Changeset 569

Timestamp:

07/29/08 16:01:29 (2 years ago)

Author:

sidtheduck

Message:

+ Fix for ticket #185 - special characters in album name
+ Fix for ticket #181 - Edit comment form
+ Fix for ticket #180 - Manage Feedback notification issues
+ Fix for possible SQL injection vulnerability found by security tester (Thanks James of GulfTech?!)
+ Redirect to plog-upload if already logged in and navigating to plog-admin/index.php

Location:

trunk

Files:

• plog-admin/index.php (modified) (1 diff)
• plog-admin/plog-admin-functions.php (modified) (24 diffs)
• plog-admin/plog-admin.php (modified) (2 diffs)
• plog-admin/plog-feedback.php (modified) (1 diff)
• plog-admin/plog-manage.php (modified) (12 diffs)
• plog-admin/plog-upload.php (modified) (1 diff)
• plog-download.php (modified) (5 diffs)
• plog-includes/plog-functions.php (modified) (11 diffs)
• plog-remote.php (modified) (3 diffs)

trunk/plog-admin/index.php

@@ -2 +2 @@
 // load configuration variables from database, plog-globals, & plog-includes/plog-functions
 require_once(dirname(dirname(__FILE__))."/plog-load-config.php");
+
+// if we're already logged in, redirect to the upload page
+if (isset($_SESSION['plogger_logged_in']) && $_SESSION['plogger_logged_in'] === true) {
+        header("Location: plog-upload.php");
+        exit;
+}
 
 $output = '';

trunk/plog-admin/plog-admin-functions.php

@@ -33 +33 @@
 }
 
+function generate_pagination_view_menu() {
+        $url_query = "?";
+        $url_parts = parse_url($_SERVER['REQUEST_URI']);
+        if (isset($url_parts['query'])) {
+                // if entries_per_page is already present in URL, remove it
+                if (strpos($url_parts['query'], "entries_per_page") !== false || strpos($url_parts['query'], "plog_page") !== false) {
+                        parse_str($url_parts['query'], $query_parts);
+                        foreach ($query_parts as $qkey => $qval) {
+                                if ($qkey != "entries_per_page" && $qkey != "plog_page") {
+                                        $url_query .= $qkey."=".$qval."&";
+                                }
+                        }
+                } else {
+                        $url_query .= $url_parts['query']."&";
+                }
+        }
+
+        $java = 'document.location.href = \''.$url_parts['path'].$url_query.'entries_per_page=\'+this.options[this.selectedIndex].value';
+
+        $possible_values = array("1"=>1, "5"=>5, "10"=>10, "20"=>20, "50"=>50, "100"=>100, "250"=>250, "500"=>500);
+        $output= "\n\t\t\t" . '<label accesskey="e" for="entries_on_page">' .plog_tr('<em>E</em>ntries per page') . '</label>
+                        <select class="entries-page" onchange="'.$java.'" name="entries_per_page" style="width: 60px;">';
+        foreach ($possible_values as $key => $value) {
+                if ($_SESSION['entries_per_page'] == $key) {
+                        $output .= "\n\t\t\t\t".'<option value="'.$value.'" selected="selected">'.$key.'</option>';
+                } else {
+                        $output .= "\n\t\t\t\t".'<option value="'.$value.'">'.$key.'</option>';
+                }
+        }
+        $output.= "\n\t\t\t".'</select>';
+        return $output;
+}
+
 function add_picture($album_id,$tmpname,$filename,$caption,$desc) {
         global $config;
@@ -72 +105 @@
 
         while (is_file($config['basedir'].'plog-content/images/'.$create_path."/".$unique_filename_base.".".$filename_ext)){
-                $unique_filename_base = SmartStripSlashes($filename_base)." (" . ++$i .")";
-        }
-
-        $final_filename = $unique_filename_base . "." . $filename_ext;
+                $unique_filename_base = SmartStripSlashes($filename_base)."(" . ++$i .")";
+        }
+
+        $final_filename = sanitize_filename($unique_filename_base) . "." . $filename_ext;
 
         // final fully qualified file name
-        $final_fqfn = $config["basedir"].'plog-content/images/'.$create_path.'/'.$final_filename;
+        $final_fqfn = $config['basedir'].'plog-content/images/'.$create_path.'/'.$final_filename;
 
         if (!makeDirs($config['basedir'].'plog-content/images/'.$create_path, 0777)) {
@@ -164 +197 @@
 };
 
-function update_picture($id,$caption,$allow_comments,$description) {
+function update_picture($id, $caption, $allow_comments, $description) {
         $id = intval($id);
         $caption = mysql_real_escape_string($caption);
@@ -175 +208 @@
                 WHERE id='$id'";
         $result = mysql_query($query);
-        if ($result) 
+        if ($result) {
                 return array('output' => plog_tr('You have successfully modified the selected picture.'));
-        else
+        } else {
                 return array('errors' => mysql_error());
+        }
 }
 
@@ -235 +269 @@
         $i = 0;
         while ($to_album != $picture['parent_album'] && is_file($config['basedir'].'plog-content/images/'.$target_path."/".$unique_filename_base.".".$filename_ext)){
-                $unique_filename_base = $filename_base." (" . ++$i . ")";
+                $unique_filename_base = $filename_base."(" . ++$i . ")";
         }
 
         // final fully qualified file name
-        $picture_path = $target_path.'/'.$unique_filename_base.".".$filename_ext;
+        $picture_path = $target_path.'/'.sanitize_filename($unique_filename_base).".".$filename_ext;
         $final_fqfn = $config['basedir'].'plog-content/images/'.$picture_path;
 
@@ -392 +426 @@
         $target_path = $config["basedir"] . "plog-content/images/".$target_name;
 
-        // do not allow collections with duplicate names, otherwise mod_rewritten links will start
-        // to behave weird.
-        if ($row["name"] != $name && is_dir($target_path)) {
-                // if there is already a directory, check to see if it's in the database
-                $collection_data = get_collection_by_name($name);
-                if ($collection_data){
-                        // it's in the database, so throw duplicate collection error
-                        return array("errors" => sprintf(plog_tr('Collection `%s` could not be renamed to `%s`, because there is another collection with that name'),$row['name'],$name));
-                } else{
-                        // it's not in the database so attempt to delete the directory
-                        if (!@rmdir($target_path)){
-                                // could not delete the directory, so prompt the user to delete it manually
-                                return array("errors" => sprintf(plog_tr('Collection directory `%s` exists, but no collection exists in the database. Attempt to delete automatically failed. Please delete folder via FTP manually and try again.'), $target_path));
+        // check for self-re-naming collection instance
+        if ($source_path != $target_path) {
+                // do not allow collections with duplicate names, otherwise mod_rewritten links will start
+                // to behave weird.
+                if (is_dir($target_path)) {
+                        // if there is already a directory, check to see if it's in the database
+                        $collection_data = get_collection_by_name($name);
+                        if ($collection_data){
+                                // it's in the database, so throw duplicate collection error
+                                return array("errors" => sprintf(plog_tr('Collection `%s` could not be renamed to `%s`, because there is another collection with that name'),$row['name'],$name));
+                        } else{
+                                // it's not in the database so attempt to delete the directory
+                                if (!@rmdir($target_path)){
+                                        // could not delete the directory, so prompt the user to delete it manually
+                                        return array("errors" => sprintf(plog_tr('Collection directory `%s` exists, but no collection exists in the database. Attempt to delete automatically failed. Please delete folder via FTP manually and try again.'), $target_path));
+                                }
                         }
                 }
-        }
-
-        // perform the rename on the directory
-        if (!rename($source_path, $target_path)) {
-                return array("errors" => sprintf(plog_tr("Error renaming directory! (%s to %s)"),$source_path,$target_path));
+
+                // perform the rename on the directory
+                if (!rename($source_path, $target_path)) {
+                        return array("errors" => sprintf(plog_tr("Error renaming directory! (%s to %s)"),$source_path,$target_path));
+                }
         }
 
@@ -470 +507 @@
         } else {
                 return array('errors' => plog_tr('Could not modify selected collection'));
-        };
+        }
 
 }
@@ -541 +578 @@
         // first try to create the directory to hold the images, if that fails, then the album
         // will be unusable anyway
-        $create_path = $config["basedir"] . "plog-content/images/".SmartStripSlashes($row["collection_path"])."/".$album_folder;
+        $create_path = $config['basedir'] . "plog-content/images/".SmartStripSlashes($row['collection_path'])."/".$album_folder;
 
         // check path so we are not creating duplicate albums within the same collection
@@ -582 +619 @@
 }
 
-function update_album($album_id,$name,$description,$thumbnail_id = 0) {
-        global $config;
-
+function update_album($album_id, $name, $description, $thumbnail_id = 0) {
+        global $config;
         $errors = $output = "";
-
-        $target_name = strtolower(sanitize_filename(SmartStripSlashes($name)));
-
+        
         $album_id = intval($album_id);
         $thumbnail_id = intval($thumbnail_id);
-        $name = mysql_real_escape_string(SmartStripSlashes($name));
+        $name = mysql_real_escape_string(SmartStripSlashes(trim($name)));
         $description = mysql_real_escape_string(SmartStripSlashes($description));
+        if (empty($name)) {
+                return array("errors" => plog_tr("Please enter a valid name for the album"));
+        }
+
+        $target_name = strtolower(sanitize_filename(SmartStripSlashes($name)));
 
          // first, get the album name and collection name of our source album
-        $sql = "SELECT c.path AS collection_path, a.path AS album_path
+        $sql = "SELECT c.path AS collection_path, a.path AS album_path, a.parent_id AS collection_id
                         FROM ".TABLE_PREFIX."albums a, ".TABLE_PREFIX."collections c
-                        WHERE c.id = a.parent_id AND a.id = '$album_id'";
+                        WHERE c.id = a.parent_id AND a.id = ".$album_id;
 
         $result = run_query($sql);
         $row = mysql_fetch_assoc($result);
 
-        $source_album_name = SmartStripSlashes($row["album_path"]);
-        $source_collection_name = SmartStripSlashes($row["collection_path"]);     
+        $source_album_name = SmartStripSlashes($row['album_path']);
+        $source_collection_name = SmartStripSlashes($row['collection_path']);     
 
         $source_path = $config['basedir'] . "plog-content/images/".$source_collection_name."/".$source_album_name;
         $target_path = $config['basedir'] . "plog-content/images/".$source_collection_name."/".$target_name;
 
-        // check path so we are not creating duplicate albums within the same collection
-        if (is_dir($target_path)){
-                // if there is already a directory, check to see if it's in the database
-                $album_data = get_album_by_name($album_name, $to_collection);
-                if ($album_data) {
-                        // it's in the database, so throw duplicate album error
-                        return array("errors" => sprintf(plog_tr('New album could not be created, because there already is one named `%s` in the collection `%s`!'), $target_name, $source_collection_name));
-                } else {
-                        // it's not in the database so attempt to delete the directory
-                        if (!@rmdir($target_path)){
-                                // could not delete the directory, so prompt the user to delete it manually
-                                return array("errors" => sprintf(plog_tr('Album directory `%s` exists, but no album exists in the database. Attempt to delete automatically failed. Please delete folder via FTP manually and try again.'), $target_path));
+        // check for self-re-naming album instance
+        if ($source_path != $target_path) {
+                // check path so we are not creating duplicate albums within the same collection
+                if (is_dir($target_path)) {
+                        // if there is already a directory, check to see if it's in the database
+                        $album_data = get_album_by_name($name, $row['collection_id']);
+                        if ($album_data) {
+                                // it's in the database, so throw duplicate album error
+                                return array("errors" => sprintf(plog_tr('New album could not be created, because there already is one named `%s` in the collection `%s`!'), $target_name, $source_collection_name));
+                        } else {
+                                // it's not in the database so attempt to delete the directory
+                                if (!@rmdir($target_path)){
+                                        // could not delete the directory, so prompt the user to delete it manually
+                                        return array("errors" => sprintf(plog_tr('Album directory `%s` exists, but no album exists in the database. Attempt to delete automatically failed. Please delete folder via FTP manually and try again.'), $target_path));
+                                }
                         }
                 }
-        }
-
-        // perform the rename on the directory
-        if (!rename($source_path, $target_path))
-        {
-                return array(
-                        "errors" => sprintf(plog_tr("Error renaming directory! (%s to %s)"),$source_path,$target_path));
+
+                // perform the rename on the directory
+                if (!rename($source_path, $target_path))
+                {
+                        return array(
+                                "errors" => sprintf(plog_tr("Error renaming directory! (%s to %s)"),$source_path,$target_path));
+                }
         }
 
