diff --git a/main/wiki/index.php b/main/wiki/index.php
index 95b786b161..e4432305e8 100755
--- a/main/wiki/index.php
+++ b/main/wiki/index.php
@@ -12,11 +12,6 @@
// name of the language file that needs to be included
$language_file = 'wiki';
-// security
-if(isset($_GET['id_session'])) {
- $_SESSION['id_session'] = intval($_GET['id_session']);
-}
-
// including the global dokeos file
require_once '../inc/global.inc.php';
@@ -235,7 +230,7 @@ if ($_GET['view'])
if ($_GET['view']<$last_row['id'])
{
- $message= '
'.get_lang('NoAreSeeingTheLastVersion').'
'.get_lang("Version").' ('.$current_row['version'].' / '.$last_row['version'].')
'.get_lang("ConvertToLastVersion").': '.get_lang("Restore").'';
+ $message= ''.get_lang('NoAreSeeingTheLastVersion').'
'.get_lang("Version").' ('.$current_row['version'].' / '.$last_row['version'].')
'.get_lang("ConvertToLastVersion").': '.get_lang("Restore").'';
Display::display_warning_message($message,false);
}
@@ -321,7 +316,7 @@ if ($_GET['view'])
}
else
{
- Display::display_confirmation_message(restore_wikipage($current_row['page_id'], $current_row['reflink'], $current_row['title'], $current_row['content'], $current_row['group_id'], $current_row['assignment'], $current_row['progress'], $current_row['version'], $last_row['version'], $current_row['linksto']).': '.api_htmlentities($last_row['title']).'',false);
+ Display::display_confirmation_message(restore_wikipage($current_row['page_id'], $current_row['reflink'], $current_row['title'], $current_row['content'], $current_row['group_id'], $current_row['assignment'], $current_row['progress'], $current_row['version'], $last_row['version'], $current_row['linksto']).': '.api_htmlentities($last_row['title']).'',false);
}
}
}
@@ -367,10 +362,10 @@ echo '';
echo '';
echo '';
///menu home
- echo '- '.get_lang('HomeWiki').'
';
+ echo '- '.get_lang('HomeWiki').'
';
if ( api_is_allowed_to_session_edit(false,true) ) {
//menu add page
- echo '- '.get_lang('AddNew').' ';
+ echo '
- '.get_lang('AddNew').' ';
}
if(api_is_allowed_to_edit(false,true) || api_is_platform_admin())
@@ -391,11 +386,11 @@ echo '
';
echo ''.$protect_addnewpage.'';
///menu find
- echo '- '.get_lang('SearchPages').'
';
+ echo '- '.get_lang('SearchPages').'
';
///menu all pages
- echo '- '.get_lang('AllPages').'
';
+ echo '- '.get_lang('AllPages').'
';
///menu recent changes
- echo '- '.get_lang('RecentChanges').'
';
+ echo '- '.get_lang('RecentChanges').'
';
///menu delete all wiki
if(api_is_allowed_to_edit(false,true) || api_is_platform_admin())
{
@@ -425,18 +420,18 @@ if (!in_array($_GET['action'], array('addnew', 'searchpages', 'allpages', 'recen
echo "";
//menu show page
- echo ' '.Display::display_icon('lp_document.png',get_lang('ShowThisPage')).' '.get_lang('Page').'';
+ echo ' '.Display::display_icon('lp_document.png',get_lang('ShowThisPage')).' '.get_lang('Page').'';
if (api_is_allowed_to_session_edit(false,true) ) {
//menu edit page
- echo ' '.Display::display_icon('lp_quiz.png',get_lang('EditThisPage')).' '.get_lang('EditPage').'';
+ echo ' '.Display::display_icon('lp_quiz.png',get_lang('EditThisPage')).' '.get_lang('EditPage').'';
//menu discuss page
echo ' '.Display::display_icon('comment_bubble.gif',get_lang('DiscussThisPage')).' '.get_lang('Discuss').'';
}
//menu history
- echo ' '.Display::display_icon('history.gif',get_lang('ShowPageHistory')).' '.get_lang('History').'';
