diff --git a/documentation/changelog.html b/documentation/changelog.html index e1829a4efd..79beef8eed 100755 --- a/documentation/changelog.html +++ b/documentation/changelog.html @@ -33,6 +33,8 @@
  • Added more quality at the icons
  • Fixed an encoding problem about database connection which is specific to Chinese language. The initial solution has been proposed by Oliver Corre (Bug #1802)
  • Multiple URL feature: Fixed Course user list (BT#1547)
    • +
  • Multiple URL feature: Fixed User List options when adding courses, users, sessions see BT#1470
    • +
  • Multiple URL feature: System Announcements and Global agenda now are filtered by URL see BT#1441
  • Deleting production user's file fixed see #1682

    • Security

    diff --git a/main/admin/calendar.lib.php b/main/admin/calendar.lib.php index 1bd8106331..87c7457414 100755 --- a/main/admin/calendar.lib.php +++ b/main/admin/calendar.lib.php @@ -681,7 +681,15 @@ function display_agenda_items() $repeats = array(); //placeholder for repeated events if (is_allowed_to_edit() && !api_is_anonymous()) { - $sql="SELECT * FROM ".$TABLEAGENDA.' ORDER BY start_date '.$_SESSION['sort']; + $sql="SELECT * FROM ".$TABLEAGENDA; + + global $_configuration; + $current_access_url_id = 1; + if ($_configuration['multiple_access_urls']) { + $current_access_url_id = api_get_current_access_url_id(); + } + $sql .= " WHERE access_url_id = $current_access_url_id"; + $sql .= ' ORDER BY start_date '.$_SESSION['sort']; //echo "
    ".$sql."
    "; $result=Database::query($sql) or die(Database::error()); $number_items=Database::num_rows($result); @@ -1680,18 +1688,22 @@ function display_upcoming_events() { /*if (api_is_allowed_to_edit()) {*/ //echo "course admin"; - $sqlquery = "SELECT - DISTINCT * - FROM ".$TABLEAGENDA." - ORDER BY start_date "; + $sqlquery = "SELECT DISTINCT * FROM ".$TABLEAGENDA; + + global $_configuration; + $current_access_url_id = 1; + if ($_configuration['multiple_access_urls']) { + $current_access_url_id = api_get_current_access_url_id(); + } + $sqlquery .= "WHERE access_url_id = $current_access_url_id "; + + $sqlquery .= " ORDER BY start_date "; //} // if the user is not an administrator of that course $result = Database::query($sqlquery); $counter = 0; - while ($item = Database::fetch_array($result,'ASSOC')) - { - if ($counter < $number_of_items_to_show) - { + while ($item = Database::fetch_array($result,'ASSOC')) { + if ($counter < $number_of_items_to_show) { echo $item['start_date'],' - ',$item['title'],'
    '; $counter++; } @@ -2843,11 +2855,15 @@ function agenda_add_item($course_info, $title, $content, $db_start_date, $db_end if ($count > 0) { return false; } - - $sql = "INSERT INTO ".$t_agenda." - (title,content, start_date, end_date) - VALUES - ('".$title."','".$content."', '".$start_date."','".$end_date."')"; + + global $_configuration; + $current_access_url_id = 1; + if ($_configuration['multiple_access_urls']) { + $current_access_url_id = api_get_current_access_url_id(); + } + + $sql = "INSERT INTO ".$t_agenda." (title,content, start_date, end_date, access_url_id) + VALUES ('".$title."','".$content."', '".$start_date."','".$end_date."', '".