'/course/import.php"><input type="hidden" name="id" value="'.$course->id.'" />';
     $submit = '<input type="submit" value="'.get_string('usethiscourse').'" /></form>';
 
@@ -78,11 +113,14 @@ optional_variable($filename,0);
                                choose_from_menu($options,"fromcourse","","choose","","0",true),
                                $submit);
     }
-    $table->data[] = array($fm.'<b>'.get_string('searchcourses').'</b>',
-                           '<input type="text" name="fromcoursesearch" />',
-                           '<input type="submit" value="'.get_string('searchcourses').'" />');
 
-    if (!empty($fromcoursesearch)) {
+    if (!empty($creator)) {
+        $table->data[] = array($fm.'<b>'.get_string('searchcourses').'</b>',
+                               '<input type="text" name="fromcoursesearch" />',
+                               '<input type="submit" value="'.get_string('searchcourses').'" />');
+    }
+
+    if (!empty($fromcoursesearch) && !empty($creator)) {
         $totalcount = 0;
         $courses = get_courses_search(explode(" ",$fromcoursesearch),"fullname ASC",$page,50,$totalcount);
         if (is_array($courses) and count($courses) > 0) {

course/importstudents.php

@@ -27,8 +27,8 @@
         redirect("$CFG->wwwroot/course/student.php?id=$course->id");
     }
 
-    if (!isadmin()) {
-        error("You must be an admin");
+    if (!isadmin() || !isteacheredit($course->id)) {
+        error("You must be an admin or a teacher of this course");
     }
 
 

course/index.php

@@ -31,7 +31,7 @@
     if (!$adminediting) {
         $countcategories = count_records("course_categories");
 
-        if ($countcategories > 1) {
+        if ($countcategories > 1 || ($countcategories == 1 && count_records('course') > 200)) {
             $strcourses = get_string("courses");
             $strcategories = get_string("categories");
             print_header("$site->shortname: $strcategories", $strcourses, 
@@ -246,7 +246,7 @@
     }
 
 /// Find any orphan courses that don't yet have a valid category and set to default
-    if ($courses = get_courses(NULL,NULL,'c.category,c.id,c.sortorder')) {
+    if ($courses = get_courses(NULL,NULL,'c.id, c.category, c.sortorder')) {
         foreach ($courses as $course) {
             if ($course->category and !isset($categories[$course->category])) {
                 set_field("course", "category", $default, "id", $course->id);

course/info.php

@@ -5,8 +5,8 @@
     require_once("../config.php");
     require_once("lib.php");
 
-    require_variable($id);    // Course id
-    optional_variable($name);
+    $id   = optional_param('id', false, PARAM_INT); // Course id
+    $name = optional_param('name', false, PARAM_RAW); // Course short name
 
     if (!$id and !$name) {
         error("Must specify course id or short name");

course/jumpto.php

@@ -1,18 +1,21 @@
 <?php  // $Id$
-       
+
 /*
- *  Jumps to a given URL.  Mostly used for accessibility.
+ *  Jumps to a given relative or Moodle absolute URL.
+ *  Mostly used for accessibility.
  *
  */
 
     require('../config.php');
 
-    $jump = optional_param('jump', '');
+    $jump = optional_param('jump', '', PARAM_RAW);
 
-    if ($jump) {
+    if (strpos($jump, $CFG->wwwroot) === 0) {            // Anything on this site
+        redirect(urldecode($jump));
+    } else if (preg_match('/^[a-z]+\.php\?/', $jump)) { 
         redirect(urldecode($jump));
     }
 
-    redirect($_SERVER['HTTP_REFERER']);
+    redirect($_SERVER['HTTP_REFERER']);   // Return to sender, just in case
 
 ?>

course/lib.php

@@ -243,25 +243,6 @@ function print_log_selector_form($course, $selecteduser=0, $selecteddate="today"
         $showcourses = 1;
     }
    
-
-    if ($course->category) {
-        if ($selectedgroup) {   // If using a group, only get users in that group.
-            $courseusers = get_group_users($selectedgroup, 'u.lastname ASC', '', 'u.id');
-        } else {
-            $courseusers = get_course_users($course->id, '', '', 'u.id');
-        }
-    } else {
-        $courseusers = get_site_users('u.lastaccess DESC', 'u.id');
-    }
-
-    $numusers = count((array)$courseusers);
-
-
-    if ($numusers < COURSE_MAX_USERS_PER_DROPDOWN && !$showusers) {
-        $showusers = 1;
-    }
-    
-
     /// Setup for group handling.
     $isteacher = isteacher($course->id);
     $isteacheredit = isteacheredit($course->id);
@@ -281,17 +262,21 @@ function print_log_selector_form($course, $selecteduser=0, $selecteddate="today"
     // Get all the possible users
     $users = array();
 
-    if ($showusers) {
-        if ($course->category) {
-            if ($selectedgroup) {   // If using a group, only get users in that group.
-                $courseusers = get_group_users($selectedgroup, 'u.lastname ASC', '', 'u.id, u.firstname, u.lastname');
-            } else {
-                $courseusers = get_course_users($course->id, '', '', 'u.id, u.firstname, u.lastname');
-            }
+    if ($course->category) {
+        if ($selectedgroup) {   // If using a group, only get users in that group.
+            $courseusers = get_group_users($selectedgroup, 'u.lastname ASC', '', 'u.id, u.firstname, u.lastname, u.idnumber');
         } else {
-            $courseusers = get_site_users("u.lastaccess DESC", "u.id, u.firstname, u.lastname");
+            $courseusers = get_course_users($course->id, '', '', 'u.id, u.firstname, u.lastname, u.idnumber');
         }
+    } else {
+        $courseusers = get_site_users("u.lastaccess DESC", "u.id, u.firstname, u.lastname, u.idnumber");
+    }
+    
+    if (count($courseusers) < COURSE_MAX_USERS_PER_DROPDOWN && !$showusers) {
+        $showusers = 1;
+    }
 
+    if ($showusers) {
         if ($courseusers) {
             foreach ($courseusers as $courseuser) {
                 $users[$courseuser->id] = fullname($courseuser, $isteacher);
@@ -1144,6 +1129,14 @@ function make_categories_list(&$list, &$parents, $category=NULL, $path="") {
 /// categories, building up a nice list for display.  It also makes
 /// an array that list all the parents for each category.
 
+    // initialize the arrays if needed
+    if (!is_array($list)) {
+        $list = array(); 
+    }
+    if (!is_array($parents)) {
+        $parents = array(); 
+    }
+
     if ($category) {
         if ($path) {
             $path = $path.' / '.$category->name;
@@ -1231,7 +1224,7 @@ function print_category_info($category, $depth) {
     if ($CFG->frontpage == FRONTPAGECOURSELIST) {
         $catimage = '<img src="'.$CFG->pixpath.'/i/course.gif" width="16" height="16" border="0" alt="" />';
     } else {
-        $catimage = "&nbsp";
+        $catimage = "&nbsp;";
     }
 
     echo "\n\n".'<table border="0" cellpadding="3" cellspacing="0" width="100%">';
@@ -1440,20 +1433,20 @@ function print_course_search($value="", $return=false, $format="plain") {
     if ($format == 'plain') {
         $output  = '<form name="coursesearch" action="'.$CFG->wwwroot.'/course/search.php" method="get">';
         $output .= '<center><p align="center" class="coursesearchbox">';
-        $output .= '<input type="text" size="30" name="search" alt="'.$strsearchcourses.'" value="'.$value.'" />';
-        $output .= '<input type="submit" value="'.$strsearchcourses.'" />';
+        $output .= '<input type="text" size="30" name="search" alt="'.s($strsearchcourses).'" value="'.s($value).'" />';
+        $output .= '<input type="submit" value="'.s($strsearchcourses).'" />';
         $output .= '</p></center></form>';
     } else if ($format == 'short') {
         $output  = '<form name="coursesearch" action="'.$CFG->wwwroot.'/course/search.php" method="get">';
         $output .= '<center><p align="center" class="coursesearchbox">';
-        $output .= '<input type="text" size="12" name="search" alt="'.$strsearchcourses.'" value="'.$value.'" />';
-        $output .= '<input type="submit" value="'.$strsearchcourses.'" />';
+        $output .= '<input type="text" size="12" name="search" alt="'.s($strsearchcourses).'" value="'.s($value).'" />';
+        $output .= '<input type="submit" value="'.s($strsearchcourses).'" />';
         $output .= '</p></center></form>';
     } else if ($format == 'navbar') {
         $output  = '<form name="coursesearch" action="'.$CFG->wwwroot.'/course/search.php" method="get">';
         $output .= '<table border="0" cellpadding="0" cellspacing="0"><tr><td nowrap="nowrap">';
-        $output .= '<input type="text" size="20" name="search" alt="'.$strsearchcourses.'" value="'.$value.'" />';
-        $output .= '<input type="submit" value="'.$strsearchcourses.'" />';
+        $output .= '<input type="text" size="20" name="search" alt="'.s($strsearchcourses).'" value="'.s($value).'" />';
+        $output .= '<input type="submit" value="'.s($strsearchcourses).'" />';
         $output .= '</td></tr></table>';
         $output .= '</form>';
     }
@@ -1607,6 +1600,22 @@ function move_section($course, $section, $move) {
     if (isset($USER->display[$course->id]) and ($USER->display[$course->id] == $section)) {
         course_set_display($course->id, $sectiondest);
     }
+
+    // Check for duplicates.
+    // There is a very rare case that some sections in the same course have the same section id.
+    if (($count_section = count_records('course_sections', 'course', $course->id) - 1) != $course->numsections) {
+        $sections = get_records_select('course_sections', "course = $course->id AND section > 0", 'section ASC');
+        $n = 1;
+        foreach ($sections as $section) {
+            if (!set_field('course_sections', 'section', $n, 'id', $section->id)) {
+                return false;
+            }
+            $n++;
+        }
+        if (!set_field('course', 'numsections', $count_section, 'id', $course->id)) {
+            return false;
+        }
+    }
     return true;
 }
 

course/loginas.php

@@ -77,9 +77,8 @@
     $strloginas    = get_string("loginas");
     $strloggedinas = get_string("loggedinas", "", $student_name);
 
-    print_header("$course->fullname: $strloginas $student_name", "$course->fullname", 
-                 "<a href=\"$CFG->wwwroot/course/view.php?id=$course->id\">$course->shortname</a> -> 
-                  $strloginas $student_name");
+    print_header_simple("$strloginas $student_name", '', "$strloginas $student_name", '', '', 
+                       true, '&nbsp;', navmenu($course));
     notice($strloggedinas, "$CFG->wwwroot/course/view.php?id=$course->id");
 
