Bumped to 1.6.8

JCloze: set textbox size allowing for minimum gap size setting and longest answer;
JMatch: allow for duplicates and distractors in RHS items;
JQuiz: set textbox size allowing for longest answer, and use textarea if answer longer than 29 chars;

admin/auth.php

@@ -26,7 +26,6 @@
     if ($config = data_submitted()) {
 
         $config = (array)$config;
-        validate_form($config, $err);
 
         // extract and sanitize the auth key explicitly
         $modules = get_list_of_plugins("auth");
@@ -36,6 +35,14 @@
             notify("Error defining the authentication method");
         }
 
+        // load the auth plugin library
+        require_once("{$CFG->dirroot}/auth/$auth/lib.php");
+
+        $err = array();
+        if (function_exists('auth_validate_form')) {
+            auth_validate_form($config, $err);
+        }
+
         if (count($err) == 0) {
             foreach ($config as $name => $value) {
                 if (preg_match('/^pluginconfig_(.+?)$/', $name, $matches)) {
@@ -233,14 +240,6 @@
 
 /// Functions /////////////////////////////////////////////////////////////////
 
-function validate_form(&$form, &$err) {
-
-   // if (empty($form->fullname))
-   //     $err["fullname"] = get_string("missingsitename");
-
-    return;
-}
-
 //
 // Good enough for most auth plugins
 // but some may want a custom one if they are offering

admin/blocks.php

@@ -156,7 +156,7 @@
 
     $table->define_columns(array('name', 'instances', 'version', 'hideshow', 'multiple', 'delete', 'settings'));
     $table->define_headers(array($strname, $strcourses, $strversion, $strhide.'/'.$strshow, $strmultiple, $strdelete, $strsettings));
-    $table->define_baseurl($CFG->wwwroot.'/admin/blocks.php');
+    $table->define_baseurl($CFG->wwwroot.'/'.$CFG->admin.'/blocks.php');
 
     $table->set_attribute('cellspacing', '0');
     $table->set_attribute('id', 'blocks');
@@ -218,7 +218,7 @@
         
         $table->define_columns(array('block', 'delete'));
         $table->define_headers(array($strname, $strdelete));
-        $table->define_baseurl($CFG->wwwroot.'/admin/blocks.php');
+        $table->define_baseurl($CFG->wwwroot.'/'.$CFG->admin.'/blocks.php');
     
         $table->set_attribute('cellspacing', '0');
         $table->set_attribute('id', 'incompatible');

admin/config.php

@@ -3,6 +3,8 @@
 
     require_once('../config.php');
 
+    $installing = optional_param('installing', 0, PARAM_BOOL);
+
     $focus = '';
 
     if ($site = get_site()) {   // If false then this is a new installation
@@ -46,7 +48,10 @@
                         $value = implode(',',$value);
                     }
                 }
-                unset($conf);
+                if ($name == "locale") {
+                    $value = trim($value);
+                }
+                $conf = new object();
                 $conf->name  = $name;
                 $conf->value = $value;
                 if ($current = get_record('config', 'name', $name)) {
@@ -60,8 +65,16 @@
                     }
                 }
             }
-            redirect('index.php', get_string('changessaved'), 1);
-            exit;
+            if ($installing) {
+                print_header();
+                notify(get_string('changessaved'), 'notifysuccess');
+                print_continue('index.php');
+                exit;
+            } else {
+                // the following redirect was randomly breaking upgrades because it did double redirects,
+                // we must not use it during install/upgrade
+                redirect('index.php', get_string('changessaved'), 1);
+            }
 
         } else {
             foreach ($err as $key => $value) {
@@ -74,9 +87,6 @@
 
     if (empty($config)) {
         $config = $CFG;
-        if (!$config->locale = get_field('config', 'value', 'name', 'locale')) {
-            $config->locale = $CFG->lang;
-        }
     }
 
     $sesskey = !empty($USER->id) ? $USER->sesskey : '';
@@ -143,6 +153,7 @@
 
     }
     echo '<center>';
+    echo '<input type="hidden" name="installing" value="'.$installing.'" />';
     echo '<input type="hidden" name="sesskey" value="'.$sesskey.'" />';
     echo '<input type="submit" value="'.get_string('savechanges').'" />';
     echo '</center>';

admin/configvars.php

@@ -69,7 +69,7 @@ class configvar {
 
 /// debug
     unset($options);
-    $options[7]  = $strno;
+    $options[5]  = $strno;
     $options[15] = $stryes;
 
     $misc['debug'] = new configvar (get_string('configdebug', 'admin'),
@@ -157,8 +157,8 @@ class configvarrss extends configvar {
 
 /// slasharguments
     unset($options);
-    $options[0] = "file.php?file=/pic.jpg";
-    $options[1] = "file.php/pic.jpg";
+    $options[0] = "file.php?file=/1/pic.jpg";
+    $options[1] = "file.php/1/pic.jpg";
 
     $operatingsystem['slasharguments'] = new configvar (get_string('configslasharguments', 'admin'),
         choose_from_menu ($options, 'slasharguments', $config->slasharguments, '', '', '', true) );
@@ -312,17 +312,20 @@ class configvarrss extends configvar {
 /// language menu
     $interface['langcache'] = new configvar ( get_string('configlangcache', 'admin'),
         choose_from_menu($noyesoptions, 'langcache', $config->langcache, '', '', '', true) );
-        
+
 /// locale
     $interface['locale'] = new configvar ( get_string('configlocale', 'admin'),
-        '<input name="locale" type="text" size="10" value="'.s($config->locale).'" alt="locale" />' );
+        '<input name="locale" type="text" size="15" value="'.s($config->locale).'" alt="locale" />' );
 
 /// docroot
     $interface['docroot'] = new configvar ( get_string('configdocroot', 'admin'),
         '<input name="docroot" type="text" size="60" value="'.s($config->docroot).'" alt="docroot" />' );
 
+/// doctonewwindow
+    $interface['doctonewwindow'] = new configvar ( get_string('configdoctonewwindow', 'admin'),
+        choose_from_menu($noyesoptions, 'doctonewwindow', $config->doctonewwindow, '', '', '', true) );
+
 /// timezone
-    
     $interface['timezone'] = new configvar ( get_string('configtimezone', 'admin'),
         choose_from_menu (get_list_of_timezones(), 'timezone', $config->timezone, get_string('serverlocaltime'), '', '99', true ) );
 
@@ -447,6 +450,9 @@ class configvarrss extends configvar {
     $security['notifyloginthreshold'] = new configvar (get_string('confignotifyloginthreshold', 'admin'),
         choose_from_menu($options, 'notifyloginthreshold', $config->notifyloginthreshold, '', '', '', true) );
 
+    $security['protectusernames'] = new configvar (get_string('configprotectusernames', 'admin'),
+        choose_from_menu($noyesoptions, 'protectusernames', $config->protectusernames, '', '', '', true) );
+
 /// secureforms
     $security['secureforms'] = new configvar (get_string('configsecureforms', 'admin'),
         choose_from_menu ($noyesoptions, 'secureforms', $config->secureforms, '', '', '', true) );
@@ -588,6 +594,7 @@ class configvarrss extends configvar {
     }
     
 /// enable stats
+if (empty($CFG->disablestatsprocessing)) {
     $stats['enablestats'] = new configvar (get_string('configenablestats','admin'),
         choose_from_menu($noyesoptions, 'enablestats', $config->enablestats, '', '', '', true) );
 
@@ -633,7 +640,7 @@ class configvarrss extends configvar {
 
     $stats['statsuserthreshold'] = new configvar (get_string('configstatsuserthreshold','admin'),
       '<input type="text" name="statsuserthreshold" size="4" value="'.$config->statsuserthreshold.'" />');
-                                              
+}                                        
 
 ////////////////////////////////////////////////////////////////////
 
@@ -646,6 +653,8 @@ class configvarrss extends configvar {
     $configvars['permissions']     = $permissions;
     $configvars['requestedcourse'] = $reqcourse;
     $configvars['misc']            = $misc;
+if (empty($CFG->disablestatsprocessing)) {
     $configvars['stats']           = $stats;
+}
 
 ?>

admin/courses.php

@@ -0,0 +1,42 @@
+<?php // $Id$
+
+    require_once('../config.php');
+
+    require_login();
+
+    if (!isadmin()) {
+        error("Only admins can access this page");
+    }
+
+    if (!$site = get_site()) {
+        redirect("index.php");
+    }
+
+    $stradministration = get_string("administration");
+    $strcourses        = get_string("courses");
+
+    print_header("$site->shortname: $stradministration: $strcourses", "$site->fullname", 
+                 "<a href=\"index.php\">$stradministration</a> -> $strcourses");
+
+    print_heading($strcourses);
+
+    $table->align = array ("right", "left");
+
+    $table->data[] = array('<b><a href="../course/index.php?edit=on&amp;sesskey='.$USER->sesskey.'">'.get_string("managecourses")."</a></b>",
+                           get_string("adminhelpcourses"));
+    $table->data[] = array("<b><a href=\"enrol.php?sesskey=$USER->sesskey\">".get_string("enrolmentplugins")."</a></b>",
+                           get_string("adminhelpenrolments"));
+    $table->data[] = array("<b><a href=\"../course/index.php?edit=off&amp;sesskey=$USER->sesskey\">".get_string("assignstudents")."</a></b>",
+                           get_string("adminhelpassignstudents"));
+    $table->data[] = array("<b><a href=\"../course/index.php?edit=on&amp;sesskey=$USER->sesskey\">".get_string("assignteachers")."</a></b>",
+                           get_string("adminhelpassignteachers")." <img src=\"../pix/t/user.gif\" height=\"11\" width=\"11\" alt=\"\" />");
+    $table->data[] = array("<b><a href=\"creators.php?sesskey=$USER->sesskey\">".get_string("assigncreators")."</a></b>",
+                           get_string("adminhelpassigncreators"));
+    $table->data[] = array("<b><a href=\"admin.php?sesskey=$USER->sesskey\">".get_string("assignadmins")."</a></b>",
+                           get_string("adminhelpassignadmins"));
+
+    print_table($table);
+
+    print_footer($site);
+
+?>

admin/creators.html

@@ -64,9 +64,6 @@
           ?>
          </select>
          <br />
-         <script type="text/javascript">
-            function
-         </script>
          <input type="text" name="searchtext" size="30" value="<?php p($searchtext) ?>" 
                   onFocus ="document.creatorsform.add.disabled=true;
                             document.creatorsform.remove.disabled=true;

admin/cron.php

@@ -42,11 +42,23 @@
     //unset test cookie, user must login again anyway
     setcookie('MoodleSessionTest'.$CFG->sessioncookie, '', time() - 3600, '/');
 
+/// switch to site language and locale
+	if (!empty($CFG->courselang)) {
+        unset ($CFG->courselang);
+	}
+    if (!empty($SESSION->lang)) {
+        unset ($SESSION->lang);
+    }
+    $USER->lang = '';
+    moodle_setlocale();
+
+/// send mime type and encoding
+    @header('Content-Type: text/plain; charset='.current_charset());
+
 /// Start output log
 
     $timenow  = time();
 
-    mtrace("<pre>");
     mtrace("Server Time: ".date('r',$timenow)."\n\n");
 
 /// Run all cron jobs for each module
@@ -129,11 +141,13 @@
     
         /// Delete users who haven't confirmed within required period
 
-        $oneweek = $timenow - ($CFG->deleteunconfirmed * 3600);
-        if ($users = get_users_unconfirmed($oneweek)) {
-            foreach ($users as $user) {
-                if (delete_records('user', 'id', $user->id)) {
-                    mtrace("Deleted unconfirmed user for ".fullname($user, true)." ($user->id)");
+        if (!empty($CFG->deleteunconfirmed)) {
+            $oneweek = $timenow - ($CFG->deleteunconfirmed * 3600);
+            if ($users = get_users_unconfirmed($oneweek)) {
+                foreach ($users as $user) {
+                    if (delete_records('user', 'id', $user->id)) {
+                        mtrace("Deleted unconfirmed user for ".fullname($user, true)." ($user->id)");
+                    }
                 }
             }
         }
@@ -143,11 +157,13 @@
 
         /// Delete users who haven't completed profile within required period
 
-        $oneweek = $timenow - ($CFG->deleteunconfirmed * 3600);
-        if ($users = get_users_not_fully_set_up($oneweek)) {
-            foreach ($users as $user) {
-                if (delete_records('user', 'id', $user->id)) {
-                    mtrace("Deleted not fully setup user $user->username ($user->id)");
+        if (!empty($CFG->deleteunconfirmed)) {
+            $oneweek = $timenow - ($CFG->deleteunconfirmed * 3600);
+            if ($users = get_users_not_fully_set_up($oneweek)) {
+                foreach ($users as $user) {
+                    if (delete_records('user', 'id', $user->id)) {
+                        mtrace("Deleted not fully setup user $user->username ($user->id)");
+                    }
                 }
             }
         }
@@ -262,10 +278,10 @@
         unset($enrol);
     }
 
-    if (!empty($CFG->enablestats)) {
+    if (!empty($CFG->enablestats) and empty($CFG->disablestatsprocessing)) {
 
         // check we're not before our runtime
-        $timetocheck = strtotime("$CFG->statsruntimestarthour:$CFG->statsruntimestartminute today");
+        $timetocheck = strtotime("today $CFG->statsruntimestarthour:$CFG->statsruntimestartminute");
 
         if (time() > $timetocheck) {
             $time = 60*60*20; // set it to 20 here for first run... (overridden by $CFG)

admin/delete.php

@@ -43,7 +43,7 @@ function delete_subdirectories($rootdir) {
 
     $dir = opendir($rootdir);
 
-    while ($file = readdir($dir)) {
+    while (false !== ($file = readdir($dir))) {
         if ($file != '.' and $file != '..') {
             $fullfile = $rootdir .'/'. $file;
             if (filetype($fullfile) == 'dir') {

admin/environment.php

@@ -57,10 +57,12 @@
     $strmoodleversion = get_string('moodleversion');
     $strupdate = get_string('updatecomponent', 'admin');
     $strupwards = get_string('upwards', 'admin');
+    $strmisc = get_string('miscellaneous');
 
 /// Print the header stuff
     print_header("$SITE->shortname: $strenvironment", $SITE->fullname,
-                 "<a href=\"index.php\">$stradmin</a> -> ".$strenvironment);
+                 "<a href=\"index.php\">$stradmin</a> -> <a href=\"misc.php\">$strmisc</a> -> "
+                 .$strenvironment);
 
 /// Print the component download link
     echo '<div class="reportlink"><a href="environment.php?action=updatecomponent&amp;sesskey='.$USER->sesskey.'">'.$strupdate.'</a></div>';

admin/environment.xml

@@ -43,10 +43,12 @@
         <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
       <VENDOR name="postgres" version="7.4" />
-      <VENDOR name="mssql" version="8.0" />
+      <VENDOR name="mssql" version="9.0" />
       <VENDOR name="oracle" version="9.0" />
     </DATABASE>
-    <PHP version="4.3.0" level="required" />
+    <PHP version="4.3.0" level="required">
+       <RESTRICT function="restrict_php50_version" message="php50restricted" />
+    </PHP>
     <PHP_EXTENSIONS>
       <PHP_EXTENSION name="iconv" level="optional">
         <FEEDBACK>

admin/filters.php

@@ -192,7 +192,7 @@
     $table->column_style('order', 'text-align', 'center');
     $table->column_style('settings', 'text-align', 'center');
     $table->define_headers(array($txt->name, $txt->hideshow, $txt->updown, $txt->settings));
-    $table->define_baseurl("$CFG->wwwroot/admin/filters.php");
+    $table->define_baseurl("$CFG->wwwroot/$CFG->admin/filters.php");
     $table->set_attribute('id', 'blocks');
     $table->set_attribute('class', 'flexible generaltable generalbox');
     $table->set_attribute('style', 'margin:auto;');

admin/health.php

@@ -1,14 +1,23 @@
 <?php  // $Id$
 
+    ob_start(); //for whitespace test
     require_once('../config.php');
 
+	// extra whitespace test - intentionally breaks cookieless mode
+	$extraws = '';
+    while (true) {
+        $extraws .= ob_get_contents();
+        if (!@ob_end_clean()) { //
+            break;
+        }
+    }
+
     define('SEVERITY_NOTICE',      'notice');
     define('SEVERITY_ANNOYANCE',   'annoyance');
     define('SEVERITY_SIGNIFICANT', 'significant');
     define('SEVERITY_CRITICAL',    'critical');
 
-    $resetsesserrorcounter = optional_param('resetsesserrorcounter', 0, PARAM_BOOL);
-    $solution              = optional_param('solution', 0, PARAM_SAFEDIR); //in fact it is class name alhanumeric and _
+    $solution = optional_param('solution', 0, PARAM_SAFEDIR); //in fact it is class name alhanumeric and _
 
     require_login();
     if (!isadmin()) {
@@ -18,9 +27,11 @@
     $site = get_site();
     $stradmin         = get_string('administration');
     $strhealthcenter  = get_string('healthcenter');
+    $strmisc          = get_string('miscellaneous');
 
     print_header($site->shortname.': '.$strhealthcenter, $site->fullname,
-                  '<a href="index.php">'.$stradmin.'</a> -> '.$strhealthcenter);
+                  '<a href="index.php">'.$stradmin.'</a> -> <a href="misc.php">'.$strmisc.'</a> ->'.
+                  $strhealthcenter);
 
 echo <<<STYLES
 <style type="text/css">
@@ -216,18 +227,13 @@ class problem_000001 extends problem_base {
 
 class problem_000002 extends problem_base {
     function title() {
-        return 'Extra characters at the end of config.php';
+        return 'Extra characters at the end of config.php or other library function';
     }
     function exists() {
-        // [pj] When the requirements are raised to PHP 4.3.0 this will be file_get_contents()
-        if($fp = @fopen('../config.php', 'r')) {
-            $contents = fread($fp, 16384); // 16K should be enough
-            $ending = substr($contents, -2);
-            unset($contents);
-            if($ending == '?>') {
-                return false;
-            }
-            fclose($fp);
+        global $extraws;
+
+        if($extraws === '') {
+            return false;
         }
         return true;
     }
@@ -235,11 +241,11 @@ class problem_000002 extends problem_base {
         return SEVERITY_SIGNIFICANT;
     }
     function description() {
-        return 'Your Moodle configuration file, config.php, contains some characters after the closing PHP tag (?>). This could cause Moodle to exhibit several kinds of problems and should be fixed.';
+        return 'Your Moodle configuration file config.php or another library file, contains some characters after the closing PHP tag (?>). This causes Moodle to exhibit several kinds of problems (such as broken downloaded files) and must be fixed.';
     }
     function solution() {
         global $CFG;
-        return 'You need to edit <strong>'.$CFG->dirroot.'/config.php</strong> and remove all characters (including spaces and returns) after the ending ?> tag. These two characters should be the very last in that file.';
+        return 'You need to edit <strong>'.$CFG->dirroot.'/config.php</strong> and remove all characters (including spaces and returns) after the ending ?> tag. These two characters should be the very last in that file. The extra trailing whitespace may be also present in other PHP files that are included from lib/setup.php.';
     }
 }
 
@@ -350,24 +356,41 @@ class problem_000008 extends problem_base {
         return 'PHP: memory_limit cannot be controlled by Moodle';
     }
     function exists() {
-        $memlimit = @ini_get('memory_limit');
-        if(empty($memlimit)) {
+        $oldmemlimit = @ini_get('memory_limit');
+        if(empty($oldmemlimit)) {
             // PHP not compiled with memory limits, this means that it's
-            // probably limited to 8M so we have a problem...
-            return true;
+            // probably limited to 8M or in case of Windows not at all.
+            // We can ignore it for now - there is not much to test anyway
+            // TODO: add manual test that fills memory??
+            return false;
         }
-        // Otherwise, raise_memory_limit in setup.php will do the trick
+        $oldmemlimit = get_real_size($oldmemlimit);
+        //now lets change the memory limit to something unique below 128M==134217728
+        @ini_set('memory_limit', 134217720);
+        $testmemlimit = get_real_size(@ini_get('memory_limit'));
+        //verify the change had any effect at all
+        if ($oldmemlimit == $testmemlimit) {
+            //memory limit can not be changed - is it big enough then?
+            if ($oldmemlimit < get_real_size('128M')) {
+                return true;
+            } else {
+                return false;
+            }
+        }
+        @ini_set('memory_limit', $oldmemlimit);
         return false;
     }
     function severity() {
-        return SEVERITY_ANNOYANCE;
+        return SEVERITY_NOTICE;
     }
     function description() {
-        return 'The settings for PHP on your server do not allow a script to request more memory during its execution. This means that most likely there is a hard limit of 8MB for each script. It is possible that certain operations within Moodle will require more than this amount in order to complete successfully, especially if there are lots of data to be processed. Therefore, it is recommended that you contact your server administrator to address this issue.';
+        return 'The settings for PHP on your server do not allow a script to request more memory during its execution. '.
+               'This means that there is a hard limit of '.@ini_get('memory_limit').' for each script. '.
+               'It is possible that certain operations within Moodle will require more than this amount in order '.
+               'to complete successfully, especially if there are lots of data to be processed.';
     }
     function solution() {
-        global $CFG;
-        return 'We need a good solution here. Enabling memory limit control means recompiling PHP... maybe this should be SEVERITY_NOTICE instead of SEVERITY_ANNOYANCE?';
+        return 'It is recommended that you contact your web server administrator to address this issue.';
     }
 }
 
@@ -421,7 +444,7 @@ class problem_000010 extends problem_base {
             $desc .= '<li>slasharguments are enabled in Moodle configuration</li>';   
         }
         if ($this->status() == -1) {
-            $desc .= '<li>can not run automatic test, you can verify it <a href="'.$CFG->wwwroot.'/file.php/testslasharguments" target="_blank">here</a></li>';
+            $desc .= '<li>can not run automatic test, you can verify it <a href="'.$CFG->wwwroot.'/file.php/testslasharguments" target="_blank">here</a> manually</li>';
         } else if ($this->status() == 0) {
             $desc .= '<li>slashargument test <strong>failed</strong>, please check server configuration</li>';
         } else {
@@ -462,13 +485,13 @@ class problem_000010 extends problem_base {
     function status() {
         global $CFG;
         $handle = @fopen($CFG->wwwroot.'/file.php?file=/testslasharguments', "r");
-        $contents = trim(@fread($handle, 7));
+        $contents = @trim(fread($handle, 10));
         @fclose($handle);
         if ($contents != 'test -1') {
             return -1;
         }
         $handle = @fopen($CFG->wwwroot.'/file.php/testslasharguments', "r");
-        $contents = trim(@fread($handle, 6));
+        $contents = trim(@fread($handle, 10));
         @fclose($handle);
         switch ($contents) {
             case 'test 1': return 1;
@@ -499,7 +522,7 @@ class problem_000011 extends problem_base {
     }
     function solution() {
         global $CFG;
-        if (!empty($resetsesserrorcounter)) {
+        if (optional_param('resetsesserrorcounter', 0, PARAM_BOOL)) {
             if (get_field('config', 'name', 'name', 'session_error_counter')) {
                 delete_records('config', 'name', 'session_error_counter');
             }
@@ -535,6 +558,7 @@ class problem_00000x extends problem_base {
 TODO:
 
     session.save_path -- it doesn't really matter because we are already IN a session, right?
+    detect unsupported characters in $CFG->wwwroot - see bug Bug #6091 - relative vs absolute path during backup/restore process
 
 */
 

admin/index.php

@@ -5,20 +5,28 @@
         header('Location: ../install.php');
         die;
     }
-   
+
+/// Check that PHP is of a sufficient version
+/// Moved here because older versions do not allow while(@ob_end_clean());
+    if (version_compare(phpversion(), "4.3.0") < 0) {
+        $phpversion = phpversion();
+        echo "Sorry, Moodle requires PHP 4.3.0 or later (currently using version $phpversion)";
+        die;
+    }
+
+/// Turn off time limits and try to flush everything all the time, sometimes upgrades can be slow.
+
+    @set_time_limit(0);
+    @ob_implicit_flush(true);
+    while(@ob_end_clean()); // ob_end_flush prevents sending of headers
+
+
     require_once('../config.php');
     include_once($CFG->dirroot.'/lib/adminlib.php');  // Contains various admin-only functions
 
     $id             = optional_param('id', '', PARAM_ALPHANUM);
     $confirmupgrade = optional_param('confirmupgrade', 0, PARAM_BOOL);
     $agreelicence = optional_param('agreelicence',0, PARAM_BOOL);
-/// Check that PHP is of a sufficient version
-
-    if (!check_php_version("4.1.0")) { //TODO: should we bump it up to 4.3.0??
-        $phpversion = phpversion();
-        print_heading("Sorry, Moodle requires PHP 4.1.0 or later (currently using version $phpversion)");
-        die;
-    }
 
 
 /// Check some PHP server settings
@@ -68,13 +76,6 @@
         $CFG->version = "";
     }
 
-/// Turn off time limits and try to flush everything all the time, sometimes upgrades can be slow.
-
-    @set_time_limit(0);
-    @ob_implicit_flush(true);
-    @ob_end_flush();
- 
-
 /// Check if the main tables have been installed yet or not.
 
     if (! $tables = $db->Metatables() ) {    // No tables yet at all.
@@ -221,7 +222,7 @@
 /// If any new configurations were found then send to the config page to check
 
     if (!empty($configchange)) {
-        redirect("config.php");
+        redirect("config.php?installing=1");
     }
 
 /// Find and check all main modules and load them up or upgrade them if necessary
@@ -257,7 +258,7 @@
 
 /// Define the unique site ID code if it isn't already
     if (empty($CFG->siteidentifier)) {    // Unique site identification code
-        set_config('siteidentifier', random_string(32));
+        set_config('siteidentifier', random_string(32).$_SERVER['HTTP_HOST']);
     }
 
 /// Check if the guest user exists.  If not, create one.
@@ -318,10 +319,13 @@
         print_spacer(10,10);
     }
 
-    if (ini_get_bool('register_globals') && !ini_get_bool('magic_quotes_gpc')) {
-        print_simple_box(get_string('globalsquoteswarning', 'admin'), 'center', '60%');
+    if (ini_get_bool('register_globals')) {
+        print_simple_box(get_string('globalswarning', 'admin'), 'center', '60%');
     }
 
+    if (is_dataroot_insecure()) {
+        print_simple_box(get_string('datarootsecuritywarning', 'admin', $CFG->dataroot), 'center', '60%');
+    }
 
 /// If no recently cron run
     $lastcron = get_field_sql('SELECT max(lastcron) FROM ' . $CFG->prefix . 'modules');
@@ -399,38 +403,44 @@
     $userdata .= '<div class="adminlink"><a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/uploaduser.php?sesskey='.$USER->sesskey.'">'.
                  get_string('uploadusers').'</a> - <span class="explanation">'.get_string('adminhelpuploadusers').'</span></div>';
 
-    $userdata .= '<hr /><div class="adminlink"><a href="enrol.php?sesskey='.$USER->sesskey.'">'.get_string('enrolmentplugins').
-                 '</a> - <span class="explanation">'.get_string('adminhelpenrolments').'</span></div>';
-    $userdata .= '<div class="adminlink"><a href="../course/index.php?edit=off&amp;sesskey='.$USER->sesskey.'">'.
-                 get_string('assignstudents').'</a> - <span class="explanation">'.get_string('adminhelpassignstudents').'</span></div>';
-
-    $userdata .= '<div class="adminlink"><a href="../course/index.php?edit=on&amp;sesskey='.$USER->sesskey.'">'.
-                 get_string('assignteachers').'</a> - <span class="explanation">'.get_string('adminhelpassignteachers').
-                 ' <img src="../pix/t/user.gif" height="11" width="11" alt="" /></span></div>';
-    $userdata .= '<div class="adminlink"><a href="creators.php?sesskey='.$USER->sesskey.'">'.get_string('assigncreators').
-                 '</a> - <span class="explanation">'.get_string('adminhelpassigncreators').'</span></div>';
-    $userdata .= '<div class="adminlink"><a href="admin.php?sesskey='.$USER->sesskey.'">'.get_string('assignadmins').
-                 '</a> - <span class="explanation">'.get_string('adminhelpassignadmins').'</span></div>';
-
     $table->data[] = array('<strong><a href="users.php">'.get_string('users').'</a></strong>', $userdata);
 
-    $table->data[] = array('<strong><a href="../course/index.php?edit=on&amp;sesskey='.$USER->sesskey.'">'.get_string('courses').'</a></strong>',
-                           '<div class="explanation">'.get_string('adminhelpcourses').'</div>');
-    $table->data[] = array('<strong><a href="../files/index.php?id='.$site->id.'">'.get_string('sitefiles').'</a></strong>',
-                           '<div class="explanation">'.get_string('adminhelpsitefiles').'</div>');
-    $table->data[] = array('<strong><a href="stickyblocks.php">'.get_string('stickyblocks','admin').'</a></strong>',
-                           '<div class="explanation">'.get_string('adminhelpstickyblocks').'</div>');
-    $table->data[] = array('<strong><a href="report.php">'.get_string('reports').'</a></strong>', 
-                           '<div class="explanation">'.get_string('adminhelpreports').'</div>');
-    $table->data[] = array('<strong><a href="environment.php">'.get_string('environment','admin').'</a></strong>',
-                           '<div class="explanation">'.get_string('adminhelpenvironment').'</div>');
+    $coursedata = '<div class="adminlink"><a href="../course/index.php?edit=on&amp;sesskey='.$USER->sesskey.'">'.get_string('managecourses').
+                 '</a> - <span class="explanation">'.get_string('adminhelpcourses').'</span></div>';
+    $coursedata .= '<div class="adminlink"><a href="enrol.php?sesskey='.$USER->sesskey.'">'.get_string('enrolmentplugins').
+                 '</a> - <span class="explanation">'.get_string('adminhelpenrolments').'</span></div>';
+    $coursedata .= '<div class="adminlink"><a href="../course/index.php?edit=off&amp;sesskey='.$USER->sesskey.'">'.
+                 get_string('assignstudents').'</a> - <span class="explanation">'.get_string('adminhelpassignstudents').'</span></div>';
+    $coursedata .= '<div class="adminlink"><a href="../course/index.php?edit=on&amp;sesskey='.$USER->sesskey.'">'.
+                 get_string('assignteachers').'</a> - <span class="explanation">'.get_string('adminhelpassignteachers').
+                 ' <img src="../pix/t/user.gif" height="11" width="11" alt="" /></span></div>';
+    $coursedata .= '<div class="adminlink"><a href="creators.php?sesskey='.$USER->sesskey.'">'.get_string('assigncreators').
+                 '</a> - <span class="explanation">'.get_string('adminhelpassigncreators').'</span></div>';
+    $coursedata .= '<div class="adminlink"><a href="admin.php?sesskey='.$USER->sesskey.'">'.get_string('assignadmins').
+                 '</a> - <span class="explanation">'.get_string('adminhelpassignadmins').'</span></div>';
 
+    $table->data[] = array('<strong><a href="courses.php">'.get_string('courses').'</a></strong>', $coursedata);
+
+    $miscdata = '<div class="adminlink"><a href="../files/index.php?id='.$site->id.'">'.get_string('sitefiles').
+                 '</a> - <span class="explanation">'.get_string('adminhelpsitefiles').'</span></div>';
+    $miscdata .= '<div class="adminlink"><a href="stickyblocks.php">'.get_string('stickyblocks','admin').
+                 '</a> - <span class="explanation">'.get_string('adminhelpstickyblocks').'</span></div>';
+    $miscdata .= '<div class="adminlink"><a href="report.php">'.get_string('reports').
+                 '</a> - <span class="explanation">'.get_string('adminhelpreports').'</span></div>';
+//to be enabled later
+/*    $miscdata .= '<div class="adminlink"><a href="health.php">'.get_string('healthcenter').
+                 '</a> - <span class="explanation">'.get_string('adminhelphealthcenter').'</span></div>';*/
+    $miscdata .= '<div class="adminlink"><a href="environment.php">'.get_string('environment', 'admin').
+                 '</a> - <span class="explanation">'.get_string('adminhelpenvironment').'</span></div>';
 /// Optional stuff
     if (file_exists("$CFG->dirroot/$CFG->admin/$CFG->dbtype")) {
-        $table->data[] = array("<strong><a href=\"$CFG->dbtype/frame.php\">".get_string('managedatabase').'</a></strong>',
-                               '<div class="explanation">'.get_string('adminhelpmanagedatabase').'</div>');
+        $miscdata .= '<div class="adminlink"><a href="'.$CFG->dbtype.'/frame.php">'.get_string('managedatabase').
+        			 '</a> - <span class="explanation">'.get_string('adminhelpmanagedatabase').'</span></div>';
     }
 
+    $table->data[] = array('<strong><a href="misc.php">'.get_string('miscellaneous').'</a></strong>', $miscdata);
+
+
 /// Hooks for Matt Oquists contrib code for repositories and portfolio.  
 /// The eventual official versions may not look like this
     if (isset($CFG->portfolio) && file_exists("$CFG->dirroot/$CFG->portfolio")) {
@@ -468,14 +478,6 @@ epository').'</a></strong>',
 
     print_simple_box_end();
 