$current_access_url_id."')"; $result = Database::query($sql) or die (Database::error()); $last_id=Database::insert_id(); @@ -2902,8 +2918,7 @@ function agenda_add_item($course_info, $title, $content, $db_start_date, $db_end * @param array Original event's destination * @return boolean False if error, True otherwise */ - function get_calendar_items($month, $year) -{ + function get_calendar_items($month, $year) { global $_user, $_course; global $is_allowed_to_edit; @@ -2922,12 +2937,19 @@ function agenda_add_item($course_info, $title, $content, $db_start_date, $db_end $repeats = array(); $data=array(); if (is_allowed_to_edit()) { - $sql="SELECT - DISTINCT * + $sql="SELECT DISTINCT * FROM ".$TABLEAGENDA." agenda - WHERE MONTH(start_date)='".$month."' AND YEAR(start_date)='".$year."' - GROUP BY id ". - "ORDER BY start_date "; + WHERE MONTH(start_date)='".$month."' AND YEAR(start_date)='".$year."'"; + + global $_configuration; + $current_access_url_id = 1; + if ($_configuration['multiple_access_urls']) { + $current_access_url_id = api_get_current_access_url_id(); + } + $sql .= " AND access_url_id = '$current_access_url_id' "; + + $sql .= "GROUP BY id ORDER BY start_date "; + $result=Database::query($sql); while ($row=Database::fetch_array($result)) { diff --git a/main/calendar/agenda.inc.php b/main/calendar/agenda.inc.php index cd8ca40cf5..2a7de9bdc5 100755 --- a/main/calendar/agenda.inc.php +++ b/main/calendar/agenda.inc.php @@ -259,13 +259,21 @@ function get_calendar_items($month, $year) { $data[$datum_item][$datum_item][] = $row; } } - /* - //Check global agenda events */ + + /* Check global agenda events */ $table_agenda_system = Database :: get_main_table(TABLE_MAIN_SYSTEM_CALENDAR); + + global $_configuration; + $current_access_url_id = 1; + if ($_configuration['multiple_access_urls']) { + $current_access_url_id = api_get_current_access_url_id(); + } + $sql = "SELECT DISTINCT * FROM ".$table_agenda_system." WHERE MONTH(start_date)='".$month."' - AND YEAR(start_date)='".$year."' + AND YEAR(start_date)='".$year."' + AND access_url_id = '$current_access_url_id' ORDER BY start_date "; $result=Database::query($sql); while ($row = Database::fetch_array($result, 'ASSOC')) { @@ -2039,8 +2047,14 @@ function display_agenda_items($select_month, $select_year) { //Check global agenda events */ $table_agenda_system = Database :: get_main_table(TABLE_MAIN_SYSTEM_CALENDAR); + global $_configuration; + $current_access_url_id = 1; + if ($_configuration['multiple_access_urls']) { + $current_access_url_id = api_get_current_access_url_id(); + } + $sql = "SELECT DISTINCT id, title, content , start_date, end_date FROM ".$table_agenda_system." - WHERE 1=1 ".$show_all_current." + WHERE 1=1 ".$show_all_current." AND access_url_id = $current_access_url_id ORDER BY start_date "; $result=Database::query($sql); while ($row = Database::fetch_array($result, 'ASSOC')) { @@ -4685,19 +4699,26 @@ function agenda_import_ical($course_info,$file) { * @param string Type of view (month_view, week_view, day_view) * @return array The results of the database query, or null if not found */ -function get_global_agenda_items($agendaitems, $day = "", $month = "", $year = "", $week = "", $type) -{ +function get_global_agenda_items($agendaitems, $day = "", $month = "", $year = "", $week = "", $type) { + global $_user, $_configuration; + $tbl_global_agenda= Database::get_main_table(TABLE_MAIN_SYSTEM_CALENDAR); - global $_user; - global $_configuration; + $month=Database::escape_string($month); $year=Database::escape_string($year); $week=Database::escape_string($week); $day=Database::escape_string($day); // 1. creating the SQL statement for getting the personal agenda items in MONTH view - if ($type == "month_view" or $type == "") // we are in month view - { - $sql = "SELECT * FROM ".