 

course/loglive.php

@@ -4,7 +4,8 @@
     require_once("../config.php");
     require_once("lib.php");
 
-    require_variable($id);
+    $id   = required_param('id', PARAM_INT);
+    $page = optional_param('page', 0, PARAM_INT);     // which page to show
 
     require_login();
 
@@ -28,12 +29,12 @@
     $strupdatesevery = get_string("updatesevery", "moodle", COURSE_LIVELOG_REFRESH);
 
     print_header("$strlivelogs ($strupdatesevery)", "$strlivelogs", "", "", 
-                 '<meta http-equiv="Refresh" content="'.COURSE_LIVELOG_REFRESH.'; url=loglive.php?id='.$id.'" />');
+                 '<meta http-equiv="Refresh" content="'.COURSE_LIVELOG_REFRESH.'; url=loglive.php?id='.$course->id.'" />');
 
     $user=0;
     $date=time() - 3600;
 
-    print_log($course, $user, $date, "l.time DESC", 0, 500, 
+    print_log($course, $user, $date, "l.time DESC", $page, 500,
               "loglive.php?id=$course->id&amp;user=$user&amp;date=$date");
 
     print_footer($course);

course/mod.php

@@ -29,14 +29,29 @@
 
     if (isset($_POST["course"]) and confirm_sesskey()) {    // add or update form submitted
 
-        if (!$course = get_record("course", "id", $mod->course)) {
-            error("This course doesn't exist");
+        if (empty($mod->coursemodule)) { //add
+            if (! $course = get_record("course", "id", $mod->course)) {
+                error("This course doesn't exist");
+            }
+            $mod->instance = '';
+            $mod->coursemodule = '';
+        } else { //delete and update
+            if (! $cm = get_record("course_modules", "id", $mod->coursemodule)) {
+                error("This course module doesn't exist");
+            }
+
+            if (! $course = get_record("course", "id", $cm->course)) {
+                error("This course doesn't exist");
+            }
+            $mod->instance = $cm->instance;
+            $mod->coursemodule = $cm->id;
         }
 
         if (!isteacheredit($course->id)) {
             error("You can't modify this course!");
         }
-
+        
+        $mod->course = $course->id;
         $mod->modulename = clean_filename($mod->modulename);  // For safety
         $modlib = "$CFG->dirroot/mod/$mod->modulename/lib.php";
 
@@ -239,6 +254,10 @@
             error("This course module doesn't exist");
         }
 
+        if (!isteacheredit($cm->course)) {
+            error("You can't modify this course!");
+        }
+
         $cm->indent += $_GET['indent'];
 
         if ($cm->indent < 0) {
@@ -603,10 +622,10 @@
             $defaultformat = FORMAT_MOODLE;
         }
 
-        $icon = "<img align=\"middle\" height=\"16\" width=\"16\" src=\"$CFG->modpixpath/$module->name/icon.gif\" alt=\"\" />&nbsp;";
+        $icon = '<img align="middle" height="16" width="16" src="'.$CFG->modpixpath.'/'.$module->name.'/icon.gif" alt="" style="vertical-align: middle;" />&nbsp;';
 
         print_heading_with_help($pageheading, "mods", $module->name, $icon);
-        print_simple_box_start("center");
+        print_simple_box_start('center', '', '', 5, 'generalbox', $module->name);
         include_once($modform);
         print_simple_box_end();
 

course/recent.php

@@ -8,7 +8,7 @@
     require_variable($id);
 
     $user          = optional_param('user', '0', PARAM_INT);
-    $sortby        = optional_param('user', 'default');
+    $sortby        = optional_param('sortby', 'default', PARAM_ALPHA);
     $selectedgroup = optional_param('selectedgroup', '');
 
     if (! $course = get_record("course", "id", $id) ) {

course/search.php

@@ -5,11 +5,11 @@
     require_once("../config.php");
     require_once("lib.php");
 
-    optional_variable($search, "");    // search words
-    optional_variable($page, "0");     // which page to show
-    optional_variable($perpage, "10"); // how many per page
+    $search  = optional_param('search', '', PARAM_RAW);  // search words
+    $page    = optional_param('page', 0, PARAM_INT);     // which page to show
+    $perpage = optional_param('perpage', 10, PARAM_INT); // how many per page
 
-    $search = trim(strip_tags($search));
+    $search = trim(strip_tags($search)); // trim & clean raw searched string
 
     if ($search) {
         $searchterms = explode(" ", $search);    // Search for words independently
@@ -55,7 +55,7 @@
     $searchform = print_course_search($search, true, "navbar");
 
     print_header("$site->fullname : $strsearchresults", $site->fullname, 
-                 "<a href=\"index.php\">$strcourses</a> -> <a href=\"search.php\">$strsearch</a> -> '$search'", "", "", "", $searchform);
+                 "<a href=\"index.php\">$strcourses</a> -> <a href=\"search.php\">$strsearch</a> -> '".s($search)."'", "", "", "", $searchform);
 
 
     $lastcategory = -1;
@@ -64,7 +64,8 @@
 
         print_heading("$strsearchresults: $totalcount");
 
-        print_paging_bar($totalcount, $page, $perpage, "search.php?search=$search&amp;perpage=$perpage&");
+        $encodedsearch = urlencode(stripslashes($search));
+        print_paging_bar($totalcount, $page, $perpage, "search.php?search=$encodedsearch&amp;perpage=$perpage&");
 
         foreach ($courses as $course) {
             $course->fullname = highlight("$search", $course->fullname);
@@ -77,10 +78,10 @@
             print_spacer(5,5);
         }
 
-        print_paging_bar($totalcount, $page, $perpage, "search.php?search=$search&amp;perpage=$perpage&");
+        print_paging_bar($totalcount, $page, $perpage, "search.php?search=$encodedsearch&amp;perpage=$perpage&");
 
     } else {
-        print_heading(get_string("nocoursesfound", "", $search));
+        print_heading(get_string("nocoursesfound", "", s($search)));
     }
 
     echo "<br /><br />";

course/student.html

@@ -2,7 +2,7 @@
 <form name="studentform" id="studentform" method="post" action="student.php">
 <input type="hidden" name="previoussearch" value="<?php echo $previoussearch ?>" />
 <input type="hidden" name="sesskey" value="<?php echo $sesskey ?>" />
-<input type="hidden" name="id" value="<?php echo $id?>" />
+<input type="hidden" name="id" value="<?php echo $course->id ?>" />
   <table align="center" border="0" cellpadding="5" cellspacing="0">
     <tr>
       <td valign="top">
@@ -63,16 +63,18 @@
                           .'<optgroup label="'.get_string('trysearching').'"><option></option></optgroup>'."\n";
                   }
                   else {
-                      foreach ($users as $user) {
-                          $fullname = fullname($user, true);
-                          echo "<option value=\"$user->id\">".$fullname.", ".$user->email."</option>\n";
+                      if ($usercount > 0) {    //fix for bug#4455
+                          foreach ($users as $user) {
+                              $fullname = fullname($user, true);
+                              echo "<option value=\"$user->id\">".$fullname.", ".$user->email."</option>\n";
+                          }
                       }
                   }
               }
           ?>
          </select>
          <br />
-         <input type="text" name="searchtext" size="30" value="<?php echo $searchtext ?>" 
+         <input type="text" name="searchtext" size="30" value="<?php p($searchtext) ?>" 
                   onFocus ="document.studentform.add.disabled=true;
                             document.studentform.remove.disabled=true;
                             document.studentform.removeselect.selectedIndex=-1;

course/teacher.php

@@ -55,16 +55,6 @@
     }
 
 
-
-/// Print headers
-
-    print_header("$course->shortname: $strassignteachers", 
-                 "$course->fullname", 
-                 "<a href=\"index.php\">$strcourses</a> -> ".
-                 "<a href=\"view.php?id=$course->id\">$course->shortname</a> -> ".
-                 "$strassignteachers", "");
-
-
 /// If data submitted, then process and store.
 
     if ($form = data_submitted() and confirm_sesskey()) {
@@ -94,6 +84,14 @@
         redirect("teacher.php?id=$course->id", get_string("changessaved"));
     }
 
+/// Print headers
+
+    print_header("$course->shortname: $strassignteachers", 
+                 "$course->fullname", 
+                 "<a href=\"index.php\">$strcourses</a> -> ".
+                 "<a href=\"view.php?id=$course->id\">$course->shortname</a> -> ".
+                 "$strassignteachers", "");
+
 /// Add a teacher if one is specified
 
     if (!empty($_GET['add']) and confirm_sesskey()) {
@@ -158,7 +156,7 @@
             }
     
             $table->data[] = array ($picture, fullname($teacher, true), $authority,
-                                    "<input type=\"text\" name=\"r$teacher->id\" value=\"$teacher->role\" size=\"30\" />",
+                                    "<input type=\"text\" name=\"r$teacher->id\" value=\"$teacher->role\" size=\"30\" maxlength=\"40\" />",
                                     $editall, $removelink);
         }
         $teacherlist = implode(",",$teacherarray);

course/unenrol.php

@@ -24,7 +24,7 @@
         error("You must be a teacher with editing rights to do this");
     }
 
-    if ($user->id == $USER->id and !$CFG->allowunenroll) {
+    if ($user->id == $USER->id and !$CFG->allowunenroll or $course->metacourse) {
         error("You are not allowed to unenroll");
     }
 

course/user.php

@@ -185,7 +185,7 @@ function print_outline_row($mod, $instance, $result) {
     }
     echo "</td>";
     echo "<td>&nbsp;&nbsp;&nbsp;</td>";
-    if (isset($result->time)) {
+    if (!empty($result->time)) {
         $timeago = format_time(time() - $result->time);
         echo "<td valign=\"top\" nowrap=\"nowrap\">".userdate($result->time)." ($timeago)</td>";
     }

course/view.php

@@ -11,8 +11,8 @@
     $edit        = optional_param('edit');
     $idnumber    = optional_param('idnumber');
 
