From 6e07810c6428f25865bf73038872e4efcaf2f25a Mon Sep 17 00:00:00 2001
From: Julio Montoya <gugli100@gmail.com>
Date: Mon, 25 Feb 2019 15:47:07 +0100
Subject: [PATCH] Minor - 1.11.x fixes

---
 main/inc/ajax/agenda.ajax.php                 |  1 +
 main/inc/ajax/course_home.ajax.php            | 20 +++---
 main/inc/ajax/exercise.ajax.php               |  6 +-
 main/inc/ajax/model.ajax.php                  | 11 +++-
 main/inc/ajax/sequence.ajax.php               | 30 +++++++--
 main/inc/ajax/user_manager.ajax.php           | 28 ++++----
 main/inc/ajax/work.ajax.php                   |  3 +-
 main/inc/lib/TicketManager.php                | 64 +++++++++----------
 main/lp/learnpath.class.php                   | 44 ++++++-------
 .../Component/Editor/Driver/CourseDriver.php  |  1 -
 10 files changed, 117 insertions(+), 91 deletions(-)

diff --git a/main/inc/ajax/agenda.ajax.php b/main/inc/ajax/agenda.ajax.php
index e4453d2db6..7af342ea9b 100755
--- a/main/inc/ajax/agenda.ajax.php
+++ b/main/inc/ajax/agenda.ajax.php
@@ -1,5 +1,6 @@
 <?php
 /* For licensing terms, see /license.txt */
+
 /**
  * Responses to AJAX calls.
  */
diff --git a/main/inc/ajax/course_home.ajax.php b/main/inc/ajax/course_home.ajax.php
index cbf99f9827..bfd09fda4b 100755
--- a/main/inc/ajax/course_home.ajax.php
+++ b/main/inc/ajax/course_home.ajax.php
@@ -139,17 +139,17 @@ switch ($action) {
         require_once __DIR__.'/../global.inc.php';
 
         // Get the name of the database course.
-        $tbl_course_description = Database::get_course_table(TABLE_COURSE_DESCRIPTION);
         $course_info = api_get_course_info($_GET['code']);
-
+        $content = get_lang('NoDescription');
+        if (!empty($course_info)) {
         if (api_get_setting('course_catalog_hide_private') === 'true' &&
             $course_info['visibility'] == COURSE_VISIBILITY_REGISTERED
         ) {
             echo get_lang('PrivateAccess');
             break;
         }
-
-        $sql = "SELECT * FROM $tbl_course_description
+            $table = Database::get_course_table(TABLE_COURSE_DESCRIPTION);
+            $sql = "SELECT * FROM $table
                 WHERE c_id = ".$course_info['real_id']." AND session_id = 0
                 ORDER BY id";
         $result = Database::query($sql);
@@ -157,17 +157,15 @@ switch ($action) {
             while ($description = Database::fetch_object($result)) {
                 $descriptions[$description->id] = $description;
             }
-            $extraField = new ExtraField('course');
-            $fieldValues = $extraField->getDataAndFormattedValues($course_info['real_id']);
 
-            // Function that displays the details of the course description in html.
-            echo CourseManager::get_details_course_description_html(
+                $content = CourseManager::get_details_course_description_html(
                 $descriptions,
-                $fieldValues
+                    api_get_system_encoding(),
+                    false
             );
-        } else {
-            echo get_lang('NoDescription');
         }
+        }
+        echo $content;
         break;
     case 'session_courses_lp_default':
         /**
diff --git a/main/inc/ajax/exercise.ajax.php b/main/inc/ajax/exercise.ajax.php
index 92ce1cf6f9..ff7f56ea64 100755
--- a/main/inc/ajax/exercise.ajax.php
+++ b/main/inc/ajax/exercise.ajax.php
@@ -730,7 +730,11 @@ switch ($action) {
         $objExercise = new Exercise();
         $objExercise->read($exerciseId);
         $objQuestion = Question::read($questionId);
-
+        $id = '';
+        if (api_get_configuration_value('show_question_id')) {
+            $id = '<h4>#'.$objQuestion->course['code'].'-'.$objQuestion->iid.'</h4>';
+        }
+        echo $id;
         echo '<p class="lead">'.$objQuestion->get_question_type_name().'</p>';
         if ($objQuestion->type === FILL_IN_BLANKS) {
             echo '<script>
diff --git a/main/inc/ajax/model.ajax.php b/main/inc/ajax/model.ajax.php
index b3b78b82b3..92e12ccf30 100755
--- a/main/inc/ajax/model.ajax.php
+++ b/main/inc/ajax/model.ajax.php
@@ -842,7 +842,7 @@ switch ($action) {
             '*',
             $object->table,
             [
-                'where' => ["session_id = ? " => $sessionId],
+                'where' => ['session_id = ? ' => $sessionId],
                 'order' => "$sidx $sord",
                 'LIMIT' => "$start , $limit", ]
         );
@@ -1425,6 +1425,9 @@ switch ($action) {
         break;
     case 'get_sessions_tracking':
         if (api_is_drh() || api_is_session_admin()) {
+            $orderByName = Database::escape_string($sidx);
+            $orderByName = in_array($orderByName, ['name', 'access_start_date']) ? $orderByName : 'name';
+            $orderBy = " ORDER BY $orderByName $sord";
             $sessions = SessionManager::get_sessions_followed_by_drh(
                 api_get_user_id(),
                 $start,
@@ -1432,7 +1435,7 @@ switch ($action) {
                 false,
                 false,
                 false,
-                null,
+                $orderBy,
                 $keyword,
                 $description
             );
@@ -1444,7 +1447,9 @@ switch ($action) {
                 $limit,
                 false,
                 $keyword,
-                $description
+                $description,
+                $sidx,
+                $sord
             );
         }
 