@@ -925 +967 @@
                 return false;
         }
-        $output .= "\n\t" . '<form class="edit" action="'.$_SERVER["PHP_SELF"].'" method="post">
-                <table>';
+        $query = "";
+        if (strpos($_SERVER['PHP_SELF'], "plog-manage") !== false) {
+                $query = "?level=comments&amp;id=".$comment['parent_id'];
+        }
+
+        $output .= "\n\t" . '<form class="edit" action="'.$_SERVER['PHP_SELF'].$query.'" method="post">';
+
+        // get the thumbnail
+        $photo = get_picture_by_id($comment['parent_id']);
+        $thumbpath = generate_thumb(SmartStripSlashes($photo['path']), $photo['id'],THUMB_SMALL);
+        $output .= "\n\t\t" . '<div style="float: right;"><img src="'.$thumbpath.'" alt="" /></div>';
+
+        $output .= "\n\t\t<table>";
         $output .= "\n\t\t\t" . '<tr>
                                 <td>' . plog_tr('Author:') . '<br /><input size="30" name="author" id="author" value="'.SmartStripSlashes($comment['author']).'"/ ></td>
@@ -940 +993 @@
                         <input type="hidden" name="pid" value="'.$comment['id'].'" >
                         <input type="hidden" name="action" value="update-comment" >
-                        <button class="submit" type="submit">' . plog_tr('Update') . '</button>';
-
-                if (isset($_REQUEST["level"]))
-                {
-                        $output .= "\n\t\t\t" . '<input type="hidden" name="level" value="'.$_REQUEST['level'].'" />';
-                }
-
-                if (isset($_REQUEST["id"]))
-                {
-                        $output .= "\n\t\t\t" . '<input type="hidden" name="id" value="'.$_REQUEST['id'].'" />';
-                }
+                        <input class="submit" name="update" value="' . plog_tr('Update') . '" type="submit" />
+                        <input class="submit" name="cancel" value="' . plog_tr('Cancel') . '" type="submit" />';
 
                         $output .= "\n\n\t\t" . '</form>';
@@ -1135 +1179 @@
 
 /// XXX: something for the future: perhaps hooks for plugins should be implemented,
-// so plugis could add new fields to all those forms.
+// so plugins could add new fields to all those forms.
 function plog_add_collection_form() {
         $output = "\n\t\t" . '<input type="button" class="submit" id="show-collection" onclick="toggle(\'create-collection\'); toggle(\'show-collection\')" value="' . plog_tr('Create a Collection') . '" />';
@@ -1178 +1222 @@
         $output = '';
         $collection_id = intval($collection_id);
-        $output .= "\n\t\t" . '<form class="edit" action="'.$_SERVER["REQUEST_URI"].'" method="post">';
+        $output .= "\n\t\t" . '<form class="edit" action="'.$_SERVER['PHP_SELF'].'" method="post">';
         $collection = get_collection_by_id($collection_id);
 
@@ -1205 +1249 @@
         $output .= "\n\t\t\t" . '<div>
                         <label accesskey="n" for="name">' . plog_tr('<em>N</em>ame') . ':</label><br />
-                        <input size="30" name="name" id="name" value="'.SmartStripSlashes($collection['name']).'" /><br />
+                        <input size="30" name="name" id="name" value="'.htmlspecialchars(SmartStripSlashes($collection['name'])).'" /><br />
                         <label accesskey="d" for="description">' . plog_tr('<em>D</em>escription') . ':</label><br />
-                        <input size="80" name="description" id="description" value="'.SmartStripSlashes($collection['description']).'" /><br />
+                        <input size="80" name="description" id="description" value="'.htmlspecialchars(SmartStripSlashes($collection['description'])).'" /><br />
                         Thumbnail:<br />
                                 <select name="thumbnail_id" onchange="updateThumbPreview(this)" class="thumbselect" id="thumbselect">
@@ -1216 +1260 @@
                                 <input type="hidden" name="action" value="update-collection" />
                                 <br />
-                                <button class="submit" type="submit">' . plog_tr('Update') . '</button>
+                                <input class="submit" name="update" value="' . plog_tr('Update') . '" type="submit" />
+                                <input class="submit" name="cancel" value="' . plog_tr('Cancel') . '" type="submit" />
                         </div>';
 
@@ -1231 +1276 @@
         $auto_graphic = $config['gallery_url']."plog-admin/images/auto.gif";
 
-        $output = "\n\t\t" . '<form class="edit" action="'.$_SERVER["PHP_SELF"].'?level=albums&amp;id='.$album["parent_id"].'" method="post">';
+        $output = "\n\t\t" . '<form class="edit" action="'.$_SERVER['PHP_SELF'].'?level=albums&amp;id='.$album['parent_id'].'" method="post">';
 
         $images = '<option class="thumboption" value="0" style="padding-left: 100px; background-image: url('.$auto_graphic.'); background-repeat: no-repeat;">' . plog_tr('automatic') . '</option>';
@@ -1242 +1287 @@
                         $style = 'class="thumboption" style="padding-left: '.($thumbnail_config[THUMB_SMALL]["size"] + 5).'px; background-image: url('.generate_thumb(SmartStripSlashes($row["path"]), $row["id"]).'); background-repeat: no-repeat;"';
 
-                        $images .= "\n\t\t\t\t<option $style value='" . $row["id"] . "'" . $selected . ">";
+                        $images .= "\n\t\t\t\t<option ".$style." value='" . $row["id"] . "'" . $selected . ">";
                         $images .= !empty($row["caption"]) ? SmartStripSlashes($row["caption"]) : SmartStripSlashes(basename($row["path"]));
                         $images .= "</option>";
@@ -1249 +1294 @@
                 $output .= "\n\t\t\t" . '<div>
                         <label for="name" accesskey="n">' . plog_tr('<em>N</em>ame') . ':</label><br />
-                        <input size="30" name="name" id="name" value="'.SmartStripSlashes($album['name']).'" /><br />
+                        <input size="30" name="name" id="name" value="'.htmlspecialchars(SmartStripSlashes($album['name'])).'" /><br />
                         <label for="description" accesskey="d">' . plog_tr('<em>D</em>escription') . ':</label><br />
-                        <input size="80" name="description" id="description" value="'.SmartStripSlashes($album['description']).'" /><br />
+                        <input size="80" name="description" id="description" value="'.htmlspecialchars(SmartStripSlashes($album['description'])).'" /><br />
                         Thumbnail:<br />
                                 <select name="thumbnail_id" class="thumbselect" id="thumbselect" onchange="updateThumbPreview(this)">
@@ -1260 +1305 @@
                                 <input type="hidden" name="action" value="update-album" />
                                 <br />
-                                <button class="submit" type="submit">' . plog_tr('Update') . '</button>
+                                <input class="submit" name="update" value="' . plog_tr('Update') . '" type="submit" />
+                                <input class="submit" name="cancel" value="' . plog_tr('Cancel') . '" type="submit" />
                         </div>';
                 $output .= "\n\t\t" . '</form>' . "\n";
@@ -1331 +1377 @@
                         //$java = "javascript:this.ThumbPreviewPopup('$target')";
                         $output .= "\n\t\t\t\t" . '<td><div class="img-shadow"><a href="'.plogger_get_picture_thumb(THUMB_LARGE).'" rel="lightbox" title="'.plogger_get_picture_caption().'">'.$imgtag.'</a></div></td>';
-                        $output .= "\n\t\t\t\t<td><strong><a class='folder' href='?level=comments&amp;id=" . $id . "'>" . basename(plogger_get_source_picture_path()) . "</a></strong></td>";
+                        $output .= "\n\t\t\t\t".'<td><strong><a class="folder" href="'.$_SERVER['PHP_SELF'].'?level=comments&amp;id=' . $id . '">' . basename(plogger_get_source_picture_path()) . '</a></strong> &#8212; ' . sprintf(plog_tr('contains %d comment(s)'), plogger_picture_comment_count()) . '</td>';
                         $output .= "\n\t\t\t\t<td><p id=\"picture-caption-" . plogger_get_picture_id() ."\">" . plogger_get_picture_caption() . "&nbsp;</p></td>";
                         $output .= "\n\t\t\t\t<td><p id=\"picture-description-" . plogger_get_picture_id() ."\">" . plogger_get_picture_description() . "&nbsp;</p></td>";
@@ -1342 +1388 @@
 
                         $parent_id = $_REQUEST["id"];
-                        $output .= '<a href="?action=1&amp;selected%5B%5D=' . $id . '&amp;level=pictures&amp;delete_checked=1&amp;id='.$parent_id;
-                        if (isset($_GET["entries_per_page"])) $output .= '&amp;entries_per_page=' . intval($_GET["entries_per_page"]);
-                        if (isset($_GET["plog_page"])) $output .= '&amp;plog_page=' . intval($_GET["plog_page"]);
+                        $output .= '<a href="?action=move-delete&amp;selected%5B%5D=' . $id . '&amp;level=pictures&amp;delete_checked=1&amp;id='.$parent_id;
+                        if (isset($_GET['plog_page'])) $output .= '&amp;plog_page=' . intval($_GET['plog_page']);
                         $output .= '" onclick="return confirm(\'' . plog_tr('Are you sure you want to delete this item?') . '\');"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/x.gif" alt="' . plog_tr('Delete') . '" title="' . plog_tr('Delete') . '" /></a></td>';
                         $output .= "\n\t\t\t</tr>";
@@ -1415 +1460 @@
                         $counter++;
 
-                        $output .= "\n\t\t\t<tr class='$table_row_color'>";
-                        $output .= "\n\t\t\t\t<td><input type='checkbox' name='selected[]' value='" . $id . "' /></td>";
-                        $output .= "\n\t\t\t\t<td><a class='folder' href='?level=pictures&amp;id=" .$id . "'><span id='album-name-" . plogger_get_album_id(). "'><strong>" . plogger_get_album_name() . "</strong></span></a> &#8212; " . sprintf(plog_tr('contains %d picture(s)'),plogger_album_picture_count()) . "</td>";
-                        $output .= "\n\t\t\t\t<td><p id='album-description-" . plogger_get_album_id() . "'>" . plogger_get_album_description() . "&nbsp;</p></td>";
-                        $output .= "\n\t\t\t\t" . '<td><a href="?action=edit-album&amp;id=' . $id . '"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/edit.gif" alt="' . plog_tr('Edit') . '" title="' . plog_tr('Edit') . '" /></a>';
-                        $output .= '<a href="?action=1&amp;selected%5B%5D=' . $id . '&amp;level=albums&amp;delete_checked=1&amp;id='.$_REQUEST["id"].'" onclick="return confirm(\'' . plog_tr('Are you sure you want to delete this item?') . '\');"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/x.gif" alt="' . plog_tr('Delete') . '" title="' . plog_tr('Delete') . '" /></a></td>';
+                        $output .= "\n\t\t\t".'<tr class="'.$table_row_color.'">';
+                        $output .= "\n\t\t\t\t".'<td><input type="checkbox" name="selected[]" value="'.$id.'" /></td>';
+                        $output .= "\n\t\t\t\t".'<td><a class="folder" href="'.$_SERVER['PHP_SELF'].'?level=pictures&amp;id='.$id.'"><span id="album-name-'.plogger_get_album_id().'"><strong>'.plogger_get_album_name().'</strong></span></a> &#8212; ' . sprintf(plog_tr('contains %d picture(s)'), plogger_album_picture_count()) . '</td>';
+                        $output .= "\n\t\t\t\t".'<td><p id="album-description-'.plogger_get_album_id().'">'.plogger_get_album_description().'&nbsp;</p></td>';
+                        $output .= "\n\t\t\t\t".'<td><a href="'.$_SERVER['PHP_SELF'].'?action=edit-album&amp;id='.$id.'"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/edit.gif" alt="' . plog_tr('Edit') . '" title="' . plog_tr('Edit') . '" /></a>';
+                        $output .= '<a href="'.$_SERVER['PHP_SELF'].'?action=move-delete&amp;selected%5B%5D='.$id.'&amp;level=albums&amp;delete_checked=1&amp;id='.$_REQUEST['id'];
+                        if (isset($_GET['plog_page'])) { $output .= '&amp;plog_page='.intval($_GET['plog_page']); }
+                        $output .= '" onclick="return confirm(\'' . plog_tr('Are you sure you want to delete this item?') . '\');"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/x.gif" alt="' . plog_tr('Delete') . '" title="' . plog_tr('Delete') . '" /></a></td>';
                         $output .= "\n\t\t\t</tr>";
 