+ echo ' '.Display::display_icon('history.gif',get_lang('ShowPageHistory')).' '.get_lang('History').'';
//menu linkspages
echo ' '.Display::display_icon('lp_link.png',get_lang('ShowLinksPages')).' '.get_lang('LinksPages').'';
@@ -487,19 +482,19 @@ if ($_GET['action']=='more')
echo ' ';
echo '';
echo ' | ';
echo ' ';
echo '';
echo' | ';
echo ' |
|
';
@@ -507,37 +502,37 @@ if ($_GET['action']=='more')
//Submenu Most linked pages
- //echo ''.get_lang('MostLinkedPages').'';//TODO:
+ //echo ''.get_lang('MostLinkedPages').'';//TODO:
//Submenu Dead end pages
- //echo ''.get_lang('DeadEndPages').'';//TODO:
+ //echo ''.get_lang('DeadEndPages').'';//TODO:
//Submenu Most new pages (not versions)
- //echo ''.get_lang('MostNewPages').'';//TODO:
+ //echo ''.get_lang('MostNewPages').'';//TODO:
//Submenu Most long pages
- //echo ''.get_lang('MostLongPages').'';//TODO:
+ //echo ''.get_lang('MostLongPages').'';//TODO:
//Submenu Protected pages
- //echo ''.get_lang('ProtectedPages').'';//TODO:
+ //echo ''.get_lang('ProtectedPages').'';//TODO:
//Submenu Hidden pages
- //echo ''.get_lang('HiddenPages').'';//TODO:
+ //echo ''.get_lang('HiddenPages').'';//TODO:
//Submenu Most discuss pages
- //echo ''.get_lang('MostDiscussPages').'';//TODO:
+ //echo ''.get_lang('MostDiscussPages').'';//TODO:
//Submenu Best scored pages
- //echo ''.get_lang('BestScoredPages').'';//TODO:
+ //echo ''.get_lang('BestScoredPages').'';//TODO:
//Submenu Pages with more progress
- //echo ''.get_lang('MProgressPages').'';//TODO:
+ //echo ''.get_lang('MProgressPages').'';//TODO:
//Submenu Most active users in discuss
- //echo ''.get_lang('MostDiscussUsers').'';//TODO:
+ //echo ''.get_lang('MostDiscussUsers').'';//TODO:
//Submenu Random page
- //echo ''.get_lang('RandomPage').'';//TODO:
+ //echo ''.get_lang('RandomPage').'';//TODO:
}
@@ -559,13 +554,13 @@ if ($_GET['action']=='mactiveusers')
$userinfo=Database::get_user_info_from_id($obj->user_id);
$row = array ();
- $row[] = $obj->user_id <>0 ? ''.api_htmlentities(api_get_person_name($userinfo['firstname'], $userinfo['lastname'])).'' : get_lang('Anonymous').' ('.$obj->user_ip.')';
- $row[] =''.$obj->NUM_EDIT.'';
+ $row[] = $obj->user_id <>0 ? ''.api_htmlentities(api_get_person_name($userinfo['firstname'], $userinfo['lastname'])).'' : get_lang('Anonymous').' ('.$obj->user_ip.')';
+ $row[] =''.$obj->NUM_EDIT.'';
$rows[] = $row;
}
$table = new SortableTableFromArrayConfig($rows,1,10,'MostActiveUsersA_table','','','DESC');
- $table->set_additional_parameters(array('cidReq' =>Security::remove_XSS($_GET['cidReq']),'action'=>Security::remove_XSS($_GET['action']),'group_id'=>Security::remove_XSS($_GET['group_id'])));
+ $table->set_additional_parameters(array('cidReq' =>Security::remove_XSS($_GET['cidReq']),'action'=>Security::remove_XSS($_GET['action']),'session_id'=>Security::remove_XSS($_GET['session_id']),'group_id'=>Security::remove_XSS($_GET['group_id'])));
$table->set_header(0,get_lang('Author'), true, array ('style' => 'width:30px;'));
$table->set_header(1,get_lang('Contributions'), true);
$table->display();
@@ -579,7 +574,7 @@ if ($_GET['action']=='usercontrib')
{
$userinfo=Database::get_user_info_from_id($_GET['user_id']);
- echo '';
+ echo '';
if(api_is_allowed_to_edit(false,true) || api_is_platform_admin()) //only by professors if page is hidden