$tbl_global_agenda." WHERE MONTH(start_date)='".$month."' AND YEAR(start_date) = '".$year."' ORDER BY start_date ASC"; + + global $_configuration; + $current_access_url_id = 1; + if ($_configuration['multiple_access_urls']) { + $current_access_url_id = api_get_current_access_url_id(); + } + + if ($type == "month_view" or $type == "") { + // We are in month view + $sql = "SELECT * FROM ".$tbl_global_agenda." WHERE MONTH(start_date)='".$month."' AND YEAR(start_date) = '".$year."' AND access_url_id = $current_access_url_id ORDER BY start_date ASC"; } // 2. creating the SQL statement for getting the personal agenda items in WEEK view if ($type == "week_view") // we are in week view @@ -4712,7 +4733,7 @@ function get_global_agenda_items($agendaitems, $day = "", $month = "", $year = " // in sql statements you have to use year-month-day for date calculations $start_filter = $start_year."-".$start_month."-".$start_day." 00:00:00"; $end_filter = $end_year."-".$end_month."-".$end_day." 23:59:59"; - $sql = " SELECT * FROM ".$tbl_global_agenda." WHERE start_date>='".$start_filter."' AND start_date<='".$end_filter."'"; + $sql = " SELECT * FROM ".$tbl_global_agenda." WHERE start_date>='".$start_filter."' AND start_date<='".$end_filter."' AND access_url_id = $current_access_url_id "; } // 3. creating the SQL statement for getting the personal agenda items in DAY view if ($type == "day_view") // we are in day view @@ -4720,8 +4741,9 @@ function get_global_agenda_items($agendaitems, $day = "", $month = "", $year = " // we could use mysql date() function but this is only available from 4.1 and higher $start_filter = $year."-".$month."-".$day." 00:00:00"; $end_filter = $year."-".$month."-".$day." 23:59:59"; - $sql = " SELECT * FROM ".$tbl_global_agenda." WHERE start_date>='".$start_filter."' AND start_date<='".$end_filter."'"; + $sql = " SELECT * FROM ".$tbl_global_agenda." WHERE start_date>='".$start_filter."' AND start_date<='".$end_filter."' AND access_url_id = $current_access_url_id"; } + $result = Database::query($sql); while ($item = Database::fetch_array($result)) { @@ -4740,13 +4762,10 @@ function get_global_agenda_items($agendaitems, $day = "", $month = "", $year = " $minute = $agendatime[1]; $second = $agendatime[2]; // if the student has specified a course we a add a link to that course - if ($item['course'] <> "") - { + if ($item['course'] <> "") { $url = $_configuration['root_web']."main/admin/agenda.php?cidReq=".urlencode($item['course'])."&day=$day&month=$month&year=$year#$day"; // RH //Patrick Cool: to highlight the relevant agenda item $course_link = "".$item['course'].""; - } - else - { + } else { $course_link = ""; } // Creating the array that will be returned. If we have week or month view we have an array with the date as the key diff --git a/main/inc/lib/system_announcements.lib.php b/main/inc/lib/system_announcements.lib.php index 918693d7c3..50fdc1e107 100755 --- a/main/inc/lib/system_announcements.lib.php +++ b/main/inc/lib/system_announcements.lib.php @@ -33,6 +33,15 @@ class SystemAnnouncementManager $sql .= " AND visible_teacher = 1 "; break; } + + global $_configuration; + $current_access_url_id = 1; + if ($_configuration['multiple_access_urls']) { + $current_access_url_id = api_get_current_access_url_id(); + } + $sql .= " AND access_url_id = '$current_access_url_id' "; + + $sql .