-    
-    if (optional_param('dbmigrate')) {               // ??? Is this actually used?
-        print_simple_box_start('center','60%');
-        require_once($CFG->dirroot.'/admin/utfdbmigrate.php');
-        db_migrate2utf8();
-        print_simple_box_end();
-    }
-
 
     print_footer($site);
 

admin/lang.php

@@ -1,9 +1,59 @@
 <?PHP // $Id$
+    /**
+    * Display the admin/language menu and process strings translation.
+    *
+    * CHANGES
+    *
+    * 2006/06/08 mudrd8mz
+    * 1) Fixed bug 5745 reported by Harry Smith so now can edit en_utf8_local pack
+    * 2) More notification messages included
+    *
+    * 2006/05/30 mudrd8mz
+    * Merged with version by Mitsuhiro Yoshida - display icon links instead of text links
+    * (I have changed the position of arrow icons to not to be so close each other)
+    *
+    * 2006/05/19 mudrd8mz
+    * A lot of changes to support translation of *_utf8_local langugage packs. Needs testing
+    *
+    * 2006/05/16 mudrd8mz
+    * 1) LANG_DEFAULT_FILE can be now set. moodle.php used to be opened automatically.
+    *    As it was (and still is) one of the biggest files it usually took a long time to load the page
+    *    even if you just want to choose the file to translate.
+    * 2) added links from "missing" to "compare" mode page
+    * 3) english strings are now key-sorted in "missing" mode
+    * 4) list of files with missing strings is now displayed at the top of "missing" page
+    *
+    * 2006/05/14 mudrd8mz Improvements of lang.php,v 1.65 2006/04/10 22:15:57 stronk7 Exp 
+    *  1) "go to first missing string" link can be displayed (see LANG_DISPLAY_MISSING_LINKS)
+    *  2) "go to next missing" link can be displayed (see LANG_DISPLAY_MISSING_LINKS)
+    *  3) submit button may be repeated (see LANG_SUBMIT_REPEAT*)
+    *  4) added (empty) "summary" attribute for the <table>'s
+    *  5) added error_reporting(E_ALL ^ E_NOTICE); in "compare" mode (even in debug environment
+    *     we know that missing keys are missing strings here, not bugs ;-)
+    */
 
     require_once('../config.php');
 
+    define('LANG_SUBMIT_REPEAT', 1);            // repeat displaying submit button?
+    define('LANG_SUBMIT_REPEAT_EVERY', 20);     // if so, after how many lines?
+    define('LANG_DISPLAY_MISSING_LINKS', 1);    // display "go to first/next missing string" links?
+    define('LANG_DEFAULT_FILE', '');            // default file to translate. Empty allowed
+    define('LANG_LINK_MISSING_STRINGS', 1);     // create links from "missing" page to "compare" page?
+    define('LANG_DEFAULT_USELOCAL', 0);         // should *_utf8_local be used by default?
+
     $mode        = optional_param('mode', '', PARAM_ALPHA);
-    $currentfile = optional_param('currentfile', 'moodle.php', PARAM_FILE);
+    $currentfile = optional_param('currentfile', LANG_DEFAULT_FILE, PARAM_FILE);
+    $uselocal    = optional_param('uselocal', -1, PARAM_INT);
+
+    if ($uselocal == -1) {
+        if (isset($SESSION->langtranslateintolocal)) {
+            $uselocal = $SESSION->langtranslateintolocal;
+        } else {
+            $uselocal = LANG_DEFAULT_USELOCAL;
+        }
+    } else {
+        $SESSION->langtranslateintolocal = $uselocal;
+    }
 
     require_login();
 
@@ -23,9 +73,30 @@
     $streditstrings = get_string("editstrings", 'admin');
     $stredithelpdocs = get_string("edithelpdocs", 'admin');
     $strthislanguage = get_string("thislanguage");
+    $strgotofirst = get_string('gotofirstmissing','admin');
+    $strfilestoredin = get_string('langstorein', 'admin');
+    $strfilestoredinhelp = get_string('langstoreinhelp', 'admin');
+    $strswitchlangdirbtn = get_string('langstoreswitch', 'admin');
+    $strchoosefiletoedit = get_string('langchoosefile', 'admin');
+    $streditennotallowed = get_string('langnoeditenglish', 'admin');
+    $strfilecreated = get_string('langfilecreated', 'admin');
 
+    // FIXME / TODO
+    // remove following lines after adding string into proper english lang pack
+    $strgotofirst = 'go to first missing string';
+    $strfilestoredin = 'Save file into folder :';
+    $strfilestoredinhelp = 'Where the file will be stored';
+    $strswitchlangdirbtn = 'switch';
+    $strchoosefiletoedit = 'Choose file to edit from the box above';
+    $streditennotallowed = 'Language en_utf8 cannot be edited with this page - switch to local';
+    $strfilecreated = 'New file created';
+
+    $currentlang = current_language();
+    
     switch ($mode) {
         case "missing":
+            // Missing array keys are not bugs here but missing strings
+            error_reporting(E_ALL ^ E_NOTICE);
             $navigation = "<a href=\"lang.php\">$strlanguage</a> -> $strmissingstrings";
             $title = $strmissingstrings;
             $button = '<form target="'.$CFG->framename.'" method="get" action="'.$CFG->wwwroot.'/'.$CFG->admin.'/lang.php">'.
@@ -46,7 +117,6 @@
             break;
     }
 
-    $currentlang = current_language();
 
     print_header("$site->shortname: $title", "$site->fullname",
                  "<a href=\"index.php\">$stradministration</a> -> ".
@@ -55,7 +125,7 @@
 
     if (!$mode) {
         print_simple_box_start('center','80%');
-        echo '<table align="center" width="100%"><tr><td width="50%" align="center">';
+        echo '<table summary="" align="center" width="100%"><tr><td width="50%" align="center">';
         print_string('managelang','admin');
         echo '</td><td align="center" width="50%">';
         print_string('editlang','admin');
@@ -65,7 +135,7 @@
         echo '</td><td>';
         $currlang = current_language();
         $langs = get_list_of_languages();
-        echo "<table align=\"center\"><tr><td align=\"right\">";
+        echo "<table summary=\"\" align=\"center\"><tr><td align=\"right\">";
         echo "<b>$strcurrentlanguage:</b>";
         echo "</td><td>";
         echo popup_form ("$CFG->wwwroot/$CFG->admin/lang.php?lang=", $langs, "chooselang", $currlang, "", "", "", true);
@@ -84,8 +154,13 @@
 
     // Get a list of all the root files in the English directory
 
-    $langdir = "$CFG->dataroot/lang/$currentlang";
     $enlangdir = "$CFG->dirroot/lang/en_utf8";
+    if ($currentlang == 'en_utf8') {
+        $langdir = $enlangdir;
+    } else {
+        $langdir = "$CFG->dataroot/lang/$currentlang";
+    }
+    $locallangdir = "$CFG->dataroot/lang/{$currentlang}_local";
 
     if (! $stringfiles = get_directory_list($enlangdir, "", false)) {
         error("Could not find English language pack!");
@@ -105,20 +180,31 @@
             error ('to edit this language pack, you need to put it in '.$CFG->dataroot.'/lang');
         }
 
+        // Following variables store the HTML output to be echo-ed
+        $m = '';
+        $o = '';
+
         // For each file, check that a counterpart exists, then check all the strings
         foreach ($stringfiles as $file) {
             unset($string);
             include("$enlangdir/$file");
             $enstring = $string;  
+
+            ksort($enstring);
             
             unset($string);
 
             if (file_exists("$langdir/$file")) {
                 include("$langdir/$file");
+                $fileismissing = 0;
             } else {
-                notify(get_string("filemissing", "", "$langdir/$file"));
+                $fileismissing = 1;
+                // notify(get_string("filemissing", "", "$langdir/$file"));
+                $o .= '<div class="notifyproblem" align="center">'.get_string("filemissing", "", "$langdir/$file").'</div><br />';
                 $string = array();
             }
+
+            $missingcounter = 0;
     
             $first = true;
             foreach ($enstring as $key => $value) {
@@ -127,18 +213,39 @@
                     $value = str_replace("$"."a", "\\$"."a", $value);
                     $value = str_replace("%%","%",$value);
                     if ($first) {
-                        echo "<p><b>".get_string("stringsnotset","","$langdir/$file")."</b></p><pre>";
+                        $m .= "<a href=\"lang.php?mode=missing#$file\">$file";
+                        $m .= $fileismissing ? '*' : '';
+                        $m .= '</a> &nbsp; ';
+                        $o .= "<p><a name=\"$file\"></a><b>".get_string("stringsnotset","","$langdir/$file")."</b></p><pre>";
                         $first = false;
                         $somethingfound = true;
                     }
-                    echo "$"."string['$key'] = \"$value\";<br />";
+                    $missingcounter++;
+                    if (LANG_LINK_MISSING_STRINGS) {
+                        $missinglinkstart = "<a href=\"lang.php?mode=compare&amp;currentfile=$file#missing$missingcounter\">";
+                        $missinglinkend = '</a>';
+                    } else {
+                        $missinglinkstart = '';
+                        $missinglinkend = '';
+                    }
+                    $o .= "$"."string['".$missinglinkstart.$key.$missinglinkend."'] = \"$value\";<br />";
                 }
             }
             if (!$first) {
-                echo '</pre><hr />';
+                $o .= '</pre><hr />';
             }
         }
   
+        if ($m <> '') {
+            echo '<br />';
+            print_simple_box_start("center", "80%");
+            echo '<center><font size="2">';
+            echo $m;
+            echo '</font></center>';
+            print_simple_box_end();
+        }
+        echo $o;
+
         if (! $files = get_directory_list("$CFG->dirroot/lang/en_utf8/help", "CVS")) {
             error("Could not find English language help files!");
         }
@@ -169,12 +276,26 @@
         }
 
     } else if ($mode == "compare") {
-
-        if (!file_exists($langdir)) {
-            error ('to edit this language pack, you need to put it in '.$CFG->dataroot.'/lang');
+   
+        if (!$uselocal && !file_exists($langdir)) {
+            if (!lang_make_directory($langdir)) {
+                error('ERROR: Could not create directory '.$langdir);
+            } else {
+                echo '<div class="notifysuccess" align="center">Created directory '.
+                                                     $langdir .'</div>'."<br />\n";
+            }
         }
-
-
+        if ($uselocal && !file_exists($locallangdir)) {
+            if (!lang_make_directory($locallangdir)) {
+                echo '<div class="notifyproblem" align="center">ERROR: Could not create directory '.
+                                     $locallangdir .'</div>'."<br />\n";
+                $uselocal = 0;
+            } else {
+                echo '<div class="notifysuccess" align="center">Created directory '.
+                                                     $locallangdir .'</div>'."<br />\n";
+            }
+        }
+        
         if (isset($_POST['currentfile'])){   // Save a file
             if (!confirm_sesskey()) {
                 error(get_string('confirmsesskeybad', 'error'));
@@ -188,12 +309,28 @@
             }
             
             unset($newstrings['currentfile']);
-            if (lang_save_file($langdir, $currentfile, $newstrings)) {
-                notify(get_string("changessaved")." ($langdir/$currentfile)", "green");
+
+            if ($uselocal) {
+                include("$langdir/$currentfile");
+                if (isset($string)) {
+                    $packstring = $string;
+                } else {
+                    $packstring = array();
+                }
+                unset($string);
+                $saveinto = $locallangdir;
             } else {
-                error("Could not save the file '$currentfile'!", "lang.php?mode=compare&amp;currentfile=$currentfile");
+                $packstring = array();  
+                $saveinto = $langdir;
             }
-        }
+            
+            if (lang_save_file($saveinto, $currentfile, $newstrings, $uselocal, $packstring)) {
+                notify(get_string("changessaved")." ($saveinto/$currentfile)", "green");
+            } else {
+                error("Could not save the file '$saveinto/$currentfile'!", "lang.php?mode=compare&amp;currentfile=$currentfile");
+            }
+            unset($packstring);
+        } 
 
         print_heading_with_help($streditstrings, "langedit");
 
@@ -209,133 +346,213 @@
         echo '</font></center>';
         print_simple_box_end();
 
-        
-        print_heading("$currentfile", "center", 4);
 
-        if (!file_exists("$langdir/$currentfile")) {
-            if (!touch("$langdir/$currentfile")) {
-                echo "<p><font color=\"red\">".get_string("filemissing", "", "$langdir/$currentfile")."</font></p>";
-                continue;
+        print_simple_box_start("center", "80%");
+        echo '<center>'.$strfilestoredin.' <strong>';
+        echo $uselocal ? "{$currentlang}_local" : $currentlang;
+        echo '</strong> ';
+        helpbutton('langswitchstorage', $strfilestoredinhelp, 'moodle');
+        
+        echo '<form target="'.$CFG->framename.'" method="get" action="'.$CFG->wwwroot.'/'.$CFG->admin.'/lang.php">'.
+             '<input type="hidden" name="mode" value="compare" />'.
+             '<input type="hidden" name="currentfile" value="'.$currentfile.'" />'.
+             '<input type="hidden" name="uselocal" value="'.(1 - $uselocal % 2).'" />'.
+             '<input type="submit" value="'.$strswitchlangdirbtn.'" />'.
+             '</form></center>';
+        print_simple_box_end();
+       
+        if ($currentfile <> '') {
+            $saveto = $uselocal ? $locallangdir : $langdir;
+            error_reporting(0);
+            if (!file_exists("$saveto/$currentfile")) {
+                if (!@touch("$saveto/$currentfile")) {
+                    print_heading(get_string("filemissing", "", "$saveto/$currentfile"), "center", 4, "error");
+                } else {
+                    print_heading($strfilecreated, "center", 4, "notifysuccess");
+                }
+            }
+            if ($currentlang == "en_utf8" && !$uselocal) {
+                $editable = false;
+                print_heading($streditennotallowed, 'center', 4);
+            } elseif ($f = fopen("$saveto/$currentfile","r+")) {
+                $editable = true;
+                fclose($f);
+            } else {
+                $editable = false;
+                echo "<p><font size=\"1\">".get_string("makeeditable", "", "$saveto/$currentfile")."</font></p>";
+            }
+            error_reporting($CFG->debug);
+            
+            print_heading("$currentfile", "center", 4);
+            if (LANG_DISPLAY_MISSING_LINKS && $editable) {
+                print_heading('<a href="#missing1">'.$strgotofirst.'</a>', "center", 4);
             }
-        }
 
-        error_reporting(0);
-        if ($f = fopen("$langdir/$currentfile","r+") && ($currentlang != "en_utf8")) {
-            $editable = true;
-            fclose($f);
-        } else {
-            $editable = false;
-            echo "<p><font size=\"1\">".get_string("makeeditable", "", "$langdir/$currentfile")."</font></p>";
-        }
-        ///added code here to prevent en_utf8 being edited
-        
-        error_reporting(7);
+            unset($string);
+            include("$enlangdir/$currentfile");
+            $enstring = $string;  
+            if ($currentlang != 'en' and $currentfile == 'moodle.php') {
+                $enstring['thislanguage'] = "<< TRANSLATORS: Specify the name of your language here.  If possible use Unicode Numeric Character References >>";
+                $enstring['thischarset'] = "<< TRANSLATORS: Specify the character set of your language here. Note that all text created while this language is active will be stored using this character set, so don't change it once you have set it. Example: iso-8859-1 >>";
+                $enstring['thisdirection'] = "<< TRANSLATORS: This string specifies the direction of your text, either left-to-right or right-to-left.  Insert either 'ltr' or 'rtl' here. >>";
+                $enstring['parentlanguage'] = "<< TRANSLATORS: If your language has a Parent Language that Moodle should use when strings are missing from your language pack, then specify the code for it here.  If you leave this blank then English will be used.  Example: nl >>";
+            }
+            ksort($enstring);
 
+            unset($string);
 
-        unset($string);
-        include("$enlangdir/$currentfile");
-        $enstring = $string;  
-        if ($currentlang != 'en' and $currentfile == 'moodle.php') {
-            $enstring['thislanguage'] = "<< TRANSLATORS: Specify the name of your language here.  If possible use Unicode Numeric Character References >>";
-            $enstring['thischarset'] = "<< TRANSLATORS: Specify the character set of your language here. Note that all text created while this language is active will be stored using this character set, so don't change it once you have set it. Example: iso-8859-1 >>";
-            $enstring['thisdirection'] = "<< TRANSLATORS: This string specifies the direction of your text, either left-to-right or right-to-left.  Insert either 'ltr' or 'rtl' here. >>";
-            $enstring['parentlanguage'] = "<< TRANSLATORS: If your language has a Parent Language that Moodle should use when strings are missing from your language pack, then specify the code for it here.  If you leave this blank then English will be used.  Example: nl >>";
-        }
-        ksort($enstring);
-
-        unset($string);
-        include("$langdir/$currentfile");
-
-        if ($editable) {
-            echo "<form name=\"$currentfile\" action=\"lang.php\" method=\"post\">";
-        }
-        echo "<table width=\"100%\" cellpadding=\"2\" cellspacing=\"3\" border=\"0\" class=\"generalbox\">";
-        foreach ($enstring as $key => $envalue) {
-            $envalue = nl2br(htmlspecialchars($envalue));
-            $envalue = preg_replace('/(\$a\-\&gt;[a-zA-Z0-9]*|\$a)/', '<b>$0</b>', $envalue);  // Make variables bold. 
-            $envalue = str_replace("%%","%",$envalue);
-            $envalue = str_replace("\\","",$envalue);              // Delete all slashes
-
-            echo "\n\n".'<tr>';
-            echo '<td dir="ltr" lang="en" width="20%" nowrap="nowrap" valign="top">'.$key.'</td>'."\n";
-            echo '<td dir="ltr" lang="en" width="40%" valign="top">'.$envalue.'</td>'."\n";
-
-            $value = $string[$key];
-            $value = str_replace("\r","",$value);              // Bad character caused by Windows
-            $value = preg_replace("/\n{3,}/", "\n\n", $value); // Collapse runs of blank lines
-            $value = trim($value, "\n");                       // Delete leading/trailing lines
-            $value = str_replace("\\","",$value);              // Delete all slashes
-            $value = str_replace("%%","%",$value);
-            $value = str_replace("<","&lt;",$value);
-            $value = str_replace(">","&gt;",$value);
-            $value = str_replace('"',"&quot;",$value);
-
-            $cellcolour = $value ? '': 'class="highlight"';
+            @include("$locallangdir/$currentfile");
+            $localstring = isset($string) ? $string : array();
+            unset($string);
+            
+            @include("$langdir/$currentfile");
 
             if ($editable) {
-                echo '<td width="40%" '.$cellcolour.' valign="top">'."\n";
-                if (isset($string[$key])) {
-                    $valuelen = strlen($value);
-                } else {
-                    $valuelen = strlen($envalue);
-                }
-                $cols=50;
-                if (strstr($value, "\r") or strstr($value, "\n") or $valuelen > $cols) {
-                    $rows = ceil($valuelen / $cols);
-                    echo '<textarea name="stringXXX'.lang_form_string_key($key).'" cols="'.$cols.'" rows="'.$rows.'">'.$value.'</textarea>'."\n";
-                } else {
-                    if ($valuelen) {
-                        $cols = $valuelen + 2;
-                    }
-                    echo '<input type="text" name="stringXXX'.lang_form_string_key($key).'" value="'.$value.'" size="'.$cols.'" />';
-                }
-                echo '</td>';
-
-            } else {
-                echo '<td width="40%" bgcolor="'.$cellcolour.'" valign="top">'.$value.'</td>';
+                echo "<form name=\"$currentfile\" action=\"lang.php\" method=\"post\">";
             }
-        }
-        if ($editable) {
-            echo '<tr><td colspan="2">&nbsp;<td><br />';
-            echo '<input type="hidden" name="sesskey" value="'.$USER->sesskey.'" />';
-            echo '    <input type="hidden" name="currentfile" value="'.$currentfile.'" />';
-            echo '    <input type="hidden" name="mode" value="compare" />';
-            echo '    <input type="submit" name="update" value="'.get_string('savechanges').': '.$currentfile.'" />';
-            echo '</td></tr>';
-        }
-        echo '</table>';
-        echo '</form>'; 
+            echo "<table summary=\"\" width=\"100%\" cellpadding=\"2\" cellspacing=\"3\" border=\"0\" class=\"generalbox\">";
+            $linescounter = 0;
+            $missingcounter = 0;
+            foreach ($enstring as $key => $envalue) {
+                $linescounter++ ;
+                if (LANG_SUBMIT_REPEAT &&  $editable && $linescounter % LANG_SUBMIT_REPEAT_EVERY == 0) {
+                    echo '<tr><td colspan="2">&nbsp;<td><br />';
+                    echo '    <input type="submit" name="update" value="'.get_string('savechanges').': '.$currentfile.'" />';
+                    echo '<br />&nbsp;</td></tr>';
+                }
+                $envalue = nl2br(htmlspecialchars($envalue));
+                $envalue = preg_replace('/(\$a\-\&gt;[a-zA-Z0-9]*|\$a)/', '<b>$0</b>', $envalue);  // Make variables bold. 
+                $envalue = str_replace("%%","%",$envalue);
+                $envalue = str_replace("\\","",$envalue);              // Delete all slashes
 
+                echo "\n\n".'<tr>';
+                echo '<td dir="ltr" lang="en" width="20%" nowrap="nowrap" valign="top">'.$key.'</td>'."\n";
+                echo '<td dir="ltr" lang="en" width="40%" valign="top">'.$envalue.'</td>'."\n";
+
+                // Missing array keys are not bugs here but missing strings
+                error_reporting(E_ALL ^ E_NOTICE);
+                if ($uselocal) {
+                    $value = lang_fix_value_from_file($localstring[$key]);
+                    $value2 = lang_fix_value_from_file($string[$key]);
+                    if ($value == '') {
+                        $value = $value2;
+                    }
+                } else {
+                    $value = lang_fix_value_from_file($string[$key]);
+                    $value2 = lang_fix_value_from_file($localstring[$key]);
+                }
+                error_reporting($CFG->debug);
+
+                // Color highlighting:
+                // red #ef6868 - translation missing in both system and local pack
+                // yellow #feff7f - translation missing in system pack but is translated in local
+                // green #AAFFAA - translation present in both system and local but is different
+                if (!$value) {
+                    if (!$value2) {
+                        $cellcolour = 'style="background-color: #ef6868"'; // TODO: replace by CSS class
+                    } else {
+                        $cellcolour = 'style="background-color: #feff7f"'; // TODO: replace by CSS class
+                    }
+                    $missingcounter++;
+                    if (LANG_DISPLAY_MISSING_LINKS) {
+                        $missingtarget = '<a name="missing'.$missingcounter.'"></a>';
+                        $missingnext = '<a href="#missing'.($missingcounter+1).'">'.
+                        '<img src="' . $CFG->pixpath . '/t/down.gif" height="11" width="11" border="0" alt="" /></a>';
+                        $missingprev = '<a href="#missing'.($missingcounter-1).'">'.
+                        '<img src="' . $CFG->pixpath . '/t/up.gif" height="11" width="11" border="0" alt="" /></a>';
+                    } else {
+                        $missingtarget = '';
+                        $missingnext = '';
+                        $missingprev = '';
+                    }
+                } else {
+                    if ($value <> $value2 && $value2 <> '') {
+                        $cellcolour = 'style="background-color: #AAFFAA"'; // TODO: replace by CSS class
+                    } else {
+                        $cellcolour = '';
+                    }
+                    $missingtarget = '';
+                    $missingnext = '';
+                    $missingprev = '';
+                }
+
+                if ($editable) {
+                    echo '<td width="40%" '.$cellcolour.' valign="top">'. $missingprev . $missingtarget."\n";
+                    if (isset($string[$key])) {
+                        $valuelen = strlen($value);
+                    } else {
+                        $valuelen = strlen($envalue);
+                    }
+                    $cols=50;
+                    if (strstr($value, "\r") or strstr($value, "\n") or $valuelen > $cols) {
+                        $rows = ceil($valuelen / $cols);
+                        echo '<textarea name="stringXXX'.lang_form_string_key($key).'" cols="'.$cols.'" rows="'.$rows.'">'.$value.'</textarea>'."\n";
+                    } else {
+                        if ($valuelen) {
+                            $cols = $valuelen + 5;
+                        }
+                        echo '<input type="text" name="stringXXX'.lang_form_string_key($key).'" value="'.$value.'" size="'.$cols.'" />';
+                    }
+                    if ($value2 <> '' && $value <> $value2) {
+                        echo '<br /><span style="font-size:small">'.$value2.'</span>';
+                    }
+                    echo $missingnext . '</td>';
+
+                } else {
+                    echo '<td width="40%" bgcolor="'.$cellcolour.'" valign="top">'.$value.'</td>';
+                }
+            }
+            if ($editable) {
+                echo '<tr><td colspan="2">&nbsp;<td><br />';
+                echo '<input type="hidden" name="sesskey" value="'.$USER->sesskey.'" />';
+                echo '    <input type="hidden" name="currentfile" value="'.$currentfile.'" />';
+                echo '    <input type="hidden" name="mode" value="compare" />';
+                echo '    <input type="submit" name="update" value="'.get_string('savechanges').': '.$currentfile.'" />';
+                echo '</td></tr>';
+            }
+            echo '</table>';
+            echo '</form>'; 
+
+        } else {
+            // no $currentfile specified
+            print_heading($strchoosefiletoedit, "center", 4);
+        }
     }
 
     print_footer();
 
 //////////////////////////////////////////////////////////////////////
 
-function lang_save_file($path, $file, $strings) {
-// Thanks to Petri Asikainen for the original version of code 
-// used to save language files.
-//
-// $path is a full pathname to the file
-// $file is the file to overwrite.
-// $strings is an array of strings to write
-
+/**
+ * Save language translation file.
+ *
+ * Thanks to Petri Asikainen for the original version of code 
+ * used to save language files.
+ *
+ * @uses $CFG
+ * @uses $USER
+ * @param string $path Full pathname to the directory to use
+ * @param string $file File to overwrite
+ * @param array $strings Array of strings to write
+ * @param bool $local Should *_local version be saved?
+ * @param array $packstrings Array of default langpack strings (needed if $local)
+ * @return bool Created successfully?
+ */ 
+function lang_save_file($path, $file, $strings, $local, $packstrings) {
     global $CFG, $USER;
-
-    error_reporting(0);
-    if (!$f = fopen("$path/$file","w")) {
+    if (!$f = @fopen("$path/$file","w")) {
         return false;
     }
-    error_reporting(7);
-
 
     fwrite($f, "<?PHP // \$Id\$ \n");
-    fwrite($f, "      // $file - created with Moodle $CFG->release ($CFG->version)\n\n\n");
-
+    fwrite($f, "      // $file - created with Moodle $CFG->release ($CFG->version)\n");
+    if ($local) {
+        fwrite($f, "      // local modifications from $CFG->wwwroot\n");
+    }
+    fwrite($f, "\n\n");
     ksort($strings);
-
     foreach ($strings as $key => $value) {
-        list($id, $stringname) = explode('XXX',$key);
+        @list($id, $stringname) = explode('XXX',$key);
         if ($CFG->lang != "zh_hk" and $CFG->lang != "zh_tw") {  // Some MB languages include backslash bytes
             $value = str_replace("\\","",$value);           // Delete all slashes
         }
@@ -343,16 +560,55 @@ function lang_save_file($path, $file, $strings) {
         $value = str_replace('"', "\\\"", $value);          // Add slashes for "
         $value = str_replace("%","%%",$value);              // Escape % characters
         $value = str_replace("\r", "",$value);              // Remove linefeed characters
+        $value = trim($value);                              // Delete leading/trailing white space
         if ($id == "string" and $value != ""){
-            fwrite($f,"\$string['$stringname'] = '$value';\n");
+            if ((!$local) || (lang_fix_value_from_file($packstrings[$stringname]) <> lang_fix_value_from_file($value))) {
+                fwrite($f,"\$string['$stringname'] = '$value';\n");
+            }
         }
     }
     fwrite($f,"\n?>\n");
     fclose($f);
-
     return true;
 }
 
+/**
+ * Fix value of string to translate.
+ *
+ * @param string $value Original string from the file
+ * @return string Fixed value
+ */
+function lang_fix_value_from_file($value='') {
+    $value = str_replace("\r","",$value);              // Bad character caused by Windows
+    $value = preg_replace("/\n{3,}/", "\n\n", $value); // Collapse runs of blank lines
+    $value = trim($value);                             // Delete leading/trailing white space
+    $value = str_replace("\\","",$value);              // Delete all slashes
+    $value = str_replace("%%","%",$value);
+    $value = str_replace("<","&lt;",$value);
+    $value = str_replace(">","&gt;",$value);
+    $value = str_replace('"',"&quot;",$value);
+    return $value;
+}
+
+/**
+ * Try and create a new language directory.
+ *
+ * @uses $CFG
+ * @param string $directory  directory name under $CFG->dataroot/lang eg cs_utf8_local
+ * @return string|false Returns full path to directory if successful, false if not
+ */
+function lang_make_directory($dir, $shownotices=true) {
+    global $CFG;
+    umask(0000);
+    if (! file_exists($dir)) {
+        if (! @mkdir($dir, $CFG->directorypermissions)) {
+            return false;
+        }
+        //@chmod($dir, $CFG->directorypermissions);  // Just in case mkdir didn't do it
+    }
+    return $dir;
+}
+
 
 
 /// Following functions are required because '.' in form input names
@@ -362,7 +618,6 @@ function lang_form_string_key($keyfromfile) {
     return str_replace('.', '##46#', $keyfromfile);  /// Derived from &#46, the ascii value for a period.
 }
 
-
 function lang_file_string_key($keyfromform) {
     return str_replace('##46#', '.', $keyfromform);
 }

admin/misc.php

@@ -0,0 +1,47 @@
+<?php // $Id$
+
+    require_once('../config.php');
+
+    require_login();
+
+    if (!isadmin()) {
+        error("Only admins can access this page");
+    }
+
+    if (!$site = get_site()) {
+        redirect("index.php");
+    }
+
+    $stradministration = get_string("administration");
+    $strmisc           = get_string("miscellaneous");
+
+    print_header("$site->shortname: $stradministration: $strmisc", "$site->fullname", 
+                 "<a href=\"index.php\">$stradministration</a> -> $strmisc");
+
+    print_heading($strmisc);
+
+    $table->align = array ("right", "left");
+
+    $table->data[] = array('<b><a href="../files/index.php?id='.$site->id.'">'.get_string('sitefiles').'</a></b>',
+                           get_string("adminhelpsitefiles"));
+    $table->data[] = array('<b><a href="stickyblocks.php">'.get_string('stickyblocks','admin')."</a></b>",
+                           get_string('adminhelpstickyblocks'));
+    $table->data[] = array('<b><a href="report.php">'.get_string('reports')."</a></b>",
+                           get_string('adminhelpreports'));
+// to be enabled later
+/*    $table->data[] = array('<b><a href="health.php">'.get_string('healthcenter')."</a></b>",
+                           get_string('adminhelphealthcenter'));*/
+    $table->data[] = array('<b><a href="environment.php">'.get_string('environment', 'admin')."</a></b>",
+                           get_string('adminhelpenvironment'));
+    if (file_exists("$CFG->dirroot/$CFG->admin/$CFG->dbtype")) {
+        $table->data[] = array('<b><a href="'.$CFG->dbtype.'/frame.php">'.get_string('managedatabase')."</a></b>",
+                           get_string('adminhelpmanagedatabase'));
+    }
+
+    print_table($table);
+
+    print_footer($site);
+
+?>
+
+

admin/modules.php

@@ -177,7 +177,7 @@
             $settings = "";
         }
 
-        $count = count_records("$module->name");
+        $count = count_records_select("$module->name",'course<>0');
 
         if ($module->visible) {
             $visible = "<a href=\"modules.php?hide=$module->name&amp;sesskey=$USER->sesskey\" title=\"$strhide\">".

admin/register.php

@@ -26,7 +26,7 @@
     }
 
     if (empty($CFG->siteidentifier)) {    // Unique site identification code
-        set_config('siteidentifier', random_string(32));
+        set_config('siteidentifier', random_string(32).$_SERVER['HTTP_HOST']);
     }
 
 

admin/report.php

@@ -9,9 +9,11 @@
 
     $stradmin = get_string('administration');
     $strreports = get_string('reports');
+    $strmisc = get_string('miscellaneous');
 
     print_header($strreports, $strreports,
-                 '<a href="index.php">'.$stradmin.'</a> -> '.$strreports);
+                 '<a href="index.php">'.$stradmin.'</a> -> <a href="misc.php">'.$strmisc.'</a> ->'.
+                 $strreports);
 
