From 2701ef3c663629b7a3f6bfdf60635baf86094ac8 Mon Sep 17 00:00:00 2001 From: Carlos Vargas Date: Mon, 15 Mar 2010 11:34:32 -0500 Subject: [PATCH 1/9] Create introduction to the course and introduction to the tools for session. CT#750 --- main/inc/introductionSection.inc.php | 11 +++++++---- main/inc/lib/add_course.lib.inc.php | 9 +++++---- main/install/db_main.sql | 2 +- main/install/migrate-db-1.8.6.2-1.8.7-pre.sql | 3 ++- 4 files changed, 15 insertions(+), 10 deletions(-) diff --git a/main/inc/introductionSection.inc.php b/main/inc/introductionSection.inc.php index 2e872b4e26..41be4a76aa 100755 --- a/main/inc/introductionSection.inc.php +++ b/main/inc/introductionSection.inc.php @@ -30,6 +30,8 @@ require_once api_get_path(LIBRARY_PATH).'course_description.lib.php'; $TBL_INTRODUCTION = Database::get_course_table(TABLE_TOOL_INTRO); $intro_editAllowed = $is_allowed_to_edit; +$session_id = api_get_session_id(); + global $charset; $intro_cmdEdit = empty($_GET['intro_cmdEdit']) ? '' : $_GET['intro_cmdEdit']; @@ -91,9 +93,10 @@ if ($intro_editAllowed) { $form_values = $form->exportValues(); $intro_content = Security::remove_XSS(stripslashes(api_html_entity_decode($form_values['intro_content'])), COURSEMANAGERLOWSECURITY); - if (!empty($intro_content)) { - $sql = "REPLACE $TBL_INTRODUCTION SET id='$moduleId',intro_text='".Database::escape_string($intro_content)."'"; + $sql = "REPLACE $TBL_INTRODUCTION SET id='$moduleId',intro_text='".Database::escape_string($intro_content)."', session_id='".$session_id."'"; + + var_dump($sql); Database::query($sql); Display::display_confirmation_message(get_lang('IntroductionTextUpdated'), false); } else { @@ -107,7 +110,7 @@ if ($intro_editAllowed) { /* Delete Command */ if ($intro_cmdDel) { - Database::query("DELETE FROM $TBL_INTRODUCTION WHERE id='".$moduleId."'"); + Database::query("DELETE FROM $TBL_INTRODUCTION WHERE id='".$moduleId."' AND session_id='".$session_id."'"); Display::display_confirmation_message(get_lang('IntroductionTextDeleted')); } } @@ -117,7 +120,7 @@ if ($intro_editAllowed) { /* Retrieves the module introduction text, if exist */ -$sql = "SELECT intro_text FROM $TBL_INTRODUCTION WHERE id='".$moduleId."'"; +$sql = "SELECT intro_text FROM $TBL_INTRODUCTION WHERE id='".$moduleId."' AND session_id='".$session_id."'"; $intro_dbQuery = Database::query($sql); $intro_dbResult = Database::fetch_array($intro_dbQuery); $intro_content = $intro_dbResult['intro_text']; diff --git a/main/inc/lib/add_course.lib.inc.php b/main/inc/lib/add_course.lib.inc.php index 8c800808bc..3bb587a6c8 100755 --- a/main/inc/lib/add_course.lib.inc.php +++ b/main/inc/lib/add_course.lib.inc.php @@ -1105,7 +1105,8 @@ function update_Db_course($courseDbName, $language = null) CREATE TABLE `".$TABLEINTROS . "` ( id varchar(50) NOT NULL, intro_text text NOT NULL, - PRIMARY KEY (id) + session_id INT NOT NULL DEFAULT 0, + PRIMARY KEY (id, session_id) )" . $charset_clause); /* @@ -2324,12 +2325,12 @@ function fill_Db_course($courseDbName, $courseRepository, $language,$default_doc */ $intro_text='
mr. Dokeos'.lang2db(get_lang('IntroductionText')).'
'; - Database::query("INSERT INTO `".$TABLEINTROS . "` VALUES ('" . TOOL_COURSE_HOMEPAGE . "','".$intro_text. "')"); - Database::query("INSERT INTO `".$TABLEINTROS . "` VALUES ('" . TOOL_STUDENTPUBLICATION . "','".lang2db(get_lang('IntroductionTwo')) . "')"); + Database::query("INSERT INTO `".$TABLEINTROS . "` VALUES ('" . TOOL_COURSE_HOMEPAGE . "','".$intro_text. "', 0)"); + Database::query("INSERT INTO `".$TABLEINTROS . "` VALUES ('" . TOOL_STUDENTPUBLICATION . "','".lang2db(get_lang('IntroductionTwo')) . "', 0)"); //wiki intro $intro_wiki='
'.lang2db(get_lang('IntroductionWiki')).'
