MDL-24779 mod/hotpot tidy up calls to js_value() method which escapes and encodes unicode strings for javascript

from HEAD

COPYING.txt

@@ -0,0 +1,339 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.

admin/config.php

@@ -3,6 +3,8 @@
 
     require_once('../config.php');
 
+    $installing = optional_param('installing', 0, PARAM_BOOL);
+
     $focus = '';
 
     if ($site = get_site()) {   // If false then this is a new installation
@@ -46,7 +48,10 @@
                         $value = implode(',',$value);
                     }
                 }
-                unset($conf);
+                if ($name == "locale") {
+                    $value = trim($value);
+                }
+                $conf = new object();
                 $conf->name  = $name;
                 $conf->value = $value;
                 if ($current = get_record('config', 'name', $name)) {
@@ -60,8 +65,16 @@
                     }
                 }
             }
-            redirect('index.php', get_string('changessaved'), 1);
-            exit;
+            if ($installing) {
+                print_header();
+                notify(get_string('changessaved'), 'notifysuccess');
+                print_continue('index.php');
+                exit;
+            } else {
+                // the following redirect was randomly breaking upgrades because it did double redirects,
+                // we must not use it during install/upgrade
+                redirect('index.php', get_string('changessaved'), 1);
+            }
 
         } else {
             foreach ($err as $key => $value) {
@@ -74,9 +87,6 @@
 
     if (empty($config)) {
         $config = $CFG;
-        if (!$config->locale = get_field('config', 'value', 'name', 'locale')) {
-            $config->locale = $CFG->lang;
-        }
     }
 
     $sesskey = !empty($USER->id) ? $USER->sesskey : '';
@@ -143,6 +153,7 @@
 
     }
     echo '<center>';
+    echo '<input type="hidden" name="installing" value="'.$installing.'" />';
     echo '<input type="hidden" name="sesskey" value="'.$sesskey.'" />';
     echo '<input type="submit" value="'.get_string('savechanges').'" />';
     echo '</center>';

admin/configvars.php

@@ -69,7 +69,7 @@ class configvar {
 
 /// debug
     unset($options);
-    $options[7]  = $strno;
+    $options[5]  = $strno;
     $options[15] = $stryes;
 
     $misc['debug'] = new configvar (get_string('configdebug', 'admin'),
@@ -312,10 +312,10 @@ class configvarrss extends configvar {
 /// language menu
     $interface['langcache'] = new configvar ( get_string('configlangcache', 'admin'),
         choose_from_menu($noyesoptions, 'langcache', $config->langcache, '', '', '', true) );
-        
+
 /// locale
     $interface['locale'] = new configvar ( get_string('configlocale', 'admin'),
-        '<input name="locale" type="text" size="10" value="'.s($config->locale).'" alt="locale" />' );
+        '<input name="locale" type="text" size="15" value="'.s($config->locale).'" alt="locale" />' );
 
 /// docroot
     $interface['docroot'] = new configvar ( get_string('configdocroot', 'admin'),
@@ -450,6 +450,9 @@ class configvarrss extends configvar {
     $security['notifyloginthreshold'] = new configvar (get_string('confignotifyloginthreshold', 'admin'),
         choose_from_menu($options, 'notifyloginthreshold', $config->notifyloginthreshold, '', '', '', true) );
 
+    $security['protectusernames'] = new configvar (get_string('configprotectusernames', 'admin'),
+        choose_from_menu($noyesoptions, 'protectusernames', $config->protectusernames, '', '', '', true) );
+
 /// secureforms
     $security['secureforms'] = new configvar (get_string('configsecureforms', 'admin'),
         choose_from_menu ($noyesoptions, 'secureforms', $config->secureforms, '', '', '', true) );
@@ -458,6 +461,9 @@ class configvarrss extends configvar {
     $security['loginhttps'] = new configvar (get_string('configloginhttps', 'admin'),
         choose_from_menu ($noyesoptions, 'loginhttps', $config->loginhttps, '', '', '', true) );
 
+/// profilesforenrolledusersonly
+    $security['profilesforenrolledusersonly'] = new configvar (get_string('configprofilesforenrolledusersonly', 'admin'), choose_from_menu ($noyesoptions, 'profilesforenrolledusersonly', $CFG->profilesforenrolledusersonly, '', '', '', true) );
+
 /// runclamonupload
     $security['runclamonupload'] = new configvar (get_string('configrunclamonupload', 'admin'),
         choose_from_menu($noyesoptions, 'runclamonupload', $config->runclamonupload, '', '', '', true) );
@@ -591,6 +597,7 @@ class configvarrss extends configvar {
     }
     
 /// enable stats
+if (empty($CFG->disablestatsprocessing)) {
     $stats['enablestats'] = new configvar (get_string('configenablestats','admin'),
         choose_from_menu($noyesoptions, 'enablestats', $config->enablestats, '', '', '', true) );
 
@@ -636,7 +643,7 @@ class configvarrss extends configvar {
 
     $stats['statsuserthreshold'] = new configvar (get_string('configstatsuserthreshold','admin'),
       '<input type="text" name="statsuserthreshold" size="4" value="'.$config->statsuserthreshold.'" />');
-                                              
+}                                        
 
 ////////////////////////////////////////////////////////////////////
 
@@ -649,6 +656,8 @@ class configvarrss extends configvar {
     $configvars['permissions']     = $permissions;
     $configvars['requestedcourse'] = $reqcourse;
     $configvars['misc']            = $misc;
+if (empty($CFG->disablestatsprocessing)) {
     $configvars['stats']           = $stats;
+}
 
 ?>

admin/cron.php

@@ -141,11 +141,13 @@
     
         /// Delete users who haven't confirmed within required period
 
-        $oneweek = $timenow - ($CFG->deleteunconfirmed * 3600);
-        if ($users = get_users_unconfirmed($oneweek)) {
-            foreach ($users as $user) {
-                if (delete_records('user', 'id', $user->id)) {
-                    mtrace("Deleted unconfirmed user for ".fullname($user, true)." ($user->id)");
+        if (!empty($CFG->deleteunconfirmed)) {
+            $oneweek = $timenow - ($CFG->deleteunconfirmed * 3600);
+            if ($users = get_users_unconfirmed($oneweek)) {
+                foreach ($users as $user) {
+                    if (delete_records('user', 'id', $user->id)) {
+                        mtrace("Deleted unconfirmed user for ".fullname($user, true)." ($user->id)");
+                    }
                 }
             }
         }
@@ -155,11 +157,13 @@
 
         /// Delete users who haven't completed profile within required period
 
-        $oneweek = $timenow - ($CFG->deleteunconfirmed * 3600);
-        if ($users = get_users_not_fully_set_up($oneweek)) {
-            foreach ($users as $user) {
-                if (delete_records('user', 'id', $user->id)) {
-                    mtrace("Deleted not fully setup user $user->username ($user->id)");
+        if (!empty($CFG->deleteunconfirmed)) {
+            $oneweek = $timenow - ($CFG->deleteunconfirmed * 3600);
+            if ($users = get_users_not_fully_set_up($oneweek)) {
+                foreach ($users as $user) {
+                    if (delete_records('user', 'id', $user->id)) {
+                        mtrace("Deleted not fully setup user $user->username ($user->id)");
+                    }
                 }
             }
         }
@@ -274,10 +278,10 @@
         unset($enrol);
     }
 
-    if (!empty($CFG->enablestats)) {
+    if (!empty($CFG->enablestats) and empty($CFG->disablestatsprocessing)) {
 
         // check we're not before our runtime
-        $timetocheck = strtotime("$CFG->statsruntimestarthour:$CFG->statsruntimestartminute today");
+        $timetocheck = strtotime("today $CFG->statsruntimestarthour:$CFG->statsruntimestartminute");
 
         if (time() > $timetocheck) {
             $time = 60*60*20; // set it to 20 here for first run... (overridden by $CFG)

admin/delete.php

@@ -43,7 +43,7 @@ function delete_subdirectories($rootdir) {
 
     $dir = opendir($rootdir);
 
-    while ($file = readdir($dir)) {
+    while (false !== ($file = readdir($dir))) {
         if ($file != '.' and $file != '..') {
             $fullfile = $rootdir .'/'. $file;
             if (filetype($fullfile) == 'dir') {

admin/environment.xml

@@ -43,10 +43,12 @@
         <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
       <VENDOR name="postgres" version="7.4" />
-      <VENDOR name="mssql" version="8.0" />
+      <VENDOR name="mssql" version="9.0" />
       <VENDOR name="oracle" version="9.0" />
     </DATABASE>
-    <PHP version="4.3.0" level="required" />
+    <PHP version="4.3.0" level="required">
+       <RESTRICT function="restrict_php50_version" message="php50restricted" />
+    </PHP>
     <PHP_EXTENSIONS>
       <PHP_EXTENSION name="iconv" level="optional">
         <FEEDBACK>

admin/index.php

@@ -222,7 +222,7 @@
 /// If any new configurations were found then send to the config page to check
 
     if (!empty($configchange)) {
-        redirect("config.php");
+        redirect("config.php?installing=1");
     }
 
 /// Find and check all main modules and load them up or upgrade them if necessary
@@ -258,7 +258,7 @@
 
 /// Define the unique site ID code if it isn't already
     if (empty($CFG->siteidentifier)) {    // Unique site identification code
-        set_config('siteidentifier', random_string(32));
+        set_config('siteidentifier', random_string(32).$_SERVER['HTTP_HOST']);
     }
 
 /// Check if the guest user exists.  If not, create one.
@@ -319,10 +319,13 @@
         print_spacer(10,10);
     }
 
-    if (ini_get_bool('register_globals') && !ini_get_bool('magic_quotes_gpc')) {
-        print_simple_box(get_string('globalsquoteswarning', 'admin'), 'center', '60%');
+    if (ini_get_bool('register_globals')) {
+        print_simple_box(get_string('globalswarning', 'admin'), 'center', '60%');
     }
 
+    if (is_dataroot_insecure()) {
+        print_simple_box(get_string('datarootsecuritywarning', 'admin', $CFG->dataroot), 'center', '60%');
+    }
 
 /// If no recently cron run
     $lastcron = get_field_sql('SELECT max(lastcron) FROM ' . $CFG->prefix . 'modules');
@@ -475,14 +478,6 @@ epository').'</a></strong>',
 
     print_simple_box_end();
 
-    
-    if (optional_param('dbmigrate')) {               // ??? Is this actually used?
-        print_simple_box_start('center','60%');
-        require_once($CFG->dirroot.'/admin/utfdbmigrate.php');
-        db_migrate2utf8();
-        print_simple_box_end();
-    }
-
 
     print_footer($site);
 

admin/modules.php

@@ -177,7 +177,7 @@
             $settings = "";
         }
 
-        $count = count_records("$module->name");
+        $count = count_records_select("$module->name",'course<>0');
 
         if ($module->visible) {
             $visible = "<a href=\"modules.php?hide=$module->name&amp;sesskey=$USER->sesskey\" title=\"$strhide\">".

admin/register.php

@@ -26,7 +26,7 @@
     }
 
     if (empty($CFG->siteidentifier)) {    // Unique site identification code
-        set_config('siteidentifier', random_string(32));
+        set_config('siteidentifier', random_string(32).$_SERVER['HTTP_HOST']);
     }
 
 

admin/report/courseoverview/index.php

@@ -78,7 +78,11 @@
             error(get_string('statsnodata'),$CFG->wwwroot.'/'.$CFG->admin.'/report/courseoverview/index.php');
         }
 
-        echo '<center><img src="'.$CFG->wwwroot.'/'.$CFG->admin.'/report/courseoverview/reportsgraph.php?time='.$time.'&report='.$report.'&numcourses='.$numcourses.'" /></center>';
+        if (empty($CFG->gdversion)) {
+            echo "<center>(".get_string("gdneed").")</center>";
+        } else {
+            echo '<center><img src="'.$CFG->wwwroot.'/'.$CFG->admin.'/report/courseoverview/reportsgraph.php?time='.$time.'&report='.$report.'&numcourses='.$numcourses.'" /></center>';
+        }
         
         $table = new object();
         $table->align = array('left','center','center','center');

admin/report/spamcleaner/index.php

@@ -0,0 +1,397 @@
+<?php
+
+/**
+ * Spam Cleaner
+ *
+ * Helps an admin to clean up spam in Moodle
+ *
+ * @version $Id$
+ * @authors Dongsheng Cai, Martin Dougiamas, Amr Hourani
+ * @license http://www.gnu.org/copyleft/gpl.html GNU Public License
+ */
+
+// Configuration
+
+// List of known spammy keywords, please add more here
+
+$autokeywords = array(
+                    "<img",
+                    "fuck",
+                    "casino",
+                    "porn",
+                    "xxx",
+                    "cialis",
+                    "viagra",
+                    "poker",
+                    "warcraft"
+                );
+
+/////////////////////////////////////////////////////////////////////////////////
+
+require_once('../../../config.php');
+require_once($CFG->libdir.'/adminlib.php');
+function delete_user($user) {
+    $updateuser = new object();
+    $updateuser->id           = $user->id;
+    $updateuser->deleted      = 1;
+    $updateuser->username     = addslashes("$user->email.".time());
+    $updateuser->email        = '';
+    $updateuser->idnumber     = '';
+    $updateuser->timemodified = time();
+    if (update_record('user', $updateuser)) {
+        role_unassign(0, $user->id);
+        return true;
+    } else {
+        return false;
+    }
+}
+
+$keyword = optional_param('keyword', '', PARAM_RAW);
+$autodetect = optional_param('autodetect', '', PARAM_RAW);
+$del = optional_param('del', '', PARAM_RAW);
+$delall = optional_param('delall', '', PARAM_RAW);
+$ignore = optional_param('ignore', '', PARAM_RAW);
+$reset = optional_param('reset', '', PARAM_RAW);
+$id = optional_param('id', '', PARAM_INT);
+
+require_login();
+
+// Implement some AJAX calls 
+
+// Delete one user
+if (!empty($del) && confirm_sesskey() && ($id != $USER->id)) {
+    if (isset($SESSION->users_result[$id])) {
+        $user = $SESSION->users_result[$id];
+        if (delete_user($user)) {
+            unset($SESSION->users_result[$id]);
+            echo 1;
+        } else {
+            echo 0;
+        }
+    } else {
+        echo 0;
+    }
+    exit;
+}
+
+// Delete lots of users
+if (!empty($delall) && confirm_sesskey()) {
+    if (!empty($SESSION->users_result)) {
+        foreach ($SESSION->users_result as $userid => $user) {
+            if ($userid != $USER->id) {
+                if (delete_user($user)) {
+                    unset($SESSION->users_result[$userid]);
+                }
+            }
+        }
+    }
+    echo 1;
+    exit;
+}
+
+if (!empty($ignore)) {
+    unset($SESSION->users_result[$id]);
+    echo 1;
+    exit;
+}
+
+$strspamcleaner = get_string('spamcleaner', 'admin'); 
+$strnav = '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/index.php">'.get_string('administration').'</a> -> <a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/report.php">'. get_string('reports') .'</a> -> '.$strspamcleaner;
+// Print headers and things
+print_header($strspamcleaner, $strspamcleaner, $strnav);
+
+print_spamcleaner_javascript();
+
+print_simple_box(get_string('spamcleanerintro', 'report_spamcleaner'));
+    
+?>
+
+<div class="mdl-align">
+
+<form method="post" action="index.php">
+  <div>
+    <input type="text" name="keyword" id="keyword_el" value="<?php p($keyword) ?>" /> 
+    <input type="hidden" name="sesskey" value="<?php echo sesskey();?>" />
+    <input type="submit" value="<?php echo get_string('spamsearch', 'report_spamcleaner')?>" />
+  </div>
+</form>
+<p><?php echo get_string('spameg', 'report_spamcleaner');?></p>
+
+<hr />
+
+<form method="post"  action="index.php">
+  <div>
+    <input type="submit" name="autodetect" value="<?php echo get_string('spamauto', 'report_spamcleaner');?>" />
+  </div>
+</form>
+
+
+</div>
+
+<?php
+
+echo '<div id="result" class="mdl-align">';
+
+// Print list of resulting profiles
+
+if (!empty($keyword)) {               // Use the keyword(s) supplied by the user
+    $keywords = explode(',', $keyword);
+    foreach ($keywords as $key => $keyword) {
+        $keywords[$key] = trim($keyword);
+    }
+    search_spammers($keywords);
+
+} else if (!empty($autodetect)) {     // Use the inbuilt keyword list to detect users
+    search_spammers($autokeywords);
+}
+
+echo '</div>';
+
+/////////////////////////////////////////////////////////////////////////////////
+
+
+///  Functions 
+
+
+function search_spammers($keywords) {
+
+    global $CFG, $USER, $DB; 
+
+    if (!is_array($keywords)) {
+        $keywords = array($keywords);    // Make it into an array
+    }
+
+    $like = sql_ilike();
+
+    $keywordfull = array();
+    foreach ($keywords as $keyword) {
+        $keyword = addslashes($keyword);   // Just to be safe
+        $keywordfull[] = " description $like '%$keyword%' ";
+        $keywordfull2[] = " p.summary $like '%$keyword%' ";
+    }
+    $conditions = '( '.implode(' OR ', $keywordfull).' )';
+    $conditions2 = '( '.implode(' OR ', $keywordfull2).' )';
+
+    $sql = "SELECT * FROM {$CFG->prefix}user WHERE deleted = 0 AND id <> {$USER->id} AND $conditions";  // Exclude oneself
+    $sql2= "SELECT u.*, p.summary FROM {$CFG->prefix}user AS u, {$CFG->prefix}post AS p WHERE $conditions2 AND u.deleted = 0 AND u.id=p.userid AND u.id <> {$USER->id}";
+    $spamusers_desc = get_recordset_sql($sql);
+    $spamusers_blog = get_recordset_sql($sql2);
+
+    $keywordlist = implode(', ', $keywords);
+    print_simple_box(get_string('spamresult', 'report_spamcleaner').s($keywordlist)).' ...';
+
+    print_user_list(array($spamusers_desc, $spamusers_blog), $keywords);
+
+}
+
+function print_user_list($users_rs, $keywords) {
+    global $CFG, $SESSION;
+
+    // reset session everytime this function is called
+    $SESSION->users_result = array();
+    $count = 0;
+
+    foreach ($users_rs as $key=>$rs) {
+         while(!$rs->EOF) { 
+            $user = (object)$rs->fields;
+            if (!$count) {
+                echo '<table border="1" width="100%" id="data-grid"><tr><th>&nbsp;</th><th>'.get_string('user','admin').'</th><th>'.get_string('spamdesc', 'report_spamcleaner').'</th><th>'.get_string('spamoperation', 'report_spamcleaner').'</th></tr>';
+            }
+            $rs->MoveNext();
+            $count++;
+            filter_user($user, $keywords, $count);
+        }
+    }
+
+    if (!$count) {
+        echo get_string('spamcannotfinduser', 'report_spamcleaner');
+
+    } else {
+        echo '</table>';
+        echo '<div class="mld-align">
+              <button id="removeall_btn">'.get_string('spamdeleteall', 'report_spamcleaner').'</button>
+              </div>';
+    }
+}
+function filter_user($user, $keywords, $count) {
+    global $CFG;
+    $image_search = false;
+    if (in_array('<img', $keywords)) {
+        $image_search = true;
+    }
+    if (isset($user->summary)) {
+        $user->description = '<h3>'.get_string('spamfromblog', 'report_spamcleaner').'</h3>'.$user->summary;
+        unset($user->summary);
+    }
+    if (preg_match('#<img.*src=[\"\']('.$CFG->pixpath.')#', $user->description, $matches)
+        && $image_search) {
+        $result = false;
+        foreach ($keywords as $keyword) {
+            if (preg_match('#'.$keyword.'#', $user->description)
+                && ($keyword != '<img')) {
+                $result = true;
+            }
+        }
+        if ($result) {
+            echo print_user_entry($user, $keywords, $count);
+        } else {
+            unset($user);
+        }
+    } else {
+        echo print_user_entry($user, $keywords, $count);
+    }
+}
+
+
+function print_user_entry($user, $keywords, $count) {
+
+    global $SESSION, $CFG;
+
+    $smalluserobject = new object;      // All we need to delete them later
+    $smalluserobject->id = $user->id;
+    $smalluserobject->email = $user->email;
+    $smalluserobject->auth = $user->auth;
+    $smalluserobject->firstname = $user->firstname;
+    $smalluserobject->lastname = $user->lastname;
+
+    if (empty($SESSION->users_result[$user->id])) {
+        $SESSION->users_result[$user->id] = $smalluserobject;
+        $html = '<tr valign="top" id="row-'.$user->id.'" class="result-row">';
+        $html .= '<td width="10">'.$count.'</td>';
+        $html .= '<td width="30%" align="left"><a href="'.$CFG->wwwroot."/user/view.php?course=1&amp;id=".$user->id.'" title="'.s($user->username).'">'.fullname($user).'</a>';
+
+        $html .= "<ul>";
+        $profile_set = array('city'=>true, 'country'=>true, 'email'=>true);
+        foreach ($profile_set as $key=>$value) {
+            if (isset($user->$key)){
+                $html .= '<li>'.$user->$key.'</li>';
+            }
+        }
+        $html .= "</ul>";
+        $html .= '</td>';
+
+        foreach ($keywords as $keyword) {
+            $user->description = highlight($keyword, $user->description);
+        }
+
+        $html .= '<td align="left">'.format_text($user->description, FORMAT_MOODLE).'</td>';
+        $html .= '<td width="100px" align="center">';
+        $html .= '<button onclick="del_user(this,'.$user->id.')">'.get_string('deleteuser', 'admin').'</button><br />';
+        $html .= '<button onclick="ignore_user(this,'.$user->id.')">'.get_string('ignore', 'admin').'</button>';
+        $html .= '</td>';
+        $html .= '</tr>';
+        return $html;
+    } else {
+        return null;
+    }
+
+
+}
+
+function print_spamcleaner_javascript() {
+    global $CFG;
+
+$sesskey = sesskey();
+
+?>
+<script type="text/javascript" src="<?php echo $CFG->wwwroot;?>/lib/yui/yahoo-dom-event/yahoo-dom-event.js"></script>
+<script type="text/javascript" src="<?php echo $CFG->wwwroot;?>/lib/yui/connection/connection-min.js"></script>
+<script type="text/javascript">
+//<![CDATA[
+var service_url = '<?php echo $CFG->wwwroot;?>/admin/report/spamcleaner/index.php';
+function ajax(url, callback)
+{
+    method = 'POST';
+    if (window.XMLHttpRequest) {
+        var req = new XMLHttpRequest();
+    } else {
+        var MSXML = ['MSXML2.XMLHTTP.6.0', 'MSXML2.XMLHTTP.3.0', 'MSXML2.XMLHTTP.5.0', 'MSXML2.XMLHTTP.4.0', 'MSXML2.XMLHTTP', 'Microsoft.XMLHTTP'];
+        for(var n = 0; n < MSXML.length; n ++) {
+            try {
+                var req = new ActiveXObject(MSXML[n]);       
+                break;
+            } catch(e) {
+            }
+        }
+    }
+    with(req) {
+        try {
+            open(method, url, true);
+            setRequestHeader('Content-Type', 'application/x-www-form-urlencoded; charset=UTF-8');
+            send(null);           
+        } catch(e) {
+            alert(e);
+        }
+        onreadystatechange = function()
+        {
+            if (req.readyState == 4)
+            {
+                callback(req.responseText, req.status);
+                delete(req);
+            }
+        }
+    }
+}
+var row = null;
+function delall_cb (text) {
+    if(text){
+        window.location.href=window.location.href;
+    }
+}
+function init() {
+    var remove_all = document.getElementById('removeall_btn');
+    if(remove_all){
+        remove_all.onclick = function(){
+            var yes = confirm('<?php echo get_string('spamdeleteallconfirm', 'report_spamcleaner');?>');
+            if(yes){
+                ajax(service_url + '?delall=yes&sesskey=<?php echo $sesskey;?>', delall_cb);
+            }
+        }
+    }
+}
+function del_cb (text) {
+    if(row) {
+        if(text){
+            while(row.tagName != 'TR') {
+                row = row.parentNode;
+            }
+            row.parentNode.removeChild(row);
+            row = null;
+        } else {
+            alert('<?php echo get_string('spamcannotdelete', 'report_spamcleaner');?>');
+        }
+    }
+}
+function ignore_cb (text) {
+        if(row) {
+            if(text){
+                while(row.tagName != 'TR') {
+                    row = row.parentNode;
+                }
+                row.parentNode.removeChild(row);
+                row = null;
+            }
+        }
+}
+function del_user(obj, id) {
+    var yes = confirm('<?php echo get_string('spamdeleteconfirm', 'report_spamcleaner');?>');
+    if(yes){
+        row = obj;
+        ajax(service_url + '?del=yes&sesskey=<?php echo $sesskey;?>&id='+id, del_cb);
+    }
+}
+function ignore_user(obj, id) {
+    row = obj;
+    ajax(service_url + '?ignore=yes&sesskey=<?php echo $sesskey;?>&id='+id, ignore_cb);
+}
+window.onload = function(){
+    init();
+}
+//]]>
+</script>
+
+<?php 
+}
+
+print_footer();
+?>