     $directories = get_list_of_plugins('admin/report');
 

admin/report/courseoverview/index.php

@@ -23,7 +23,7 @@
     $strreports = get_string('reports');
     $strcourseoverview = get_string('courseoverview');
 
-    $strnav = '<a href="'.$CFG->wwwroot.'/admin/index.php">'.get_string('administration').'</a> -> <a href="'.$CFG->wwwroot.'/admin/report.php">'.$strreports.'</a> -> '.$strcourseoverview;
+    $strnav = '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/index.php">'.get_string('administration').'</a> -> <a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/report.php">'.$strreports.'</a> -> '.$strcourseoverview;
     
     $reportoptions = stats_get_report_options($course->id,STATS_MODE_RANKED);
 
@@ -75,10 +75,14 @@
         $courses = get_records_sql($sql);
 
         if (empty($courses)) {
-            error(get_string('statsnodata'),$CFG->wwwroot.'/admin/report/courseoverview/index.php');
+            error(get_string('statsnodata'),$CFG->wwwroot.'/'.$CFG->admin.'/report/courseoverview/index.php');
         }
 
-        echo '<center><img src="'.$CFG->wwwroot.'/admin/report/courseoverview/reportsgraph.php?time='.$time.'&report='.$report.'&numcourses='.$numcourses.'" /></center>';
+        if (empty($CFG->gdversion)) {
+            echo "<center>(".get_string("gdneed").")</center>";
+        } else {
+            echo '<center><img src="'.$CFG->wwwroot.'/'.$CFG->admin.'/report/courseoverview/reportsgraph.php?time='.$time.'&report='.$report.'&numcourses='.$numcourses.'" /></center>';
+        }
         
         $table = new object();
         $table->align = array('left','center','center','center');

admin/report/courseoverview/mod.php

@@ -18,8 +18,7 @@
         $numcourses = optional_param('numcourses', 20, PARAM_INT);
 
         $course = get_site();
-        stats_check_uptodate($course->id);
-
+        $statsstatus = stats_check_uptodate($course->id);
 
         $reportoptions = stats_get_report_options($course->id,STATS_MODE_RANKED);
 
@@ -49,6 +48,10 @@
         echo '<form action="report/courseoverview/index.php" method="post">'."\n";
         print_table($table);
         echo '</form>';
+        if ($statsstatus !== NULL) {
+            notify ($statsstatus);
+        }
+
     }
 ?>
 

admin/report/courseoverview/reportsgraph.php

@@ -28,7 +28,7 @@
     $courses = get_records_sql($sql);
     
     if (empty($courses)) {
-        error(get_string('statsnodata'),$CFG->wwwroot.'/admin/report/course/index.php');
+        error(get_string('statsnodata'),$CFG->wwwroot.'/'.$CFG->admin.'/report/course/index.php');
     }
     
 

admin/report/stats/mod.php

@@ -6,7 +6,11 @@
     
     if (!empty($CFG->enablestats)) {
         echo '<p style="text-align:center;">';
-        echo '<a href="'.$CFG->wwwroot.'/admin/report/stats/index.php?course='.$course->id.'">'.get_string('stats').'</a>';
+        echo '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/report/stats/index.php?course='.$course->id.'">'.get_string('stats').'</a>';
         echo '</p>';
+        $statsstatus = stats_check_uptodate($course->id);
+        if ($statsstatus !== NULL) {
+            notify ($statsstatus);
+        }
     }
 ?>

admin/site.html

@@ -33,26 +33,46 @@
           <table width="100%" cellpadding="0" cellspacing="0" border="0">
             <tr>
         <?php
+           $coursecount = (count_records('course') <= FRONTPAGECOURSELIMIT);
            $options = array(FRONTPAGENEWS           =>  get_string("frontpagenews"),
                             FRONTPAGECOURSELIST     =>  get_string("frontpagecourselist"),
                             FRONTPAGECATEGORYNAMES  =>  get_string("frontpagecategorynames"),
+                            FRONTPAGECATEGORYCOMBO  =>  get_string("frontpagecategorycombo"),
                             );
-           $values = array(get_string('hide'), get_string('order1', 'admin'), get_string('order2', 'admin'));
+           $values = array(get_string('hide'), get_string('order1', 'admin'), get_string('order2', 'admin'), get_string('order3', 'admin'), get_string('order4', 'admin'));
            $seq = array_flip(explode(',',$form->frontpage));
            foreach ($seq as $k => $s) {
                $seq[$k]++;
            }
-           if (count_records("course") > 200) {
-               unset($options[FRONTPAGECOURSELIST]);
-               if (isset($seq[FRONTPAGECOURSELIST])) {
-                   $form->frontpage = 2;
-               }
-           } else {
-               $values[] = get_string('order3', 'admin');
+           if (!$coursecount and isset($seq[FRONTPAGECOURSELIST])) {
+               unset($seq[FRONTPAGECOURSELIST]); //disable course list option when too many course present
            }
+
+           foreach ($options as $key => $option) {
+               $disabled = (!$coursecount and ($key == FRONTPAGECOURSELIST));
+               echo "<td>$option<br />";
+               choose_from_menu ($values, "frontpage[$key]", isset($seq[$key])?$seq[$key]:0, '', '', 0, false, $disabled);
+               echo '</td>';
+           }
+        ?>
+            </tr>
+          </table>
+        </td>
+</tr>
+<tr valign="top">
+        <td align="right"><?php print_string("frontpageformatloggedin") ?>:</td>
+        <td>
+          <table width="100%" cellpadding="0" cellspacing="0" border="0">
+            <tr>
+        <?php
+           $seq = array_flip(explode(',',$form->frontpageloggedin));
+           foreach ($seq as $k => $s) {
+               $seq[$k]++;
+           }
+
            foreach ($options as $key => $option) {
                echo "<td>$option<br />";
-               choose_from_menu ($values, "frontpage[$key]", isset($seq[$key])?$seq[$key]:0, "");
+               choose_from_menu ($values, "frontpageloggedin[$key]", isset($seq[$key])?$seq[$key]:0, '');
                echo '</td>';
            }
         ?>

admin/site.php

@@ -37,6 +37,13 @@
                 $form->numsections = 1;    // Force the topic display for this format
             }
 
+            $form->frontpageloggedin = array_flip($form->frontpageloggedin);
+            unset($form->frontpageloggedin[0]);
+            $form->frontpageloggedin = array_flip($form->frontpageloggedin);
+            asort($form->frontpageloggedin);
+            $form->frontpageloggedin = implode(',',array_flip($form->frontpageloggedin));
+            set_config("frontpageloggedin", $form->frontpageloggedin);
+
             $form->timemodified = time();
 
             if ($form->id) {
@@ -98,12 +105,18 @@
 
     if (isset($CFG->frontpage)) {
         $form->frontpage = $CFG->frontpage;
-
     } else {
         $form->frontpage = FRONTPAGECOURSELIST;  // Show course list by default
         set_config("frontpage", $form->frontpage);
     }
 
+    if (isset($CFG->frontpageloggedin)) {
+        $form->frontpageloggedin = $CFG->frontpageloggedin;
+    } else {
+        $form->frontpageloggedin = $form->frontpage;
+        set_config("frontpageloggedin", $form->frontpageloggedin);
+    }
+
     $stradmin = get_string("administration");
     $strconfiguration = get_string("configuration");
     $strsitesettings = get_string("sitesettings");

admin/stickyblocks.php

@@ -34,7 +34,8 @@
     $strheading = get_string('adminhelpstickyblocks');
     
     print_header($strtitle,$strtitle,'<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/index.php">'.
-                 get_string('admin').'</a> -> '.$strtitle);
+                 get_string('admin').'</a> -> <a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/misc.php">'.
+                 get_string('miscellaneous').'</a> ->'.$strtitle);
 
     echo '<table border="0" cellpadding="3" cellspacing="0" width="100%" id="layout-table">';
     echo '<tr valign="top">';
@@ -62,7 +63,7 @@
     echo '<td valign="top" width="*" id="middle-column">';
     print_simple_box_start('center');
     print_heading($strheading);
-    echo '<form method="post" action="'.$CFG->wwwroot.'/admin/stickyblocks.php">'
+    echo '<form method="post" action="'.$CFG->wwwroot.'/'.$CFG->admin.'/stickyblocks.php">'
         .'<p align="center">'.get_string('stickyblockspagetype','admin').': ';
     choose_from_menu($options,'pt',$pt,'choose','this.form.submit();');
     echo '</p></form>';

admin/upgradeforumread.php

@@ -2,6 +2,7 @@
 
     require_once('../config.php');
     require_once($CFG->dirroot.'/mod/forum/lib.php');
+    require_once($CFG->libdir.'/adminlib.php');
 
     $confirm = optional_param('confirm', 0, PARAM_BOOL);
 

admin/uploaduser.php

@@ -264,7 +264,6 @@ if ($um->preprocess_files() && confirm_sesskey()) {
                             //This can be used to obtain a list of userids for existing users
                             notify("$user->id ".get_string('usernotaddedregistered', 'error', $username));
                             $userserrors++;
-                            continue;
                         }
 
                     } else { // new user

admin/user.php

@@ -158,7 +158,7 @@
                 $updateuser = new object();
                 $updateuser->id = $user->id;
                 $updateuser->deleted = "1";
-                $updateuser->username = "$user->email.".time();  // Remember it just in case
+                $updateuser->username = addslashes("$user->email.".time());  // Remember it just in case
                 $updateuser->email = "";               // Clear this field to free it up
                 $updateuser->idnumber = "";               // Clear this field to free it up
                 $updateuser->timemodified = time();

admin/users.php

@@ -24,27 +24,15 @@
 
     $table->data[] = array("<b><a href=\"auth.php?sesskey=$USER->sesskey\">".get_string("authentication")."</a></b>",
                            get_string("adminhelpauthentication"));
-
     $table->data[] = array("<b><a href=\"user.php\">".get_string("edituser")."</a></b>",
                            get_string("adminhelpedituser"));
     $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/user.php?newuser=true&amp;sesskey=$USER->sesskey\">".get_string("addnewuser")."</a></b>",
                                get_string("adminhelpaddnewuser"));
     $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/uploaduser.php?sesskey=$USER->sesskey\">".get_string("uploadusers")."</a></b>",
                                get_string("adminhelpuploadusers"));
-    $table->data[] = array('', '<hr />');
-    $table->data[] = array("<b><a href=\"enrol.php?sesskey=$USER->sesskey\">".get_string("enrolmentplugins")."</a></b>",
-                           get_string("adminhelpenrolments"));
-    $table->data[] = array("<b><a href=\"../course/index.php?edit=off&amp;sesskey=$USER->sesskey\">".get_string("assignstudents")."</a></b>",
-                           get_string("adminhelpassignstudents"));
-    $table->data[] = array("<b><a href=\"../course/index.php?edit=on&amp;sesskey=$USER->sesskey\">".get_string("assignteachers")."</a></b>",
-                           get_string("adminhelpassignteachers")." <img src=\"../pix/t/user.gif\" height=\"11\" width=\"11\" alt=\"\" />");
-    $table->data[] = array("<b><a href=\"creators.php?sesskey=$USER->sesskey\">".get_string("assigncreators")."</a></b>",
-                           get_string("adminhelpassigncreators"));
-    $table->data[] = array("<b><a href=\"admin.php?sesskey=$USER->sesskey\">".get_string("assignadmins")."</a></b>",
-                           get_string("adminhelpassignadmins"));
 
     print_table($table);
-    
+
     print_footer($site);
 
 ?>

admin/utfdbmigrate.php

@@ -1,4 +1,5 @@
 <?php //$Id$
+
 ///dummy field names are used to help adding and dropping indexes. There's only 1 case now, in scorm_scoes_track
 
     require_once('../config.php');
@@ -7,6 +8,47 @@
     require_once($CFG->dirroot.'/course/lib.php');
     require_login();
 
+	// decalre once
+	global $enc;
+	
+	$customlang = array();
+	
+	$enc = array('af' => 'iso-8859-1', 'ar' => 'windows-1256', 'be' => 'windows-1251', 'bg' => 'windows-1251', 'bs' => 'windows-1250', 'ca' => 'iso-8859-1', 'cs' => 'iso-8859-2', 'da' => 'iso-8859-1', 'de' => 'iso-8859-1', 'de_du' => 'iso-8859-1', 'de_utf8' => 'utf-8', 'el' => 'windows-1253', 'en' => 'iso-8859-1', 'en_ja' => 'euc-jp', 'en_us' => 'iso-8859-1', 'en_utf8' => 'utf-8', 'es' => 'iso-8859-1', 'es_ar' => 'iso-8859-1', 'es_es' => 'iso-8859-1', 'es_mx' => 'iso-8859-1', 'et' => 'iso-8859-1', 'eu' => 'iso-8859-1', 'fa' => 'windows-1256', 'fa_utf8' => 'utf-8', 'fi' => 'iso-8859-1', 'fil' => 'iso-8859-15', 'fr' => 'iso-8859-1', 'fr_ca' => 'iso-8859-15', 'ga' => 'iso-8859-1', 'gl' => 'iso-8859-1', 'he' => 'ISO-8859-8-I', 'he_utf8' => 'utf-8', 'hi' => 'iso-8859-1', 'hr' => 'windows-1250', 'hr_utf8' => 'utf-8', 'hu' => 'iso-8859-2', 'id' => 'iso-8859-1', 'is' => 'iso-8859-1', 'it' => 'iso-8859-1', 'ja' => 'EUC-JP', 'ja_utf8' => 'UTF-8', 'ka_utf8' => 'UTF-8', 'km_utf8' => 'UTF-8', 'kn_utf8' => 'utf-8', 'ko' => 'EUC-KR', 'ko_utf8' => 'UTF-8', 'lt' => 'windows-1257', 'lv' => 'ISO-8859-4', 'mi_nt' => 'iso-8859-1', 'mi_tn_utf8' => 'utf-8', 'ms' => 'iso-8859-1', 'nl' => 'iso-8859-1', 'nn' => 'iso-8859-1', 'no' => 'iso-8859-1', 'no_gr' => 'iso-8859-1', 'pl' => 'iso-8859-2', 'pt' => 'iso-8859-1', 'pt_br' => 'iso-8859-1', 'ro' => 'iso-8859-2', 'ru' => 'windows-1251', 'sk' => 'iso-8859-2', 'sl' => 'iso-8859-2', 'sl_utf8' => 'utf-8', 'so' => 'iso-8859-1', 'sq' => 'iso-8859-1', 'sr_utf8' => 'utf-8', 'sv' => 'iso-8859-1', 'th' => 'TIS-620', 'th_utf8' => 'UTF-8', 'tl' => 'iso-8859-15', 'tl_utf8' => 'UTF-8', 'tr' => 'iso-8859-9', 'uk' => 'windows-1251', 'vi_utf8' => 'UTF-8', 'zh_cn' => 'GB18030', 'zh_cn_utf8' => 'UTF-8', 'zh_tw' => 'Big5', 'zh_tw_utf8' => 'UTF-8');
+	
+	/**************************************
+	 * Custom lang pack handling 		  *
+	 **************************************/
+	
+	// scan list of langs, including customs packs
+	$langs = get_list_of_languages();
+	
+	// foreach lang
+	foreach ($langs as $lang => $lang1) {
+	  
+		if (in_array($lang, array_keys($enc))) {
+		  	// if already in array, ignore
+			continue;  
+		}
+		
+		// if this lang has got a charset	
+		
+		if ($result = get_string_from_file('thischarset',$CFG->dirroot.'/lang/'.$lang.'/moodle.php', "\$resultstring")) {
+			eval($result);	
+			$enc[$lang] = $resultstring;		
+		} else if ($result = get_string_from_file('parentlanguage',$CFG->dirroot.'/lang/'.$lang.'/moodle.php',"\$resultstring")) {
+		// else if there's a parent lang we can use
+		    eval($result);
+		  	$enc[$lang] = $enc[$resultstring];  
+		} else {
+		 	notify ('unknown lang pack detected '.$lang); 
+		}
+
+	}	
+	
+	/**************************************
+	 * End custom lang pack handling      *
+	 **************************************/
+
     if (!isadmin()) {
         error('Only admins can access this page');
     }
@@ -45,9 +87,12 @@
         print_simple_box_end();
         db_migrate2utf8();
         print_heading('db unicode migration has been completed!');
-        unlink($filename);    //no longer in maintenance mode
+        if (!get_config('', 'migrate_maintmode')) { // already in maint mode
+            unlink($filename);    //no longer in maintenance mode
+        }
+        delete_records('config', 'name', 'migrate_maintmode');
         @require_logout();
-        print_continue($CFG->wwwroot.'/admin/langimport.php');
+        print_continue($CFG->wwwroot.'/'.$CFG->admin.'/langimport.php');
     }
 
     //else if $migrate
@@ -73,12 +118,16 @@
             //put the site in maintenance mode
             check_dir_exists($CFG->dataroot.'/'.SITEID, true);
 
-            if (touch($filename)) {
-                $file = fopen($filename, 'w');
-                fwrite($file, get_string('maintinprogress','admin'));
-                fclose($file);
+            if (file_exists($filename)) {
+                set_config('migrate_maintmode', 1); // already in maintenance mode
             } else {
-                notify (get_string('maintfileopenerror','admin'));
+                if (touch($filename)) {
+                    $file = fopen($filename, 'w');
+                    fwrite($file, get_string('maintinprogress','admin'));
+                    fclose($file);
+                } else {
+                    notify (get_string('maintfileopenerror','admin'));
+                }
             }
             //print second confirmation box
             echo '<form name="migratefrom" action="utfdbmigrate.php" method="POST">';
@@ -107,7 +156,6 @@
             }
 
             //print the "i-know-what-lang-to-use" menu
-            $enc = array('af' => 'iso-8859-1', 'ar' => 'windows-1256', 'be' => 'windows-1251', 'bg' => 'windows-1251', 'bs' => 'windows-1250', 'ca' => 'iso-8859-1', 'cs' => 'iso-8859-2', 'da' => 'iso-8859-1', 'de' => 'iso-8859-1', 'de_du' => 'iso-8859-1', 'de_utf8' => 'utf-8', 'el' => 'windows-1253', 'en' => 'iso-8859-1', 'en_ja' => 'euc-jp', 'en_us' => 'iso-8859-1', 'en_utf8' => 'utf-8', 'es' => 'iso-8859-1', 'es_ar' => 'iso-8859-1', 'es_es' => 'iso-8859-1', 'es_mx' => 'iso-8859-1', 'et' => 'iso-8859-1', 'eu' => 'iso-8859-1', 'fa' => 'windows-1256', 'fa_utf8' => 'utf-8', 'fi' => 'iso-8859-1', 'fil' => 'iso-8859-15', 'fr' => 'iso-8859-1', 'fr_ca' => 'iso-8859-15', 'ga' => 'iso-8859-1', 'gl' => 'iso-8859-1', 'he' => 'ISO-8859-8-I', 'he_utf8' => 'utf-8', 'hi' => 'iso-8859-1', 'hr' => 'windows-1250', 'hr_utf8' => 'utf-8', 'hu' => 'iso-8859-2', 'id' => 'iso-8859-1', 'it' => 'iso-8859-1', 'ja' => 'EUC-JP', 'ja_utf8' => 'UTF-8', 'ka_utf8' => 'UTF-8', 'km_utf8' => 'UTF-8', 'kn_utf8' => 'utf-8', 'ko' => 'EUC-KR', 'ko_utf8' => 'UTF-8', 'lt' => 'windows-1257', 'lv' => 'ISO-8859-4', 'mi_nt' => 'iso-8859-1', 'mi_tn_utf8' => 'utf-8', 'ms' => 'iso-8859-1', 'nl' => 'iso-8859-1', 'nn' => 'iso-8859-1', 'no' => 'iso-8859-1', 'no_gr' => 'iso-8859-1', 'pl' => 'iso-8859-2', 'pt' => 'iso-8859-1', 'pt_br' => 'iso-8859-1', 'ro' => 'iso-8859-2', 'ru' => 'windows-1251', 'sk' => 'iso-8859-2', 'sl' => 'iso-8859-2', 'sl_utf8' => 'utf-8', 'so' => 'iso-8859-1', 'sq' => 'iso-8859-1', 'sr_utf8' => 'utf-8', 'sv' => 'iso-8859-1', 'th' => 'TIS-620', 'th_utf8' => 'UTF-8', 'tl' => 'iso-8859-15', 'tl_utf8' => 'UTF-8', 'tr' => 'iso-8859-9', 'uk' => 'windows-1251', 'vi_utf8' => 'UTF-8', 'zh_cn' => 'GB18030', 'zh_cn_utf8' => 'UTF-8', 'zh_tw' => 'Big5', 'zh_tw_utf8' => 'UTF-8');
 
             echo '<br />The whole site is in this encoding: (leave blank if you are not sure)';
             echo '<select name="globallang"><option value="">I am not sure</option>';
@@ -297,7 +345,7 @@ function db_migrate2utf8(){   //Eloy: Perhaps some type of limit parameter here
         $crash->table = $crashdata[0];
         $crash->field = $crashdata[1];
         $crash->record = $crashdata[2];
-		
+
         notify("Resuming migration from: $crash->table / .$crash->field, Record: $crash->record");
     }
 
@@ -346,7 +394,7 @@ function db_migrate2utf8(){   //Eloy: Perhaps some type of limit parameter here
                 $tablefunction = 'migrate2utf8_'.$dbtablename;
             }
             if ($CFG->dbtype=='mysql' && function_exists($tablefunction)) {
-                $tablefunction($dbtable['#']['FIELDS'][0]['#']['FIELD'], $crash, $debug, $maxrecords); // execute it.
+                $tablefunction($dbtable['#']['FIELDS'][0]['#']['FIELD'], $crash, $debug, $maxrecords, $done, $tablestoconvert); // execute it.
             } else {
 
             /******************************************************
@@ -571,8 +619,8 @@ function db_migrate2utf8(){   //Eloy: Perhaps some type of limit parameter here
 
                                     $processedrecords++;
                                     //print some output once in a while
-                                    if (($processedrecords) % 5000 == 0) {
-                                        print_progress($done, $tablestoconvert, 5, 1, 
+                                    if (($processedrecords) % 1000 == 0) {
+                                        print_progress($done, $tablestoconvert, 5, 1,
                                                        'Processing: '.$dbtablename.'/'.$fieldname.' ');
                                     }
                                 }
@@ -772,7 +820,7 @@ function db_migrate2utf8(){   //Eloy: Perhaps some type of limit parameter here
             echo $lang.', ';
         }
     }
-    echo '</b><br/><a href="'.$CFG->wwwroot.'/admin/langimport.php">Language Import Utility</a></div>';
+    echo '</b><br/><a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/langimport.php">Language Import Utility</a></div>';
     print_simple_box_end();
     delete_records('config','name','langsused');
 
@@ -845,7 +893,7 @@ function get_main_teacher_lang($courseid) {
 
 function get_original_encoding($sitelang, $courselang, $userlang){
 
-    global $CFG;
+    global $CFG, $enc;
 
     $lang = '';
     if ($courselang) {
@@ -861,8 +909,6 @@ function get_original_encoding($sitelang, $courselang, $userlang){
         error ('no language found!');
     }
 
-    $enc = array('af' => 'iso-8859-1', 'ar' => 'windows-1256', 'be' => 'windows-1251', 'bg' => 'windows-1251', 'bs' => 'windows-1250', 'ca' => 'iso-8859-1', 'cs' => 'iso-8859-2', 'da' => 'iso-8859-1', 'de' => 'iso-8859-1', 'de_du' => 'iso-8859-1', 'de_utf8' => 'utf-8', 'el' => 'windows-1253', 'en' => 'iso-8859-1', 'en_ja' => 'euc-jp', 'en_us' => 'iso-8859-1', 'en_utf8' => 'utf-8', 'es' => 'iso-8859-1', 'es_ar' => 'iso-8859-1', 'es_es' => 'iso-8859-1', 'es_mx' => 'iso-8859-1', 'et' => 'iso-8859-1', 'eu' => 'iso-8859-1', 'fa' => 'windows-1256', 'fa_utf8' => 'utf-8', 'fi' => 'iso-8859-1', 'fil' => 'iso-8859-15', 'fr' => 'iso-8859-1', 'fr_ca' => 'iso-8859-15', 'ga' => 'iso-8859-1', 'gl' => 'iso-8859-1', 'he' => 'ISO-8859-8-I', 'he_utf8' => 'utf-8', 'hi' => 'iso-8859-1', 'hr' => 'windows-1250', 'hr_utf8' => 'utf-8', 'hu' => 'iso-8859-2', 'id' => 'iso-8859-1', 'it' => 'iso-8859-1', 'ja' => 'EUC-JP', 'ja_utf8' => 'UTF-8', 'ka_utf8' => 'UTF-8', 'km_utf8' => 'UTF-8', 'kn_utf8' => 'utf-8', 'ko' => 'EUC-KR', 'ko_utf8' => 'UTF-8', 'lt' => 'windows-1257', 'lv' => 'ISO-8859-4', 'mi_nt' => 'iso-8859-1', 'mi_tn_utf8' => 'utf-8', 'ms' => 'iso-8859-1', 'nl' => 'iso-8859-1', 'nn' => 'iso-8859-1', 'no' => 'iso-8859-1', 'no_gr' => 'iso-8859-1', 'pl' => 'iso-8859-2', 'pt' => 'iso-8859-1', 'pt_br' => 'iso-8859-1', 'ro' => 'iso-8859-2', 'ru' => 'windows-1251', 'sk' => 'iso-8859-2', 'sl' => 'iso-8859-2', 'sl_utf8' => 'utf-8', 'so' => 'iso-8859-1', 'sq' => 'iso-8859-1', 'sr_utf8' => 'utf-8', 'sv' => 'iso-8859-1', 'th' => 'TIS-620', 'th_utf8' => 'UTF-8', 'tl' => 'iso-8859-15', 'tl_utf8' => 'UTF-8', 'tr' => 'iso-8859-9', 'uk' => 'windows-1251', 'vi_utf8' => 'UTF-8', 'zh_cn' => 'GB18030', 'zh_cn_utf8' => 'UTF-8', 'zh_tw' => 'Big5', 'zh_tw_utf8' => 'UTF-8');
-
     if ($enc[$lang]) {
         return $enc[$lang];
     } else {
@@ -898,7 +944,7 @@ function log_the_problem_somewhere() {  //Eloy: Nice function, perhaps we could
     }
 }
 
-//only this function should be used during db migraton, because of addslashes at the end of the convertion
+// only this function should be used during db migraton, because of addslashes at the end of the convertion
 function utfconvert($string, $enc, $slash=true) {
     global $textlib;
     if ($result = $textlib->convert($string, $enc)) {

auth/README

@@ -121,6 +121,14 @@ Optional:
     Userinformation in array ( name => value, .... 
     or false in case of error
 
+    auth_validate_form(&$form, &$err)
+    
+    Validate form data.
+
+    Returns:
+    Bool. Manipulates $form and $err arrays in place
+
+
 COURSE CREATING
 
     auth_iscreator($username)

auth/db/lib.php

@@ -118,6 +118,16 @@ function auth_get_userinfo($username){
 }
 
 
+function auth_user_update_password($username, $newpassword) {
+    global $CFG;
+    if ($CFG->auth_dbpasstype === 'internal') {
+        return set_field('user', 'password', md5($newpassword), 'username', $username);
+    } else {
+        // we should have never been called!
+        return false;
+    }
+}
+
 /**
  * syncronizes user fron external db to moodle user table
  *
@@ -201,7 +211,7 @@ function auth_sync_users ($do_updates=0) {
         $updatekeys = array();
         foreach ($all_keys as $key) {
             if (preg_match('/^field_updatelocal_(.+)$/',$key, $match)) {
-                if ($pcfg->{$match[0]}) { // if it has a true value
+                if ($pcfg->{$key} === 'onlogin') {
                     array_push($updatekeys, $match[1]); // the actual key name
                 }
             }
@@ -409,4 +419,43 @@ function auth_db_update_user_record($username, $updatekeys=false) {
     return get_record_select("user", "username = '$username' AND deleted <> '1'");
 }
 
-?>
+// A chance to validate form data, and last chance to 
+// do stuff before it is inserted in config_plugin
+function auth_validate_form(&$form, &$err) {
+    
+    // compat until we rework auth a bit
+    if ($form['auth_dbpasstype'] === 'internal') {
+        $CFG->auth_db_stdchangepassword = true;
+        if ($conf = get_record('config', 'name', 'auth_db_stdchangepassword')) {
+            $conf->value = 1;
+            if (! update_record('config', $conf)) {
+                notify("Could not update $name to $value");
+            }
+        } else {
+            $conf = new StdClass;
+            $conf->name = 'auth_db_stdchangepassword';
+            $conf->value = 1;
+            if (! insert_record('config', $conf)) {
+                notify("Error: could not add new variable $name !");
+            }
+        }
+    } else {
+        $CFG->auth_db_stdchangepassword = false;
+        if ($conf = get_record('config', 'name', 'auth_db_stdchangepassword')) {
+            $conf->value = 0;
+            if (! update_record('config', $conf)) {
+                notify("Could not update $name to $value");
+            }
+        } else {
+            $conf = new StdClass;
+            $conf->name = 'auth_db_stdchangepassword';
+            $conf->value = 0;
+            if (! insert_record('config', $conf)) {
+                notify("Error: could not add new variable $name !");
+            }
+        }
+    }
+    return true;
+}
+
+?>

auth/fc/fcFPP.php

@@ -111,7 +111,8 @@ class fcFPP
 		$this->_user = $userid;
 		$this->_pwd  = $passwd; 
 		return TRUE;		
-	    } elseif (preg_match ("/^\Sorry/",$line)){	//Denied access but a valid user and password
+        } elseif (strpos($line, 'You are not allowed')){ // Denied access but a valid user and password
+                                                         // "Sorry. You are not allowed to login with the FPP interface"
 	    	return TRUE;
 	    } else {					//Invalid user or password
 		return FALSE;
@@ -215,4 +216,4 @@ class fcFPP
 }
    
 
-?>
+?>

auth/ldap/lib.php

@@ -711,7 +711,7 @@ function auth_ldap_bulk_insert($users){
     // bulk insert -- superfast with $bulk_insert_records
     $sql = 'INSERT INTO '.$CFG->prefix.'extuser (idnumber) VALUES ';
     // make those values safe
-    array_map('addslashes', $users);
+    $users = array_map('addslashes', $users);
     // join and quote the whole lot
     $sql = $sql . '(\'' . join('\'),(\'', $users) . '\')';
     print "+ " . count($users) . " users\n";
@@ -1082,8 +1082,8 @@ function auth_ldap_getdefaults(){
                         );
     $default['ldap_memberattribute_isdn'] = array(
                         'edir' => '1',
-                        'rfs2307' => '0',
-                        'rfs2307bis' => '1',
+                        'rfc2307' => '0',
+                        'rfc2307bis' => '1',
                         'samba' => '0', //is this right?
                         'ad' => '1',
                         'default' => '0'

auth/shibboleth/lib.php

@@ -1,6 +1,7 @@
 <?PHP  // $Id$
 //CHANGELOG:
 //28.10.2004 SHIBBOLETH Authentication functions v.0.1
+//2005-2006 Various extensions and fixes by Lukas Haemmerle
 //Distributed under GPL (c)Markus Hagman 2004-
 
 function auth_user_login($username, $password) {
@@ -41,9 +42,9 @@ function auth_get_userinfo($username) {
   
     foreach ($attrmap as $key=>$value) {
         if (!empty($CFG->unicodedb)) {
-            $result[$key]=$_SERVER[$value];
+            $result[$key]=get_first_string($_SERVER[$value]);
         } else {
-            $result[$key]=utf8_decode($_SERVER[$value]);
+            $result[$key]=utf8_decode(get_first_string($_SERVER[$value]));
         }
     }
 
@@ -84,4 +85,15 @@ function auth_shib_attributes(){
 
     return $moodleattributes;
 }
+
+
+function get_first_string($string){
+// Cleans and returns first of potential many values (multi-valued attributes)
+
+    $list = split( ';', $string);
+    $clean_string = rtrim($list[0]);
+
+    return $clean_string;
+}
+
 ?>

backup/backup.php

@@ -17,13 +17,7 @@
 
     if (!empty($id)) {
         if (!isteacheredit($id)) {
-            if (empty($to)) {
-                error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
-            } else {
-                if (!isteacheredit($to)) {
-                    error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
-                }
-            }
+            error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
     } else {
         if (!isadmin()) {
@@ -31,6 +25,12 @@
         }
     }
 
+    if (!empty($to)) {
+        if (!isteacheredit($to)) {
+            error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
+        }
+    }
+
     //Check site
     if (!$site = get_site()) {
         error("Site not found!");
@@ -128,7 +128,7 @@
     }
     print_simple_box_end();
 
-    //Print footer  
+    //Print footer
     print_footer();
 