@@ -628,7 +623,7 @@ if ($_GET['action']=='usercontrib')
$row[] = $year.'-'.$month.'-'.$day.' '.$hours.":".$minutes.":".$seconds;
$row[] =$ShowAssignment;
- $row[] = ''.api_htmlentities($obj->title).'';
+ $row[] = ''.api_htmlentities($obj->title).'';
$row[] =Security::remove_XSS($obj->version);
$row[] =Security::remove_XSS($obj->comment);
//$row[] = api_strlen($obj->comment)>30 ? Security::remove_XSS(api_substr($obj->comment,0,30)).'...' : Security::remove_XSS($obj->comment);
@@ -644,7 +639,7 @@ if ($_GET['action']=='usercontrib')
}
$table = new SortableTableFromArrayConfig($rows,2,10,'UsersContributions_table','','','ASC');
- $table->set_additional_parameters(array('cidReq' =>Security::remove_XSS($_GET['cidReq']),'action'=>Security::remove_XSS($_GET['action']),'user_id'=>Security::remove_XSS($_GET['user_id']),'group_id'=>Security::remove_XSS($_GET['group_id'])));
+ $table->set_additional_parameters(array('cidReq' =>Security::remove_XSS($_GET['cidReq']),'action'=>Security::remove_XSS($_GET['action']),'user_id'=>Security::remove_XSS($_GET['user_id']),'session_id'=>Security::remove_XSS($_GET['session_id']),'group_id'=>Security::remove_XSS($_GET['group_id'])));
$table->set_header(0,get_lang('Date'), true, array ('style' => 'width:200px;'));
$table->set_header(1,get_lang('Type'), true, array ('style' => 'width:30px;'));
@@ -702,13 +697,13 @@ if ($_GET['action']=='mostchanged')
$row = array ();
$row[] =$ShowAssignment;
- $row[] = ''.api_htmlentities($obj->title).'';
+ $row[] = ''.api_htmlentities($obj->title).'';
$row[] = $obj->MAX;
$rows[] = $row;
}
$table = new SortableTableFromArrayConfig($rows,2,10,'MostChangedPages_table','','','DESC');
- $table->set_additional_parameters(array('cidReq' =>Security::remove_XSS($_GET['cidReq']),'action'=>Security::remove_XSS($_GET['action']),'group_id'=>Security::remove_XSS($_GET['group_id'])));
+ $table->set_additional_parameters(array('cidReq' =>Security::remove_XSS($_GET['cidReq']),'action'=>Security::remove_XSS($_GET['action']),'session_id'=>Security::remove_XSS($_GET['session_id']),'group_id'=>Security::remove_XSS($_GET['group_id'])));
$table->set_header(0,get_lang('Type'), true, array ('style' => 'width:30px;'));
$table->set_header(1,get_lang('Title'), true);
$table->set_header(2,get_lang('Changes'), true);
@@ -756,13 +751,13 @@ if ($_GET['action']=='mvisited')
$row = array ();
$row[] =$ShowAssignment;
- $row[] = ''.api_htmlentities($obj->title).'';
+ $row[] = ''.api_htmlentities($obj->title).'';
$row[] = $obj->tsum;
$rows[] = $row;
}
$table = new SortableTableFromArrayConfig($rows,2,10,'MostVisitedPages_table','','','DESC');
- $table->set_additional_parameters(array('cidReq' =>Security::remove_XSS($_GET['cidReq']),'action'=>Security::remove_XSS($_GET['action']),'group_id'=>Security::remove_XSS($_GET['group_id'])));
+ $table->set_additional_parameters(array('cidReq' =>Security::remove_XSS($_GET['cidReq']),'action'=>Security::remove_XSS($_GET['action']),'session_id'=>Security::remove_XSS($_GET['session_id']),'group_id'=>Security::remove_XSS($_GET['group_id'])));
$table->set_header(0,get_lang('Type'), true, array ('style' => 'width:30px;'));
$table->set_header(1,get_lang('Title'), true);
$table->set_header(2,get_lang('Visits'), true);
@@ -811,7 +806,7 @@ if ($_GET['action']=='wanted')
{
if (trim($v)!="")
{
- echo ''.api_htmlentities(str_replace('_',' ',$v)).'';