admin/report/spamcleaner/mod.php

@@ -0,0 +1,318 @@
+<?php
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
+$keyword = optional_param('keyword', '', PARAM_RAW);
+$autodetect = optional_param('autodetect', '', PARAM_RAW);
+$reset = optional_param('reset', '', PARAM_RAW);
+$id = optional_param('id', '', PARAM_INT);
+
+// List of known spammy keywords, please add more here
+
+$autokeywords = array(
+                    "<img",
+                    "fuck",
+                    "casino",
+                    "porn",
+                    "xxx",
+                    "cialis",
+                    "viagra",
+                    "poker",
+                    "warcraft"
+                );
+
+// Print headers and things
+
+print_heading(get_string('spamcleaner', 'admin'));
+print_spamcleaner_javascript();
+
+print_simple_box(get_string('spamcleanerintro', 'report_spamcleaner'));
+    
+?>
+
+<div class="mdl-align">
+
+<form method="post" action="report.php">
+  <div>
+    <input type="text" name="keyword" id="keyword_el" value="<?php p($keyword) ?>" /> 
+    <input type="hidden" name="sesskey" value="<?php echo sesskey();?>" />
+    <input type="submit" value="<?php echo get_string('spamsearch', 'report_spamcleaner')?>" />
+  </div>
+</form>
+<p><?php echo get_string('spameg', 'report_spamcleaner');?></p>
+
+<hr />
+
+<form method="post"  action="report.php">
+  <div>
+    <input type="submit" name="autodetect" value="<?php echo get_string('spamauto', 'report_spamcleaner');?>" />
+  </div>
+</form>
+
+
+</div>
+
+<?php
+
+echo '<div id="result" class="mdl-align">';
+
+// Print list of resulting profiles
+
+if (!empty($keyword)) {               // Use the keyword(s) supplied by the user
+    $keywords = explode(',', $keyword);
+    foreach ($keywords as $key => $keyword) {
+        $keywords[$key] = trim($keyword);
+    }
+    search_spammers($keywords);
+
+} else if (!empty($autodetect)) {     // Use the inbuilt keyword list to detect users
+    search_spammers($autokeywords);
+}
+
+echo '</div>';
+
+/////////////////////////////////////////////////////////////////////////////////
+
+
+///  Functions 
+
+
+function search_spammers($keywords) {
+
+    global $CFG, $USER, $DB; 
+
+    if (!is_array($keywords)) {
+        $keywords = array($keywords);    // Make it into an array
+    }
+
+    $like = sql_ilike();
+
+    $keywordfull = array();
+    foreach ($keywords as $keyword) {
+        $keyword = addslashes($keyword);   // Just to be safe
+        $keywordfull[] = " description $like '%$keyword%' ";
+        $keywordfull2[] = " p.summary $like '%$keyword%' ";
+    }
+    $conditions = '( '.implode(' OR ', $keywordfull).' )';
+    $conditions2 = '( '.implode(' OR ', $keywordfull2).' )';
+
+    $sql = "SELECT * FROM {$CFG->prefix}user WHERE deleted = 0 AND id <> {$USER->id} AND $conditions";  // Exclude oneself
+    $sql2= "SELECT u.*, p.summary FROM {$CFG->prefix}user AS u, {$CFG->prefix}post AS p WHERE $conditions2 AND u.deleted = 0 AND u.id=p.userid AND u.id <> {$USER->id}";
+    $spamusers_desc = get_recordset_sql($sql);
+    $spamusers_blog = get_recordset_sql($sql2);
+
+    $keywordlist = implode(', ', $keywords);
+    print_simple_box(get_string('spamresult', 'report_spamcleaner').s($keywordlist)).' ...';
+
+    print_user_list(array($spamusers_desc, $spamusers_blog), $keywords);
+
+}
+
+function print_user_list($users_rs, $keywords) {
+    global $CFG, $SESSION;
+
+    // reset session everytime this function is called
+    $SESSION->users_result = array();
+    $count = 0;
+
+    foreach ($users_rs as $key=>$rs) {
+         while(!$rs->EOF) { 
+            $user = (object)$rs->fields;
+            if (!$count) {
+                echo '<table border="1" width="100%" id="data-grid"><tr><th>&nbsp;</th><th>'.get_string('user','admin').'</th><th>'.get_string('spamdesc', 'report_spamcleaner').'</th><th>'.get_string('spamoperation', 'report_spamcleaner').'</th></tr>';
+            }
+            $rs->MoveNext();
+            $count++;
+            filter_user($user, $keywords, $count);
+        }
+    }
+
+    if (!$count) {
+        echo get_string('spamcannotfinduser', 'report_spamcleaner');
+
+    } else {
+        echo '</table>';
+        echo '<div class="mld-align">
+              <button id="removeall_btn">'.get_string('spamdeleteall', 'report_spamcleaner').'</button>
+              </div>';
+    }
+}
+function filter_user($user, $keywords, $count) {
+    global $CFG;
+    $image_search = false;
+    if (in_array('<img', $keywords)) {
+        $image_search = true;
+    }
+    if (isset($user->summary)) {
+        $user->description = '<h3>'.get_string('spamfromblog', 'report_spamcleaner').'</h3>'.$user->summary;
+        unset($user->summary);
+    }
+    if (preg_match('#<img.*src=[\"\']('.$CFG->pixpath.')#', $user->description, $matches)
+        && $image_search) {
+        $result = false;
+        foreach ($keywords as $keyword) {
+            if (preg_match('#'.$keyword.'#', $user->description)
+                && ($keyword != '<img')) {
+                $result = true;
+            }
+        }
+        if ($result) {
+            echo print_user_entry($user, $keywords, $count);
+        } else {
+            unset($user);
+        }
+    } else {
+        echo print_user_entry($user, $keywords, $count);
+    }
+}
+
+
+function print_user_entry($user, $keywords, $count) {
+
+    global $SESSION, $CFG;
+
+    $smalluserobject = new object;      // All we need to delete them later
+    $smalluserobject->id = $user->id;
+    $smalluserobject->email = $user->email;
+    $smalluserobject->auth = $user->auth;
+    $smalluserobject->firstname = $user->firstname;
+    $smalluserobject->lastname = $user->lastname;
+
+    if (empty($SESSION->users_result[$user->id])) {
+        $SESSION->users_result[$user->id] = $smalluserobject;
+        $html = '<tr valign="top" id="row-'.$user->id.'" class="result-row">';
+        $html .= '<td width="10">'.$count.'</td>';
+        $html .= '<td width="30%" align="left"><a href="'.$CFG->wwwroot."/user/view.php?course=1&amp;id=".$user->id.'" title="'.s($user->username).'">'.fullname($user).'</a>';
+
+        $html .= "<ul>";
+        $profile_set = array('city'=>true, 'country'=>true, 'email'=>true);
+        foreach ($profile_set as $key=>$value) {
+            if (isset($user->$key)){
+                $html .= '<li>'.$user->$key.'</li>';
+            }
+        }
+        $html .= "</ul>";
+        $html .= '</td>';
+
+        foreach ($keywords as $keyword) {
+            $user->description = highlight($keyword, $user->description);
+        }
+
+        $html .= '<td align="left">'.format_text($user->description, FORMAT_MOODLE).'</td>';
+        $html .= '<td width="100px" align="center">';
+        $html .= '<button onclick="del_user(this,'.$user->id.')">'.get_string('deleteuser', 'admin').'</button><br />';
+        $html .= '<button onclick="ignore_user(this,'.$user->id.')">'.get_string('ignore', 'admin').'</button>';
+        $html .= '</td>';
+        $html .= '</tr>';
+        return $html;
+    } else {
+        return null;
+    }
+
+
+}
+
+function print_spamcleaner_javascript()  {
+    global $CFG;
+
+$sesskey = sesskey();
+
+?>
+<script type="text/javascript">
+//<![CDATA[
+var service_url = '<?php echo $CFG->wwwroot;?>/admin/report/spamcleaner/index.php';
+function ajax(url, callback)
+{
+    method = 'POST';
+    if (window.XMLHttpRequest) {
+        var req = new XMLHttpRequest();
+    } else {
+        var MSXML = ['MSXML2.XMLHTTP.6.0', 'MSXML2.XMLHTTP.3.0', 'MSXML2.XMLHTTP.5.0', 'MSXML2.XMLHTTP.4.0', 'MSXML2.XMLHTTP', 'Microsoft.XMLHTTP'];
+        for(var n = 0; n < MSXML.length; n ++) {
+            try {
+                var req = new ActiveXObject(MSXML[n]);       
+                break;
+            } catch(e) {
+            }
+        }
+    }
+    with(req) {
+        try {
+            open(method, url, true);
+            setRequestHeader('Content-Type', 'application/x-www-form-urlencoded; charset=UTF-8');
+            send(null);           
+        } catch(e) {
+            alert(e);
+        }
+        onreadystatechange = function()
+        {
+            if (req.readyState == 4)
+            {
+                callback(req.responseText, req.status);
+                delete(req);
+            }
+        }
+    }
+}
+var row = null;
+function delall_cb (text) {
+    if(text){
+        window.location.href=window.location.href;
+    }
+}
+function init() {
+    var remove_all = document.getElementById('removeall_btn');
+    if(remove_all){
+        remove_all.onclick = function(){
+            var yes = confirm('<?php echo get_string('spamdeleteallconfirm', 'report_spamcleaner');?>');
+            if(yes){
+                ajax(service_url + '?delall=yes&sesskey=<?php echo $sesskey;?>', delall_cb);
+            }
+        }
+    }
+}
+function del_cb (text) {
+    if(row) {
+        if(text){
+            while(row.tagName != 'TR') {
+                row = row.parentNode;
+            }
+            row.parentNode.removeChild(row);
+            row = null;
+        } else {
+            alert('<?php echo get_string('spamcannotdelete', 'report_spamcleaner');?>');
+        }
+    }
+}
+function ignore_cb (text) {
+        if(row) {
+            if(text){
+                while(row.tagName != 'TR') {
+                    row = row.parentNode;
+                }
+                row.parentNode.removeChild(row);
+                row = null;
+            }
+        }
+}
+function del_user(obj, id) {
+    var yes = confirm('<?php echo get_string('spamdeleteconfirm', 'report_spamcleaner');?>');
+    if(yes){
+        row = obj;
+        ajax(service_url + '?del=yes&sesskey=<?php echo $sesskey;?>&id='+id, del_cb);
+    }
+}
+function ignore_user(obj, id) {
+    row = obj;
+    ajax(service_url + '?ignore=yes&sesskey=<?php echo $sesskey;?>&id='+id, ignore_cb);
+}
+window.onload = function(){
+    init();
+}
+//]]>
+</script>
+
+<?php 
+}
+?>

admin/upgradeforumread.php

@@ -2,6 +2,7 @@
 
     require_once('../config.php');
     require_once($CFG->dirroot.'/mod/forum/lib.php');
+    require_once($CFG->libdir.'/adminlib.php');
 
     $confirm = optional_param('confirm', 0, PARAM_BOOL);
 

admin/uploaduser.php

@@ -264,7 +264,6 @@ if ($um->preprocess_files() && confirm_sesskey()) {
                             //This can be used to obtain a list of userids for existing users
                             notify("$user->id ".get_string('usernotaddedregistered', 'error', $username));
                             $userserrors++;
-                            continue;
                         }
 
                     } else { // new user

admin/user.php

@@ -158,7 +158,7 @@
                 $updateuser = new object();
                 $updateuser->id = $user->id;
                 $updateuser->deleted = "1";
-                $updateuser->username = "$user->email.".time();  // Remember it just in case
+                $updateuser->username = addslashes("$user->email.".time());  // Remember it just in case
                 $updateuser->email = "";               // Clear this field to free it up
                 $updateuser->idnumber = "";               // Clear this field to free it up
                 $updateuser->timemodified = time();

admin/utfdbmigrate.php

@@ -13,7 +13,7 @@
 	
 	$customlang = array();
 	
-	$enc = array('af' => 'iso-8859-1', 'ar' => 'windows-1256', 'be' => 'windows-1251', 'bg' => 'windows-1251', 'bs' => 'windows-1250', 'ca' => 'iso-8859-1', 'cs' => 'iso-8859-2', 'da' => 'iso-8859-1', 'de' => 'iso-8859-1', 'de_du' => 'iso-8859-1', 'de_utf8' => 'utf-8', 'el' => 'windows-1253', 'en' => 'iso-8859-1', 'en_ja' => 'euc-jp', 'en_us' => 'iso-8859-1', 'en_utf8' => 'utf-8', 'es' => 'iso-8859-1', 'es_ar' => 'iso-8859-1', 'es_es' => 'iso-8859-1', 'es_mx' => 'iso-8859-1', 'et' => 'iso-8859-1', 'eu' => 'iso-8859-1', 'fa' => 'windows-1256', 'fa_utf8' => 'utf-8', 'fi' => 'iso-8859-1', 'fil' => 'iso-8859-15', 'fr' => 'iso-8859-1', 'fr_ca' => 'iso-8859-15', 'ga' => 'iso-8859-1', 'gl' => 'iso-8859-1', 'he' => 'ISO-8859-8-I', 'he_utf8' => 'utf-8', 'hi' => 'iso-8859-1', 'hr' => 'windows-1250', 'hr_utf8' => 'utf-8', 'hu' => 'iso-8859-2', 'id' => 'iso-8859-1', 'it' => 'iso-8859-1', 'ja' => 'EUC-JP', 'ja_utf8' => 'UTF-8', 'ka_utf8' => 'UTF-8', 'km_utf8' => 'UTF-8', 'kn_utf8' => 'utf-8', 'ko' => 'EUC-KR', 'ko_utf8' => 'UTF-8', 'lt' => 'windows-1257', 'lv' => 'ISO-8859-4', 'mi_nt' => 'iso-8859-1', 'mi_tn_utf8' => 'utf-8', 'ms' => 'iso-8859-1', 'nl' => 'iso-8859-1', 'nn' => 'iso-8859-1', 'no' => 'iso-8859-1', 'no_gr' => 'iso-8859-1', 'pl' => 'iso-8859-2', 'pt' => 'iso-8859-1', 'pt_br' => 'iso-8859-1', 'ro' => 'iso-8859-2', 'ru' => 'windows-1251', 'sk' => 'iso-8859-2', 'sl' => 'iso-8859-2', 'sl_utf8' => 'utf-8', 'so' => 'iso-8859-1', 'sq' => 'iso-8859-1', 'sr_utf8' => 'utf-8', 'sv' => 'iso-8859-1', 'th' => 'TIS-620', 'th_utf8' => 'UTF-8', 'tl' => 'iso-8859-15', 'tl_utf8' => 'UTF-8', 'tr' => 'iso-8859-9', 'uk' => 'windows-1251', 'vi_utf8' => 'UTF-8', 'zh_cn' => 'GB18030', 'zh_cn_utf8' => 'UTF-8', 'zh_tw' => 'Big5', 'zh_tw_utf8' => 'UTF-8');
+	$enc = array('af' => 'iso-8859-1', 'ar' => 'windows-1256', 'be' => 'windows-1251', 'bg' => 'windows-1251', 'bs' => 'windows-1250', 'ca' => 'iso-8859-1', 'cs' => 'iso-8859-2', 'da' => 'iso-8859-1', 'de' => 'iso-8859-1', 'de_du' => 'iso-8859-1', 'de_utf8' => 'utf-8', 'el' => 'windows-1253', 'en' => 'iso-8859-1', 'en_ja' => 'euc-jp', 'en_us' => 'iso-8859-1', 'en_utf8' => 'utf-8', 'es' => 'iso-8859-1', 'es_ar' => 'iso-8859-1', 'es_es' => 'iso-8859-1', 'es_mx' => 'iso-8859-1', 'et' => 'iso-8859-1', 'eu' => 'iso-8859-1', 'fa' => 'windows-1256', 'fa_utf8' => 'utf-8', 'fi' => 'iso-8859-1', 'fil' => 'iso-8859-15', 'fr' => 'iso-8859-1', 'fr_ca' => 'iso-8859-15', 'ga' => 'iso-8859-1', 'gl' => 'iso-8859-1', 'he' => 'ISO-8859-8-I', 'he_utf8' => 'utf-8', 'hi' => 'iso-8859-1', 'hr' => 'windows-1250', 'hr_utf8' => 'utf-8', 'hu' => 'iso-8859-2', 'id' => 'iso-8859-1', 'is' => 'iso-8859-1', 'it' => 'iso-8859-1', 'ja' => 'EUC-JP', 'ja_utf8' => 'UTF-8', 'ka_utf8' => 'UTF-8', 'km_utf8' => 'UTF-8', 'kn_utf8' => 'utf-8', 'ko' => 'EUC-KR', 'ko_utf8' => 'UTF-8', 'lt' => 'windows-1257', 'lv' => 'ISO-8859-4', 'mi_nt' => 'iso-8859-1', 'mi_tn_utf8' => 'utf-8', 'ms' => 'iso-8859-1', 'nl' => 'iso-8859-1', 'nn' => 'iso-8859-1', 'no' => 'iso-8859-1', 'no_gr' => 'iso-8859-1', 'pl' => 'iso-8859-2', 'pt' => 'iso-8859-1', 'pt_br' => 'iso-8859-1', 'ro' => 'iso-8859-2', 'ru' => 'windows-1251', 'sk' => 'iso-8859-2', 'sl' => 'iso-8859-2', 'sl_utf8' => 'utf-8', 'so' => 'iso-8859-1', 'sq' => 'iso-8859-1', 'sr_utf8' => 'utf-8', 'sv' => 'iso-8859-1', 'th' => 'TIS-620', 'th_utf8' => 'UTF-8', 'tl' => 'iso-8859-15', 'tl_utf8' => 'UTF-8', 'tr' => 'iso-8859-9', 'uk' => 'windows-1251', 'vi_utf8' => 'UTF-8', 'zh_cn' => 'GB18030', 'zh_cn_utf8' => 'UTF-8', 'zh_tw' => 'Big5', 'zh_tw_utf8' => 'UTF-8');
 	
 	/**************************************
 	 * Custom lang pack handling 		  *
@@ -87,7 +87,10 @@
         print_simple_box_end();
         db_migrate2utf8();
         print_heading('db unicode migration has been completed!');
-        unlink($filename);    //no longer in maintenance mode
+        if (!get_config('', 'migrate_maintmode')) { // already in maint mode
+            unlink($filename);    //no longer in maintenance mode
+        }
+        delete_records('config', 'name', 'migrate_maintmode');
         @require_logout();
         print_continue($CFG->wwwroot.'/'.$CFG->admin.'/langimport.php');
     }
@@ -115,12 +118,16 @@
             //put the site in maintenance mode
             check_dir_exists($CFG->dataroot.'/'.SITEID, true);
 
-            if (touch($filename)) {
-                $file = fopen($filename, 'w');
-                fwrite($file, get_string('maintinprogress','admin'));
-                fclose($file);
+            if (file_exists($filename)) {
+                set_config('migrate_maintmode', 1); // already in maintenance mode
             } else {
-                notify (get_string('maintfileopenerror','admin'));
+                if (touch($filename)) {
+                    $file = fopen($filename, 'w');
+                    fwrite($file, get_string('maintinprogress','admin'));
+                    fclose($file);
+                } else {
+                    notify (get_string('maintfileopenerror','admin'));
+                }
             }
             //print second confirmation box
             echo '<form name="migratefrom" action="utfdbmigrate.php" method="POST">';

auth/db/lib.php

@@ -211,7 +211,7 @@ function auth_sync_users ($do_updates=0) {
         $updatekeys = array();
         foreach ($all_keys as $key) {
             if (preg_match('/^field_updatelocal_(.+)$/',$key, $match)) {
-                if ($pcfg->{$match[0]}) { // if it has a true value
+                if ($pcfg->{$key} === 'onlogin') {
                     array_push($updatekeys, $match[1]); // the actual key name
                 }
             }

auth/fc/fcFPP.php

@@ -16,7 +16,8 @@
 /*                                                                      */
 /* This program is free software. You can redistribute it and/or modify */
 /* it under the terms of the GNU General Public License as published by */
-/* the Free Software Foundation; either version 2 of the License.       */
+/* the Free Software Foundation; either version 2 of the License or any */
+/* later version.                                                       */
 /************************************************************************/
 /* Author: Torsten Anderson, torsten.anderson@skeria.skelleftea.se
  */
@@ -111,7 +112,8 @@ class fcFPP
 		$this->_user = $userid;
 		$this->_pwd  = $passwd; 
 		return TRUE;		
-	    } elseif (preg_match ("/^\Sorry/",$line)){	//Denied access but a valid user and password
+        } elseif (strpos($line, 'You are not allowed')){ // Denied access but a valid user and password
+                                                         // "Sorry. You are not allowed to login with the FPP interface"
 	    	return TRUE;
 	    } else {					//Invalid user or password
 		return FALSE;
@@ -215,4 +217,4 @@ class fcFPP
 }
    
 
-?>
+?>

auth/ldap/lib.php

@@ -711,7 +711,7 @@ function auth_ldap_bulk_insert($users){
     // bulk insert -- superfast with $bulk_insert_records
     $sql = 'INSERT INTO '.$CFG->prefix.'extuser (idnumber) VALUES ';
     // make those values safe
-    array_map('addslashes', $users);
+    $users = array_map('addslashes', $users);
     // join and quote the whole lot
     $sql = $sql . '(\'' . join('\'),(\'', $users) . '\')';
     print "+ " . count($users) . " users\n";

auth/shibboleth/lib.php

@@ -1,6 +1,7 @@
 <?PHP  // $Id$
 //CHANGELOG:
 //28.10.2004 SHIBBOLETH Authentication functions v.0.1
+//2005-2006 Various extensions and fixes by Lukas Haemmerle
 //Distributed under GPL (c)Markus Hagman 2004-
 
 function auth_user_login($username, $password) {
@@ -41,9 +42,9 @@ function auth_get_userinfo($username) {
   
     foreach ($attrmap as $key=>$value) {
         if (!empty($CFG->unicodedb)) {
-            $result[$key]=$_SERVER[$value];
+            $result[$key]=get_first_string($_SERVER[$value]);
         } else {
-            $result[$key]=utf8_decode($_SERVER[$value]);
+            $result[$key]=utf8_decode(get_first_string($_SERVER[$value]));
         }
     }
 
@@ -84,4 +85,15 @@ function auth_shib_attributes(){
 
     return $moodleattributes;
 }
+
+
+function get_first_string($string){
+// Cleans and returns first of potential many values (multi-valued attributes)
+
+    $list = split( ';', $string);
+    $clean_string = rtrim($list[0]);
+
+    return $clean_string;
+}
+
 ?>

backup/backup.php

@@ -17,13 +17,7 @@
 
     if (!empty($id)) {
         if (!isteacheredit($id)) {
-            if (empty($to)) {
-                error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
-            } else {
-                if (!isteacheredit($to)) {
-                    error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
-                }
-            }
+            error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
     } else {
         if (!isadmin()) {
@@ -31,6 +25,12 @@
         }
     }
 
+    if (!empty($to)) {
+        if (!isteacheredit($to)) {
+            error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
+        }
+    }
+
     //Check site
     if (!$site = get_site()) {
         error("Site not found!");
@@ -128,7 +128,7 @@
     }
     print_simple_box_end();
 
-    //Print footer  
+    //Print footer
     print_footer();
 
 ?>

backup/backup_scheduled.php

@@ -408,8 +408,8 @@ function schedule_backup_course_configure($course,$starttime = 0) {
                     if (empty($preferences->mods[$mod->modname]->instances)) {
                         $preferences->mods[$mod->modname]->instances = array(); // avoid warnings
                     }
-                    $preferences->mods[$mod->modname]->instances[$mod->instance]->backup = $preferences->mods[$modname]->backup;
-                    $preferences->mods[$mod->modname]->instances[$mod->instance]->userinfo = $preferences->mods[$modname]->userinfo;
+                    $preferences->mods[$mod->modname]->instances[$mod->instance]->backup = $preferences->mods[$mod->modname]->backup;
+                    $preferences->mods[$mod->modname]->instances[$mod->instance]->userinfo = $preferences->mods[$mod->modname]->userinfo;
                     // there isn't really a nice way to do this...
                     $preferences->mods[$mod->modname]->instances[$mod->instance]->name = get_field($mod->modname,'name','id',$mod->instance);
                 }
@@ -772,7 +772,9 @@ function schedule_backup_course_delete_old_files($preferences,$starttime=0) {
         $dirtocheck = $CFG->dataroot."/".$preferences->backup_course."/backupdata";
     }
     schedule_backup_log($starttime,$preferences->backup_course,"    checking $dirtocheck");
-    mtrace("            Keeping backup files in $dirtocheck");
+    if ($CFG->debug > 7) {
+        mtrace("            Keeping backup files in $dirtocheck");
+    }
 
     //Get all the files in $dirtocheck
     $files = get_directory_list($dirtocheck,"",false);

backup/backuplib.php

@@ -521,7 +521,8 @@
             fwrite ($bf,full_tag("INCLUDED",4,false,$included));
             fwrite ($bf,full_tag("USERINFO",4,false,$userinfo));
 
-            if (is_array($preferences->mods[$element->name]->instances)
+            if (isset($preferences->mods[$element->name]->instances)
+                && is_array($preferences->mods[$element->name]->instances)
                 && count($preferences->mods[$element->name]->instances)) {
                 fwrite ($bf, start_tag("INSTANCES",4,true));
                 foreach ($preferences->mods[$element->name]->instances as $id => $object) {
@@ -1239,7 +1240,8 @@
                     //See if it is a valid module to backup
                     if ($log->module == "course" or 
                         $log->module == "user" or
-                        $preferences->mods[$log->module]->backup == 1) {
+                        (array_key_exists($log->module, $preferences->mods) and $preferences->mods[$log->module]->backup == 1)) {
+                        // logs with 'upload' in module field are ignored, there is no restore code anyway 
                         //Begin log tag
                          fwrite ($bf,start_tag("LOG",3,true));
     
@@ -1661,7 +1663,8 @@
 
         require_once($CFG->dirroot.'/mod/'.$module.'/backuplib.php');
 
-        if (is_array($preferences->mods[$module]->instances)) {
+        if (isset($preferences->mods[$module]->instances)
+            && is_array($preferences->mods[$module]->instances)) {
             $onemodbackup = $module.'_backup_one_mod';
             if (function_exists($onemodbackup)) {
                 foreach ($preferences->mods[$module]->instances as $instance => $object) {

backup/bb/restore_bb.php

@@ -9,7 +9,7 @@ require_once($CFG->dirroot.'/backup/bb/xsl_emulate_xslt.inc');
   
 function get_subdirs($directory){
     $opendirectory = opendir( $directory );
-    while($filename = readdir($opendirectory)) {
+    while(false !== ($filename = readdir($opendirectory))) {
         if (is_dir($directory.$filename) and $filename != ".." and $filename != "."){
             $subdirs[] = $filename;
         }

backup/db/postgres7.php

@@ -51,24 +51,14 @@ function backup_upgrade($oldversion=0) {
     }
 
     if ($oldversion < 2006042801) {
-        modify_database('', 'ALTER TABLE prefix_backup_log
-            ALTER COLUMN "time" TYPE integer,
-            ALTER COLUMN "time" SET DEFAULT 0,
-            ALTER COLUMN laststarttime TYPE integer,
-            ALTER COLUMN laststarttime SET DEFAULT 0,
-            ALTER COLUMN courseid TYPE integer,
-            ALTER COLUMN courseid SET DEFAULT 0');
-
-        modify_database('', 'ALTER TABLE mdl_backup_courses
-            ALTER COLUMN lastendtime TYPE integer,
-            ALTER COLUMN lastendtime SET DEFAULT 0,
-            ALTER COLUMN laststarttime TYPE integer,
-            ALTER COLUMN laststarttime SET DEFAULT 0,
-            ALTER COLUMN courseid TYPE integer,
-            ALTER COLUMN courseid SET DEFAULT 0,
-            ALTER COLUMN nextstarttime TYPE integer,
-            ALTER COLUMN nextstarttime SET DEFAULT 0');
+        table_column('backup_log', 'time', 'time', 'integer', '', '', '0');
+        table_column('backup_log', 'laststarttime', 'laststarttime', 'integer', '', '', '0');
+        table_column('backup_log', 'courseid', 'courseid', 'integer', '', '', '0');
 
+        table_column('backup_courses', 'lastendtime', 'lastendtime', 'integer', '', '', '0');
+        table_column('backup_courses', 'laststarttime', 'laststarttime', 'integer', '', '', '0');
+        table_column('backup_courses', 'courseid', 'courseid', 'integer', '', '', '0');
+        table_column('backup_courses', 'nextstarttime', 'nextstarttime', 'integer', '', '', '0');
     }
 
     //Finally, return result

backup/lib.php

@@ -118,7 +118,7 @@
         }
 
         // Loop through all directory entries, and construct two temporary arrays containing files and sub directories
-        while($entry = readdir($handle)) {
+        while(false !== ($entry = readdir($handle))) {
             if (is_dir($dir. $slash .$entry) && $entry != ".." && $entry != "." && $entry != $excludeddir) {
                 $dir_subdirs[] = $dir. $slash .$entry;
             }
@@ -195,7 +195,7 @@
         $results = null;
   
         $dir = opendir($rootdir);
-        while ($file=readdir($dir)) {
+        while (false !== ($file=readdir($dir))) {
             if ($file=="." || $file=="..") {
                 continue;
             }
@@ -214,7 +214,7 @@
         $results = "";
  