-    if (empty($id) && empty($name)) {
-        error("Must specify course id or short name");
+    if (empty($id) && empty($name) && empty($idnumber)) {
+        error("Must specify course id, short name or idnumber");
     }
 
     if (!empty($name)) {

enrol/authorize/ccval.php

@@ -1,128 +1,126 @@
 <?php // $Id$
 /************************************************************************
- *
- * CCVal - Credit Card Validation function.
- *
- * Copyright (c) 1999, 2003 Holotech Enterprises. All rights reserved.
- * You may freely modify and use this function for your own purposes. You
- * may freely distribute it, without modification and with this notice
- * and entire header intact.
- *
- * This function accepts a credit card number and, optionally, a code for
- * a credit card name. If a Name code is specified, the number is checked
- * against card-specific criteria, then validated with the Luhn Mod 10
- * formula. Otherwise it is only checked against the formula. Valid name
- * codes are:
- *
- *    mcd - Master Card
- *    vis - Visa
- *    amx - American Express
- *    dsc - Discover
- *    dnc - Diners Club
- *    jcb - JCB
- *    swi - Switch
- *    dlt - Delta
- *    enr - EnRoute
- *
- * You can also optionally specify an expiration date in the formay mmyy.
- * If the validation fails on the date, the function returns 0. If it
- * fails on the number validation, it returns false.
- *
- * A description of the criteria used in this function can be found at
- * http://www.paylib.net/ccval.html. If you have any questions or
- * comments, please direct them to ccval@holotech.net
- *
- *                                          Alan Little
- *                                          Holotech Enterprises
- *                                          http://www.holotech.net/
- *                                          August 2003
- *
- ************************************************************************/
+*
+* CCVal - Credit Card Validation function.
+*
+* Copyright (c) 1999, 2003 Holotech Enterprises. All rights reserved.
+* You may freely modify and use this function for your own purposes. You
+* may freely distribute it, without modification and with this notice
+* and entire header intact.
+*
+* This function accepts a credit card number and, optionally, a code for
+* a credit card name. If a Name code is specified, the number is checked
+* against card-specific criteria, then validated with the Luhn Mod 10
+* formula. Otherwise it is only checked against the formula. Valid name
+* codes are:
+*
+*    mcd - Master Card
+*    vis - Visa
+*    amx - American Express
+*    dsc - Discover
+*    dnc - Diners Club
+*    jcb - JCB
+*    swi - Switch
+*    dlt - Delta
+*    enr - EnRoute
+*
+* You can also optionally specify an expiration date in the formay mmyy.
+* If the validation fails on the date, the function returns 0. If it
+* fails on the number validation, it returns false.
+*
+* A description of the criteria used in this function can be found at
+* http://www.paylib.net/ccval.html. If you have any questions or
+* comments, please direct them to ccval@holotech.net
+*
+*                                          Alan Little
+*                                          Holotech Enterprises
+*                                          http://www.holotech.net/
+*                                          August 2003
+*
+************************************************************************/
 
-  function CCVal($Num, $Name = "n/a", $Exp = "") {
-
-//  Check the expiration date first
-    if (strlen($Exp)) {
-      $Month = substr($Exp, 0, 2);
-      $Year  = substr($Exp, -2);
-
-      $WorkDate = "$Month/01/$Year";
-      $WorkDate = strtotime($WorkDate);
-      $LastDay  = date("t", $WorkDate);
-
-      $Expires  = strtotime("$Month/$LastDay/$Year 11:59:59");
-      if ($Expires < time()) return 0;
+function CCVal($Num, $Name = "n/a", $Exp = "")
+{
+    // Check the expiration date first
+    if (strlen($Exp))
+    {
+        $Month = substr($Exp, 0, 2);
+        $Year  = substr($Exp, -2);
+        $WorkDate = "$Month/01/$Year";
+        $WorkDate = strtotime($WorkDate);
+        $LastDay  = date("t", $WorkDate);
+        $Expires  = strtotime("$Month/$LastDay/$Year 11:59:59");
+        if ($Expires < time()) return 0;
     }
 
-//  Innocent until proven guilty
+    //  Innocent until proven guilty
     $GoodCard = true;
 
-//  Get rid of any non-digits
+    //  Get rid of any non-digits
     $Num = ereg_replace("[^0-9]", "", $Num);
 
-//  Perform card-specific checks, if applicable
-    switch ($Name) {
+    // Perform card-specific checks, if applicable
+    switch ($Name)
+    {
+        case "mcd" :
+        $GoodCard = ereg("^5[1-5].{14}$", $Num);
+        break;
 
-    case "mcd" :
-      $GoodCard = ereg("^5[1-5].{14}$", $Num);
-      break;
+        case "vis" :
+        $GoodCard = ereg("^4.{15}$|^4.{12}$", $Num);
+        break;
 
-    case "vis" :
-      $GoodCard = ereg("^4.{15}$|^4.{12}$", $Num);
-      break;
+        case "amx" :
+        $GoodCard = ereg("^3[47].{13}$", $Num);
+        break;
 
-    case "amx" :
-      $GoodCard = ereg("^3[47].{13}$", $Num);
-      break;
+        case "dsc" :
+        $GoodCard = ereg("^6011.{12}$", $Num);
+        break;
 
-    case "dsc" :
-      $GoodCard = ereg("^6011.{12}$", $Num);
-      break;
+        case "dnc" :
+        $GoodCard = ereg("^30[0-5].{11}$|^3[68].{12}$", $Num);
+        break;
 
-    case "dnc" :
-      $GoodCard = ereg("^30[0-5].{11}$|^3[68].{12}$", $Num);
-      break;
+        case "jcb" :
+        $GoodCard = ereg("^3.{15}$|^2131|1800.{11}$", $Num);
+        break;
 
-    case "jcb" :
-      $GoodCard = ereg("^3.{15}$|^2131|1800.{11}$", $Num);
-      break;
-  
-    case "dlt" :
-      $GoodCard = ereg("^4.{15}$", $Num);
-      break;
+        case "dlt" :
+        $GoodCard = ereg("^4.{15}$", $Num);
+        break;
 
-    case "swi" :
-      $GoodCard = ereg("^[456].{15}$|^[456].{17,18}$", $Num);
-      break;
+        case "swi" :
+        $GoodCard = ereg("^[456].{15}$|^[456].{17,18}$", $Num);
+        break;
 
-    case "enr" :
-      $GoodCard = ereg("^2014.{11}$|^2149.{11}$", $Num);
-      break;
+        case "enr" :
+        $GoodCard = ereg("^2014.{11}$|^2149.{11}$", $Num);
+        break;
     }
 
-//  The Luhn formula works right to left, so reverse the number.
+    // The Luhn formula works right to left, so reverse the number.
     $Num = strrev($Num);
-
     $Total = 0;
 
-    for ($x=0; $x<strlen($Num); $x++) {
-      $digit = substr($Num,$x,1);
+    for ($x=0; $x < strlen($Num); $x++)
+    {
+        $digit = substr($Num, $x, 1);
 
-//    If it's an odd digit, double it
-      if ($x/2 != floor($x/2)) {
-        $digit *= 2;
+        // If it's an odd digit, double it
+        if ($x/2 != floor($x/2)) {
+            $digit *= 2;
 
-//    If the result is two digits, add them
-        if (strlen($digit) == 2)
-          $digit = substr($digit,0,1) + substr($digit,1,1);
-      }
-
-//    Add the current digit, doubled and added if applicable, to the Total
-      $Total += $digit;
+            // If the result is two digits, add them
+            if (strlen($digit) == 2)
+                $digit = substr($digit, 0, 1) + substr($digit, 1, 1);
+        }
+        // Add the current digit, doubled and added if applicable, to the Total
+        $Total += $digit;
     }
 
-//  If it passed (or bypassed) the card-specific check and the Total is
-//  evenly divisible by 10, it's cool!
-    if ($GoodCard && $Total % 10 == 0) return true; else return false;
-  }
-?>
+    // If it passed (or bypassed) the card-specific check and the Total is
+    // evenly divisible by 10, it's cool!
+    return ($GoodCard && $Total % 10 == 0);
+}
+?>

enrol/authorize/config.html

@@ -13,13 +13,34 @@
 <tr valign="top">
     <td align="right">enrol_currency:</td>
     <td>
-    <?php choose_from_menu ($ancurrencies, "enrol_currency", $frm->enrol_currency, "","", "") ?>
+    <?php
+      $ancurrencies = array(
+        'USD' => 'US Dollars',
+        'EUR' => 'Euros',
+        'JPY' => 'Japanese Yen',
+        'GBP' => 'British Pounds',
+        'CAD' => 'Canadian Dollars'
+      );
+     choose_from_menu ($ancurrencies, "enrol_currency", $frm->enrol_currency, "","", "") ?>
     </td>
     <td>
     <?php  print_string("currency") ?>
     </td>
 </tr>
 
+<tr valign="top">
+    <td align="right">loginhttps:</td>
+    <td>
+    <?php  echo (empty($CFG->loginhttps) ? "<font color=\"red\">off</font>" : "<font color=\"green\">on</font>") ?>
+    </td>
+    <td>
+    <?php
+     $a->url = "$CFG->wwwroot/$CFG->admin/config.php#configsectionsecurity";
+     print_string("logindesc", "enrol_authorize", $a)
+    ?>
+    </td>
+</tr>
+
 <tr valign="top"><td colspan="3"><hr noshade="noshade" size="1"></td></tr>
 
 <tr valign="top">
@@ -52,7 +73,7 @@
 <tr valign="top">
     <td align="right">an_password:</td>
     <td>
-        <input type="text" name="an_password" value="<?php p($frm->an_password) ?>" />
+        <input type="password" name="an_password" value="<?php p($frm->an_password) ?>" />
     </td>
     <td>
     <?php  print_string("anpassword", "enrol_authorize") ?>
@@ -69,6 +90,16 @@
     </td>
 </tr>
 
+<tr valign="top">
+    <td align="right">an_avs:</td>
+    <td>
+        <input type="checkbox" value="1" name="an_avs" <?php if (!empty($frm->an_avs)) echo "checked=\"true\"" ?> />
+    </td>
+    <td>
+    <?php  print_string("adminavs", "enrol_authorize") ?>
+    </td>
+</tr>
+
 <tr valign="top">
     <td align="right">an_test:</td>
     <td>
@@ -111,14 +142,4 @@
     </td>
 </tr>
 
