Commit Graph

259 Commits

Author SHA1 Message Date
Bharat Mediratta
8a36c24f39 Fix some broken identity APIs:
- add_user_to_group and remove_user_from_group should take Group_Definition instances
  to be consistent
- add_user_to_group and remove_user_from_group in drivers/IdentityProvider.php should
  not be static
2010-09-06 18:20:46 -07:00
Bharat Mediratta
883d8f1e23 Whitespace. 2010-09-06 15:06:37 -07:00
Tim Almdal
04f6646b06 Hopefully the third and final patch for #1216. Set the default from and reply-to addresses to an empty string. The first time the user model is saved, set the sendmail from and reply-to addresses. Requires an update to gallery version 38. 2010-09-01 23:19:43 -07:00
Tim Almdal
e09c6dbd5e Patch for ticket #1216. Move the values that were in the sendmail config file and store them as gallery module variables. Requires a version number bump to 37. 2010-08-31 20:45:09 -07:00
Bharat Mediratta
ab598b2931 Put the theme CSS at the end of the module CSS so that the theme has
the final say.  Fixes ticket #1315.
2010-08-29 21:15:58 -07:00
Bharat Mediratta
2c717b18d3 Don't concatenate two strings together as an argument for t() or t2();
the l10n_scanner cannot parse it properly and drops those from the
localization list.  Fixes ticket #1284.
2010-08-29 20:04:02 -07:00
Bharat Mediratta
c6a28a93dd Put up a warning and don't accept movie files if we don't have ffmpeg.
This fixes ticket #973.
2010-08-21 15:11:06 -07:00
Bharat Mediratta
3c7dc6d7a6 Handle 404 exceptions specially to reduce spam in the log files. Fixes ticket #1228. 2010-08-08 12:46:26 -07:00
Bharat Mediratta
1abf43d3f1 Add a max_level to _sanitize_for_dump() so that we don't blow the stack. 2010-08-07 22:06:57 -07:00
Bharat Mediratta
400c248e2d default maintenance_mode from false -> 0 for consistency with the value we set in the db 2010-08-01 21:10:27 -07:00
Bharat Mediratta
c33b24c9fa Make maintenance mode a variable instead of a config. Then create
links on the Admin > Maintenance page to allow you to turn it on and
off.  This should be efficient since we cache all vars and look them
up on every request anyway.

This also allows us to have the Fix task enable maintenance mode while
it's running which greatly reduces the chances that somebody will come
along and hork the database while we're tinkering with MPTT pointers.

Fixes ticket #1259.
2010-08-01 21:00:30 -07:00
Bharat Mediratta
ebbb73787d Trap ORM_Validation_Exception specially and report which fields failed validation. 2010-07-29 19:37:38 -07:00
Bharat Mediratta
adeea49e0a Catch any exceptions thrown when we try to restore the original
identity provider after we fail to set up a new one.
2010-07-21 11:43:51 -07:00
Bharat Mediratta
b7cd2f73c5 PHPDoc fix. 2010-07-10 15:18:54 -07:00
Bharat Mediratta
0a42d74d55 Reset the time limit to 30 seconds every time we delete a child. Fixes ticket #1199. 2010-07-10 15:10:20 -07:00
Bharat Mediratta
41ca2b0195 Rework our exception framework to fit into Kohana's model better.
Instead of overwriting Kohana_Exception::handle() (which we were doing
in MY_Kohana_Exception) we instead use their existing template system.

gallery/views/kohana/error.php overrides system/views/kohana/error.php
and is the standard error template for all exceptions.  Our version of
error.php figures out the appropriate view based on context (cli,
authenticated admin, guest viewing a 404, guest viewing a system
error) and delegates appropriately.  Each delegated view has a narrow
responsibility.