         $dir = opendir($rootdir);
-        while ($file=readdir($dir)) {
+        while (false !== ($file=readdir($dir))) {
             if ($file=="." || $file=="..") {
                 continue;
             }
@@ -293,13 +293,15 @@
 
         global $CFG;
 
+        $status = true; // Initialize this, next code will change its value if needed
+
         if (!is_dir($to_file)) {
             //echo "<br />Creating ".$to_file;                                //Debug
             umask(0000);
             $status = mkdir($to_file,$CFG->directorypermissions);
         }
         $dir = opendir($from_file);
-        while ($file=readdir($dir)) {
+        while (false !== ($file=readdir($dir))) {
             if ($file=="." || $file=="..") {
                 continue;
             }

backup/restore_execute.html

@@ -53,6 +53,15 @@
         print_simple_box(get_string("restorefinished"),"center");
     } else {
         print_simple_box(get_string("importdatafinished"),"center");
+        $file = $CFG->dataroot . '/'
+            . $SESSION->import_preferences->backup_course
+            . '/backupdata/' . $SESSION->import_preferences->backup_name;
+        if (is_readable($file)) {
+            unlink($file);
+        }
+        else {
+            error_log("import course data: couldn't unlink $file");
+        }
         unset($SESSION->restore);
     }
     print_continue("$CFG->wwwroot/course/view.php?id=".$restore->course_id);

backup/restorelib.php

@@ -1077,7 +1077,7 @@
                     if (!$preferencescount) {
                         $continue = false;
                         if (!defined('RESTORE_SILENTLY')) {
-                            echo '<li>'.get_string('backupwithoutgradebook','grade').'</li>';
+                            echo '<li>'.get_string('backupwithoutgradebook','grades').'</li>';
                         }
                     }
 
@@ -1088,7 +1088,7 @@
                             if ($pref_rec->value == 0) {
                                 $continue = false;
                                 if (!defined('RESTORE_SILENTLY')) {
-                                    echo '<li>'.get_string('respectingcurrentdata','grade').'</li>';
+                                    echo '<li>'.get_string('respectingcurrentdata','grades').'</li>';
                                 }
                             }
                         }
@@ -1382,6 +1382,19 @@
                     $user->lang = 'mi_nt';
                 }
 
+                //Country list updates - MDL-13060 
+                //Any user whose country code has been deleted or modified needs to be assigned a valid one.
+                $country_update_map = array(
+                    'ZR' => 'CD', 
+                    'TP' => 'TL',
+                    'FX' => 'FR', 
+                    'KO' => 'RS', 
+                    'CS' => 'RS',
+                    'WA' => 'GB');
+                if (array_key_exists($user->country, $country_update_map)) {
+                    $user->country = $country_update_map[$user->country];
+                }
+
                 //Check if it's admin and coursecreator
                 $is_admin =         !empty($user->roles['admin']);
                 $is_coursecreator = !empty($user->roles['coursecreator']);
@@ -1858,14 +1871,7 @@
                 foreach ($info as $category) {
                     //Skip empty categories (some backups can contain them)
                     if (!empty($category->id)) {
-                        $catrestore = "restore_question_categories";
-                        if (function_exists($catrestore)) {
-                            //print_object ($category);                                                //Debug
-                            $status = $catrestore($category,$restore);
-                        } else {
-                            //Something was wrong. Function should exist.
-                            $status = false;
-                        }
+                        $status = restore_question_categories($category,$restore);
                     }
                 }
 
@@ -2203,19 +2209,6 @@
                                 //Assign it to admin
                                 $eve->userid = $adminid;
                             }
-
-                            //We must recode the repeatid if the event has it
-                            if (!empty($eve->repeatid)) {
-                                $repeat_rec = backup_getid($restore->backup_unique_code,"event_repeatid",$eve->repeatid);
-                                if ($repeat_rec) {    //Exists, so use it...
-                                    $eve->repeatid = $repeat_rec->new_id;
-                                } else {              //Doesn't exists, calculate the next and save it
-                                    $oldrepeatid = $eve->repeatid;
-                                    $max_rec = get_record_sql('SELECT 1, MAX(repeatid) AS repeatid FROM '.$CFG->prefix.'event');
-                                    $eve->repeatid = empty($max_rec) ? 1 : $max_rec->repeatid + 1;
-                                    backup_putid($restore->backup_unique_code,"event_repeatid", $oldrepeatid, $eve->repeatid);
-                                }
-                            }
  
                             //We have to recode the groupid field
                             $group = backup_getid($restore->backup_unique_code,"groups",$eve->groupid);
@@ -2228,6 +2221,22 @@
 
                             //The structure is equal to the db, so insert the event
                             $newid = insert_record ("event",$eve);
+
+                            //We must recode the repeatid if the event has it
+                            //The repeatid now refers to the id of the original event. (see Bug#5956)
+                            if ($newid && !empty($eve->repeatid)) {
+                                $repeat_rec = backup_getid($restore->backup_unique_code,"event_repeatid",$eve->repeatid);
+                                if ($repeat_rec) {    //Exists, so use it...
+                                    $eve->repeatid = $repeat_rec->new_id;
+                                } else {              //Doesn't exists, calculate the next and save it
+                                    $oldrepeatid = $eve->repeatid;
+                                    $eve->repeatid = $newid;
+                                    backup_putid($restore->backup_unique_code,"event_repeatid", $oldrepeatid, $eve->repeatid);
+                                }
+                                $eve->id = $newid;
+                                // update the record to contain the correct repeatid
+                                update_record('event',$eve);
+                            }
                         } else {
                             //get current event id
                             $newid = $eve_db->id;
@@ -4843,7 +4852,7 @@
     }
 
     function restore_execute(&$restore,$info,$course_header,&$errorstr) {
-        global $CFG;
+        global $CFG, $USER;
         $status = true;
         //Checks for the required files/functions to restore every module
         //and include them
@@ -5306,9 +5315,9 @@
             }
             if (!$status = restore_decode_content_links($restore)) {
                 if (!defined('RESTORE_SILENTLY')) {
-                    notify("Could not refresh events for activities!");
+                    notify("Could not decode content links!");
                 } else {
-                    $errorstr = "Could not refresh events for activities!";
+                    $errorstr = "Could not decode content links!";
                     return false;
                 }
             }

backup/version.php

@@ -5,6 +5,8 @@
 // database (backup_version) to determine whether upgrades should
 // be performed (see db/backup_*.php)
 
-$backup_version = 2006053000;   // The current version is a date (YYYYMMDDXX)
+$backup_version = 2006082300;   // The current version is a date (YYYYMMDDXX)
 
-$backup_release = "1.6";  // User-friendly version number
+$backup_release = "1.6.2";  // User-friendly version number
+
+?>

blocks/blog_tags/block_blog_tags.php

@@ -71,13 +71,13 @@ class block_blog_tags extends block_base {
 
         $timewithin = $this->config->timewithin * 24 * 60 * 60; /// convert to seconds
         
-        $sql  = 'SELECT t.*, COUNT(DISTINCT bt.id) as ct ';
+        $sql  = 'SELECT t.id, t.type, t.text, COUNT(DISTINCT bt.id) as ct ';
         $sql .= "FROM {$CFG->prefix}tags as t, {$CFG->prefix}blog_tag_instance as bt, {$CFG->prefix}post as p ";
         $sql .= 'WHERE t.id = bt.tagid ';
         $sql .= 'AND p.id = bt.entryid ';
-        $sql .= 'AND (p.publishstate = "site" or p.publishstate="public") ';
+        $sql .= 'AND (p.publishstate = \'site\' or p.publishstate=\'public\') ';
         $sql .= "AND bt.timemodified > {$timewithin} ";
-        $sql .= 'GROUP BY bt.tagid ';
+        $sql .= 'GROUP BY  t.id, t.type, t.text ';
         $sql .= 'ORDER BY ct DESC, t.text ASC ';
         $sql .= "LIMIT {$this->config->numberoftags} ";
 

blocks/html/block_html.php

@@ -12,7 +12,7 @@ class block_html extends block_base {
     }
 
     function specialization() {
-        $this->title = isset($this->config->title) ? $this->config->title : get_string('newhtmlblock', 'block_html');
+        $this->title = isset($this->config->title) ? format_string($this->config->title) : get_string('newhtmlblock', 'block_html');
     }
 
     function instance_allow_multiple() {
@@ -24,8 +24,13 @@ class block_html extends block_base {
             return $this->content;
         }
 
-        $filteropt = new stdClass;
-        $filteropt->noclean = true;
+        if (!empty($this->instance->pinned) or $this->instance->pagetype === 'course-view') {
+            // fancy html allowed only on course page and in pinned blocks for security reasons
+            $filteropt = new stdClass;
+            $filteropt->noclean = true;
+        } else {
+            $filteropt = null;
+        }
 
         $this->content = new stdClass;
         $this->content->text = isset($this->config->text) ? format_text($this->config->text, FORMAT_HTML, $filteropt) : '';

blocks/html/config_instance.html

@@ -1,12 +1,19 @@
-<?php $usehtmleditor = can_use_html_editor(); ?>
+<?php
+    $usehtmleditor = can_use_html_editor();
+
+    $text = isset($this->config->text) ? $this->config->text : '';
+    if (empty($this->instance->pinned) and $this->instance->pagetype !== 'course-view') {
+        $text = clean_text($text, FORMAT_HTML);
+    }
+?>
 <table cellpadding="9" cellspacing="0">
 <tr valign="top">
     <td align="right"><?php print_string('configtitle', 'block_html'); ?>:</td>
-    <td><input type="text" name="title" size="30" value="<?php echo isset($this->config->title)?$this->config->title:''; ?>" /> (<?php print_string('leaveblanktohide', 'block_html'); ?>)</td>
+    <td><input type="text" name="title" size="30" value="<?php echo isset($this->config->title)?p($this->config->title):''; ?>" /> (<?php print_string('leaveblanktohide', 'block_html'); ?>)</td>
 </tr>
 <tr valign="top">
     <td align="right"><?php print_string('configcontent', 'block_html'); ?>:</td>
-    <td><?php print_textarea($usehtmleditor, 25, 50, 0, 0, 'text', isset($this->config->text)?$this->config->text:'') ?></td>
+    <td><?php print_textarea($usehtmleditor, 25, 50, 0, 0, 'text', $text) ?></td>
 </tr>
 <tr>
     <td colspan="3" align="center">

blocks/login/block_login.php

@@ -52,7 +52,7 @@ class block_login extends block_base {
             $this->content->text .= '<table align="center" cellpadding="2" cellspacing="0" class="logintable">';
 
             $this->content->text .= '<tr><td class="c0 r0" align="right">'.get_string('username').':</td>';
-            $this->content->text .= '<td class="c1 r0"><input type="text" name="username" size="10" value="'.$username.'" /></td></tr>';
+            $this->content->text .= '<td class="c1 r0"><input type="text" name="username" size="10" value="'.s($username).'" /></td></tr>';
 
             $this->content->text .= '<tr><td class="c0 r1" align="right">'.get_string('password').':</td>';
             $this->content->text .= '<td class="c1 r1"><input type="password" name="password" size="10" value="" /></td></tr>';

blocks/online_users/block_online_users.php

@@ -118,7 +118,7 @@ class block_online_users extends block_base {
                 $this->content->text .= '<a href="'.$CFG->wwwroot.'/user/view.php?id='.$user->id.'&amp;course='.$COURSE->id.'" title="'.$timeago.'">'.$user->fullname.'</a>';
                 if (!empty($USER->id) and ($USER->id != $user->id) and !empty($CFG->messaging) and !isguest()) {  // Only when logged in
                     $this->content->text .= "\n".' <a title="'.get_string('messageselectadd').'" target="message_'.$user->id.'" href="'.$CFG->wwwroot.'/message/discussion.php?id='.$user->id.'" onclick="return openpopup(\'/message/discussion.php?id='.$user->id.'\', \'message_'.$user->id.'\', \'menubar=0,location=0,scrollbars,status,resizable,width=400,height=500\', 0);">'
-                        .'<img class="icon message" src="'.$CFG->pixpath.'/t/message.gif" alt="'. get_string('messageselectadd') .'" /></a>';
+                        .'<img class="messageicon" src="'.$CFG->pixpath.'/t/message.gif" alt="'. get_string('messageselectadd') .'" /></a>';
                 }
                 $this->content->text .= "</li>\n";
             }

blocks/participants/block_participants.php

@@ -7,7 +7,7 @@ class block_participants extends block_list {
     }
 
     function get_content() {
-        global $USER, $CFG;
+        global $USER, $CFG, $COURSE;
 
         if ($this->content !== NULL) {
             return $this->content;
@@ -27,13 +27,14 @@ class block_participants extends block_list {
             $this->instance->pageid = SITEID;
         }
 
-        if ($this->instance->pageid != SITEID || 
+        /// MDL-13252 Always get the course page id or else the id may be incorrect in the user/index.php
+        if ($COURSE->id != SITEID || 
             $CFG->showsiteparticipantslist > 1 || 
             ($CFG->showsiteparticipantslist == 1 && isteacherinanycourse()) || 
             isteacher(SITEID)) {
 
             $this->content->items[] = '<a title="'.get_string('listofallpeople').'" href="'.
-                                      $CFG->wwwroot.'/user/index.php?id='.$this->instance->pageid.'">'.get_string('participants').'</a>';
+                                      $CFG->wwwroot.'/user/index.php?id='.$COURSE->id.'">'.get_string('participants').'</a>';
             $this->content->icons[] = '<img src="'.$CFG->pixpath.'/i/users.gif" height="16" width="16" alt="" />';
         }
 

blocks/rss_client/block_rss_client.php

@@ -123,7 +123,7 @@
             $numids = count($rssidarray);
             $count = 0;
             foreach ($rssidarray as $rssid) {
-                $output .=  $this->get_rss_by_id($rssid, $display_description, $shownumentries, ($numids > 1) ? true : false);
+                $output .=  clean_text($this->get_rss_by_id($rssid, $display_description, $shownumentries, ($numids > 1) ? true : false), FORMAT_HTML);
                 if ($numids > 1 && $count != $numids -1 && !empty($rssfeedstring)) {
                     $output .= '<hr width="80%" />';
                 }

blog/blogpage.php

@@ -1,5 +1,9 @@
 <?php  // $Id$
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 /**
 * Definition of blog page type.
  */

blog/edit.php

@@ -115,8 +115,8 @@ if ($editid) {  // User is editing a post
     $blogEntry = get_record('post','id',$editid);
 
     //using an unformatted entry body here so that extra formatting information is not stored in the db
-    $post->body = stripslashes_safe($blogEntry->summary);
-    $post->etitle = stripslashes_safe($blogEntry->subject);
+    $post->body = $blogEntry->summary;
+    $post->etitle = $blogEntry->subject;
     $post->postid = $editid;
     $post->userid = $blogEntry->userid;
     $post->format = $blogEntry->format;
@@ -194,8 +194,8 @@ function do_save($post) {
 
         /// Write a blog entry into database
         $blogEntry = new object;
-        $blogEntry->subject = addslashes($post->etitle);
-        $blogEntry->summary = addslashes($post->body);
+        $blogEntry->subject = $post->etitle;
+        $blogEntry->summary = $post->body;
         $blogEntry->module = 'blog';
         $blogEntry->userid = $USER->id;
         $blogEntry->format = $post->format;
@@ -267,8 +267,8 @@ function do_update($post) {
 //  echo "id id ".$post->postid;
 //  print_object($blogentry);  //debug
 
-    $blogEntry->subject = addslashes($post->etitle);
-    $blogEntry->summary = addslashes($post->body);
+    $blogEntry->subject = $post->etitle;
+    $blogEntry->summary = $post->body;
     if ($blogEntry->summary == '<br />') {
         $blogEntry->summary = '';
     }

blog/header.php

@@ -110,10 +110,10 @@ if ($ME == $CFG->wwwroot.'/blog/edit.php') {  /// We are in edit mode, print the
 
         case 'course':
             if ($tagid || !empty($tag)) {
-                print_header_simple("$course->shortname: $blogstring", $course->fullname,
+                print_header("$course->shortname: $blogstring", $course->fullname,
                             '<a href="index.php?filtertype=course&amp;filterselect='.$filterselect.'">'. "$blogstring</a> -> $tagstring: $taginstance->text",'','',true,$PAGE->get_extra_header_string());
             } else {
-                print_header_simple("$course->shortname: $blogstring", $course->fullname,
+                print_header("$course->shortname: $blogstring", $course->fullname,
                             $blogstring,'','',true,$PAGE->get_extra_header_string());
             }
         break;
@@ -123,11 +123,11 @@ if ($ME == $CFG->wwwroot.'/blog/edit.php') {  /// We are in edit mode, print the
             $thisgroup = get_record('groups', 'id', $filterselect);
 
             if ($tagid || !empty($tag)) {
-                print_header_simple("$course->shortname: $blogstring", $course->fullname,
+                print_header("$course->shortname: $blogstring", $course->fullname,
                             '<a href="'.$CFG->wwwroot.'/user/index.php?id='.$course->id.'&amp;group='.$filterselect.'">'.$thisgroup->name.'</a> ->
                             <a href="index.php?filtertype=group&amp;filterselect='.$filterselect.'">'. "$blogstring</a> -> $tagstring: $taginstance->text",'','',true,$PAGE->get_extra_header_string());
             } else {
-                print_header_simple("$course->shortname: $blogstring", $course->fullname,
+                print_header("$course->shortname: $blogstring", $course->fullname,
                             '<a href="'.$CFG->wwwroot.'/user/index.php?id='.$course->id.'&amp;group='.$filterselect.'">'.$thisgroup->name."</a> ->
                             $blogstring",'','',true,$PAGE->get_extra_header_string());
 

blog/index.php

@@ -20,7 +20,7 @@ $limit = optional_param('limit', 0, PARAM_INT);
 $start = optional_param('formstart', 0, PARAM_INT);
 $userid = optional_param('userid',0,PARAM_INT);
 $courseid = optional_param('courseid',SITEID,PARAM_INT);
-$tag = s(urldecode(optional_param('tag', '', PARAM_NOTAGS)));
+$tag = optional_param('tag', '', PARAM_NOTAGS);
 $tagid = optional_param('tagid', 0, PARAM_INT);
 $postid = optional_param('postid',0,PARAM_INT);
 $filtertype = optional_param('filtertype', '', PARAM_ALPHA);

blog/lib.php

@@ -119,6 +119,9 @@
                 blog_print_entry($blogEntry, 'list', $filtertype, $filterselect); //print this entry.
                 $count++;
             }
+
+            print_paging_bar(get_viewable_entry_count($userid, $postid, $limit, $start,$filtertype, $filterselect, $tagid, $tag, $sort='lastmodified DESC'), $blogpage, $bloglimit, get_baseurl($filtertype, $filterselect), 'blogpage');
+
             if (!$count) {
                 print '<br /><center>'. get_string('noentriesyet', 'blog') .'</center><br />';
 
@@ -151,10 +154,10 @@
 
         global $USER, $CFG, $course, $ME;
 
-        $template['body'] = get_formatted_entry_body(stripslashes_safe($blogEntry->summary), $blogEntry->format);
-        $template['title'] = '<a name="'. $blogEntry->subject .'"></a>';
+        $template['body'] = get_formatted_entry_body($blogEntry->summary, $blogEntry->format);
+        $template['title'] = '<a name="'. s($blogEntry->subject, true) .'"></a>';
         //enclose the title in nolink tags so that moodle formatting doesn't autolink the text
-        $template['title'] .= '<span class="nolink">'. stripslashes_safe($blogEntry->subject);
+        $template['title'] .= '<span class="nolink">'. strip_tags(format_string($blogEntry->subject, true));
         $template['title'] .= '</span>';
         $template['userid'] = $blogEntry->userid;
         $template['author'] = fullname(get_record('user','id',$blogEntry->userid));
@@ -339,7 +342,7 @@
         if ($format) {
             return format_text($body, $format);
         }
-        return stripslashes_safe($body);
+        return $body;
     }
 
 /// Main filter function

calendar/event.php

@@ -9,14 +9,14 @@
 // Copyright (C) 2003-2004  Greek School Network            www.sch.gr     //
 //                                                                         //
 // Designed by:                                                            //
-//     Avgoustos Tsinakos (tsinakos@uom.gr)                                //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Avgoustos Tsinakos (tsinakos@teikav.edu.gr)                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // Programming and development:                                            //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // For bugs, suggestions, etc contact:                                     //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // The current module was developed at the University of Macedonia         //
 // (www.uom.gr) under the funding of the Greek School Network (www.sch.gr) //
@@ -205,13 +205,14 @@
                 if (count($err) == 0) {
                     $form->timemodified = time();
 
-                    if ($form->repeat) {
-                        $fetch = get_record_sql('SELECT 1, MAX(repeatid) AS repeatid FROM '.$CFG->prefix.'event');
-                        $form->repeatid = empty($fetch) ? 1 : $fetch->repeatid + 1;
-                    }
-
                     /// Get the event id for the log record.
                     $eventid = insert_record('event', $form, true);
+                    
+                    /// Use the event id as the repeatid to link repeat entries together
+                    if ($form->repeat) {
+                        $form->repeatid = $form->id = $eventid;
+                        update_record('event', $form);         // update the row, to set its repeatid        	
+                    }
 
                     /// Log the event entry.
                     add_to_log($form->courseid, 'calendar', 'add', 'event.php?action=edit&id='.$eventid, stripslashes($form->name));
@@ -262,7 +263,7 @@
     }
 
     print_header($site->shortname.': '.$strcalendar.': '.$title, $strcalendar, $nav.' -> '.$title,
-                 $focus, '', true, '', user_login_string($site));
+                 'eventform.name', '', true, 'new.name', user_login_string($site));
 
     echo calendar_overlib_html();
 
@@ -378,7 +379,7 @@
                     $form->timestart = make_timestamp($cal_y, $cal_m, 1, 0, 0, 0);
                 }
             }
-            if($form->timestart < 0) {
+            if(!isset($form->timestart) or $form->timestart < 0) {
                 $form->timestart = time();
             }
 

calendar/event_edit.html

@@ -1,4 +1,4 @@
-<form method="post" action="event.php" name="edit">
+<form method="post" action="event.php" name="eventform">
 <table cellpadding="5" cellspacing="0">
   <tr>
     <td style="vertical-align: top; text-align: right;">

calendar/event_new.html

@@ -2,7 +2,7 @@
     // The following is a hack to fix bug 1488
     $course = get_record('course', 'id', ($form->courseid) ? $form->courseid : $site->id);
 ?>
-<form method="post" action="event.php" name="new">
+<form method="post" action="event.php" name="eventform">
 <table cellpadding="5">
   <tr>
     <td style="vertical-align: top; text-align: right;">

calendar/lib.php

@@ -9,14 +9,14 @@
 // Copyright (C) 2003-2004  Greek School Network            www.sch.gr     //
 //                                                                         //
 // Designed by:                                                            //
-//     Avgoustos Tsinakos (tsinakos@uom.gr)                                //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Avgoustos Tsinakos (tsinakos@teikav.edu.gr)                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // Programming and development:                                            //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // For bugs, suggestions, etc contact:                                     //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // The current module was developed at the University of Macedonia         //
 // (www.uom.gr) under the funding of the Greek School Network (www.sch.gr) //
@@ -242,7 +242,7 @@ function calendar_get_mini($courses, $groups, $users, $cal_month = false, $cal_y
                     $popupicon = $CFG->pixpath.'/c/user.gif';
                     $popupalt  = '';
                 }
-                $popupcontent .= '<div><img height="16" width="16" src="'.$popupicon.'" style="vertical-align: middle; margin-right: 4px;" alt="'.$popupalt.'" /><a href="'.$dayhref.'">'.format_string($event->name,true).'</a></div>';
+                $popupcontent .= '<div><img height="16" width="16" src="'.$popupicon.'" style="vertical-align: middle; margin-right: 4px;" alt="'.$popupalt.'" /><a href="'.$dayhref.'#event_'.$event->id.'">'.format_string($event->name,true).'</a></div>';
             }
             
             //Accessibility: functionality moved to calendar_get_popup.
@@ -338,6 +338,7 @@ function calendar_get_popup($is_today, $event_timestart, $popupcontent='') {
         $popupcaption .= get_string('eventsfor', 'calendar', userdate($event_timestart, get_string('strftimedayshort')));
     }
     $popupcontent = str_replace("'", "\'", htmlspecialchars($popupcontent));
+    $popupcaption = str_replace("'", "\'", htmlspecialchars($popupcaption)); 
     $popup = 'onmouseover="return overlib(\''.$popupcontent.'\', CAPTION, \''.$popupcaption.'\');" onmouseout="return nd();"';
     return $popup;
 }
@@ -455,7 +456,7 @@ function calendar_print_event($event) {
     static $strftimetime;
 
     $event = calendar_add_event_metadata($event);
-    echo '<table class="event" cellspacing="0">';
+    echo '<a name="event_'.$event->id.'"></a><table class="event" cellspacing="0">';
     echo '<tr><td class="picture">';
     if (!empty($event->icon)) {
         echo $event->icon;
@@ -868,7 +869,7 @@ function calendar_get_sideblock_upcoming($events, $linkhref = NULL) {
             if(!empty($linkhref)) {
                 $ed = usergetdate($events[$i]->timestart);
                 $href = calendar_get_link_href(CALENDAR_URL.$linkhref, $ed['mday'], $ed['mon'], $ed['year']);
-                $content .= '<a href="'.$href.'">'.$events[$i]->name.'</a>';
+                $content .= '<a href="'.$href.'#event_'.$events[$i]->id.'">'.$events[$i]->name.'</a>';
             }
             else {
                 $content .= $events[$i]->name;
@@ -1093,6 +1094,10 @@ function calendar_set_filters(&$courses, &$group, &$user, $courseeventsfrom = NU
     else {
         $courses = false;
     }
+   //BUG 6130 clean $courses array as SESSION has bad entries. 
+   foreach ($courses as $index => $value) {
+       if (empty($value)) unset($courses[$index]);
+   }
 
     if($SESSION->cal_show_user || $ignorefilters) {
         // This doesn't work for arrays yet (maybe someday it will)

calendar/set.php

@@ -9,14 +9,14 @@
 // Copyright (C) 2003-2004  Greek School Network            www.sch.gr     //
 //                                                                         //
 // Designed by:                                                            //
-//     Avgoustos Tsinakos (tsinakos@uom.gr)                                //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Avgoustos Tsinakos (tsinakos@teikav.edu.gr)                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // Programming and development:                                            //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // For bugs, suggestions, etc contact:                                     //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // The current module was developed at the University of Macedonia         //
 // (www.uom.gr) under the funding of the Greek School Network (www.sch.gr) //

calendar/view.php

@@ -9,14 +9,14 @@
 // Copyright (C) 2003-2004  Greek School Network            www.sch.gr     //
 //                                                                         //
 // Designed by:                                                            //
-//     Avgoustos Tsinakos (tsinakos@uom.gr)                                //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Avgoustos Tsinakos (tsinakos@teikav.edu.gr)                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // Programming and development:                                            //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // For bugs, suggestions, etc contact:                                     //
-//     Jon Papaioannou (pj@uom.gr)                                         //
+//     Jon Papaioannou (pj@moodle.org)                                     //
 //                                                                         //
 // The current module was developed at the University of Macedonia         //
 // (www.uom.gr) under the funding of the Greek School Network (www.sch.gr) //
@@ -44,8 +44,8 @@
     require_once($CFG->dirroot.'/course/lib.php');
     require_once($CFG->dirroot.'/calendar/lib.php');
 