-<tr valign="top">
-    <td align="right">enrol_allowinternal:</td>
-    <td>
-        <input type="checkbox" value="1" name="enrol_allowinternal" <?php if (!empty($frm->enrol_allowinternal)) echo "checked=\"true\"" ?> />
-    </td>
-    <td>
-    <?php  print_string('allowinternal') ?>
-    </td>
-</tr>
-
 </table>

enrol/authorize/db/mysql.php

@@ -1,19 +1,33 @@
-<?PHP  //$Id$
-
-// MySQL commands for upgrading this enrolment module
-
-function authorize_upgrade($oldversion=0) {
-
-    global $CFG, $THEME, $db;
-
-    $result = true;
-
-    if ($oldversion == 0) {
-        modify_database("$CFG->dirroot/enrol/authorize/db/mysql.sql");
-    }
-
-    return $result;
-
-}
-
-?>
+<?PHP  //$Id$
+
+// MySQL commands for upgrading this enrolment module
+
+function authorize_upgrade($oldversion=0) {
+    global $CFG, $THEME, $db;
+
+    $result = true;
+
+    if ($oldversion == 0 || !in_array($CFG->prefix . 'enrol_authorize', $db->MetaTables('TABLES'))) {
+        $result = modify_database("$CFG->dirroot/enrol/authorize/db/mysql.sql");
+        return $result; // SQL file contains all upgrades.
+    }
+
+    if ($oldversion < 2005071601) {
+        // Be sure, only last 4 digit is inserted.
+        table_column('enrol_authorize', 'cclastfour', 'cclastfour', 'integer', '4', 'unsigned', '0', 'not null');
+        table_column('enrol_authorize', 'courseid', 'courseid', 'integer', '10', 'unsigned', '0', 'not null');
+        table_column('enrol_authorize', 'userid', 'userid', 'integer', '10', 'unsigned', '0', 'not null');
+        // Add some indexes for speed.
+        execute_sql("ALTER TABLE `{$CFG->prefix}enrol_authorize` ADD INDEX courseid(courseid)", false);
+        execute_sql("ALTER TABLE `{$CFG->prefix}enrol_authorize` ADD INDEX userid(userid)", false);
+    }
+
+    if ($oldversion && $oldversion < 2005071602) {
+        notify("If you are using the authorize.net enrolment plugin for credit card 
+                handling, please ensure that you have turned loginhttps ON in Admin >> Variables >> Security.");
+    }
+
+    return $result;
+}
+
+?>

enrol/authorize/db/mysql.sql

@@ -1,12 +1,14 @@
-CREATE TABLE `prefix_enrol_authorize` (
-  `id` int(10) unsigned NOT NULL auto_increment,
-  `cclastfour` int(11) default '0',
-  `ccexp` varchar(6) default '',
-  `cvv` varchar(4) default '',
-  `ccname` varchar(255) default '',
-  `courseid` int(11) NOT NULL default '0',
-  `userid` int(11) NOT NULL default '0',
-  `avscode` char(1) default 'P',
-  `transid` varchar(255) default '',
-  PRIMARY KEY  (`id`)
-) TYPE=MyISAM COMMENT='Holds all known information about creditcard transactions';
+CREATE TABLE `prefix_enrol_authorize` (
+  `id` int(10) unsigned NOT NULL auto_increment,
+  `cclastfour` int(4) unsigned NOT NULL default '0',
+  `ccexp` varchar(6) default '',
+  `cvv` varchar(4) default '',
+  `ccname` varchar(255) NOT NULL default '',
+  `courseid` int(10) unsigned NOT NULL default '0',
+  `userid` int(10) unsigned NOT NULL default '0',
+  `avscode` char(1) default 'P',
+  `transid` varchar(255) default '',
+  PRIMARY KEY  (`id`),
+  KEY `courseid` (`courseid`),
+  KEY `userid` (`userid`)
+) TYPE=MyISAM COMMENT='Holds all known information about creditcard transactions';

enrol/authorize/db/postgres7.php

@@ -7,33 +7,24 @@ function authorize_upgrade($oldversion=0) {
 
     $result = true;
 
-    if ($oldversion == 0) {
-        modify_database("$CFG->dirroot/enrol/authorize/db/postgres7.sql");
+    if ($oldversion == 0 || !in_array($CFG->prefix . 'enrol_authorize', $db->MetaTables('TABLES'))) {
+        $result = modify_database("$CFG->dirroot/enrol/authorize/db/postgres7.sql");
+        return $result; // SQL file contains all upgrades.
     }
 
-    if ($oldversion < 2005080200) {
+    if ($oldversion < 2005071601) {
         // Be sure, only last 4 digit is inserted.
         table_column('enrol_authorize', 'cclastfour', 'cclastfour', 'integer', '4', 'unsigned', '0', 'not null');
         table_column('enrol_authorize', 'courseid', 'courseid', 'integer', '10', 'unsigned', '0', 'not null');
         table_column('enrol_authorize', 'userid', 'userid', 'integer', '10', 'unsigned', '0', 'not null');
         // Add some indexes for speed.
-        modify_database('',"CREATE INDEX prefix_enrol_authorize_courseid_idx ON prefix_enrol_authorize (courseid);");
-        modify_database('',"CREATE INDEX prefix_enrol_authorize_userid_idx ON prefix_enrol_authorize (userid);");
+        execute_sql("CREATE INDEX {$CFG->prefix}enrol_authorize_courseid_idx ON {$CFG->prefix}enrol_authorize (courseid);", false);
+        execute_sql("CREATE INDEX {$CFG->prefix}enrol_authorize_userid_idx ON {$CFG->prefix}enrol_authorize (userid);", false);
     }
-    
-    if ($oldversion < 2005112100) {
-        include_once("$CFG->dirroot/enrol/authorize/enrol.php");
 
-        table_column('enrol_authorize', '', 'authcode', 'varchar', '6', '', '', '', 'avscode'); // CAPTURE_ONLY
-        table_column('enrol_authorize', '', 'status', 'integer', '10', 'unsigned', '0', 'not null', 'transid');
-        table_column('enrol_authorize', '', 'timecreated', 'integer', '10', 'unsigned', '0', 'not null', 'status');
-        table_column('enrol_authorize', '', 'timeupdated', 'integer', '10', 'unsigned', '0', 'not null', 'timecreated');
-        // status index for speed.
-        modify_database('',"CREATE INDEX prefix_enrol_authorize_status_idx ON prefix_enrol_authorize (status);");
-        // defaults.
-        $timenow = time();
-        $status = AN_STATUS_AUTH | AN_STATUS_CAPTURE;
-        execute_sql(" UPDATE {$CFG->prefix}enrol_authorize SET timecreated='$timenow', timeupdated='$timenow', status='$status' ", false);
+    if ($oldversion && $oldversion < 2005071602) {
+        notify("If you are using the authorize.net enrolment plugin for credit card 
+                handling, please ensure that you have turned loginhttps ON in Admin >> Variables >> Security.");
     }
     
     return $result;

enrol/authorize/db/postgres7.sql

@@ -1,11 +1,14 @@
 CREATE TABLE prefix_enrol_authorize (
    id SERIAL PRIMARY KEY,
-   cclastfour integer default '0',
+   cclastfour integer DEFAULT 0 NOT NULL,
    ccexp varchar(6) default '',
    cvv varchar(4) default '',
    ccname varchar(255) default '',
-   courseid integer NOT NULL default '0',
-   userid integer NOT NULL default '0',
+   courseid integer DEFAULT 0 NOT NULL,
+   userid integer DEFAULT 0 NOT NULL,
    avscode varchar(1) default 'P',
    transid varchar(255) default ''
-);
+);
+
+CREATE INDEX prefix_enrol_authorize_courseid_idx ON prefix_enrol_authorize(courseid);
+CREATE INDEX prefix_enrol_authorize_userid_idx ON prefix_enrol_authorize(userid);

enrol/authorize/enrol.html

@@ -1,4 +1,4 @@
-<p align="center"><?php if (! empty($this->errormsg)) {formerr($this->errormsg);} ?></p>
+<p align="center"><?php if (! empty($this->ccerrormsg)) {formerr($this->ccerrormsg);} ?></p>
 
 <div align="center">
 
@@ -24,12 +24,29 @@
     for ($i=1; $i<=12; $i++) {
         $months[$i] = userdate(gmmktime(12,0,0,$i,1,2000), "%B");
     }
-    choose_from_menu($months, 'ccexpiremm', $form->ccexpiremm, '');
-    ?> <input type="text" name="ccexpireyyyy" size="4" maxlength="4" value="<?php p($form->ccexpireyyyy) ?>"  /></td>
+    choose_from_menu($months, 'ccexpiremm', $form->ccexpiremm);
+    $nowdate = getdate();
+    $nowyear = $nowdate["year"]-1;
+    for ($i=$nowyear; $i<=$nowyear+11; $i++) {
+        $years[$i] = $i;
+    }
+    choose_from_menu($years, 'ccexpireyyyy', $form->ccexpireyyyy);
+    ?></td>
 </tr>
 <tr>
   <td align="right"><?php print_string("cctype", "enrol_authorize") ?>: </td>
   <td align="left"><?php
+  $CCTYPES = array(
+        'mcd' => 'Master Card',
+        'vis' => 'Visa',
+        'amx' => 'American Express',
+        'dsc' => 'Discover',
+        'dnc' => 'Diners Club',
+        'jcb' => 'JCB',
+        'swi' => 'Switch',
+        'dlt' => 'Delta',
+        'enr' => 'EnRoute'
+  );
   choose_from_menu($CCTYPES, 'cctype', $form->cctype);
   ?>
 </td>
@@ -39,6 +56,21 @@
   <td align="left"><input type="text" name="cvv" size="4" maxlength="4" value="<?php p($form->cvv) ?>" />
                    <font size=1><?php print_string("ccvvhelp", "enrol_authorize") ?></font></td>
 </tr>
+<?php if (!empty($CFG->an_avs)) { /* Address Verification System */ ?>
+<tr>
+  <td align="right"><?php print_string("address") ?>: </td>
+  <td align="left"><input type="text" name="ccaddress" size="32" value="<?php p($useraddress) ?>"  /></td>
+</tr>
+<tr>
+  <td align="right"><?php print_string("city") ?> / <?php print_string("state") ?>: </td>
+  <td align="left"><input type="text" name="cccity" size="16" value="<?php p($usercity) ?>" /> /
+                   <input type="text" name="ccstate" size="2" maxlength="2" value="<?php p($form->ccstate) ?>" /></td>
+</tr>
+<tr>
+  <td align="right"><?php print_string("country") ?>: </td>
+  <td align="left"><?php choose_from_menu(get_list_of_countries(), "cccountry", $usercountry, get_string("selectacountry")."..."); ?></td>
+</tr>
+<?php } ?>
 <tr>
   <td align="right"><?php print_string("zipcode", "enrol_authorize") ?>: </td>
   <td align="left"><input type="text" name="cczip" size="5" value="<?php p($form->cczip) ?>" /></td>

enrol/authorize/enrol.php

@@ -14,454 +14,447 @@ require_once("$CFG->dirroot/enrol/enrol.class.php");
 
 class enrolment_plugin extends enrolment_base {
 
-/// Override: print_entry()
-function print_entry($course) {
-    global $CFG, $USER, $form;
+    var $ccerrormsg;
 