'; - Database::query("INSERT INTO `".$TABLEINTROS . "` VALUES ('" . TOOL_WIKI . "','".$intro_wiki. "')"); + Database::query("INSERT INTO `".$TABLEINTROS . "` VALUES ('" . TOOL_WIKI . "','".$intro_wiki. "', 0)"); /* ----------------------------------------------------------- diff --git a/main/install/db_main.sql b/main/install/db_main.sql index e5ee44fb6f..28eafe5509 100644 --- a/main/install/db_main.sql +++ b/main/install/db_main.sql @@ -757,7 +757,7 @@ VALUES ('show_tabs', 'dashboard', 'checkbox', 'Platform', 'true', 'ShowTabsTitle', 'ShowTabsComment', NULL, 'TabsDashboard', 1), ('use_users_timezone', 'timezones', 'radio', 'Timezones', 'true', 'UseUsersTimezoneTitle','UseUsersTimezoneComment',NULL,'Timezones', 1), ('timezone_value', 'timezones', 'select', 'Timezones', '', 'TimezoneValueTitle','TimezoneValueComment',NULL,'Timezones', 1), -('dokeos_database_version', NULL, 'textfield', NULL,'1.8.7.10879','DokeosDatabaseVersion','',NULL,NULL,0); +('dokeos_database_version', NULL, 'textfield', NULL,'1.8.7.10983','DokeosDatabaseVersion','',NULL,NULL,0); UNLOCK TABLES; diff --git a/main/install/migrate-db-1.8.6.2-1.8.7-pre.sql b/main/install/migrate-db-1.8.6.2-1.8.7-pre.sql index 53c9067e5d..92475da0bb 100755 --- a/main/install/migrate-db-1.8.6.2-1.8.7-pre.sql +++ b/main/install/migrate-db-1.8.6.2-1.8.7-pre.sql @@ -48,7 +48,7 @@ INSERT INTO settings_current (variable, subkey, type, category, selected_value, ALTER TABLE user_field_values CHANGE id id BIGINT NOT NULL AUTO_INCREMENT; ALTER TABLE user_field_values ADD INDEX (user_id, field_id); -UPDATE settings_current SET selected_value = '1.8.7.10741' WHERE variable = 'dokeos_database_version'; +UPDATE settings_current SET selected_value = '1.8.7.10983' WHERE variable = 'dokeos_database_version'; ALTER TABLE course_rel_user DROP PRIMARY KEY, ADD PRIMARY KEY (course_code, user_id, relation_type); ALTER TABLE session_rel_user DROP PRIMARY KEY, ADD PRIMARY KEY (id_session, id_user, relation_type); @@ -97,3 +97,4 @@ ALTER TABLE attendance ADD INDEX(active); ALTER TABLE lp_view ADD session_id INT NOT NULL DEFAULT 0; ALTER TABLE lp_view ADD INDEX(session_id); INSERT INTO course_setting (variable,value,category) VALUES ('allow_user_view_user_list',1,'user'); +ALTER TABLE tool_intro ADD COLUMN session_id INT NOT NULL DEFAULT 0 AFTER intro_text, DROP PRIMARY KEY, ADD PRIMARY KEY USING BTREE(id, session_id); From 1794131c204b065a69e145bdd8600142e5e73003 Mon Sep 17 00:00:00 2001 From: Carlos Vargas Date: Mon, 15 Mar 2010 11:55:14 -0500 Subject: [PATCH 2/9] minor delete //var_dump --- main/inc/introductionSection.inc.php | 1 - 1 file changed, 1 deletion(-) diff --git a/main/inc/introductionSection.inc.php b/main/inc/introductionSection.inc.php index 41be4a76aa..331d7a347f 100755 --- a/main/inc/introductionSection.inc.php +++ b/main/inc/introductionSection.inc.php @@ -96,7 +96,6 @@ if ($intro_editAllowed) { if (!empty($intro_content)) { $sql = "REPLACE $TBL_INTRODUCTION SET id='$moduleId',intro_text='".Database::escape_string($intro_content)."', session_id='".$session_id."'"; - var_dump($sql); Database::query($sql); Display::display_confirmation_message(get_lang('IntroductionTextUpdated'), false); } else { From 4db5fee9120ff2bb523e38557d618093ae5300f8 Mon Sep 17 00:00:00 2001 From: Carlos Vargas Date: Mon, 15 Mar 2010 14:58:35 -0500 Subject: [PATCH 3/9] change \"from\" email CT#662 --- main/inc/lib/mail.lib.inc.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/main/inc/lib/mail.lib.inc.php b/main/inc/lib/mail.lib.inc.php index 4563c9ffc0..bd881fd59e 100755 --- a/main/inc/lib/mail.lib.inc.php +++ b/main/inc/lib/mail.lib.inc.php @@ -140,6 +140,10 @@ function api_mail_html($recipient_name, $recipient_email, $subject, $message, $s $mail->IsHTML(0); $mail->SMTPKeepAlive = true; + if (($sender_email != "") && ($sender_name != "")) { + $mail->AddReplyTo ($sender_email,$sender_name); + } + // attachments // $mail->AddAttachment($path); // $mail->AddAttachment($path,$filename); From 9a34083293a9febca302758c837e13297e4d96da Mon Sep 17 00:00:00 2001 From: Carlos Vargas Date: Tue, 16 Mar 2010 10:24:02 -0500 Subject: [PATCH 4/9] icons na view_choose and full_screen CT#602 --- main/img/view_choose_na.gif | Bin 0 -> 14201 bytes main/img/view_fullscreen_na.gif | Bin 0 -> 14270 bytes 2 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 main/img/view_choose_na.gif create mode 100644 main/img/view_fullscreen_na.gif diff --git a/main/img/view_choose_na.gif b/main/img/view_choose_na.gif new file mode 100644 index 0000000000000000000000000000000000000000..ad42fb956ebe9787f17fd149637ab7d07a294665 GIT binary patch literal 14201 zcmeI3Yg|)h9LEo8YG8?ZNs;m}FC}g}XE$JD8;l{h1QZ4+T6);d#$;^caDYK77rDhv zKrj;mBrS@vKui-9gfP2MbThkSSy`G1A~!E|CIr@t`aCcE^yWFAeYR)M`Tn2F_xZhj zeEogg#KZz*0Wydnqobp@Z{NOo^X82kH%3NAhKGlThK2?Q2L}cQu3x|2-`{`j+O@vE zzTV#6D_5>uzI?g6ySuBatFyDSqobp}y}hlit+loF})) zWo2c%ckeDOEiEZ2*|lp|QBhH0VPQc*L4JOIUS3{qZf;IaPIh*7R#sMKX6DYFJ2Nse z($mw^($Z2>Q+Mpxv2EM7l$4a@BqU_rx^=<9!9hVmfq{W*)~pE#2=Mp! z_w)1f_4W1f@malkwYRsoQmORv@=_=io}Qi_9v*VJTqcuArBZiycZozI7K`27++1B< zU0hs5B9TBK;Pd%B9uLQH48yowE}P9>wQ7~Kv-8T8E14re;PXEja2mB+AGj9vCTN2B zm3mmrggS<#(I`@KaYb29&AtZ14xOE8Sd zKQ~FhHBmZ@$3zjs`52$iVF*rqvXLe%9Ao^_u|fVC$D52-Q+hM4HyKguxI~mGftImY z)`=#b@y!wDiHVHy+&dfPs!g$&g)n10E{;u%%oIwQPKlBt3ED)dOeTYTZ2LZXicB(5 zG4ZG}R3Noh{tcR(b+Vphj);_7eQh5KL-7yJkX@kYm>*zc{m3b zaCo?iCzgmr625S}{4Qv`T#8vm+$H9Yb?ct~(f?n+wi zobmqdOrw@)O;jvF%k{B@j>L3&trVN={MYr3t(u7i6H9C&mwzpN;wbM)W77LQ8GdX~ zI0=wks0-=>G5`d_bU|G}27q9gE~pF001yn*1$6-#0D@tH;zV1jBSeT|fqaV3;nb3&;Qv{IBV5*Q(?c$kA`-EitBXh|;PY^d%VDo_UitWAE0!-?%5p-NJo<>^VuwWwA6_tj z-rR@g*w23OfmwF8_s^U${k~~ar`RBf)9^H#8Av+9wqC}uUJyfOjv`aFe zX5z)78Px)|qwe?G^7bq{gU!Vr^@~|rWK+`!lDDkBNJeg{{H`|P)RY+yHV$-$u9*Ji zfyg7#vYHx&5%K6ND{+c2FFnQq1<>@WX|XNBF{^jW%tb z0(*CYsyt0Oq?Jgv7?9;&7jjcqgbJN{<_3Ec==`vj-p&j{xN!O+`_j16i?*uP6N?vC P#dT*pCY~ca5%)gUa=JDgl4<9~!@ZiDy`}gnN zyEi>OJvB8oIXO8oF)=TOtJ9q934Gj$r4h{?q^!NAQzJ2@F zty_J4eK&93ym8~k_3PJrdwZ{4yLR>J)hk!7^z`&}cXwaBc(JRitD~di!i5X%?d@%C zZLO`X=g*&SX=!O{YHDn3JagtuLqkJ-eSKYBU2Sb`O-)U8b#+x$)u~gbPM$njSy@?8 zQE}qLiQ~tQA3Jueyu7@utgN)Ow4|h@xVX5esHm{8u%MtIKR^HI(W7~Jc}I>M$<58p z$;rvi&Ndp2Sy@>IgCQd$BRxI+@ZrO0X=$mcsVONbNl8g0N$PYutyZg2sgz2kLZOh$ zl_>$ z=I7@T`22qjQ07jINWjzGQX44M>Yd86LGbfzCOz|VIpx>G`;5fU}Z^h23AZu(-fS$?Juy7*9e z_NEp`7b{~&2}O%@n*MRAaU`i_V_0%>GCi3^*XZOJ!xTacXJSky%|y@=Q`DqHPg5su zUKr$?afC#oRHx9A3XK{yk1L7M93r_?s(GTNXK`~9?b1Z*MEdiM(xn;|rk7|j1|7$i zMm804Or30jj*yTVU9?7{5m@B^pEzi1KPneE~;F*2Ua0U(c zjy73g;A|FS&kOYn(09tknplM_WwD%r({L7zfk!g}*gn2&9A7Md0a`5QU}h07h?;>4Lg|3;@9}T~HU0 z0U#Kr3+e(g00hHyL0v!wfMA#|s0+vd5De1=bpaUwf?>L#E+7LyFiaQJ1!MpShUtR3 zfD8b^FkMg=kO3eVrVHuE(zx$uDe~*s*>z`kLHGF4i@E-$z@BiEFTYZ21%gr0t|J-}+%Rl|`>L0FLzVt;; z_r=eX-GusH?51t~zzH^5-8^ zoH%~0ysWgOxTvro|7hNk_j7Zyjalzy8Zy!kr~NE7MW38>h)mQaXfJGZdr8h-G51D?_TrzHZ8BV~M4(DG%CFGX0fEt48z z?@Zg%W}sxPEZFFmwAyvrMx5s!n06_WX=PVl>DL(D8j<9P`P{v|6isqtBhaM$vlO!EJXlVrjHn?-m)?^;$vkDlZS)3Oe$! ze0V*&_x(;vUbPP&*A^z|wizZ@RJjT(n%@ntShHjNtXB->QpsjVD^g}i>&o^((jBcg z$(#~8S96s^0;%m*17g|p(opx>usGa$6M+wPTBD@CGuK7g%(rnb)&|>ePBUb?%Qi5& zopy{Et)2J8b#@o*HFS2naPla*o22=*Ij#pA5=0wS&9z^ZYC9-jl%=|Pd|e(L Date: Tue, 16 Mar 2010 17:26:38 +0200 Subject: [PATCH 5/9] Feature #272 - Revision of a "TODO" about PEAR's date control. --- main/inc/lib/pear/HTML/QuickForm/date.php | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/main/inc/lib/pear/HTML/QuickForm/date.php b/main/inc/lib/pear/HTML/QuickForm/date.php index 934f19aff0..6b14a9419c 100755 --- a/main/inc/lib/pear/HTML/QuickForm/date.php +++ b/main/inc/lib/pear/HTML/QuickForm/date.php @@ -56,11 +56,7 @@ class HTML_QuickForm_date extends HTML_QuickForm_group 'language' => 'en', 'format' => 'dMY', 'minYear' => 2001, - // Modified by Chamilo team, 16-MAR-2010. - // TODO: This modification to be re-thought. - //'maxYear' => 2090, - 'maxYear' => 2010, - // + 'maxYear' => 2090, 'addEmptyOption' => false, 'emptyOptionValue' => '', 'emptyOptionText' => ' ', @@ -288,6 +284,11 @@ class HTML_QuickForm_date extends HTML_QuickForm_group $this->_persistantFreeze = true; $this->_appendName = true; $this->_type = 'date'; + // Added by Ivan Tcholakov, 16-MAR-2010. + $current_year = intval(api_get_local_time()); + $this->_options['minYear'] = $current_year - 9; + $this->_options['maxYear'] = $current_year + 1; + // // set the options, do not bother setting bogus ones if (is_array($options)) { foreach ($options as $name => $value) { From ac16a3b8a124257e6dec71187129d6fb4a2ca5db Mon Sep 17 00:00:00 2001 From: Julio Montoya Date: Tue, 16 Mar 2010 10:26:52 -0500 Subject: [PATCH 6/9] Security issue - Adding security::remove_XSS, intval and escape_string functions --- .../gradebook/lib/gradebook_functions.inc.php | 42 ++++++++----------- 1 file changed, 18 insertions(+), 24 deletions(-) diff --git a/main/gradebook/lib/gradebook_functions.inc.php b/main/gradebook/lib/gradebook_functions.inc.php index c1d93701a3..cd638067d3 100755 --- a/main/gradebook/lib/gradebook_functions.inc.php +++ b/main/gradebook/lib/gradebook_functions.inc.php @@ -1,14 +1,15 @@ , Hogeschool Ghent +* @author Julio Montoya adding security functions * @version april 2007 */ require_once ('gradebook_functions_users.inc.php'); - /** * Adds a resource to the unique gradebook of a given course * @param string Course code @@ -118,7 +119,7 @@ function block_students() { */ function get_course_name_from_code($code) { $tbl_main_categories= Database :: get_main_table(TABLE_MAIN_COURSE); - $sql= 'SELECT title,code FROM ' . $tbl_main_categories . 'WHERE code = "' . $code . '"'; + $sql= 'SELECT title, code FROM ' . $tbl_main_categories . 'WHERE code = "' . Database::escape_string($code) . '"'; $result= Database::query($sql); if ($col= Database::fetch_array($result)) { return $col['title']; @@ -235,17 +236,10 @@ function build_edit_icons_link($link, $selectcat) { * @return int false on error or link ID */ function is_resource_in_course_gradebook($course_code, $resource_type, $resource_id, $session_id = 0) { - /* See defines in lib/be/linkfactory.class.php - define('LINK_EXERCISE',1); - define('LINK_DROPBOX',2); - define('LINK_STUDENTPUBLICATION',3); - define('LINK_LEARNPATH',4); - define('LINK_FORUM_THREAD',5), - define('LINK_WORK',6); - */ - require_once(api_get_path(SYS_CODE_PATH).'gradebook/lib/be/linkfactory.class.php'); - require_once (api_get_path(SYS_CODE_PATH).'gradebook/lib/be.inc.php'); - require_once(api_get_path(SYS_CODE_PATH).'gradebook/lib/be/linkfactory.class.php'); + require_once api_get_path(SYS_CODE_PATH).'gradebook/lib/be/linkfactory.class.php'; + require_once api_get_path(SYS_CODE_PATH).'gradebook/lib/be.inc.php'; + require_once api_get_path(SYS_CODE_PATH).'gradebook/lib/be/linkfactory.class.php'; + // TODO find the corresponding category (the first one for this course, ordered by ID) $t = Database::get_main_table(TABLE_MAIN_GRADEBOOK_CATEGORY); $l = Database::get_main_table(TABLE_MAIN_GRADEBOOK_LINK); @@ -262,7 +256,7 @@ function is_resource_in_course_gradebook($course_code, $resource_type, $resource } $row = Database::fetch_array($res); $category = $row['id']; - $sql = "SELECT * FROM $l l WHERE l.category_id = $category AND type = ".(int) $resource_type." and ref_id = ".(int) $resource_id; + $sql = "SELECT id FROM $l l WHERE l.category_id = $category AND type = ".(int) $resource_type." and ref_id = ".(int) $resource_id; $res = Database::query($sql); if (Database::num_rows($res)<1) { return false; @@ -285,15 +279,15 @@ function remove_resource_from_course_gradebook($link_id) { return true; } /** - * return the database name + * Return the database name * @param int * @return String */ function get_database_name_by_link_id($id_link) { $course_table = Database::get_main_table(TABLE_MAIN_COURSE); $tbl_grade_links = Database :: get_main_table(TABLE_MAIN_GRADEBOOK_LINK); - $res=Database::query('SELECT db_name from '.$course_table.' c inner join '.$tbl_grade_links.' l - on c.code=l.course_code WHERE l.id='.$id_link.' OR l.category_id='.$id_link); + $res=Database::query('SELECT db_name FROM '.$course_table.' c INNER JOIN '.