-    $course = optional_param('course', 0);
-    $view = optional_param('view', 'upcoming');
+    $courseid = optional_param('course', 0, PARAM_INT);
+    $view = optional_param('view', 'upcoming', PARAM_ALPHA);
     $day  = optional_param('cal_d', 0, PARAM_INT);
     $mon  = optional_param('cal_m', 0, PARAM_INT);
     $yr   = optional_param('cal_y', 0, PARAM_INT);
@@ -54,7 +54,9 @@
         redirect($CFG->wwwroot.'/'.$CFG->admin.'/index.php');
     }
 
-    if ($CFG->forcelogin) {
+    if ($courseid) {
+        require_login($courseid);
+    } else if ($CFG->forcelogin) {
         require_login();
     }
 
@@ -87,8 +89,8 @@
     }
 
     // If a course has been supplied in the URL, change the filters to show that one
-    if (!empty($course)) {
-        if ($course = get_record('course', 'id', $course)) {
+    if (!empty($courseid)) {
+        if ($course = get_record('course', 'id', $courseid)) {
             if ($course->id == SITEID) {
                 // If coming from the home page, show all courses
                 $SESSION->cal_courses_shown = calendar_get_default_courses(true);
@@ -100,6 +102,8 @@
                 calendar_set_referring_course($SESSION->cal_courses_shown);
             }
         }
+    } else {
+        $course = null;
     }
 
     if (empty($USER->id) or isguest()) {
@@ -302,9 +306,15 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users) {
     list($d, $m, $y) = array($date['mday'], $date['mon'], $date['year']); // This is what we want to display
     $display->maxdays = calendar_days_in_month($m, $y);
 
-    // We 'll keep these values as GMT here, and offset them when the time comes to query the db
-    $display->tstart = gmmktime(0, 0, 0, $m, 1, $y); // This is GMT
-    $display->tend = gmmktime(23, 59, 59, $m, $display->maxdays, $y); // GMT
+    if (get_user_timezone_offset() < 99) {
+        // We 'll keep these values as GMT here, and offset them when the time comes to query the db
+	    $display->tstart = gmmktime(0, 0, 0, $m, 1, $y); // This is GMT
+	    $display->tend = gmmktime(23, 59, 59, $m, $display->maxdays, $y); // GMT
+    } else {
+        // no timezone info specified
+	    $display->tstart = mktime(0, 0, 0, $m, 1, $y);
+	    $display->tend = mktime(23, 59, 59, $m, $display->maxdays, $y);
+    }
 
     $startwday = gmdate('w', $display->tstart); // $display->tstart is already GMT, so don't use date(): messes with server's TZ
 
@@ -440,7 +450,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users) {
         if(isset($eventsbyday[$day])) {
             echo '<ul class="events-new">';
             foreach($eventsbyday[$day] as $eventindex) {
-                echo '<li><a href="'.$dayhref.'">'.format_string($events[$eventindex]->name,true).'</a></li>';
+                echo '<li><a href="'.$dayhref.'#event_'.$events[$eventindex]->id.'">'.format_string($events[$eventindex]->name, true).'</a></li>';
             }
             echo '</ul>';
         }

config-dist.php

@@ -139,6 +139,9 @@ $CFG->admin = 'admin';
 // Useful for webhost operators who have alternate methods of backups
 //      $CFG->disablescheduledbackups = true;
 //
+// Prevent stats processing and hide the GUI
+//      $CFG->disablestatsprocessing = true;
+//
 // Restrict certain usernames from doing things that may mess up a site
 // This is especially useful for demonstration teacher accounts
 //      $CFG->restrictusers = 'teacher,fred,jim';

course/category.php

@@ -8,7 +8,7 @@
 
     $id       = required_param('id', PARAM_INT);          // Category id
     $page     = optional_param('page', 0, PARAM_INT);     // which page to show
-    $perpage  = optional_param('perpage', 20, PARAM_INT); // how many per page
+    $perpage  = optional_param('perpage', $CFG->coursesperpage, PARAM_INT); // how many per page
     $edit     = optional_param('edit', -1, PARAM_BOOL);
     $hide     = optional_param('hide', 0, PARAM_INT);
     $show     = optional_param('show', 0, PARAM_INT);

course/editsection.php

@@ -60,7 +60,7 @@
         $strsummaryof = get_string('summaryof', '', " $sectionname $form->section");
     }
 
-    print_header_simple($stredit, '', $stredit);
+    print_header_simple($stredit, '', $stredit, 'theform.summary' );
 
     print_heading($strsummaryof);
     print_simple_box_start('center');

course/enrol.php

@@ -60,13 +60,13 @@
 /// moved here to fix bug 5734
     if ($course->metacourse) {
         print_header_simple();
-        notice(get_string('coursenotaccessible'), $CFG->wwwroot);
+        notice(get_string('coursenotaccessible'), "$CFG->wwwroot/index.php");
     }
     
 /// Users can't enroll to site course
     if (!$course->category) {
         print_header_simple();
-        notice(get_string('enrollfirst'), $CFG->wwwroot);
+        notice(get_string('enrollfirst'), "$CFG->wwwroot/index.php");
     }
 
 /// Double check just in case they are enrolled to start in the future 
@@ -75,22 +75,23 @@
         if ($course->enrolperiod and $student->timestart and ($student->timestart >= time())) {
             $message = get_string('enrolmentnotyet', '', userdate($student->timestart));
             print_header();
-            notice($message, $CFG->wwwroot);
+            notice($message, "$CFG->wwwroot/index.php");
         }
     }
 
 /// Check if the course is enrollable
     if (!method_exists($enrol, 'print_entry')) {
         print_header_simple();
-        notice(get_string('enrolmentnointernal'), $CFG->wwwroot);
+        notice(get_string('enrolmentnointernal'), "$CFG->wwwroot/index.php");
     }
 
-    if (!$course->enrollable ||
+    if (!$loginasguest and ($USER->username != 'guest') and(
+            !$course->enrollable ||
             ($course->enrollable == 2 && $course->enrolstartdate > 0 && $course->enrolstartdate > time()) ||
             ($course->enrollable == 2 && $course->enrolenddate > 0 && $course->enrolenddate <= time())
-            ) {
-        print_header_simple();
-        notice(get_string('notenrollable'), $CFG->wwwroot);
+            )) {
+        print_header($course->shortname, $course->fullname, $course->shortname );
+        notice(get_string('notenrollable'), "$CFG->wwwroot/index.php");
     }
 
 /// Check the submitted enrollment key if there is one

course/index.php

@@ -56,6 +56,9 @@
         }
 
         echo "<center>";
+        if (isloggedin() and !isguest() and !isadmin() and !iscreator()) {  // Print link to request a new course
+            print_single_button("request.php", NULL, get_string("courserequest"), "get");
+        }
         if (iscreator()) {       // Print link to create a new course
             print_single_button("edit.php", NULL, get_string("addnewcourse"), "get");
         }

course/jumpto.php

@@ -10,6 +10,10 @@
 
     $jump = optional_param('jump', '', PARAM_RAW);
 
+    if (!confirm_sesskey()) {
+        print_error('confirmsesskeybad');
+    }
+
     if (strpos($jump, $CFG->wwwroot) === 0) {            // Anything on this site
         redirect(urldecode($jump));
     } else if (preg_match('/^[a-z]+\.php\?/', $jump)) { 

course/lib.php

@@ -246,19 +246,50 @@ function make_log_url($module, $url) {
         case 'message':
         case 'calendar':
         case 'blog':
-            return "/$module/$url";
+            if (strpos($url, '../') === 0) {
+                $url = ltrim($url, '.');
+            } else {
+                $url = "/course/$url";
+            }
+            break;
+            $url = "/$module/$url";
             break;
         case 'upload':
-            return $url;
+            $url = $url;
             break;
         case 'library':
         case '':
-            return '/';
+            $url = '/';
             break;
         default:
-            return "/mod/$module/$url";
+            $url = "/mod/$module/$url";
             break;
     }
+
+    //now let's sanitise urls - there might be some ugly nasties:-(
+    $parts = explode('?', $url);
+    $script = array_shift($parts);
+    if (strpos($script, 'http') === 0) {
+        $script = clean_param($script, PARAM_URL);
+    } else {
+        $script = clean_param($script, PARAM_PATH);
+    }
+
+    $query = '';
+    if ($parts) {
+        $query = implode('', $parts);
+        $query = str_replace('&', '&', $query); // both & and & are stored in db :-|
+        $parts = explode('&', $query);
+        $eq = urlencode('=');
+        foreach ($parts as $key=>$part) {
+            $part = urlencode(urldecode($part));
+            $part = str_replace($eq, '=', $part);
+            $parts[$key] = $part;
+        }
+        $query = '?'.implode('&', $parts);
+    }
+
+    return $script.$query;
 }
 
 function print_log($course, $user=0, $date=0, $order="l.time ASC", $page=0, $perpage=100,
@@ -406,10 +437,6 @@ function print_log($course, $user=0, $date=0, $order="l.time ASC", $page=0, $per
         //Filter log->info 
         $log->info = format_string($log->info);
 
-        $log->url  = strip_tags(urldecode($log->url));   // Some XSS protection
-        $log->info = strip_tags(urldecode($log->info));  // Some XSS protection
-        $log->url  = str_replace('&', '&', $log->url); /// XHTML compatibility
-
         echo '<tr class="r'.$row.'">';
         if ($course->id == SITEID) {
             echo "<td class=\"r$row c0\" nowrap=\"nowrap\">\n";
@@ -1202,14 +1229,14 @@ function print_courses($category, $width="100%", $hidesitecourse = false) {
         $categories = get_categories(0);  // Parent = 0   ie top-level categories only
         if (count($categories) == 1) {
             $category   = array_shift($categories);
-            $courses    = get_courses($category->id, 'c.sortorder ASC', 'c.id,c.category,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.teacher,c.cost,c.currency,c.enrol');
+            $courses    = get_courses($category->id, 'c.sortorder ASC', 'c.id,c.category,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.teacher,c.cost,c.currency,c.enrol,c.guest');
         } else {
-            $courses    = get_courses('all', 'c.sortorder ASC', 'c.id,c.category,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.teacher,c.cost,c.currency,c.enrol');
+            $courses    = get_courses('all', 'c.sortorder ASC', 'c.id,c.category,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.teacher,c.cost,c.currency,c.enrol,c.guest');
         }
         unset($categories);
     } else {
         $categories = get_categories($category->id);  // sub categories
-        $courses    = get_courses($category->id, 'c.sortorder ASC', 'c.id,c.category,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.teacher,c.cost,c.currency,c.enrol');
+        $courses    = get_courses($category->id, 'c.sortorder ASC', 'c.id,c.category,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.teacher,c.cost,c.currency,c.enrol,c.guest');
     }
 
     if ($courses) {
@@ -1847,7 +1874,7 @@ function move_courses ($courseids, $categoryid) {
                     // figure out a sortorder that we can use in the destination category
                     $sortorder = get_field_sql('SELECT MIN(sortorder)-1 AS min
                                                     FROM ' . $CFG->prefix . 'course WHERE category=' . $categoryid);
-                    if ($sortorder === false) {
+                    if (is_null($sortorder) || $sortorder === false) {
                         // the category is empty
                         // rather than let the db default to 0
                         // set it to > 100 and avoid extra work in fix_coursesortorder()                        
@@ -1858,16 +1885,8 @@ function move_courses ($courseids, $categoryid) {
 
                     $course->category  = $categoryid;
                     $course->sortorder = $sortorder;
-                    $course->fullname = addslashes($course->fullname);
-                    $course->shortname = addslashes($course->shortname);
-                    $course->summary = addslashes($course->summary);
-                    $course->password = addslashes($course->password);
-                    $course->teacher = addslashes($course->teacher);
-                    $course->teachers = addslashes($course->teachers);
-                    $course->student = addslashes($course->student);
-                    $course->students = addslashes($course->students);
                     
-                    if (!update_record('course', $course)) {
+                    if (!update_record('course', addslashes_object($course))) {
                         notify("An error occurred - course not moved!");
                     }
                 }

course/mod.php

@@ -503,7 +503,7 @@
         $form->sesskey      = !empty($USER->id) ? $USER->sesskey : '';
 
         $sectionname    = get_string("name$course->format");
-        $fullmodulename = strtolower(get_string("modulename", $module->name));
+        $fullmodulename = get_string("modulename", $module->name);
 
         if ($form->section && $course->format != 'site') {
             $heading->what = $fullmodulename;
@@ -563,7 +563,7 @@
         $form->sesskey      = !empty($USER->id) ? $USER->sesskey : '';
 
         $sectionname    = get_string("name$course->format");
-        $fullmodulename = strtolower(get_string("modulename", $module->name));
+        $fullmodulename = get_string("modulename", $module->name);
 
         if ($form->section) {
             $heading->what = $fullmodulename;
@@ -638,7 +638,7 @@
     $strmodulenameplural = get_string("modulenameplural", $module->name);
 
     if ($module->name == "label") {
-        $focuscursor = "";
+        $focuscursor = "form.content";
     } else {
         $focuscursor = "form.name";
     }

course/recent.php

@@ -25,6 +25,7 @@
     add_to_log($course->id, "course", "recent", "recent.php?id=$course->id", "$course->id");
 
     $strrecentactivity = get_string("recentactivity");
+    $meta = '<meta name="robots" content="none" />'; // prevent duplicate content in search engines MDL-7299
 
     $loggedinas = user_login_string($course, $USER);
 
@@ -42,13 +43,13 @@
         if ($date)
             $dateinfo = userdate($date, get_string("strftimedaydate"));
 
-        if ($course->category) {
+        if ($course->id != SITEID) {
             print_header("$course->shortname: $strrecentactivity", "$course->fullname",
                          "<a href=\"view.php?id=$course->id\">$course->shortname</a> ->
-                          <a href=\"recent.php?id=$course->id\">$strrecentactivity</a> -> $userinfo, $dateinfo", "");
+                          <a href=\"recent.php?id=$course->id\">$strrecentactivity</a> -> $userinfo, $dateinfo", "", $meta);
         } else {
             print_header("$course->shortname: $strrecentactivity", "$course->fullname",
-                         "<a href=\"recent.php?id=$course->id\">$strrecentactivity</a> -> $userinfo, $dateinfo", "");
+                         "<a href=\"recent.php?id=$course->id\">$strrecentactivity</a> -> $userinfo, $dateinfo", "", $meta);
         }
 
         print_heading("$course->fullname: $userinfo, $dateinfo (".usertimezone().")", '', 3);
@@ -67,12 +68,12 @@
             }
         }
 
-        if ($course->category) {
+        if ($course->id != SITEID) {
             print_header("$course->shortname: $strrecentactivity", "$course->fullname",
-                     "<a href=\"view.php?id=$course->id\">$course->shortname</a> -> $strrecentactivity", "");
+                     "<a href=\"view.php?id=$course->id\">$course->shortname</a> -> $strrecentactivity", "", $meta);
         } else {
             print_header("$course->shortname: $strrecentactivity", "$course->fullname",
-                     "$strrecentactivity", "");
+                     "$strrecentactivity", "", $meta);
         }
 
         print_heading(get_string("activitysince", "", userdate($date)));

course/report/participation/index.php

@@ -155,7 +155,7 @@
     $postfun = $module->name.'_get_post_actions';
 
     if (!function_exists($viewfun) || !function_exists($postfun)) {
-        error(get_string('modulemisssingcode','error',$module->name),$baseurl);
+        error(get_string('modulemissingcode','error',$module->name),$baseurl);
     }
 
     $viewnames = $viewfun();

course/report/stats/report.php

@@ -1,5 +1,9 @@
 <?php
 
+    if (!defined('MOODLE_INTERNAL')) {
+        die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+    }
+
     $courses = get_courses('all','c.shortname','c.id,c.shortname,c.fullname');
     $courseoptions = array();
 
@@ -139,4 +143,4 @@
         print_table($table);
     }
 
-?>
+?>

course/search.php

@@ -219,7 +219,7 @@
 
         if ($perpage != 99999 && $totalcount > $perpage) {
             echo "<center><p>";
-            echo "<a href=\"search.php?search=$encoededsearch&perpage=99999\">".get_string("showall", "", $totalcount)."</a>";
+            echo "<a href=\"search.php?search=$encodedsearch&perpage=99999\">".get_string("showall", "", $totalcount)."</a>";
             echo "</p></center>";
         }
 

doc/index.php

@@ -11,7 +11,7 @@
     }
 
     if (!empty($sub)) {
-        $sub = "#$sub";
+        $sub = '#'.s($sub);
     } else {
         $sub = "";
     }

doc/install.html

@@ -114,7 +114,7 @@
      by creating a file in the data directory called .htaccess, containing this line:
   <blockquote>
      
-    <pre>deny from all</pre>
+    <pre>deny from all<br />AllowOverride None</pre>
   </blockquote>
   <p>To make sure that Moodle can save uploaded files in this directory, check that 
      the web server software (eg Apache) has permission to write 

enrol/authorize/authorizenetlib.php

@@ -10,13 +10,14 @@ define('AN_ERROR',    '3');
 define('AN_DELIM',    '|');
 define('AN_ENCAP',    '"');
 
-require_once('const.php');
+require_once($CFG->dirroot.'/enrol/authorize/const.php');
+require_once($CFG->dirroot.'/enrol/authorize/enrol.php');
 
 /**
  * Gets settlement date and time
  *
- * @param int $time Processed time, usually now.
- * @return int Settlement date
+ * @param int $time Time processed, usually now.
+ * @return int Settlement date and time
  */
 function authorize_getsettletime($time)
 {
@@ -54,10 +55,6 @@ function authorize_expired(&$order)
 {
     static $timediff30;
 
-    if (empty($timediff30)) {
-        $timediff30 = authorize_getsettletime(time()) - (30 * 24 * 3600);
-    }
-
     if ($order->status == AN_STATUS_EXPIRE) {
         return true;
     }
@@ -65,28 +62,32 @@ function authorize_expired(&$order)
         return false;
     }
 
-    $exp = (authorize_getsettletime($order->timecreated) < $timediff30);
+    if (empty($timediff30)) {
+        $timediff30 = authorize_getsettletime(time()) - (30 * 24 * 3600);
+    }
 
-    if ($exp) {
+    $isexpired = (authorize_getsettletime($order->timecreated) < $timediff30);
+    if ($isexpired) {
         $order->status = AN_STATUS_EXPIRE;
         update_record('enrol_authorize', $order);
     }
-
-    return $exp;
+    return $isexpired;
 }
 
 /**
- * Performs an action on authorize.net
+ * Performs an action on authorize.net and updates/inserts records. If record update fails,
+ * sends email to admin.
  *
  * @param object &$order Which transaction data will be sent. See enrol_authorize table.
- * @param string &$message Information about error messages.
- * @param object &$extra Extra transaction data.
+ * @param string &$message Information about error message if this function returns false.
+ * @param object &$extra Extra data that used for refunding and credit card information.
  * @param int $action Which action will be performed. See AN_ACTION_*
- * @return bool true, transaction was successful, false otherwise.
+ * @param string $cctype Used internally to configure credit types automatically.
+ * @return bool true Transaction was successful, false otherwise. Use $message for reason.
  * @author Ethem Evlice <ethem a.t evlice d.o.t com>
  * @uses $CFG
  */
-function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE)
+function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE, $cctype=NULL)
 {
     global $CFG;
     static $conststring;
@@ -94,37 +95,34 @@ function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE)
     $test = !empty($CFG->an_test);
 
     if (!isset($conststring)) {
-        $consdata = array(
+        $mconfig = get_config('enrol/authorize');
+        $constdata = array(
              'x_version'         => '3.1',
              'x_delim_data'      => 'True',
              'x_delim_char'      => AN_DELIM,
              'x_encap_char'      => AN_ENCAP,
              'x_relay_response'  => 'FALSE',
              'x_method'          => 'CC',
-             'x_login'           => $CFG->an_login,
+             'x_login'           => rc4decrypt($mconfig->an_login),
              'x_test_request'    => $test ? 'TRUE' : 'FALSE'
         );
         $str = '';
-        foreach($consdata as $ky => $vl) {
+        foreach($constdata as $ky => $vl) {
             $str .= $ky . '=' . urlencode($vl) . '&';
         }
-        $str .= (!empty($CFG->an_tran_key)) ?
-                'x_tran_key=' . urlencode($CFG->an_tran_key):
-                'x_password=' . urlencode($CFG->an_password);
+        $str .= (!empty($mconfig->an_tran_key)) ?
+                'x_tran_key=' . urlencode(rc4decrypt($mconfig->an_tran_key)):
+                'x_password=' . urlencode(rc4decrypt($mconfig->an_password));
 
         $conststring = $str;
     }
 
     $action = intval($action);
 
-    if (empty($order) || empty($order->id)) {
+    if (empty($order) or empty($order->id)) {
         $message = "Check order->id!";
         return false;
     }
-    elseif ($action <= AN_ACTION_NONE || $action > AN_ACTION_VOID) {
-        $message = "No action taken!";
-        return false;
-    }
 
     $poststring = $conststring;
 
@@ -180,11 +178,10 @@ function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE)
                 return false;
             }
             if (empty($extra)) {
-                $message = "need extra fields for CREDIT!";
+                $message = "Need extra fields to REFUND!";
                 return false;
             }
             $total = floatval($extra->sum) + floatval($extra->amount);
-            unset($extra->sum); // this is not used in refunds table.
             if (($extra->amount == 0) || ($total > $order->amount)) {
                 $message = "Can be credited up to original amount.";
                 return false;
@@ -198,20 +195,8 @@ function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE)
 
         case AN_ACTION_VOID:
         {
-            if ($order->status == AN_STATUS_AUTH) {
-                if (authorize_expired($order)) {
-                    $message = "Authorized transaction must be voided within 30 days. EXPIRED!";
-                    return false;
-                }
-            }
-            elseif ($order->status == AN_STATUS_AUTHCAPTURE or $order->status == AN_STATUS_CREDIT) {
-                if (authorize_settled($order)) {
-                    $message = "Settled transaction cannot be voided. Check Cut-Off time!";
-                    return false;
-                }
-            }
-            else {
-                $message = "Order status must be authorized, auth/captured or refunded!";
+            if (authorize_expired($order) || authorize_settled($order)) {
+                $message = "The transaction cannot be voided due to the fact that it is expired or settled.";
                 return false;
             }
             $poststring .= '&x_type=VOID&x_trans_id=' . urlencode($order->transid);
@@ -219,7 +204,7 @@ function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE)
         }
 
         default: {
-            $message = "Missing action? $action";
+            $message = "Invalid action: $action";
             return false;
         }
     }
@@ -229,6 +214,7 @@ function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE)
         $referer = "Referer: $CFG->an_referer\r\n";
     }
 
+    $errno = 0; $errstr = '';
     $host = $test ? 'certification.authorize.net' : 'secure.authorize.net';
     $fp = fsockopen("ssl://$host", 443, $errno, $errstr, 60);
     if (!$fp) {
@@ -236,6 +222,12 @@ function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE)
         return false;
     }
 
+    // critical section
+    @ignore_user_abort(true);
+    if (intval(ini_get('max_execution_time')) > 0) {
+        @set_time_limit(300);
+    }
+
     fwrite($fp, "POST /gateway/transact.dll HTTP/1.0\r\n" .
                 "Host: $host\r\n" . $referer .
                 "Content-type: application/x-www-form-urlencoded\r\n" .
@@ -284,11 +276,15 @@ function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE)
                 $order->transid = $transid;
                 if ($action == AN_ACTION_AUTH_ONLY) {
                     $order->status = AN_STATUS_AUTH;
-                    // dont't update settletime
+                    // don't update order->settletime
                 } else {
                     $order->status = AN_STATUS_AUTHCAPTURE;
                     $order->settletime = authorize_getsettletime(time());
                 }
+                if (! update_record('enrol_authorize', $order)) {
+                    enrolment_plugin_authorize::email_to_admin("Error while trying to update data " .
+                    "in table enrol_authorize. Please edit manually this record: ID=$order->id.", $order);
+                }
                 break;
             }
             case AN_ACTION_CREDIT:
@@ -298,30 +294,47 @@ function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE)
                 $extra->status = AN_STATUS_CREDIT;
                 $extra->transid = $transid;
                 $extra->settletime = authorize_getsettletime(time());
+                unset($extra->sum); // this is not used in refunds table.
+                if (! $extra->id = insert_record('enrol_authorize_refunds', $extra)) {
+                    enrolment_plugin_authorize::email_to_admin("Error while trying to insert data " .
+                    "into table enrol_authorize_refunds. Please add manually this record:", $extra);
+                }
                 break;
             }
             case AN_ACTION_VOID:
             {
+                $tableupdate = ($order->status == AN_STATUS_CREDIT) ? 'enrol_authorize_refunds' : 'enrol_authorize';
                 $order->status = AN_STATUS_VOID;
-                // dont't update settletime
+                // don't update order->settletime
+                if (! update_record($tableupdate, $order)) {
+                    enrolment_plugin_authorize::email_to_admin("Error while trying to update data " .
+                    "in table $tableupdate. Please edit manually this record: ID=$order->id.", $order);
+                }
                 break;
             }
-            default: return false;
         }
         return true;
     }
     else
     {
-        $reason = "reason" . $response[2];
-        $message = get_string($reason, "enrol_authorize");
-        if ($message == '[[' . $reason . ']]') {
+        $reasonno = $response[2];
+        $reasonstr = "reason" . $reasonno;
+        $message = get_string($reasonstr, "enrol_authorize");
+        if ($message == '[[' . $reasonstr . ']]') {
             $message = isset($response[3]) ? $response[3] : 'unknown error';
         }
-        if (!empty($CFG->an_avs)) {
+        if (! (empty($CFG->an_avs) or $response[5] == "P")) { // P = AVS not applicable
             $avs = "avs" . strtolower($response[5]);
             $stravs = get_string($avs, "enrol_authorize");
             $message .= "<br />" . get_string("avsresult", "enrol_authorize", $stravs);
         }
+        if (!$test && !empty($cctype) && ($reasonno == 17 or $reasonno == 28)) {
+            $ccaccepts = enrolment_plugin_authorize::get_list_of_creditcards();
+            unset($ccaccepts[$cctype]);
+            set_config('an_acceptccs', implode(',', array_keys($ccaccepts)));
+            enrolment_plugin_authorize::email_to_admin("$message: ($cctype)" .
+            "This is new config(an_acceptccs):", $ccaccepts);
+        }
         return false;
     }
 }

enrol/authorize/config.html

@@ -9,6 +9,7 @@ if (!isset($frm->enrol_mailadmins)) $frm->enrol_mailadmins = '';
 if (!isset($frm->an_login)) $frm->an_login = '';
 if (!isset($frm->an_tran_key)) $frm->an_tran_key = '';
 if (!isset($frm->an_password)) $frm->an_password = '';
+if (!isset($frm->delete_current)) $frm->delete_current = '';
 if (!isset($frm->an_referer)) $frm->an_referer = 'http://';
 if (!isset($frm->an_avs)) $frm->an_avs = '';
 if (!isset($frm->an_test)) $frm->an_test = '';
@@ -31,7 +32,7 @@ if (!isset($frm->an_cutoff_hour)) {
 }
 
 if (!isset($frm->acceptccs)) {
-    $frm->acceptccs = array_keys(get_list_of_creditcards());
+    $frm->acceptccs = array_keys(enrolment_plugin_authorize::get_list_of_creditcards());
     $CFG->an_acceptccs = implode(',', $frm->acceptccs);
 }
 