= " ORDER BY date_start DESC LIMIT 0,7"; $announcements = Database::query($sql); @@ -87,6 +96,7 @@ class SystemAnnouncementManager $db_table = Database :: get_main_table(TABLE_MAIN_SYSTEM_ANNOUNCEMENTS); $sql = "SELECT *, DATE_FORMAT(date_start,'%d-%m-%Y %h:%i:%s') AS display_date FROM ".$db_table." WHERE (lang='$user_selected_language' OR lang IS NULL) AND ((NOW() BETWEEN date_start AND date_end) OR date_end='0000-00-00')"; + switch ($visible) { case VISIBLE_GUEST : $sql .= " AND visible_guest = 1 "; @@ -98,6 +108,13 @@ class SystemAnnouncementManager $sql .= " AND visible_teacher = 1 "; break; } + + global $_configuration; + $current_access_url_id = 1; + if ($_configuration['multiple_access_urls']) { + $current_access_url_id = api_get_current_access_url_id(); + } + $sql .= " AND access_url_id = '$current_access_url_id' "; if(!isset($_GET['start']) || $_GET['start'] == 0) { $sql .= " ORDER BY date_start DESC LIMIT ".$start.",20"; @@ -191,6 +208,15 @@ class SystemAnnouncementManager break; } } + + global $_configuration; + $current_access_url_id = 1; + if ($_configuration['multiple_access_urls']) { + $current_access_url_id = api_get_current_access_url_id(); + } + $sql .= " AND access_url_id = '$current_access_url_id' "; + + $sql .= 'LIMIT '.$start.',21'; $announcements = Database::query($sql); $i = 0; @@ -210,7 +236,17 @@ class SystemAnnouncementManager { $db_table = Database :: get_main_table(TABLE_MAIN_SYSTEM_ANNOUNCEMENTS); - $sql = "SELECT *, IF( NOW() BETWEEN date_start AND date_end, '1', '0') AS visible FROM ".$db_table." ORDER BY date_start ASC"; + $sql = "SELECT *, IF( NOW() BETWEEN date_start AND date_end, '1', '0') AS visible FROM ".$db_table." "; + + + global $_configuration; + $current_access_url_id = 1; + if ($_configuration['multiple_access_urls']) { + $current_access_url_id = api_get_current_access_url_id(); + } + $sql .= " WHERE access_url_id = '$current_access_url_id' "; + $sql .= "ORDER BY date_start ASC"; + $announcements = Database::query($sql); $all_announcements = array(); while ($announcement = Database::fetch_object($announcements)) { @@ -267,8 +303,15 @@ class SystemAnnouncementManager $content = str_replace('file=/home/', 'file='.api_get_path(WEB_PATH).'home/', $content); $langsql = is_null($lang) ? 'NULL' : "'".Database::escape_string($lang)."'"; - $sql = "INSERT INTO ".$db_table." (title,content,date_start,date_end,visible_teacher,visible_student,visible_guest, lang) - VALUES ('".$title."','".$content."','".$start."','".$end."','".$visible_teacher."','".$visible_student."','".$visible_guest."',".$langsql.")"; + + global $_configuration; + $current_access_url_id = 1; + if ($_configuration['multiple_access_urls']) { + $current_access_url_id = api_get_current_access_url_id(); + } + + $sql = "INSERT INTO ".$db_table." (title,content,date_start,date_end,visible_teacher,visible_student,visible_guest, lang, access_url_id) + VALUES ('".$title."','".$content."','".$start."','".$end."','".$visible_teacher."','".$visible_student."','".$visible_guest."',".$langsql.", ".$current_access_url_id.")"; if ($send_mail==1) { SystemAnnouncementManager::send_system_announcement_by_email($title, $content,$visible_teacher, $visible_student, $lang); } @@ -321,10 +364,16 @@ class SystemAnnouncementManager //Fixing urls that are sent by email $content = str_replace('src=\"/home/', 'src=\"'.api_get_path(WEB_PATH).'home/', $content); $content = str_replace('file=/home/', 'file='.api_get_path(WEB_PATH).'home/', $content); - + + global $_configuration; + $current_access_url_id = 1; + if ($_configuration['multiple_access_urls']) { + $current_access_url_id = api_get_current_access_url_id(); + } + $id = intval($id); $sql = "UPDATE ".