$tbl_grade_links.' l + ON c.code=l.course_code WHERE l.id='.intval($id_link).' OR l.category_id='.intval($id_link)); $my_db_name=Database::fetch_array($res,'ASSOC'); return $my_db_name['db_name']; } @@ -402,8 +396,8 @@ function parse_xml_data($file) { function update_user_info_about_certificate ($cat_id,$user_id,$path_certificate) { $table_certificate = Database::get_main_table(TABLE_MAIN_GRADEBOOK_CERTIFICATE); if (!UserManager::is_user_certified($cat_id,$user_id)) { - $sql='UPDATE '.$table_certificate.' SET path_certificate="'.$path_certificate.'" - WHERE cat_id="'.$cat_id.'" AND user_id="'.$user_id.'" '; + $sql='UPDATE '.$table_certificate.' SET path_certificate="'.Database::escape_string($path_certificate).'" + WHERE cat_id="'.intval($cat_id).'" AND user_id="'.intval($user_id).'" '; $rs=Database::query($sql,__FILE__,__LINE__); } } @@ -419,12 +413,12 @@ function parse_xml_data($file) { function register_user_info_about_certificate ($cat_id,$user_id,$score_certificate, $date_certificate) { $table_certificate = Database::get_main_table(TABLE_MAIN_GRADEBOOK_CERTIFICATE); $sql_exist='SELECT COUNT(*) as count FROM '.$table_certificate.' gc - WHERE gc.cat_id="'.$cat_id.'" AND user_id="'.$user_id.'" '; + WHERE gc.cat_id="'.intval($cat_id).'" AND user_id="'.intval($user_id).'" '; $rs_exist=Database::query($sql_exist,__FILE__,__LINE__); $row=Database::fetch_array($rs_exist); if ($row['count']==0) { - echo $sql='INSERT INTO '.$table_certificate.' (cat_id,user_id,score_certificate,date_certificate) - VALUES("'.$cat_id.'","'.$user_id.'","'.$score_certificate.'","'.$date_certificate.'")'; + $sql='INSERT INTO '.$table_certificate.' (cat_id,user_id,score_certificate,date_certificate) + VALUES("'.intval($cat_id).'","'.intval($user_id).'","'.Database::escape_string($score_certificate).'","'.Database::escape_string($date_certificate).'")'; $rs=Database::query($sql,__FILE__,__LINE__); } @@ -437,7 +431,7 @@ function parse_xml_data($file) { */ function get_certificate_date_by_user_id ($cat_id,$user_id) { $table_certificate = Database::get_main_table(TABLE_MAIN_GRADEBOOK_CERTIFICATE); - $sql_get_date='SELECT date_certificate FROM '.$table_certificate.' WHERE cat_id="'.$cat_id.'" AND user_id="'.$user_id.'"'; + $sql_get_date='SELECT date_certificate FROM '.$table_certificate.' WHERE cat_id="'.intval($cat_id).'" AND user_id="'.intval($user_id).'"'; $rs_get_date=Database::query($sql_get_date,__FILE__,__LINE__); $row_get_date=Database::fetch_array($rs_get_date,'ASSOC'); return $row_get_date['date_certificate']; From b2b976c8c759f1e9acc7aef37acf593ea6d7aa26 Mon Sep 17 00:00:00 2001 From: Julio Montoya Date: Tue, 16 Mar 2010 10:27:47 -0500 Subject: [PATCH 7/9] Cleaning code, adding Security::remove_XSS, intval functions --- main/gradebook/gradebook_edit_all.php | 2 +- main/gradebook/index.php | 2 +- main/gradebook/lib/be/abstractlink.class.php | 2 +- main/gradebook/lib/be/evaluation.class.php | 4 ++-- main/gradebook/lib/be/linkfactory.class.php | 14 ++++++++------ 5 files changed, 13 insertions(+), 11 deletions(-) diff --git a/main/gradebook/gradebook_edit_all.php b/main/gradebook/gradebook_edit_all.php index 0733d55df9..30eed0e966 100755 --- a/main/gradebook/gradebook_edit_all.php +++ b/main/gradebook/gradebook_edit_all.php @@ -157,7 +157,7 @@ if ($my_api_cidreq=='') { } ?>
- +
diff --git a/main/gradebook/index.php b/main/gradebook/index.php index 96c87c52cd..ccf1af9796 100755 --- a/main/gradebook/index.php +++ b/main/gradebook/index.php @@ -714,7 +714,7 @@ if (isset ($_GET['studentoverview'])) { $pdf->ezText($organization_name,22,array('justification'=>'left')); $pdf->ezSetY(580); $pdf->ezText($portal_name,22,array('justification'=>'right')); - $pdf->ezStream(); + $pdf->ezStream();*/ } exit; } else { //in any other case (no search, no pdf), print the available gradebooks diff --git a/main/gradebook/lib/be/abstractlink.class.php b/main/gradebook/lib/be/abstractlink.class.php index df3d1d106a..571e9614f8 100755 --- a/main/gradebook/lib/be/abstractlink.class.php +++ b/main/gradebook/lib/be/abstractlink.class.php @@ -166,7 +166,7 @@ abstract class AbstractLink implements GradebookItem $sql .