 ?>

backup/backup_scheduled.php

@@ -408,8 +408,8 @@ function schedule_backup_course_configure($course,$starttime = 0) {
                     if (empty($preferences->mods[$mod->modname]->instances)) {
                         $preferences->mods[$mod->modname]->instances = array(); // avoid warnings
                     }
-                    $preferences->mods[$mod->modname]->instances[$mod->instance]->backup = $preferences->mods[$modname]->backup;
-                    $preferences->mods[$mod->modname]->instances[$mod->instance]->userinfo = $preferences->mods[$modname]->userinfo;
+                    $preferences->mods[$mod->modname]->instances[$mod->instance]->backup = $preferences->mods[$mod->modname]->backup;
+                    $preferences->mods[$mod->modname]->instances[$mod->instance]->userinfo = $preferences->mods[$mod->modname]->userinfo;
                     // there isn't really a nice way to do this...
                     $preferences->mods[$mod->modname]->instances[$mod->instance]->name = get_field($mod->modname,'name','id',$mod->instance);
                 }
@@ -772,7 +772,9 @@ function schedule_backup_course_delete_old_files($preferences,$starttime=0) {
         $dirtocheck = $CFG->dataroot."/".$preferences->backup_course."/backupdata";
     }
     schedule_backup_log($starttime,$preferences->backup_course,"    checking $dirtocheck");
-    mtrace("            Keeping backup files in $dirtocheck");
+    if ($CFG->debug > 7) {
+        mtrace("            Keeping backup files in $dirtocheck");
+    }
 
     //Get all the files in $dirtocheck
     $files = get_directory_list($dirtocheck,"",false);

backup/backuplib.php

@@ -521,7 +521,8 @@
             fwrite ($bf,full_tag("INCLUDED",4,false,$included));
             fwrite ($bf,full_tag("USERINFO",4,false,$userinfo));
 
-            if (is_array($preferences->mods[$element->name]->instances)
+            if (isset($preferences->mods[$element->name]->instances)
+                && is_array($preferences->mods[$element->name]->instances)
                 && count($preferences->mods[$element->name]->instances)) {
                 fwrite ($bf, start_tag("INSTANCES",4,true));
                 foreach ($preferences->mods[$element->name]->instances as $id => $object) {
@@ -1239,7 +1240,8 @@
                     //See if it is a valid module to backup
                     if ($log->module == "course" or 
                         $log->module == "user" or
-                        $preferences->mods[$log->module]->backup == 1) {
+                        (array_key_exists($log->module, $preferences->mods) and $preferences->mods[$log->module]->backup == 1)) {
+                        // logs with 'upload' in module field are ignored, there is no restore code anyway 
                         //Begin log tag
                          fwrite ($bf,start_tag("LOG",3,true));
     
@@ -1661,7 +1663,8 @@
 
         require_once($CFG->dirroot.'/mod/'.$module.'/backuplib.php');
 
-        if (is_array($preferences->mods[$module]->instances)) {
+        if (isset($preferences->mods[$module]->instances)
+            && is_array($preferences->mods[$module]->instances)) {
             $onemodbackup = $module.'_backup_one_mod';
             if (function_exists($onemodbackup)) {
                 foreach ($preferences->mods[$module]->instances as $instance => $object) {
@@ -1718,6 +1721,7 @@
 
         foreach ($mypreferences->mods as $name => $info) {
             //Check if the xxxx_encode_content_links exists
+            include_once("$CFG->dirroot/mod/$name/backuplib.php");
             $function_name = $name."_encode_content_links";
             if (function_exists($function_name)) {
                 $result = $function_name($result,$mypreferences);

backup/bb/restore_bb.php

@@ -9,7 +9,7 @@ require_once($CFG->dirroot.'/backup/bb/xsl_emulate_xslt.inc');
   
 function get_subdirs($directory){
     $opendirectory = opendir( $directory );
-    while($filename = readdir($opendirectory)) {
+    while(false !== ($filename = readdir($opendirectory))) {
         if (is_dir($directory.$filename) and $filename != ".." and $filename != "."){
             $subdirs[] = $filename;
         }

backup/db/postgres7.php

@@ -51,24 +51,14 @@ function backup_upgrade($oldversion=0) {
     }
 
     if ($oldversion < 2006042801) {
-        modify_database('', 'ALTER TABLE prefix_backup_log
-            ALTER COLUMN "time" TYPE integer,
-            ALTER COLUMN "time" SET DEFAULT 0,
-            ALTER COLUMN laststarttime TYPE integer,
-            ALTER COLUMN laststarttime SET DEFAULT 0,
-            ALTER COLUMN courseid TYPE integer,
-            ALTER COLUMN courseid SET DEFAULT 0');
-
-        modify_database('', 'ALTER TABLE mdl_backup_courses
-            ALTER COLUMN lastendtime TYPE integer,
-            ALTER COLUMN lastendtime SET DEFAULT 0,
-            ALTER COLUMN laststarttime TYPE integer,
-            ALTER COLUMN laststarttime SET DEFAULT 0,
-            ALTER COLUMN courseid TYPE integer,
-            ALTER COLUMN courseid SET DEFAULT 0,
-            ALTER COLUMN nextstarttime TYPE integer,
-            ALTER COLUMN nextstarttime SET DEFAULT 0');
+        table_column('backup_log', 'time', 'time', 'integer', '', '', '0');
+        table_column('backup_log', 'laststarttime', 'laststarttime', 'integer', '', '', '0');
+        table_column('backup_log', 'courseid', 'courseid', 'integer', '', '', '0');
 
+        table_column('backup_courses', 'lastendtime', 'lastendtime', 'integer', '', '', '0');
+        table_column('backup_courses', 'laststarttime', 'laststarttime', 'integer', '', '', '0');
+        table_column('backup_courses', 'courseid', 'courseid', 'integer', '', '', '0');
+        table_column('backup_courses', 'nextstarttime', 'nextstarttime', 'integer', '', '', '0');
     }
 
     //Finally, return result

backup/lib.php

@@ -118,7 +118,7 @@
         }
 
         // Loop through all directory entries, and construct two temporary arrays containing files and sub directories
-        while($entry = readdir($handle)) {
+        while(false !== ($entry = readdir($handle))) {
             if (is_dir($dir. $slash .$entry) && $entry != ".." && $entry != "." && $entry != $excludeddir) {
                 $dir_subdirs[] = $dir. $slash .$entry;
             }
@@ -195,7 +195,7 @@
         $results = null;
   
         $dir = opendir($rootdir);
-        while ($file=readdir($dir)) {
+        while (false !== ($file=readdir($dir))) {
             if ($file=="." || $file=="..") {
                 continue;
             }
@@ -214,7 +214,7 @@
         $results = "";
  
         $dir = opendir($rootdir);
-        while ($file=readdir($dir)) {
+        while (false !== ($file=readdir($dir))) {
             if ($file=="." || $file=="..") {
                 continue;
             }
@@ -293,13 +293,15 @@
 
         global $CFG;
 
+        $status = true; // Initialize this, next code will change its value if needed
+
         if (!is_dir($to_file)) {
             //echo "<br />Creating ".$to_file;                                //Debug
             umask(0000);
             $status = mkdir($to_file,$CFG->directorypermissions);
         }
         $dir = opendir($from_file);
-        while ($file=readdir($dir)) {
+        while (false !== ($file=readdir($dir))) {
             if ($file=="." || $file=="..") {
                 continue;
             }
@@ -411,8 +413,10 @@
             $rec->old_id = $old_id;
             $rec->new_id = ($new_id === null? 0 : $new_id);
             $rec->info = $info_to_save;
-            
-            $status = insert_record('backup_ids', $rec, false);
+
+            if (!insert_record('backup_ids', $rec, false)) {
+                $status = false;
+            }
         }
         return $status;
     }

backup/restore_execute.html

@@ -53,6 +53,15 @@
         print_simple_box(get_string("restorefinished"),"center");
     } else {
         print_simple_box(get_string("importdatafinished"),"center");
+        $file = $CFG->dataroot . '/'
+            . $SESSION->import_preferences->backup_course
+            . '/backupdata/' . $SESSION->import_preferences->backup_name;
+        if (is_readable($file)) {
+            unlink($file);
+        }
+        else {
+            error_log("import course data: couldn't unlink $file");
+        }
         unset($SESSION->restore);
     }
     print_continue("$CFG->wwwroot/course/view.php?id=".$restore->course_id);

backup/restorelib.php

@@ -63,6 +63,8 @@
     //from backup format to destination site/course in order to mantain inter-activities
     //working in the backup/restore process
     function restore_decode_content_links($restore) {
+        global $CFG;
+
         $status = true;
 
         if (!defined('RESTORE_SILENTLY')) {
@@ -72,6 +74,7 @@
             //If the module is being restored
             if ($info->restore == 1) {
                 //Check if the xxxx_decode_content_links_caller exists
+	            include_once("$CFG->dirroot/mod/$name/restorelib.php");
                 $function_name = $name."_decode_content_links_caller";
                 if (function_exists($function_name)) {
                     if (!defined('RESTORE_SILENTLY')) {
@@ -477,7 +480,8 @@
                 $suffixshort = "";
             }
             $currentfullname = $fullname.$suffixfull;
-            $currentshortname = $shortname.$suffixshort;
+            // Limit the size of shortname - database column accepts <= 15 chars
+            $currentshortname = substr($shortname, 0, 15 - strlen($suffixshort)).$suffixshort;
             $coursefull  = get_record("course","fullname",addslashes($currentfullname));
             $courseshort = get_record("course","shortname",addslashes($currentshortname));
             $counter++;
@@ -1073,7 +1077,7 @@
                     if (!$preferencescount) {
                         $continue = false;
                         if (!defined('RESTORE_SILENTLY')) {
-                            echo '<li>'.get_string('backupwithoutgradebook','grade').'</li>';
+                            echo '<li>'.get_string('backupwithoutgradebook','grades').'</li>';
                         }
                     }
 
@@ -1084,7 +1088,7 @@
                             if ($pref_rec->value == 0) {
                                 $continue = false;
                                 if (!defined('RESTORE_SILENTLY')) {
-                                    echo '<li>'.get_string('respectingcurrentdata','grade').'</li>';
+                                    echo '<li>'.get_string('respectingcurrentdata','grades').'</li>';
                                 }
                             }
                         }
@@ -1378,6 +1382,19 @@
                     $user->lang = 'mi_nt';
                 }
 
+                //Country list updates - MDL-13060 
+                //Any user whose country code has been deleted or modified needs to be assigned a valid one.
+                $country_update_map = array(
+                    'ZR' => 'CD', 
+                    'TP' => 'TL',
+                    'FX' => 'FR', 
+                    'KO' => 'RS', 
+                    'CS' => 'RS',
+                    'WA' => 'GB');
+                if (array_key_exists($user->country, $country_update_map)) {
+                    $user->country = $country_update_map[$user->country];
+                }
+
                 //Check if it's admin and coursecreator
                 $is_admin =         !empty($user->roles['admin']);
                 $is_coursecreator = !empty($user->roles['coursecreator']);
@@ -1854,14 +1871,7 @@
                 foreach ($info as $category) {
                     //Skip empty categories (some backups can contain them)
                     if (!empty($category->id)) {
-                        $catrestore = "restore_question_categories";
-                        if (function_exists($catrestore)) {
-                            //print_object ($category);                                                //Debug
-                            $status = $catrestore($category,$restore);
-                        } else {
-                            //Something was wrong. Function should exist.
-                            $status = false;
-                        }
+                        $status = restore_question_categories($category,$restore);
                     }
                 }
 
@@ -2199,19 +2209,6 @@
                                 //Assign it to admin
                                 $eve->userid = $adminid;
                             }
-
-                            //We must recode the repeatid if the event has it
-                            if (!empty($eve->repeatid)) {
-                                $repeat_rec = backup_getid($restore->backup_unique_code,"event_repeatid",$eve->repeatid);
-                                if ($repeat_rec) {    //Exists, so use it...
-                                    $eve->repeatid = $repeat_rec->new_id;
-                                } else {              //Doesn't exists, calculate the next and save it
-                                    $oldrepeatid = $eve->repeatid;
-                                    $max_rec = get_record_sql('SELECT 1, MAX(repeatid) AS repeatid FROM '.$CFG->prefix.'event');
-                                    $eve->repeatid = empty($max_rec) ? 1 : $max_rec->repeatid + 1;
-                                    backup_putid($restore->backup_unique_code,"event_repeatid", $oldrepeatid, $eve->repeatid);
-                                }
-                            }
  
                             //We have to recode the groupid field
                             $group = backup_getid($restore->backup_unique_code,"groups",$eve->groupid);
@@ -2224,6 +2221,22 @@
 
                             //The structure is equal to the db, so insert the event
                             $newid = insert_record ("event",$eve);
+
+                            //We must recode the repeatid if the event has it
+                            //The repeatid now refers to the id of the original event. (see Bug#5956)
+                            if ($newid && !empty($eve->repeatid)) {
+                                $repeat_rec = backup_getid($restore->backup_unique_code,"event_repeatid",$eve->repeatid);
+                                if ($repeat_rec) {    //Exists, so use it...
+                                    $eve->repeatid = $repeat_rec->new_id;
+                                } else {              //Doesn't exists, calculate the next and save it
+                                    $oldrepeatid = $eve->repeatid;
+                                    $eve->repeatid = $newid;
+                                    backup_putid($restore->backup_unique_code,"event_repeatid", $oldrepeatid, $eve->repeatid);
+                                }
+                                $eve->id = $newid;
+                                // update the record to contain the correct repeatid
+                                update_record('event',$eve);
+                            }
                         } else {
                             //get current event id
                             $newid = $eve_db->id;
@@ -2486,7 +2499,7 @@
                         $modrestore = $mod->modtype."_restore_mods";
                         if (function_exists($modrestore)) {
                             //print_object ($mod);                                                //Debug
-                            $status &= $modrestore($mod,$restore);
+                            $status = $status and $modrestore($mod,$restore); //bit operator & not reliable here!
                         } else {
                             //Something was wrong. Function should exist.
                             $status = false;
@@ -4839,7 +4852,7 @@
     }
 
     function restore_execute(&$restore,$info,$course_header,&$errorstr) {
-        global $CFG;
+        global $CFG, $USER;
         $status = true;
         //Checks for the required files/functions to restore every module
         //and include them
@@ -5302,9 +5315,9 @@
             }
             if (!$status = restore_decode_content_links($restore)) {
                 if (!defined('RESTORE_SILENTLY')) {
-                    notify("Could not refresh events for activities!");
+                    notify("Could not decode content links!");
                 } else {
-                    $errorstr = "Could not refresh events for activities!";
+                    $errorstr = "Could not decode content links!";
                     return false;
                 }
             }

backup/version.php

@@ -5,6 +5,8 @@
 // database (backup_version) to determine whether upgrades should
 // be performed (see db/backup_*.php)
 
-$backup_version = 2006053000;   // The current version is a date (YYYYMMDDXX)
+$backup_version = 2006082300;   // The current version is a date (YYYYMMDDXX)
 
-$backup_release = "1.6";  // User-friendly version number
+$backup_release = "1.6.2";  // User-friendly version number
+
+?>

blocks/admin/block_admin.php

@@ -56,7 +56,7 @@ class block_admin extends block_list {
             $this->content->icons[] = '<img src="'.$CFG->pixpath.'/i/log.gif" alt="" />';
 
 
-            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/admin/report.php">'.get_string('reports').'</a>';
+            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/report.php">'.get_string('reports').'</a>';
             $this->content->icons[] = '<img src="'.$CFG->pixpath.'/i/stats.gif" alt="" />';
 
             $this->content->items[] = '<a href="'.$CFG->wwwroot.'/files/index.php?id='.SITEID.'">'.get_string('sitefiles').'</a>';

blocks/blog_tags/block_blog_tags.php

@@ -71,13 +71,13 @@ class block_blog_tags extends block_base {
 
         $timewithin = $this->config->timewithin * 24 * 60 * 60; /// convert to seconds
         
-        $sql  = 'SELECT t.*, COUNT(DISTINCT bt.id) as ct ';
+        $sql  = 'SELECT t.id, t.type, t.text, COUNT(DISTINCT bt.id) as ct ';
         $sql .= "FROM {$CFG->prefix}tags as t, {$CFG->prefix}blog_tag_instance as bt, {$CFG->prefix}post as p ";
         $sql .= 'WHERE t.id = bt.tagid ';
         $sql .= 'AND p.id = bt.entryid ';
-        $sql .= 'AND (p.publishstate = "site" or p.publishstate="public") ';
+        $sql .= 'AND (p.publishstate = \'site\' or p.publishstate=\'public\') ';
         $sql .= "AND bt.timemodified > {$timewithin} ";
-        $sql .= 'GROUP BY bt.tagid ';
+        $sql .= 'GROUP BY  t.id, t.type, t.text ';
         $sql .= 'ORDER BY ct DESC, t.text ASC ';
         $sql .= "LIMIT {$this->config->numberoftags} ";
 

blocks/html/config_instance.html

@@ -2,7 +2,7 @@
 <table cellpadding="9" cellspacing="0">
 <tr valign="top">
     <td align="right"><?php print_string('configtitle', 'block_html'); ?>:</td>
-    <td><input type="text" name="title" size="30" value="<?php echo isset($this->config->title)?$this->config->title:''; ?>" /> (<?php print_string('leaveblanktohide', 'block_html'); ?>)</td>
+    <td><input type="text" name="title" size="30" value="<?php echo isset($this->config->title)?p($this->config->title):''; ?>" /> (<?php print_string('leaveblanktohide', 'block_html'); ?>)</td>
 </tr>
 <tr valign="top">
     <td align="right"><?php print_string('configcontent', 'block_html'); ?>:</td>

blocks/loancalc/block_loancalc.php

@@ -198,6 +198,7 @@ function comp(v) { // general entry point for all cases
 				</tr>
 			</table>
 			</form>';
+        $this->content->footer = '';
 
         return $this->content;
 

blocks/login/block_login.php

@@ -52,7 +52,7 @@ class block_login extends block_base {
             $this->content->text .= '<table align="center" cellpadding="2" cellspacing="0" class="logintable">';
 
             $this->content->text .= '<tr><td class="c0 r0" align="right">'.get_string('username').':</td>';
-            $this->content->text .= '<td class="c1 r0"><input type="text" name="username" size="10" value="'.$username.'" /></td></tr>';
+            $this->content->text .= '<td class="c1 r0"><input type="text" name="username" size="10" value="'.s($username).'" /></td></tr>';
 
             $this->content->text .= '<tr><td class="c0 r1" align="right">'.get_string('password').':</td>';
             $this->content->text .= '<td class="c1 r1"><input type="password" name="password" size="10" value="" /></td></tr>';

blocks/online_users/block_online_users.php

@@ -118,7 +118,7 @@ class block_online_users extends block_base {
                 $this->content->text .= '<a href="'.$CFG->wwwroot.'/user/view.php?id='.$user->id.'&amp;course='.$COURSE->id.'" title="'.$timeago.'">'.$user->fullname.'</a>';
                 if (!empty($USER->id) and ($USER->id != $user->id) and !empty($CFG->messaging) and !isguest()) {  // Only when logged in
                     $this->content->text .= "\n".' <a title="'.get_string('messageselectadd').'" target="message_'.$user->id.'" href="'.$CFG->wwwroot.'/message/discussion.php?id='.$user->id.'" onclick="return openpopup(\'/message/discussion.php?id='.$user->id.'\', \'message_'.$user->id.'\', \'menubar=0,location=0,scrollbars,status,resizable,width=400,height=500\', 0);">'
-                        .'<img class="icon message" src="'.$CFG->pixpath.'/t/message.gif" alt="'. get_string('messageselectadd') .'" /></a>';
+                        .'<img class="messageicon" src="'.$CFG->pixpath.'/t/message.gif" alt="'. get_string('messageselectadd') .'" /></a>';
                 }
                 $this->content->text .= "</li>\n";
             }

blocks/participants/block_participants.php

@@ -7,7 +7,7 @@ class block_participants extends block_list {
     }
 
     function get_content() {
-        global $USER, $CFG;
+        global $USER, $CFG, $COURSE;
 
         if ($this->content !== NULL) {
             return $this->content;
@@ -27,13 +27,14 @@ class block_participants extends block_list {
             $this->instance->pageid = SITEID;
         }
 
-        if ($this->instance->pageid != SITEID || 
+        /// MDL-13252 Always get the course page id or else the id may be incorrect in the user/index.php
+        if ($COURSE->id != SITEID || 
             $CFG->showsiteparticipantslist > 1 || 
             ($CFG->showsiteparticipantslist == 1 && isteacherinanycourse()) || 
             isteacher(SITEID)) {
 
             $this->content->items[] = '<a title="'.get_string('listofallpeople').'" href="'.
-                                      $CFG->wwwroot.'/user/index.php?id='.$this->instance->pageid.'">'.get_string('participants').'</a>';
+                                      $CFG->wwwroot.'/user/index.php?id='.$COURSE->id.'">'.get_string('participants').'</a>';
             $this->content->icons[] = '<img src="'.$CFG->pixpath.'/i/users.gif" height="16" width="16" alt="" />';
         }
 

blocks/rss_client/block_rss_client.php

@@ -123,7 +123,7 @@
             $numids = count($rssidarray);
             $count = 0;
             foreach ($rssidarray as $rssid) {
-                $output .=  $this->get_rss_by_id($rssid, $display_description, $shownumentries, ($numids > 1) ? true : false);
+                $output .=  clean_text($this->get_rss_by_id($rssid, $display_description, $shownumentries, ($numids > 1) ? true : false), FORMAT_HTML);
                 if ($numids > 1 && $count != $numids -1 && !empty($rssfeedstring)) {
                     $output .= '<hr width="80%" />';
                 }

blog/blogpage.php

@@ -1,5 +1,9 @@
 <?php  // $Id$
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 /**
 * Definition of blog page type.
  */

blog/edit.php

@@ -115,8 +115,8 @@ if ($editid) {  // User is editing a post
     $blogEntry = get_record('post','id',$editid);
 
     //using an unformatted entry body here so that extra formatting information is not stored in the db
-    $post->body = stripslashes_safe($blogEntry->summary);
-    $post->etitle = stripslashes_safe($blogEntry->subject);
+    $post->body = $blogEntry->summary;
+    $post->etitle = $blogEntry->subject;
     $post->postid = $editid;
     $post->userid = $blogEntry->userid;
     $post->format = $blogEntry->format;
@@ -194,8 +194,8 @@ function do_save($post) {
 
         /// Write a blog entry into database
         $blogEntry = new object;
-        $blogEntry->subject = addslashes($post->etitle);
-        $blogEntry->summary = addslashes($post->body);
+        $blogEntry->subject = $post->etitle;
+        $blogEntry->summary = $post->body;
         $blogEntry->module = 'blog';
         $blogEntry->userid = $USER->id;
         $blogEntry->format = $post->format;
@@ -267,8 +267,8 @@ function do_update($post) {
 //  echo "id id ".$post->postid;
 //  print_object($blogentry);  //debug
 
-    $blogEntry->subject = addslashes($post->etitle);
-    $blogEntry->summary = addslashes($post->body);
+    $blogEntry->subject = $post->etitle;
+    $blogEntry->summary = $post->body;
     if ($blogEntry->summary == '<br />') {
         $blogEntry->summary = '';
     }

blog/header.php

@@ -110,10 +110,10 @@ if ($ME == $CFG->wwwroot.'/blog/edit.php') {  /// We are in edit mode, print the
 
         case 'course':
             if ($tagid || !empty($tag)) {
-                print_header_simple("$course->shortname: $blogstring", $course->fullname,
+                print_header("$course->shortname: $blogstring", $course->fullname,
                             '<a href="index.php?filtertype=course&amp;filterselect='.$filterselect.'">'. "$blogstring</a> -> $tagstring: $taginstance->text",'','',true,$PAGE->get_extra_header_string());
             } else {
-                print_header_simple("$course->shortname: $blogstring", $course->fullname,
+                print_header("$course->shortname: $blogstring", $course->fullname,
                             $blogstring,'','',true,$PAGE->get_extra_header_string());
             }
         break;
@@ -123,11 +123,11 @@ if ($ME == $CFG->wwwroot.'/blog/edit.php') {  /// We are in edit mode, print the
             $thisgroup = get_record('groups', 'id', $filterselect);
 
             if ($tagid || !empty($tag)) {
-                print_header_simple("$course->shortname: $blogstring", $course->fullname,
+                print_header("$course->shortname: $blogstring", $course->fullname,
                             '<a href="'.$CFG->wwwroot.'/user/index.php?id='.$course->id.'&amp;group='.$filterselect.'">'.$thisgroup->name.'</a> ->
                             <a href="index.php?filtertype=group&amp;filterselect='.$filterselect.'">'. "$blogstring</a> -> $tagstring: $taginstance->text",'','',true,$PAGE->get_extra_header_string());
             } else {
-                print_header_simple("$course->shortname: $blogstring", $course->fullname,
+                print_header("$course->shortname: $blogstring", $course->fullname,
                             '<a href="'.$CFG->wwwroot.'/user/index.php?id='.$course->id.'&amp;group='.$filterselect.'">'.$thisgroup->name."</a> ->
                             $blogstring",'','',true,$PAGE->get_extra_header_string());
 

blog/index.php

@@ -20,7 +20,7 @@ $limit = optional_param('limit', 0, PARAM_INT);
 $start = optional_param('formstart', 0, PARAM_INT);
 $userid = optional_param('userid',0,PARAM_INT);
 $courseid = optional_param('courseid',SITEID,PARAM_INT);
-$tag = s(urldecode(optional_param('tag', '', PARAM_NOTAGS)));
+$tag = optional_param('tag', '', PARAM_NOTAGS);
 $tagid = optional_param('tagid', 0, PARAM_INT);
 $postid = optional_param('postid',0,PARAM_INT);
 $filtertype = optional_param('filtertype', '', PARAM_ALPHA);
@@ -143,7 +143,7 @@ $blogpage = optional_param('blogpage',0,PARAM_INT);
 
 blog_print_html_formatted_entries($userid, $postid, $limit, ($blogpage * $limit) ,$filtertype, $filterselect, $tagid, $tag, $filtertype, $filterselect);
 
-add_to_log($site->id, 'blog', 'view', 'index.php?filtertype='.$filtertype.'&filterselect='.$filterselect.'&postid='.$postid.'&tagid='.$tagid.'&tag='.$tag, 'view blog entry');
+add_to_log($courseid, 'blog', 'view', 'index.php?filtertype='.$filtertype.'&filterselect='.$filterselect.'&postid='.$postid.'&tagid='.$tagid.'&tag='.$tag, 'view blog entry');
 
 include($CFG->dirroot .'/blog/footer.php');
 

blog/lib.php

@@ -119,6 +119,9 @@
                 blog_print_entry($blogEntry, 'list', $filtertype, $filterselect); //print this entry.
                 $count++;
             }
+
+            print_paging_bar(get_viewable_entry_count($userid, $postid, $limit, $start,$filtertype, $filterselect, $tagid, $tag, $sort='lastmodified DESC'), $blogpage, $bloglimit, get_baseurl($filtertype, $filterselect), 'blogpage');
+
             if (!$count) {
                 print '<br /><center>'. get_string('noentriesyet', 'blog') .'</center><br />';
 
@@ -151,10 +154,10 @@
 
         global $USER, $CFG, $course, $ME;
 
-        $template['body'] = get_formatted_entry_body(stripslashes_safe($blogEntry->summary), $blogEntry->format);
-        $template['title'] = '<a name="'. $blogEntry->subject .'"></a>';
+        $template['body'] = get_formatted_entry_body($blogEntry->summary, $blogEntry->format);
+        $template['title'] = '<a name="'. s($blogEntry->subject, true) .'"></a>';
         //enclose the title in nolink tags so that moodle formatting doesn't autolink the text
-        $template['title'] .= '<span class="nolink">'. stripslashes_safe($blogEntry->subject);
+        $template['title'] .= '<span class="nolink">'. strip_tags(format_string($blogEntry->subject, true));
         $template['title'] .= '</span>';
         $template['userid'] = $blogEntry->userid;
         $template['author'] = fullname(get_record('user','id',$blogEntry->userid));
@@ -339,7 +342,7 @@
         if ($format) {
             return format_text($body, $format);
         }
-        return stripslashes_safe($body);
+        return $body;
     }
 
 /// Main filter function
@@ -408,8 +411,8 @@
 
             case 'site':
 
-                if (!isguest() && isloggedin()) {
-
+                if (isloggedin()) {
+					
                     $SQL = 'SELECT '.$requiredfields.' FROM '.$CFG->prefix.'post p, '.$tagtablesql
                             .$CFG->prefix.'user u
                             WHERE p.userid = u.id '.$tagquerysql.'
@@ -469,22 +472,33 @@
 
             case 'group':
 
-                $SQL = 'SELECT '.$requiredfields.' FROM '.$CFG->prefix.'post p, '.$tagtablesql
-                        .$CFG->prefix.'groups_members m, '.$CFG->prefix.'user u
-                        WHERE p.userid = m.userid '.$tagquerysql.'
-                        AND u.id = p.userid
-                        AND m.groupid = '.$filterselect.'
-                        AND (p.publishstate = \'site\' OR p.publishstate = \'public\' OR p.userid = '.$USER->id.')';
+				$SQL = 'SELECT '.$requiredfields.' FROM '.$CFG->prefix.'post p, '.$tagtablesql
+	                    .$CFG->prefix.'groups_members m, '.$CFG->prefix.'user u
+	                    WHERE p.userid = m.userid '.$tagquerysql.'
+	                    AND u.id = p.userid
+	                    AND m.groupid = '.$filterselect.'
+	                    AND (p.publishstate = \'site\' OR p.publishstate = \'public\' OR p.userid = '.$USER->id.')';
 
             break;
 
             case 'user':
-
-                $SQL = 'SELECT '.$requiredfields.' FROM '.$CFG->prefix.'post p, '.$tagtablesql
-                        .$CFG->prefix.'user u
-                        WHERE p.userid = u.id '.$tagquerysql.'
-                        AND u.id = '.$filterselect.'
-                        AND (p.publishstate = \'site\' OR p.publishstate = \'public\' OR p.userid = '.$USER->id.')';
+				
+				if (isloggedin()) {
+				  
+	                $SQL = 'SELECT '.$requiredfields.' FROM '.$CFG->prefix.'post p, '.$tagtablesql
+	                        .$CFG->prefix.'user u
+	                        WHERE p.userid = u.id '.$tagquerysql.'
+	                        AND u.id = '.$filterselect.'
+	                        AND (p.publishstate = \'site\' OR p.publishstate = \'public\' OR p.userid = '.$USER->id.')';
+	            } else {
+	                
+					$SQL = 'SELECT '.$requiredfields.' FROM '.$CFG->prefix.'post p, '.$tagtablesql
+	                        .$CFG->prefix.'user u
+	                        WHERE p.userid = u.id '.$tagquerysql.'
+	                        AND u.id = '.$filterselect.'
+	                        AND p.publishstate = \'public\'';	              
+	              
+	            }
 
             break;
 

calendar/event.php

@@ -9,14 +9,14 @@
 // Copyright (C) 2003-2004  Greek School Network            www.sch.gr     //
 //                                                                         //
 // Designed by:                                                            //
-//     Avgoustos Tsinakos (tsinakos@uom.gr)                                //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Avgoustos Tsinakos (tsinakos@teikav.edu.gr)                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // Programming and development:                                            //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // For bugs, suggestions, etc contact:                                     //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // The current module was developed at the University of Macedonia         //
 // (www.uom.gr) under the funding of the Greek School Network (www.sch.gr) //
@@ -205,13 +205,14 @@
                 if (count($err) == 0) {
                     $form->timemodified = time();
 
-                    if ($form->repeat) {
-                        $fetch = get_record_sql('SELECT 1, MAX(repeatid) AS repeatid FROM '.$CFG->prefix.'event');
-                        $form->repeatid = empty($fetch) ? 1 : $fetch->repeatid + 1;
-                    }
-
                     /// Get the event id for the log record.
                     $eventid = insert_record('event', $form, true);
+                    
+                    /// Use the event id as the repeatid to link repeat entries together
+                    if ($form->repeat) {
+                        $form->repeatid = $form->id = $eventid;
+                        update_record('event', $form);         // update the row, to set its repeatid        	
+                    }
 
                     /// Log the event entry.
                     add_to_log($form->courseid, 'calendar', 'add', 'event.php?action=edit&id='.$eventid, stripslashes($form->name));
@@ -262,7 +263,7 @@
     }
 
     print_header($site->shortname.': '.$strcalendar.': '.$title, $strcalendar, $nav.' -> '.$title,
-                 $focus, '', true, '', user_login_string($site));
+                 'eventform.name', '', true, 'new.name', user_login_string($site));
 
     echo calendar_overlib_html();
 
@@ -378,7 +379,7 @@
                     $form->timestart = make_timestamp($cal_y, $cal_m, 1, 0, 0, 0);
                 }
             }
-            if($form->timestart < 0) {
+            if(!isset($form->timestart) or $form->timestart < 0) {
                 $form->timestart = time();
             }
 