$db_table." SET lang=$langsql,title='".$title."',content='".$content."',date_start='".$start."',date_end='".$end."', "; - $sql .= " visible_teacher = '".$visible_teacher."', visible_student = '".$visible_student."', visible_guest = '".$visible_guest."' WHERE id='".$id."'"; + $sql .= " visible_teacher = '".$visible_teacher."', visible_student = '".$visible_student."', visible_guest = '".$visible_guest."' , access_url_id = '".$current_access_url_id."' WHERE id='".$id."'"; if ($send_mail==1) { SystemAnnouncementManager::send_system_announcement_by_email($title, $content,$visible_teacher, $visible_student, $lang); @@ -411,6 +460,15 @@ class SystemAnnouncementManager if (!empty($language)) { //special condition because language was already treated for SQL insert before $sql .= " AND language = '".Database::escape_string($language)."' "; } + + global $_configuration; + $current_access_url_id = 1; + if ($_configuration['multiple_access_urls']) { + $current_access_url_id = api_get_current_access_url_id(); + } + $sql .= " AND access_url_id = '".$current_access_url_id."' "; + + if ($teacher == '0' AND $student == '0') { return true; } @@ -422,5 +480,4 @@ class SystemAnnouncementManager $res = @api_mail_html(api_get_person_name($row['firstname'], $row['lastname'], null, PERSON_NAME_EMAIL_ADDRESS), $row['email'], api_html_entity_decode(stripslashes($title), ENT_QUOTES, $charset), api_html_entity_decode(stripslashes(str_replace(array('\r\n', '\n', '\r'),'',$content)), ENT_QUOTES, $charset), api_get_person_name(api_get_setting('administratorName'), api_get_setting('administratorSurname'), null, PERSON_NAME_EMAIL_ADDRESS), api_get_setting('emailAdministrator')); } } -} -?> \ No newline at end of file +} \ No newline at end of file diff --git a/main/install/db_main.sql b/main/install/db_main.sql index 2bda4479f9..12b19d8434 100755 --- a/main/install/db_main.sql +++ b/main/install/db_main.sql @@ -1000,6 +1000,7 @@ CREATE TABLE sys_announcement ( title varchar(250) NOT NULL default '', content text NOT NULL, lang varchar(70) NULL default NULL, + access_url_id INT NOT NULL default 1, PRIMARY KEY (id) ); @@ -1294,6 +1295,7 @@ CREATE TABLE IF NOT EXISTS sys_calendar ( content text, start_date datetime NOT NULL default '0000-00-00 00:00:00', end_date datetime NOT NULL default '0000-00-00 00:00:00', + access_url_id INT NOT NULL default 1, PRIMARY KEY (id) ); diff --git a/main/install/migrate-db-1.8.7-1.8.8-pre.sql b/main/install/migrate-db-1.8.7-1.8.8-pre.sql index 7e2c8d7303..0ae7a4a1bf 100755 --- a/main/install/migrate-db-1.8.7-1.8.8-pre.sql +++ b/main/install/migrate-db-1.8.7-1.8.8-pre.sql @@ -33,4 +33,7 @@ UPDATE settings_current SET selected_value = '1.8.8.12378' WHERE variable = 'cha ALTER TABLE course_setting CONVERT TO CHARACTER SET utf8 COLLATE utf8_general_ci; ALTER TABLE forum_forum ADD start_time DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00'; ALTER TABLE forum_forum ADD end_time DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00'; -ALTER TABLE wiki_mailcue ADD session_id smallint DEFAULT 0; \ No newline at end of file +ALTER TABLE wiki_mailcue ADD session_id smallint DEFAULT 0; + +ALTER TABLE sys_announcement ADD COLUMN access_url_id INT NOT NULL default 1; +ALTER TABLE sys_calendar ADD COLUMN access_url_id INT NOT NULL default 1;