= ' visible = '.intval($visible); $paramcount ++; } - + $result = Database::query($sql); $links = AbstractLink::create_objects_from_sql_result($result); return $links; diff --git a/main/gradebook/lib/be/evaluation.class.php b/main/gradebook/lib/be/evaluation.class.php index b471b0c3d8..f99462c427 100755 --- a/main/gradebook/lib/be/evaluation.class.php +++ b/main/gradebook/lib/be/evaluation.class.php @@ -131,7 +131,7 @@ class Evaluation implements GradebookItem public function load ($id = null, $user_id = null, $course_code = null, $category_id = null, $visible = null) { $tbl_grade_evaluations = Database :: get_main_table(TABLE_MAIN_GRADEBOOK_EVALUATION); - $sql='SELECT id,name,description,user_id,course_code,category_id,date,weight,max,visible,type FROM '.$tbl_grade_evaluations; + $sql='SELECT id,name,description,user_id,course_code,category_id,created_at,weight,max,visible,type FROM '.$tbl_grade_evaluations; $paramcount = 0; if (isset ($id)) { $sql.= ' WHERE id = '.intval($id); @@ -161,7 +161,7 @@ class Evaluation implements GradebookItem $sql .= ' visible = '.intval($visible); $paramcount ++; } - + $result = Database::query($sql); $alleval = Evaluation::create_evaluation_objects_from_sql_result($result); return $alleval; diff --git a/main/gradebook/lib/be/linkfactory.class.php b/main/gradebook/lib/be/linkfactory.class.php index 1d4e4aaf5c..905f9912fc 100755 --- a/main/gradebook/lib/be/linkfactory.class.php +++ b/main/gradebook/lib/be/linkfactory.class.php @@ -6,13 +6,14 @@ // - add include // - change create() and get_all_types() // Please do not change existing values, they are used in the database ! -define('LINK_EXERCISE', 1); -define('LINK_DROPBOX',2); -define('LINK_STUDENTPUBLICATION',3); -define('LINK_LEARNPATH',4); -define('LINK_FORUM_THREAD',5); +define('LINK_EXERCISE', 1); +define('LINK_DROPBOX', 2); +define('LINK_STUDENTPUBLICATION', 3); +define('LINK_LEARNPATH', 4); +define('LINK_FORUM_THREAD', 5); //define('LINK_WORK',6); -define('LINK_ATTENDANCE',7); +define('LINK_ATTENDANCE', 7); + require_once 'gradebookitem.class.php'; require_once 'abstractlink.class.php'; require_once 'exerciselink.class.php'; @@ -22,6 +23,7 @@ require_once 'studentpublicationlink.class.php'; require_once 'learnpathlink.class.php'; require_once 'forumthreadlink.class.php'; require_once 'attendancelink.class.php'; + /** * Factory for link objects * @author Bert Steppé From 6eda50b26a9456c08b5f18e633e86924d8584d42 Mon Sep 17 00:00:00 2001 From: Carlos Vargas Date: Tue, 16 Mar 2010 10:55:06 -0500 Subject: [PATCH 8/9] new icons attendance --- main/img/attendance.gif | Bin 1280 -> 1260 bytes main/img/attendance_na.gif | Bin 813 -> 848 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/main/img/attendance.gif b/main/img/attendance.gif index 42ef08a90e7032a4d84d5fd4ee869dee98952f1d..211fe655d857937c711d8cc525680e029eb4cf50 100644 GIT binary patch literal 1260 zcmV=z!;`H$P+S=KM#&y-%)$8f$#N)noooctX zw*LD6^7HYA$!fFK>D=1g{QUg%^z@#@+wJY`?CI>*)z-%5!T$aIt<&oL`}^|i`l8C= zd92^>?CgMY1>+XE3-tO-1`S|(!`}>>D z==SyY_x1Po_V%N$pyuG>h_vEvrP!XHpp2-8+}PdQ-|DjBm-zDa<>Tkn;qvhA@a*gC z@$K>U_4Sv`>r-z{sHmuw)^Yv*|GduL_xARXzvgmna-q?Ye#K{hv*O0&zvJia_44y~ zsoR9B*2vDyf5m8~(dU}X=dsh};NIeSx@fi1*(z3>+bjR@`JnO=H%$`@9^yE?CtCA`1$zp>g}u2=lJ&c@a^#N?D6F7_}Aq0 z(%21m_3!%7(9qG-)Ya0}gvV;}>iOyB>gMF;rP__* z+351{@$&HUc%jdq(2n}~`O(wQ$H&K-yy0$cZNb97d3<=O-jSK1taq#5v$M1H@b>WW z@VB?O;^gRgui3xdxyr-Ka;VwD&B1rA*#7qaq{`u>&F0C=$c?19&dkn##%{>i?9Sio znak#JqSS-OYNO8Rw#?VV!^6bG#N_Gka<^dV@cFdR;mFU%f1=3C-0{HI=8(AK<>u#- z#pI*Y>6XdmrPS?Hd7fQ&lC7<+e68S8fT`o(gw&z+vWD~@qn)0Xqw9K?Cbsd`1bVn`S+ks9LlHU@#o7RC zgSljPhzN4naLp(T!bo`FR_9A12|l_E;`mPl2L~7+SE= z^n=Hb8spr7@fOcVHHRj$sM$k~#~*!9R;0MmZW|H_>6$dWw~ItLC;or{c~jy>jvSIc zTv^tsVHiIiEG?=~?}oKUrRY$=wtDIYb9uhd`}VAwU42eS0qmEKK`{2}PnlD+1hb zQvwEzdA^0ueHY84lb+4JwX6 z5Je0qqL|@^2MY8HF|J6#OdGsp5CIJ|RET0E1913H4>ceoiZjhbGs^`v&@e-eG?