@@ -484,15 +485,20 @@
             echo '<div class="header">'.get_string('newevent', 'calendar').$header.'</div>';
 
             if($eventtype == 'select') {
-                $defaultcourse = $SESSION->cal_course_referer;
-                if(isteacheredit($defaultcourse, $USER->id)) {
-                    $defaultgroup = $groupid = 0;
+                $courseid = optional_param('courseid', $SESSION->cal_course_referer, PARAM_INT);
+                if ($courseid == 0) { // workaround by Dan for bug #6130
+                    $courseid = SITEID;
                 }
-                else {
-                    $defaultgroup = user_group($defaultcourse, $USER->id);
-                    $groupid      = optional_param('groupid',  $defaultgroup->id, PARAM_INT);
+                if (!$course = get_record('course', 'id', $courseid)) {
+                    error('Incorrect course ID');
                 }
-                $courseid = optional_param('courseid', $defaultcourse, PARAM_INT);
+                if ($groupmode = groupmode($course)) {   // Groups are being used
+                    $changegroup = optional_param('group', -1, PARAM_INT);
+                    $groupid = get_and_set_current_group($course, $groupmode, $changegroup);
+                } else {
+                    $groupid = 0;
+                }
+
                 echo '<h2>'.get_string('eventkind', 'calendar').':</h2>';
                 echo '<div id="selecteventtype">';
                 include('event_select.html');

calendar/event_edit.html

@@ -1,4 +1,4 @@
-<form method="post" action="event.php" name="edit">
+<form method="post" action="event.php" name="eventform">
 <table cellpadding="5" cellspacing="0">
   <tr>
     <td style="vertical-align: top; text-align: right;">

calendar/event_new.html

@@ -2,7 +2,7 @@
     // The following is a hack to fix bug 1488
     $course = get_record('course', 'id', ($form->courseid) ? $form->courseid : $site->id);
 ?>
-<form method="post" action="event.php" name="new">
+<form method="post" action="event.php" name="eventform">
 <table cellpadding="5">
   <tr>
     <td style="vertical-align: top; text-align: right;">
@@ -29,9 +29,9 @@
       <?php print_string('eventdate', 'calendar'); ?>:
     </td>
     <td>
-      <?php print_date_selector('startday', 'startmon', 'startyr', $form->timestart);?>
+      <?php print_date_selector('startday', 'startmon', 'startyr', (int)$form->timestart);?>
       <?php print_string('eventtime', 'calendar');?>
-      <?php print_time_selector('starthr', 'startmin', $form->timestart) ?>
+      <?php print_time_selector('starthr', 'startmin', (int)$form->timestart) ?>
       <?php if (isset($err['timestart'])) formerr($err['timestart']); ?>
     </td>
   </tr>

calendar/lib.php

@@ -9,14 +9,14 @@
 // Copyright (C) 2003-2004  Greek School Network            www.sch.gr     //
 //                                                                         //
 // Designed by:                                                            //
-//     Avgoustos Tsinakos (tsinakos@uom.gr)                                //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Avgoustos Tsinakos (tsinakos@teikav.edu.gr)                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // Programming and development:                                            //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // For bugs, suggestions, etc contact:                                     //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // The current module was developed at the University of Macedonia         //
 // (www.uom.gr) under the funding of the Greek School Network (www.sch.gr) //
@@ -104,9 +104,15 @@ function calendar_get_mini($courses, $groups, $users, $cal_month = false, $cal_y
     list($d, $m, $y) = array($date['mday'], $date['mon'], $date['year']); // This is what we want to display
     $display->maxdays = calendar_days_in_month($m, $y);
 
-    // We 'll keep these values as GMT here, and offset them when the time comes to query the db
-    $display->tstart = gmmktime(0, 0, 0, $m, 1, $y); // This is GMT
-    $display->tend = gmmktime(23, 59, 59, $m, $display->maxdays, $y); // GMT
+    if (get_user_timezone_offset() < 99) {
+        // We 'll keep these values as GMT here, and offset them when the time comes to query the db
+	    $display->tstart = gmmktime(0, 0, 0, $m, 1, $y); // This is GMT
+	    $display->tend = gmmktime(23, 59, 59, $m, $display->maxdays, $y); // GMT
+    } else {
+        // no timezone info specified
+	    $display->tstart = mktime(0, 0, 0, $m, 1, $y);
+	    $display->tend = mktime(23, 59, 59, $m, $display->maxdays, $y);
+    }
 
     $startwday = dayofweek(1, $m, $y);
 
@@ -236,7 +242,7 @@ function calendar_get_mini($courses, $groups, $users, $cal_month = false, $cal_y
                     $popupicon = $CFG->pixpath.'/c/user.gif';
                     $popupalt  = '';
                 }
-                $popupcontent .= '<div><img height="16" width="16" src="'.$popupicon.'" style="vertical-align: middle; margin-right: 4px;" alt="'.$popupalt.'" /><a href="'.$dayhref.'">'.format_string($event->name,true).'</a></div>';
+                $popupcontent .= '<div><img height="16" width="16" src="'.$popupicon.'" style="vertical-align: middle; margin-right: 4px;" alt="'.$popupalt.'" /><a href="'.$dayhref.'#event_'.$event->id.'">'.format_string($event->name,true).'</a></div>';
             }
             
             //Accessibility: functionality moved to calendar_get_popup.
@@ -332,6 +338,7 @@ function calendar_get_popup($is_today, $event_timestart, $popupcontent='') {
         $popupcaption .= get_string('eventsfor', 'calendar', userdate($event_timestart, get_string('strftimedayshort')));
     }
     $popupcontent = str_replace("'", "\'", htmlspecialchars($popupcontent));
+    $popupcaption = str_replace("'", "\'", htmlspecialchars($popupcaption)); 
     $popup = 'onmouseover="return overlib(\''.$popupcontent.'\', CAPTION, \''.$popupcaption.'\');" onmouseout="return nd();"';
     return $popup;
 }
@@ -449,7 +456,7 @@ function calendar_print_event($event) {
     static $strftimetime;
 
     $event = calendar_add_event_metadata($event);
-    echo '<table class="event" cellspacing="0">';
+    echo '<a name="event_'.$event->id.'"></a><table class="event" cellspacing="0">';
     echo '<tr><td class="picture">';
     if (!empty($event->icon)) {
         echo $event->icon;
@@ -862,7 +869,7 @@ function calendar_get_sideblock_upcoming($events, $linkhref = NULL) {
             if(!empty($linkhref)) {
                 $ed = usergetdate($events[$i]->timestart);
                 $href = calendar_get_link_href(CALENDAR_URL.$linkhref, $ed['mday'], $ed['mon'], $ed['year']);
-                $content .= '<a href="'.$href.'">'.$events[$i]->name.'</a>';
+                $content .= '<a href="'.$href.'#event_'.$events[$i]->id.'">'.$events[$i]->name.'</a>';
             }
             else {
                 $content .= $events[$i]->name;
@@ -1087,6 +1094,10 @@ function calendar_set_filters(&$courses, &$group, &$user, $courseeventsfrom = NU
     else {
         $courses = false;
     }
+   //BUG 6130 clean $courses array as SESSION has bad entries. 
+   foreach ($courses as $index => $value) {
+       if (empty($value)) unset($courses[$index]);
+   }
 
     if($SESSION->cal_show_user || $ignorefilters) {
         // This doesn't work for arrays yet (maybe someday it will)

calendar/set.php

@@ -9,14 +9,14 @@
 // Copyright (C) 2003-2004  Greek School Network            www.sch.gr     //
 //                                                                         //
 // Designed by:                                                            //
-//     Avgoustos Tsinakos (tsinakos@uom.gr)                                //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Avgoustos Tsinakos (tsinakos@teikav.edu.gr)                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // Programming and development:                                            //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // For bugs, suggestions, etc contact:                                     //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // The current module was developed at the University of Macedonia         //
 // (www.uom.gr) under the funding of the Greek School Network (www.sch.gr) //

calendar/view.php

@@ -9,14 +9,14 @@
 // Copyright (C) 2003-2004  Greek School Network            www.sch.gr     //
 //                                                                         //
 // Designed by:                                                            //
-//     Avgoustos Tsinakos (tsinakos@uom.gr)                                //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Avgoustos Tsinakos (tsinakos@teikav.edu.gr)                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // Programming and development:                                            //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // For bugs, suggestions, etc contact:                                     //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // The current module was developed at the University of Macedonia         //
 // (www.uom.gr) under the funding of the Greek School Network (www.sch.gr) //
@@ -44,8 +44,8 @@
     require_once($CFG->dirroot.'/course/lib.php');
     require_once($CFG->dirroot.'/calendar/lib.php');
 
-    $course = optional_param('course', 0);
-    $view = optional_param('view', 'upcoming');
+    $courseid = optional_param('course', 0, PARAM_INT);
+    $view = optional_param('view', 'upcoming', PARAM_ALPHA);
     $day  = optional_param('cal_d', 0, PARAM_INT);
     $mon  = optional_param('cal_m', 0, PARAM_INT);
     $yr   = optional_param('cal_y', 0, PARAM_INT);
@@ -54,6 +54,12 @@
         redirect($CFG->wwwroot.'/'.$CFG->admin.'/index.php');
     }
 
+    if ($courseid) {
+        require_login($courseid);
+    } else if ($CFG->forcelogin) {
+        require_login();
+    }
+
     //add_to_log($course->id, "course", "view", "view.php?id=$course->id", "$course->id");
     $now = usergetdate(time());
     $pagetitle = '';
@@ -83,8 +89,8 @@
     }
 
     // If a course has been supplied in the URL, change the filters to show that one
-    if (!empty($course)) {
-        if ($course = get_record('course', 'id', $course)) {
+    if (!empty($courseid)) {
+        if ($course = get_record('course', 'id', $courseid)) {
             if ($course->id == SITEID) {
                 // If coming from the home page, show all courses
                 $SESSION->cal_courses_shown = calendar_get_default_courses(true);
@@ -96,6 +102,8 @@
                 calendar_set_referring_course($SESSION->cal_courses_shown);
             }
         }
+    } else {
+        $course = null;
     }
 
     if (empty($USER->id) or isguest()) {
@@ -298,9 +306,15 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users) {
     list($d, $m, $y) = array($date['mday'], $date['mon'], $date['year']); // This is what we want to display
     $display->maxdays = calendar_days_in_month($m, $y);
 
-    // We 'll keep these values as GMT here, and offset them when the time comes to query the db
-    $display->tstart = gmmktime(0, 0, 0, $m, 1, $y); // This is GMT
-    $display->tend = gmmktime(23, 59, 59, $m, $display->maxdays, $y); // GMT
+    if (get_user_timezone_offset() < 99) {
+        // We 'll keep these values as GMT here, and offset them when the time comes to query the db
+	    $display->tstart = gmmktime(0, 0, 0, $m, 1, $y); // This is GMT
+	    $display->tend = gmmktime(23, 59, 59, $m, $display->maxdays, $y); // GMT
+    } else {
+        // no timezone info specified
+	    $display->tstart = mktime(0, 0, 0, $m, 1, $y);
+	    $display->tend = mktime(23, 59, 59, $m, $display->maxdays, $y);
+    }
 
     $startwday = gmdate('w', $display->tstart); // $display->tstart is already GMT, so don't use date(): messes with server's TZ
 
@@ -436,7 +450,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users) {
         if(isset($eventsbyday[$day])) {
             echo '<ul class="events-new">';
             foreach($eventsbyday[$day] as $eventindex) {
-                echo '<li><a href="'.$dayhref.'">'.format_string($events[$eventindex]->name,true).'</a></li>';
+                echo '<li><a href="'.$dayhref.'#event_'.$events[$eventindex]->id.'">'.format_string($events[$eventindex]->name, true).'</a></li>';
             }
             echo '</ul>';
         }

config-dist.php

@@ -139,6 +139,9 @@ $CFG->admin = 'admin';
 // Useful for webhost operators who have alternate methods of backups
 //      $CFG->disablescheduledbackups = true;
 //
+// Prevent stats processing and hide the GUI
+//      $CFG->disablestatsprocessing = true;
+//
 // Restrict certain usernames from doing things that may mess up a site
 // This is especially useful for demonstration teacher accounts
 //      $CFG->restrictusers = 'teacher,fred,jim';
@@ -281,6 +284,9 @@ $CFG->admin = 'admin';
 //
 //     $CFG->emailconnectionerrorsto = 'your@emailaddress.com';
 // 
+// Restore pre-1.6 behaviour where courses could still be available
+// even if the category they were in was hidden
+//     $CFG->allowvisiblecoursesinhiddencategories = true;
 // 
 // NOTE: if you are using custompix in your theme, see /fixpix.php.
 

course/category.php

@@ -8,7 +8,7 @@
 
     $id       = required_param('id', PARAM_INT);          // Category id
     $page     = optional_param('page', 0, PARAM_INT);     // which page to show
-    $perpage  = optional_param('perpage', 20, PARAM_INT); // how many per page
+    $perpage  = optional_param('perpage', $CFG->coursesperpage, PARAM_INT); // how many per page
     $edit     = optional_param('edit', -1, PARAM_BOOL);
     $hide     = optional_param('hide', 0, PARAM_INT);
     $show     = optional_param('show', 0, PARAM_INT);

course/edit.php

@@ -145,6 +145,7 @@
                         $newteacher->course = $newcourseid;
                         $newteacher->authority = 1;   // First teacher is the main teacher
                         $newteacher->editall = 1;     // Course creator can edit their own course
+                        $newteacher->enrol = 'manual';// enrol the teacher too - bug #6120
 
                         if (!$newteacher->id = insert_record("user_teachers", $newteacher)) {
                             error("Could not add you to this new course!");

course/editsection.php

@@ -60,7 +60,7 @@
         $strsummaryof = get_string('summaryof', '', " $sectionname $form->section");
     }
 
-    print_header_simple($stredit, '', $stredit);
+    print_header_simple($stredit, '', $stredit, 'theform.summary' );
 
     print_heading($strsummaryof);
     print_simple_box_start('center');

course/enrol.php

@@ -60,13 +60,13 @@
 /// moved here to fix bug 5734
     if ($course->metacourse) {
         print_header_simple();
-        notice(get_string('coursenotaccessible'), $CFG->wwwroot);
+        notice(get_string('coursenotaccessible'), "$CFG->wwwroot/index.php");
     }
     
 /// Users can't enroll to site course
     if (!$course->category) {
         print_header_simple();
-        notice(get_string('enrollfirst'), $CFG->wwwroot);
+        notice(get_string('enrollfirst'), "$CFG->wwwroot/index.php");
     }
 
 /// Double check just in case they are enrolled to start in the future 
@@ -75,22 +75,23 @@
         if ($course->enrolperiod and $student->timestart and ($student->timestart >= time())) {
             $message = get_string('enrolmentnotyet', '', userdate($student->timestart));
             print_header();
-            notice($message, $CFG->wwwroot);
+            notice($message, "$CFG->wwwroot/index.php");
         }
     }
 
 /// Check if the course is enrollable
     if (!method_exists($enrol, 'print_entry')) {
         print_header_simple();
-        notice(get_string('enrolmentnointernal'), $CFG->wwwroot);
+        notice(get_string('enrolmentnointernal'), "$CFG->wwwroot/index.php");
     }
 
-    if (!$course->enrollable ||
+    if (!$loginasguest and ($USER->username != 'guest') and(
+            !$course->enrollable ||
             ($course->enrollable == 2 && $course->enrolstartdate > 0 && $course->enrolstartdate > time()) ||
             ($course->enrollable == 2 && $course->enrolenddate > 0 && $course->enrolenddate <= time())
-            ) {
-        print_header_simple();
-        notice(get_string('notenrollable'), $CFG->wwwroot);
+            )) {
+        print_header($course->shortname, $course->fullname, $course->shortname );
+        notice(get_string('notenrollable'), "$CFG->wwwroot/index.php");
     }
 
 /// Check the submitted enrollment key if there is one
@@ -98,21 +99,15 @@
     if ($form = data_submitted()) {
       //User is not enrolled in the course, wants to access course content
       //as a guest, and course setting allow unlimited guest access
-      //Code cribbed from course/loginas.php
-      if ($loginasguest and ($course->guest==1)) {
-        $realuser = $USER->id;
-        $realname = fullname($USER, true);
-        $USER = guest_user();
-        $USER->loggedin = true;
-        $USER->site = $CFG->wwwroot;
-        $USER->realuser = $realuser;
-        $USER->sessionIP = md5(getremoteaddr());   // Store the current IP in the session
-        if (isset($SESSION->currentgroup)) {    // Remember current cache setting for later
-            $SESSION->oldcurrentgroup = $SESSION->currentgroup;
+      //
+      //the original idea was to use "loginas" feature, but require_login() would have to be changed
+      //and we would have to explain it to all users - it is now plain login action
+      if ($loginasguest and !empty($CFG->guestloginbutton) and ($course->guest==1 or $course->guest==2)) {
+        if (isset($SESSION->currentgroup)) {
             unset($SESSION->currentgroup);
         }
-        $guest_name = fullname($USER, true);
-        add_to_log($course->id, "course", "loginas", "../user/view.php?id=$course->id&$USER->id$", "$realname -> $guest_name");
+        $USER = get_complete_user_data('username', 'guest');    // get full guest user data
+        add_to_log(SITEID, 'user', 'login', "view.php?id=$USER->id&course=".SITEID, $USER->id, 0, $USER->id);
         if ($SESSION->wantsurl) {
             $destination = $SESSION->wantsurl;
             unset($SESSION->wantsurl);

course/format/lams/format.php

@@ -298,12 +298,12 @@ while ($section <= $course->numsections) {
             }
 
             if ($section > 1) {                       // Add a arrow to move section up
-                echo '<a href="view.php?id='.$course->id.'&amp;section='.$section.'&amp;move=-1&amp;sesskey='.$USER->sesskey.'#section-'.($section-1).'" title="'.$strmoveup.'">'.
+                echo '<a href="view.php?id='.$course->id.'&amp;random='.rand(1,10000).'&amp;section='.$section.'&amp;move=-1&amp;sesskey='.$USER->sesskey.'#section-'.($section-1).'" title="'.$strmoveup.'">'.
                     '<img src="'.$CFG->pixpath.'/t/up.gif" vspace="3" height="11" width="11" border="0" alt="'.$strmoveup.'" /></a><br />';
             }
 
             if ($section < $course->numsections) {    // Add a arrow to move section down
-                echo '<a href="view.php?id='.$course->id.'&amp;section='.$section.'&amp;move=1&amp;sesskey='.$USER->sesskey.'#section-'.($section+1).'" title="'.$strmovedown.'">'.
+                echo '<a href="view.php?id='.$course->id.'&amp;random='.rand(1,10000).'&amp;section='.$section.'&amp;move=1&amp;sesskey='.$USER->sesskey.'#section-'.($section+1).'" title="'.$strmovedown.'">'.
                     '<img src="'.$CFG->pixpath.'/t/down.gif" vspace="3" height="11" width="11" border="0" alt="'.$strmovedown.'" /></a><br />';
             }
 

course/format/topics/format.php

@@ -226,12 +226,12 @@
                 }
 
                 if ($section > 1) {                       // Add a arrow to move section up
-                    echo '<a href="view.php?id='.$course->id.'&amp;section='.$section.'&amp;move=-1&amp;sesskey='.$USER->sesskey.'#section-'.($section-1).'" title="'.$strmoveup.'">'.
+                    echo '<a href="view.php?id='.$course->id.'&amp;random='.rand(1,10000).'&amp;section='.$section.'&amp;move=-1&amp;sesskey='.$USER->sesskey.'#section-'.($section-1).'" title="'.$strmoveup.'">'.
                          '<img src="'.$CFG->pixpath.'/t/up.gif" vspace="3" height="11" width="11" border="0" alt="'.$strmoveup.'" /></a><br />';
                 }
 
                 if ($section < $course->numsections) {    // Add a arrow to move section down
-                    echo '<a href="view.php?id='.$course->id.'&amp;section='.$section.'&amp;move=1&amp;sesskey='.$USER->sesskey.'#section-'.($section+1).'" title="'.$strmovedown.'">'.
+                    echo '<a href="view.php?id='.$course->id.'&amp;random='.rand(1,10000).'&amp;section='.$section.'&amp;move=1&amp;sesskey='.$USER->sesskey.'#section-'.($section+1).'" title="'.$strmovedown.'">'.
                          '<img src="'.$CFG->pixpath.'/t/down.gif" vspace="3" height="11" width="11" border="0" alt="'.$strmovedown.'" /></a><br />';
                 }
 

course/format/weeks/format.php

@@ -217,12 +217,12 @@
                          '<img src="'.$CFG->pixpath.'/i/show.gif" vspace="3" class="icon hide" alt="'.$strweekshow.'" /></a><br />';
                 }
                 if ($section > 1) {                       // Add a arrow to move section up
-                    echo '<a href="view.php?id='.$course->id.'&amp;section='.$section.'&amp;move=-1&amp;sesskey='.$USER->sesskey.'#section-'.($section-1).'" title="'.$strmoveup.'">'.
+                    echo '<a href="view.php?id='.$course->id.'&amp;random='.rand(1,10000).'&amp;section='.$section.'&amp;move=-1&amp;sesskey='.$USER->sesskey.'#section-'.($section-1).'" title="'.$strmoveup.'">'.
                          '<img src="'.$CFG->pixpath.'/t/up.gif" vspace="3" class="icon up" alt="'.$strmoveup.'" /></a><br />';
                 }
 
                 if ($section < $course->numsections) {    // Add a arrow to move section down
-                    echo '<a href="view.php?id='.$course->id.'&amp;section='.$section.'&amp;move=1&amp;sesskey='.$USER->sesskey.'#section-'.($section+1).'" title="'.$strmovedown.'">'.
+                    echo '<a href="view.php?id='.$course->id.'&amp;random='.rand(1,10000).'&amp;section='.$section.'&amp;move=1&amp;sesskey='.$USER->sesskey.'#section-'.($section+1).'" title="'.$strmovedown.'">'.
                          '<img src="'.$CFG->pixpath.'/t/down.gif" vspace="3" class="icon down" alt="'.$strmovedown.'" /></a><br />';
                 }
             }

course/format/weekscss/format.php

@@ -221,12 +221,12 @@
                          '<img src="'.$CFG->pixpath.'/i/show.gif" class="icon hide" alt="'.$strweekshow.'" /></a><br />';
                 }
                 if ($section > 1) {                       // Add a arrow to move section up
-                    echo '<a href="view.php?id='.$course->id.'&amp;section='.$section.'&amp;move=-1&amp;sesskey='.$USER->sesskey.'#section-'.($section-1).'" title="'.$strmoveup.'">'.
+                    echo '<a href="view.php?id='.$course->id.'&amp;random='.rand(1,10000).'&amp;section='.$section.'&amp;move=-1&amp;sesskey='.$USER->sesskey.'#section-'.($section-1).'" title="'.$strmoveup.'">'.
                          '<img src="'.$CFG->pixpath.'/t/up.gif" class="icon up" alt="'.$strmoveup.'" /></a><br />';
                 }
 
                 if ($section < $course->numsections) {    // Add a arrow to move section down
-                    echo '<a href="view.php?id='.$course->id.'&amp;section='.$section.'&amp;move=1&amp;sesskey='.$USER->sesskey.'#section-'.($section+1).'" title="'.$strmovedown.'">'.
+                    echo '<a href="view.php?id='.$course->id.'&amp;random='.rand(1,10000).'&amp;section='.$section.'&amp;move=1&amp;sesskey='.$USER->sesskey.'#section-'.($section+1).'" title="'.$strmovedown.'">'.
                          '<img src="'.$CFG->pixpath.'/t/down.gif" class="icon down" alt="'.$strmovedown.'" /></a><br />';
                 }
             }

course/index.php

@@ -56,6 +56,9 @@
         }
 
         echo "<center>";
+        if (isloggedin() and !isguest() and !isadmin() and !iscreator()) {  // Print link to request a new course
+            print_single_button("request.php", NULL, get_string("courserequest"), "get");
+        }
         if (iscreator()) {       // Print link to create a new course
             print_single_button("edit.php", NULL, get_string("addnewcourse"), "get");
         }

course/jumpto.php

@@ -10,6 +10,10 @@
 
     $jump = optional_param('jump', '', PARAM_RAW);
 
+    if (!confirm_sesskey()) {
+        print_error('confirmsesskeybad');
+    }
+
     if (strpos($jump, $CFG->wwwroot) === 0) {            // Anything on this site
         redirect(urldecode($jump));
     } else if (preg_match('/^[a-z]+\.php\?/', $jump)) { 

course/lib.php

@@ -24,6 +24,9 @@ define("FRONTPAGENEWS",           0);
 define("FRONTPAGECOURSELIST",     1);
 define("FRONTPAGECATEGORYNAMES",  2);
 define("FRONTPAGETOPICONLY",      3);
+define("FRONTPAGECATEGORYCOMBO",  4);
+
+define("FRONTPAGECOURSELIMIT",    200);           // maximum number of courses displayed on the frontpage
 
 function print_recent_selector_form($course, $advancedfilter=0, $selecteduser=0, $selecteddate="lastlogin",
                                     $mod="", $modid="activity/All", $modaction="", $selectedgroup="", $selectedsort="default") {
@@ -405,12 +408,12 @@ function print_log($course, $user=0, $date=0, $order="l.time ASC", $page=0, $per
 
         $log->url  = strip_tags(urldecode($log->url));   // Some XSS protection
         $log->info = strip_tags(urldecode($log->info));  // Some XSS protection
-        $log->url  = str_replace('&', '&', $log->url); /// XHTML compatibility
+        $log->url  = s($log->url); /// XSS protection and XHTML compatibility - should be in link_to_popup_window() instead!!
 
         echo '<tr class="r'.$row.'">';
         if ($course->id == SITEID) {
             echo "<td class=\"r$row c0\" nowrap=\"nowrap\">\n";
-            echo "    <a href=\"view.php?id={$log->course}\">".$courses[$log->course]."</a>\n";
+            echo "    <a href=\"{$CFG->wwwroot}/course/view.php?id={$log->course}\">".$courses[$log->course]."</a>\n";
             echo "</td>\n";
         }
         echo "<td class=\"r$row c1\" nowrap=\"nowrap\" align=\"right\">".userdate($log->time, '%a').
@@ -1034,7 +1037,7 @@ function make_categories_list(&$list, &$parents, $category=NULL, $path="") {
 }
 
 
-function print_whole_category_list($category=NULL, $displaylist=NULL, $parentslist=NULL, $depth=-1) {
+function print_whole_category_list($category=NULL, $displaylist=NULL, $parentslist=NULL, $depth=-1, $files = true) {
 /// Recursive function to print out all the categories in a nice format
 /// with or without courses included
     global $CFG;
@@ -1049,7 +1052,7 @@ function print_whole_category_list($category=NULL, $displaylist=NULL, $parentsli
 
     if ($category) {
         if ($category->visible or iscreator()) {
-            print_category_info($category, $depth);
+            print_category_info($category, $depth, $files);
         } else {
             return;  // Don't bother printing children of invisible categories
         }
@@ -1072,7 +1075,7 @@ function print_whole_category_list($category=NULL, $displaylist=NULL, $parentsli
             $down = $last ? false : true;
             $first = false;
 
-            print_whole_category_list($cat, $displaylist, $parentslist, $depth + 1);
+            print_whole_category_list($cat, $displaylist, $parentslist, $depth + 1, $files);
         }
     }
 }
@@ -1093,7 +1096,7 @@ function make_categories_options() {
     return $cats;
 }
 
-function print_category_info($category, $depth) {
+function print_category_info($category, $depth, $files = false) {
 /// Prints the category info in indented fashion
 /// This function is only used by print_whole_category_list() above
 
@@ -1108,10 +1111,8 @@ function print_category_info($category, $depth) {
 
     $catlinkcss = $category->visible ? '' : ' class="dimmed" ';
 
-    $frontpage = explode(',', $CFG->frontpage);
-    $frontpage = $frontpage?array_flip($frontpage):array();
-    $coursecount = count_records('course') <= 200;
-    if (isset($frontpage[FRONTPAGECATEGORYNAMES]) && !isset($frontpage[FRONTPAGECOURSELIST]) && $coursecount) {
+    $coursecount = count_records('course') <= FRONTPAGECOURSELIMIT;
+    if ($files and $coursecount) {
         $catimage = '<img src="'.$CFG->pixpath.'/i/course.gif" width="16" height="16" border="0" alt="" />';
     } else {
         $catimage = "&nbsp;";
@@ -1119,7 +1120,7 @@ function print_category_info($category, $depth) {
 
     echo "\n\n".'<table border="0" cellpadding="3" cellspacing="0" width="100%">';
 
-    if (isset($frontpage[FRONTPAGECATEGORYNAMES]) && !isset($frontpage[FRONTPAGECOURSELIST]) && $coursecount) {
+    if ($files and $coursecount) {
         $courses = get_courses($category->id, 'c.sortorder ASC', 'c.id,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.guest,c.cost,c.currency');
 
         echo "<tr>";
@@ -1201,14 +1202,14 @@ function print_courses($category, $width="100%", $hidesitecourse = false) {
         $categories = get_categories(0);  // Parent = 0   ie top-level categories only
         if (count($categories) == 1) {
             $category   = array_shift($categories);
-            $courses    = get_courses($category->id, 'c.sortorder ASC', 'c.id,c.category,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.teacher,c.cost,c.currency,c.enrol');
+            $courses    = get_courses($category->id, 'c.sortorder ASC', 'c.id,c.category,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.teacher,c.cost,c.currency,c.enrol,c.guest');
         } else {
-            $courses    = get_courses('all', 'c.sortorder ASC', 'c.id,c.category,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.teacher,c.cost,c.currency,c.enrol');
+            $courses    = get_courses('all', 'c.sortorder ASC', 'c.id,c.category,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.teacher,c.cost,c.currency,c.enrol,c.guest');
         }
         unset($categories);
     } else {
         $categories = get_categories($category->id);  // sub categories
-        $courses    = get_courses($category->id, 'c.sortorder ASC', 'c.id,c.category,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.teacher,c.cost,c.currency,c.enrol');
+        $courses    = get_courses($category->id, 'c.sortorder ASC', 'c.id,c.category,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.teacher,c.cost,c.currency,c.enrol,c.guest');
     }
 
     if ($courses) {
@@ -1509,20 +1510,17 @@ function move_section($course, $section, $move) {
         course_set_display($course->id, $sectiondest);
     }
 
-    // Check for duplicates.
+    // Check for duplicates and fix order if needed.
     // There is a very rare case that some sections in the same course have the same section id.
-    if (($count_section = count_records('course_sections', 'course', $course->id) - 1) != $course->numsections) {
-        $sections = get_records_select('course_sections', "course = $course->id AND section > 0", 'section ASC');
-        $n = 1;
-        foreach ($sections as $section) {
+    $sections = get_records_select('course_sections', "course = $course->id", 'section ASC');
+    $n = 0;
+    foreach ($sections as $section) {
+        if ($section->section != $n) {
             if (!set_field('course_sections', 'section', $n, 'id', $section->id)) {
                 return false;
             }
-            $n++;
-        }
-        if (!set_field('course', 'numsections', $count_section, 'id', $course->id)) {
-            return false;
         }
+        $n++;
     }
     return true;
 }
@@ -1849,7 +1847,7 @@ function move_courses ($courseids, $categoryid) {
                     // figure out a sortorder that we can use in the destination category
                     $sortorder = get_field_sql('SELECT MIN(sortorder)-1 AS min
                                                     FROM ' . $CFG->prefix . 'course WHERE category=' . $categoryid);
-                    if ($sortorder === false) {
+                    if (is_null($sortorder) || $sortorder === false) {
                         // the category is empty
                         // rather than let the db default to 0
                         // set it to > 100 and avoid extra work in fix_coursesortorder()                        

course/loginas.php

@@ -4,9 +4,32 @@
     require_once("../config.php");
     require_once("lib.php");
 
-    $id       = required_param('id', PARAM_INT);           // course id
-    $user     = optional_param('user', 0, PARAM_INT);      // login as this user
+/// Reset user back to their real self if needed
     $return   = optional_param('return', 0, PARAM_BOOL);   // return to the page we came from
+
+    if (!empty($USER->realuser)) {
+        $USER = get_complete_user_data('id', $USER->realuser);
+
+        if (isset($SESSION->oldcurrentgroup)) {      // Restore previous "current group" cache.
+            $SESSION->currentgroup = $SESSION->oldcurrentgroup;
+            unset($SESSION->oldcurrentgroup);
+        }
+        if (isset($SESSION->oldtimeaccess)) {        // Restore previous timeaccess settings
+            $USER->timeaccess = $SESSION->oldtimeaccess;
+            unset($SESSION->oldtimeaccess);
+        }
+
+        if ($return and isset($_SERVER["HTTP_REFERER"])) { // That's all we wanted to do, so let's go back
+            redirect($_SERVER["HTTP_REFERER"]);
+        } else {
+            redirect($CFG->wwwroot);
+        }
+    }
+
+///-------------------------------------
+/// try to login as student if allowed
+    $id       = required_param('id', PARAM_INT);           // course id
+    $user     = required_param('user', PARAM_INT);         // login as this user
     $password = optional_param('password', '', PARAM_RAW); // site wide password
 
     if (!$site = get_site()) {
@@ -21,24 +44,6 @@
         require_login($course->id);
     }
 