This paves the way for us to add new error views per module.  For
example, the rest module will define its own template in
Rest_Exception and then its exceptions can be rendered the way that it
wants (json encoded, in that case).
2010-06-19 14:07:32 -07:00
Bharat Mediratta
5736698b4b single -> double quotes. 2010-06-19 10:51:05 -07:00
Bharat Mediratta
dceecabbf1 Make login/logout continuation url code consistent. Where necessary,
we specify the continue_url in the session, but we store it in the
login form so that we can propagate it across the session creation
that happens at login time.
2010-06-12 15:16:47 -07:00
Bharat Mediratta
1240878df0 Fix-ups for d98b85f7d3
- Pass the CSS selector of the active image in as an arg to site_menu
  so that quick operations know what they're operating on.
- Change the ids from g-{photo,movie}-id to the generic g-item-id
- Initialize ajax handlers for site menu on the photo and movie page
- Drop the movie context menu, it's now in the site menu
2010-05-14 16:55:15 -07:00
Bharat Mediratta
c9edb943f9 Fix a bug introduced when we patched the "disallowed global data"
security check.  Not sure why the patch worked for some and not for
others, but this should resolve it either way.  Fixes ticket #1123.
2010-04-10 17:01:48 -07:00
Bharat Mediratta
c3c2b45280 Update the copyright to 2010. It's only 3 months into the year :-) 2010-03-03 10:15:34 -08:00
Andy Staudacher
a19b97f8d6 First step towards fixing ticket #1038: Allowing for custom page <title> in admin pages, just like in non-admin pages.
TODO: Set $view->page_title in the many admin controllers we have. I just set it for admin_maintenance.php to show how it's intended to be used. I copied the title from views/admin_maintenance.html.php to the controller.
2010-02-28 13:35:58 -08:00
Andy Staudacher
d9707ae749 Fix for ticket #1036 - Don't echo any sensitive information such as passwords, hashes or personally identifiable information. 2010-02-27 02:37:39 -08:00
Andy Staudacher
1d8862d957 Fix for ticket #1034: Fix db cache driver delete() call which was missed in a recent refactoring / fix. 2010-02-24 01:28:38 -08:00
Andy Staudacher
6afc5ccf5c Fix translation cache for installations with 0 translations in the DB. 2010-02-23 10:02:27 -08:00
Andy Staudacher
95374070db Merge commit 'upstream/master' 2010-02-22 00:00:25 -08:00
Andy Staudacher
334cd2368d Performance improvement: Load all translations of a locale as one serialized array from the Cache.
Until now, we loaded hundreds of translation messages row by row, and unserializing one by one at bootstrap time. That amounted to a significant percentage of the complete request time. This approach is more than 10x faster.
2010-02-21 23:50:01 -08:00
Andy Staudacher
6591ea2577 Fix delete() function of DB based Cache driver. It expected a scalar key / tag value, but it was always an array of keys / tags.
(compare to system/libraries/Cache.php and the File.php driver)
2010-02-21 23:48:23 -08:00
Bharat Mediratta
9b7542b9f1 Add Menu::add_before() 2010-02-21 17:14:19 -08:00
Bharat Mediratta
d3e07f8a97 Revert "Fix for ticket #1017: Handle the common case of t(html::clean($var)) by casting SafeString instances to string in translate()."
This reverts commit 4ca55a90ee.
2010-02-18 16:19:41 -08:00
Andy Staudacher
45910ffdc0 Improve setlocale() call, using some of G2's locale fallback code to match the platform's locale names. 2010-02-18 16:19:17 -08:00
Andy Staudacher
4ca55a90ee Fix for ticket #1017: Handle the common case of t(html::clean($var)) by casting SafeString instances to string in translate(). 2010-02-16 23:54:39 -08:00
Andy Staudacher
30dcaaa236 Need to allow access to ::change_provider for CLI, to make packager work. 2010-02-14 18:33:10 -08:00
Andy Staudacher
74471df777 Minor security tightening of IdentityProvider::change_provider(). 2010-02-14 16:12:18 -08:00
Andy Staudacher
2dad1d7cd1 Some HTML validation fixes (don't render empty <ul> lists, empty id attributes, use &amp; not &) 2010-02-14 07:15:57 -08:00
Andy Staudacher
d53f6d0e05 Fix for tickets 1009 and 603: Show a themed error page to guests / registered users (not to admins though). And show a login form to guests for 404 (incl. insufficient view permissions) errors. 2010-02-12 16:40:44 -08:00
Bharat Mediratta
6dfab72922 Override Input::clean_input_keys() to sanitize malicious values out of
strings instead of dying.  This at least gives us graceful degradation.

Fixes ticket #764, patch thanks to djnz.
2010-02-08 15:37:11 -08:00
Tim Almdal
6783de2457 Remove the redundant reference to ["force_rtl". 2010-02-07 14:17:58 -08:00
Tim Almdal
b6c0d3a48c Refactor the is_rtl() helper into the Gallery_I18n class. This allows checking
for a config value "force_rtl" which will layout the gallery pages in rtl mode
without having to change to an language that is no longer understandable to the
developer.

Adding the line "$config['force_rtl'] = true;" to the config/locales.php file
will make it happen.
2010-02-07 13:55:17 -08:00
Bharat Mediratta
adac97b537 Add prefix support for the target of RENAME TABLE. 2010-02-07 08:28:32 -08:00
Bharat Mediratta
c050acf30a Fix lots of warnings that pop up when we're in E_STRICT mode. They're
mostly issues around uninitialized variables, calling non-static
functions in a static context, calling Session functions directly
instead of on its singleton, passing non-variables by reference, and
subclasses not using the same interface as the parent class.
2010-01-31 16:07:41 -08:00
Bharat Mediratta
dccb2b73ff Dump out validation errors so that we have some extra information in the logs. 2010-01-30 16:19:00 -08:00
Bharat Mediratta
0d73738099 Stop using obsolete form::close()
Update the way we include the hidden CSRF field for InPlaceEdit.
2010-01-29 10:13:10 -08:00
Bharat Mediratta
9908f37eef Use identity::set_active_user() instead of auth::login() when we
change providers otherwise the user_installer code is going to be
calling auth::login() which causes all kinds of unexpected weirdness,
like it triggers the handler in gallery_event which detects graphics
toolkits, and that's only supposed to run on the first admin login.
2010-01-28 21:33:41 -08:00
Bharat Mediratta
4b32a71afc Convert back to using ORM::factory(..., $id) instead of calling where(). 2010-01-27 22:34:11 -08:00
Bharat Mediratta
804614711a Make only one attempt to restore the old identity provider in case of
failure.  Else, we can get into an infinite recursion.
2010-01-25 19:49:52 -08:00
Bharat Mediratta
fecac4a859 Merge branch 'master' of git@github.com:gallery/gallery3 into bharat_dev
Conflicts:
	modules/gallery/tests/xss_data.txt
2010-01-23 16:29:10 -08:00
Tim Almdal
abdeb21ccb Add a user_menu method to the Admin_View and then use this method to get the
user menu.  Since the information displayed is identical in both admin and
theme views, it makes sense to combine the generation to it is done in a common
location.
2010-01-23 13:29:49 -08:00
Tim Almdal
eabeeeb126 Trap any errors that may occur when trying to install a new identity provider and then reinstall the current one. 2010-01-22 13:38:05 -08:00
Tim Almdal
ae568b6182 Refactor the identity provider installation in to a common helper method (change_provider) with an initialization callback. 2010-01-22 12:09:11 -08:00