-                };
-                $output .= "\n\t\t\t" . '<tr class="footer">
+                }
+                $output .= "\n\t\t\t".'<tr class="footer">
                                 <td colspan="7"></td>
                         </tr>
-                </table>' . "\n";
+                </table>'."\n";
         } else {
                 $output .= "\n\n\t\t<p class=\"actions\">" . plog_tr("There are no albums in this collection yet, why don't you create one?") . "</p>\n";
-        };
+        }
         return $output;
 
@@ -1488 +1535 @@
                         $output .= "\n\t\t\t<tr class=\"$table_row_color\">";
                         $output .= "\n\t\t\t\t<td><input type='checkbox' name='selected[]' value='" . $id . "' /></td>";
-                        $output .= "\n\t\t\t\t<td><a class='folder' href='?level=albums&amp;id=" .$id . "'><span id='collection-name-" . plogger_get_collection_id() . "'><strong>" . plogger_get_collection_name() . "</strong></span></a> &#8212; " . sprintf(plog_tr('contains %d albums'),plogger_collection_album_count()) . "</td>";
-                        $output .= "\n\t\t\t\t<td><p id='collection-description-" . plogger_get_collection_id() . "'>" . plogger_get_collection_description() . "&nbsp;</p></td>";
+                        $output .= "\n\t\t\t\t<td><a class='folder' href='?level=albums&amp;id=" .$id . "'><span id='collection-name-" . plogger_get_collection_id()."'><strong>".plogger_get_collection_name()."</strong></span></a> &#8212; " . sprintf(plog_tr('contains %d albums'), plogger_collection_album_count()) . "</td>";
+                        $output .= "\n\t\t\t\t<td><p id='collection-description-" . plogger_get_collection_id() . "'>" . plogger_get_collection_description()."&nbsp;</p></td>";
                         $output .= "\n\t\t\t\t" . '<td><a href="?action=edit-collection&amp;id=' . $id . '"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/edit.gif" alt="' . plog_tr('Edit') . '" title="' . plog_tr('Edit') . '" /></a>';
-                        $output .= '<a href="?action=1&amp;selected%5B%5D=' . $id . '&amp;level=collections&amp;delete_checked=1&amp;id='.@$_REQUEST["id"].'" onclick="return confirm(\'' . plog_tr('Are you sure you want to delete this item?') . '\');"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/x.gif" alt="' . plog_tr('Delete') . '" title="' . plog_tr('Delete') . '" /></a></td>';
+                        $output .= '<a href="?action=move-delete&amp;selected%5B%5D=' . $id . '&amp;level=collections&amp;delete_checked=1&amp;';
+                        if (isset($_REQUEST['id'])) { $output .= 'id='.intval($_REQUEST['id']); }
+                        if (isset($_GET['plog_page'])) { $output .= '&amp;plog_page=' . intval($_GET['plog_page']); }
+                        $output .= '" onclick="return confirm(\'' . plog_tr('Are you sure you want to delete this item?') . '\');"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/x.gif" alt="' . plog_tr('Delete') . '" title="' . plog_tr('Delete') . '" /></a></td>';
                         $output .= "\n\t\t\t</tr>";
-                };
+                }
                 $output .= "\n\t\t\t" . '<tr class="footer">
                                 <td colspan="7"></td>
@@ -1500 +1550 @@
         } else {
                 $output .= "\n\n\t\t<p class=\"actions\">" . plog_tr('There are no collections yet') . "</p>\n";
-        };
+        }
         return $output;
 }

trunk/plog-admin/plog-admin.php

@@ -22 +22 @@
 }
 
-if (!isset($_SESSION["plogger_logged_in"])){ 
+if (!isset($_SESSION['plogger_logged_in']) || $_SESSION['plogger_logged_in'] !== true){ 
         header("Location: index.php");
         exit;
@@ -63 +63 @@
         <script type="text/javascript" src="'.$config['gallery_url'].'plog-admin/js/plogger.js"></script>
         <script type="text/javascript" src="'.$config['gallery_url'].'plog-admin/js/lightbox.js"></script>
-        <script type="text/javascript" src="'.$config['gallery_url'].'plog-admin/js/AmiJS.js"></script>
-        <script type="text/javascript" src="'.$config['gallery_url'].'plog-admin/js/greybox.js"></script>
         '.$inHead.'
-        <script type="text/javascript">
-                //GreyBox configuration
-                //Use animation?
-                var GB_ANIMATION = true;
-                var GB_IMG_DIR = "'.$config['gallery_url'].'plog-admin/images/";
-                //Clicking on the transparent overlay closes the GreyBox window?
-                var GB_overlay_click_close = false;
-        </script>
 </head>
 

trunk/plog-admin/plog-feedback.php

@@ -9 +9 @@
 $inHead = '<script src="js/ajax_editing.js" type="text/javascript"></script>';
 
-function generate_pagination_view_menu() {
-
-        $java = 'document.location.href = \''.$_SERVER["PHP_SELF"].'?'.'&amp;entries_per_page=\'+this.options[this.selectedIndex].value';
-
-        $possible_values = array("5"=>5, "10"=>10, "20"=>20, "50"=>50);
-        $output = "\n\t\t\t\t\t" . '<label accesskey="e" for="entries_on_page">' .plog_tr('<em>E</em>ntries per page') . '</label>
-                                        <select class="entries-page" onchange="'.$java.'" name="entries_per_page" style="width: 60px;">';
-        foreach ($possible_values as $key => $value)
-                if ($_SESSION['entries_per_page'] == $key)
-                        $output .= "\n\t\t\t\t\t\t<option value=\"$value\" selected=\"selected\">$key</option>";
-                else
-                        $output .= "\n\t\t\t\t\t\t<option value=\"$value\">$key</option>";
-        $output.= "\n\t\t\t\t\t</select>";
-
-        return $output;
-
+$output = "\n\t" . '<h1>'. plog_tr("Manage Feedback") . '</h1>' . "\n";
+
+if (isset($_REQUEST['action'])) {
+        if ($_REQUEST['action'] == "approve-delete") {
+                // here we will determine if we need to perform an approved or delete action.
+                $num_items = 0;
+
+                // perform the delete function on the selected items
+                if (isset($_REQUEST['delete_checked'])) {
+                        if (isset($_REQUEST['selected'])) {
+                                foreach($_REQUEST['selected'] as $del_id) {
+                                        // lets build the query string
+                                        $del_id = intval($del_id);
+
+                                        $query = "DELETE FROM ".TABLE_PREFIX."comments WHERE `id`= '".$del_id."'";
+                                        $result = run_query($query);
+
+                                        $num_items++;
+                                }
+
+                                $output .= "\n\t".'<p class="actions">'.sprintf(plog_tr('You have deleted %d comment(s) successfully.'),$num_items).'</p>';
+
+                        } else{
+                                $output .= "\n\t".'<p class="errors">'.plog_tr('Nothing selected to delete!').'</p>';
+                        }
+                } else if (isset($_REQUEST['approve_checked'])) {
+                        // set the approval bit to 1 for all selected comments
+
+                        if (isset($_REQUEST['selected'])) {
+                                foreach($_REQUEST['selected'] as $appr_id) {
+                                        // lets build the query string
+                                        $appr_id = intval($appr_id);
+
+                                        $query = "UPDATE ".TABLE_PREFIX."comments SET `approved` = 1 WHERE `id`= '".$appr_id."'";
+                                        $result = run_query($query);
+
+                                        $num_items++;
+                                }
+
+                                $output .= "\n\t<p class=\"actions\">" . sprintf(plog_tr('You have approved %d comment(s) successfully.'),$num_items) . "</p>";
+                        } else {
+                                $output .= "\n\t<p class=\"errors\">". plog_tr('Nothing selected to approve!') . "</p>";
+                        }
+                }
+        } else if ($_REQUEST['action'] == "edit-comment") {
+                // show the edit form
+                $output .= edit_comment_form($_REQUEST['pid']);
+                $edit_page = 1;
+        } else if ($_REQUEST['action'] == "update-comment") {
+                if (!isset($_REQUEST['cancel'])) {
+                        // update comment in database
+                        $result = update_comment($_POST['pid'],$_POST['author'],$_POST['email'],$_POST['url'],$_POST['comment']);
+                        if (isset($result['errors'])) {
+                                $output .= "\n\t" . '<p class="errors">' . $result['errors'] . '</p>';
+                        } else if (isset($result['output'])) {
+                                $output .= "\n\t" . '<p class="actions">' . $result['output'] . '</p>';
+                        }
+                }
+        }
 }
 