=0R zBR=+Eg8&3Hq761iz!1X>TyhyhC31v73QGcw00Rv>>|n#1K@h;l2_caAkD30}>E9D4 WOd#h!oKPXdpMc8nObh}A1OPjl04lox literal 1280 zcmV+b1^@a-Nk%w1VHN-u0O$Vz{~R6qC@P&~0MSfkpl1O1N>rw72=h)^scsDKR9~ob z8}wOY?OSGgb-jCex_*4Ux^kGHhZ}-`!G?s!i-f^}hsTD8!oY_gt%y{zib;%($m4sI zkB`fflfsac$&HoIn3T(^kie9c(XyZv&X^qIk2{){&6JqUoS4rx%>Y5l0HK-7qLsokQf*sG_~So~QuH9kT0GfT zYU93F!oa1xyx`@!eZjojd);M%;5YBX8@#{V{kulZzPW_u5x~FWh}x69!{xfg;JVOs z=EZl&#N)Zh>6F>7!p7tO#7*+dCgI1C$H(4}-lgfrjPK7U#>wW%$>5piOUcRY%EN%A%gf^E%#iKWHtf_uz0vB;&E@sfF3rsT&du`3&+_cepVrXN%+T%3&-%*I z|H9Sp%+u-8(&_WsJl4|W&(i(V)9S_9^7q|9z24!>*Z5<@6Y4>#OdY1>)+Pm{oUaH(dF^( z;=i*a4_~+>I=jZ<7>Hp&E z^VaVF;OzS8>h$F8_1^CP+wlDC?DymE{_XAf-tzzU?&tCE^Y`%E-1YkJ@cQ8N|JwHd z^YQiN_5Akp`26$i?)U%b`Tyek|N8g*`}qCn{{8m*{`vd({QCa#|Ns8{|Ns5_`Tzg? z|NH*`{Qv*|A^s6Va%Ew3Wn>_CX>@2HM@dak03rDV0SW;B04x9i000&M761SU{s8?6 zv?s8j!Gj13z7v(n5wn5>6B=wrW-@#;a zo+>s68lneA1#=rwcpIgqPX+`EW=tw&s%|a@8+^eKw($n9U9m6-AV8QAD^{gSfdY_V z*OXQQr$Cw($^aA^7g_*`6$D2R2mpEnQ-erg9WdfZxkz-0PZ=A#L6$fCU;= zjKD=B)ocS!7&n073OFmwBM=OGv_s4pTcm-9=8+9?9@9*g7=+xBI;Nalt>FJi1 zmcYQk?d|Qfw6yT>@a5&@rKP2llauP|>g43)=H}+g%F6Te^R>0LJ&d%K2+@z$WjEs!e*Vm$=qM)Fl($dn2iHVSqko)`l z_V)J3$jHIL!B|*W_4W0ho}Q7Bk(!#C{QUgI#l=!mQkj{V+S=Or`T4iEx8maBkB^UC zU0q~kWPg8usHmuegM*lunE3ekj*gE0{{CfUWt5bZUS3{TS69u=&APg})6>(~*x1I# z#{d8S000000000000000000000000000000000000000000000A^8LW0046UEC2ui z02Tli000O7fOCR^Q9CdZ5o;wbgN=?GFh?{E7Z)NTN;?#ejVo3Q9R~&z4+thg9#>qP za~lydD-r`C86X1%2sR!)1dbsv3l(W+8BiGo83Y9kLmpL*Q6CEwR2m>44<`i#5)Upy zBuR}aG&u$dP!<+52Lu!~2opRuAB|ug1_C)1F9b3y0lrKS;9y1r1&z??Krs--0tju? zENIXm3kw}3REV&_1A_`3Mot)@kRZksEjx<5Xwad8j03qhlmFg6i&ntkl+9S03ilE89-RW001rKOc=w1#f%3aFjT;z!9oBB4gwS~ zPyhe~K?llQFaZaH5jjsR2Ux8+K>);qPBe*d0o0oT4j2fyTp&OV2C(OJDG)RK>*zbfPbDdKmrgBCWeS;0w4eZ0s_JZU?K%U308u90N|TIf_n=bG&n(kevbOT a`2Rj|VxayU8aOB*V1NSl5P%?o002ARDS@;A literal 813 zcmV+|1Je9QNk%w1VHN-u0OkMy{r&y?{QUa*`uX|!`1ttt_V)Gl_4D)d^78WW@$vBR z@bB;M?(XjG?d|OB?Cb06>gww0>FMa`=;!C>=H}+*<>lk!g z$;rpZ$HvCS#l^+L!^6SB!M?t}y}iA>yu7=+ySlo%xw*NxxVW~qwzajjv$M0Zva+$U zv9PePudlDJuCA@Et*or9tE;Q3s;a4}si>%^rlzK)rKO{zqoSgsp`oFmprD_hpPikZ zoSdASo12=NnwgoImzS58mX?*3m6MZ`l9G~| zW@Tk%VPRoiU0qpOSyxwAP*6}#PEG&-00000000000000000000A^8LV2LS&7EC2ui z02Tli000O7fB=F5f`x{Mh=m6*H8mTBgo%b6Vn$LPUS3BR6%`p4 z2ucZ?JPss6F=uvkO&rVbNN?46qaG=!X$!>41#2YXrSRv7c+0j zJgGqA1`R7+fJkUTLJ*1=3O0~ILWBtuED?J2Xo7@GjR+-J2=cI_fCMg1a%$lb;l>Rn zSxg9t078Z!3Q7o6xWeYimMvdSxF|y7$P5_~GUO1HV2S`8anMXDu|&<42Hd)-ir^!F z+bIr;e9UPRr;Z&oWE42qi^0NPAd!}I5Fy76nl^Oc=-BHZMvfR99`qO>Xom^~A*PfO z!-T|x&l7?Su<*e`4grK>)IfCt2M!AhV#lVDz`~9qAqsIQa=<}~0UAaeP;jAy3~>g) r9cq#+g@X}1hAhc3f`KGLHGtT#k)XB#M4UDW8gO6$WkcZ)1p)v&12>Y% From bb145fd3deed22c0312bcc389396cedb22951f56 Mon Sep 17 00:00:00 2001 From: Yannick Warnier Date: Tue, 16 Mar 2010 11:13:05 -0500 Subject: [PATCH 9/9] Minor typo --- main/admin/sub_language.class.php | 38 ++++++++++++++++++++-------- main/inc/global.inc.php | 42 +++++++++++++++---------------- 2 files changed, 48 insertions(+), 32 deletions(-) diff --git a/main/admin/sub_language.class.php b/main/admin/sub_language.class.php index 7a03d1e64a..d8ad124e5a 100755 --- a/main/admin/sub_language.class.php +++ b/main/admin/sub_language.class.php @@ -213,26 +213,42 @@ class SubLanguageManager { /** * Make available the language * @param Integer The language id - * @return void() + * @return void */ - public static function make_available_language ($language_id) { + public static function make_available_language ($language_id) { $tbl_admin_languages= Database :: get_main_table(TABLE_MAIN_LANGUAGE); $sql_make_available = "UPDATE $tbl_admin_languages SET available='1' WHERE id='".Database::escape_string($language_id)."'"; $result = Database::query($sql_make_available); - } - /** - * Set platform language - * @param Integer The language id - * @return void() - */ - public static function set_platform_language ($language_id) { - $tbl_admin_languages= Database :: get_main_table(TABLE_MAIN_LANGUAGE); + } + /** + * Set platform language + * @param Integer The language id + * @return void() + */ + public static function set_platform_language ($language_id) { + $tbl_admin_languages = Database :: get_main_table(TABLE_MAIN_LANGUAGE); $tbl_settings_current = Database :: get_main_table(TABLE_MAIN_SETTINGS_CURRENT); $sql_update = "SELECT english_name FROM ". $tbl_admin_languages." WHERE id='".Database::escape_string($language_id)."'"; $result = Database::query($sql_update); $lang=Database::fetch_array($result); $sql_update_2 = "UPDATE ".