-    if (isset($USER->realuser)) {   /// Reset user back to their real self
-        $USER = get_complete_user_data('id', $USER->realuser);
-
-        if (isset($SESSION->oldcurrentgroup)) {      // Restore previous "current group" cache.
-            $SESSION->currentgroup = $SESSION->oldcurrentgroup;
-            unset($SESSION->oldcurrentgroup);
-        }
-        if (isset($SESSION->oldtimeaccess)) {        // Restore previous timeaccess settings
-            $USER->timeaccess = $SESSION->oldtimeaccess;
-            unset($SESSION->oldtimeaccess);
-        }
-
-        if ($return) {       /// That's all we wanted to do, so let's go back
-            redirect($_SERVER["HTTP_REFERER"]);
-            exit;
-        }
-    }
-
     // $user must be defined to go on
 
     if (!isteacher($course->id)) {

course/mod.php

@@ -503,7 +503,7 @@
         $form->sesskey      = !empty($USER->id) ? $USER->sesskey : '';
 
         $sectionname    = get_string("name$course->format");
-        $fullmodulename = strtolower(get_string("modulename", $module->name));
+        $fullmodulename = get_string("modulename", $module->name);
 
         if ($form->section && $course->format != 'site') {
             $heading->what = $fullmodulename;
@@ -563,7 +563,7 @@
         $form->sesskey      = !empty($USER->id) ? $USER->sesskey : '';
 
         $sectionname    = get_string("name$course->format");
-        $fullmodulename = strtolower(get_string("modulename", $module->name));
+        $fullmodulename = get_string("modulename", $module->name);
 
         if ($form->section) {
             $heading->what = $fullmodulename;
@@ -638,7 +638,7 @@
     $strmodulenameplural = get_string("modulenameplural", $module->name);
 
     if ($module->name == "label") {
-        $focuscursor = "";
+        $focuscursor = "form.content";
     } else {
         $focuscursor = "form.name";
     }

course/recent.php

@@ -25,6 +25,7 @@
     add_to_log($course->id, "course", "recent", "recent.php?id=$course->id", "$course->id");
 
     $strrecentactivity = get_string("recentactivity");
+    $meta = '<meta name="robots" content="none" />'; // prevent duplicate content in search engines MDL-7299
 
     $loggedinas = user_login_string($course, $USER);
 
@@ -42,13 +43,13 @@
         if ($date)
             $dateinfo = userdate($date, get_string("strftimedaydate"));
 
-        if ($course->category) {
+        if ($course->id != SITEID) {
             print_header("$course->shortname: $strrecentactivity", "$course->fullname",
                          "<a href=\"view.php?id=$course->id\">$course->shortname</a> ->
-                          <a href=\"recent.php?id=$course->id\">$strrecentactivity</a> -> $userinfo, $dateinfo", "");
+                          <a href=\"recent.php?id=$course->id\">$strrecentactivity</a> -> $userinfo, $dateinfo", "", $meta);
         } else {
             print_header("$course->shortname: $strrecentactivity", "$course->fullname",
-                         "<a href=\"recent.php?id=$course->id\">$strrecentactivity</a> -> $userinfo, $dateinfo", "");
+                         "<a href=\"recent.php?id=$course->id\">$strrecentactivity</a> -> $userinfo, $dateinfo", "", $meta);
         }
 
         print_heading("$course->fullname: $userinfo, $dateinfo (".usertimezone().")", '', 3);
@@ -67,12 +68,12 @@
             }
         }
 
-        if ($course->category) {
+        if ($course->id != SITEID) {
             print_header("$course->shortname: $strrecentactivity", "$course->fullname",
-                     "<a href=\"view.php?id=$course->id\">$course->shortname</a> -> $strrecentactivity", "");
+                     "<a href=\"view.php?id=$course->id\">$course->shortname</a> -> $strrecentactivity", "", $meta);
         } else {
             print_header("$course->shortname: $strrecentactivity", "$course->fullname",
-                     "$strrecentactivity", "");
+                     "$strrecentactivity", "", $meta);
         }
 
         print_heading(get_string("activitysince", "", userdate($date)));

course/report/participation/index.php

@@ -155,7 +155,7 @@
     $postfun = $module->name.'_get_post_actions';
 
     if (!function_exists($viewfun) || !function_exists($postfun)) {
-        error(get_string('modulemisssingcode','error',$module->name),$baseurl);
+        error(get_string('modulemissingcode','error',$module->name),$baseurl);
     }
 
     $viewnames = $viewfun();

course/report/stats/report.php

@@ -1,5 +1,9 @@
 <?php
 
+    if (!defined('MOODLE_INTERNAL')) {
+        die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+    }
+
     $courses = get_courses('all','c.shortname','c.id,c.shortname,c.fullname');
     $courseoptions = array();
 
@@ -139,4 +143,4 @@
         print_table($table);
     }
 
-?>
+?>

course/search.php

@@ -219,7 +219,7 @@
 
         if ($perpage != 99999 && $totalcount > $perpage) {
             echo "<center><p>";
-            echo "<a href=\"search.php?search=$encoededsearch&perpage=99999\">".get_string("showall", "", $totalcount)."</a>";
+            echo "<a href=\"search.php?search=$encodedsearch&perpage=99999\">".get_string("showall", "", $totalcount)."</a>";
             echo "</p></center>";
         }
 

course/user.php

@@ -86,7 +86,10 @@
 
             require_once($CFG->dirroot.'/lib/statslib.php');
 
-            stats_check_uptodate($course->id);
+            $statsstatus = stats_check_uptodate($course->id);
+            if ($statsstatus !== NULL) {
+                notify ($statsstatus);
+            }
 
             $earliestday = get_field_sql('SELECT timeend FROM '.$CFG->prefix.'stats_user_daily ORDER BY timeend LIMIT 1');
             $earliestweek = get_field_sql('SELECT timeend FROM '.$CFG->prefix.'stats_user_weekly ORDER BY timeend LIMIT 1');
@@ -125,7 +128,7 @@
                 error(get_string('nostatstodisplay'), $CFG->wwwroot.'/course/user.php?id='.$course->id.'&user='.$user->id.'&mode=outline');
             }
 
-            echo '<center><img src="'.$CFG->wwwroot.'/course/statsgraph.php?mode='.STATS_MODE_DETAILED.'&course='.$course->id.'&time='.$time.'&report='.STATS_REPORT_USER_VIEW.'&userid='.$user->id.'" /></center>';
+            echo '<center><img src="'.$CFG->wwwroot.'/course/report/stats/graph.php?mode='.STATS_MODE_DETAILED.'&course='.$course->id.'&time='.$time.'&report='.STATS_REPORT_USER_VIEW.'&userid='.$user->id.'" /></center>';
 
             $stats = stats_fix_zeros($stats,$param->timeafter,$param->table,(!empty($param->line2)),(!empty($param->line3)));
             

doc/index.php

@@ -11,7 +11,7 @@
     }
 
     if (!empty($sub)) {
-        $sub = "#$sub";
+        $sub = '#'.s($sub);
     } else {
         $sub = "";
     }

doc/install.html

@@ -114,7 +114,7 @@
      by creating a file in the data directory called .htaccess, containing this line:
   <blockquote>
      
-    <pre>deny from all</pre>
+    <pre>deny from all<br />AllowOverride None</pre>
   </blockquote>
   <p>To make sure that Moodle can save uploaded files in this directory, check that 
      the web server software (eg Apache) has permission to write 

enrol/README.txt

@@ -3,13 +3,86 @@ ENROLMENT MODULES
 
 (Yes, that's the correct English spelling  ;-) )
 
-enrol.class.php contains the base class and explains 
-all the possible functions that an enrolment module 
-can have.
+enrol.class.php contains a simple 'factory' method that
+will instantiate your class when called. For an example
+of a complete class, take a look at the 'manual' class.
 
-Each plugin is in a subfolder here and extends the
-base class as necessary.
+Each plugin is in a subfolder here.
 
+Except for the configuration methods, most methods 
+defined in the API are optional -- callers will use
+method_exists() to determine whether your plugin offers
+the functionality they are after.
+
+
+Mandatory methods
+-----------------
+
+  config_form
+  process_config
+
+
+Login-time methods
+------------------
+
+  get_student_courses
+  get_teacher_courses
+
+You probably will want to offer at least get_student_courses().
+
+These methods are triggered when a user logs in successfully,
+and they are expected to populate $USER->student and 
+$USER->teacher arrays and maintain (add/delete) entries from
+user_students and user_teachers.
+
+These methods are relevant for most plugins, and are the main
+interest for plugins that work with a read-only backend such
+as LDAP or a database. You probably will want to offer at 
+least get_student_courses().
+
+Note that with the multi-enrol infrastructure two things have 
+changed. We now have an 'enrol' field in those tables, and 
+each plugin must maintain only its own enrolment records. 
+Conversely, the $USER->student and ->teacher arrays have the
+enrolment type as value, like
+
+   $USER->student = array ( $courseid => $plugintype );
+
+Interactive enrolment methods
+-----------------------------
+
+  print_entry()
+  check_entry()
+  check_group_entry()
+  get_access_icons()
+
+These methods are for enrolment plugins that allow for user
+driven enrolment. These methods are relevant for plugins 
+that implement payment gateways (credit card, paypal),
+as well as "magic password" schemes. 
+
+Only one interactive enrolment method can be active for
+a given course. The site default can be set from
+Admin->Enrolment, and then individual courses can be
+set to specific interactive enrolment methods.
+
+
+Cron
+----
+
+If your class offers a cron() method, it will be invoked by
+the standard Moodle cron every 5 minutes. Note that if the
+tasks are not lightweight you must control how frequently they
+execute, perhaps offering a config option.
+
+For really heavy cron processing, an alternative is to have
+a separate script to be called separately. Currently the LDAP
+and DB plugins have external scripts. 
+
+
+Guilty Parties
+--------------
 
 Martin Dougiamas and Shane Elliott, Moodle.com
+Martin Langhoff and Patrick Li, Catalyst IT
 

enrol/authorize/authorizenetlib.php

@@ -10,15 +10,16 @@ define('AN_ERROR',    '3');
 define('AN_DELIM',    '|');
 define('AN_ENCAP',    '"');
 
-require_once('const.php');
+require_once($CFG->dirroot.'/enrol/authorize/const.php');
+require_once($CFG->dirroot.'/enrol/authorize/enrol.php');
 
 /**
  * Gets settlement date and time
  *
- * @param int $time Processed time, usually now.
- * @return int Settlement date
+ * @param int $time Time processed, usually now.
+ * @return int Settlement date and time
  */
-function getsettletime($time)
+function authorize_getsettletime($time)
 {
     global $CFG;
 
@@ -38,24 +39,55 @@ function getsettletime($time)
  * @param object $order Order details
  * @return bool true, if settled, false otherwise.
  */
-function settled($order)
+function authorize_settled($order)
 {
     return (($order->status == AN_STATUS_AUTHCAPTURE || $order->status == AN_STATUS_CREDIT) &&
             ($order->settletime > 0) && ($order->settletime < time()));
 }
 
 /**
- * Performs an action on authorize.net
+ * Is order expired? 'Authorized/Pending Capture' transactions are expired after 30 days.
+ *
+ * @param object &$order Order details.
+ * @return bool true, transaction is expired, false otherwise.
+ */
+function authorize_expired(&$order)
+{
+    static $timediff30;
+
+    if ($order->status == AN_STATUS_EXPIRE) {
+        return true;
+    }
+    elseif ($order->status != AN_STATUS_AUTH) {
+        return false;
+    }
+
+    if (empty($timediff30)) {
+        $timediff30 = authorize_getsettletime(time()) - (30 * 24 * 3600);
+    }
+
+    $isexpired = (authorize_getsettletime($order->timecreated) < $timediff30);
+    if ($isexpired) {
+        $order->status = AN_STATUS_EXPIRE;
+        update_record('enrol_authorize', $order);
+    }
+    return $isexpired;
+}
+
+/**
+ * Performs an action on authorize.net and updates/inserts records. If record update fails,
+ * sends email to admin.
  *
  * @param object &$order Which transaction data will be sent. See enrol_authorize table.
- * @param string &$message Information about error messages.
- * @param object &$extra Extra transaction data.
+ * @param string &$message Information about error message if this function returns false.
+ * @param object &$extra Extra data that used for refunding and credit card information.
  * @param int $action Which action will be performed. See AN_ACTION_*
- * @return bool true, transaction was successful, false otherwise.
+ * @param string $cctype Used internally to configure credit types automatically.
+ * @return bool true Transaction was successful, false otherwise. Use $message for reason.
  * @author Ethem Evlice <ethem a.t evlice d.o.t com>
  * @uses $CFG
  */
-function authorizenet_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE)
+function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE, $cctype=NULL)
 {
     global $CFG;
     static $conststring;
@@ -63,40 +95,36 @@ function authorizenet_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE
     $test = !empty($CFG->an_test);
 
     if (!isset($conststring)) {
-        $consdata = array(
+        $mconfig = get_config('enrol/authorize');
+        $constdata = array(
              'x_version'         => '3.1',
              'x_delim_data'      => 'True',
              'x_delim_char'      => AN_DELIM,
              'x_encap_char'      => AN_ENCAP,
              'x_relay_response'  => 'FALSE',
              'x_method'          => 'CC',
-             'x_login'           => $CFG->an_login,
+             'x_login'           => rc4decrypt($mconfig->an_login),
              'x_test_request'    => $test ? 'TRUE' : 'FALSE'
         );
         $str = '';
-        foreach($consdata as $ky => $vl) {
+        foreach($constdata as $ky => $vl) {
             $str .= $ky . '=' . urlencode($vl) . '&';
         }
-        $str .= (!empty($CFG->an_tran_key)) ?
-                'x_tran_key=' . urlencode($CFG->an_tran_key):
-                'x_password=' . urlencode($CFG->an_password);
+        $str .= (!empty($mconfig->an_tran_key)) ?
+                'x_tran_key=' . urlencode(rc4decrypt($mconfig->an_tran_key)):
+                'x_password=' . urlencode(rc4decrypt($mconfig->an_password));
 
         $conststring = $str;
     }
 
     $action = intval($action);
 
-    if (empty($order) || empty($order->id)) {
+    if (empty($order) or empty($order->id)) {
         $message = "Check order->id!";
         return false;
     }
-    elseif ($action <= AN_ACTION_NONE || $action > AN_ACTION_VOID) {
-        $message = "No action taken!";
-        return false;
-    }
 
     $poststring = $conststring;
-    $timenowsettle = getsettletime(time());
 
     switch ($action) {
         case AN_ACTION_AUTH_ONLY:
@@ -125,10 +153,7 @@ function authorizenet_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE
                 $message = "Order status must be authorized!";
                 return false;
             }
-            $timediff = $timenowsettle - (30 * 3600 * 24);
-            $timecreatedsettle = getsettletime($order->timecreated);
-            if ($timecreatedsettle < $timediff) {
-                $order->status = AN_STATUS_EXPIRE;
+            if (authorize_expired($order)) {
                 $message = "Transaction must be captured within 30 days. EXPIRED!";
                 return false;
             }
@@ -142,21 +167,21 @@ function authorizenet_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE
                 $message = "Order status must be authorized/captured!";
                 return false;
             }
-            if (!settled($order)) {
+            if (!authorize_settled($order)) {
                 $message = "Order must be settled. Try VOID, check Cut-Off time if it fails!";
                 return false;
             }
+            $timenowsettle = authorize_getsettletime(time());
             $timediff = $timenowsettle - (120 * 3600 * 24);
             if ($order->settletime < $timediff) {
                 $message = "Order must be credited within 120 days!";
                 return false;
             }
             if (empty($extra)) {
-                $message = "need extra fields for CREDIT!";
+                $message = "Need extra fields to REFUND!";
                 return false;
             }
             $total = floatval($extra->sum) + floatval($extra->amount);
-            unset($extra->sum); // this is not used in refunds table.
             if (($extra->amount == 0) || ($total > $order->amount)) {
                 $message = "Can be credited up to original amount.";
                 return false;
@@ -170,23 +195,8 @@ function authorizenet_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE
 
         case AN_ACTION_VOID:
         {
-            if ($order->status == AN_STATUS_AUTH) {
-                $timediff = $timenowsettle - (30 * 3600 * 24);
-                $timecreatedsettle = getsettletime($order->timecreated);
-                if ($timecreatedsettle < $timediff) {
-                    $message = "Authorized transaction must be voided within 30 days. EXPIRED!";
-                    $order->status = AN_STATUS_EXPIRE;
-                    return false;
-                }
-            }
-            elseif ($order->status == AN_STATUS_AUTHCAPTURE || $order->status == AN_STATUS_CREDIT) {
-                if (settled($order)) {
-                    $message = "Settled transaction cannot be voided. Check Cut-Off time!";
-                    return false;
-                }
-            }
-            else {
-                $message = "Order status must be authorized, auth/captured or refunded!";
+            if (authorize_expired($order) || authorize_settled($order)) {
+                $message = "The transaction cannot be voided due to the fact that it is expired or settled.";
                 return false;
             }
             $poststring .= '&x_type=VOID&x_trans_id=' . urlencode($order->transid);
@@ -194,7 +204,7 @@ function authorizenet_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE
         }
 
         default: {
-            $message = "Missing action? $action";
+            $message = "Invalid action: $action";
             return false;
         }
     }
@@ -204,6 +214,7 @@ function authorizenet_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE
         $referer = "Referer: $CFG->an_referer\r\n";
     }
 
+    $errno = 0; $errstr = '';
     $host = $test ? 'certification.authorize.net' : 'secure.authorize.net';
     $fp = fsockopen("ssl://$host", 443, $errno, $errstr, 60);
     if (!$fp) {
@@ -211,6 +222,12 @@ function authorizenet_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE
         return false;
     }
 
+    // critical section
+    @ignore_user_abort(true);
+    if (intval(ini_get('max_execution_time')) > 0) {
+        @set_time_limit(300);
+    }
+
     fwrite($fp, "POST /gateway/transact.dll HTTP/1.0\r\n" .
                 "Host: $host\r\n" . $referer .
                 "Content-type: application/x-www-form-urlencoded\r\n" .
@@ -259,10 +276,14 @@ function authorizenet_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE
                 $order->transid = $transid;
                 if ($action == AN_ACTION_AUTH_ONLY) {
                     $order->status = AN_STATUS_AUTH;
-                    // dont't update settletime
+                    // don't update order->settletime
                 } else {
                     $order->status = AN_STATUS_AUTHCAPTURE;
-                    $order->settletime = getsettletime(time());
+                    $order->settletime = authorize_getsettletime(time());
+                }
+                if (! update_record('enrol_authorize', $order)) {
+                    enrolment_plugin_authorize::email_to_admin("Error while trying to update data " .
+                    "in table enrol_authorize. Please edit manually this record: ID=$order->id.", $order);
                 }
                 break;
             }
@@ -272,31 +293,48 @@ function authorizenet_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE
                 // So, $extra must be updated, not $order.
                 $extra->status = AN_STATUS_CREDIT;
                 $extra->transid = $transid;
-                $extra->settletime = getsettletime(time());
+                $extra->settletime = authorize_getsettletime(time());
+                unset($extra->sum); // this is not used in refunds table.
+                if (! $extra->id = insert_record('enrol_authorize_refunds', $extra)) {
+                    enrolment_plugin_authorize::email_to_admin("Error while trying to insert data " .
+                    "into table enrol_authorize_refunds. Please add manually this record:", $extra);
+                }
                 break;
             }
             case AN_ACTION_VOID:
             {
+                $tableupdate = ($order->status == AN_STATUS_CREDIT) ? 'enrol_authorize_refunds' : 'enrol_authorize';
                 $order->status = AN_STATUS_VOID;
-                // dont't update settletime
+                // don't update order->settletime
+                if (! update_record($tableupdate, $order)) {
+                    enrolment_plugin_authorize::email_to_admin("Error while trying to update data " .
+                    "in table $tableupdate. Please edit manually this record: ID=$order->id.", $order);
+                }
                 break;
             }
-            default: return false;
         }
         return true;
     }
     else
     {
-        $reason = "reason" . $response[2];
-        $message = get_string($reason, "enrol_authorize");
-        if ($message == '[[' . $reason . ']]') {
+        $reasonno = $response[2];
+        $reasonstr = "reason" . $reasonno;
+        $message = get_string($reasonstr, "enrol_authorize");
+        if ($message == '[[' . $reasonstr . ']]') {
             $message = isset($response[3]) ? $response[3] : 'unknown error';
         }
-        if (!empty($CFG->an_avs)) {
+        if (! (empty($CFG->an_avs) or $response[5] == "P")) { // P = AVS not applicable
             $avs = "avs" . strtolower($response[5]);
             $stravs = get_string($avs, "enrol_authorize");
             $message .= "<br />" . get_string("avsresult", "enrol_authorize", $stravs);
         }
+        if (!$test && !empty($cctype) && ($reasonno == 17 or $reasonno == 28)) {
+            $ccaccepts = enrolment_plugin_authorize::get_list_of_creditcards();
+            unset($ccaccepts[$cctype]);
+            set_config('an_acceptccs', implode(',', array_keys($ccaccepts)));
+            enrolment_plugin_authorize::email_to_admin("$message: ($cctype)" .
+            "This is new config(an_acceptccs):", $ccaccepts);
+        }
         return false;
     }
 }

enrol/authorize/config.html

@@ -9,6 +9,7 @@ if (!isset($frm->enrol_mailadmins)) $frm->enrol_mailadmins = '';
 if (!isset($frm->an_login)) $frm->an_login = '';
 if (!isset($frm->an_tran_key)) $frm->an_tran_key = '';
 if (!isset($frm->an_password)) $frm->an_password = '';
+if (!isset($frm->delete_current)) $frm->delete_current = '';
 if (!isset($frm->an_referer)) $frm->an_referer = 'http://';
 if (!isset($frm->an_avs)) $frm->an_avs = '';
 if (!isset($frm->an_test)) $frm->an_test = '';
@@ -31,7 +32,7 @@ if (!isset($frm->an_cutoff_hour)) {
 }
 
 if (!isset($frm->acceptccs)) {
-    $frm->acceptccs = array_keys(get_list_of_creditcards());
+    $frm->acceptccs = array_keys(enrolment_plugin_authorize::get_list_of_creditcards());
     $CFG->an_acceptccs = implode(',', $frm->acceptccs);
 }
 
@@ -48,7 +49,7 @@ if (!isset($frm->acceptccs)) {
 <tr valign="top">
     <td align="right">enrol_cost:</td>
     <td><input type="text" size="5" name="enrol_cost" value="<?php p($frm->enrol_cost) ?>" /></td>
-    <td><?php print_string("costdefault") ?></td>
+    <td><?php print_string("costdefault") ?>. <?php print_string("costdefaultdesc", "enrol_authorize") ?></td>
 </tr>
 
 <tr valign="top">
@@ -78,32 +79,35 @@ if (!isset($frm->acceptccs)) {
 <tr valign="top"><td colspan="3"><h4><?php print_string("adminauthorizesettings", "enrol_authorize") ?></h4></td></tr>
 
 <tr valign="top">
-    <td align="right">an_login:</td>
-    <td><input type="text" name="an_login" value="<?php p($frm->an_login) ?>" /></td>
-    <td><?php print_string("anlogin", "enrol_authorize") ?></td>
+    <td align="right">&nbsp;&nbsp;</td>
+    <td><?php print_string("logininfo", "enrol_authorize") ?></td>
 </tr>
 
 <tr valign="top">
-    <td align="right">#&nbsp;</td>
-    <td colspan="2"><?php print_string("chooseone", "enrol_authorize") ?></td>
+    <td align="right">an_login:<br /><?php echo (isset($mconfig->an_login)) ? '<font color=green>'.get_string('ok').'</font>' : ''; ?></td>
+    <td><?php print_string("anlogin", "enrol_authorize") ?><br /><input type="text" name="an_login" size="26" value="" /><sup>*</sup></td>
 </tr>
 
 <tr valign="top">
-    <td align="right">an_tran_key:</td>
-    <td><input type="text" name="an_tran_key" value="<?php p($frm->an_tran_key) ?>" /></td>
-    <td><?php print_string("antrankey", "enrol_authorize") ?></td>
+    <td align="right">an_tran_key:<br /><?php echo (isset($mconfig->an_tran_key)) ? '<font color=green>'.get_string('ok').'</font>' : ''; ?></td>
+    <td><?php print_string("antrankey", "enrol_authorize") ?><br /><input type="text" name="an_tran_key" size="26" value="" /><sup>#1</sup></td>
 </tr>
 
 <tr valign="top">
-    <td align="right">an_password:</td>
-    <td><input type="text" name="an_password" value="<?php p($frm->an_password) ?>" /></td>
-    <td><?php print_string("anpassword", "enrol_authorize") ?></td>
+    <td align="right">an_password:<br /><?php echo (isset($mconfig->an_password)) ? '<font color=green>'.get_string('ok').'</font>' : ''; ?></td>
+    <td><?php print_string("anpassword", "enrol_authorize") ?><br /><input type="text" name="an_password" size="26" value="" /><sup>#2</sup></td>
+</tr>
+
+<tr valign="top">
+    <td align="right">delete_current:</td>
+    <td><?php print_checkbox('delete_current', '1', !empty($frm->delete_current)) ?> <br />
+        <?php print_string("deletecheck", "moodle", get_string('oldpassword')) ?><br /><hr size="1" width="100%" noshade /></td>
 </tr>
 
 <tr valign="top">
     <td align="right">an_referer:</td>
-    <td><input type="text" name="an_referer" value="<?php p($frm->an_referer) ?>" /></td>
-    <td><?php print_string("anreferer", "enrol_authorize") ?></td>
+    <td><input type="text" name="an_referer" size="35" value="<?php p($frm->an_referer) ?>" /><br />
+        <?php print_string("anreferer", "enrol_authorize") ?></td>
 </tr>
 
 <tr valign="top">
@@ -127,7 +131,7 @@ if (!isset($frm->acceptccs)) {
 <tr valign="top">
     <td align="right">an_acceptccs:</td>
     <td><?php
-    $allccs = get_list_of_creditcards(true);
+    $allccs = enrolment_plugin_authorize::get_list_of_creditcards(true);
     foreach ($allccs as $key => $val) {
         print_checkbox('acceptccs[]', $key, stristr($CFG->an_acceptccs, $key) !== false, $val); echo "<br />\n";
     }

enrol/authorize/const.php

@@ -23,7 +23,7 @@ define('AN_STATUS_TEST',        0x80);
 /**#@-*/
 
 /**#@+
- * Actions used in authorizenet_action function.
+ * Actions used in authorize_action function.
  *
  * NONE: No action. Function always returns false.
  * AUTH_ONLY: Used to authorize only, don't capture.

enrol/authorize/db/mysql.php

@@ -69,7 +69,7 @@ function enrol_authorize_upgrade($oldversion=0) {
             include_once("$CFG->dirroot/enrol/authorize/authorizenetlib.php");
             foreach ($settlements as $settlement) {
                 execute_sql("UPDATE {$CFG->prefix}enrol_authorize SET settletime = '" .
-                getsettletime($settlement->settletime) . "' WHERE id = '$settlement->id'", false);
+                authorize_getsettletime($settlement->settletime) . "' WHERE id = '$settlement->id'", false);
             }
         }
     }
@@ -108,6 +108,27 @@ function enrol_authorize_upgrade($oldversion=0) {
         delete_records('config_plugins', 'name', 'an_nextmail');
     }
 
+    if ($oldversion < 2006021531) { // Don't show authorize.net login info at config page
+        if (isset($CFG->an_login)) {
+            if (!empty($CFG->an_login)) {
+                set_config('an_login', rc4encrypt($CFG->an_login), 'enrol/authorize');
+            }
+            delete_records('config', 'name', 'an_login');
+        }
+        if (isset($CFG->an_tran_key)) {
+            if (!empty($CFG->an_tran_key)) {
+                set_config('an_tran_key', rc4encrypt($CFG->an_tran_key), 'enrol/authorize');
+            }
+            delete_records('config', 'name', 'an_tran_key');
+        }
+        if (isset($CFG->an_password)) {
+            if (!empty($CFG->an_password)) {
+                set_config('an_password', rc4encrypt($CFG->an_password), 'enrol/authorize');
+            }
+            delete_records('config', 'name', 'an_password');
+        }
+    }
+
     return $result;
 }
 

enrol/authorize/db/postgres7.php

@@ -20,7 +20,7 @@ function enrol_authorize_upgrade($oldversion=0) {
     // Authorize module was installed before. Upgrades must be applied to SQL file.
 
     if ($oldversion && $oldversion < 2005071602) {
-        notify("If you are using the authorize.net enrolment plugin for credit card 
+        notify("If you are using the authorize.net enrolment plugin for credit card
                 handling, please ensure that you have turned loginhttps ON in Admin >> Variables >> Security.");
     }
 
@@ -80,7 +80,7 @@ function enrol_authorize_upgrade($oldversion=0) {
             include_once("$CFG->dirroot/enrol/authorize/authorizenetlib.php");
             foreach ($settlements as $settlement) {
                 execute_sql("UPDATE {$CFG->prefix}enrol_authorize SET settletime = '" .
-                getsettletime($settlement->settletime) . "' WHERE id = '$settlement->id'", false);
+                authorize_getsettletime($settlement->settletime) . "' WHERE id = '$settlement->id'", false);
             }
         }
     }
@@ -119,6 +119,27 @@ function enrol_authorize_upgrade($oldversion=0) {
         delete_records('config_plugins', 'name', 'an_nextmail');
     }
 
+    if ($oldversion < 2006021531) { // Don't show authorize.net login info at config page
+        if (isset($CFG->an_login)) {
+            if (!empty($CFG->an_login)) {
+                set_config('an_login', rc4encrypt($CFG->an_login), 'enrol/authorize');
+            }
+            delete_records('config', 'name', 'an_login');
+        }
+        if (isset($CFG->an_tran_key)) {
+            if (!empty($CFG->an_tran_key)) {
+                set_config('an_tran_key', rc4encrypt($CFG->an_tran_key), 'enrol/authorize');
+            }
+            delete_records('config', 'name', 'an_tran_key');
+        }
+        if (isset($CFG->an_password)) {
+            if (!empty($CFG->an_password)) {
+                set_config('an_password', rc4encrypt($CFG->an_password), 'enrol/authorize');
+            }
+            delete_records('config', 'name', 'an_password');
+        }
+    }
+
     return $result;
 }
 

enrol/authorize/enrol.html

@@ -1,7 +1,8 @@
 <?php // $Id$
 
+enrolment_plugin_authorize::prevent_double_paid($course);
 $formvars = array('password', 'ccaddress', 'cccity', 'ccstate', 'cccountry', 'cczip',
-                  'ccfirstname', 'cclastname', 'cc', 'ccexpiremm', 'ccexpireyyyy', 'cctype', 'cvv');
+                  'firstname', 'lastname', 'cc', 'ccexpiremm', 'ccexpireyyyy', 'cctype', 'cvv');
 
 foreach ($formvars as $var) {
     if (!isset($form->$var)) {
@@ -9,9 +10,9 @@ foreach ($formvars as $var) {
     }
 }
 
-$curcost = $this->get_course_cost($course);
-$userfirstname = empty($form->ccfirstname) ? $USER->firstname : $form->ccfirstname;
-$userlastname = empty($form->cclastname) ? $USER->lastname : $form->cclastname;
+$curcost = enrolment_plugin_authorize::get_course_cost($course);
+$userfirstname = empty($form->firstname) ? $USER->firstname : $form->firstname;
+$userlastname = empty($form->lastname) ? $USER->lastname : $form->lastname;
 $useraddress = empty($form->ccaddress) ? $USER->address : $form->ccaddress;
 $usercity = empty($form->cccity) ? $USER->city : $form->cccity;
 $usercountry = empty($form->cccountry) ? $USER->country : $form->cccountry;
@@ -36,8 +37,8 @@ $usercountry = empty($form->cccountry) ? $USER->country : $form->cccountry;
 </tr>
 <tr>
   <td align="right"><?php print_string("nameoncard", "enrol_authorize") ?>: </td>
-  <td align="left"><input type="text" name="ccfirstname" size="8" value="<?php p($userfirstname) ?>" />
-  <input type="text" name="cclastname" size="8" value="<?php p($userlastname) ?>" />
+  <td align="left"><input type="text" name="firstname" size="8" value="<?php p($userfirstname) ?>" />
+  <input type="text" name="lastname" size="8" value="<?php p($userlastname) ?>" />
   <?php if (!empty($this->ccerrors['ccfirstlast'])) { formerr($this->ccerrors['ccfirstlast']); } ?></td>
 </tr>
 <tr>
@@ -59,7 +60,7 @@ $usercountry = empty($form->cccountry) ? $USER->country : $form->cccountry;
 <tr>
   <td align="right"><?php print_string("cctype", "enrol_authorize") ?>: </td>
   <td align="left"><?php
-  choose_from_menu(get_list_of_creditcards(), 'cctype', $form->cctype);
+  choose_from_menu(enrolment_plugin_authorize::get_list_of_creditcards(), 'cctype', $form->cctype);
   if (!empty($this->ccerrors['cctype'])) { formerr($this->ccerrors['cctype']); }
   ?>
 </td>

enrol/authorize/enrol.php

@@ -1,44 +1,8 @@
-<?php  // $Id$
+<?php // $Id$
 
 require_once($CFG->dirroot.'/enrol/enrol.class.php');
 require_once($CFG->dirroot.'/enrol/authorize/const.php');
 