-$output = "\n\t" . '<h1>'. plog_tr("Manage Feedback") . '</h1>' . "\n";
-
-// here we will determine if we need to perform a move or delete action.
-$num_items = 0;
-
-// perform the delete function on the selected items
-if (isset($_REQUEST['delete_checked']) || (isset($_REQUEST['action']) && $_REQUEST['action'] == 'delete_checked')) {
-
-        if (isset($_REQUEST["selected"])) {
-                foreach($_REQUEST["selected"] as $del_id) {
-                        // lets build the query string
-                        $del_id = intval($del_id);
-
-                        $query = "DELETE FROM ".TABLE_PREFIX."comments WHERE `id`= '$del_id'";
-                        $result = run_query($query);
-
-                        $num_items++;
-                }
-
-                $output .= "\n\t<p class=\"actions\">" . sprintf(plog_tr('You have deleted %d comment(s) successfully.'),$num_items) . "</p>";
-
-        } else{
-                $output .= "\n\t<p class=\"errors\">" . plog_tr('Nothing selected to delete!') . "</p>";
-        }
-};
-
-if (isset($_REQUEST['approve_checked']) || (isset($_REQUEST['action']) && $_REQUEST['action'] == 'approve_checked')) {
-        // set the approval bit to 1 for all selected comments
-
-        if (isset($_REQUEST["selected"])) {
-                foreach($_REQUEST["selected"] as $appr_id) {
-                        // lets build the query string
-                        $appr_id = intval($appr_id);
-
-                        $query = "UPDATE ".TABLE_PREFIX."comments SET `approved` = 1 WHERE `id`= '$appr_id'";
-                        $result = run_query($query);
-
-                        $num_items++;
-                }
-
-                $output .= "\n\t<p class=\"actions\">" . sprintf(plog_tr('You have approved %d comment(s) successfully.'),$num_items) . "</p>";
+if (!isset($edit_page)) {
+        // lets iterate through all the content and build a table
+        // set the default level if nothing is specified
+
+        // handle pagination
+        // lets determine the limit filter based on current page and number of results per page
+        if (isset($_REQUEST['entries_per_page'])) {
+                $_SESSION['entries_per_page'] = $_REQUEST['entries_per_page'];
+        } else if (!isset($_SESSION['entries_per_page'])){
+                $_SESSION['entries_per_page'] = 20;
+        }
+
+        $plog_page = isset($_REQUEST['plog_page']) ? $_REQUEST['plog_page'] : 1; // default to the first page
+
+        $first_item = ($plog_page - 1) * $_SESSION['entries_per_page'];
+        if ($first_item < 0) {
+                $first_item = 0;
+        }
+        $limit = "LIMIT ".$first_item.", ".$_SESSION['entries_per_page'];
+
+        // lets generate the pagination menu as well
+        $recordCount = "SELECT count(*) AS num_comments FROM ".TABLE_PREFIX."comments WHERE `approved` = 1";
+        $totalRowsResult = mysql_query($recordCount);
+        $num_comments = mysql_result($totalRowsResult,"num_comments");
+
+        $query = "SELECT COUNT(*) as in_moderation from ".TABLE_PREFIX."comments WHERE `approved` = 0";
+        $mod_result = run_query($query);
+        $num_comments_im = mysql_result($mod_result, "in_moderation");
+
+        // filter based on whether were looking at approved comments or unmoderated comments
+        if (isset($_REQUEST['moderate']) && $_REQUEST['moderate'] == 1) {
+                $approved = 0;
+                $moderate = 1;
         } else {
-                $output .= "\n\t<p class=\"errors\">". plog_tr('Nothing selected to approve!') . "</p>";
-        }
-};
-
-if (isset($_REQUEST["action"])) {
-        if ($_REQUEST["action"] == "edit-comment") {
-                // show the edit form
-                $output .= edit_comment_form($_REQUEST["pid"]);
-        }
-
-        else if ($_REQUEST["action"] == "update-comment") {
-                // update comment in database
-                $result = update_comment($_POST["pid"],$_POST["author"],$_POST["email"],$_POST["url"],$_POST["comment"]);
-                if (isset($result['errors'])) {
-                        $output .= "\n\t" . '<p class="errors">' . $result['errors'] . '</p>';
-                } elseif (isset($result['output'])) {
-                        $output .= "\n\t" . '<p class="actions">' . $result['output'] . '</p>';
-
-                }
-        }
-
+                $approved = 1;
+                $moderate = 0;
+        }
+        $output .= "\n\t\t" . '<form id="contentList" action="'.$_SERVER['PHP_SELF'].'?moderate='.$moderate.'" method="post">';
+
+        if ($approved) {
+                $pagination_menu = generate_pagination("admin", "feedback", $plog_page, $num_comments, $_SESSION['entries_per_page']);
+        } else {
+                $pagination_menu = generate_pagination("admin", "feedback", $plog_page, $num_comments_im, $_SESSION['entries_per_page'], array("moderate" => 1));
+        }
+        $pagination_menu = "\n\t\t" . '<div class="pagination">'.$pagination_menu.'</div>';
+
+        // generate javascript init function for ajax editing
+        $query = "SELECT *, UNIX_TIMESTAMP(`date`) AS `unix_date` from ".TABLE_PREFIX."comments WHERE `approved` = ".$approved." ORDER BY `id` DESC ".$limit;
+        $result = run_query($query);
+
+        if (mysql_num_rows($result) > 0) {
+                $output .= "\n\t\t" . '<script type="text/javascript">';
+                $output .= "\n\t\t\tEvent.observe(window, 'load', init, false);";
+                $output .= "\n\t\t\tfunction init() {";
+
+                while($row = mysql_fetch_assoc($result)) {
+                        $output .= "\n\t\t\tmakeEditable('comment-comment-".$row['id']."');
+                                makeEditable('comment-author-".$row['id']."');
+                                makeEditable('comment-url-".$row['id']."');
+                                makeEditable('comment-email-".$row['id']."');";
+                }
+
+                $output .= "\n\t\t\t}";
+                $output .= "\n\t\t</script>";
+        }
+
+        $query = "SELECT *, UNIX_TIMESTAMP(`date`) AS `unix_date` from ".TABLE_PREFIX."comments WHERE `approved` = ".$approved." ORDER BY `id` DESC ".$limit;
+        $result = run_query($query);
+
+        $empty = 0;
+        $allowedCommentKeys = array("unix_date", "author", "email", "url", "comment");
+        if ($result) {
+                if (mysql_num_rows($result) == 0) {
+                        if ($approved) {
+                                $output .= "\n\t\t" . '<p class="actions">' . plog_tr('You have no user comments on your gallery.') . '</p>';
+                        } else {
+                                $output .= "\n\t\t" . '<p class="actions">' . plog_tr('You have no comments waiting for approval.') . '</p>';
+                        }
+                        $empty = 1;
+                }
+                if ($approved) {
+                        if ($num_comments_im > 0) {
+                                $output.= "\n\t\t" . '<p class="actions">' . sprintf(plog_tr('You have %d comment(s) waiting for approval.'),$num_comments_im) . ' <a href="plog-feedback.php?moderate=1">' . plog_tr('Click here') . '</a> to review and approve/delete the moderated comment(s).</p>';
+                        }
+                }
+
+                $counter = 0;
+                $allowedCommentKeys = array("unix_date", "author", "email", "url", "comment");
+
+                while($row = mysql_fetch_assoc($result)) {
+                        // if we're on our first iteration, dump the header
+                        if ($counter == 0) {
+                                if ($approved) {
+                                        $output .= "\n\n\t\t" . '<table style="width: 100%;">
+                                <tr>
+                                        <td>' . sprintf(plog_tr('You have <strong>%d</strong> user comment(s).'),$num_comments) . '</td>';
+                                } else {
+                                        $output .= "\n\n\t\t" . '<table style="width: 100%;">
+                                <tr>
+                                        <td>' . sprintf(plog_tr('You have <strong>%d</strong> user comment(s) awaiting approval.'),$num_comments_im) . '</td>';
+                                }
+
+                                // output view entries pagination control
+                                $output .= "\n\t\t\t\t" . '<td align="right">'.generate_pagination_view_menu().'
+                                        </td>
+                                </tr>
+                        </table>';
+
+                                if (!$empty) { $output .= $pagination_menu; }
+
+                                $output .= "\n\n\t\t" . '<table style="width: 100%;" cellpadding="4">
+                                <tr class="header">
+                                        <th class="table-header-left"></th>
+                                        <th class="table-header-middle">' . plog_tr('Thumb') . '</th>';
+
+                                foreach ($row as $name => $value) {
+                                        if (in_array($name, $allowedCommentKeys)) { 
+                                                $output .= "\n\t\t\t\t<th class=\"table-header-middle\">". plog_tr(ucfirst($name)) ."</th>";
+                                        }
+                                }
+
+                                $output .= "\n\t\t\t\t" . '<th class="table-header-right">' . plog_tr('Actions') . '</th>
+                                </tr>';
+                        }
+
+                        if ($counter%2 == 0) {
+                                $table_row_color = "color-1";
+                        } else {
+                                $table_row_color = "color-2";
+                        }
+
+                        // start a new table row (alternating colors)
+                        $output .= "\n\t\t\t".'<tr class="'.$table_row_color.'">';
+
+                        // give the row a checkbox
+                        $output .= "\n\t\t\t\t" . '<td><input type="checkbox" name="selected[]" value="'.$row['id'].'" /></td>';
+
+                        // give the row a thumbnail, we need to look up the parent picture for the comment
+                        $picture = get_picture_by_id($row['parent_id']);
+                        $thumbpath = generate_thumb($picture['path'], $picture['id'], THUMB_SMALL);
+
+                        // generate XHTML with thumbnail and link to picture view.
+                        $imgtag = '<img src="'.$thumbpath.'" title="'.$picture['caption'].'" alt="'.$picture['caption'].'" />';
+                        $output .= "\n\t\t\t\t" . '<td><div class="img-shadow"><a href="'.generate_thumb($picture['path'], $picture['id'], THUMB_LARGE).'" rel="lightbox" title="'.plogger_get_picture_caption().'">'.$imgtag.'</a></div></td>';
+
+                        foreach ($row as $key => $value) {
+                                $value = htmlspecialchars($value);
+                                $value = SmartStripSlashes($value);
+
+                                if ($key == "unix_date") {
+                                        $output .= "\n\t\t\t\t" . '<td>'.date($config['date_format'], $value).'</td>';
+                                } else if ($key == "allow_comments") {
+                                        if ($value) {
+                                                $output .= "\n\t\t\t\t<td>". plog_tr('Yes') . "</td>";
+                                        } else {
+                                                $output .= "\n\t\t\t\t<td>" . plog_tr('No') . "</td>";
+                                        }
+                                }
+                                //else if ($key == "ip") {
+                                //      $output .= "<td>" . @gethostbyaddr($value) . "</td>";
+                                //}
+                                else {
+                                        if (in_array($key, $allowedCommentKeys))
+                                                        $output .= "\n\t\t\t\t".'<td><p id="comment-'.$key.'-'.$row['id'].'">'.$value.'&nbsp;</p></td>';
+                                }
+                        }
+
+                        // $output .= our actions panel
+                        $query = "?action=edit-comment&amp;pid=$row[id]";
+                        $output .= "\n\t\t\t\t" . '<td>
+                                        <div>
+                                                <a href="'.$_SERVER['PHP_SELF'].$query.'&amp;entries_per_page='.$_SESSION['entries_per_page'].'&amp;moderate='.$moderate.'"><img src="'.$config['gallery_url'].'plog-admin/images/edit.gif" alt="'.plog_tr('Edit').'" title="'.plog_tr('Edit').'" /></a>
+                                                <a href="'.$_SERVER['PHP_SELF'].'?action=approve-delete&amp;delete_checked=1&amp;selected[]='.$row['id'].'&amp;moderate='.$moderate.'" onclick="return confirm(\'' . plog_tr('Are you sure you want to delete this comment?') . '\');"><img src="'.$config['gallery_url'].'plog-admin/images/x.gif" alt="'.plog_tr('Delete').'" title="'.plog_tr('Delete').'" /></a>';
+
+                        if (!$approved){
+                                $output .= "\n\t\t\t\t\t\t".'<a href="'.$_SERVER['PHP_SELF'].'?action=approve-delete&amp;approve_checked=1&amp;selected[]='.$row['id'].'&amp;moderate=1" onclick="return confirm(\''.plog_tr('Are you sure you want to approve this comment?').'\');"><img src="'.$config['gallery_url'].'plog-admin/images/new_file.gif" alt="'.plog_tr('Approve').'" title="'.plog_tr('Approve').'" /></a>';
+                        }
+
+                        $output .= "\n\t\t\t\t\t</div>\n\t\t\t\t</td>\n\t\t\t</tr>";
+                        $counter++;
+                }
+
+                if ($counter > 0) {
+                        $output .= "\n\t\t\t" . '<tr class="footer">
+                                        <td colspan="9"></td>
+                                </tr>
+                        </table>';
+                }
+        }
+
+        if (!$empty) {
+                $output .= "\n\n\t\t" . '<div><a href="#" onclick="checkAll(document.getElementById(\'contentList\')); return false;">' . plog_tr('Invert Checkbox Selection') . '</a></div>
+                        '.$pagination_menu;
+        }
+
+        $output .= "\n\n\t\t" . '<div>
+                        <input type="hidden" name="action" value="approve-delete" />
+                        <input class="submit" type="submit" name="delete_checked" onclick="return confirm(\''. plog_tr('Are you sure you want to delete the selected comments?') . '\');" value="' . plog_tr('Delete Checked') . '" />';
+
+        if (!$approved) {
+                $output .= "\n\t\t\t" . '<input class="submit" type="submit" name="approve_checked" onclick="return confirm(\'' . plog_tr('Are you sure you want to approve the selected comments?') . '\');" value="' . plog_tr('Approve Checked') . '" />';
+        }
+
+        $output .= "\n\n\t\t" . '</div>' . "\n\t\t" . '</form>'. "\n";
 }
 