+ echo ''.api_htmlentities(str_replace('_',' ',$v)).'';
}
}
}
@@ -895,7 +890,7 @@ if ($_GET['action']=='orphaned')
$ShowAssignment='';
}
- echo ''.$ShowAssignment.''.api_htmlentities($row['title']).'';
+ echo ''.$ShowAssignment.''.api_htmlentities($row['title']).'';
}
echo '';
}
@@ -932,10 +927,10 @@ if ($_GET['action']=='delete')
if ($_GET['delete'] == 'yes')
{
- $sql='DELETE '.$tbl_wiki_discuss.' FROM '.$tbl_wiki.', '.$tbl_wiki_discuss.' WHERE '.$tbl_wiki.'.reflink="'.Database::escape_string($page).'" AND '.$tbl_wiki.'.'.$groupfilter.' AND '.$tbl_wiki_discuss.'.publication_id='.$tbl_wiki.'.id';
+ $sql='DELETE '.$tbl_wiki_discuss.' FROM '.$tbl_wiki.', '.$tbl_wiki_discuss.' WHERE '.$tbl_wiki.'.reflink="'.Database::escape_string($page).'" AND '.$tbl_wiki.'.'.$groupfilter.' AND '.$tbl_wiki.'.session_id='.$session_id.' AND '.$tbl_wiki_discuss.'.publication_id='.$tbl_wiki.'.id';
Database::query($sql);
- $sql='DELETE '.$tbl_wiki_mailcue.' FROM '.$tbl_wiki.', '.$tbl_wiki_mailcue.' WHERE '.$tbl_wiki.'.reflink="'.Database::escape_string($page).'" AND '.$tbl_wiki.'.'.$groupfilter.' AND '.$tbl_wiki_mailcue.'.id='.$tbl_wiki.'.id';
+ $sql='DELETE '.$tbl_wiki_mailcue.' FROM '.$tbl_wiki.', '.$tbl_wiki_mailcue.' WHERE '.$tbl_wiki.'.reflink="'.Database::escape_string($page).'" AND '.$tbl_wiki.'.'.$groupfilter.' AND '.$tbl_wiki.'.session_id='.$session_id.' AND '.$tbl_wiki_mailcue.'.id='.$tbl_wiki.'.id';
Database::query($sql);
$sql='DELETE FROM '.$tbl_wiki.' WHERE reflink="'.Database::escape_string($page).'" AND '.$groupfilter.$condition_session.'';
@@ -989,7 +984,7 @@ if ($_GET['action']=='searchpages')
echo ''.get_lang('SearchPages').'
';
echo '';
// initiate the object
- $form = new FormValidator('wiki_search','post', api_get_self().'?cidReq='.api_htmlentities($_GET['cidReq']).'&action='.api_htmlentities($_GET['action']).'&group_id='.api_htmlentities($_GET['group_id']));
+ $form = new FormValidator('wiki_search','post', api_get_self().'?cidReq='.api_htmlentities($_GET['cidReq']).'&action='.api_htmlentities($_GET['action']).'&session_id='.api_htmlentities($_GET['session_id']).'&group_id='.api_htmlentities($_GET['group_id']));
// settting the form elements
@@ -1054,7 +1049,7 @@ if ($_GET['action']=='links')
}
echo '
';
//fix index to title Main page into linksto
@@ -1115,7 +1110,7 @@ if ($_GET['action']=='links')
$row = array ();
$row[] =$ShowAssignment;
- $row[] = '
'.api_htmlentities($obj->title).'';
+ $row[] = '
'.api_htmlentities($obj->title).'';
$row[] = $obj->user_id <>0 ? '
'.api_htmlentities(api_get_person_name($userinfo['firstname'], $userinfo['lastname'])).'' : get_lang('Anonymous').' ('.$obj->user_ip.')';
$row[] = $year.'-'.$month.'-'.$day.' '.$hours.":".$minutes.":".$seconds;
$rows[] = $row;
@@ -1204,11 +1199,13 @@ if ($_GET['action']=='showpage' AND !isset($_POST['SaveWikiNew']))
if ($_GET['action']=='edit')
{
+
if (api_get_session_id()!=0 && api_is_allowed_to_session_edit(false,true)==false) {
api_not_allowed();
}
$_clean['group_id']=(int)$_SESSION['_gid'];
+
$sql='SELECT * FROM '.$tbl_wiki.', '.$tbl_wiki_conf.' WHERE '.$tbl_wiki_conf.'.page_id='.$tbl_wiki.'.page_id AND '.$tbl_wiki.'.reflink="'.Database::escape_string($page).'" AND '.$tbl_wiki.'.'.$groupfilter.$condition_session.' ORDER BY id DESC';
$result=Database::query($sql);
@@ -1443,7 +1440,7 @@ if ($_GET['action']=='edit')
exit;
}
//form
- echo '