-    if ($this->zero_cost($course)) {
-        if (!empty($CFG->enrol_allowinternal)) {
+    /// Override: print_entry()
+    function print_entry($course) {
+        global $CFG, $USER, $form;
+
+        if ($this->zero_cost($course) || isguest()) {
             parent::print_entry($course);
-        } else {
-            print_header();
-            notice(get_string("enrolmentnointernal"), $CFG->wwwroot);
+            return;
         }
-    } else {
-        // check payment
+
+        // check paid?
         $this->check_paid();
 
-        if ((!empty($CFG->loginhttps)) && (!isset($_SERVER['HTTPS']))) {
-            $wwwsroot = str_replace('http://','https://', $CFG->wwwroot);
-            $sdestination = "$wwwsroot/course/enrol.php?id=$course->id";
-            redirect($sdestination);
-            exit;
+        // I want to paid on SSL.
+        if (empty($_SERVER['HTTPS']) || $_SERVER['HTTPS'] == 'off') {
+            if (empty($CFG->loginhttps)) {
+                error(get_string("httpsrequired", "enrol_authorize"));
+            } else {
+                $wwwsroot = str_replace('http://','https://', $CFG->wwwroot);
+                $sdestination = "$wwwsroot/course/enrol.php?id=$course->id";
+                redirect($sdestination);
+                exit;
+            }
         }
 
+        $formvars = array('password', 'ccfirstname','cclastname','cc','ccexpiremm','ccexpireyyyy','cctype','cvv',
+                          'ccaddress', 'cccity', 'ccstate', 'cccountry', 'cczip');
+        foreach ($formvars as $var) {
+            if (!isset($form->$var)) {
+                $form->$var = '';
+            }
+        }
+
+        $teacher = get_teacher($course->id);
+        $cost = $this->get_course_cost($course);
         $strloginto = get_string("loginto", "", $course->shortname);
         $strcourses = get_string("courses");
-        $teacher = get_teacher($course->id);
+        $userfirstname = empty($form->ccfirstname) ? $USER->firstname : $form->ccfirstname;
+        $userlastname = empty($form->cclastname) ? $USER->lastname : $form->cclastname;
+        $useraddress = empty($form->ccaddress) ? $USER->address : $form->ccaddress;
+        $usercity = empty($form->cccity) ? $USER->city : $form->cccity;
+        $usercountry = empty($form->cccountry) ? $USER->country : $form->cccountry;
 
         print_header($strloginto, $course->fullname, "<a href=\"$CFG->wwwroot/course/\">$strcourses</a> -> $strloginto");
         print_course($course, "80%");
+
+        if ($course->password) {
+            print_simple_box(get_string('choosemethod', 'enrol_authorize'), 'center');
+            $password = '';
+            include($CFG->dirroot . '/enrol/internal/enrol.html');
+        }
+
         print_simple_box_start("center");
+        include($CFG->dirroot . '/enrol/authorize/enrol.html');
+        print_simple_box_end();
 
-        $coursefullname	= $course->fullname;
-        $courseshortname= $course->shortname;
-        $userfirstname	= $USER->firstname;
-        $userlastname	= $USER->lastname;
-        $useraddress	= $USER->address;
-        $usercity		= $USER->city;
-        $cost			= $this->get_course_cost($course);
+        print_footer();
+    }
 
-        $CCTYPES = array(
-            'mcd' => 'Master Card',
-            'vis' => 'Visa',
-            'amx' => 'American Express',
-            'dsc' => 'Discover',
-            'dnc' => 'Diners Club',
-            'jcb' => 'JCB',
-            'swi' => 'Switch',
-            'dlt' => 'Delta',
-            'enr' => 'EnRoute'
+    /// Override: check_entry()
+    function check_entry($form, $course) {
+        if ($this->zero_cost($course) || (!empty($form->password)) || isguest()) {
+            parent::check_entry($form, $course);
+        } else {
+            $this->cc_submit($form, $course);
+        }
+    }
+
+    function cc_submit($form, $course)
+    {
+        global $CFG, $USER, $SESSION;
+        require_once($CFG->dirroot . '/enrol/authorize/ccval.php');
+
+        if (empty($form->ccfirstname) || empty($form->cclastname) ||
+            empty($form->cc) || empty($form->cvv) || empty($form->cctype) ||
+            empty($form->ccexpiremm) || empty($form->ccexpireyyyy)) {
+            $this->ccerrormsg = get_string("allfieldsrequired");
+            return;
+        }
+
+        if (!empty($CFG->an_avs)) {
+            if (empty($form->ccaddress) || empty($form->cccity) ||
+                empty($form->cccountry) || empty($form->cczip)) {
+                $this->ccerrormsg = get_string("allfieldsrequired");
+                return;
+            }
+        }
+
+        $exp_date = (($form->ccexpiremm<10) ? strval('0'.$form->ccexpiremm) : strval($form->ccexpiremm)) . ($form->ccexpireyyyy);
+        $valid_cc = CCVal($form->cc, $form->cctype, $exp_date);
+        if (!$valid_cc) {
+            $this->ccerrormsg = get_string((($valid_cc===0) ? 'ccexpired' : 'ccinvalid'), 'enrol_authorize');
+            return;
+        }
+
+        $this->check_paid();
+        $order_number = 0; // can be get from db
+        $cost = $this->get_course_cost($course);
+        $formdata = array (
+            'x_version'         => '3.1',
+            'x_delim_data'      => 'True',
+            'x_delim_char'      => AN_DELIM,
+            'x_encap_char'      => AN_ENCAP,
+            'x_relay_response'  => 'False',
+            'x_login'           => $CFG->an_login,
+            'x_test_request'    => (!empty($CFG->an_test)) ? 'True' : 'False',
+            'x_type'            => 'AUTH_CAPTURE',
+            'x_method'          => 'CC',
+            'x_first_name'      => $form->ccfirstname,
+            'x_last_name'       => $form->cclastname,
+            'x_address'         => $form->ccaddress,
+            'x_city'            => $form->cccity,
+            'x_zip'             => $form->cczip,
+            'x_country'         => $form->cccountry,
+            'x_state'           => $form->ccstate,
+            'x_card_num'        => $form->cc,
+            'x_card_code'       => $form->cvv,
+            'x_currency_code'   => $CFG->enrol_currency,
+            'x_amount'          => $cost,
+            'x_exp_date'        => $exp_date,
+            'x_email'           => $USER->email,
+            'x_email_customer'  => 'False',
+            'x_cust_id'         => $USER->id,
+            'x_customer_ip'     => $_SERVER["REMOTE_ADDR"],
+            'x_phone'           => '',
+            'x_fax'             => '',
+            'x_invoice_num'     => $order_number,
+            'x_description'     => $course->shortname
         );
 
-        $formvars = array('ccfirstname','cclastname','cc','ccexpiremm','ccexpireyyyy','cctype','cvv','cczip');
-        foreach ($formvars as $var) {
-            if (!isset($form->$var)) {
-    			$form->$var = '';
-    		} 
-    	}
-
-    	include($CFG->dirroot . '/enrol/authorize/enrol.html');
-    	print_simple_box_end();
-    	print_footer();
-    }
-}
-
-/// Override: check_entry()
-function check_entry($form, $course) {
-    global $CFG;
-    if ($this->zero_cost($course)) {
-        if (!empty($CFG->enrol_allowinternal)) {
-            parent::check_entry($form, $course);
+        // build the post string
+        $poststring = '';
+        foreach($formdata as $k => $v) {
+            $poststring .= $k . "=" . urlencode($v) . "&";
         }
-    } else {
-    	$this->cc_submit($form, $course);
-    }
-}
+        $poststring .= (!empty($CFG->an_tran_key)) ?
+                        "x_tran_key" . "=" . urlencode($CFG->an_tran_key):
+                        "x_password" . "=" . urlencode($CFG->an_password);
 