-$output .= "\n\t\t" . '<form id="contentList" action="'.$_SERVER["PHP_SELF"].'" method="get">';
-
-$allowedCommentKeys = array("unix_date", "author", "email", "url", "comment");
-
-// lets iterate through all the content and build a table
-// set the default level if nothing is specified
-
-// handle pagination
-// lets determine the limit filter based on current page and number of results per page
-if (!isset($_REQUEST["plog_page"])) $_REQUEST["plog_page"] = "1"; // we're on the first page
-
-if (isset($_REQUEST['entries_per_page'])) $_SESSION['entries_per_page'] = $_REQUEST['entries_per_page'];
-
-if (!isset($_SESSION['entries_per_page'])) $_SESSION['entries_per_page'] = 20;
-
-#$url = "&amp;entries_per_page=$_SESSION[entries_per_page]&amp;level=$_REQUEST[level]&amp;id=$_REQUEST[id]";
-$url = "?entries_per_page=$_SESSION[entries_per_page]";
-
-$plog_page = isset($_REQUEST["plog_page"]) ? $_REQUEST["plog_page"] : 1;
-
-$first_item = ($plog_page - 1) * $_SESSION['entries_per_page'];
-$limit = "LIMIT $first_item, $_SESSION[entries_per_page]";
-
-// lets generate the pagination menu as well
-$recordCount = "SELECT count(*) AS num_comments FROM ".TABLE_PREFIX."comments WHERE `approved` = 1";
-$totalRowsResult = mysql_query($recordCount);
-$num_comments = mysql_result($totalRowsResult,"num_comments");
-
-$query = "SELECT COUNT(*) as in_moderation from ".TABLE_PREFIX."comments WHERE `approved` = 0";
-$mod_result = run_query($query);
-$num_comments_im = mysql_result($mod_result, "in_moderation");
-
-// filter based on whether were looking at approved comments or unmoderated comments
-$approved = isset($_REQUEST['moderate']) ? 0 : 1;
-
-if ($approved) {
-        $pagination_menu = generate_pagination("admin", "feedback", $plog_page, $num_comments, $_SESSION['entries_per_page']);
-} else {
-        $pagination_menu = generate_pagination("admin", "feedback", $plog_page, $num_comments_im, $_SESSION['entries_per_page'], array("moderate" => 1));
-}
-$pagination_menu = "\n\t\t" . '<div class="pagination">'.$pagination_menu.'</div>';
-
-// generate javascript init function for ajax editing
-$query = "SELECT *, UNIX_TIMESTAMP(`date`) AS `unix_date` from ".TABLE_PREFIX."comments WHERE `approved` = $approved ORDER BY `id` DESC $limit";
-$result = run_query($query);
-
-if (mysql_num_rows($result) > 0) {
-        $output .= "\n\t\t" . '<script type="text/javascript">';
-        $output .= "\n\t\t\tEvent.observe(window, 'load', init, false);";
-        $output .= "\n\t\t\tfunction init() {";
-
-        while($row = mysql_fetch_assoc($result)) {
-                $output .= "\n\t\t\tmakeEditable('comment-comment-".$row['id']."');
-                        makeEditable('comment-author-".$row['id']."');
-                        makeEditable('comment-url-".$row['id']."');
-                        makeEditable('comment-email-".$row['id']."');";
-        }
-
-        $output .= "\n\t\t\t}";
-        $output .= "\n\t\t</script>";
-}
-
-$query = "SELECT *, UNIX_TIMESTAMP(`date`) AS `unix_date` from ".TABLE_PREFIX."comments WHERE `approved` = $approved ORDER BY `id` DESC $limit";
-$result = run_query($query);
-
-$empty = 0;
-if ($result) {
-        if (mysql_num_rows($result) == 0) {
-        $output.= "\n\t\t" . '<p class="actions">' . plog_tr('You have no user comments on your gallery.') . '</p>';
-        $empty = 1;
-        }
-        if ($approved) {
-                if ($num_comments_im > 0) {
-                        $output.= "\n\t\t" . '<p class="actions">' . sprintf(plog_tr('You have %d comment(s) waiting for approval.'),$num_comments_im) . ' <a href="plog-feedback.php?moderate=1">' . plog_tr('Click here') . '</a> to review and approve/delete the moderated comment(s).</p>';
-                }
-        }
-        $counter = 0;
-
-        while($row = mysql_fetch_assoc($result)) {
-                // if we're on our first iteration, dump the header
-                if ($counter == 0) {
-                        if ($approved)
-                                $output .= "\n\n\t\t" . '<table style="width: 100%;">
-                        <tr>
-                                <td>' . sprintf(plog_tr('You have <strong>%d</strong> user comment(s).'),$num_comments) . '</td>';
-                        else
-                                $output .= "\n\n\t\t" . '<table style="width: 100%;">
-                        <tr>
-                                <td>' . sprintf(plog_tr('You have <strong>%d</strong> user comment(s) awaiting approval.'),$num_comments_im) . '</td>';
-
-                        // output view entries pagination control
-                        $output .= "\n\t\t\t\t" . '<td align="right">'.generate_pagination_view_menu().'
-                                </td>
-                        </tr>
-                </table>';
-
-                        if (!$empty) { $output .= $pagination_menu; }
-
-                        $output .= "\n\n\t\t" . '<table style="width: 100%;" cellpadding="4">
-                        <tr class="header">
-                                <th class="table-header-left"></th>
-                                <th class="table-header-middle">' . plog_tr('Thumb') . '</th>';
-
-                        foreach ($row as $name => $value) {
-                                if (in_array($name, $allowedCommentKeys)) 
-                                $output .= "\n\t\t\t\t<th class=\"table-header-middle\">". plog_tr(ucfirst($name)) ."</th>";
-                        }
-
-                        $output .= "\n\t\t\t\t" . '<th class="table-header-right">' . plog_tr('Actions') . '</th>
-                        </tr>';
-                }
-
-                if ($counter%2 == 0) $table_row_color = "color-1";
-                else $table_row_color = "color-2";
-
-                // start a new table row (alternating colors)
-                $output .= "\n\t\t\t<tr class=\"$table_row_color\">";
-
-                // give the row a checkbox
-                $output .= "\n\t\t\t\t" . '<td><input type="checkbox" name="selected[]" value="'.$row["id"].'" /></td>';
-
-                // give the row a thumbnail, we need to look up the parent picture for the comment
-                $picture = get_picture_by_id($row["parent_id"]);
-
-                $thumbpath = generate_thumb($picture["path"],$picture["id"],THUMB_SMALL);
-
-                // generate XHTML with thumbnail and link to picture view.
-                $imgtag = '<img src="'.$thumbpath.'" title="'.$picture["caption"].'" alt="'.$picture["caption"].'" />';
-                //$target = 'plog-thumbpopup.php?src='.$picture["id"];;
-                //$java = "javascript:this.ThumbPreviewPopup('$target')";
-
-                $output .= "\n\t\t\t\t" . '<td><div class="img-shadow"><a href="'.generate_thumb($picture["path"],$picture["id"],THUMB_LARGE).'" rel="lightbox" title="'.plogger_get_picture_caption().'">'.$imgtag.'</a></div></td>';
-
-                foreach($row as $key => $value) {
-                        $value = htmlspecialchars($value);
-                        $value = SmartStripSlashes($value);
-
-                        if ($key == "unix_date") {
-                                $output .= "\n\t\t\t\t" . '<td>'.date($config["date_format"], $value).'</td>';
-                        }
-                        else if ($key == "allow_comments") {
-                                if ($value) $output .= "\n\t\t\t\t<td>". plog_tr('Yes') . "</td>";
-                                else $output .= "\n\t\t\t\t<td>" . plog_tr('No') . "</td>";
-                        }
-                        //else if ($key == "ip") {
-                        //      $output .= "<td>" . @gethostbyaddr($value) . "</td>";
-                        //}
-
-                        else {
-                                if (in_array($key, $allowedCommentKeys))
-                                                $output .= "\n\t\t\t\t<td><p id=\"comment-$key-" . $row['id'] ."\">$value&nbsp;</p></td>";
-                        }
-                }
-
-                // $output .= our actions panel
-                $query = "?action=edit-comment&amp;pid=$row[id]";
-
-                if (!$approved) {
-                        $output .= "\n\t\t\t\t" . '<td>
-                                        <div><a href="'.$_SERVER["PHP_SELF"]."$query&amp;entries_per_page=$_SESSION[entries_per_page]&amp;moderate=1".'"><img src="'.$config['gallery_url'].'plog-admin/images/edit.gif" alt="' . plog_tr('Edit') . '" title="' . plog_tr('Edit') . '" /></a>
-                                        <a href="'.$_SERVER["PHP_SELF"]."?action=delete_checked&amp;selected[]=$row[id]&amp;moderate=1".'" onclick="return confirm(\'' . plog_tr('Are you sure you want to delete this comment?') . '\');"><img src="'.$config['gallery_url'].'plog-admin/images/x.gif" alt="' . plog_tr('Delete') . '" title="' . plog_tr('Delete') . '" /></a>
-                                        <a href="'.$_SERVER["PHP_SELF"]."?action=approve_checked&amp;selected[]=$row[id]&amp;moderate=1".'" onclick="return confirm(\'' . plog_tr('Are you sure you want to approve this comment?') . '\');"><img src="'.$config['gallery_url'].'plog-admin/images/new_file.gif" alt="' . plog_tr('Approve') . '" title="' . plog_tr('Approve') . '" /></a></div>
-                                </td>';
-                }
-                else
-                        $output .= "\n\t\t\t\t" . '<td>
-                                        <div><a href="'.$_SERVER["PHP_SELF"]."$query&amp;entries_per_page=$_SESSION[entries_per_page]&amp;moderate=$approved".'"><img src="'.$config['gallery_url'].'plog-admin/images/edit.gif" alt="' . plog_tr('Edit') . '" title="' . plog_tr('Edit') . '" /></a>
-                                        <a href="'.$_SERVER["PHP_SELF"]."?action=delete_checked&amp;selected[]=$row[id]".'" onclick="return confirm(\'' . plog_tr('Are you sure you want to delete this comment?') . '\');"><img src="'.$config['gallery_url'].'plog-admin/images/x.gif" alt="' . plog_tr('Delete') . '" title="' . plog_tr('Delete') . '" /></a></div>
-                                </td>';
-
-                $output .= "\n\t\t\t</tr>";
-                $counter++;
-        }
-
-        if ($counter > 0)
-                $output .= "\n\t\t\t" . '<tr class="footer">
-                                <td colspan="9"></td>
-                        </tr>
-                </table>';
-}
-
-if (!$empty) {
-        $output .= "\n\n\t\t" . '<div><a href="#" onclick="checkAll(document.getElementById(\'contentList\')); return false;">' . plog_tr('Invert Checkbox Selection') . '</a></div>
-                '.$pagination_menu;
-}
-
-$output .= "\n\n\t\t" . '<div><input class="submit" type="submit" name="delete_checked" onclick="return confirm(\''. plog_tr('Are you sure you want to delete the selected comments?') . '\');" value="' . plog_tr('Delete Checked') . '" />';
-if (!$approved) {
-        $output .= '<input class="submit" type="submit" name="approve_checked" onclick="return confirm(\'' . plog_tr('Are you sure you want to approve the selected comments?') . '\');" value="' . plog_tr('Approve Checked') . '" /></div>';
-}
-
-$output .= "\n\t\t" . '</form>'. "\n";
-
 display($output, "feedback");
 

trunk/plog-admin/plog-manage.php

@@ -9 +9 @@
 $inHead = '<script src="js/ajax_editing.js" type="text/javascript"></script>';
 