@@ -48,7 +49,7 @@ if (!isset($frm->acceptccs)) {
 <tr valign="top">
     <td align="right">enrol_cost:</td>
     <td><input type="text" size="5" name="enrol_cost" value="<?php p($frm->enrol_cost) ?>" /></td>
-    <td><?php print_string("costdefault") ?></td>
+    <td><?php print_string("costdefault") ?>. <?php print_string("costdefaultdesc", "enrol_authorize") ?></td>
 </tr>
 
 <tr valign="top">
@@ -78,32 +79,35 @@ if (!isset($frm->acceptccs)) {
 <tr valign="top"><td colspan="3"><h4><?php print_string("adminauthorizesettings", "enrol_authorize") ?></h4></td></tr>
 
 <tr valign="top">
-    <td align="right">an_login:</td>
-    <td><input type="text" name="an_login" value="<?php p($frm->an_login) ?>" /></td>
-    <td><?php print_string("anlogin", "enrol_authorize") ?></td>
+    <td align="right">&nbsp;&nbsp;</td>
+    <td><?php print_string("logininfo", "enrol_authorize") ?></td>
 </tr>
 
 <tr valign="top">
-    <td align="right">#&nbsp;</td>
-    <td colspan="2"><?php print_string("chooseone", "enrol_authorize") ?></td>
+    <td align="right">an_login:<br /><?php echo (isset($mconfig->an_login)) ? '<font color=green>'.get_string('ok').'</font>' : ''; ?></td>
+    <td><?php print_string("anlogin", "enrol_authorize") ?><br /><input type="text" name="an_login" size="26" value="" /><sup>*</sup></td>
 </tr>
 
 <tr valign="top">
-    <td align="right">an_tran_key:</td>
-    <td><input type="text" name="an_tran_key" value="<?php p($frm->an_tran_key) ?>" /></td>
-    <td><?php print_string("antrankey", "enrol_authorize") ?></td>
+    <td align="right">an_tran_key:<br /><?php echo (isset($mconfig->an_tran_key)) ? '<font color=green>'.get_string('ok').'</font>' : ''; ?></td>
+    <td><?php print_string("antrankey", "enrol_authorize") ?><br /><input type="text" name="an_tran_key" size="26" value="" /><sup>#1</sup></td>
 </tr>
 
 <tr valign="top">
-    <td align="right">an_password:</td>
-    <td><input type="text" name="an_password" value="<?php p($frm->an_password) ?>" /></td>
-    <td><?php print_string("anpassword", "enrol_authorize") ?></td>
+    <td align="right">an_password:<br /><?php echo (isset($mconfig->an_password)) ? '<font color=green>'.get_string('ok').'</font>' : ''; ?></td>
+    <td><?php print_string("anpassword", "enrol_authorize") ?><br /><input type="text" name="an_password" size="26" value="" /><sup>#2</sup></td>
+</tr>
+
+<tr valign="top">
+    <td align="right">delete_current:</td>
+    <td><?php print_checkbox('delete_current', '1', !empty($frm->delete_current)) ?> <br />
+        <?php print_string("deletecheck", "moodle", get_string('oldpassword')) ?><br /><hr size="1" width="100%" noshade /></td>
 </tr>
 
 <tr valign="top">
     <td align="right">an_referer:</td>
-    <td><input type="text" name="an_referer" value="<?php p($frm->an_referer) ?>" /></td>
-    <td><?php print_string("anreferer", "enrol_authorize") ?></td>
+    <td><input type="text" name="an_referer" size="35" value="<?php p($frm->an_referer) ?>" /><br />
+        <?php print_string("anreferer", "enrol_authorize") ?></td>
 </tr>
 
 <tr valign="top">
@@ -127,7 +131,7 @@ if (!isset($frm->acceptccs)) {
 <tr valign="top">
     <td align="right">an_acceptccs:</td>
     <td><?php
-    $allccs = get_list_of_creditcards(true);
+    $allccs = enrolment_plugin_authorize::get_list_of_creditcards(true);
     foreach ($allccs as $key => $val) {
         print_checkbox('acceptccs[]', $key, stristr($CFG->an_acceptccs, $key) !== false, $val); echo "<br />\n";
     }

enrol/authorize/db/mysql.php

@@ -108,6 +108,27 @@ function enrol_authorize_upgrade($oldversion=0) {
         delete_records('config_plugins', 'name', 'an_nextmail');
     }
 
+    if ($oldversion < 2006021531) { // Don't show authorize.net login info at config page
+        if (isset($CFG->an_login)) {
+            if (!empty($CFG->an_login)) {
+                set_config('an_login', rc4encrypt($CFG->an_login), 'enrol/authorize');
+            }
+            delete_records('config', 'name', 'an_login');
+        }
+        if (isset($CFG->an_tran_key)) {
+            if (!empty($CFG->an_tran_key)) {
+                set_config('an_tran_key', rc4encrypt($CFG->an_tran_key), 'enrol/authorize');
+            }
+            delete_records('config', 'name', 'an_tran_key');
+        }
+        if (isset($CFG->an_password)) {
+            if (!empty($CFG->an_password)) {
+                set_config('an_password', rc4encrypt($CFG->an_password), 'enrol/authorize');
+            }
+            delete_records('config', 'name', 'an_password');
+        }
+    }
+
     return $result;
 }
 

enrol/authorize/db/postgres7.php

@@ -119,6 +119,27 @@ function enrol_authorize_upgrade($oldversion=0) {
         delete_records('config_plugins', 'name', 'an_nextmail');
     }
 
+    if ($oldversion < 2006021531) { // Don't show authorize.net login info at config page
+        if (isset($CFG->an_login)) {
+            if (!empty($CFG->an_login)) {
+                set_config('an_login', rc4encrypt($CFG->an_login), 'enrol/authorize');
+            }
+            delete_records('config', 'name', 'an_login');
+        }
+        if (isset($CFG->an_tran_key)) {
+            if (!empty($CFG->an_tran_key)) {
+                set_config('an_tran_key', rc4encrypt($CFG->an_tran_key), 'enrol/authorize');
+            }
+            delete_records('config', 'name', 'an_tran_key');
+        }
+        if (isset($CFG->an_password)) {
+            if (!empty($CFG->an_password)) {
+                set_config('an_password', rc4encrypt($CFG->an_password), 'enrol/authorize');
+            }
+            delete_records('config', 'name', 'an_password');
+        }
+    }
+
     return $result;
 }
 

enrol/authorize/enrol.html

@@ -1,8 +1,8 @@
 <?php // $Id$
 
-$this->prevent_double_paid($course);
+enrolment_plugin_authorize::prevent_double_paid($course);
 $formvars = array('password', 'ccaddress', 'cccity', 'ccstate', 'cccountry', 'cczip',
-                  'ccfirstname', 'cclastname', 'cc', 'ccexpiremm', 'ccexpireyyyy', 'cctype', 'cvv');
+                  'firstname', 'lastname', 'cc', 'ccexpiremm', 'ccexpireyyyy', 'cctype', 'cvv');
 
 foreach ($formvars as $var) {
     if (!isset($form->$var)) {
@@ -10,9 +10,9 @@ foreach ($formvars as $var) {
     }
 }
 
-$curcost = $this->get_course_cost($course);
-$userfirstname = empty($form->ccfirstname) ? $USER->firstname : $form->ccfirstname;
-$userlastname = empty($form->cclastname) ? $USER->lastname : $form->cclastname;
+$curcost = enrolment_plugin_authorize::get_course_cost($course);
+$userfirstname = empty($form->firstname) ? $USER->firstname : $form->firstname;
+$userlastname = empty($form->lastname) ? $USER->lastname : $form->lastname;
 $useraddress = empty($form->ccaddress) ? $USER->address : $form->ccaddress;
 $usercity = empty($form->cccity) ? $USER->city : $form->cccity;
 $usercountry = empty($form->cccountry) ? $USER->country : $form->cccountry;
@@ -37,8 +37,8 @@ $usercountry = empty($form->cccountry) ? $USER->country : $form->cccountry;
 </tr>
 <tr>
   <td align="right"><?php print_string("nameoncard", "enrol_authorize") ?>: </td>
-  <td align="left"><input type="text" name="ccfirstname" size="8" value="<?php p($userfirstname) ?>" />
-  <input type="text" name="cclastname" size="8" value="<?php p($userlastname) ?>" />
+  <td align="left"><input type="text" name="firstname" size="8" value="<?php p($userfirstname) ?>" />
+  <input type="text" name="lastname" size="8" value="<?php p($userlastname) ?>" />
   <?php if (!empty($this->ccerrors['ccfirstlast'])) { formerr($this->ccerrors['ccfirstlast']); } ?></td>
 </tr>
 <tr>
@@ -60,7 +60,7 @@ $usercountry = empty($form->cccountry) ? $USER->country : $form->cccountry;
 <tr>
   <td align="right"><?php print_string("cctype", "enrol_authorize") ?>: </td>
   <td align="left"><?php
-  choose_from_menu(get_list_of_creditcards(), 'cctype', $form->cctype);
+  choose_from_menu(enrolment_plugin_authorize::get_list_of_creditcards(), 'cctype', $form->cctype);
   if (!empty($this->ccerrors['cctype'])) { formerr($this->ccerrors['cctype']); }
   ?>
 </td>

enrol/authorize/enrol.php

@@ -1,44 +1,8 @@
-<?php  // $Id$
+<?php // $Id$
 
 require_once($CFG->dirroot.'/enrol/enrol.class.php');
 require_once($CFG->dirroot.'/enrol/authorize/const.php');
 
-/**
- * get_list_of_creditcards
- *
- * @param bool $getall
- * @return array
- */
-function get_list_of_creditcards($getall = false)
-{
-    global $CFG;
-
-    $alltypes = array(
-        'mcd' => 'Master Card',
-        'vis' => 'Visa',
-        'amx' => 'American Express',
-        'dsc' => 'Discover',
-        'dnc' => 'Diners Club',
-        'jcb' => 'JCB',
-        'swi' => 'Switch',
-        'dlt' => 'Delta',
-        'enr' => 'EnRoute'
-    );
-
-    if ($getall || empty($CFG->an_acceptccs)) {
-        return $alltypes;
-    }
-
-    $ret = array();
-    $ccs = explode(',', $CFG->an_acceptccs);
-
-    foreach ($ccs as $key) {
-        $ret[$key] = $alltypes[$key];
-    }
-
-    return $ret;
-}
-
 /**
  * enrolment_plugin_authorize
  *
@@ -100,7 +64,7 @@ class enrolment_plugin_authorize
     function print_entry($course) {
         global $CFG, $USER, $form;
 
-        $zerocost = $this->zero_cost($course);
+        $zerocost = enrolment_plugin_authorize::zero_cost($course);
         if ($zerocost) {
             $manual = enrolment_factory::factory('manual');
             if (!empty($this->errormsg)) {
@@ -110,9 +74,7 @@ class enrolment_plugin_authorize
             return;
         }
 
-        httpsrequired();
-
-        if (empty($_SERVER['HTTPS']) || $_SERVER['HTTPS'] == 'off') {
+        if (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] != 443) { // MDL-9836
             if (empty($CFG->loginhttps)) {
                 error(get_string('httpsrequired', 'enrol_authorize'));
             } else {
@@ -122,6 +84,8 @@ class enrolment_plugin_authorize
             }
         }
 
+        httpsrequired();
+
         $strcourses = get_string('courses');
         $strloginto = get_string('loginto', '', $course->shortname);
 
@@ -132,17 +96,18 @@ class enrolment_plugin_authorize
             print_heading(get_string('choosemethod', 'enrol_authorize'), 'center');
         }
 
+        print_simple_box_start('center');
         if (isguest()) {
-            $curcost = $this->get_course_cost($course);
-            echo '<div align="center"><p>'.get_string('paymentrequired').'</p>';
+            $curcost = enrolment_plugin_authorize::get_course_cost($course);
+            echo '<div align="center">';
+            echo '<p>'.get_string('paymentrequired').'</p>';
             echo '<p><b>'.get_string('cost').": $curcost[currency] $curcost[cost]".'</b></p>';
             echo '<p><a href="'.$CFG->httpswwwroot.'/login/">'.get_string('loginsite').'</a></p>';
             echo '</div>';
         } else {
-            print_simple_box_start('center');
             include($CFG->dirroot.'/enrol/authorize/enrol.html');
-            print_simple_box_end();
         }
+        print_simple_box_end();
 
         if ($course->password) {
             $password = '';
@@ -162,7 +127,8 @@ class enrolment_plugin_authorize
      * @access public
      */
     function check_entry($form, $course) {
-        if ($this->zero_cost($course) or (!empty($course->password) and !empty($form->password))) {
+        if (enrolment_plugin_authorize::zero_cost($course) or
+           (!empty($course->password) and !empty($form->password))) {
             $manual = enrolment_factory::factory('manual');
             $manual->check_entry($form, $course);
             if (!empty($manual->errormsg)) {
@@ -187,17 +153,17 @@ class enrolment_plugin_authorize
         global $CFG, $USER, $SESSION;
         require_once('authorizenetlib.php');
 
-        $this->prevent_double_paid($course);
+        enrolment_plugin_authorize::prevent_double_paid($course);
 
         $useripno = getremoteaddr();
-        $curcost = $this->get_course_cost($course);
+        $curcost = enrolment_plugin_authorize::get_course_cost($course);
         $exp_date = sprintf("%02d", $form->ccexpiremm) . $form->ccexpireyyyy;
 
         // NEW ORDER
         $timenow = time();
         $order = new stdClass();
         $order->cclastfour = substr($form->cc, -4);
-        $order->ccname = $form->ccfirstname . " " . $form->cclastname;
+        $order->ccname = $form->firstname . " " . $form->lastname;
         $order->courseid = $course->id;
         $order->userid = $USER->id;
         $order->status = AN_STATUS_NONE; // it will be changed...
@@ -208,7 +174,7 @@ class enrolment_plugin_authorize
         $order->currency = $curcost['currency'];
         $order->id = insert_record("enrol_authorize", $order);
         if (!$order->id) {
-            $this->email_to_admin("Error while trying to insert new data", $order);
+            enrolment_plugin_authorize::email_to_admin("Error while trying to insert new data", $order);
             $this->ccerrors['header'] = "Insert record error. Admin has been notified!";
             return;
         }
@@ -219,8 +185,8 @@ class enrolment_plugin_authorize
         $extra->x_exp_date = $exp_date;
         $extra->x_currency_code = $curcost['currency'];
         $extra->x_amount = $curcost['cost'];
-        $extra->x_first_name = $form->ccfirstname;
-        $extra->x_last_name = $form->cclastname;
+        $extra->x_first_name = $form->firstname;
+        $extra->x_last_name = $form->lastname;
         $extra->x_country = $form->cccountry;
         $extra->x_address = $form->ccaddress;
         $extra->x_state = $form->ccstate;
@@ -240,9 +206,9 @@ class enrolment_plugin_authorize
         $message = '';
         $an_review = !empty($CFG->an_review);
         $action = $an_review ? AN_ACTION_AUTH_ONLY : AN_ACTION_AUTH_CAPTURE;
-        $success = authorize_action($order, $message, $extra, $action);
+        $success = authorize_action($order, $message, $extra, $action, $form->cctype);
         if (!$success) {
-            $this->email_to_admin($message, $order);
+            enrolment_plugin_authorize::email_to_admin($message, $order);
             $this->ccerrors['header'] = $message;
             return;
         }
@@ -261,43 +227,31 @@ class enrolment_plugin_authorize
             return;
         }
 
-        if ($an_review) { // review enabled, inform admin and redirect to main page.
-            if (update_record("enrol_authorize", $order)) {
-                $a = new stdClass;
-                $a->url = "$CFG->wwwroot/enrol/authorize/index.php?order=$order->id";
-                $a->orderid = $order->id;
-                $a->transid = $order->transid;
-                $a->amount = "$order->currency $order->amount";
-                $a->expireon = userdate(authorize_getsettletime($timenow + (30 * 3600 * 24)));
-                $a->captureon = userdate(authorize_getsettletime($timenow + (intval($CFG->an_capture_day) * 3600 * 24)));
-                $a->course = $course->fullname;
-                $a->user = fullname($USER);
-                $a->acstatus = ($CFG->an_capture_day > 0) ? get_string('yes') : get_string('no');
-                $emailmessage = get_string('adminneworder', 'enrol_authorize', $a);
-                $a = new stdClass;
-                $a->course = $course->shortname;
-                $a->orderid = $order->id;
-                $emailsubject = get_string('adminnewordersubject', 'enrol_authorize', $a);
-                $admins = get_admins();
-                foreach ($admins as $admin) {
-                    email_to_user($admin, $USER, $emailsubject, $emailmessage);
-                }
-            }
-            else {
-                $this->email_to_admin("Error while trying to update data. Please edit manually this record: " .
-                                      "ID=$order->id in enrol_authorize table.", $order);
+        if ($an_review) { // review enabled, inform admin and redirect user to main page.
+            $a = new stdClass;
+            $a->url = "$CFG->wwwroot/enrol/authorize/index.php?order=$order->id";
+            $a->orderid = $order->id;
+            $a->transid = $order->transid;
+            $a->amount = "$order->currency $order->amount";
+            $a->expireon = userdate(authorize_getsettletime($timenow + (30 * 3600 * 24)));
+            $a->captureon = userdate(authorize_getsettletime($timenow + (intval($CFG->an_capture_day) * 3600 * 24)));
+            $a->course = $course->fullname;
+            $a->user = fullname($USER);
+            $a->acstatus = ($CFG->an_capture_day > 0) ? get_string('yes') : get_string('no');
+            $emailmessage = get_string('adminneworder', 'enrol_authorize', $a);
+            $a = new stdClass;
+            $a->course = $course->shortname;
+            $a->orderid = $order->id;
+            $emailsubject = get_string('adminnewordersubject', 'enrol_authorize', $a);
+            $admins = get_admins();
+            foreach ($admins as $admin) {
+                email_to_user($admin, $USER, $emailsubject, $emailmessage);
             }
             redirect($CFG->wwwroot, get_string("reviewnotify", "enrol_authorize"), '30');
             return;
         }
 
-        // credit card captured, ENROL student...
-        if (!update_record("enrol_authorize", $order)) {
-            $this->email_to_admin("Error while trying to update data. Please edit manually this record: " .
-                                   "ID=$order->id in enrol_authorize table.", $order);
-                                   // no error occured??? enrol student??? return??? Database busy???
-        }
-
+        // Credit card captured, ENROL student now...
         if ($course->enrolperiod) {
             $timestart = $timenow;
             $timeend = $timestart + $course->enrolperiod;
@@ -338,7 +292,8 @@ class enrolment_plugin_authorize
                 }
             }
         } else {
-            $this->email_to_admin("Error while trying to enrol ".fullname($USER)." in '$course->fullname'", $order);
+            enrolment_plugin_authorize::email_to_admin("Error while trying to enrol " .
+            fullname($USER) . " in '$course->fullname'", $order);
         }
 
         if ($SESSION->wantsurl) {
@@ -379,7 +334,7 @@ class enrolment_plugin_authorize
             }
         }
 
-        if (empty($form->ccfirstname) || empty($form->cclastname)) {
+        if (empty($form->firstname) || empty($form->lastname)) {
             $this->ccerrors['ccfirstlast'] = get_string('missingfullname');
         }
 
@@ -387,7 +342,8 @@ class enrolment_plugin_authorize
             $this->ccerrors['cvv'] = get_string('missingcvv', 'enrol_authorize');
         }
 
-        if (empty($form->cctype) || !in_array($form->cctype, array_keys(get_list_of_creditcards()))) {
+        if (empty($form->cctype) or
+            !in_array($form->cctype, array_keys(enrolment_plugin_authorize::get_list_of_creditcards()))) {
             $this->ccerrors['cctype'] = get_string('missingcctype', 'enrol_authorize');
         }
 
@@ -414,45 +370,6 @@ class enrolment_plugin_authorize
         return true;
     }
 
-    /**
-     * zero_cost
-     *
-     * @param unknown_type $course
-     * @return number
-     * @access private
-     */
-    function zero_cost($course) {
-        $curcost = $this->get_course_cost($course);
-        return (abs($curcost['cost']) < 0.01);
-    }
-
-
-    /**
-     * get_course_cost
-     *
-     * @param object $course
-     * @return array
-     * @access private
-     */
-    function get_course_cost($course)
-    {
-        global $CFG;
-
-        $cost = (float)0;
-        $currency = (!empty($course->currency))
-                     ? $course->currency :( empty($CFG->enrol_currency)
-                                            ? 'USD' : $CFG->enrol_currency );
-
-        if (!empty($course->cost)) {
-            $cost = (float)(((float)$course->cost) < 0) ? $CFG->enrol_cost : $course->cost;
-        }
-
-        $cost = format_float($cost, 2);
-        $ret = array('cost' => $cost, 'currency' => $currency);
-
-        return $ret;
-    }
-
 
     /**
      * Gets access icons.
@@ -465,7 +382,7 @@ class enrolment_plugin_authorize
 
         $manual = enrolment_factory::factory('manual');
         $str = $manual->get_access_icons($course);
-        $curcost = $this->get_course_cost($course);
+        $curcost = enrolment_plugin_authorize::get_course_cost($course);
 
         if (abs($curcost['cost']) > 0.00) {
             $strrequirespayment = get_string("requirespayment");
@@ -497,21 +414,31 @@ class enrolment_plugin_authorize
     function config_form($frm)
     {
         global $CFG;
+        $mconfig = get_config('enrol/authorize');
 
-        if (!$this->check_openssl_loaded()) {
+        if (! enrolment_plugin_authorize::check_openssl_loaded()) {
             notify('PHP must be compiled with SSL support (--with-openssl)');
         }
 
         if (empty($CFG->loginhttps) and substr($CFG->wwwroot, 0, 5) !== 'https') {
-            notify('loginhttps must be ON');
+            $a = new stdClass;
+            $a->url = "$CFG->wwwroot/$CFG->admin/config.php#configsectionsecurity";
+            notice(get_string('adminconfighttps', 'enrol_authorize', $a));
+        }
+        elseif (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] != 443) { // MDL-9836
+            $wwwsroot = qualified_me();
+            $wwwsroot = str_replace('http:', 'https:', $wwwsroot);
+            $a = new stdClass;
+            $a->url = $wwwsroot;
+            notice(get_string('adminconfighttpsgo', 'enrol_authorize', $a));
         }
 
         if (!empty($frm->an_review)) {
             $captureday = intval($frm->an_capture_day);
             $emailexpired = intval($frm->an_emailexpired);
             if ($captureday > 0 || $emailexpired > 0) {
-                $mconfig = get_config('enrol/authorize');
-                if ((time() - intval($mconfig->an_lastcron) > 3600 * 24)) {
+                $lastcron = get_field_sql('SELECT max(lastcron) FROM ' . $CFG->prefix . 'modules');
+                if ((time() - intval($lastcron) > 3600 * 24)) {
                     notify(get_string('admincronsetup', 'enrol_authorize'));
                 }
             }
@@ -525,10 +452,10 @@ class enrolment_plugin_authorize
         }
 
         if (data_submitted()) {
-            if (empty($frm->an_login)) {
+            if (empty($mconfig->an_login)) {
                 notify("an_login required");
             }
-            if (empty($frm->an_tran_key) && empty($frm->an_password)) {
+            if (empty($mconfig->an_tran_key) && empty($mconfig->an_password)) {
                 notify("an_tran_key or an_password required");
             }
         }
@@ -547,9 +474,12 @@ class enrolment_plugin_authorize
     function process_config($config)
     {
         global $CFG;
+        $mconfig = get_config('enrol/authorize');
 
         // site settings
-        set_config('enrol_cost', optional_param('enrol_cost', 5, PARAM_INT));
+        if (($cost = optional_param('enrol_cost', 5, PARAM_INT)) > 0) {
+            set_config('enrol_cost', $cost);
+        }
         set_config('enrol_currency', optional_param('enrol_currency', 'USD', PARAM_ALPHA));
         set_config('enrol_mailstudents', optional_param('enrol_mailstudents', 0, PARAM_BOOL));
         set_config('enrol_mailteachers', optional_param('enrol_mailteachers', 0, PARAM_BOOL));
@@ -561,7 +491,9 @@ class enrolment_plugin_authorize
         set_config('an_teachermanagepay', optional_param('an_teachermanagepay', 0, PARAM_BOOL));
         set_config('an_referer', optional_param('an_referer', 'http://', PARAM_URL));
 
-        $acceptccs = optional_param('acceptccs', array_keys(get_list_of_creditcards()), PARAM_ALPHA);
+        $acceptccs = optional_param('acceptccs',
+                                    array_keys(enrolment_plugin_authorize::get_list_of_creditcards()),
+                                    PARAM_ALPHA);
         set_config('an_acceptccs', implode(',', $acceptccs));
 
         $cutoff_hour = optional_param('an_cutoff_hour', 0, PARAM_INT);
@@ -577,12 +509,12 @@ class enrolment_plugin_authorize
 
         $captureday = ($captureday > 29) ? 29 : (($captureday < 0) ? 0 : $captureday);
         $emailexpired = ($emailexpired > 5) ? 5 : (($emailexpired < 0) ? 0 : $emailexpired);
-        $mconfig = get_config('enrol/authorize');
 
-        if ((!empty($reviewval)) &&
-            ($captureday > 0 || $emailexpired > 0) &&
-            (time() - intval($mconfig->an_lastcron) > 3600 * 24)) {
-            return false;
+        if (!empty($reviewval) && ($captureday > 0 || $emailexpired > 0)) {
+            $lastcron = get_field_sql('SELECT max(lastcron) FROM ' . $CFG->prefix . 'modules');
+            if (time() - intval($lastcron) > 3600 * 24) {
+                return false;
+            }
         }
 
         set_config('an_review', $reviewval);
@@ -591,32 +523,89 @@ class enrolment_plugin_authorize
         set_config('an_emailexpiredteacher', $emailexpiredteacher);
         set_config('an_sorttype', $sorttype);
 
-        // required fields
-        $loginval = optional_param('an_login', '');
-        $tranval = optional_param('an_tran_key', '');
-        $passwordval = optional_param('an_password', '');
-
-        if ((empty($CFG->loginhttps) and substr($CFG->wwwroot, 0, 5) !== 'https') ||
-            !$this->check_openssl_loaded() ||
-            empty($loginval) ||
-            (empty($tranval) and empty($passwordval))) {
+        // https and openssl library is required
+        if ((substr($CFG->wwwroot, 0, 5) !== 'https' and empty($CFG->loginhttps)) or
+            !enrolment_plugin_authorize::check_openssl_loaded()) {
             return false;
         }
 