-function cc_submit($form, $course)
-{
-    global $CFG, $USER, $SESSION;
-    require_once($CFG->dirroot . '/enrol/authorize/ccval.php');
-
-    if (empty($form->ccfirstname) || empty($form->cclastname) ||
-    	empty($form->cc) || empty($form->cvv) || empty($form->cctype) ||
-    	empty($form->ccexpiremm) || empty($form->ccexpireyyyy)) {
-    		$this->errormsg = get_string("allfieldsrequired");
-    		return;
-    	}
-
-    $exp_date = (($form->ccexpiremm<10) ? strval('0'.$form->ccexpiremm) : strval($form->ccexpiremm)) . ($form->ccexpireyyyy);
-
-    if (! CCVal($form->cc, $form->cctype, $exp_date)) {
-    	$this->errormsg = get_string("ccinvalid", "enrol_authorize");
-    	return;
-    }
-    
-    $this->check_paid();
-    $order_number = 0; // can be get from db
-    $formdata = array (
-    	'x_version'			=> '3.1',
-    	'x_delim_data'		=> 'True',
-    	'x_delim_char'		=> AN_DELIM,
-    	'x_encap_char'		=> AN_ENCAP,
-    	'x_relay_response'	=> 'False',
-    	'x_login'			=> $CFG->an_login,
-    	'x_test_request'	=> (!empty($CFG->an_test)) ? 'True' : 'False',
-    	'x_type'			=> 'AUTH_CAPTURE',
-    	'x_method'			=> 'CC',
-    	// user
-    	'x_first_name'		=> (empty($form->ccfirstname) ? $USER->firstname : $form->ccfirstname),
-    	'x_last_name'		=> (empty($form->cclastname) ? $USER->lastname : $form->cclastname),
-    	'x_address'			=> $USER->address,
-    	'x_city'			=> $USER->city,
-    	'x_state'			=> '',
-    	'x_zip'				=> $form->cczip,
-    	'x_country'			=> $USER->country,
-    	'x_card_num'		=> $form->cc,
-    	'x_card_code'		=> $form->cvv,
-    	'x_currency_code'	=> $CFG->enrol_currency,
-    	'x_amount'			=> $this->get_course_cost($course),
-    	'x_exp_date'		=> $exp_date,
-    	'x_email'			=> $USER->email,
-    	'x_email_customer'	=> 'False',
-    	'x_cust_id'			=> $USER->id,
-    	'x_customer_ip'		=> $_SERVER["REMOTE_ADDR"],
-    	'x_phone'			=> '',
-    	'x_fax'				=> '',
-    	'x_invoice_num'		=> $order_number,
-    	'x_description'		=> $course->shortname
-    );
-
-    //build the post string
-    $poststring = '';
-    if (!empty($CFG->an_tran_key)) {
-    	$poststring .= urlencode("x_tran_key") . "=" . urlencode($CFG->an_tran_key);
-    } else {
-    	$an_pswd = (isset($CFG->an_password)) ? $CFG->an_password : '';
-    	$poststring .= urlencode("x_password") . "=" . urlencode($an_pswd);
-    }
-    foreach($formdata as $key => $val) {
-    	$poststring .= "&" . urlencode($key) . "=" . urlencode($val);
-    }
-    //built
-
-    $response = array();
-    $anrefererheader = "";    	
-    if (isset($CFG->an_referer) && (!empty($CFG->an_referer)) &&
-    ($CFG->an_referer != "http://") && ($CFG->an_referer != "https://")) {
-    	$anrefererheader = "Referer: " . $CFG->an_referer . "\r\n";
-    }
-    $fp = fsockopen("ssl://" . AN_HOST, AN_PORT, $errno, $errstr, 60);
-    if(!$fp) {
-    	$this->errormsg =  "$errstr ($errno)";
-    	return;
-    } else {
-    	//send the server request
-    	fputs($fp,
-    		"POST " . AN_PATH . " HTTP/1.1\r\n" .
-    		"Host: " . AN_HOST . "\r\n" . 
-    		$anrefererheader .
-    		"Content-type: application/x-www-form-urlencoded\r\n" .
-    		"Content-length: " . strlen($poststring) . "\r\n" .
-    		"Connection: close\r\n\r\n" .
-    		$poststring . "\r\n\r\n");
-
-    	//Get the response header from the server
-    	$str = '';
-    	while(!feof($fp) && !stristr($str, 'content-length')) {
-    		$str = fgets($fp, 4096);
-    	}
-    	// If didnt get content-lenght, something is wrong.
-    	if (!stristr($str, 'content-length')) {
-    		$this->errormsg =  "content-length error";
-    		return;
-    	}
-       
-    	// Get length of data to be received.
-    	$length = trim(substr($str,strpos($str,'content-length') + 15));
-    	// Get buffer (blank data before real data)
-    	fgets($fp, 4096);
-    	// Get real data
-    	$data = fgets($fp, $length);
-    	fclose($fp);
-    	$response = explode(AN_ENCAP.AN_DELIM.AN_ENCAP, $data);
-    	if ($response === false)
-    	{
-    		$this->errormsg = "response error";
-    		return;
-    	}
-    	$rcount = count($response) - 1;
-    	if ($response[0]{0} == AN_ENCAP) {
-    		$response[0] = substr($response[0], 1);
-    	}
-    	if (substr($response[$rcount], -1) == AN_ENCAP) {
-    		$response[$rcount] = substr($response[$rcount], 0, -1);
-    	}
-    }
-
-    if ($response[0] != AN_APPROVED) {
-    	$this->errormsg = isset($response[3]) ? $response[3] : 'unknown error';
-    } else {
-    	$SESSION->ccpaid = 1; // security check: don't duplicate payment
-    	if ($course->enrolperiod) {
-    		$timestart = time();
-    		$timeend   = $timestart + $course->enrolperiod;
-    	} else {
-    		$timestart = $timeend = 0;
-    	}
-
-    	if (!enrol_student($USER->id, $course->id, $timestart, $timeend)) {
-    		$this->email_cc_error_to_admin("Error while trying to enrol ".fullname($USER)." in '$course->fullname'", $response);
-    	} else {
-    		// begin: send email
-    		$teacher = get_teacher($course->id);
-    		if (!empty($CFG->enrol_mailstudents)) {
-    			$a->coursename = "$course->fullname";
-    			$a->profileurl = "$CFG->wwwroot/user/view.php?id=$USER->id";
-    			email_to_user($USER, $teacher, get_string("enrolmentnew", '', $course->shortname),
-    			get_string('welcometocoursetext', '', $a));
-    		}
-    		if (!empty($CFG->enrol_mailteachers)) {
-    			$a->course = "$course->fullname";
-    			$a->user = fullname($USER);
-    			email_to_user($teacher, $USER, get_string("enrolmentnew", '', $course->shortname),
-    			get_string('enrolmentnewuser', '', $a));
-    		}
-    		if (!empty($CFG->enrol_mailadmins)) {
-    			$a->course = "$course->fullname";
-    			$a->user = fullname($USER);
-    			$admins = get_admins();
-    			foreach ($admins as $admin) {
-    				email_to_user($admin, $USER, get_string("enrolmentnew", '', $course->shortname),
-    				get_string('enrolmentnewuser', '', $a));
-    			}
-    		}
-    		// end: send email
-
-    		// begin: authorize_table
-    		$cclast4 = substr($form->cc, -4);
-    		$datax->cclastfour = ($cclast4 === false) ? '0000' : $cclast4;
-    		$datax->ccexp = $exp_date;
-    		$datax->cvv = $form->cvv;
-    		$datax->ccname = $formdata['x_first_name'] . " " . $formdata['x_last_name'];
-    		$datax->courseid = $course->id;
-    		$datax->userid = $USER->id;
-    		$datax->avscode = strval($response[5]);
-    		$datax->transid = strval($response[6]);
-    		if (!insert_record("enrol_authorize", $datax)) {	// Insert a transaction record
-    			$this->email_cc_error_to_admin("Error while trying to insert valid transaction", $datax);
-    		}
-
-    	} // end if (!enrol_student)
-
-    	if ($SESSION->wantsurl) {
-    		$destination = $SESSION->wantsurl;
-    		unset($SESSION->wantsurl);
-    	} else {
-    		$destination = "$CFG->wwwroot/course/view.php?id=$course->id";
-    	}
-    	redirect($destination);
-    }
-}
-
-function zero_cost($course) {
-
-    $cost = $this->get_course_cost($course);
-    if (abs($cost) < 0.01) { // no cost
-    	return true;
-    }
-    return false;
-}
-
-function get_course_cost($course) {
-    global $CFG;
-    $cost = (float)0;
-
-    if (isset($course->cost)) {
-    	if (((float)$course->cost) < 0) {
-    		$cost = (float)$CFG->enrol_cost;
-    	} else {
-    		$cost = (float)$course->cost;
-    	}   	
-    }
-    $cost = format_float($cost, 2);
-    return $cost;
-}
-
-/// Override the get_access_icons() function
-function get_access_icons($course) {
-    global $CFG;
-
-    $str = '';
-    $cost = $this->get_course_cost($course);
-
-    if (abs($cost) < 0.01) {
-    	$str = parent::get_access_icons($course);
-    } else {
-    	$strrequirespayment = get_string("requirespayment");
-    	$strcost = get_string("cost");
-
-    	if (empty($CFG->enrol_currency)) {
-    		set_config('enrol_currency', 'USD');
-    	}
-
-    	switch ($CFG->enrol_currency) {
-    	case 'EUR':	$currency = '&euro;'; break;
-    	case 'CAD':	$currency = '$'; break;
-    	case 'GBP':	$currency = '&pound;'; break;
-    	case 'JPY':	$currency = '&yen;'; break;
-    	default:	$currency = '$'; break;
+        // referer
+        $anrefererheader = '';
+        if (!(empty($CFG->an_referer) || $CFG->an_referer == "http://" || $CFG->an_referer == "https://")) {
+            $anrefererheader = "Referer: " . $CFG->an_referer . "\r\n";
         }
 
-        $str .= "<p class=\"coursecost\"><font size=-1>$strcost: " .
-    			"<a title=\"$strrequirespayment\" href=\"$CFG->wwwroot/course/view.php?id=$course->id\"></a>" .
-    			"$currency" . format_float($cost, 2) . '</a></p>';
-    }
-    return $str;
-}
+        $response = array();
+        $fp = fsockopen("ssl://" . AN_HOST, AN_PORT, $errno, $errstr, 60);
+        if (!$fp) {
+            $this->ccerrormsg =  "$errstr ($errno)";
+            return;
+        } else {
+            //send the server request
+            fputs($fp,
+                  "POST " . AN_PATH . " HTTP/1.0\r\n" .
+                  "Host: " . AN_HOST . "\r\n" . $anrefererheader .
+                  "Content-type: application/x-www-form-urlencoded\r\n" .
+                  "Connection: close\r\n" .
+                  "Content-length: " . strlen($poststring) . "\r\n\r\n" .
+                  $poststring . "\r\n"
+            );
 
+            //Get the response header from the server
+            $str = '';
+            while(!feof($fp) && !stristr($str, 'content-length')) {
+                $str = fgets($fp, 4096);
+            }
+            // If didnt get content-lenght, something is wrong.
+            if (!stristr($str, 'content-length')) {
+                $this->ccerrormsg =  "content-length error";
+                @fclose($fp);
+                return;
+            }
 
-function config_form($frm) {
-    global $CFG;
-    $ancurrencies = array(
-    	'USD' => 'US Dollars',
-    	'EUR' => 'Euros',
-    	'JPY' => 'Japanese Yen',
-    	'GBP' => 'British Pounds',
-    	'CAD' => 'Canadian Dollars'
-    );
+            // Get length of data to be received.
+            $length = trim(substr($str,strpos($str,'content-length') + 15));
+            // Get buffer (blank data before real data)
+            fgets($fp, 4096);
+            // Get real data
+            $data = fgets($fp, $length);
+            @fclose($fp);
+            $response = explode(AN_ENCAP.AN_DELIM.AN_ENCAP, $data);
+            if ($response === false)
+            {
+                $this->ccerrormsg = "response error";
+                return;
+            }
+            $rcount = count($response) - 1;
+            if ($response[0]{0} == AN_ENCAP) {
+                $response[0] = substr($response[0], 1);
+            }
+            if (substr($response[$rcount], -1) == AN_ENCAP) {
+                $response[$rcount] = substr($response[$rcount], 0, -1);
+            }
+        }
 