-function generate_pagination_view_menu() {
-
-        $java = 'document.location.href = \''.$_SERVER["PHP_SELF"].'?level='.$_REQUEST["level"].'&amp;id='.$_REQUEST["id"].'&amp;entries_per_page=\'+this.options[this.selectedIndex].value';
-
-        $possible_values = array("5"=>5, "10"=>10, "20"=>20, "50"=>50);
-        $output= "\n\t\t\t" . '<label accesskey="e" for="entries_on_page">' .plog_tr('<em>E</em>ntries per page') . '</label>
-                        <select class="entries-page" onchange="'.$java.'" name="entries_per_page" style="width: 60px;">';
-        foreach ($possible_values as $key => $value)
-        if ($_SESSION['entries_per_page'] == $key)
-        $output .= "\n\t\t\t\t<option value=\"$value\" selected=\"selected\">$key</option>";
-        else
-        $output .= "\n\t\t\t\t<option value=\"$value\">$key</option>";
-        $output.= "\n\t\t\t</select>";
-        return $output;
-}
-
 function generate_move_menu($level) {
-        if ($level == "albums") $parent = "collections";
-        if ($level == "pictures") $parent = "albums";
-        $output = "\n\t\t\t" . '<input class="submit" type="submit" name="move_checked" value="' . plog_tr("Move Checked To") . '" />';
+        if ($level == "albums") { $parent = "collections"; }
+        if ($level == "pictures") { $parent = "albums"; }
+        $output = "\n\t\t\t".'<input class="submit" type="submit" name="move_checked" value="' . plog_tr("Move Checked To") . '" />';
 
         if ($level == "pictures") {
@@ -34 +18 @@
                 $output .= generate_albums_menu($albums);
         } else {
-                $output .= "\n\t\t\t\t" . '<select class="move-del-manage" id="group_id" name="group_id">';
+                $output .= "\n\t\t\t\t".'<select class="move-del-manage" id="group_id" name="group_id">';
                 $collections = get_collections();
                 foreach($collections as $collection) {
-                        $output .= "\n\t\t\t\t\t" . '<option value="'.$collection["id"].'">'.SmartStripSlashes($collection["name"]);
+                        $output .= "\n\t\t\t\t\t".'<option value="'.$collection['id'].'">'.SmartStripSlashes($collection['name']);
                         $output .= '</option>';
                 }
-                $output .= "\n\t\t\t\t" . '</select>';
+                $output .= "\n\t\t\t\t".'</select>';
         }
 
@@ -47 +31 @@
 
 function generate_albums_menu($albums) {
-        $output = "\n\t\t\t" . '<select id="group_id" name="group_id">';
+        $output = "\n\t\t\t".'<select id="group_id" name="group_id">';
         foreach($albums as $album_id => $album) {
                 $selected = '';
                 // if we are on the current album then set it to be the default option
-                if (isset($_REQUEST["albums_menu"]) && isset($_REQUEST["new_album_name"])){
-                        if ($albums_menu == $album_id || $new_album_name == $album['album_name']){
+                if (isset($_REQUEST['albums_menu']) && isset($_REQUEST['new_album_name'])) {
+                        if ($albums_menu == $album_id || $new_album_name == $album['album_name']) {
                                 $selected = " selected=\"selected\"";
                         }
                 }
 
-                $output .= "\n\t\t\t\t<option value=\"".$album_id."\"".$selected.">".SmartStripSlashes($album['collection_name']).": ".SmartStripSlashes($album['album_name'])."" ;
+                $output .= "\n\t\t\t\t".'<option value="'.$album_id.'"'.$selected.'>'.SmartStripSlashes($album['collection_name']).': '.SmartStripSlashes($album['album_name']);
                 $output .= "</option>";
         }
@@ -65 +49 @@
 }
 
-function generate_breadcrumb_admin($level, $id = 0){
+function generate_breadcrumb_admin($level, $id = 0) {
         switch ($level){
                 case 'collections':
                         $breadcrumbs = '<strong>' . plog_tr('Collections') . '</strong>';
-
-                break;
+                        break;
                 case 'albums':
                         $collection = get_collection_by_id($id);
-                        $collection_name = SmartStripSlashes($collection["name"]);
-                        $breadcrumbs = '<a href="'.$_SERVER["PHP_SELF"].'">' . plog_tr('Collections') . '</a> &raquo; ' . "<strong>".$collection_name."</strong>";
-
-                break;
+                        $collection_name = SmartStripSlashes($collection['name']);
+                        $breadcrumbs = '<a href="'.$_SERVER['PHP_SELF'].'">' . plog_tr('Collections') . '</a> &raquo; ' . "<strong>".$collection_name."</strong>";
+                        break;
                 case 'pictures':
                         $album = get_album_by_id($id);
-                        $album_link = SmartStripSlashes($album["name"]);
-                        $collection_link = '<a href="'.$_SERVER["PHP_SELF"].'?level=albums&amp;id='.$album["parent_id"].'">'.SmartStripSlashes($album["collection_name"]).'</a>';
-                        $breadcrumbs = '<a href="'.$_SERVER["PHP_SELF"].'">' . plog_tr('Collections') . '</a> &raquo; ' . $collection_link . ' &raquo; ' . '<strong>'.$album_link.'</strong>';
-                break;
-
+                        $album_link = SmartStripSlashes($album['name']);
+                        $collection_link = '<a href="'.$_SERVER['PHP_SELF'].'?level=albums&amp;id='.$album['parent_id'].'">'.SmartStripSlashes($album['collection_name']).'</a>';
+                        $breadcrumbs = '<a href="'.$_SERVER['PHP_SELF'].'">' . plog_tr('Collections') . '</a> &raquo; ' . $collection_link . ' &raquo; ' . '<strong>'.$album_link.'</strong>';
+                        break;
                 case 'comments':
-
                         $query = "SELECT * FROM `".TABLE_PREFIX."pictures` WHERE `id`='".$id."'";
                         $result = run_query($query);
                         $row = mysql_fetch_assoc($result);
 
-                        $picture_link = '<strong>'.SmartStripSlashes(basename($row["path"])).'</strong>';
-                        $album_id = $row["parent_album"];
-                        $collection_id = $row["parent_collection"];
+                        $picture_link = '<strong>'.SmartStripSlashes(basename($row['path'])).'</strong>';
+                        $album_id = $row['parent_album'];
+                        $collection_id = $row['parent_collection'];
 
                         $query = "SELECT * FROM `".TABLE_PREFIX."albums` WHERE `id`='".$album_id."'";
@@ -98 +78 @@
                         $row = mysql_fetch_assoc($result);
 
-                        $album_link = '<a href="'.$_SERVER["PHP_SELF"].'?level=pictures&amp;id='.$album_id.'">'.SmartStripSlashes($row["name"]).'</a>';
+                        $album_link = '<a href="'.$_SERVER['PHP_SELF'].'?level=pictures&amp;id='.$album_id.'">'.SmartStripSlashes($row['name']).'</a>';
 
                         $query = "SELECT * FROM `".TABLE_PREFIX."collections` WHERE `id`='".$collection_id."'";
@@ -104 +84 @@
                         $row = mysql_fetch_assoc($result);
 
-                        $collection_link = '<a href="'.$_SERVER["PHP_SELF"].'?level=albums&amp;id='.$collection_id.'">'.SmartStripSlashes($row["name"]).'</a>';
-
-                        $breadcrumbs = '<a href="'.$_SERVER["PHP_SELF"].'">' . plog_tr('Collections') .' </a> &raquo; ' . $collection_link . ' &raquo; '
+                        $collection_link = '<a href="'.$_SERVER['PHP_SELF'].'?level=albums&amp;id='.$collection_id.'">'.SmartStripSlashes($row['name']).'</a>';
+
+                        $breadcrumbs = '<a href="'.$_SERVER['PHP_SELF'].'">' . plog_tr('Collections') .' </a> &raquo; ' . $collection_link . ' &raquo; '
                         .$album_link. ' &raquo; '.$picture_link . ' &raquo;' . " " . plog_tr('Comments');
-
-                break;
+                        break;
                 default:
-                $breadcrumbs = '<strong>' . plog_tr('Collections') . '</strong>';
+                        $breadcrumbs = '<strong>' . plog_tr('Collections') . '</strong>';
         }
 
@@ -117 +96 @@
 }
 
-$id = isset($_GET['id']) ? intval($_REQUEST['id']) : 0;
-
-if (!isset($_REQUEST["level"]) or $_REQUEST["level"] == '') $level = "collections";
-else $level = $_REQUEST['level'];
+$id = isset($_REQUEST['id']) ? intval($_REQUEST['id']) : 0;
+$level = (isset($_REQUEST['level']) && $_REQUEST['level'] != '') ? $_REQUEST['level'] : "collections";
 
 $output = "\n\t" . '<h1>' . plog_tr('Manage Content') . '</h1>' . "\n";
@@ -129 +106 @@
 global $config;
 
-if (empty($_REQUEST['level'])) {
-        $_REQUEST['level'] = '';
-}
-
-// here we will determine if we need to perform a move or delete action.
-if (isset($_REQUEST["action"])) {
-        $num_items = 0;
-
-        $action_result = array();
-
-        if (isset($_REQUEST['delete_checked']) ) {
-                // perform the delete function on the selected items
-
-                if (isset($_REQUEST["selected"])) {
-                        foreach($_REQUEST["selected"] as $del_id) {
-                                // lets build the query string
-                                if ($level == "pictures") {
-                                        $rv = delete_picture($del_id);
+// here we will determine if we need to perform any form actions.
+if (isset($_REQUEST['action'])) {
+        switch ($_REQUEST['action']) {
+                case 'move-delete':
+                        // we're either moving or deleting
+                        $num_items = 0;
+                        $action_result = array();
+
+                        if (isset($_REQUEST['delete_checked']) ) {
+                                // perform the delete function on the selected items
+                                if (isset($_REQUEST['selected'])) {
+                                        foreach($_REQUEST['selected'] as $del_id) {
+                                                if ($level == "pictures") {
+                                                        $rv = delete_picture($del_id);
+                                                }
+                                                if ($level == "collections") {
+                                                        $rv = delete_collection($del_id);
+                                                }
+                                                if ($level == "albums") {
+                                                        $rv = delete_album($del_id);
+                                                }
+
+                                                if (isset($rv['errors'])) {
+                                                        $output .= "\n\t" . '<p class="errors">' . $rv['errors'] . '</p>' ."\n";
+                                                } else {
+                                                        $num_items++;
+                                                }
+                                        }
+
+                                        if ($num_items > 0) {
+                                                $output .= "\n\t<p class=\"actions\">";
+                                                if ($num_items > 1) {
+                                                        $output .= sprintf(plog_tr('You have deleted %d entries successfully'),$num_items);
+                                                } else {
+                                                        $output .= sprintf(plog_tr('You have deleted %d entry successfully'),$num_items);
+                                                }
+                                                $output .= "</p>\n";
+
+                                        }
+                                } else {
+                                        $output .= "\n\t<p class=\"errors\">" . plog_tr('Nothing selected to delete!') . "</p>\n";
                                 }
-                                if ($level == "collections") {
-                                        $rv = delete_collection($del_id);
+                        }       else if (isset($_REQUEST['move_checked'])) {
+                                if ($level == "albums") { $parent = "parent_id"; }
+                                if ($level == "pictures") { $parent = "parent_album"; }
+
+                                // perform the move function on the selected items
+                                $pid = $_REQUEST['group_id'];
+
+                                if (isset($_REQUEST['selected'])) {
+                                        foreach ($_REQUEST['selected'] as $mov_id) {
+
+                                                // if we are using pictures we need to update the parent_collection as well
+                                                if ($level == "pictures") {
+                                                        $result = move_picture($mov_id, $pid);
+                                                        if (empty($result['errors'])) {
+                                                                $num_items++;
+                                                        } else {
+                                                                $output .= "\n\t" . '<p class="errors">' . $result['errors'] . '</p>' . "\n";
+                                                        }
+                                                } else if ($level == "albums") {
+                                                        // if we are moving entire albums then we need to rename the folder
+                                                        // $pid is our target collection id, $mov_id is our source album
+
+                                                        $result = move_album($mov_id,$pid);
+                                                        if (empty($result['errors'])) {
+                                                                $num_items++;
+                                                        } else {
+                                                                $output .= "\n\t" . '<p class="errors">' . $result['errors'] . '</p>' . "\n";
+                                                        }
+                                                }
+
+                                        }
+
+                                        $output .= "\n\t<p class=\"actions\">" . sprintf(plog_tr('You have moved %d entry(s) successfully.'),$num_items) . "</p>\n";
+                                } else {
+                                        $output .= "\n\t<p class=\"errors\">" . plog_tr('Nothing selected to move!') . "</p>\n";
                                 }
-                                if ($level == "albums") {
-                                        $rv = delete_album($del_id);
-                                }
-
-                                if (isset($rv['errors'])) {
-                                        $output .= "\n\t" . '<p class="errors">' . $rv['errors'] . '</p>' ."\n";
-                                } else {
-                                        $num_items++;
-                                };
-                        }
-
-                        if ($num_items > 0){
-                                $output .= "\n\t<p class=\"actions\">";
-                                if ($num_items > 1) {
-                                        $output .= sprintf(plog_tr('You have deleted %d entries successfully'),$num_items);
-                                } else {
-                                        $output .= sprintf(plog_tr('You have deleted %d entry successfully'),$num_items);
-                                };
-                                $output .= "</p>\n";
-
-                        }
-                }
-                else{
-                        $output .= "\n\t<p class=\"errors\">" . plog_tr('Nothing selected to delete!') . "</p>\n";
-                }
-        }
-        else if (isset($_REQUEST['move_checked'])) {
-                if ($level == "albums") $parent = "parent_id";
-                if ($level == "pictures") $parent = "parent_album";
-
-                // perform the move function on the selected items
-                $pid = $_REQUEST["group_id"];
-
-                if (isset($_REQUEST["selected"])) {
-                        foreach ($_REQUEST["selected"] as $mov_id) {
-
-                                // if we are using pictures we need to update the parent_collection as well
-                                if ($level == "pictures") {
-                                        // lets build the query string
-                                        $result = move_picture($mov_id,$pid);
-                                        if (empty($result['errors'])) {
-                                                $num_items++;
-                                        } else {
-                                                $output .= "\n\t" . '<p class="errors">' . $result['errors'] . '</p>' . "\n";
-                                        }
-                                } else if ($level == "albums") {
-                                        // if we are moving entire albums then we need to rename the folder
-                                        // $pid is our target collection id, $mov_id is our source album
-
-                                        $result = move_album($mov_id,$pid);
-                                        if (empty($result['errors'])) {
-                                                $num_items++;
-                                        } else {
-                                                $output .= "\n\t" . '<p class="errors">' . $result['errors'] . '</p>' . "\n";
-                                        }
-                                }
-
-                        }
-
-                        $output .= "\n\t<p class=\"actions\">" . sprintf(plog_tr('You have moved %d entry(s) successfully.'),$num_items) . "</p>\n";
-                }
-                else{
-                        $output .= "\n\t<p class=\"errors\">" . plog_tr('Nothing selected to move!') . "</p>\n";
-                }
-        }
-        else if (!empty($_GET["action"])){
-                if($_GET["action"] == "edit-picture") {
+                        }
+                        break;
+                case "edit-picture":
                         $level = 'picture';
-                        // show the edit form
-                        $photo = get_picture_by_id($_REQUEST["id"]);
+                        // show the edit picture form
+                        $photo = get_picture_by_id($id);
                         if ($photo['allow_comments'] == 1) $state = "checked=\"checked\""; else $state = "";
 