-        set_config('an_login', $loginval);
-        set_config('an_password', $passwordval);
-        set_config('an_tran_key', $tranval);
+        // REQUIRED fields;
+        // an_login
+        $loginval = optional_param('an_login', '');
+        if (empty($loginval) && empty($mconfig->an_login)) {
+            return false;
+        }
+        $loginval = !empty($loginval) ? rc4encrypt($loginval) : strval($mconfig->an_login);
+        set_config('an_login', $loginval, 'enrol/authorize');
+
+        // an_tran_key, an_password
+        $tranval = optional_param('an_tran_key', '');
+        $tranval = !empty($tranval) ? rc4encrypt($tranval) : (isset($mconfig->an_tran_key)?$mconfig->an_tran_key:'');
+        $passwordval = optional_param('an_password', '');
+        $passwordval = !empty($passwordval) ? rc4encrypt($passwordval) :(isset($mconfig->an_password)?$mconfig->an_password:'');
+        $deletecurrent = optional_param('delete_current', '0', PARAM_BOOL);
+        if (!empty($deletecurrent) and !empty($tranval)) {
+            delete_records('config_plugins', 'name', 'an_password', 'plugin', 'enrol/authorize');
+            $passwordval = '';
+        }
+        elseif (!empty($passwordval)) {
+            set_config('an_password', $passwordval, 'enrol/authorize');
+        }
+        if (empty($tranval) and empty($passwordval)) {
+            return false;
+        }
+        if (!empty($tranval)) {
+            set_config('an_tran_key', $tranval, 'enrol/authorize');
+        }
 
         return true;
     }
 
+    /**
+     * zero_cost (static method)
+     *
+     * @param unknown_type $course
+     * @return number
+     * @static
+     */
+    function zero_cost($course) {
+        $curcost = enrolment_plugin_authorize::get_course_cost($course);
+        return (abs($curcost['cost']) < 0.01);
+    }
+
 
     /**
-     * email_to_admin
+     * get_course_cost (static method)
+     *
+     * @param object $course
+     * @return array
+     * @static
+     */
+    function get_course_cost($course)
+    {
+        global $CFG;
+
+        $cost = (float)0;
+        $currency = (!empty($course->currency))
+                     ? $course->currency :( empty($CFG->enrol_currency)
+                                            ? 'USD' : $CFG->enrol_currency );
+
+        if (!empty($course->cost)) {
+            $cost = (float)(((float)$course->cost) < 0) ? $CFG->enrol_cost : $course->cost;
+        }
+
+        $cost = format_float($cost, 2);
+        $ret = array('cost' => $cost, 'currency' => $currency);
+
+        return $ret;
+    }
+
+    /**
+     * email_to_admin (static method)
      *
      * @param string $subject
      * @param mixed $data
-     * @access private
+     * @static
      */
     function email_to_admin($subject, $data)
     {
@@ -625,19 +614,16 @@ class enrolment_plugin_authorize
         $admin = get_admin();
         $data = (array)$data;
 
-        $message = "$SITE->fullname:  Transaction failed.\n\n$subject\n\n";
-        foreach ($data as $key => $value) {
-            $message .= "$key => $value\n";
-        }
-        email_to_user($admin, $admin, "Authorize.net ERROR: ".$subject, $message);
+        $message = "$SITE->fullname: Transaction failed.\n\n$subject\n\n";
+        $message .= print_r($data, true);
+        email_to_user($admin, $admin, "$SITE->fullname: Authorize.net ERROR", $message);
     }
 
-
     /**
-     * prevent_double_paid
+     * prevent_double_paid (static method)
      *
      * @param object $course
-     * @access private
+     * @static
      */
     function prevent_double_paid($course)
     {
@@ -654,22 +640,56 @@ class enrolment_plugin_authorize
         }
         if (isset($SESSION->ccpaid)) {
             unset($SESSION->ccpaid);
-            redirect($CFG->wwwroot . '/login/logout.php');
+            redirect($CFG->wwwroot . '/login/logout.php?sesskey='.sesskey());
             return;
         }
     }
 
-
     /**
-     * check_openssl_loaded
+     * check_openssl_loaded (static method)
      *
      * @return bool
-     * @access private
+     * @static
      */
     function check_openssl_loaded() {
         return extension_loaded('openssl');
     }
 
+    /**
+     * get_list_of_creditcards (static method)
+     *
+     * @param bool $getall
+     * @return array
+     * @static
+     */
+    function get_list_of_creditcards($getall = false)
+    {
+        global $CFG;
+
+        $alltypes = array(
+            'mcd' => 'Master Card',
+            'vis' => 'Visa',
+            'amx' => 'American Express',
+            'dsc' => 'Discover',
+            'dnc' => 'Diners Club',
+            'jcb' => 'JCB',
+            'swi' => 'Switch',
+            'dlt' => 'Delta',
+            'enr' => 'EnRoute'
+        );
+
+        if ($getall or empty($CFG->an_acceptccs)) {
+            return $alltypes;
+        }
+
+        $ret = array();
+        $ccs = explode(',', $CFG->an_acceptccs);
+        foreach ($ccs as $key) {
+            $ret[$key] = $alltypes[$key];
+        }
+        return $ret;
+    }
+
 
     /**
      * This function is run by admin/cron.php every time if admin has enabled this plugin.
@@ -692,23 +712,22 @@ class enrolment_plugin_authorize
         $timediff30 = $settlementtime - (30 * $oneday);
 
         $mconfig = get_config('enrol/authorize');
-        set_config('an_lastcron', $timenow, 'enrol/authorize');
 
         mtrace("Processing authorize cron...");
 
         if (intval($mconfig->an_dailysettlement) < $settlementtime) {
             set_config('an_dailysettlement', $settlementtime, 'enrol/authorize');
-            mtrace("    daily cron: some cleanups and sending email to admins the count of pending orders expiring", "...");
+            mtrace("    daily cron; some cleanups and sending email to admins the count of pending orders expiring", ": ");
             $this->cron_daily();
-            mtrace("done", "\n");
+            mtrace("done");
         }
 
         mtrace("    scheduled capture", ": ");
         if (empty($CFG->an_review) or
            (!empty($CFG->an_test)) or
            (intval($CFG->an_capture_day) < 1) or
-           (!$this->check_openssl_loaded())) {
-            mtrace("disabled", "\n");
+           (!enrolment_plugin_authorize::check_openssl_loaded())) {
+            mtrace("disabled");
             return; // order review disabled or test mode or manual capture or openssl wasn't loaded.
         }
 
@@ -716,11 +735,11 @@ class enrolment_plugin_authorize
         $sql = "SELECT E.*, C.fullname, C.enrolperiod " .
                "FROM {$CFG->prefix}enrol_authorize E " .
                "INNER JOIN {$CFG->prefix}course C ON C.id = E.courseid " .
-               "WHERE (status = '" .AN_STATUS_AUTH. "') " .
+               "WHERE (E.status = '" .AN_STATUS_AUTH. "') " .
                "  AND (E.timecreated < '$timediffcnf') AND (E.timecreated > '$timediff30')";
 
         if (!$orders = get_records_sql($sql)) {
-            mtrace("no pending orders", "\n");
+            mtrace("no pending orders");
             return;
         }
 
@@ -730,11 +749,12 @@ class enrolment_plugin_authorize
 
         $ordercount = count((array)$orders);
         if (($ordercount * $eachconn) + intval($mconfig->an_lastcron) > $timenow) {
-            mtrace("blocked", "\n");
+            mtrace("blocked");
             return;
         }
+        set_config('an_lastcron', $timenow, 'enrol/authorize');
 
-        mtrace($ordercount ." orders are processing", "\n");
+        mtrace("    $ordercount orders are being processed now", ": ");
 
         $faults = '';
         $sendem = array();
@@ -747,10 +767,6 @@ class enrolment_plugin_authorize
             $extra = NULL;
             $success = authorize_action($order, $message, $extra, AN_ACTION_PRIOR_AUTH_CAPTURE);
             if ($success) {
-                if (!update_record("enrol_authorize", $order)) {
-                    $this->email_to_admin("Error while trying to update data. Please edit manually this record: " .
-                    "ID=$order->id in enrol_authorize table.", $order);
-                }
                 $timestart = $timeend = 0;
                 if ($order->enrolperiod) {
                     $timestart = $timenow;
@@ -775,6 +791,8 @@ class enrolment_plugin_authorize
             }
         }
 
+        mtrace("processed");
+
         $timenow = time();
         $elapsed = $timenow - $elapsed;
         $eachconn = ceil($elapsed / $ordercount);
@@ -796,32 +814,30 @@ class enrolment_plugin_authorize
         }
 
         mtrace("    sending welcome messages to students", ": ");
-        $select = "SELECT E.id, E.courseid, E.userid, C.fullname " .
-                  "FROM {$CFG->prefix}enrol_authorize E " .
-                  "INNER JOIN {$CFG->prefix}course C ON C.id = E.courseid " .
-                  "WHERE E.id IN(" . implode(',', $sendem) . ") " .
-                  "ORDER BY E.userid";
+        $select = "SELECT e.id, e.courseid, e.userid, c.fullname
+                 FROM {$CFG->prefix}enrol_authorize e
+                 INNER JOIN {$CFG->prefix}course c ON c.id = e.courseid
+               WHERE e.id IN(" . implode(',', $sendem) . ")
+               ORDER BY e.userid";
+
         $emailinfo = get_records_sql($select);
-        $emailcount = count($emailinfo);
-        for($i = 0; $i < $emailcount; ) {
+        $ei = reset($emailinfo);
+        while ($ei !== false) {
             $usercourses = array();
-            $lastuserid = $emailinfo[$i]->userid;
-            for ($j=$i; $j < $emailcount and $emailinfo[$j]->userid == $lastuserid; $j++) {
-                $usercourses[] = $emailinfo[$j]->fullname;
+            $lastuserid = $ei->userid;
+            for ($current = $ei; $current !== false && $current->userid == $lastuserid; $current = next($emailinfo)) {
+                $usercourses[] = $current->fullname;
             }
+            $ei = $current;
             $a = new stdClass;
             $a->courses = implode("\n", $usercourses);
             $a->profileurl = "$CFG->wwwroot/user/view.php?id=$lastuserid";
             $a->paymenturl = "$CFG->wwwroot/enrol/authorize/index.php?user=$lastuserid";
             $emailmessage = get_string('welcometocoursesemail', 'enrol_authorize', $a);
             $user = get_record('user', 'id', $lastuserid);
-            email_to_user($user,
-                          $adminuser,
-                          get_string("enrolmentnew", '', $SITE->shortname),
-                          $emailmessage);
-            $i = $j;
+            @email_to_user($user, $adminuser, get_string("enrolmentnew", '', $SITE->shortname), $emailmessage);
         }
-        mtrace("sent", "\n");
+        mtrace("sent");
     }
 
     /**
@@ -887,11 +903,12 @@ class enrolment_plugin_authorize
         }
 
         $sorttype = empty($CFG->an_sorttype) ? 'ttl' : $CFG->an_sorttype;
+        $where = "(E.status='". AN_STATUS_AUTH ."') AND (E.timecreated<'$timediffem') AND (E.timecreated>'$timediff30')";
         $sql = "SELECT E.courseid, E.currency, C.fullname, C.shortname, " .
                "COUNT(E.courseid) AS cnt, SUM(E.amount) as ttl " .
                "FROM {$CFG->prefix}enrol_authorize E " .
                "INNER JOIN {$CFG->prefix}course C ON C.id = E.courseid " .
-               "WHERE $select GROUP BY E.courseid ORDER BY $sorttype DESC";
+               "WHERE $where GROUP BY E.courseid ORDER BY $sorttype DESC";
 
         $courseinfos = get_records_sql($sql);
         foreach($courseinfos as $courseinfo) {

enrol/authorize/index.php

@@ -9,6 +9,11 @@
     $courseid = optional_param('course', SITEID, PARAM_INT);
     $userid   = optional_param('user', 0, PARAM_INT);
 
+/// Get course
+    if (!$course = get_record('course', 'id', $courseid)) {
+        error('Could not find that course');
+    }
+
 /// Only site users can access to this page
     require_login(); // Don't use $courseid! User may want to see old orders.
 
@@ -17,7 +22,7 @@
     }
 
 /// Load strings. All strings should be defined here. locallib.php uses these strings.
-    $strs = get_strings(array('status','action','time','course','confirm','yes','no','all','none','error'));
+    $strs = get_strings(array('status','action','time','course','confirm','no','all','none','error'));
     $authstrs = get_strings(array('orderid','nameoncard','void','capture','refund','delete',
                 'authcaptured','authorizedpendingcapture','capturedpendingsettle','capturedsettled',
                 'settled','refunded','cancelled','expired','tested','new',
@@ -25,11 +30,7 @@
 
 /// Print header
     $strpaymentmanagement = get_string('paymentmanagement', 'enrol_authorize');
-    if (!$course = get_record('course', 'id', $courseid)) {
-        error('Could not find that course');
-    }
-    print_header_simple("$strpaymentmanagement", "", "<a href=\"index.php\">$strpaymentmanagement</a>");
-
+    print_header_simple($strpaymentmanagement, "", "<a href=\"index.php\">$strpaymentmanagement</a>");
 
 /// If orderid is empty, user wants to see all orders
     if (empty($orderid)) {

enrol/authorize/lib.php

@@ -1,54 +0,0 @@
-<?PHP // $Id$
-
-/**
- * backup_authorize_info
- *
- * @param resource $bf
- * @param object $prefs
- * @return bool
- */
-function backup_authorize_info($bf, $prefs)
-{
-    global $CFG;
-
-    $status = true;
-
-    if ($orders = get_records("enrol_authorize", "courseid", $prefs->backup_course))
-    {
-        fwrite($bf, start_tag("AUTHORIZEORDERS", 2 ,true));
-        foreach ($orders as $order) {
-            fwrite($bf, start_tag("ORDER", 3, true));
-            fwrite($bf, full_tag("ID", 4, false, $order->id));
-            fwrite($bf, full_tag("CCLASTFOUR", 4, false, $order->cclastfour));
-            fwrite($bf, full_tag("CCNAME", 4, false, $order->ccname));
-            fwrite($bf, full_tag("COURSEID", 4, false, $order->courseid));
-            fwrite($bf, full_tag("USERID", 4, false, $order->userid));
-            fwrite($bf, full_tag("TRANSID", 4, false, $order->transid));
-            fwrite($bf, full_tag("STATUS", 4, false, $order->status));
-            fwrite($bf, full_tag("TIMECREATED", 4, false, $order->timecreated));
-            fwrite($bf, full_tag("SETTLETIME", 4, false, $order->settletime));
-            fwrite($bf, full_tag("AMOUNT", 4, false, $order->amount));
-            fwrite($bf, full_tag("CURRENCY", 4, false, $order->currency));
-            if ($refunds = get_records("enrol_authorize_refunds", "orderid", $order->id)) {
-                fwrite($bf, start_tag("REFUNDS",4, true));
-                foreach ($refunds as $refund) {
-                    fwrite($bf, start_tag("REFUND", 5, true));
-                    fwrite($bf, full_tag("ID", 6, false, $refund->id));
-                    fwrite($bf, full_tag("ORDERID", 6, false, $refund->orderid));
-                    fwrite($bf, full_tag("STATUS", 6, false, $refund->status));
-                    fwrite($bf, full_tag("AMOUNT", 6, false, $refund->amount));
-                    fwrite($bf, full_tag("TRANSID", 6, false, $refund->transid));
-                    fwrite($bf, full_tag("SETTLETIME", 6, false, $refund->settletime));
-                    fwrite($bf, end_tag("REFUND", 5, true));
-                }
-                $status = fwrite($bf, end_tag("REFUNDS", 4, true));
-            }
-            fwrite ($bf, end_tag("ORDER", 3, true));
-        }
-        $status = fwrite($bf, end_tag("AUTHORIZEORDERS", 2, true));
-    }
-    return $status;
-}
-
-
-?>

enrol/authorize/locallib.php

@@ -18,7 +18,7 @@ define('ORDER_VOID',    'void');
  */
 function authorize_print_orders()
 {
-    global $CFG, $USER;
+    global $CFG, $USER, $SITE;
     global $strs, $authstrs;
     global $courseid, $userid;
     require_once($CFG->libdir.'/tablelib.php');
@@ -40,21 +40,19 @@ function authorize_print_orders()
                         AN_STATUS_TEST => $authstrs->tested
     );
 
-    if ($courses = get_courses('all', 'c.sortorder ASC', 'c.id,c.fullname,c.enrol')) {
-        $popupcrs = array();
-        foreach ($courses as $crs) {
-            if ($crs->enrol == 'authorize' || (empty($crs->enrol) && $CFG->enrol == 'authorize')) {
-                $popupcrs[intval($crs->id)] = $crs->fullname;
-            }
-        }
-        if (!empty($popupcrs)) {
-            print_simple_box_start('center', '100%');
-            echo "$strs->status: ";
-            echo popup_form($baseurl.'&course='.$courseid.'&status=',$statusmenu,'statusmenu',$status,'','','',true);
-            echo "   $strs->course: ";
-            echo popup_form($baseurl.'&status='.$status.'&course=',$popupcrs,'coursesmenu',$courseid,'','','',true);
-            print_simple_box_end();
-        }
+    $sql = "SELECT c.id, c.fullname FROM {$CFG->prefix}course c INNER JOIN {$CFG->prefix}enrol_authorize e ON c.id = e.courseid ";
+    if ($userid > 0) {
+    	$sql .= "WHERE (e.userid='$userid') ";
+    }
+    $sql .= "ORDER BY c.sortorder, c.fullname";
+    if ($popupcrs = get_records_sql_menu($sql)) {
+        $popupcrs = array($SITE->id => $SITE->fullname) + $popupcrs;
+        print_simple_box_start('center', '100%');
+        echo "$strs->status: ";
+        echo popup_form($baseurl.'&course='.$courseid.'&status=',$statusmenu,'statusmenu',$status,'','','',true);
+        echo "   $strs->course: ";
+        echo popup_form($baseurl.'&status='.$status.'&course=',$popupcrs,'coursesmenu',$courseid,'','','',true);
+        print_simple_box_end();
     }
 
     $table = new flexible_table('enrol-authorize');
@@ -66,7 +64,7 @@ function authorize_print_orders()
 
     $table->define_columns(array('id', 'timecreated', 'userid', 'status', ''));
     $table->define_headers(array($authstrs->orderid, $strs->time, $authstrs->nameoncard, $strs->status, $strs->action));
-    $table->define_baseurl($baseurl."&status=$status");
+    $table->define_baseurl($baseurl."&status=$status&course=$courseid");
 
     $table->sortable(true, 'id', SORT_DESC);
     $table->pageable(true);
@@ -101,10 +99,10 @@ function authorize_print_orders()
     }
 
     if ($userid > 0) {
-        $where .= "AND (userid = '" . $userid . "') ";
+        $where .= "AND (E.userid = '" . $userid . "') ";
     }
     if ($courseid != SITEID) {
-        $where .= "AND (courseid = '" . $courseid . "') ";
+        $where .= "AND (E.courseid = '" . $courseid . "') ";
     }
 
     if ($sort = $table->get_sql_sort()) {
@@ -217,14 +215,14 @@ function authorize_print_order_details($orderno)
         if (empty($confirm)) {
             $strcaptureyes = get_string('captureyes', 'enrol_authorize');
             $table->data[] = array("<b>$strs->confirm:</b>",
-            "$strcaptureyes<br /><a href='index.php?order=$orderno&amp;sesskey=$USER->sesskey&amp;".ORDER_CAPTURE."=y&amp;confirm=1'>$strs->yes</a>
-            &nbsp;&nbsp;&nbsp;&nbsp;<a href='index.php?order=$orderno'>$strs->no</a>");
+            "$strcaptureyes <br />
+            <input type='hidden' name='confirm' value='1'><input type='submit' name='". ORDER_CAPTURE ."' value='$authstrs->capture' />
+            &nbsp;&nbsp;&nbsp;<a href='index.php?order=$orderno'>$strs->no</a>");
         }
         else {
             $message = '';
             $extra = NULL;
             $success = authorize_action($order, $message, $extra, AN_ACTION_PRIOR_AUTH_CAPTURE);
-            update_record("enrol_authorize", $order); // May be expired.
             if (!$success) {
                 $table->data[] = array("<b><font color='red'>$strs->error:</font></b>", $message);
             }
@@ -301,17 +299,8 @@ function authorize_print_order_details($orderno)
                 $success = authorize_action($order, $message, $extra, AN_ACTION_CREDIT);
                 if ($success) {
                     if (empty($CFG->an_test)) {
-                        $extra->id = insert_record("enrol_authorize_refunds", $extra);
                         if (empty($extra->id)) {
-                            $emailsubject = "Authorize.net: insert record error";
-                            $emailmessage = "Error while trying to insert new data to enrol_authorize_refunds table:\n";
-                            $data = (array)$extra;
-                            foreach ($data as $key => $value) {
-                                $emailmessage .= "$key => $value\n";
-                            }
-                            $adminuser = get_admin();
-                            email_to_user($adminuser, $adminuser, $emailsubject, $emailmessage);
-                            $table->data[] = array("<b><font color=red>$strs->error:</font></b>", $emailmessage);
+                            $table->data[] = array("<b><font color=red>$strs->error:</font></b>", 'insert record error');
                         }
                         else {
                             if (!empty($unenrol)) {
@@ -333,27 +322,25 @@ function authorize_print_order_details($orderno)
         print_table($table);
     }
     elseif (!empty($cmdvoid) and confirm_sesskey()) { // VOID
-        if (!in_array(ORDER_VOID, $status->actions)) {
-            $a = new stdClass;
-            $a->action = $authstrs->void;
-            error(get_string('youcantdo', 'enrol_authorize', $a));
-        }
-
         $suborderno = optional_param('suborder', 0, PARAM_INT);
         if (empty($suborderno)) { // cancel original transaction.
+            if (!in_array(ORDER_VOID, $status->actions)) {
+                $a = new stdClass;
+                $a->action = $authstrs->void;
+                error(get_string('youcantdo', 'enrol_authorize', $a));
+            }
             if (empty($confirm)) {
                 $strvoidyes = get_string('voidyes', 'enrol_authorize');
                 $table->data[] = array("<b>$strs->confirm:</b>",
                     "$strvoidyes<br /><input type='hidden' name='".ORDER_VOID."' value='y'>
                      <input type='hidden' name='confirm' value='1'>
-                     <input type='submit' value='$strs->yes'>
+                     <input type='submit' value='$authstrs->void'>
                      &nbsp;&nbsp;&nbsp;&nbsp;<a href='index.php?order=$orderno'>$strs->no</a>");
             }
             else {
                 $extra = NULL;
                 $message = '';
                 $success = authorize_action($order, $message, $extra, AN_ACTION_VOID);
-                update_record("enrol_authorize", $order); // May be expired.
                 if ($success) {
                     if (empty($CFG->an_test)) {
                         redirect("index.php?order=$orderno");
@@ -369,14 +356,22 @@ function authorize_print_order_details($orderno)
             }
         }
         else { // cancel refunded transaction
-            $suborder = get_record('enrol_authorize_refunds',
-                                   'id', $suborderno,
-                                   'orderid', $orderno,
-                                   'status', AN_STATUS_CREDIT);
+            $sql = "SELECT R.*, E.courseid FROM {$CFG->prefix}enrol_authorize_refunds R " .
+                   "INNER JOIN {$CFG->prefix}enrol_authorize E ON R.orderid = E.id " .
+                   "WHERE R.id = '$suborderno' AND R.orderid = '$orderno' AND R.status = '" .AN_STATUS_CREDIT. "'";
+
+            $suborder = get_record_sql($sql);
             if (!$suborder) { // not found
                 error("Transaction can not be voided because of already been voided.");
             }
             else {
+                $refundedstatus = authorize_get_status_action($suborder);
+                if (!in_array(ORDER_VOID, $refundedstatus->actions)) {
+                    $a = new stdClass;
+                    $a->action = $authstrs->void;
+                    error(get_string('youcantdo', 'enrol_authorize', $a));
+                }
+                unset($suborder->courseid);
                 if (empty($confirm)) {
                     $a = new stdClass;
                     $a->transid = $suborder->transid;
@@ -388,14 +383,13 @@ function authorize_print_order_details($orderno)
                         "$strsubvoidyes<br /><input type='hidden' name='".ORDER_VOID."' value='y'>
                          <input type='hidden' name='confirm' value='1'>
                          <input type='hidden' name='suborder' value='$suborderno'>
-                         <input type='submit' value='$strs->yes'>
+                         <input type='submit' value='$authstrs->void'>
                          &nbsp;&nbsp;&nbsp;&nbsp;<a href='index.php?order=$orderno'>$strs->no</a>");
                 }
                 else {
                     $message = '';
                     $extra = NULL;
                     $success = authorize_action($suborder, $message, $extra, AN_ACTION_VOID);
-                    update_record("enrol_authorize_refunds", $suborder); // May be expired.
                     if ($success) {
                         if (empty($CFG->an_test)) {
                             if (!empty($unenrol)) {
@@ -428,7 +422,7 @@ function authorize_print_order_details($orderno)
             $table->data[] = array("<b>$strs->confirm:</b>",
                 "<input type='hidden' name='".ORDER_DELETE."' value='y'>
                  <input type='hidden' name='confirm' value='1'>
-                 <input type='submit' value='$strs->yes'>
+                 <input type='submit' value='$authstrs->delete'>
                  &nbsp;&nbsp;&nbsp;&nbsp;<a href='index.php?order=$orderno'>$strs->no</a>");
         }
         else {
@@ -454,15 +448,21 @@ function authorize_print_order_details($orderno)
         print_table($table);
         if ($settled) { // show refunds.
             $t2 = new stdClass;
-            $t2->size = array('15%', '15%', '20%', '35%', '15%');
+            $t2->size = array('45%', '15%', '20%', '10%', '10%');
             $t2->align = array('right', 'right', 'right', 'right', 'right');
-            $t2->head = array($authstrs->transid,
-                              $authstrs->amount,
+            $t2->head = array($authstrs->settlementdate,
+                              $authstrs->transid,
                               $strs->status,
-                              $authstrs->settlementdate,
-                              $strs->action);
-            $refunds = get_records('enrol_authorize_refunds', 'orderid', $orderno);
+                              $strs->action,
+                              $authstrs->amount);
+
+            $sql = "SELECT R.*, E.courseid FROM {$CFG->prefix}enrol_authorize_refunds R " .
+                   "INNER JOIN {$CFG->prefix}enrol_authorize E ON R.orderid = E.id " .
+                   "WHERE R.orderid = '$orderno'";
+
+            $refunds = get_records_sql($sql);
             if ($refunds) {
+                $sumrefund = floatval(0.0);
                 foreach ($refunds as $rf) {
                     $substatus = authorize_get_status_action($rf);
                     $subactions = '&nbsp;';
@@ -475,12 +475,36 @@ function authorize_print_order_details($orderno)
                             "<a href='index.php?$vl=y&amp;sesskey=$USER->sesskey&amp;order=$orderno&amp;suborder=$rf->id'>{$authstrs->$vl}</a> ";
                         }
                     }
-                    $t2->data[] = array($rf->transid,
-                                        $rf->amount,
-                                        $authstrs->{$substatus->status},
-                                        userdate($rf->settletime),
-                                        $subactions);
+                    $sign = '';
+                    $color = '';
+                    switch ($substatus->status) {
+                        case 'cancelled':
+                            $color = 'black';
+                            break;
+
+                        case 'refunded':
+                            $sign = '-';
+                            $color = 'red';
+                            $sumrefund += floatval($rf->amount);
+                            break;
+
+                        case 'settled':
+                        default:
+                            $sign = '-';
+                            $color = 'green';
+                            $sumrefund += floatval($rf->amount);
+                            break;
+                    }
+
+                    $t2->data[] = array(
+                        userdate($rf->settletime),
+                        $rf->transid,
+                        $authstrs->{$substatus->status},
+                        $subactions,
+                        "<font color='$color'>" . format_float($sign . $rf->amount, 2) . "</font>"
+                    );
                 }
+                $t2->data[] = array('','',get_string('total'),$order->currency,format_float('-'.$sumrefund, 2));
             }
             else {
                 $t2->data[] = array('','',get_string('noreturns', 'enrol_authorize'),'','');

enrol/authorize/version.php

@@ -1,6 +1,6 @@
 <?PHP // $Id$
 
-$plugin->version  = 2006021501;
+$plugin->version  = 2006021531;
 $plugin->requires = 2005072200;
 