-    $vars = array('enrol_cost', 'enrol_currency', 'an_login', 'an_tran_key', 'an_password', 'an_referer', 'an_test',
-    			  'enrol_mailstudents', 'enrol_mailteachers', 'enrol_mailadmins', 'enrol_allowinternal');
+        if ($response[0] != AN_APPROVED) {
+            $this->ccerrormsg = isset($response[3]) ? $response[3] : 'unknown error';
+        } else {
+            $SESSION->ccpaid = 1; // security check: don't duplicate payment
+            if ($course->enrolperiod) {
+                $timestart = time();
+                $timeend   = $timestart + $course->enrolperiod;
+            } else {
+                $timestart = $timeend = 0;
+            }
 
-    foreach ($vars as $var) {
-    	if (!isset($frm->$var)) {
-    		$frm->$var = '';
-    	}
+            if (!enrol_student($USER->id, $course->id, $timestart, $timeend)) {
+                $this->email_cc_error_to_admin("Error while trying to enrol ".fullname($USER)." in '$course->fullname'", $response);
+            } else {
+                // begin: send email
+                $teacher = get_teacher($course->id);
+                if (!empty($CFG->enrol_mailstudents)) {
+                    $a->coursename = "$course->fullname";
+                    $a->profileurl = "$CFG->wwwroot/user/view.php?id=$USER->id";
+                    email_to_user($USER, $teacher, get_string("enrolmentnew", '', $course->shortname),
+                    get_string('welcometocoursetext', '', $a));
+                }
+                if (!empty($CFG->enrol_mailteachers)) {
+                    $a->course = "$course->fullname";
+                    $a->user = fullname($USER);
+                    email_to_user($teacher, $USER, get_string("enrolmentnew", '', $course->shortname),
+                    get_string('enrolmentnewuser', '', $a));
+                }
+                if (!empty($CFG->enrol_mailadmins)) {
+                    $a->course = "$course->fullname";
+                    $a->user = fullname($USER);
+                    $admins = get_admins();
+                    foreach ($admins as $admin) {
+                        email_to_user($admin, $USER, get_string("enrolmentnew", '', $course->shortname),
+                        get_string('enrolmentnewuser', '', $a));
+                    }
+                }
+                // end: send email
+
+                // begin: authorize_table
+                $datax->cclastfour = substr($form->cc, -4);
+                $datax->ccexp = $exp_date;
+                $datax->cvv = $form->cvv;
+                $datax->ccname = $formdata['x_first_name'] . " " . $formdata['x_last_name'];
+                $datax->courseid = $course->id;
+                $datax->userid = $USER->id;
+                $datax->avscode = strval($response[5]);
+                $datax->transid = strval($response[6]);
+                if (!insert_record("enrol_authorize", $datax)) { // Insert a transaction record
+                    $this->email_cc_error_to_admin("Error while trying to insert valid transaction", $datax);
+                }
+
+            } // end if (!enrol_student)
+
+            if ($SESSION->wantsurl) {
+                $destination = $SESSION->wantsurl;
+                unset($SESSION->wantsurl);
+            } else {
+                $destination = "$CFG->wwwroot/course/view.php?id=$course->id";
+            }
+            redirect($destination);
+        }
     }
 
-    if (!$this->check_openssl_loaded()) {
-    	notify('PHP must be compiled with SSL support (--with-openssl)');
+    function zero_cost($course) { return(abs($this->get_course_cost($course)) < 0.01); }
+    function get_course_cost($course) {
+        global $CFG;
+        $cost = (float)0;
+
+        if (isset($course->cost)) {
+            if (((float)$course->cost) < 0) {
+                $cost = (float)$CFG->enrol_cost;
+            } else {
+                $cost = (float)$course->cost;
+            }
+        }
+        $cost = format_float($cost, 2);
+        return $cost;
     }
-    if (data_submitted()) {  // something POSTed
+
+    /// Override the get_access_icons() function
+    function get_access_icons($course) {
+        global $CFG;
+
+        $str = parent::get_access_icons($course);
+        $cost = $this->get_course_cost($course);
+
+        if (abs($cost) > 0.00) {
+            $strrequirespayment = get_string("requirespayment");
+            $strcost = get_string("cost");
+
+            if (empty($CFG->enrol_currency)) {
+                set_config('enrol_currency', 'USD');
+            }
+
+            switch ($CFG->enrol_currency) {
+                case 'EUR': $currency = '&euro;'; break;
+                case 'CAD': $currency = '$'; break;
+                case 'GBP': $currency = '&pound;'; break;
+                case 'JPY': $currency = '&yen;'; break;
+                default:    $currency = '$'; break;
+            }
+
+            $str .= "<p class=\"coursecost\"><font size=-1>$strcost: " .
+                    "<a title=\"$strrequirespayment\" href=\"$CFG->wwwroot/course/view.php?id=$course->id\">" .
+                    "$currency" . format_float($cost, 2) . '</a></font></p>';
+        }
+        return $str;
+    }
+
+
+    function config_form($frm) {
+        global $CFG;
+
+        $vars = array('an_login', 'an_tran_key', 'an_password', 'an_referer', 'an_avs', 'an_test',
+                      'enrol_cost', 'enrol_currency', 'enrol_mailstudents', 'enrol_mailteachers', 'enrol_mailadmins');
+
+        foreach ($vars as $var) {
+            if (!isset($frm->$var)) {
+                $frm->$var = '';
+            }
+        }
+
+        if (!$this->check_openssl_loaded()) {
+            notify('PHP must be compiled with SSL support (--with-openssl)');
+        }
+
+        if (data_submitted()) {
+            // Some required fields
+            if (empty($frm->an_login)) {
+                notify("an_login required");
+            }
+            if (empty($frm->an_tran_key) && empty($frm->an_password)) {
+                notify("an_tran_key or an_password required");
+            }
+            if (empty($CFG->loginhttps)) {
+                notify("\$CFG->loginhttps must be ON");
+            }
+
+        }
+        include($CFG->dirroot.'/enrol/authorize/config.html');
+    }
+
+    function check_openssl_loaded() {
+        return extension_loaded('openssl');
+    }
+
+    function process_config($config) {
+        global $CFG;
+
+        if (empty($CFG->loginhttps) || !$this->check_openssl_loaded())
+        {
+            return false;
+        }
+
+        $return = true;
+
+        if (!isset($config->an_login)) {
+            $config->an_login = '';
+        }
+        set_config('an_login', $config->an_login);
+
+        if (!isset($config->an_password)) {
+            $config->an_password = '';
+        }
+        set_config('an_password', $config->an_password);
+
+        if (!isset($config->an_tran_key)) {
+            $config->an_tran_key = '';
+        }
+        set_config('an_tran_key', $config->an_tran_key);
+
         // Some required fields
-        if (empty($frm->an_login)) {
-    	    notify("an_login required");
+        if (empty($config->an_login)) {
+            $return = false;
         }
-        if (empty($frm->an_tran_key) && empty($frm->an_password)) {
-    	    notify("an_tran_key or an_password required");
+        if (empty($config->an_tran_key) && empty($config->an_password)) {
+            $return = false;
+        }
+
+        if (empty($config->an_referer)) {
+            $config->an_referer = 'http://';
+        }
+        set_config('an_referer', $config->an_referer);
+
+        if (!isset($config->an_avs)) {
+            $config->an_avs = '';
+        }
+        set_config('an_avs', $config->an_avs);
+
+        if (!isset($config->an_test)) {
+            $config->an_test = '';
+        }
+        set_config('an_test', $config->an_test);
+
+        // --------------------------------------
+        if (!isset($config->enrol_cost)) {
+            $config->enrol_cost = '0';
+        }
+        set_config('enrol_cost', $config->enrol_cost);
+
+        if (!isset($config->enrol_currency)) {
+            $config->enrol_currency = 'USD';
+        }
+        set_config('enrol_currency', $config->enrol_currency);
+
+        if (!isset($config->enrol_mailstudents)) {
+            $config->enrol_mailstudents = '';
+        }
+        set_config('enrol_mailstudents', $config->enrol_mailstudents);
+
+        if (!isset($config->enrol_mailteachers)) {
+            $config->enrol_mailteachers = '';
+        }
+        set_config('enrol_mailteachers', $config->enrol_mailteachers);
+
+        if (!isset($config->enrol_mailadmins)) {
+            $config->enrol_mailadmins = '';
+        }
+        set_config('enrol_mailadmins', $config->enrol_mailadmins);
+
+        return $return;
+    }
+
+    function email_cc_error_to_admin($subject, $data) {
+        $admin = get_admin();
+        $site = get_site();
+        $message = "$site->fullname:  Transaction failed.\n\n$subject\n\n";
+
+        foreach ($data as $key => $value) {
+            $message .= "$key => $value\n";
+        }
+
+        email_to_user($admin, $admin, "CC ERROR: ".$subject, $message);
+    }
+
+    function check_paid() {
+        global $CFG, $SESSION;
+
+        if (isset($SESSION->ccpaid)) {
+            unset($SESSION->ccpaid);
+            redirect($CFG->wwwroot . '/login/logout.php');
+            exit;
         }
     }
-    include($CFG->dirroot.'/enrol/authorize/config.html');
-}
-
-function check_openssl_loaded() {
-    return extension_loaded('openssl');
-}
-
-function process_config($config) {
-
-    $return = $this->check_openssl_loaded();
-
-    if (!isset($config->an_login)) {
-    	$config->an_login = '';
-    }
-    set_config('an_login', $config->an_login);
-
-    if (!isset($config->an_password)) {
-    	$config->an_password = '';
-    }
-    set_config('an_password', $config->an_password);
-
-    if (!isset($config->an_tran_key)) {
-    	$config->an_tran_key = '';
-    }
-    set_config('an_tran_key', $config->an_tran_key);
-
-    // Some required fields
-    if (empty($config->an_login)) {
-    	$return = false;   	
-    }
-    if (empty($config->an_tran_key) && empty($config->an_password)) {
-    	$return = false;   	
-    }
-
-    if (empty($config->an_referer)) {
-    	$config->an_referer = 'http://';
-    }
-    set_config('an_referer', $config->an_referer);
-
-    if (!isset($config->an_test)) {
-    	$config->an_test = '';
-    }
-    set_config('an_test', $config->an_test);
-
-    // --------------------------------------
-    if (!isset($config->enrol_cost)) {
-    	$config->enrol_cost = '0';
-    }
-    set_config('enrol_cost', $config->enrol_cost);
-
-    if (!isset($config->enrol_currency)) {
-    	$config->enrol_currency = 'USD';
-    }
-    set_config('enrol_currency', $config->enrol_currency);
-
-    if (!isset($config->enrol_mailstudents)) {
-    	$config->enrol_mailstudents = '';
-    }
-    set_config('enrol_mailstudents', $config->enrol_mailstudents);
-
-    if (!isset($config->enrol_mailteachers)) {
-    	$config->enrol_mailteachers = '';
-    }
-    set_config('enrol_mailteachers', $config->enrol_mailteachers);
-
-    if (!isset($config->enrol_mailadmins)) {
-    	$config->enrol_mailadmins = '';
-    }
-    set_config('enrol_mailadmins', $config->enrol_mailadmins);
-
-    if (!isset($config->enrol_allowinternal)) {
-    	$config->enrol_allowinternal = '';
-    }
-    set_config('enrol_allowinternal', $config->enrol_allowinternal);
-
-    return $return;
-}
-
-function email_cc_error_to_admin($subject, $data) {
-    $admin = get_admin();
-    $site = get_admin();
-
-    $message = "$site->fullname:  Transaction failed.\n\n$subject\n\n";
-    foreach ($data as $key => $value) {
-    	$message .= "$key => $value\n";
-    }
-    email_to_user($admin, $admin, "CC ERROR: ".$subject, $message);
-}
-
-function check_paid() {
-
-    global $CFG, $SESSION;
-
-    if (isset($SESSION->ccpaid)) {
-    	unset($SESSION->ccpaid);
-    	redirect($CFG->wwwroot . '/login/logout.php');
-    	exit;    	
-    }
-}
 