-/**
- * get_list_of_creditcards
- *
- * @param bool $getall
- * @return array
- */
-function get_list_of_creditcards($getall = false)
-{
-    global $CFG;
-
-    $alltypes = array(
-        'mcd' => 'Master Card',
-        'vis' => 'Visa',
-        'amx' => 'American Express',
-        'dsc' => 'Discover',
-        'dnc' => 'Diners Club',
-        'jcb' => 'JCB',
-        'swi' => 'Switch',
-        'dlt' => 'Delta',
-        'enr' => 'EnRoute'
-    );
-
-    if ($getall || empty($CFG->an_acceptccs)) {
-        return $alltypes;
-    }
-
-    $ret = array();
-    $ccs = explode(',', $CFG->an_acceptccs);
-
-    foreach ($ccs as $key) {
-        $ret[$key] = $alltypes[$key];
-    }
-
-    return $ret;
-}
-
 /**
  * enrolment_plugin_authorize
  *
@@ -62,25 +26,55 @@ class enrolment_plugin_authorize
     var $log;
 
 
+    /**
+     * Returns information about the courses a student has access to
+     *
+     * Set the $user->student course array
+     * Set the $user->timeaccess course array
+     *
+     * @param object &$user must contain $user->id already set
+     */
+    function get_student_courses(&$user) {
+        $manual = enrolment_factory::factory('manual');
+        $manual->get_student_courses($user);
+    }
+
+
+    /**
+     * Returns information about the courses a teacher has access to
+     *
+     * Set the $user->teacher course array
+     * Set the $user->teacheredit course array
+     * Set the $user->timeaccess course array
+     *
+     * @param object &$user must contain $user->id already set
+     */
+    function get_teacher_courses(&$user) {
+        $manual = enrolment_factory::factory('manual');
+        $manual->get_teacher_courses($user);
+    }
+
+
     /**
      * Shows a credit card form for registration.
      *
      * @param object $course Course info
      * @access public
      */
-    function print_entry($course)
-    {
+    function print_entry($course) {
         global $CFG, $USER, $form;
 
-        if ($this->zero_cost($course) or isguest()) {
+        $zerocost = enrolment_plugin_authorize::zero_cost($course);
+        if ($zerocost) {
             $manual = enrolment_factory::factory('manual');
+            if (!empty($this->errormsg)) {
+                $manual->errormsg = $this->errormsg;
+            }
             $manual->print_entry($course);
-            return; // No money for guests ;)
+            return;
         }
 
-        $this->prevent_double_paid($course);
-
-        if (empty($_SERVER['HTTPS']) || $_SERVER['HTTPS'] == 'off') {
+        if (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] != 443) { // MDL-9836
             if (empty($CFG->loginhttps)) {
                 error(get_string('httpsrequired', 'enrol_authorize'));
             } else {
@@ -90,7 +84,8 @@ class enrolment_plugin_authorize
             }
         }
 
-        $teacher = get_teacher($course->id);
+        httpsrequired();
+
         $strcourses = get_string('courses');
         $strloginto = get_string('loginto', '', $course->shortname);
 
@@ -98,15 +93,28 @@ class enrolment_plugin_authorize
         print_course($course, '80%');
 
         if ($course->password) {
-            print_simple_box(get_string('choosemethod', 'enrol_authorize'), 'center');
-            $password = '';
-            include($CFG->dirroot.'/enrol/manual/enrol.html');
+            print_heading(get_string('choosemethod', 'enrol_authorize'), 'center');
         }
 
         print_simple_box_start('center');
-        include($CFG->dirroot.'/enrol/authorize/enrol.html');
+        if (isguest()) {
+            $curcost = enrolment_plugin_authorize::get_course_cost($course);
+            echo '<div align="center">';
+            echo '<p>'.get_string('paymentrequired').'</p>';
+            echo '<p><b>'.get_string('cost').": $curcost[currency] $curcost[cost]".'</b></p>';
+            echo '<p><a href="'.$CFG->httpswwwroot.'/login/">'.get_string('loginsite').'</a></p>';
+            echo '</div>';
+        } else {
+            include($CFG->dirroot.'/enrol/authorize/enrol.html');
+        }
         print_simple_box_end();
 
+        if ($course->password) {
+            $password = '';
+            $teacher = get_teacher($course->id);
+            include($CFG->dirroot.'/enrol/manual/enrol.html');
+        }
+
         print_footer();
     }
 
@@ -119,9 +127,13 @@ class enrolment_plugin_authorize
      * @access public
      */
     function check_entry($form, $course) {
-        if ((!empty($form->password)) or isguest() or $this->zero_cost($course)) {
+        if (enrolment_plugin_authorize::zero_cost($course) or
+           (!empty($course->password) and !empty($form->password))) {
             $manual = enrolment_factory::factory('manual');
             $manual->check_entry($form, $course);
+            if (!empty($manual->errormsg)) {
+                $this->errormsg = $manual->errormsg;
+            }
         } elseif ((!empty($form->ccsubmit)) and $this->validate_enrol_form($form)) {
             $this->cc_submit($form, $course);
         }
@@ -141,17 +153,17 @@ class enrolment_plugin_authorize
         global $CFG, $USER, $SESSION;
         require_once('authorizenetlib.php');
 
-        $this->prevent_double_paid($course);
+        enrolment_plugin_authorize::prevent_double_paid($course);
 
         $useripno = getremoteaddr();
-        $curcost = $this->get_course_cost($course);
+        $curcost = enrolment_plugin_authorize::get_course_cost($course);
         $exp_date = sprintf("%02d", $form->ccexpiremm) . $form->ccexpireyyyy;
 
         // NEW ORDER
         $timenow = time();
         $order = new stdClass();
         $order->cclastfour = substr($form->cc, -4);
-        $order->ccname = $form->ccfirstname . " " . $form->cclastname;
+        $order->ccname = $form->firstname . " " . $form->lastname;
         $order->courseid = $course->id;
         $order->userid = $USER->id;
         $order->status = AN_STATUS_NONE; // it will be changed...
@@ -162,7 +174,7 @@ class enrolment_plugin_authorize
         $order->currency = $curcost['currency'];
         $order->id = insert_record("enrol_authorize", $order);
         if (!$order->id) {
-            $this->email_to_admin("Error while trying to insert new data", $order);
+            enrolment_plugin_authorize::email_to_admin("Error while trying to insert new data", $order);
             $this->ccerrors['header'] = "Insert record error. Admin has been notified!";
             return;
         }
@@ -173,8 +185,8 @@ class enrolment_plugin_authorize
         $extra->x_exp_date = $exp_date;
         $extra->x_currency_code = $curcost['currency'];
         $extra->x_amount = $curcost['cost'];
-        $extra->x_first_name = $form->ccfirstname;
-        $extra->x_last_name = $form->cclastname;
+        $extra->x_first_name = $form->firstname;
+        $extra->x_last_name = $form->lastname;
         $extra->x_country = $form->cccountry;
         $extra->x_address = $form->ccaddress;
         $extra->x_state = $form->ccstate;
@@ -194,9 +206,9 @@ class enrolment_plugin_authorize
         $message = '';
         $an_review = !empty($CFG->an_review);
         $action = $an_review ? AN_ACTION_AUTH_ONLY : AN_ACTION_AUTH_CAPTURE;
-        $success = authorizenet_action($order, $message, $extra, $action);
+        $success = authorize_action($order, $message, $extra, $action, $form->cctype);
         if (!$success) {
-            $this->email_to_admin($message, $order);
+            enrolment_plugin_authorize::email_to_admin($message, $order);
             $this->ccerrors['header'] = $message;
             return;
         }
@@ -209,49 +221,37 @@ class enrolment_plugin_authorize
             else {
                 $timestart = $timenow;
                 $timeend = $timestart + (3600 * 24); // just enrol for 1 days :)
-                enrol_student($USER->id, $course->id, $timestart, $timeend, 'authorize');
+                enrol_student($USER->id, $course->id, $timestart, $timeend, 'manual');
                 redirect("$CFG->wwwroot/course/view.php?id=$course->id");
             }
             return;
         }
 
-        if ($an_review) { // review enabled, inform admin and redirect to main page.
-            if (update_record("enrol_authorize", $order)) {
-                $a = new stdClass;
-                $a->url = "$CFG->wwwroot/enrol/authorize/index.php?order=$order->id";
-                $a->orderid = $order->id;
-                $a->transid = $order->transid;
-                $a->amount = "$order->currency $order->amount";
-                $a->expireon = userdate(getsettletime($timenow + (30 * 3600 * 24)));
-                $a->captureon = userdate(getsettletime($timenow + (intval($CFG->an_capture_day) * 3600 * 24)));
-                $a->course = $course->fullname;
-                $a->user = fullname($USER);
-                $a->acstatus = ($CFG->an_capture_day > 0) ? get_string('yes') : get_string('no');
-                $emailmessage = get_string('adminneworder', 'enrol_authorize', $a);
-                $a = new stdClass;
-                $a->course = $course->shortname;
-                $a->orderid = $order->id;
-                $emailsubject = get_string('adminnewordersubject', 'enrol_authorize', $a);
-                $admins = get_admins();
-                foreach ($admins as $admin) {
-                    email_to_user($admin, $USER, $emailsubject, $emailmessage);
-                }
-            }
-            else {
-                $this->email_to_admin("Error while trying to update data. Please edit manually this record: " .
-                                      "ID=$order->id in enrol_authorize table.", $order);
+        if ($an_review) { // review enabled, inform admin and redirect user to main page.
+            $a = new stdClass;
+            $a->url = "$CFG->wwwroot/enrol/authorize/index.php?order=$order->id";
+            $a->orderid = $order->id;
+            $a->transid = $order->transid;
+            $a->amount = "$order->currency $order->amount";
+            $a->expireon = userdate(authorize_getsettletime($timenow + (30 * 3600 * 24)));
+            $a->captureon = userdate(authorize_getsettletime($timenow + (intval($CFG->an_capture_day) * 3600 * 24)));
+            $a->course = $course->fullname;
+            $a->user = fullname($USER);
+            $a->acstatus = ($CFG->an_capture_day > 0) ? get_string('yes') : get_string('no');
+            $emailmessage = get_string('adminneworder', 'enrol_authorize', $a);
+            $a = new stdClass;
+            $a->course = $course->shortname;
+            $a->orderid = $order->id;
+            $emailsubject = get_string('adminnewordersubject', 'enrol_authorize', $a);
+            $admins = get_admins();
+            foreach ($admins as $admin) {
+                email_to_user($admin, $USER, $emailsubject, $emailmessage);
             }
             redirect($CFG->wwwroot, get_string("reviewnotify", "enrol_authorize"), '30');
             return;
         }
 
-        // credit card captured, ENROL student...
-        if (!update_record("enrol_authorize", $order)) {
-            $this->email_to_admin("Error while trying to update data. Please edit manually this record: " .
-                                   "ID=$order->id in enrol_authorize table.", $order);
-                                   // no error occured??? enrol student??? return??? Database busy???
-        }
-
+        // Credit card captured, ENROL student now...
         if ($course->enrolperiod) {
             $timestart = $timenow;
             $timeend = $timestart + $course->enrolperiod;
@@ -259,7 +259,7 @@ class enrolment_plugin_authorize
             $timestart = $timeend = 0;
         }
 
-        if (enrol_student($USER->id, $course->id, $timestart, $timeend, 'authorize')) {
+        if (enrol_student($USER->id, $course->id, $timestart, $timeend, 'manual')) {
             $teacher = get_teacher($course->id);
             if (!empty($CFG->enrol_mailstudents)) {
                 $a = new stdClass;
@@ -292,7 +292,8 @@ class enrolment_plugin_authorize
                 }
             }
         } else {
-            $this->email_to_admin("Error while trying to enrol ".fullname($USER)." in '$course->fullname'", $order);
+            enrolment_plugin_authorize::email_to_admin("Error while trying to enrol " .
+            fullname($USER) . " in '$course->fullname'", $order);
         }
 
         if ($SESSION->wantsurl) {
@@ -333,7 +334,7 @@ class enrolment_plugin_authorize
             }
         }
 
-        if (empty($form->ccfirstname) || empty($form->cclastname)) {
+        if (empty($form->firstname) || empty($form->lastname)) {
             $this->ccerrors['ccfirstlast'] = get_string('missingfullname');
         }
 
@@ -341,7 +342,8 @@ class enrolment_plugin_authorize
             $this->ccerrors['cvv'] = get_string('missingcvv', 'enrol_authorize');
         }
 
-        if (empty($form->cctype) || !in_array($form->cctype, array_keys(get_list_of_creditcards()))) {
+        if (empty($form->cctype) or
+            !in_array($form->cctype, array_keys(enrolment_plugin_authorize::get_list_of_creditcards()))) {
             $this->ccerrors['cctype'] = get_string('missingcctype', 'enrol_authorize');
         }
 
@@ -368,45 +370,6 @@ class enrolment_plugin_authorize
         return true;
     }
 
-    /**
-     * zero_cost
-     *
-     * @param unknown_type $course
-     * @return number
-     * @access private
-     */
-    function zero_cost($course) {
-        $curcost = $this->get_course_cost($course);
-        return (abs($curcost['cost']) < 0.01);
-    }
-
-
-    /**
-     * get_course_cost
-     *
-     * @param object $course
-     * @return array
-     * @access private
-     */
-    function get_course_cost($course)
-    {
-        global $CFG;
-
-        $cost = (float)0;
-        $currency = (!empty($course->currency))
-                     ? $course->currency :( empty($CFG->enrol_currency)
-                                            ? 'USD' : $CFG->enrol_currency );
-
-        if (!empty($course->cost)) {
-            $cost = (float)(((float)$course->cost) < 0) ? $CFG->enrol_cost : $course->cost;
-        }
-
-        $cost = format_float($cost, 2);
-        $ret = array('cost' => $cost, 'currency' => $currency);
-
-        return $ret;
-    }
-
 
     /**
      * Gets access icons.
@@ -419,7 +382,7 @@ class enrolment_plugin_authorize
 
         $manual = enrolment_factory::factory('manual');
         $str = $manual->get_access_icons($course);
-        $curcost = $this->get_course_cost($course);
+        $curcost = enrolment_plugin_authorize::get_course_cost($course);
 
         if (abs($curcost['cost']) > 0.00) {
             $strrequirespayment = get_string("requirespayment");
@@ -451,21 +414,31 @@ class enrolment_plugin_authorize
     function config_form($frm)
     {
         global $CFG;
+        $mconfig = get_config('enrol/authorize');
 
-        if (!$this->check_openssl_loaded()) {
+        if (! enrolment_plugin_authorize::check_openssl_loaded()) {
             notify('PHP must be compiled with SSL support (--with-openssl)');
         }
 
         if (empty($CFG->loginhttps) and substr($CFG->wwwroot, 0, 5) !== 'https') {
-            notify('loginhttps must be ON');
+            $a = new stdClass;
+            $a->url = "$CFG->wwwroot/$CFG->admin/config.php#configsectionsecurity";
+            notice(get_string('adminconfighttps', 'enrol_authorize', $a));
+        }
+        elseif (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] != 443) { // MDL-9836
+            $wwwsroot = qualified_me();
+            $wwwsroot = str_replace('http:', 'https:', $wwwsroot);
+            $a = new stdClass;
+            $a->url = $wwwsroot;
+            notice(get_string('adminconfighttpsgo', 'enrol_authorize', $a));
         }
 
         if (!empty($frm->an_review)) {
             $captureday = intval($frm->an_capture_day);
             $emailexpired = intval($frm->an_emailexpired);
             if ($captureday > 0 || $emailexpired > 0) {
-                $mconfig = get_config('enrol/authorize');
-                if ((time() - intval($mconfig->an_lastcron) > 3600 * 24)) {
+                $lastcron = get_field_sql('SELECT max(lastcron) FROM ' . $CFG->prefix . 'modules');
+                if ((time() - intval($lastcron) > 3600 * 24)) {
                     notify(get_string('admincronsetup', 'enrol_authorize'));
                 }
             }
@@ -479,10 +452,10 @@ class enrolment_plugin_authorize
         }
 
         if (data_submitted()) {
-            if (empty($frm->an_login)) {
+            if (empty($mconfig->an_login)) {
                 notify("an_login required");
             }
-            if (empty($frm->an_tran_key) && empty($frm->an_password)) {
+            if (empty($mconfig->an_tran_key) && empty($mconfig->an_password)) {
                 notify("an_tran_key or an_password required");
             }
         }
@@ -501,9 +474,12 @@ class enrolment_plugin_authorize
     function process_config($config)
     {
         global $CFG;
+        $mconfig = get_config('enrol/authorize');
 
         // site settings
-        set_config('enrol_cost', optional_param('enrol_cost', 5, PARAM_INT));
+        if (($cost = optional_param('enrol_cost', 5, PARAM_INT)) > 0) {
+            set_config('enrol_cost', $cost);
+        }
         set_config('enrol_currency', optional_param('enrol_currency', 'USD', PARAM_ALPHA));
         set_config('enrol_mailstudents', optional_param('enrol_mailstudents', 0, PARAM_BOOL));
         set_config('enrol_mailteachers', optional_param('enrol_mailteachers', 0, PARAM_BOOL));
@@ -515,7 +491,9 @@ class enrolment_plugin_authorize
         set_config('an_teachermanagepay', optional_param('an_teachermanagepay', 0, PARAM_BOOL));
         set_config('an_referer', optional_param('an_referer', 'http://', PARAM_URL));
 
-        $acceptccs = optional_param('acceptccs', array_keys(get_list_of_creditcards()), PARAM_ALPHA);
+        $acceptccs = optional_param('acceptccs',
+                                    array_keys(enrolment_plugin_authorize::get_list_of_creditcards()),
+                                    PARAM_ALPHA);
         set_config('an_acceptccs', implode(',', $acceptccs));
 
         $cutoff_hour = optional_param('an_cutoff_hour', 0, PARAM_INT);
@@ -531,12 +509,12 @@ class enrolment_plugin_authorize
 
         $captureday = ($captureday > 29) ? 29 : (($captureday < 0) ? 0 : $captureday);
         $emailexpired = ($emailexpired > 5) ? 5 : (($emailexpired < 0) ? 0 : $emailexpired);
-        $mconfig = get_config('enrol/authorize');
 
-        if ((!empty($reviewval)) &&
-            ($captureday > 0 || $emailexpired > 0) &&
-            (time() - intval($mconfig->an_lastcron) > 3600 * 24)) {
-            return false;
+        if (!empty($reviewval) && ($captureday > 0 || $emailexpired > 0)) {
+            $lastcron = get_field_sql('SELECT max(lastcron) FROM ' . $CFG->prefix . 'modules');
+            if (time() - intval($lastcron) > 3600 * 24) {
+                return false;
+            }
         }
 
         set_config('an_review', $reviewval);
@@ -545,52 +523,107 @@ class enrolment_plugin_authorize
         set_config('an_emailexpiredteacher', $emailexpiredteacher);
         set_config('an_sorttype', $sorttype);
 
-        // required fields
-        $loginval = optional_param('an_login', '');
-        $tranval = optional_param('an_tran_key', '');
-        $passwordval = optional_param('an_password', '');
-
-        if ((empty($CFG->loginhttps) and substr($CFG->wwwroot, 0, 5) !== 'https') ||
-            !$this->check_openssl_loaded() ||
-            empty($loginval) ||
-            (empty($tranval) and empty($passwordval))) {
+        // https and openssl library is required
+        if ((substr($CFG->wwwroot, 0, 5) !== 'https' and empty($CFG->loginhttps)) or
+            !enrolment_plugin_authorize::check_openssl_loaded()) {
             return false;
         }
 
-        set_config('an_login', $loginval);
-        set_config('an_password', $passwordval);
-        set_config('an_tran_key', $tranval);
+        // REQUIRED fields;
+        // an_login
+        $loginval = optional_param('an_login', '');
+        if (empty($loginval) && empty($mconfig->an_login)) {
+            return false;
+        }
+        $loginval = !empty($loginval) ? rc4encrypt($loginval) : strval($mconfig->an_login);
+        set_config('an_login', $loginval, 'enrol/authorize');
+
+        // an_tran_key, an_password
+        $tranval = optional_param('an_tran_key', '');
+        $tranval = !empty($tranval) ? rc4encrypt($tranval) : (isset($mconfig->an_tran_key)?$mconfig->an_tran_key:'');
+        $passwordval = optional_param('an_password', '');
+        $passwordval = !empty($passwordval) ? rc4encrypt($passwordval) :(isset($mconfig->an_password)?$mconfig->an_password:'');
+        $deletecurrent = optional_param('delete_current', '0', PARAM_BOOL);
+        if (!empty($deletecurrent) and !empty($tranval)) {
+            delete_records('config_plugins', 'name', 'an_password', 'plugin', 'enrol/authorize');
+            $passwordval = '';
+        }
+        elseif (!empty($passwordval)) {
+            set_config('an_password', $passwordval, 'enrol/authorize');
+        }
+        if (empty($tranval) and empty($passwordval)) {
+            return false;
+        }
+        if (!empty($tranval)) {
+            set_config('an_tran_key', $tranval, 'enrol/authorize');
+        }
 
         return true;
     }
 
-
     /**
-     * email_to_admin
+     * zero_cost (static method)
      *
-     * @param string $subject
-     * @param mixed $data
-     * @access private
+     * @param unknown_type $course
+     * @return number
+     * @static
      */
-    function email_to_admin($subject, $data)
-    {
-        $site = get_site();
-        $admin = get_admin();
-        $data = (array)$data;
-
-        $message = "$site->fullname:  Transaction failed.\n\n$subject\n\n";
-        foreach ($data as $key => $value) {
-            $message .= "$key => $value\n";
-        }
-        email_to_user($admin, $admin, "Authorize.net ERROR: ".$subject, $message);
+    function zero_cost($course) {
+        $curcost = enrolment_plugin_authorize::get_course_cost($course);
+        return (abs($curcost['cost']) < 0.01);
     }
 
 
     /**
-     * prevent_double_paid
+     * get_course_cost (static method)
      *
      * @param object $course
-     * @access private
+     * @return array
+     * @static
+     */
+    function get_course_cost($course)
+    {
+        global $CFG;
+
+        $cost = (float)0;
+        $currency = (!empty($course->currency))
+                     ? $course->currency :( empty($CFG->enrol_currency)
+                                            ? 'USD' : $CFG->enrol_currency );
+
+        if (!empty($course->cost)) {
+            $cost = (float)(((float)$course->cost) < 0) ? $CFG->enrol_cost : $course->cost;
+        }
+
+        $cost = format_float($cost, 2);
+        $ret = array('cost' => $cost, 'currency' => $currency);
+
+        return $ret;
+    }
+
+    /**
+     * email_to_admin (static method)
+     *
+     * @param string $subject
+     * @param mixed $data
+     * @static
+     */
+    function email_to_admin($subject, $data)
+    {
+        global $SITE;
+
+        $admin = get_admin();
+        $data = (array)$data;
+
+        $message = "$SITE->fullname: Transaction failed.\n\n$subject\n\n";
+        $message .= print_r($data, true);
+        email_to_user($admin, $admin, "$SITE->fullname: Authorize.net ERROR", $message);
+    }
+
+    /**
+     * prevent_double_paid (static method)
+     *
+     * @param object $course
+     * @static
      */
     function prevent_double_paid($course)
     {
@@ -607,25 +640,65 @@ class enrolment_plugin_authorize
         }
         if (isset($SESSION->ccpaid)) {
             unset($SESSION->ccpaid);
-            redirect($CFG->wwwroot . '/login/logout.php');
+            redirect($CFG->wwwroot . '/login/logout.php?sesskey='.sesskey());
             return;
         }
     }
 
-
     /**
-     * check_openssl_loaded
+     * check_openssl_loaded (static method)
      *
      * @return bool
-     * @access private
+     * @static
      */
     function check_openssl_loaded() {
         return extension_loaded('openssl');
     }
 
+    /**
+     * get_list_of_creditcards (static method)
+     *
+     * @param bool $getall
+     * @return array
+     * @static
+     */
+    function get_list_of_creditcards($getall = false)
+    {
+        global $CFG;
+
+        $alltypes = array(
+            'mcd' => 'Master Card',
+            'vis' => 'Visa',
+            'amx' => 'American Express',
+            'dsc' => 'Discover',
+            'dnc' => 'Diners Club',
+            'jcb' => 'JCB',
+            'swi' => 'Switch',
+            'dlt' => 'Delta',
+            'enr' => 'EnRoute'
+        );
+
+        if ($getall or empty($CFG->an_acceptccs)) {
+            return $alltypes;
+        }
+
+        $ret = array();
+        $ccs = explode(',', $CFG->an_acceptccs);
+        foreach ($ccs as $key) {
+            $ret[$key] = $alltypes[$key];
+        }
+        return $ret;
+    }
+
 
     /**
-     * cron
+     * This function is run by admin/cron.php every time if admin has enabled this plugin.
+     *
+     * Everyday at settlement time (default is 00:05), it cleans up some tables
+     * and sends email to admin/teachers about pending orders expiring if manual-capture has enabled.
+     *
+     * If admin set up 'Order review' and 'Capture day', it captures credits cards and enrols students.
+     *
      * @access public
      */
     function cron()
@@ -635,91 +708,38 @@ class enrolment_plugin_authorize
 
         $oneday = 86400;
         $timenow = time();
-        $timenowsettle = getsettletime($timenow);
-        $timediff30 = $timenowsettle - (30 * $oneday);
+        $settlementtime = authorize_getsettletime($timenow);
+        $timediff30 = $settlementtime - (30 * $oneday);
+
         $mconfig = get_config('enrol/authorize');
-        set_config('an_lastcron', $timenow, 'enrol/authorize');
 
-        if (intval($mconfig->an_dailysettlement) <= $timenowsettle) {
-            set_config('an_dailysettlement', $timenowsettle + $oneday, 'enrol/authorize');
-            // Some clean-up and update
-            $select = "(status='".AN_STATUS_NONE."') AND (timecreated<'$timediff30')";
-            delete_records_select('enrol_authorize', $select);
-            $select = "(status='".AN_STATUS_AUTH."') AND (timecreated<'$timediff30')";
-            execute_sql("UPDATE {$CFG->prefix}enrol_authorize SET status='".AN_STATUS_EXPIRE."' WHERE $select", false);
-            $timediff60 = $timenowsettle - (60 * $oneday);
-            $select = "(status='".AN_STATUS_EXPIRE."') AND (timecreated<'$timediff60')";
-            delete_records_select('enrol_authorize', $select);
-            // Daily warning email for expiring pending orders.
-            if (!empty($CFG->an_emailexpired)) {
-                $timediffem = $timenowsettle - ((30 - intval($CFG->an_emailexpired)) * $oneday);
-                $select = "(status='". AN_STATUS_AUTH ."') AND (timecreated<'$timediffem') AND (timecreated>'$timediff30')";
-                if ($count = count_records_select('enrol_authorize', $select)) {
-                    $a = new stdClass;
-                    $a->pending = $count;
-                    $a->days = $CFG->an_emailexpired;
-                    $a->course = $SITE->shortname;
-                    $subject = get_string('pendingorderssubject', 'enrol_authorize', $a);
-                    $a = new stdClass;
-                    $a->pending = $count;
-                    $a->days = $CFG->an_emailexpired;
-                    $a->course = $SITE->fullname;
-                    $a->enrolurl = "$CFG->wwwroot/$CFG->admin/users.php";
-                    $a->url = $CFG->wwwroot."/enrol/authorize/index.php?status=".AN_STATUS_AUTH;
-                    $message = get_string('pendingordersemail', 'enrol_authorize', $a);
-                    $adminuser = get_admin();
-                    email_to_user($adminuser, $adminuser, $subject, $message);
-                    if (!empty($CFG->an_teachermanagepay) and !empty($CFG->an_emailexpiredteacher)) {
-                        $sorttype = empty($CFG->an_sorttype) ? 'ttl' : $CFG->an_sorttype;
-                        $sql = "SELECT E.courseid, E.currency, C.fullname, C.shortname, " .
-                               "COUNT(E.courseid) AS cnt, SUM(E.amount) as ttl " .
-                               "FROM {$CFG->prefix}enrol_authorize E " .
-                               "INNER JOIN {$CFG->prefix}course C ON C.id = E.courseid " .
-                               "WHERE $select GROUP BY E.courseid ORDER BY $sorttype DESC";
-                        $message = ''; $subject = ''; $lastcourse = 0;
-                        $courseidandcounts = get_records_sql($sql);
-                        foreach($courseidandcounts as $courseidandcount) {
-                            if ($lastcourse != $courseidandcount->courseid) {
-                                $lastcourse = $courseidandcount->courseid;
-                                $a = new stdClass;
-                                $a->course = $courseidandcount->shortname;
-                                $a->pending = $courseidandcount->cnt;
-                                $a->days = $CFG->an_emailexpired;
-                                $subject = get_string('pendingorderssubject', 'enrol_authorize', $a);
-                                $a = new stdClass;
-                                $a->course = $courseidandcount->fullname;
-                                $a->pending = $courseidandcount->cnt;
-                                $a->currency = $courseidandcount->currency;
-                                $a->sumcost = $courseidandcount->ttl;
-                                $a->days = $CFG->an_emailexpired;
-                                $a->url = $CFG->wwwroot.'/enrol/authorize/index.php?course='.
-                                          $lastcourse.'&amp;status='.AN_STATUS_AUTH;
-                                $message = get_string('pendingordersemailteacher', 'enrol_authorize', $a);
-                            }
-                            if ($teachers = get_course_teachers($lastcourse)) {
-                                foreach ($teachers as $teacher) {
-                                    email_to_user($teacher, $adminuser, $subject, $message);
-                                }
-                            }
-                        }
-                    }
-                }
-            }
+        mtrace("Processing authorize cron...");
+
+        if (intval($mconfig->an_dailysettlement) < $settlementtime) {
+            set_config('an_dailysettlement', $settlementtime, 'enrol/authorize');
+            mtrace("    daily cron; some cleanups and sending email to admins the count of pending orders expiring", ": ");
+            $this->cron_daily();
+            mtrace("done");
         }
 
-        if (empty($CFG->an_review) || (!empty($CFG->an_test)) ||
-            (intval($CFG->an_capture_day) < 1) || (!$this->check_openssl_loaded())) {
-            return;
+        mtrace("    scheduled capture", ": ");
+        if (empty($CFG->an_review) or
+           (!empty($CFG->an_test)) or
+           (intval($CFG->an_capture_day) < 1) or
+           (!enrolment_plugin_authorize::check_openssl_loaded())) {
+            mtrace("disabled");
+            return; // order review disabled or test mode or manual capture or openssl wasn't loaded.
         }
 
-        $timediffcnf = $timenowsettle - (intval($CFG->an_capture_day) * $oneday);
+        $timediffcnf = $settlementtime - (intval($CFG->an_capture_day) * $oneday);
         $sql = "SELECT E.*, C.fullname, C.enrolperiod " .
                "FROM {$CFG->prefix}enrol_authorize E " .
                "INNER JOIN {$CFG->prefix}course C ON C.id = E.courseid " .
-               "WHERE (status = '" .AN_STATUS_AUTH. "') " .
+               "WHERE (E.status = '" .AN_STATUS_AUTH. "') " .
                "  AND (E.timecreated < '$timediffcnf') AND (E.timecreated > '$timediff30')";
 
         if (!$orders = get_records_sql($sql)) {
+            mtrace("no pending orders");
             return;
         }
 
@@ -729,8 +749,12 @@ class enrolment_plugin_authorize
 
         $ordercount = count((array)$orders);
         if (($ordercount * $eachconn) + intval($mconfig->an_lastcron) > $timenow) {
+            mtrace("blocked");
             return;
         }
+        set_config('an_lastcron', $timenow, 'enrol/authorize');
+
+        mtrace("    $ordercount orders are being processed now", ": ");
 