 ?>

enrol/database/enrol.php

@@ -41,7 +41,13 @@ function get_student_courses(&$user) {
                         if (isset($user->student[$course->id])) {   /// We have it already
                             unset($user->student[$course->id]);       /// Remove from old list
                         } else {
-                            enrol_student($user->id, $course->id, 0, 0, 'database');   /// Enrol the student
+                            if ($course->enrolperiod) {
+                                $timestart = time();
+                                $timeend = time() + $course->enrolperiod;
+                            } else {
+                                $timestart = $timeend = 0;
+                            }
+                            enrol_student($user->id, $course->id, $timestart, $timeend, 'database');
                         }
                     }
                 }
@@ -204,14 +210,15 @@ function sync_enrolments($type='student') {
             $sql = "SELECT u.id AS userid, e.id AS enrolmentid" .
                 " FROM {$CFG->prefix}user u " . 
                 "      LEFT OUTER JOIN {$CFG->prefix}user_students e ON (u.id = e.userid AND e.course='{$course->id}')" .
-                " WHERE u.{$CFG->enrol_localuserfield} = '$member'";
+                " WHERE u.{$CFG->enrol_localuserfield} = '$member'" .
+                " AND (u.deleted IS NULL OR u.deleted=0)";
 
             $ers = $db->Execute($sql);
             if (!$ers) {
                 trigger_error($db->ErrorMsg() .' STATEMENT: '. $sql);
                 return false;
             }
-            if ( $ers->RecordCount() != 1 ) { // if this returns empty, it means we don't have the student record.
+            if ( $ers->RecordCount() == 0 ) { // if this returns empty, it means we don't have the student record.
                                               // should not happen -- but skip it anyway 
                 trigger_error('weird! no user record entry?');
                 continue;

enrol/ldap/enrol.php

@@ -81,6 +81,9 @@ function get_user_courses(&$user, $type) {
             }
         }
         
+        /// Add it to new list
+        $newenrolments[$course_obj->id] = 'ldap';
+
         // deal with enrolment in the moodle db
         if (!empty($course_obj)) { // does course exist now?     
             if(isset($user->{$type}[$course_obj->id]) && $user->{$type}[$course_obj->id] == 'ldap'){
@@ -105,18 +108,26 @@ function get_user_courses(&$user, $type) {
     // array, those are old enrolments that we want to remove (or are they?)
     if(!empty($user->{$type})){
         foreach ($user->{$type} as $courseid => $value){
-            if($value == 'ldap'){ // this was a legacy 
+            if($value === 'ldap'){ // this was a legacy 
                 if ($type === 'student') { // enrol
                     unenrol_student($user->id, $courseid);
                 } else if ($type === 'teacher') {
                     remove_teacher($user->id, $courseid);
                 }
                 unset($user->{$type}[$course_obj->id]);
+            } else {
+                // This one is from a non-database
+                // enrolment. Add it to the newenrolments
+                // array, so we don't loose it.
+                $newenrolments[$courseid] = $value;
             }
 
         }
     }
 
+    /// Overwrite the old array with the new one
+    $user->{$type} = $newenrolments;
+
     @ldap_close($ldap_connection);
     return true;
 }
@@ -574,8 +585,8 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
 
     // override with required ext data
     $course->idnumber  = $course_ext[$CFG->enrol_ldap_course_idnumber][0];
-    $course->fullname  = $course_ext[$CFG->enrol_ldap_course_fullname][0];
-    $course->shortname = $course_ext[$CFG->enrol_ldap_course_shortname][0];
+    $course->fullname  = addslashes($course_ext[$CFG->enrol_ldap_course_fullname][0]);
+    $course->shortname = addslashes($course_ext[$CFG->enrol_ldap_course_shortname][0]);
     if (   empty($course->idnumber)
         || empty($course->fullname)
         || empty($course->shortname) ) { 
@@ -586,7 +597,7 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
     }
 
     if(!empty($CFG->enrol_ldap_course_summary)){ // optional
-        $course->summary   = $course_ext[$CFG->enrol_ldap_course_summary][0];
+        $course->summary   = addslashes($course_ext[$CFG->enrol_ldap_course_summary][0]);
     }
     if(!empty($CFG->enrol_ldap_category)){ // optional ... but ensure it is set!
         $course->category   = $CFG->enrol_ldap_category;

file.php

@@ -54,11 +54,12 @@
     }
 
     // security: only editing teachers can access backups
-    if ((!isteacheredit($course->id))
-        and (count($args) >= 2)
-        and (strtolower($args[1]) == 'backupdata')) {
-
-        error('Access not allowed');
+    if ((count($args) >= 2) and (strtolower($args[1]) == 'backupdata')) {
+        if (!isteacheredit($course->id)) {
+            error('Access not allowed');
+        } else {
+            $lifetime = 0; //disable browser caching for backups 
+        }
     }
 
     if (is_dir($pathname)) {
@@ -93,6 +94,7 @@
         and (strtolower($args[1]) == 'moddata')
         and ((strtolower($args[2]) == 'forum')
             or (strtolower($args[2]) == 'assignment')
+            or (strtolower($args[2]) == 'data')
             or (strtolower($args[2]) == 'glossary')
             or (strtolower($args[2]) == 'wiki')
             or (strtolower($args[2]) == 'exercise')

files/index.php

@@ -16,7 +16,7 @@
     $action  = optional_param('action', '', PARAM_ACTION);
     $name    = optional_param('name', '', PARAM_FILE);
     $oldname = optional_param('oldname', '', PARAM_FILE);
-    $choose  = optional_param('choose', '', PARAM_CLEAN);
+    $choose  = optional_param('choose', '', PARAM_FILE); //in fact it is always 'formname.inputname'
     $userfile= optional_param('userfile','',PARAM_FILE);
     $save    = optional_param('save', 0, PARAM_BOOL);
     $text    = optional_param('text', '', PARAM_RAW);
@@ -167,7 +167,7 @@
                 // um will take care of error reporting.
                 displaydir($wdir);
             } else {
-                $upload_max_filesize = get_max_upload_file_size($CFG->maxbytes, $course->maxbytes);
+                $upload_max_filesize = get_max_upload_file_size($CFG->maxbytes);
                 $filesize = display_size($upload_max_filesize);
 
                 $struploadafile = get_string("uploadafile");
@@ -385,6 +385,7 @@
             html_header($course, $wdir);
             if (($text != '') and confirm_sesskey()) {
                 $fileptr = fopen($basedir.'/'.$file,"w");
+                $text = preg_replace('/\x0D/', '', $text);  // http://moodle.org/mod/forum/discuss.php?d=38860
                 fputs($fileptr, stripslashes($text));
                 fclose($fileptr);
                 displaydir($wdir);

filter/activitynames/filter.php

@@ -8,12 +8,20 @@
 
         global $CFG;
 
+        // Trivial-cache - keyed on $cachedcourseid
         static $activitylist;
+        static $cachedcourseid;
 
         if (empty($courseid)) {
             $courseid = SITEID;
         }
 
+        // Initialise/invalidate our trivial cache if dealing with a different course
+        if (!isset($cachedcourseid) || $cachedcourseid !== (int)$courseid) {
+            $activitylist = array();
+        } 
+        $cachedcourseid = (int)$courseid;
+
         /// It may be cached
 
         if (empty($activitylist)) {

filter/algebra/algebradebug.php

@@ -7,6 +7,16 @@
 
     require_once("../../config.php");
 
+    if (empty($CFG->textfilters)) {
+        error ('Filter not enabled!');
+    } else {
+        $filters = explode(',', $CFG->textfilters);
+        if (array_search('filter/algebra', $filters) === FALSE) {
+            error ('Filter not enabled!');
+        }
+    }
+
+    require_once($CFG->dirroot.'/filter/tex/lib.php');
 
     $CFG->texfilterdir = "filter/tex";
     $CFG->algebrafilterdir = "filter/algebra";
@@ -15,6 +25,9 @@
       $CFG->algebrafilterdirwin = "filter\\algebra";
     }
 
+    if (!isadmin()) {
+        die('Only for admins, sorry.');
+    }
 
     $query = urldecode($_SERVER['QUERY_STRING']);
     error_reporting(E_ALL);
@@ -76,7 +89,7 @@
     }
 
 function algebra2tex($algebra) {
-  Global $CFG;
+  global $CFG;
   $algebra = str_replace('&lt;','<',$algebra);
   $algebra = str_replace('&gt;','>',$algebra);
   $algebra = str_replace('<>','#',$algebra);
@@ -91,9 +104,9 @@ function algebra2tex($algebra) {
   $algebra = str_replace('epsilon','zepslon',$algebra);
   $algebra = str_replace('upsilon','zupslon',$algebra);
   $algebra = preg_replace('!\r\n?!',' ',$algebra);
+  $algebra = escapeshellarg($algebra);
 
   if ( (PHP_OS == "WINNT") || (PHP_OS == "WIN32") || (PHP_OS == "Windows") ) {
-    $algebra = "\"". str_replace('"','\"',$algebra) . "\"";
     $cmd  = "cd $CFG->dirroot\\$CFG->algebrafilterdirwin & algebra2tex.pl x/2";
     $test = `$cmd`;
     if ($test != '\frac{x}{2}') {
@@ -109,7 +122,6 @@ function algebra2tex($algebra) {
     }
     $cmd  = "cd $CFG->dirroot\\$CFG->algebrafilterdirwin & algebra2tex.pl $algebra";
   } else {      
-    $algebra = escapeshellarg($algebra);
     $cmd  = "cd $CFG->dirroot/$CFG->algebrafilterdir; ./algebra2tex.pl x/2";
     $test = `$cmd`;
     if ($test != '\frac{x}{2}') {
@@ -198,66 +210,67 @@ function outputText($texexp) {
 }
 
 function tex2image($texexp, $md5, $return=false) {
-  global $CFG;
-  $error_message1 = "Your system is not configured to run mimeTeX. ";
-  $error_message1 .= "You need to download the appropriate<br /> executable ";
-  $error_message1 .= "from <a href=\"http://moodle.org/download/mimetex/\">";
-  $error_message1 .= "http://moodle.org/download/mimetex/</a>, or obtain the ";
-  $error_message1 .= "C source<br /> from <a href=\"http://www.forkosh.com/mimetex.zip\">";
-  $error_message1 .= "http://www.forkosh.com/mimetex.zip</a>, compile it and ";
-  $error_message1 .= "put the executable into your<br /> moodle/filter/tex/ directory. ";
-  $error_message1 .= "You also need to edit your moodle/filter/algebra/pix.php file<br />";
-  $error_message1 .= ' by adding the line<br /><pre>       case "' . PHP_OS . "\":\n";
-  $error_message1 .= "           \$cmd = \"\\\\\"\$CFG->dirroot/\$CFG->texfilterdir/";
-  $error_message1 .= 'mimetex.' . strtolower(PHP_OS) . "\\\\\" -e \\\\\"\$pathname\\\\\" \". escapeshellarg(\$texexp);";
-  $error_message1 .= "</pre>You also need to add this to your algebradebug.php file.";
+    global $CFG;
+    $error_message1 = "Your system is not configured to run mimeTeX. ";
+    $error_message1 .= "You need to download the appropriate<br /> executable ";
+    $error_message1 .= "from <a href=\"http://moodle.org/download/mimetex/\">";
+    $error_message1 .= "http://moodle.org/download/mimetex/</a>, or obtain the ";
+    $error_message1 .= "C source<br /> from <a href=\"http://www.forkosh.com/mimetex.zip\">";
+    $error_message1 .= "http://www.forkosh.com/mimetex.zip</a>, compile it and ";
+    $error_message1 .= "put the executable into your<br /> moodle/filter/tex/ directory. ";
+    $error_message1 .= "You also need to edit your moodle/filter/algebra/pix.php file<br />";
+    $error_message1 .= ' by adding the line<br /><pre>       case "' . PHP_OS . "\":\n";
+    $error_message1 .= "           \$cmd = \"\\\\\"\$CFG->dirroot/\$CFG->texfilterdir/";
+    $error_message1 .= 'mimetex.' . strtolower(PHP_OS) . "\\\\\" -e \\\\\"\$pathname\\\\\" \". escapeshellarg(\$texexp);";
+    $error_message1 .= "</pre>You also need to add this to your algebradebug.php file.";
 
-  if ($texexp) {
-       $texexp = '\Large ' . $texexp;
-       $lifetime = 86400;
-       $image  = $md5 . ".gif";
-       $filetype = 'image/gif';
-       if (!file_exists("$CFG->dataroot/$CFG->algebraimagedir")) {
-          make_upload_directory($CFG->algebraimagedir);
-       }
-       $pathname = "$CFG->dataroot/$CFG->algebraimagedir/$image";
-       if (file_exists($pathname)) {
-         unlink($pathname);
-       } 
-       $commandpath = "";
-       $cmd = "";
-         switch (PHP_OS) {
-       case "Linux":
-         $commandpath="$CFG->dirroot/$CFG->texfilterdir/mimetex.linux";
-         $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.linux\" -e \"$pathname\" ". escapeshellarg($texexp);
-       break;
-       case "WINNT":
-       case "WIN32":
-       case "Windows":
-         $commandpath="$CFG->dirroot/$CFG->texfilterdir/mimetex.exe";
-         $texexp = str_replace('"','\"',$texexp);
-         $cmd = str_replace(' ','^ ',$commandpath);
-         $cmd .= " ++ -e  \"$pathname\" \"$texexp\"";
-       break;
-       case "Darwin":
-         $commandpath="$CFG->dirroot/$CFG->texfilterdir/mimetex.darwin";
-         $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.darwin\" -e \"$pathname\" ". escapeshellarg($texexp);
-       break;
-       }
-       if (!$cmd) {
-         if (is_executable("$CFG->dirroot/$CFG->texfilterdir/mimetex")) {   /// Use the custom binary
-           $commandpath="$CFG->dirroot/$CFG->texfilterdir/mimetex";
-           $cmd = "$CFG->dirroot/$CFG->texfilterdir/mimetex -e $pathname ". escapeshellarg($texexp);
-         } else {
-           error($error_message1);
-         }
-       }
-       system($cmd, $status);
-  }
-  if ($return) {
-           return $image;
-  }
-  if ($texexp && file_exists($pathname)) {
+    if ($texexp) {
+        $texexp = '\Large ' . $texexp;
+        $lifetime = 86400;
+        $image  = $md5 . ".gif";
+        $filetype = 'image/gif';
+        if (!file_exists("$CFG->dataroot/$CFG->algebraimagedir")) {
+            make_upload_directory($CFG->algebraimagedir);
+        }
+        $pathname = "$CFG->dataroot/$CFG->algebraimagedir/$image";
+        if (file_exists($pathname)) {
+            unlink($pathname);
+        } 
+        $commandpath = "";
+        $cmd = "";
+        $texexp = tex_sanitize_formula($texexp);
+        $texexp = escapeshellarg($texexp);
+        switch (PHP_OS) {
+            case "Linux":
+                $commandpath="$CFG->dirroot/$CFG->texfilterdir/mimetex.linux";
+                $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.linux\" -e \"$pathname\" $texexp";
+            break;
+            case "WINNT":
+            case "WIN32":
+            case "Windows":
+                $commandpath="$CFG->dirroot/$CFG->texfilterdir/mimetex.exe";
+                $cmd = str_replace(' ','^ ',$commandpath);
+                $cmd .= " ++ -e  \"$pathname\" $texexp";
+            break;
+            case "Darwin":
+                $commandpath="$CFG->dirroot/$CFG->texfilterdir/mimetex.darwin";
+                $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.darwin\" -e \"$pathname\" $texexp";
+            break;
+        }
+        if (!$cmd) {
+            if (is_executable("$CFG->dirroot/$CFG->texfilterdir/mimetex")) {   /// Use the custom binary
+                $commandpath="$CFG->dirroot/$CFG->texfilterdir/mimetex";
+                $cmd = "$CFG->dirroot/$CFG->texfilterdir/mimetex -e $pathname $texexp";
+            } else {
+                error($error_message1);
+            }
+        }
+        system($cmd, $status);
+    }
+    if ($return) {
+        return $image;
+    }
+    if ($texexp && file_exists($pathname)) {
            $lastmodified = filemtime($pathname);
            header("Last-Modified: " . gmdate("D, d M Y H:i:s", $lastmodified) . " GMT");
            header("Expires: " . gmdate("D, d M Y H:i:s", time() + $lifetime) . " GMT");
@@ -267,7 +280,7 @@ function tex2image($texexp, $md5, $return=false) {
            header("Content-length: ".filesize($pathname));
            header("Content-type: $filetype");
            readfile("$pathname");
-   } else {
+    } else {
            $ecmd = "$cmd 2>&1";
            echo `$ecmd` . "<br />\n";
            echo "The shell command<br />$cmd<br />returned status = $status<br />\n";
@@ -293,7 +306,7 @@ function tex2image($texexp, $md5, $return=false) {
               echo "mimetex executable $commandpath not found!<br />";
            }
            echo "Image not found!";
-   }
+    }
 }
 
 function slasharguments($texexp, $md5) {

filter/algebra/filter.php

@@ -163,11 +163,10 @@ function algebra_filter ($courseid, $text) {
            $algebra = str_replace('epsilon','zepslon',$algebra);
            $algebra = str_replace('upsilon','zupslon',$algebra);
            $algebra = preg_replace('!\r\n?!',' ',$algebra);
+           $algebra = escapeshellarg($algebra);
            if ( (PHP_OS == "WINNT") || (PHP_OS == "WIN32") || (PHP_OS == "Windows") ) {
-              $algebra = "\"". str_replace('"','\"',$algebra) . "\"";
               $cmd  = "cd $CFG->dirroot\\$CFG->algebrafilterdirwin & algebra2tex.pl $algebra";
            } else {      
-              $algebra = escapeshellarg($algebra);
               $cmd  = "cd $CFG->dirroot/$CFG->algebrafilterdir; ./algebra2tex.pl $algebra";
            }
            $texexp = `$cmd`;

filter/algebra/pix.php

@@ -6,7 +6,18 @@
     $nomoodlecookie = true;     // Because it interferes with caching
 
     require_once('../../config.php');
+
+    if (empty($CFG->textfilters)) {
+        error ('Filter not enabled!');
+    } else {
+        $filters = explode(',', $CFG->textfilters);
+        if (array_search('filter/algebra', $filters) === FALSE) {
+            error ('Filter not enabled!');
+        }
+    }
+
     require_once($CFG->libdir.'/filelib.php');
+    require_once($CFG->dirroot.'/filter/tex/lib.php');
 
     $CFG->texfilterdir     = 'filter/tex';
     $CFG->algebrafilterdir = 'filter/algebra';
@@ -41,25 +52,26 @@
             $texexp = str_replace('>','>',$texexp);
             $texexp = preg_replace('!\r\n?!',' ',$texexp);
             $texexp = '\Large ' . $texexp;
+            $texexp = tex_sanitize_formula($texexp);
+            $texexp = escapeshellarg($texexp);
 
             if ((PHP_OS == "WINNT") || (PHP_OS == "WIN32") || (PHP_OS == "Windows")) {
-                $texexp = str_replace('"','\"',$texexp);
                 $cmd = "$CFG->dirroot/$CFG->texfilterdir/mimetex.exe";
                 $cmd = str_replace(' ','^ ',$cmd);
-                $cmd .= " ++ -e  \"$pathname\" -- \"$texexp\"";
+                $cmd .= " ++ -e  \"$pathname\" -- $texexp";
             } else if (is_executable("$CFG->dirroot/$CFG->texfilterdir/mimetex")) {   /// Use the custom binary
 
-                $cmd = "$CFG->dirroot/$CFG->texfilterdir/mimetex -e $pathname -- ". escapeshellarg($texexp);
+                $cmd = "$CFG->dirroot/$CFG->texfilterdir/mimetex -e $pathname -- $texexp";
 
             } else {                                                           /// Auto-detect the right TeX binary
                 switch (PHP_OS) {
 
                     case "Linux":
-                        $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.linux\" -e \"$pathname\" -- ". escapeshellarg($texexp);
+                        $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.linux\" -e \"$pathname\" -- $texexp";
                     break;
 
                     case "Darwin":
-                        $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.darwin\" -e \"$pathname\" -- ". escapeshellarg($texexp);
+                        $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.darwin\" -e \"$pathname\" -- $texexp";
                     break;
 
                     default:      /// Nothing was found, so tell them how to fix it.

filter/mediaplugin/defaultsettings.php

@@ -21,7 +21,7 @@
             set_config( 'filter_mediaplugin_ignore_swf','' );
         }
         else {
-            set_config( 'filter_mediaplugin_enable_swf', 1 );
+            set_config( 'filter_mediaplugin_enable_swf', 0 ); //disable swf embedding by default for now
         }
     }
     if (!isset($CFG->filter_mediaplugin_enable_mov) or $forcereset) {

filter/mediaplugin/filter.php

@@ -194,7 +194,7 @@ function mediaplugin_filter($courseid, $text) {
         $replace .= '<param name="controls" value="imagewindow" />';
         $replace .= '<param name="console" value="video" />';
         $replace .= '<param name="loop" value="true" />';
-        $replace .= '<embed src="\\2.rm" width=240" height="180" loop="true" type="audio/x-pn-realaudio-plugin" controls="imagewindow" console="video" autostart="true">';
+        $replace .= '<embed src="\\2.ram" width=240" height="180" loop="true" type="audio/x-pn-realaudio-plugin" controls="imagewindow" console="video" autostart="true">';
         $replace .= '</embed>';
         $replace .= '</object><br />';
 
@@ -203,7 +203,7 @@ function mediaplugin_filter($courseid, $text) {
         $replace .= '<param name="autostart" value="true" />';
         $replace .= '<param name="controls" value="ControlPanel" />';
         $replace .= '<param name="console" value="video" />';
-        $replace .= '<embed src="\\2.rm" width="240" height="30" controls="ControlPanel" type="audio/x-pn-realaudio-plugin" console="video" autostart="true">';
+        $replace .= '<embed src="\\2.ram" width="240" height="30" controls="ControlPanel" type="audio/x-pn-realaudio-plugin" console="video" autostart="true">';
         $replace .= '</embed>';
         $replace .= '</object></p>';
 
@@ -219,7 +219,7 @@ function mediaplugin_filter($courseid, $text) {
         $replace .= '<param name="controls" value="imagewindow" />';
         $replace .= '<param name="console" value="video" />';
         $replace .= '<param name="loop" value="true" />';
-        $replace .= '<embed src="\\2.rm" width=240" height="180" loop="true" type="audio/x-pn-realaudio-plugin" controls="imagewindow" console="video" autostart="true">';
+        $replace .= '<embed src="\\2.rpm" width=240" height="180" loop="true" type="audio/x-pn-realaudio-plugin" controls="imagewindow" console="video" autostart="true">';
         $replace .= '</embed>';
         $replace .= '</object><br />';
 
@@ -228,7 +228,7 @@ function mediaplugin_filter($courseid, $text) {
         $replace .= '<param name="autostart" value="true" />';
         $replace .= '<param name="controls" value="ControlPanel" />';
         $replace .= '<param name="console" value="video" />';
-        $replace .= '<embed src="\\2.rm" width="240" height="30" controls="ControlPanel" type="audio/x-pn-realaudio-plugin" console="video" autostart="true">';
+        $replace .= '<embed src="\\2.rpm" width="240" height="30" controls="ControlPanel" type="audio/x-pn-realaudio-plugin" console="video" autostart="true">';
         $replace .= '</embed>';
         $replace .= '</object></p>';
 

filter/mediaplugin/filterconfig.html

@@ -6,6 +6,7 @@
     $txt = new Object;
     $txt->mediapluginmp3 = get_string( 'mediapluginmp3','admin' );
     $txt->mediapluginswf = get_string( 'mediapluginswf','admin' );
+    $txt->mediapluginswfnote = get_string( 'mediapluginswfnote','admin' );
     $txt->mediapluginmov = get_string( 'mediapluginmov','admin' );
     $txt->mediapluginwmv = get_string( 'mediapluginwmv','admin' );
     $txt->mediapluginmpg = get_string( 'mediapluginmpg','admin' );
@@ -25,41 +26,49 @@
         <td align="right"><?php echo $txt->mediapluginmp3 ?></td>
         <td><?php choose_from_menu( $yesno,'filter_mediaplugin_enable_mp3',
              $CFG->filter_mediaplugin_enable_mp3 ); ?></td> 
+        <td />
     </tr>
     <tr valign="top">
         <td align="right"><?php echo $txt->mediapluginswf?></td>
         <td><?php choose_from_menu( $yesno,'filter_mediaplugin_enable_swf',
              $CFG->filter_mediaplugin_enable_swf ); ?></td> 
+        <td><?php echo $txt->mediapluginswfnote ?></td>
     </tr>
     <tr valign="top">
         <td align="right"><?php echo $txt->mediapluginmov ?></td>
         <td><?php choose_from_menu( $yesno,'filter_mediaplugin_enable_mov',
              $CFG->filter_mediaplugin_enable_mov ); ?></td> 
+        <td />
     </tr>
     <tr valign="top">
         <td align="right"><?php echo $txt->mediapluginwmv ?></td>
         <td><?php choose_from_menu( $yesno,'filter_mediaplugin_enable_wmv',
              $CFG->filter_mediaplugin_enable_wmv ); ?></td> 
+        <td />
     </tr>
     <tr valign="top">
         <td align="right"><?php echo $txt->mediapluginmpg ?></td>
         <td><?php choose_from_menu( $yesno,'filter_mediaplugin_enable_mpg',
              $CFG->filter_mediaplugin_enable_mpg ); ?></td> 
+        <td />
     </tr>
     <tr valign="top">
         <td align="right"><?php echo $txt->mediapluginavi ?></td>
         <td><?php choose_from_menu( $yesno,'filter_mediaplugin_enable_avi',
              $CFG->filter_mediaplugin_enable_avi ); ?></td> 
+        <td />
     </tr>
     <tr valign="top">
         <td align="right"><?php echo $txt->mediapluginflv ?></td>
         <td><?php choose_from_menu( $yesno,'filter_mediaplugin_enable_flv',
              $CFG->filter_mediaplugin_enable_flv ); ?></td> 
+        <td />
     </tr>
     <tr valign="top">
         <td align="right"><?php echo $txt->mediapluginram ?></td>
         <td><?php choose_from_menu( $yesno,'filter_mediaplugin_enable_ram',
              $CFG->filter_mediaplugin_enable_ram ); ?></td> 
+        <td />
     </tr>
     <tr valign="top">
         <td align="right"><?php echo $txt->mediapluginrpm ?></td>
@@ -70,5 +79,6 @@
         <td align="right"><?php echo $txt->mediapluginrm ?></td>
         <td><?php choose_from_menu( $yesno,'filter_mediaplugin_enable_rm',
              $CFG->filter_mediaplugin_enable_rm ); ?></td> 
+        <td />
     </tr>
 </table>

filter/mediaplugin/flvplayer.README.txt

@@ -1,4 +1,4 @@
 The FLV player is by Jeroen Wijering - www.jeroenwijering.com 
-and included in Moodle by his permission under the GPL.
+and included in Moodle by his permission under the GNU GPL version 2 or later.
 