-                        $output .= "\n\t\t" . '<form class="edit" action="'.$_SERVER["PHP_SELF"].'?level=pictures&amp;id='.$photo["parent_album"];
-                        if (isset($_GET["entries_per_page"])) $output .= '&amp;entries_per_page=' . intval($_GET["entries_per_page"]);
-                        if (isset($_GET["plog_page"])) $output .= '&amp;plog_page=' . intval($_GET["plog_page"]);
-                        $output .= '" method="post">';
+                        $output .= "\n\t\t" . '<form class="edit" action="'.$_SERVER['PHP_SELF'].'?level=pictures&id='.$photo['parent_album'].'" method="post">';
+
                         $thumbpath = generate_thumb(SmartStripSlashes($photo['path']), $photo['id'],THUMB_SMALL);
-                        $output .= "\n\t\t\t<div style=\"float: right;\"><img src=\"$thumbpath\" alt=\"\" /></div>";
+                        $output .= "\n\t\t\t" . '<div style="float: right;"><img src="'.$thumbpath.'" alt="" /></div>';
+
                         $output .= "\n\t\t\t" . '<div>
                                 <label accesskey="c" for="caption">' . plog_tr('<em>C</em>aption') . ':</label><br />
-                                <input size="80" name="caption" id="caption" value="'.SmartStripSlashes($photo['caption']).'" /><br />
+                                <input size="80" name="caption" id="caption" value="'.htmlspecialchars(SmartStripSlashes($photo['caption'])).'" /><br />
                                 <label>' . plog_tr('Description') . ':</label><br />
-                                <textarea name="description" id="description" cols="60" rows="5">'.SmartStripSlashes($photo['description']).'</textarea><br />
+                                <textarea name="description" id="description" cols="60" rows="5">'.htmlspecialchars(SmartStripSlashes($photo['description'])).'</textarea><br />
                                 <label for="allow_comments" accesskey="w">' . plog_tr('Allo<em>w</em> Comments') . '?</label> <input type="checkbox" id="allow_comments" name="allow_comments" value="1"'." $state /><br /><br />";
                         $output .= "\n\t\t\t\t" . '<input type="hidden" name="pid" value="'.$photo['id'].'" />
                                 <input type="hidden" name="action" value="update-picture" />
-                                <button class="submit" type="submit">' . plog_tr('Update') . '</button>
+                                <input class="submit" name="update" value="' . plog_tr('Update') . '" type="submit" />
+                                <input class="submit" name="cancel" value="' . plog_tr('Cancel') . '" type="submit" />
                         </div>';
                         $output .= "\n\t\t" . '</form>' . "\n";
-
-                }
-                else if ($_GET["action"] == "edit-album") {
-                        // show the edit form
-                        $output .= plog_edit_album_form($_REQUEST["id"]);
-                }
-                else if ($_GET["action"] == "edit-collection") {
-                        $output .= plog_edit_collection_form($_GET["id"]);
-                }
-                else if ($_GET["action"] == "edit-comment") {
-                        // show the edit form
-                        $output .= edit_comment_form($_GET["pid"]);
-                }
-        }
-        else if (!empty($_POST["action"])){
-                if ($_POST['action'] == 'update-picture') {
-                        $action_result = update_picture($_POST['pid'],$_POST['caption'],$_POST['allow_comments'],$_POST['description']);
-                }
-                else if ($_POST['action'] == 'update-album') {
-                        $action_result = update_album($_POST['pid'],$_POST['name'],$_POST['description'],$_POST['thumbnail_id']);
-                }
-                else if ($_POST["action"] == "update-collection") {
-                        $action_result = update_collection($_POST["pid"],$_POST["name"],$_POST["description"],$_POST["thumbnail_id"]);
-                }
-                else if ($_POST["action"] == "update-comment") {
-                        $action_result = update_comment($_POST["pid"],$_POST["author"],$_POST["email"],$_POST["url"],$_POST["comment"]);
-                }
-                else if ($_POST["action"] == "add-collection") {
-                        $action_result = add_collection($_POST["name"],$_POST["description"]);
-                }
-                else if ($_POST["action"] == "add-album") {
-                        $action_result = add_album($_POST["name"],$_POST["description"],$_POST["parent_collection"]);
-                }
+                        $edit_page = 1;
+                        break;
+                case "edit-album":
+                        // show the edit album form
+                        $output .= plog_edit_album_form($id);
+                        $edit_page = 1;
+                        break;
+                case "edit-collection":
+                        // show the edit collection form
+                        $output .= plog_edit_collection_form($id);
+                        $edit_page = 1;
+                        break;
+                case "edit-comment":
+                        // show the edit comment form
+                        $output .= edit_comment_form($id);
+                        $edit_page = 1;
+                        break;
+                case "update-picture":
+                        // update the picture information
+                        if (!isset($_REQUEST['cancel'])) {
+                                $action_result = update_picture($_REQUEST['pid'], $_REQUEST['caption'], $_REQUEST['allow_comments'], $_REQUEST['description']);
+                        }
+                        break;
+                case "update-album":
+                        // update the album information
+                        if (!isset($_REQUEST['cancel'])) {
+                                $action_result = update_album($_POST['pid'], $_POST['name'], $_POST['description'], $_POST['thumbnail_id']);
+                        }
+                        break;
+                case "update-collection":
+                        // update the collection infomration
+                        if (!isset($_REQUEST['cancel'])) {
+                                $action_result = update_collection($_POST['pid'], $_POST['name'], $_POST['description'], $_POST['thumbnail_id']);
+                        }
+                        break;
+                case "update-comment":
+                        // update the comment information
+                        if (!isset($_REQUEST['cancel'])) {
+                                $action_result = update_comment($_POST['pid'], $_POST['author'], $_POST['email'], $_POST['url'], $_POST['comment']);
+                        }
+                        break;
+                case "add-collection":
+                        // add a new collection
+                        $action_result = add_collection($_POST['name'], $_POST['description']);
+                        break;
+                case "add-album":
+                        // add a new album
+                        $action_result = add_album($_POST['name'], $_POST['description'], $_POST['parent_collection']);
+                        break;
         }
 
         if (!empty($action_result['errors'])) {
+                // if there are any errors from the actions above, display the errors for the user
                 $output .= "\n\t" . '<p class="errors">' . $action_result['errors'] . '</p>' . "\n";
         } elseif (!empty($action_result['output'])) {
+                // else if no errors, display the successful output
                 $output .= "\n\t" . '<p class="actions">' . $action_result['output'] . '</p>' . "\n";
-        };
-
-        if (($_REQUEST["action"] == '1') && isset($_GET["action"])){
-                unset($_GET["action"]);
-        }
-}
-
-if (!isset($_GET["action"])){
-        // here we will generate a "add collection/album" header
+        }
+
+}
+
+if (!isset($edit_page)) {
+        // here we will generate a "add collection/album" header form
         if ($level == "collections") {
                 $output .= plog_add_collection_form();
@@ -302 +286 @@
         if (isset($_REQUEST['entries_per_page'])) {
                 $_SESSION['entries_per_page'] = $_REQUEST['entries_per_page'];
-        } else {
+        } else if (!isset($_SESSION['entries_per_page'])){
                 $_SESSION['entries_per_page'] = 20;
         }
@@ -309 +293 @@
 
         // determine the filtering conditional based on the level and id number
-        if ($level == "albums" or $level == "comments"){
-                $cond = "WHERE `parent_id` = '$id'";
-        }
-        else if ($level == "pictures"){
-                $cond = "WHERE `parent_album` = '$id'";
+        if ($level == "albums" || $level == "comments"){
+                $cond = "WHERE `parent_id` = '".intval($id)."'";
+        } else if ($level == "pictures"){
+                $cond = "WHERE `parent_album` = '".intval($id)."'";
         }
 
@@ -329 +312 @@
 
         $pagination_menu = "\n\t\t" . '<div class="entries-page">'.generate_pagination_view_menu().'</div>
-                        <div class="pagination">'.generate_pagination("admin", "manage", $plog_page, $totalRows, $_SESSION['entries_per_page'], array("level" => $level, "id" => $id, "entries_per_page" => $_SESSION['entries_per_page'])).'
+                        <div class="pagination">'.generate_pagination("admin", "manage", $plog_page, $totalRows, $_SESSION['entries_per_page'], array("level" => $level, "id" => $id)).'
                 </div>';
 