         $faults = '';
         $sendem = array();
@@ -741,19 +765,14 @@ class enrolment_plugin_authorize
         foreach ($orders as $order) {
             $message = '';
             $extra = NULL;
-            $oldstatus = $order->status;
-            $success = authorizenet_action($order, $message, $extra, AN_ACTION_PRIOR_AUTH_CAPTURE);
+            $success = authorize_action($order, $message, $extra, AN_ACTION_PRIOR_AUTH_CAPTURE);
             if ($success) {
-                if (!update_record("enrol_authorize", $order)) {
-                    $this->email_to_admin("Error while trying to update data. Please edit manually this record: " .
-                    "ID=$order->id in enrol_authorize table.", $order);
-                }
                 $timestart = $timeend = 0;
                 if ($order->enrolperiod) {
                     $timestart = $timenow;
                     $timeend = $order->settletime + $order->enrolperiod;
                 }
-                if (enrol_student($order->userid, $order->courseid, $timestart, $timeend, 'authorize')) {
+                if (enrol_student($order->userid, $order->courseid, $timestart, $timeend, 'manual')) {
                     $this->log .= "User($order->userid) has been enrolled to course($order->courseid).\n";
                     if (!empty($CFG->enrol_mailstudents)) {
                         $sendem[] = $order->id;
@@ -768,13 +787,12 @@ class enrolment_plugin_authorize
                 }
             }
             else {
-                $this->log .= "Order $order->id: " . $message . "\n";
-                if ($order->status != $oldstatus) { //expired
-                    update_record("enrol_authorize", $order);
-                }
+                $this->log .= "Error, Order# $order->id: " . $message . "\n";
             }
         }
 
+        mtrace("processed");
+
         $timenow = time();
         $elapsed = $timenow - $elapsed;
         $eachconn = ceil($elapsed / $ordercount);
@@ -789,30 +807,131 @@ class enrolment_plugin_authorize
         if (!empty($CFG->enrol_mailadmins)) {
             email_to_user($adminuser, $adminuser, "AUTHORIZE.NET CRON LOG", $this->log);
         }
+
+        // Send emails to students about which courses have enrolled.
         if (empty($sendem)) {
             return;
         }
 
-        $lastcourse = 0;
-        $select = "SELECT E.id, E.courseid, E.userid, C.fullname " .
-                  "FROM {$CFG->prefix}enrol_authorize E " .
-                  "INNER JOIN {$CFG->prefix}course C ON C.id = E.courseid " .
-                  "WHERE E.id IN(" . implode(',', $sendem) . ") " .
-                  "ORDER BY E.courseid";
-        $orders = get_records_sql($select);
-        foreach ($orders as $order)
-        {
-            if ($lastcourse != $order->courseid) {
-                $lastcourse = $order->courseid;
-                $teacher = get_teacher($lastcourse);
+        mtrace("    sending welcome messages to students", ": ");
+        $select = "SELECT e.id, e.courseid, e.userid, c.fullname
+                 FROM {$CFG->prefix}enrol_authorize e
+                 INNER JOIN {$CFG->prefix}course c ON c.id = e.courseid
+               WHERE e.id IN(" . implode(',', $sendem) . ")
+               ORDER BY e.userid";
+
+        $emailinfo = get_records_sql($select);
+        $ei = reset($emailinfo);
+        while ($ei !== false) {
+            $usercourses = array();
+            $lastuserid = $ei->userid;
+            for ($current = $ei; $current !== false && $current->userid == $lastuserid; $current = next($emailinfo)) {
+                $usercourses[] = $current->fullname;
             }
-            $user = get_record('user', 'id', $order->userid);
+            $ei = $current;
             $a = new stdClass;
-            $a->coursename = $order->fullname;
-            $a->profileurl = "$CFG->wwwroot/user/view.php?id=$user->id";
-            email_to_user($user, $teacher,
-                          get_string("enrolmentnew", '', $order->fullname),
-                          get_string('welcometocoursetext', '', $a));
+            $a->courses = implode("\n", $usercourses);
+            $a->profileurl = "$CFG->wwwroot/user/view.php?id=$lastuserid";
+            $a->paymenturl = "$CFG->wwwroot/enrol/authorize/index.php?user=$lastuserid";
+            $emailmessage = get_string('welcometocoursesemail', 'enrol_authorize', $a);
+            $user = get_record('user', 'id', $lastuserid);
+            @email_to_user($user, $adminuser, get_string("enrolmentnew", '', $SITE->shortname), $emailmessage);
+        }
+        mtrace("sent");
+    }
+
+    /**
+     * Daily cron. It executes at settlement time (default is 00:05).
+     *
+     * @access private
+     */
+    function cron_daily()
+    {
+        global $CFG, $SITE;
+        require_once($CFG->dirroot.'/enrol/authorize/authorizenetlib.php');
+
+        $oneday = 86400;
+        $timenow = time();
+        $settlementtime = authorize_getsettletime($timenow);
+        $timediff30 = $settlementtime - (30 * $oneday);
+
+        // Delete orders that no transaction was made.
+        $select = "(status='".AN_STATUS_NONE."') AND (timecreated<'$timediff30')";
+        delete_records_select('enrol_authorize', $select);
+
+        // Pending orders are expired with in 30 days.
+        $select = "(status='".AN_STATUS_AUTH."') AND (timecreated<'$timediff30')";
+        execute_sql("UPDATE {$CFG->prefix}enrol_authorize SET status='".AN_STATUS_EXPIRE."' WHERE $select", false);
+
+        // Delete expired orders 60 days later.
+        $timediff60 = $settlementtime - (60 * $oneday);
+        $select = "(status='".AN_STATUS_EXPIRE."') AND (timecreated<'$timediff60')";
+        delete_records_select('enrol_authorize', $select);
+
+        // Daily warning email for pending orders expiring.
+        if (empty($CFG->an_emailexpired)) {
+            return; // not enabled
+        }
+
+        // Pending orders count will be expired.
+        $timediffem = $settlementtime - ((30 - intval($CFG->an_emailexpired)) * $oneday);
+        $select = "(status='". AN_STATUS_AUTH ."') AND (timecreated<'$timediffem') AND (timecreated>'$timediff30')";
+        $count = count_records_select('enrol_authorize', $select);
+        if (!$count) {
+            return;
+        }
+
+        // Email to admin
+        $a = new stdClass;
+        $a->pending = $count;
+        $a->days = $CFG->an_emailexpired;
+        $a->course = $SITE->shortname;
+        $subject = get_string('pendingorderssubject', 'enrol_authorize', $a);
+        $a = new stdClass;
+        $a->pending = $count;
+        $a->days = $CFG->an_emailexpired;
+        $a->course = $SITE->fullname;
+        $a->enrolurl = "$CFG->wwwroot/$CFG->admin/users.php";
+        $a->url = $CFG->wwwroot.'/enrol/authorize/index.php?status='.AN_STATUS_AUTH;
+        $message = get_string('pendingordersemail', 'enrol_authorize', $a);
+        $adminuser = get_admin();
+        email_to_user($adminuser, $adminuser, $subject, $message);
+
+        // Email to teachers
+        if (empty($CFG->an_teachermanagepay) or empty($CFG->an_emailexpiredteacher)) {
+            return; // teachers can't manage payments or email feature disabled for teachers.
+        }
+
+        $sorttype = empty($CFG->an_sorttype) ? 'ttl' : $CFG->an_sorttype;
+        $where = "(E.status='". AN_STATUS_AUTH ."') AND (E.timecreated<'$timediffem') AND (E.timecreated>'$timediff30')";
+        $sql = "SELECT E.courseid, E.currency, C.fullname, C.shortname, " .
+               "COUNT(E.courseid) AS cnt, SUM(E.amount) as ttl " .
+               "FROM {$CFG->prefix}enrol_authorize E " .
+               "INNER JOIN {$CFG->prefix}course C ON C.id = E.courseid " .
+               "WHERE $where GROUP BY E.courseid ORDER BY $sorttype DESC";
+
+        $courseinfos = get_records_sql($sql);
+        foreach($courseinfos as $courseinfo) {
+            $lastcourse = $courseinfo->courseid;
+            if ($teachers = get_course_teachers($lastcourse)) {
+                $a = new stdClass;
+                $a->course = $courseinfo->shortname;
+                $a->pending = $courseinfo->cnt;
+                $a->days = $CFG->an_emailexpired;
+                $subject = get_string('pendingorderssubject', 'enrol_authorize', $a);
+                $a = new stdClass;
+                $a->course = $courseinfo->fullname;
+                $a->pending = $courseinfo->cnt;
+                $a->currency = $courseinfo->currency;
+                $a->sumcost = $courseinfo->ttl;
+                $a->days = $CFG->an_emailexpired;
+                $a->url = $CFG->wwwroot.'/enrol/authorize/index.php?course='.
+                          $lastcourse.'&amp;status='.AN_STATUS_AUTH;
+                $message = get_string('pendingordersemailteacher', 'enrol_authorize', $a);
+                foreach ($teachers as $teacher) {
+                    email_to_user($teacher, $adminuser, $subject, $message);
+                }
+            }
         }
     }
 }

enrol/authorize/index.php

@@ -9,6 +9,11 @@
     $courseid = optional_param('course', SITEID, PARAM_INT);
     $userid   = optional_param('user', 0, PARAM_INT);
 
+/// Get course
+    if (!$course = get_record('course', 'id', $courseid)) {
+        error('Could not find that course');
+    }
+
 /// Only site users can access to this page
     require_login(); // Don't use $courseid! User may want to see old orders.
 
@@ -17,7 +22,7 @@
     }
 
 /// Load strings. All strings should be defined here. locallib.php uses these strings.
-    $strs = get_strings(array('status','action','time','course','confirm','yes','no','all','none','error'));
+    $strs = get_strings(array('status','action','time','course','confirm','no','all','none','error'));
     $authstrs = get_strings(array('orderid','nameoncard','void','capture','refund','delete',
                 'authcaptured','authorizedpendingcapture','capturedpendingsettle','capturedsettled',
                 'settled','refunded','cancelled','expired','tested','new',
@@ -25,11 +30,7 @@
 
 /// Print header
     $strpaymentmanagement = get_string('paymentmanagement', 'enrol_authorize');
-    if (!$course = get_record('course', 'id', $courseid)) {
-        error('Could not find that course');
-    }
-    print_header_simple("$strpaymentmanagement", "", "<a href=\"index.php\">$strpaymentmanagement</a>");
-
+    print_header_simple($strpaymentmanagement, "", "<a href=\"index.php\">$strpaymentmanagement</a>");
 
 /// If orderid is empty, user wants to see all orders
     if (empty($orderid)) {

enrol/authorize/lib.php

@@ -1,54 +0,0 @@
-<?PHP // $Id$
-
-/**
- * backup_authorize_info
- *
- * @param resource $bf
- * @param object $prefs
- * @return bool
- */
-function backup_authorize_info($bf, $prefs)
-{
-    global $CFG;
-
-    $status = true;
-
-    if ($orders = get_records("enrol_authorize", "courseid", $prefs->backup_course))
-    {
-        fwrite($bf, start_tag("AUTHORIZEORDERS", 2 ,true));
-        foreach ($orders as $order) {
-            fwrite($bf, start_tag("ORDER", 3, true));
-            fwrite($bf, full_tag("ID", 4, false, $order->id));
-            fwrite($bf, full_tag("CCLASTFOUR", 4, false, $order->cclastfour));
-            fwrite($bf, full_tag("CCNAME", 4, false, $order->ccname));
-            fwrite($bf, full_tag("COURSEID", 4, false, $order->courseid));
-            fwrite($bf, full_tag("USERID", 4, false, $order->userid));
-            fwrite($bf, full_tag("TRANSID", 4, false, $order->transid));
-            fwrite($bf, full_tag("STATUS", 4, false, $order->status));
-            fwrite($bf, full_tag("TIMECREATED", 4, false, $order->timecreated));
-            fwrite($bf, full_tag("SETTLETIME", 4, false, $order->settletime));
-            fwrite($bf, full_tag("AMOUNT", 4, false, $order->amount));
-            fwrite($bf, full_tag("CURRENCY", 4, false, $order->currency));
-            if ($refunds = get_records("enrol_authorize_refunds", "orderid", $order->id)) {
-                fwrite($bf, start_tag("REFUNDS",4, true));
-                foreach ($refunds as $refund) {
-                    fwrite($bf, start_tag("REFUND", 5, true));
-                    fwrite($bf, full_tag("ID", 6, false, $refund->id));
-                    fwrite($bf, full_tag("ORDERID", 6, false, $refund->orderid));
-                    fwrite($bf, full_tag("STATUS", 6, false, $refund->status));
-                    fwrite($bf, full_tag("AMOUNT", 6, false, $refund->amount));
-                    fwrite($bf, full_tag("TRANSID", 6, false, $refund->transid));
-                    fwrite($bf, full_tag("SETTLETIME", 6, false, $refund->settletime));
-                    fwrite($bf, end_tag("REFUND", 5, true));
-                }
-                $status = fwrite($bf, end_tag("REFUNDS", 4, true));
-            }
-            fwrite ($bf, end_tag("ORDER", 3, true));
-        }
-        $status = fwrite($bf, end_tag("AUTHORIZEORDERS", 2, true));
-    }
-    return $status;
-}
-
-
-?>

enrol/authorize/locallib.php

@@ -18,7 +18,7 @@ define('ORDER_VOID',    'void');
  */
 function authorize_print_orders()
 {
-    global $CFG, $USER;
+    global $CFG, $USER, $SITE;
     global $strs, $authstrs;
     global $courseid, $userid;
     require_once($CFG->libdir.'/tablelib.php');
@@ -40,21 +40,19 @@ function authorize_print_orders()
                         AN_STATUS_TEST => $authstrs->tested
     );
 
-    if ($courses = get_courses('all', 'c.sortorder ASC', 'c.id,c.fullname,c.enrol')) {
-        $popupcrs = array();
-        foreach ($courses as $crs) {
-            if ($crs->enrol == 'authorize' || (empty($crs->enrol) && $CFG->enrol == 'authorize')) {
-                $popupcrs[intval($crs->id)] = $crs->fullname;
-            }
-        }
-        if (!empty($popupcrs)) {
-            print_simple_box_start('center', '100%');
-            echo "$strs->status: ";
-            echo popup_form($baseurl.'&course='.$courseid.'&status=',$statusmenu,'statusmenu',$status,'','','',true);
-            echo "   $strs->course: ";
-            echo popup_form($baseurl.'&status='.$status.'&course=',$popupcrs,'coursesmenu',$courseid,'','','',true);
-            print_simple_box_end();
-        }
+    $sql = "SELECT c.id, c.fullname FROM {$CFG->prefix}course c INNER JOIN {$CFG->prefix}enrol_authorize e ON c.id = e.courseid ";
+    if ($userid > 0) {
+    	$sql .= "WHERE (e.userid='$userid') ";
+    }
+    $sql .= "ORDER BY c.sortorder, c.fullname";
+    if ($popupcrs = get_records_sql_menu($sql)) {
+        $popupcrs = array($SITE->id => $SITE->fullname) + $popupcrs;
+        print_simple_box_start('center', '100%');
+        echo "$strs->status: ";
+        echo popup_form($baseurl.'&course='.$courseid.'&status=',$statusmenu,'statusmenu',$status,'','','',true);
+        echo "   $strs->course: ";
+        echo popup_form($baseurl.'&status='.$status.'&course=',$popupcrs,'coursesmenu',$courseid,'','','',true);
+        print_simple_box_end();
     }
 
     $table = new flexible_table('enrol-authorize');
@@ -66,7 +64,7 @@ function authorize_print_orders()
 
     $table->define_columns(array('id', 'timecreated', 'userid', 'status', ''));
     $table->define_headers(array($authstrs->orderid, $strs->time, $authstrs->nameoncard, $strs->status, $strs->action));
-    $table->define_baseurl($baseurl."&status=$status");
+    $table->define_baseurl($baseurl."&status=$status&course=$courseid");
 
     $table->sortable(true, 'id', SORT_DESC);
     $table->pageable(true);
@@ -101,10 +99,10 @@ function authorize_print_orders()
     }
 
     if ($userid > 0) {
-        $where .= "AND (userid = '" . $userid . "') ";
+        $where .= "AND (E.userid = '" . $userid . "') ";
     }
     if ($courseid != SITEID) {
-        $where .= "AND (courseid = '" . $courseid . "') ";
+        $where .= "AND (E.courseid = '" . $courseid . "') ";
     }
 
     if ($sort = $table->get_sql_sort()) {
@@ -191,7 +189,7 @@ function authorize_print_order_details($orderno)
     echo "<input type=\"hidden\" name=\"order\" value=\"$orderno\">\n";
     echo "<input type=\"hidden\" name=\"sesskey\" value=\"" . sesskey() . "\" />";
 
-    $settled = settled($order);
+    $settled = authorize_settled($order);
     $status = authorize_get_status_action($order);
 
     $table->data[] = array("<b>$authstrs->orderid:</b>", $orderno);
@@ -217,14 +215,14 @@ function authorize_print_order_details($orderno)
         if (empty($confirm)) {
             $strcaptureyes = get_string('captureyes', 'enrol_authorize');
             $table->data[] = array("<b>$strs->confirm:</b>",
-            "$strcaptureyes<br /><a href='index.php?order=$orderno&amp;sesskey=$USER->sesskey&amp;".ORDER_CAPTURE."=y&amp;confirm=1'>$strs->yes</a>
-            &nbsp;&nbsp;&nbsp;&nbsp;<a href='index.php?order=$orderno'>$strs->no</a>");
+            "$strcaptureyes <br />
+            <input type='hidden' name='confirm' value='1'><input type='submit' name='". ORDER_CAPTURE ."' value='$authstrs->capture' />
+            &nbsp;&nbsp;&nbsp;<a href='index.php?order=$orderno'>$strs->no</a>");
         }
         else {
             $message = '';
             $extra = NULL;
-            $success = authorizenet_action($order, $message, $extra, AN_ACTION_PRIOR_AUTH_CAPTURE);
-            update_record("enrol_authorize", $order); // May be expired.
+            $success = authorize_action($order, $message, $extra, AN_ACTION_PRIOR_AUTH_CAPTURE);
             if (!$success) {
                 $table->data[] = array("<b><font color='red'>$strs->error:</font></b>", $message);
             }
@@ -235,7 +233,7 @@ function authorize_print_order_details($orderno)
                         $timestart = time(); // early start
                         $timeend = $order->settletime + $order->enrolperiod; // lately end
                     }
-                    if (enrol_student($order->userid, $order->courseid, $timestart, $timeend, 'authorize')) {
+                    if (enrol_student($order->userid, $order->courseid, $timestart, $timeend, 'manual')) {
                         $user = get_record('user', 'id', $order->userid);
                         $teacher = get_teacher($order->courseid);
                         $a = new stdClass;
@@ -298,20 +296,11 @@ function authorize_print_order_details($orderno)
             else {
                 $extra->amount = $amount;
                 $message = '';
-                $success = authorizenet_action($order, $message, $extra, AN_ACTION_CREDIT);
+                $success = authorize_action($order, $message, $extra, AN_ACTION_CREDIT);
                 if ($success) {
                     if (empty($CFG->an_test)) {
-                        $extra->id = insert_record("enrol_authorize_refunds", $extra);
                         if (empty($extra->id)) {
-                            $emailsubject = "Authorize.net: insert record error";
-                            $emailmessage = "Error while trying to insert new data to enrol_authorize_refunds table:\n";
-                            $data = (array)$extra;
-                            foreach ($data as $key => $value) {
-                                $emailmessage .= "$key => $value\n";
-                            }
-                            $adminuser = get_admin();
-                            email_to_user($adminuser, $adminuser, $emailsubject, $emailmessage);
-                            $table->data[] = array("<b><font color=red>$strs->error:</font></b>", $emailmessage);
+                            $table->data[] = array("<b><font color=red>$strs->error:</font></b>", 'insert record error');
                         }
                         else {
                             if (!empty($unenrol)) {
@@ -333,27 +322,25 @@ function authorize_print_order_details($orderno)
         print_table($table);
     }
     elseif (!empty($cmdvoid) and confirm_sesskey()) { // VOID
-        if (!in_array(ORDER_VOID, $status->actions)) {
-            $a = new stdClass;
-            $a->action = $authstrs->void;
-            error(get_string('youcantdo', 'enrol_authorize', $a));
-        }
-
         $suborderno = optional_param('suborder', 0, PARAM_INT);
         if (empty($suborderno)) { // cancel original transaction.
+            if (!in_array(ORDER_VOID, $status->actions)) {
+                $a = new stdClass;
+                $a->action = $authstrs->void;
+                error(get_string('youcantdo', 'enrol_authorize', $a));
+            }
             if (empty($confirm)) {
                 $strvoidyes = get_string('voidyes', 'enrol_authorize');
                 $table->data[] = array("<b>$strs->confirm:</b>",
                     "$strvoidyes<br /><input type='hidden' name='".ORDER_VOID."' value='y'>
                      <input type='hidden' name='confirm' value='1'>
-                     <input type='submit' value='$strs->yes'>
+                     <input type='submit' value='$authstrs->void'>
                      &nbsp;&nbsp;&nbsp;&nbsp;<a href='index.php?order=$orderno'>$strs->no</a>");
             }
             else {
                 $extra = NULL;
                 $message = '';
-                $success = authorizenet_action($order, $message, $extra, AN_ACTION_VOID);
-                update_record("enrol_authorize", $order); // May be expired.
+                $success = authorize_action($order, $message, $extra, AN_ACTION_VOID);
                 if ($success) {
                     if (empty($CFG->an_test)) {
                         redirect("index.php?order=$orderno");
@@ -369,14 +356,22 @@ function authorize_print_order_details($orderno)
             }
         }
         else { // cancel refunded transaction
-            $suborder = get_record('enrol_authorize_refunds',
-                                   'id', $suborderno,
-                                   'orderid', $orderno,
-                                   'status', AN_STATUS_CREDIT);
+            $sql = "SELECT R.*, E.courseid FROM {$CFG->prefix}enrol_authorize_refunds R " .
+                   "INNER JOIN {$CFG->prefix}enrol_authorize E ON R.orderid = E.id " .
+                   "WHERE R.id = '$suborderno' AND R.orderid = '$orderno' AND R.status = '" .AN_STATUS_CREDIT. "'";
+
+            $suborder = get_record_sql($sql);
             if (!$suborder) { // not found
                 error("Transaction can not be voided because of already been voided.");
             }
             else {
+                $refundedstatus = authorize_get_status_action($suborder);
+                if (!in_array(ORDER_VOID, $refundedstatus->actions)) {
+                    $a = new stdClass;
+                    $a->action = $authstrs->void;
+                    error(get_string('youcantdo', 'enrol_authorize', $a));
+                }
+                unset($suborder->courseid);
                 if (empty($confirm)) {
                     $a = new stdClass;
                     $a->transid = $suborder->transid;
@@ -388,14 +383,13 @@ function authorize_print_order_details($orderno)
                         "$strsubvoidyes<br /><input type='hidden' name='".ORDER_VOID."' value='y'>
                          <input type='hidden' name='confirm' value='1'>
                          <input type='hidden' name='suborder' value='$suborderno'>
-                         <input type='submit' value='$strs->yes'>
+                         <input type='submit' value='$authstrs->void'>
                          &nbsp;&nbsp;&nbsp;&nbsp;<a href='index.php?order=$orderno'>$strs->no</a>");
                 }
                 else {
                     $message = '';
                     $extra = NULL;
-                    $success = authorizenet_action($suborder, $message, $extra, AN_ACTION_VOID);
-                    update_record("enrol_authorize_refunds", $suborder); // May be expired.
+                    $success = authorize_action($suborder, $message, $extra, AN_ACTION_VOID);
                     if ($success) {
                         if (empty($CFG->an_test)) {
                             if (!empty($unenrol)) {
@@ -428,7 +422,7 @@ function authorize_print_order_details($orderno)
             $table->data[] = array("<b>$strs->confirm:</b>",
                 "<input type='hidden' name='".ORDER_DELETE."' value='y'>
                  <input type='hidden' name='confirm' value='1'>
-                 <input type='submit' value='$strs->yes'>
+                 <input type='submit' value='$authstrs->delete'>
                  &nbsp;&nbsp;&nbsp;&nbsp;<a href='index.php?order=$orderno'>$strs->no</a>");
         }
         else {
@@ -454,15 +448,21 @@ function authorize_print_order_details($orderno)
         print_table($table);
         if ($settled) { // show refunds.
             $t2 = new stdClass;
-            $t2->size = array('15%', '15%', '20%', '35%', '15%');
+            $t2->size = array('45%', '15%', '20%', '10%', '10%');
             $t2->align = array('right', 'right', 'right', 'right', 'right');
-            $t2->head = array($authstrs->transid,
-                              $authstrs->amount,
+            $t2->head = array($authstrs->settlementdate,
+                              $authstrs->transid,
                               $strs->status,
-                              $authstrs->settlementdate,
-                              $strs->action);
-            $refunds = get_records('enrol_authorize_refunds', 'orderid', $orderno);
+                              $strs->action,
+                              $authstrs->amount);
+
+            $sql = "SELECT R.*, E.courseid FROM {$CFG->prefix}enrol_authorize_refunds R " .
+                   "INNER JOIN {$CFG->prefix}enrol_authorize E ON R.orderid = E.id " .
+                   "WHERE R.orderid = '$orderno'";
+
+            $refunds = get_records_sql($sql);
             if ($refunds) {
+                $sumrefund = floatval(0.0);
                 foreach ($refunds as $rf) {
                     $substatus = authorize_get_status_action($rf);
                     $subactions = '&nbsp;';
@@ -475,12 +475,36 @@ function authorize_print_order_details($orderno)
                             "<a href='index.php?$vl=y&amp;sesskey=$USER->sesskey&amp;order=$orderno&amp;suborder=$rf->id'>{$authstrs->$vl}</a> ";
                         }
                     }
-                    $t2->data[] = array($rf->transid,
-                                        $rf->amount,
-                                        $authstrs->{$substatus->status},
-                                        userdate($rf->settletime),
-                                        $subactions);
+                    $sign = '';
+                    $color = '';
+                    switch ($substatus->status) {
+                        case 'cancelled':
+                            $color = 'black';
+                            break;
+
+                        case 'refunded':
+                            $sign = '-';
+                            $color = 'red';
+                            $sumrefund += floatval($rf->amount);
+                            break;
+
+                        case 'settled':
+                        default:
+                            $sign = '-';
+                            $color = 'green';
+                            $sumrefund += floatval($rf->amount);
+                            break;
+                    }
+
+                    $t2->data[] = array(
+                        userdate($rf->settletime),
+                        $rf->transid,
+                        $authstrs->{$substatus->status},
+                        $subactions,
+                        "<font color='$color'>" . format_float($sign . $rf->amount, 2) . "</font>"
+                    );
                 }
+                $t2->data[] = array('','',get_string('total'),$order->currency,format_float('-'.$sumrefund, 2));
             }
             else {
                 $t2->data[] = array('','',get_string('noreturns', 'enrol_authorize'),'','');
@@ -501,12 +525,10 @@ function authorize_print_order_details($orderno)
 function authorize_get_status_action($order)
 {
     global $CFG;
-    static $timediff30, $newordertime;
+    static $newordertime;
 
-    if (empty($timediff30)) {
-        $timenow = time();
-        $timediff30 = getsettletime($timenow) - (30 * 3600 * 24);
-        $newordertime = $timenow - 120; // -2 minutes. Order may be still in process.
+    if (empty($newordertime)) {
+        $newordertime = time() - 120; // -2 minutes. Order may be still in process.
     }
 
     $ret = new stdClass();
@@ -527,9 +549,7 @@ function authorize_get_status_action($order)
 
     switch ($order->status) {
     case AN_STATUS_AUTH:
-        if (getsettletime($order->timecreated) < $timediff30) {
-            $order->status = AN_STATUS_EXPIRE;
-            update_record("enrol_authorize", $order);
+        if (authorize_expired($order)) {
             if (isadmin() || (!empty($CFG->an_teachermanagepay) && isteacher($order->courseid))) {
                 $ret->actions = array(ORDER_DELETE);
             }
@@ -544,7 +564,7 @@ function authorize_get_status_action($order)
         return $ret;
 
     case AN_STATUS_AUTHCAPTURE:
-        if (settled($order)) {
+        if (authorize_settled($order)) {
             if (isadmin() || (!empty($CFG->an_teachermanagepay) && isteacher($order->courseid))) {
                 $ret->actions = array(ORDER_REFUND);
             }
@@ -559,7 +579,7 @@ function authorize_get_status_action($order)
         return $ret;
 
     case AN_STATUS_CREDIT:
-        if (settled($order)) {
+        if (authorize_settled($order)) {
             $ret->status = 'settled';
         }
         else {

enrol/authorize/version.php

@@ -1,6 +1,6 @@
 <?PHP // $Id$
 
-$plugin->version  = 2006021501;
+$plugin->version  = 2006021531;
 $plugin->requires = 2005072200;
 
 ?>

enrol/database/enrol.php

@@ -41,7 +41,13 @@ function get_student_courses(&$user) {
                         if (isset($user->student[$course->id])) {   /// We have it already
                             unset($user->student[$course->id]);       /// Remove from old list
                         } else {
-                            enrol_student($user->id, $course->id, 0, 0, 'database');   /// Enrol the student
+                            if ($course->enrolperiod) {
+                                $timestart = time();
+                                $timeend = time() + $course->enrolperiod;
+                            } else {
+                                $timestart = $timeend = 0;
+                            }
+                            enrol_student($user->id, $course->id, $timestart, $timeend, 'database');
                         }
                     }
                 }
@@ -204,14 +210,15 @@ function sync_enrolments($type='student') {
             $sql = "SELECT u.id AS userid, e.id AS enrolmentid" .
                 " FROM {$CFG->prefix}user u " . 
                 "      LEFT OUTER JOIN {$CFG->prefix}user_students e ON (u.id = e.userid AND e.course='{$course->id}')" .
-                " WHERE u.{$CFG->enrol_localuserfield} = '$member'";
+                " WHERE u.{$CFG->enrol_localuserfield} = '$member'" .
+                " AND (u.deleted IS NULL OR u.deleted=0)";
 
             $ers = $db->Execute($sql);
             if (!$ers) {
                 trigger_error($db->ErrorMsg() .' STATEMENT: '. $sql);
                 return false;
             }
-            if ( $ers->RecordCount() != 1 ) { // if this returns empty, it means we don't have the student record.
+            if ( $ers->RecordCount() == 0 ) { // if this returns empty, it means we don't have the student record.
                                               // should not happen -- but skip it anyway 
                 trigger_error('weird! no user record entry?');
                 continue;

enrol/ldap/enrol.php

@@ -81,6 +81,9 @@ function get_user_courses(&$user, $type) {
             }
         }
         
+        /// Add it to new list
+        $newenrolments[$course_obj->id] = 'ldap';
+
         // deal with enrolment in the moodle db
         if (!empty($course_obj)) { // does course exist now?     
             if(isset($user->{$type}[$course_obj->id]) && $user->{$type}[$course_obj->id] == 'ldap'){
@@ -105,18 +108,26 @@ function get_user_courses(&$user, $type) {
     // array, those are old enrolments that we want to remove (or are they?)
     if(!empty($user->{$type})){
         foreach ($user->{$type} as $courseid => $value){
-            if($value == 'ldap'){ // this was a legacy 
+            if($value === 'ldap'){ // this was a legacy 
                 if ($type === 'student') { // enrol
                     unenrol_student($user->id, $courseid);
                 } else if ($type === 'teacher') {
                     remove_teacher($user->id, $courseid);
                 }
                 unset($user->{$type}[$course_obj->id]);
+            } else {
+                // This one is from a non-database
+                // enrolment. Add it to the newenrolments
+                // array, so we don't loose it.
+                $newenrolments[$courseid] = $value;
             }
 
         }
     }
 
+    /// Overwrite the old array with the new one
+    $user->{$type} = $newenrolments;
+
     @ldap_close($ldap_connection);
     return true;
 }
@@ -574,8 +585,8 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
 
     // override with required ext data
     $course->idnumber  = $course_ext[$CFG->enrol_ldap_course_idnumber][0];
-    $course->fullname  = $course_ext[$CFG->enrol_ldap_course_fullname][0];
-    $course->shortname = $course_ext[$CFG->enrol_ldap_course_shortname][0];
+    $course->fullname  = addslashes($course_ext[$CFG->enrol_ldap_course_fullname][0]);
+    $course->shortname = addslashes($course_ext[$CFG->enrol_ldap_course_shortname][0]);
     if (   empty($course->idnumber)
         || empty($course->fullname)
         || empty($course->shortname) ) { 
@@ -586,7 +597,7 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
     }
 
     if(!empty($CFG->enrol_ldap_course_summary)){ // optional
-        $course->summary   = $course_ext[$CFG->enrol_ldap_course_summary][0];
+        $course->summary   = addslashes($course_ext[$CFG->enrol_ldap_course_summary][0]);
     }
     if(!empty($CFG->enrol_ldap_category)){ // optional ... but ensure it is set!
         $course->category   = $CFG->enrol_ldap_category;