$tbl_settings_current." SET selected_value='".$lang['english_name']."' WHERE variable='platformLanguage'"; $result_2 = Database::query($sql_update_2); - } + } + /** + * Get parent language path (or null if no parent) + * @param string Children language path + * @return string Parent language path or null + */ + public static function get_parent_language_path ($language_path) { + $tbl_admin_languages = Database :: get_main_table(TABLE_MAIN_LANGUAGE); + $tbl_settings_current = Database :: get_main_table(TABLE_MAIN_SETTINGS_CURRENT); + $sql_update = "SELECT dokeos_folder FROM ". $tbl_admin_languages." WHERE id=(SELECT parent_id FROM ". $tbl_admin_languages." WHERE dokeos_folder = '".Database::escape_string($language_path)."')"; + $result = Database::query($sql_update); + if (Database::num_rows($result) == 0) { + return null; + } + $row = Database::fetch_array($result); + return $row['dokeos_folder']; + } } ?> \ No newline at end of file diff --git a/main/inc/global.inc.php b/main/inc/global.inc.php index 27e25e7aec..e1c91c25a7 100755 --- a/main/inc/global.inc.php +++ b/main/inc/global.inc.php @@ -446,7 +446,7 @@ if (!empty($valid_languages)) { // to use it within the function get_lang(...). $language_interface_initial_value = $language_interface; -/* +/** * Include all necessary language files * - trad4all * - notification @@ -463,34 +463,34 @@ if (isset($language_file)) { $language_files = array_merge($language_files, $language_file); } } - +// if a set of language files has been properly defined if (is_array($language_files)) { + // if the sub-language feature is on if (api_get_setting('allow_use_sub_language') == 'true') { - foreach ($language_files as $index => $language_file) { + require_once api_get_path(SYS_CODE_PATH).'admin/sub_language.class.php'; + $parent_path = SubLanguageManager::get_parent_language_path($language_interface); + foreach ($language_files as $index => $language_file) { + // include English include $langpath.'english/'.$language_file.'.inc.php'; - $langfile = $langpath.$language_interface.'/'.$language_file.'.inc.php'; - - $tbl_admin_languages = Database :: get_main_table(TABLE_MAIN_LANGUAGE); - $sql_sub_language = 'SELECT dokeos_folder FROM '.$tbl_admin_languages.' WHERE parent_id=(SELECT id FROM '.$tbl_admin_languages.' WHERE dokeos_folder="'.Database::escape_string($language_interface).'" AND ISNULL(parent_id))'; - - $rs_sub_language = Database::query($sql_sub_language); - $num_row_sub_language = Database::num_rows($rs_sub_language); - - if (file_exists($langfile)) { - include $langfile; - for ($i = 0; $i < $num_row_sub_language; $i++) { - $row_sub_language = Database::result($rs_sub_language, $i, 'dokeos_folder'); - $sub_langfile = $langpath.$row_sub_language.'/'.$language_file.'.inc.php'; - if (file_exists($sub_langfile)) { - include $sub_langfile; - } - } - + // prepare string for current language and its parent + $lang_file = $langpath.$language_interface.'/'.$language_file.'.inc.php'; + $parent_lang_file = $langpath.$parent_path.'/'.$language_file.'.inc.php'; + // load the parent language file first + if (file_exists($parent_lang_file)) { + include $parent_lang_file; + } + // overwrite the parent language translations if there is a child + if (file_exists($lang_file)) { + include $lang_file; } } } else { + // if the sub-languages feature is not on, then just load the + // set language interface foreach ($language_files as $index => $language_file) { + // include English include $langpath.'english/'.$language_file.'.inc.php'; + // prepare string for current language $langfile = $langpath.$language_interface.'/'.$language_file.'.inc.php'; if (file_exists($langfile)) { include $langfile;