 Thanks, Jeroen!

filter/tex/README.mimetex

@@ -1,10 +1,10 @@
 
  --------------------------------------------------------------------------
- January 11, 2004                                              Version 1.40
+ September 6, 2008                                             Version 1.70
 
                   m i m e T e X   R e a d m e   F i l e
 
- Copyright(c) 2002-2004, John Forkosh Associates, Inc. All rights reserved.
+ Copyright(c) 2002-2008, John Forkosh Associates, Inc. All rights reserved.
  --------------------------------------------------------------------------
 
                             by: John Forkosh
@@ -12,17 +12,21 @@
 
           This file is part of mimeTeX, which is free software.
           You may redistribute and/or modify it under the terms
-          of the GNU General Public License, version 2 or later,
+          of the GNU General Public License, version 3 or later,
           as published by the Free Software Foundation. See
                    http://www.gnu.org/licenses/gpl.html
 
-          Follow the Quick Start instructions immediately below
-          or the detailed instructions in Section III to install
-          mimeTeX on your machine, and then point your browser to
-                  http://www.yourdomain.com/mimetex.html
-          for a complete discussion, including demo/tutorial and
-          reference.  Installation problems?  Point your browser
-          to my page at
+          MimeTeX is discussed and illustrated online at
+          its homepage
+                    http://www.forkosh.com/mimetex.html
+          Or you can follow the Quick Start instructions below
+          (or the more detailed instructions in Section III)
+          to immediately install mimeTeX on your own machine.
+          Then point your browser to
+                    http://www.yourdomain.com/mimetex.html
+          for a demo/tutorial and reference.
+               Installation problems?  Point your browser to
+          mimeTeX's homepage
                     http://www.forkosh.com/mimetex.html
           then click its "full mimeTeX manual" link and see
           Section II.
@@ -31,57 +35,63 @@
 I.  QUICK START
 ------------------------------------------------------------------------
   To compile and install mimeTeX
-       o unzip mimetex.zip in any convenient working directory
-       o to produce an executable that emits anti-aliased gif images
+       * unzip mimetex.zip in any convenient working directory
+       * to produce an executable that emits anti-aliased
+         gif images (recommended)
               cc -DAA mimetex.c gifsave.c -lm -o mimetex.cgi
          -or- for gif images without anti-aliasing
               cc -DGIF mimetex.c gifsave.c -lm -o mimetex.cgi
          -or- to produce an executable that emits mime xbitmaps
               cc -DXBITMAP mimetex.c -lm -o mimetex.cgi
-       o mv mimetex.cgi  to your server's cgi-bin/ directory
-       o mv mimetex.html to your server's htdocs/  directory
-       o if the relative path from htdocs to cgi-bin isn't
+         (For Windows, see "Compile Notes" in Section III below.)
+       * mv mimetex.cgi  to your server's cgi-bin/ directory
+       * mv mimetex.html to your server's htdocs/  directory
+       * if the relative path from htdocs to cgi-bin isn't
          ../cgi-bin then edit mimetex.html and change the
-         few dozen occurrences as necessary
-  To quickly learn about mimeTeX
-       o point your browser to www.yourdomain.com/mimetex.html
+         few dozen occurrences as necessary.
+  Then, to quickly learn more about mimeTeX
+       * point your browser to www.yourdomain.com/mimetex.html
   Any problems with the above?
-       o read the more detailed instructions in Section III below,
-         or see www.forkosh.com/mimetex.html
+       * read the more detailed instructions below,
+         or see http://www.forkosh.com/mimetex.html
 
 
 II.  INTRODUCTION
 ------------------------------------------------------------------------
-  MimeTeX is licensed under the gpl.  It parses LaTeX math expressions,
-  emitting either gif images or mime xbitmaps of them, rather than the
-  usual TeX dvi's.  And mimeTeX is an entirely separate little program
-  that doesn't use TeX in any way.  Therefore, mimeTeX images are easily
-  inserted directly into html documents using a standard html <img> tag,
-       <img src="../cgi-bin/mimetex.cgi?f(x)=\int_{-\infty}^x~e^{-t^2}dt"
-        border=0 align=absmiddle>
-  without intermediate dvi-to-gif conversion, and without storing lots
-  of little gif image files, one file for each converted expression.
-  This makes your web site and html documents more easily maintained.
-
-  Thus, mimeTeX is primarily intended to help you write native html
-  documents containing math.  In this sense it's a kind of "lightweight"
-  alternative to MathML, with the advantage that mimeTeX preserves LaTeX
-  syntax, and works with any browser and server.
+  MimeTeX, licensed under the gpl, lets you easily embed LaTeX math in
+  your html pages.  It parses a LaTeX math expression and immediately
+  emits the corresponding gif image, rather than the usual TeX dvi.
+       And mimeTeX is an entirely separate little program that doesn't
+  use TeX or its fonts in any way.  It's just one cgi that you put in
+  your site's cgi-bin/ directory, with no other dependencies.
+  So mimeTeX is very easy to install.  And it's equally easy to use.
+  Just place an html <img> tag in your document wherever you want to
+  see the corresponding LaTeX expression.  For example,
+    <img src="../cgi-bin/mimetex.cgi?f(x)=\int_{-\infty}^x~e^{-t^2}dt"
+     border=0 align=absmiddle>
+  generates and displays the corresponding gif image on-the-fly,
+  wherever you put that <img> tag.  MimeTeX doesn't need intermediate
+  dvi-to-gif conversion, and it doesn't clutter your filesystem with
+  separate little gif files for each converted expression.  (Optional
+  image caching does store gif files, and subsequently reads them as
+  needed, rather than re-rendering the same images every time a page
+  is reloaded.)
 
 
 III.  COMPILATION AND INSTALLATION
 ------------------------------------------------------------------------
-  I've comnpiled and run mimeTeX under Linux and NetBSD using gcc.
-  The source code is entirely ansi-standard C, and should compile
+  I've built and run mimeTeX under Linux and NetBSD using gcc.
+  The source code is ansi-standard C, and should compile
   and execute under all environments without any change whatsoever.
-  Build instructions below are for Unix.  Modify them as necessary
-  for your particular situation.
+  Build instructions below are for Unix. Modify them as necessary
+  for your particular situation.  Note the -DWINDOWS switch if
+  applicable.
 
   Unzip mimetex.zip in any convenient working directory.
-  You should now have files
+  Your working directory should now contain
        mimetex.zip    your gnu zipped mimeTeX distribution containing...
        README         this file (see mimetex.html for demo/tutorial)
-       LICENSE        GPL license, under which you may use mimeTeX
+       COPYING        GPL license, under which you may use mimeTeX
        mimetex.c      mimeTeX source program and all required functions
        mimetex.h      header file for mimetex.c (and for gfuntype.c)
        gfuntype.c     parses output from  gftype -i  and writes bitmap data
@@ -93,32 +103,35 @@ III.  COMPILATION AND INSTALLATION
   Conversion for Windows, Macs, VMS, etc, can usually be accomplished
   with unzip's -a option, i.e.,  unzip -a mimetex.zip
 
-  Now, to produce an executable that emits anti-aliased gif images
-       (which is how the "official" www.forkosh.com/mimetex.html page
-       is displayed), compile mimetex with the command
-          cc -DAA mimetex.c gifsave.c -lm -o mimetex.cgi
+  Now, to compile a mimeTeX executable that emits anti-aliased gif
+  images (recommended for most uses), type the command
+            cc -DAA mimetex.c gifsave.c -lm -o mimetex.cgi
 
-       Or, to produce an executable that emits gif images
-       without anti-aliasing, compile mimetex with the command
-          cc -DGIF mimetex.c gifsave.c -lm -o mimetex.cgi
+  Or, for an executable that emits gif images without
+  anti-aliasing,
+            cc -DGIF mimetex.c gifsave.c -lm -o mimetex.cgi
 
-       Alternatively, for an executable that emits mime xbitmaps,
-       just compile mimetex with the command
-          cc -DXBITMAP mimetex.c -lm -o mimetex.cgi
+  Alternatively, to compile a mimeTeX executable that emits
+  mime xbitmaps, just type the command
+            cc -DXBITMAP mimetex.c -lm -o mimetex.cgi
 
-       Several additional command-line options that you may find
-       useful are discussed in Section IIc (href="#options")
-       of mimetex.html .
+  Compile Notes:
+     * If (and only if) you're compiling a Windows executable
+       with the -DAA or -DGIF option (but not -DXBITMAP), then
+       add -DWINDOWS also.  For example,
+            cc -DAA -DWINDOWS mimetex.c gifsave.c -lm -o mimetex.cgi
+       The above Unix-like syntax works with MinGW (http://www.mingw.org)
+       and djgpp (http://www.delorie.com/djgpp/) Windows compilers, but
+       probably not with most others, where it's only intended as a
+       "template".
+     * Several additional command-line options that you may find
+       useful are discussed in Section IId (href="#options")
+       of your mimetex.html page.
 
-  That's all there is to building mimeTeX.  You can now test mimetex.cgi
-  from the Unix command line by typing, e.g.,
-       ./mimetex.cgi x^2+y^2
-  which should emit an ascii raster something like the left-hand
-  illustration.  And if you've compiled mimeTeX with the anti-aliasing
-  -DAA option, then you'll also see the right-hand illustration.
-  It shows asterisks in the same positions as the left-hand illustration,
-  and anti-aliased grayscale colormap indexes assigned to neighboring
-  pixels.  And you'll also be shown the actual rgb value for each index.
+  That's all there is to building mimeTeX.  You can now test your
+  mimetex.cgi executable from the Unix command line by typing, e.g.,
+       ./mimetex.cgi "x^2+y^2"
+  which should emit two ascii rasters something like the following
     Ascii dump of bitmap image...     Hex dump of colormap indexes...
     ........**..................**..  .......1**1................1**1.
     .......*..*.....*..........*..*.  .......*23*.....*..........*23*.
@@ -132,34 +145,50 @@ III.  COMPILATION AND INSTALLATION
     ................*....**.........  ................*....**1........
                                   The 5 colormap indexes denote rgb...
                                  .-->255 1-->196 2-->186 3-->177 *-->0
-  If you get much fancier than x^2+y^2, remember that many characters have
-  to be escaped from the Unix command line, e.g., x\<y or f\(x\)=x^2, etc.
-  Of course, you won't need these extra escapes when running mimetex from
-  a browser.
+  The right-hand illustration shows asterisks in the same positions as
+  the left-hand one, along with anti-aliased grayscale colormap indexes
+  assigned to neighboring pixels, and with the rgb value for each
+  index.  Just typing ./mimetex.cgi without an argument should produce
+  ascii rasters for the default expression f(x)=x^2.  If you see the
+  two ascii rasters then your binary's good, so mv it to your server's
+  cgi-bin/ directory and set permissions as necessary.
 
-  Once mimetex.cgi is working (and you're done playing with it),
-  mv it to your server's cgi-bin/ directory, where cgi programs
-  are expected (and chmod/chown it if necessary).  Then mv
-  mimetex.html to your server's htdocs/ directory.  Now point
-  your browser to www.yourdomain.com/mimetex.html , and it should
-  be rendered exactly like my page at www.forkosh.com/mimetex.html .
-       One "gotcha":  the two directories are typically of the form
-  somewhere/www/cgi-bin/ and somewhere/www/htdocs/ ,  so I set up
-  mimtex.html to get mimetex.cgi from the relative path ../cgi-bin/ .
-  If your directories are non-conforming, you may have to edit the
-  few dozen occurrences of ../cgi-bin/mimetex.cgi in mimetex.html
-  (globally changing ../cgi-bin/mimetex.cgi should work).
-  Sometimes a suitable symlink works; if not, you'll have to edit.
+  Once mimetex.cgi is working, mv it to your server's cgi-bin/ directory
+  (wherever cgi programs are expected), and chmod/chown it as necessary.
+  Then mv mimetex.html to your server's htdocs/ directory.  Now point
+  your browser to www.yourdomain.com/mimetex.html and you should see
+  your mimeTeX user's manual reference page.
 
-  Either way, once mimetex.html displays properly, and you've reviewed
-  the tutorial it contains, you can begin writing html documents using
-  mimetex.cgi to render your math.
+  Install Notes:
+     * These two directories are typically of the form
+       somewhere/www/cgi-bin/  and  somewhere/www/htdocs/
+       so I set up mimtex.html to access mimetex.cgi from
+       the relative path ../cgi-bin/   If your directories
+       are non-conforming, you may have to edit the few dozen
+       occurrences of ../cgi-bin/mimetex.cgi in mimetex.html
+       Sometimes a suitable symlink works.  If not, you'll
+       have to edit.  In that case, globally changing
+       ../cgi-bin/mimetex.cgi  often works.
+     * Either way, once mimetex.html displays properly, you can
+       assume everything is working, and can begin authoring html
+       documents using mimetex.cgi to render your own math.
 
 
 IV.  REVISION HISTORY
 ------------------------------------------------------------------------
-  01/11/04  J.Forkosh      version 1.40 beta released on www.forkosh.com
-                           LaTeX compatibility and various new features
+  A more detailed account of mimeTeX's revision history
+  is maintained at  http://www.forkosh.com/mimetexchangelog.html
+  ---
+  09/06/08  J.Forkosh      version 1.70 released.
+  11/30/04  J.Forkosh      version 1.60 released
+  10/02/04  J.Forkosh      version 1.50 released on CTAN with various new
+                           features and fixes, and updated documentation.
+  07/18/04  J.Forkosh      version 1.40 re-released on CTAN with minor
+                           changes, e.g., \mathbb font and nested \array's
+                           now supported.
+  03/21/04  J.Forkosh      version 1.40 released on CTAN, with improved
+                           LaTeX compatibility, various new features and
+                           fixes, including fix to work under Windows.
   12/21/03  J.Forkosh      version 1.30 released on CTAN, with improved
                            LaTeX compatibility and anti-aliasing, various new
                            features, and thoroughly updated documentation.
@@ -183,9 +212,5 @@ V.  CONCLUDING REMARKS
   I hope you find mimeTeX useful.  If so, a contribution to your
   country's TeX Users Group, or to the GNU project, is suggested,
   especially if you're a company that's currently profitable.
-  
-  If you also like mimeTeX's source, I'm an independent contractor
-  incorporated in the US as John Forkosh Associates, Inc.  A resume
-  is at www.forkosh.com or email john@forkosh.com
 ========================= END-OF-FILE README ===========================
 

filter/tex/latex.php

@@ -44,9 +44,11 @@
          * @return string the latex document
          */
         function construct_latex_document( $formula, $fontsize=12 ) {
-            // $fontsize don't affects to formula's size. $density can change size
-
             global $CFG;
+
+            $formula = tex_sanitize_formula($formula);
+
+            // $fontsize don't affects to formula's size. $density can change size
             $doc =  "\\documentclass[{$fontsize}pt]{article}\n"; 
             $doc .=  $CFG->filter_tex_latexpreamble;
             $doc .= "\\pagestyle{empty}\n";

filter/tex/lib.php

@@ -0,0 +1,40 @@
+<?php  //$Id$
+
+function tex_sanitize_formula($texexp) {
+    /// Check $texexp against blacklist (whitelisting could be more complete but also harder to maintain)
+    $tex_blacklist = array(
+        'include','command','loop','repeat','open','toks','output',
+        'input','catcode','name','^^',
+        '\def','\edef','\gdef','\xdef',
+        '\every','\errhelp','\errorstopmode','\scrollmode','\nonstopmode',
+        '\batchmode','\read','\write','csname','\newhelp','\uppercase',
+        '\lowercase','\relax','\aftergroup',
+        '\afterassignment','\expandafter','\noexpand','\special',
+        '\let', '\futurelet','\else','\fi','\chardef','\makeatletter','\afterground',
+        '\noexpand','\line','\mathcode','\item','\section','\mbox','\declarerobustcommand'
+    );
+
+    return  str_ireplace($tex_blacklist, 'forbiddenkeyword', $texexp);
+}
+
+/**
+ * Purge all caches when settings changed.
+ */
+function filter_tex_updatedcallback($name) {
+    global $CFG;
+
+    if (file_exists("$CFG->dataroot/filter/tex")) {
+        remove_dir("$CFG->dataroot/filter/tex");
+    }
+    if (file_exists("$CFG->dataroot/filter/algebra")) {
+        remove_dir("$CFG->dataroot/filter/algebra");
+    }
+    if (file_exists("$CFG->dataroot/temp/latex")) {
+        remove_dir("$CFG->dataroot/temp/latex");
+    }
+
+    delete_records('cache_filters', 'filter', 'tex');
+    delete_records('cache_filters', 'filter', 'algebra');
+}
+
+?>

filter/tex/pix.php

@@ -6,7 +6,18 @@
     $nomoodlecookie = true;     // Because it interferes with caching
 
     require_once('../../config.php');
+
+    if (empty($CFG->textfilters)) {
+        error ('Filter not enabled!');
+    } else {
+        $filters = explode(',', $CFG->textfilters);
+        if (array_search('filter/tex', $filters) === FALSE) {
+            error ('Filter not enabled!');
+        }
+    }
+
     require_once($CFG->libdir.'/filelib.php');
+    require_once($CFG->dirroot.'/filter/tex/lib.php');
     require_once('defaultsettings.php' );
     require_once('latex.php');
 
@@ -55,29 +66,30 @@
                 $texexp = str_replace('>','>',$texexp);
                 $texexp = preg_replace('!\r\n?!',' ',$texexp);
                 $texexp = '\Large ' . $texexp;
+                $texexp = tex_sanitize_formula($texexp);
+                $texexp = escapeshellarg($texexp);
 
                 if ((PHP_OS == "WINNT") || (PHP_OS == "WIN32") || (PHP_OS == "Windows")) {
-                    $texexp = str_replace('"','\"',$texexp);
                     $cmd = "$CFG->dirroot/$CFG->texfilterdir/mimetex.exe";
                     $cmd = str_replace(' ','^ ',$cmd);
-                    $cmd .= " ++ -e  \"$pathname\" -- \"$texexp\"";
+                    $cmd .= " ++ -e  \"$pathname\" -- $texexp";
                 } else if (is_executable("$CFG->dirroot/$CFG->texfilterdir/mimetex")) {   /// Use the custom binary
 
-                    $cmd = "$CFG->dirroot/$CFG->texfilterdir/mimetex -e $pathname -- ". escapeshellarg($texexp);
+                    $cmd = "$CFG->dirroot/$CFG->texfilterdir/mimetex -e $pathname -- $texexp";
 
                 } else {                                                           /// Auto-detect the right TeX binary
                     switch (PHP_OS) {
 
                         case "Linux":
-                            $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.linux\" -e \"$pathname\" -- ". escapeshellarg($texexp);
+                            $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.linux\" -e \"$pathname\" -- $texexp";
                         break;
 
                         case "Darwin":
-                            $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.darwin\" -e \"$pathname\" -- ". escapeshellarg($texexp);
+                            $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.darwin\" -e \"$pathname\" -- $texexp";
                         break;
 
                         case "FreeBSD":
-                            $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.freebsd\" -e \"$pathname\" ". escapeshellarg($texexp);
+                            $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.freebsd\" -e \"$pathname\" $texexp";
                         break;
 
                         default:      /// Nothing was found, so tell them how to fix it.

filter/tex/readme_moodle.txt

@@ -0,0 +1,25 @@
+Description of mimeTeX v 1.70 import into Moodle
+
+Compiling mimeTeX:
+
+===Windows===
+1/ get "Automated MinGW Installer" from https://sourceforge.net/projects/mingw/files/
+2/ install mingw
+3/ go into directory with extracted source files
+4/ execute "c:\mingw\bin\gcc -DAA -DWINDOWS mimetex.c gifsave.c -lm -o mimetex.exe"
+
+===Linux===
+1/ install gcc
+2/ go into directory with extracted source files
+3/ execute "cc -DAA mimetex.c gifsave.c -lm -o mimetex.linux"
+
+===FreeBSD===
+1/ go into directory with extracted source files
+2/ execute "cc -DAA mimetex.c gifsave.c -lm -o mimetex.freebsd"
+
+===Apple OSX===
+1/ install gcc
+2/ go into directory with extracted source files
+3/ execute "cc -DAA mimetex.c gifsave.c -lm -o mimetex.darwin"
+
+skodak

filter/tex/texdebug.php

@@ -1,15 +1,29 @@
-<?PHP // $Id$
+<?php // $Id$
       // This function fetches math. images from the data directory
       // If not, it obtains the corresponding TeX expression from the cache_tex db table
       // and uses mimeTeX to create the image file
 
-    $nomoodlecookie = true;     // Because it interferes with caching
-
     require_once("../../config.php");
 
+    if (empty($CFG->textfilters)) {
+        error ('Filter not enabled!');
+    } else {
+        $filters = explode(',', $CFG->textfilters);
+        if (array_search('filter/tex', $filters) === FALSE) {
+            error ('Filter not enabled!');
+        }
+    }
+
+    require_once($CFG->dirroot.'/filter/tex/lib.php');
+
     $CFG->texfilterdir = "filter/tex";
     $CFG->teximagedir = "filter/tex";
 
+    require_login();
+    if (!isadmin()) {
+        error('Sorry, but you do not currently have permissions to do that');
+    }
+
     $query = urldecode($_SERVER['QUERY_STRING']);
     error_reporting(E_ALL);
 
@@ -102,31 +116,32 @@
             }
             $commandpath = "";
             $cmd = "";
+            $texexp = tex_sanitize_formula($texexp);
+            $texexp = escapeshellarg($texexp);
             switch (PHP_OS) {
                 case "Linux":
                     $commandpath="$CFG->dirroot/$CFG->texfilterdir/mimetex.linux";           
-                $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.linux\" -e \"$pathname\" ". escapeshellarg($texexp);
+                    $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.linux\" -e \"$pathname\" $texexp";
                 break;
                 case "WINNT":
-                    case "WIN32":
-                    case "Windows":
+                case "WIN32":
+                case "Windows":
                     $commandpath="$CFG->dirroot/$CFG->texfilterdir/mimetex.exe";
-                $texexp = str_replace('"','\"',$texexp);
-                $cmd = str_replace(' ','^ ',$commandpath);
-                $cmd .= " ++ -e  \"$pathname\" \"$texexp\"";
+                    $cmd = str_replace(' ','^ ',$commandpath);
+                    $cmd .= " ++ -e  \"$pathname\" $texexp";
                 break;
                 case "Darwin":
                     $commandpath="$CFG->dirroot/$CFG->texfilterdir/mimetex.darwin";
-                $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.darwin\" -e \"$pathname\" ". escapeshellarg($texexp);
+                    $cmd = "\"$CFG->dirroot/$CFG->texfilterdir/mimetex.darwin\" -e \"$pathname\" $texexp";
                 break;
             }
             if (!$cmd) {
-              if (is_executable("$CFG->dirroot/$CFG->texfilterdir/mimetex")) {   /// Use the custom binary
-                $commandpath="$CFG->dirroot/$CFG->texfilterdir/mimetex";
-                $cmd = "$CFG->dirroot/$CFG->texfilterdir/mimetex -e $pathname ". escapeshellarg($texexp);
-              } else {
-                error($error_message1);
-              }
+                if (is_executable("$CFG->dirroot/$CFG->texfilterdir/mimetex")) {   /// Use the custom binary
+                    $commandpath="$CFG->dirroot/$CFG->texfilterdir/mimetex";
+                    $cmd = "$CFG->dirroot/$CFG->texfilterdir/mimetex -e $pathname $texexp";
+                } else {
+                    error($error_message1);
+                }
             }
             system($cmd, $status);
         }

filter/tex/texed.php

@@ -6,6 +6,16 @@
     $nomoodlecookie = true;     // Because it interferes with caching
 
     require_once("../../config.php");
+    require_once($CFG->dirroot.'/filter/tex/lib.php');
+
+    if (empty($CFG->textfilters)) {
+        error ('Filter not enabled!');
+    } else {
+        $filters = explode(',', $CFG->textfilters);
+        if (array_search('filter/tex', $filters) === FALSE) {
+            error ('Filter not enabled!');
+        }
+    }
 
     $CFG->texfilterdir = "filter/tex";
     $CFG->teximagedir = "filter/tex";
@@ -23,18 +33,20 @@
             make_upload_directory($CFG->teximagedir);
         }
         $pathname = "$CFG->dataroot/$CFG->teximagedir/$image";
+        $texexp = tex_sanitize_formula($texexp);
+        $texexp = escapeshellarg($texexp);
+
         switch (PHP_OS) {
             case "Linux":
-                system("$CFG->dirroot/$CFG->texfilterdir/mimetex.linux -e $pathname -- ". escapeshellarg($texexp) );
+                system("$CFG->dirroot/$CFG->texfilterdir/mimetex.linux -e $pathname -- $texexp" );
             break;
             case "WINNT":
-                case "WIN32":
-                case "Windows":
-                $texexp = str_replace('"','\"',$texexp);
-            system("$CFG->dirroot/$CFG->texfilterdir/mimetex.exe -e  $pathname -- \"$texexp\"");
+            case "WIN32":
+            case "Windows":
+                system("$CFG->dirroot/$CFG->texfilterdir/mimetex.exe -e  $pathname -- $texexp");
             break;
             case "Darwin":
-                system("$CFG->dirroot/$CFG->texfilterdir/mimetex.darwin -e $pathname -- ". escapeshellarg($texexp) );
+                system("$CFG->dirroot/$CFG->texfilterdir/mimetex.darwin -e $pathname -- $texexp" );
             break;
         }
         if (file_exists($pathname)) {

filter/tidy/filter.php

@@ -17,7 +17,7 @@
 * @param        string         text to be filtered
 */
 function tidy_filter($courseid, $text) {
-       
+    global $CFG;   
 /// Configuration for tidy. Feel free to tune for your needs, e.g. to allow
 /// proprietary markup.
     $tidyoptions = array(             
@@ -39,7 +39,11 @@ function tidy_filter($courseid, $text) {
     
 /// If enabled: run tidy over the entire string
     if (function_exists('tidy_repair_string')){
-        $text = tidy_repair_string($text, $tidyoptions);
+        if (empty($CFG->unicodedb)) {
+            $text = tidy_repair_string($text, $tidyoptions);
+        } else {
+            $text = tidy_repair_string($text, $tidyoptions, 'utf8');
+        }
     }
 
     return $text;

grade/index.php

@@ -7,6 +7,7 @@
     $user     = optional_param('user', -1);
     $group    = optional_param('group', -1);
     $action   = optional_param('action', 'grades');
+    $cview    = optional_param('cview', -1);
 
     if (!$course = get_record('course', 'id', $id)) {
         error('No course ID');