-        $output .= "\n\t\t" . '<form id="contentList" action="'.$_SERVER["PHP_SELF"].'" method="get">';
-
-        $level = $_REQUEST['level'];
-
-        if (empty($level) || $level == "collections") {
-                $output .= $pagination_menu.generate_breadcrumb_admin("");
-                $output .= plog_collection_manager($first_item,$_SESSION['entries_per_page']);
-        }
-
-        if ($level == "albums") {
-                $output .= $pagination_menu.generate_breadcrumb_admin("albums", $id);
-                $output .= plog_album_manager($id,$first_item,$_SESSION['entries_per_page']);
-        };
-
-        if ($level == "pictures") {
-                $output .= $pagination_menu.generate_breadcrumb_admin("pictures", $id);
-                $output .= plog_picture_manager($id,$first_item,$_SESSION['entries_per_page']);
-
-        };
-
-        if ($level == "comments") {
-                $output .= $pagination_menu.generate_breadcrumb_admin("comments", $id);
-                $output .= plog_comment_manager($id,$first_item,$_SESSION['entries_per_page']);
-        };
+        $output .= "\n\t\t" . '<form id="contentList" action="'.$_SERVER['PHP_SELF'].'" method="post">';
+
+        switch ($level) {
+                case "comments":
+                        $output .= $pagination_menu.generate_breadcrumb_admin("comments", $id);
+                        $output .= plog_comment_manager($id,$first_item,$_SESSION['entries_per_page']);
+                        break;
+                case "pictures":
+                        $output .= $pagination_menu.generate_breadcrumb_admin("pictures", $id);
+                        $output .= plog_picture_manager($id,$first_item,$_SESSION['entries_per_page']);
+                        break;
+                case "albums":
+                        $output .= $pagination_menu.generate_breadcrumb_admin("albums", $id);
+                        $output .= plog_album_manager($id,$first_item,$_SESSION['entries_per_page']);
+                        break;
+                case "collections":
+                default:
+                        $output .= $pagination_menu.generate_breadcrumb_admin("");
+                        $output .= plog_collection_manager($first_item,$_SESSION['entries_per_page']);
+                        break;
+        }
 
         $output .= "\n\t\t" . '<div><a href="#" onclick="checkAll(document.getElementById(\'contentList\')); return false; ">' . plog_tr('Invert Checkbox Selection') . '</a></div>
@@ -362 +342 @@
                         <input type="hidden" name="level" value="'.$level.'" />
                         <input type="hidden" name="id" value="'.$id.'" />
-                        <input type="hidden" name="action" value="1" />
+                        <input type="hidden" name="action" value="move-delete" />
                         <input class="submit" type="submit" name="delete_checked" onclick="return confirm(\'' . plog_tr('Are you sure you want to delete selected items?') . '\');" value="' . plog_tr('Delete Checked') . '" />';
         if (!empty($level) && $level != "collections" && $level != "comments"){
                 $output .= generate_move_menu($level);
-        };
+        }
         $output .= "\n\t\t</div>\n\t\t</form>\n";
 }

trunk/plog-admin/plog-upload.php

@@ -16 +16 @@
         foreach($albums as $album_id => $album) {
 
-                if ($albums_menu == $album_id || $new_album_name == $album['album_name'])
-                $selected = " selected='selected'"; else $selected = "";
+                if ($albums_menu == $album_id || $new_album_name == $album['album_name']) {
+                        $selected = " selected='selected'";
+                } else {
+                        $selected = "";
+                }
 
                 $output .= "\n\t\t\t\t\t\t\t<option value=\"".$album_id."\"$selected>".SmartStripSlashes($album['collection_name']).": ".SmartStripSlashes($album['album_name'])."</option>";

trunk/plog-download.php

@@ -2 +2 @@
 
 include(dirname(__FILE__)."/plog-load-config.php");
+if (!$config["allow_dl"]) {
+        // ignorance is bliss
+        exit();
+}
 
 /*
@@ -194 +198 @@
 if (!isset($_REQUEST["checked"]) || (!is_array($_REQUEST["checked"]))){
         echo 'No pictures were selected.';
-}
-else{
+} else {
         create_zip($_REQUEST["checked"], $_REQUEST["dl_type"]);
 }
@@ -231 +234 @@
         if ($type == "collections"){
                 foreach ($checked as $cid){
-                        $query = "SELECT * FROM `".TABLE_PREFIX."collections` WHERE `id`='".$cid."'";
+                        $query = "SELECT * FROM `".TABLE_PREFIX."collections` WHERE `id`='".intval($cid)."'";
                         $result = run_query($query);
 
@@ -257 +260 @@
                         }
                 }
-        }
-        elseif($type == "collection"){
+        } else if ($type == "collection") {
                 foreach ($checked as $aid){
-                        $query = "SELECT * FROM `".TABLE_PREFIX."albums` WHERE `id`='".$aid."'";
+                        $query = "SELECT * FROM `".TABLE_PREFIX."albums` WHERE `id`='".intval($aid)."'";
                         $result = run_query($query);
 
@@ -286 +288 @@
                         }
                 }
-        }
-        elseif($type == "album" || $type == "search"){
+        } elseif ($type == "album" || $type == "search") {
                 foreach ($checked as $pid){
-                        $query = "SELECT * FROM `".TABLE_PREFIX."pictures` WHERE `id`='".$pid."'";
+                        $query = "SELECT * FROM `".TABLE_PREFIX."pictures` WHERE `id`='".intval($pid)."'";
                         $result = run_query($query);
 

trunk/plog-includes/plog-functions.php

@@ -534 +534 @@
 
 function get_active_collections_albums() {
+        $image_collection_count = array();
+        $image_album_count = array();
         $return = array(
                 "collections" => '',
@@ -542 +544 @@
         $result = run_query($sql);
         while($row = mysql_fetch_assoc($result)) {
-                $image_collection_count[$row["parent_collection"]] = $row["imagecount"];
-                $image_album_count[$row["parent_album"]] = $row["imagecount"];
+                $image_collection_count[$row['parent_collection']] = $row['imagecount'];
+                $image_album_count[$row['parent_album']] = $row['imagecount'];
         }
         $return['collections'] = array_keys($image_collection_count);
@@ -800 +802 @@
 }
 
-function get_album_by_name($name) {
+function get_album_by_name($name, $collection_id) {
         $sql = "SELECT *
         FROM `".TABLE_PREFIX."albums`
-        WHERE `name` = '".mysql_real_escape_string($name)."'";
+        WHERE `name` = '".mysql_real_escape_string($name)."'
+        AND `parent_id` = ".intval($collection_id);
         $result = run_query($sql);
 
@@ -1189 +1192 @@
 // sanitize filename by replacing international characters with underscores
 function sanitize_filename($str) {
-        // allow only alphanumeric characters, hyphen, [, ], dot and apostrophe in file names
-        // the rest will be replaced
-        return preg_replace("/[^\w|\.|'|\-|\[|\]]/","_",$str);
+        // allow only alphanumeric characters, hyphen, [, ],  and dot in file names
+        // quotes will be suppressed & the rest will be replaced with underscores
+        return preg_replace(array("/['|\"]/", "/[^\w|\.|\-|\[|\]]/"), array("", "_"), $str);
 }
 
@@ -2020 +2023 @@
         global $config;
 
-        if ($GLOBALS['plogger_mode'] != 'slideshow' && $GLOBALS['plogger_level'] != '404') {
+        if ($GLOBALS['plogger_mode'] != 'slideshow' && $GLOBALS['plogger_level'] != '404' && $GLOBALS['plogger_level'] != "picture") {
                 $page = isset($_GET['plog_page']) ? intval($_GET['plog_page']) : 1;
                 $level = $GLOBALS['plogger_level'];
@@ -2079 +2082 @@
         case "search":
                 $keyword = isset($_GET['searchterms']) ? str_replace(" ", ",", $_GET['searchterms']) : '';
-                $description = "Search results from my Plogger gallery";
+                $description = "Search results from ".$config['gallery_name'];
                 break;
 
         default:
                 $keyword = SmartStripSlashes($config['gallery_name']); // used on gallery entry page
-                $description = "This is my Plogger gallery"; // used on gallery entry page
+                $description = "This is ".$config['gallery_name']; // used on gallery entry page
                 break;
         }
 
-        return "\t<meta name=\"keywords\" content=\"$keyword\" />
-        <meta name=\"description\" content=\"$description\" />\n";
+        return "\t<meta name=\"keywords\" content=\"".htmlspecialchars($keyword)."\" />
+        <meta name=\"description\" content=\"".htmlspecialchars($description)."\" />\n";
 }
 
@@ -2159 +2162 @@
 }
 
-function plogger_get_comment_text() {
+function plogger_get_comment_text($specialchars = false) {
         $comment = $GLOBALS["current_comment"];
         return htmlspecialchars(SmartStripSlashes($comment["comment"]));
@@ -2197 +2200 @@
 }
 
-function plogger_get_picture_caption() {
-        if (!empty($GLOBALS["current_picture"]["caption"]))
-        return SmartStripSlashes($GLOBALS["current_picture"]["caption"]);
-        else
-        return "&nbsp;";
+function plogger_get_picture_caption($specialchars = false) {
+        if (!empty($GLOBALS["current_picture"]["caption"])) {
+                if ($specialchars) {
+                        return htmlspecialchars(SmartStripSlashes($GLOBALS['current_picture']['caption']));
+                }
+                return SmartStripSlashes($GLOBALS['current_picture']['caption']);
+        } else {
+                return "&nbsp;";
+        }
 }
 
@@ -2233 +2240 @@
 }
 
-function plogger_get_picture_description() {
+function plogger_get_picture_description($specialchars = false) {
         if (isset($GLOBALS['current_picture']['description'])){
+                if ($specialchars) {
+                        return htmlspecialchars(SmartStripSlashes($GLOBALS['current_picture']['description']));
+                }
                 return SmartStripSlashes($GLOBALS['current_picture']['description']);
         } else {
@@ -2451 +2461 @@
 }
 
-function plogger_get_collection_description() {
-        return htmlspecialchars(SmartStripSlashes($GLOBALS["current_collection"]["description"]));
-}
-
-function plogger_get_collection_name() {
-        return htmlspecialchars(SmartStripSlashes($GLOBALS["current_collection"]["name"]));
+function plogger_get_collection_description($specialchars = false) {
+        if ($specialchars){
+                return htmlspecialchars(SmartStripSlashes($GLOBALS['current_collection']['description']));
+        }
+        return SmartStripSlashes($GLOBALS['current_collection']['description']);
+}
+
+function plogger_get_collection_name($specialchars = false) {
+        if ($specialchars) {
+                return htmlspecialchars(SmartStripSlashes($GLOBALS['current_collection']['name']));
+        }
+        return SmartStripSlashes($GLOBALS['current_collection']['name']);
 }
 
@@ -2524 +2540 @@
 }
 
-function plogger_get_album_description() {
-        return htmlspecialchars(SmartStripSlashes($GLOBALS["current_album"]["description"]));
-}
-
-function plogger_get_album_name() {
-        return htmlspecialchars(SmartStripSlashes($GLOBALS["current_album"]["name"]));
+function plogger_get_album_description($specialchars = false) {
+        if ($specialchars) {
+                return htmlspecialchars(SmartStripSlashes($GLOBALS['current_album']['description']));
+        }
+        return SmartStripSlashes($GLOBALS['current_album']['description']);
+}
+
+function plogger_get_album_name($specialchars = false) {
+        if ($specialchars) {
+                return htmlspecialchars(SmartStripSlashes($GLOBALS['current_album']['name']));
+        }
+        return SmartStripSlashes($GLOBALS['current_album']['name']);
 }
 

trunk/plog-remote.php

@@ -48 +48 @@
 
 function get_album_by_name($name) {
-        $sqlAlbum = "SELECT * FROM `".TABLE_PREFIX."albums` WHERE name = '$name'";
+        $sqlAlbum = "SELECT * FROM `".TABLE_PREFIX."albums` WHERE name = '".mysql_real_escape_string($name)."'";
         $resultAlbum = run_query($sqlAlbum);
         return mysql_fetch_assoc($resultAlbum);
@@ -175 +175 @@
 
         if ($albuminfo) {
-                $sqlPictures = "SELECT * FROM `".TABLE_PREFIX."pictures` WHERE parent_album = " . $albuminfo["id"];
+                $sqlPictures = "SELECT * FROM `".TABLE_PREFIX."pictures` WHERE parent_album = " . intval($albuminfo['id']);
                 $resultAlbum = run_query($sqlPictures);
                 while ($rowAlbum = mysql_fetch_assoc($resultAlbum)){
@@ -194 +194 @@
 function gr_add_album($parent,$name,$description) {
         // parent is the name of the collection
-        $query = "SELECT * FROM `".TABLE_PREFIX."collections` WHERE name = '" . $parent . "'";
+        $query = "SELECT * FROM `".TABLE_PREFIX."collections` WHERE name = '" . mysql_real_escape_string($parent) . "'";
         $result = run_query($query);