 } // end of class definition
 ?>

enrol/authorize/version.php

@@ -1,6 +1,6 @@
 <?PHP // $Id$
 
-$module->version  = 2004081800;
+$module->version  = 2005071602;
 $module->requires = 2004081800;
 
 ?>

enrol/database/enrol.php

@@ -21,13 +21,14 @@ function get_student_courses(&$user) {
                                          /// If the database fails we can at least use this
 
     // This is a hack to workaround what seems to be a bug in ADOdb with accessing 
-    // two databases of the same kind ... it seems to get confused when trying to access
+    // two MySQL databases ... it seems to get confused when trying to access
     // the first database again, after having accessed the second.
     // The following hack will make the database explicit which keeps it happy
-
-    if (strpos($CFG->prefix, $CFG->dbname) === false) {
-        $oldprefix = $CFG->prefix;
-        $CFG->prefix = "$CFG->dbname.$CFG->prefix";
+    if ($CFG->dbtype === 'mysql' && $CFG->enrol_dbtype === 'mysql') {
+        if (strpos($CFG->prefix, $CFG->dbname) === false) {
+            $oldprefix = $CFG->prefix;
+            $CFG->prefix = "`$CFG->dbname`.$CFG->prefix";
+        }
     }
 
     // Try to connect to the external database
@@ -60,7 +61,7 @@ function get_student_courses(&$user) {
                         if (isset($user->student[$course->id])) {   /// We have it already
                             unset($user->student[$course->id]);       /// Remove from old list
                         } else {
-                            enrol_student($user->id, $course->id);   /// Enrol the student
+                            enrol_student($user->id, $course->id, 0, 0, 'database');   /// Enrol the student
                         }
                     }
                 }
@@ -68,8 +69,14 @@ function get_student_courses(&$user) {
 
             if (!empty($user->student)) {    /// We have some courses left that we need to unenrol from
                 foreach ($user->student as $courseid => $value) {
-                    unenrol_student($user->id, $courseid);       /// Unenrol the student
-                    unset($user->student[$course->id]);           /// Remove from old list
+
+                    // unenrol only if it's a record pulled from external db
+                    if (get_record('user_students', 'userid', $user->id, 'course', $courseid, 'enrol', 'database')) {
+                        unenrol_student($user->id, $courseid);       /// Unenrol the student
+                        unset($user->student[$course->id]);           /// Remove from old list
+                    } else {
+                        $newstudent[$courseid] = true;
+                    }
                 }
             }
 

enrol/enrol.class.php

@@ -145,7 +145,7 @@ function print_entry($course) {
                 $timestart = $timeend = 0;
             }
 
-            if (! enrol_student($USER->id, $course->id, $timestart, $timeend)) {
+            if (! enrol_student($USER->id, $course->id, $timestart, $timeend, 'manual')) {
                 error("An error occurred while trying to enrol you.");
             }
 
@@ -226,7 +226,7 @@ function check_entry($form, $course) {
                 $timestart = $timeend = 0;
             }
 
-            if (! enrol_student($USER->id, $course->id, $timestart, $timeend)) {
+            if (! enrol_student($USER->id, $course->id, $timestart, $timeend, 'manual')) {
                 error("An error occurred while trying to enrol you.");
             }
 

enrol/ldap/config.html

@@ -1,39 +1,91 @@
 <?php // initialize variables
 
 // general
-optional_variable($frm->enrol_ldap_host_url, '');
-optional_variable($frm->enrol_ldap_version, '');
-optional_variable($frm->enrol_ldap_bind_dn, '');
-optional_variable($frm->enrol_ldap_bind_pw, '');
-optional_variable($frm->enrol_ldap_search_sub, '0');
+if (!isset ($frm->enrol_ldap_host_url)) {
+    $frm->enrol_ldap_host_url = '';
+}
+if (!isset ($frm->enrol_ldap_version )) {
+    $frm->enrol_ldap_version = '';
+}
+if (!isset ($frm->enrol_ldap_bind_dn)) {
+    $frm->enrol_ldap_bind_dn = '';
+}
+if (!isset ($frm->enrol_ldap_bind_pw)) {
+    $frm->enrol_ldap_bind_pw = '';
+}
+if (!isset ($frm->enrol_ldap_search_sub)) {
+    $frm->enrol_ldap_search_sub = '0';
+}
 // student & teacher enrol
-optional_variable($frm->enrol_ldap_student_contexts, '');
-optional_variable($frm->enrol_ldap_student_memberattribute, '');
-optional_variable($frm->enrol_ldap_teacher_contexts, '');
-optional_variable($frm->enrol_ldap_teacher_memberattribute, '');
-optional_variable($frm->enrol_ldap_objectclass, '');
-optional_variable($frm->enrol_ldap_course_idnumber_updatelocal, '');
+if (!isset ($frm->enrol_ldap_student_contexts)) {
+     $frm->enrol_ldap_student_contexts = '';
+}
+if (!isset ($frm->enrol_ldap_student_memberattribute)) {
+     $frm->enrol_ldap_student_memberattribute = '';
+}
+if (!isset ($frm->enrol_ldap_teacher_contexts)) {
+     $frm->enrol_ldap_teacher_contexts = '';
+}
+if (!isset ($frm->enrol_ldap_teacher_memberattribute)) {
+     $frm->enrol_ldap_teacher_memberattribute = '';
+}
+if (!isset ($frm->enrol_ldap_objectclass)) {
+     $frm->enrol_ldap_objectclass = '';
+}
+if (!isset ($frm->enrol_ldap_course_idnumber_updatelocal)) {
+     $frm->enrol_ldap_course_idnumber_updatelocal = '';
+}
 // fields
-optional_variable($frm->enrol_ldap_course_idnumber, '');
-optional_variable($frm->enrol_ldap_course_idnumber_updatelocal, false);
-optional_variable($frm->enrol_ldap_course_idnumber_editlock,    false);
-optional_variable($frm->enrol_ldap_course_fullname, '');
-optional_variable($frm->enrol_ldap_course_fullname_updatelocal, false);
-optional_variable($frm->enrol_ldap_course_fullname_editlock,    false);
-optional_variable($frm->enrol_ldap_course_shortname, '');
-optional_variable($frm->enrol_ldap_course_shortname_updatelocal, false);
-optional_variable($frm->enrol_ldap_course_shortname_editlock,    false);
-optional_variable($frm->enrol_ldap_course_summary, '');
-optional_variable($frm->enrol_ldap_course_summary_updatelocal, false);
-optional_variable($frm->enrol_ldap_course_summary_editlock,    false);
+if (!isset ($frm->enrol_ldap_course_idnumber)) {
+    $frm->enrol_ldap_course_idnumber = '';
+}
+if (!isset ($frm->enrol_ldap_course_idnumber_updatelocal)) {
+    $frm->enrol_ldap_course_idnumber_updatelocal = false;
+}
+if (!isset ($frm->enrol_ldap_course_idnumber_editlock)) {
+    $frm->enrol_ldap_course_idnumber_editlock = false;
+}
+if (!isset ($frm->enrol_ldap_course_fullname)) {
+    $frm->enrol_ldap_course_fullname = '';
+}
+if (!isset ($frm->enrol_ldap_course_fullname_updatelocal)) {
+    $frm->enrol_ldap_course_fullname_updatelocal = false;
+}
+if (!isset ($frm->enrol_ldap_course_fullname_editlock)) {
+    $frm->enrol_ldap_course_fullname_editlock = false;
+}
+if (!isset ($frm->enrol_ldap_course_shortname)) {
+    $frm->enrol_ldap_course_shortname = '';
+     }
+if (!isset ($frm->enrol_ldap_course_shortname_updatelocal)) {
+    $frm->enrol_ldap_course_shortname_updatelocal = false;
+}
+if (!isset ($frm->enrol_ldap_course_shortname_editlock)) {
+    $frm->enrol_ldap_course_shortname_editlock = false;
+}
+if (!isset ($frm->enrol_ldap_course_summary)) {
+    $frm->enrol_ldap_course_summary = '';
+}
+if (!isset ($frm->enrol_ldap_course_summary_updatelocal)) {
+    $frm->enrol_ldap_course_summary_updatelocal = false;
+}
+if (!isset ($frm->enrol_ldap_course_summary_editlock)) {
+    $frm->enrol_ldap_course_summary_editlock = false;
+}
 // autocreate
-optional_variable($frm->enrol_ldap_autocreate, false);
-optional_variable($frm->enrol_ldap_category, 1);
-optional_variable($frm->enrol_ldap_template, '');
-
+if (!isset ($frm->enrol_ldap_autocreate)) {
+    $frm->enrol_ldap_autocreate = false;
+}
+if (!isset ($frm->enrol_ldap_category)) {
+    $frm->enrol_ldap_category = 1;
+}
+if (!isset ($frm->enrol_ldap_template)) {
+    $frm->enrol_ldap_template = '';
+}
 // general options
-optional_variable($frm->enrol_allowinternal, false);
-
+if (!isset ($frm->enrol_allowinternal)) {
+    $frm->enrol_allowinternal = false;
+}
 ?>
 
 <table cellspacing="0" cellpadding="5" border="0" align="center">