diff --git a/main/inc/ajax/sequence.ajax.php b/main/inc/ajax/sequence.ajax.php
index fd7e346a40..a53a57f901 100644
--- a/main/inc/ajax/sequence.ajax.php
+++ b/main/inc/ajax/sequence.ajax.php
@@ -42,12 +42,24 @@ switch ($action) {
                     $graphviz = new GraphViz();
                     $graphImage = '';
                     try {
-                        $graphImage = $graphviz->createImageHtml($graph);
+                        $graphImage = $graphviz->createImageSrc($graph);
+
+                        echo Display::img(
+                            $graphImage,
+                            get_lang('GraphDependencyTree'),
+                            ['class' => 'center-block'],
+                            false
+                        );
                     } catch (UnexpectedValueException $e) {
-                        error_log($e->getMessage().' - Graph could not be rendered in resources sequence because GraphViz command "dot" could not be executed - Make sure graphviz is installed.');
-                        $graphImage = '<p class="text-center"><small>'.get_lang('MissingChartLibraryPleaseCheckLog').'</small></p>';
+                        error_log(
+                            $e->getMessage()
+                            .' - Graph could not be rendered in resources sequence'
+                            .' because GraphViz command "dot" could not be executed '
+                            .'- Make sure graphviz is installed.'
+                        );
+                        echo '<p class="text-center"><small>'.get_lang('MissingChartLibraryPleaseCheckLog')
+                            .'</small></p>';
                     }
-                    echo $graphImage;
                 }
                 break;
         }
@@ -94,7 +106,15 @@ switch ($action) {
                     $link .= '<div class="big-icon">';
                     $link .= $image;
                     $link .= '<div class="sequence-course">'.$sessionInfo['name'].'</div>';
-                    $link .= '<a href="#" class="sequence-id">'.$id.'</a>';
+                    $link .= Display::tag(
+                        'button',
+                        $id,
+                        [
+                            'class' => 'sequence-id',
+                            'title' => get_lang('UseAsReference'),
+                            'type' => 'button',
+                        ]
+                    );
                     $link .= $linkDelete;
                     $link .= $linkUndo;
                     $link .= '</div></div>';
diff --git a/main/inc/ajax/user_manager.ajax.php b/main/inc/ajax/user_manager.ajax.php
index aebbbebf59..2aba092f8a 100755
--- a/main/inc/ajax/user_manager.ajax.php
+++ b/main/inc/ajax/user_manager.ajax.php
@@ -14,21 +14,23 @@ $action = $_GET['a'];
 
 switch ($action) {
     case 'get_user_like':
-        $query = $_REQUEST['q'];
-        $conditions = [
-            'username' => $query,
-            'firstname' => $query,
-            'lastname' => $query,
-        ];
-        $users = UserManager::getUserListLike($conditions, [], false, 'OR');
-        $result = [];
-        if (!empty($users)) {
-            foreach ($users as $user) {
-                $result[] = ['id' => $user['id'], 'text' => $user['complete_name'].' ('.$user['username'].')'];
+        if (api_is_platform_admin() || api_is_drh()) {
+            $query = $_REQUEST['q'];
+            $conditions = [
+                'username' => $query,
+                'firstname' => $query,
+                'lastname' => $query,
+            ];
+            $users = UserManager::getUserListLike($conditions, [], false, 'OR');
+            $result = [];
+            if (!empty($users)) {
+                foreach ($users as $user) {
+                    $result[] = ['id' => $user['id'], 'text' => $user['complete_name'].' ('.$user['username'].')'];
+                }
+                $result['items'] = $result;
             }
-            $result['items'] = $result;
+            echo json_encode($result);
         }
-        echo json_encode($result);
         break;
     case 'get_user_popup':
         $courseId = isset($_REQUEST['course_id']) ? (int) $_REQUEST['course_id'] : 0;
diff --git a/main/inc/ajax/work.ajax.php b/main/inc/ajax/work.ajax.php
index 3e26d0742b..d50c872271 100755
--- a/main/inc/ajax/work.ajax.php
+++ b/main/inc/ajax/work.ajax.php
@@ -64,7 +64,8 @@ switch ($action) {
 
                 $json = [];
                 if (!empty($result) && is_array($result) && empty($result['error'])) {
-                    $json['name'] = Display::url(
+                    $json['name'] = api_htmlentities($result['title']);
+                    $json['link'] = Display::url(
                         api_htmlentities($result['title']),
                         api_htmlentities($result['view_url']),
                         ['target' => '_blank']
diff --git a/main/inc/lib/TicketManager.php b/main/inc/lib/TicketManager.php
index 0b72d3f959..1293a3c0c0 100644
--- a/main/inc/lib/TicketManager.php
+++ b/main/inc/lib/TicketManager.php
@@ -50,6 +50,7 @@ class TicketManager
         $table_support_project = Database::get_main_table(TABLE_TICKET_PROJECT);
 
         $order = empty($order) ? 'category.total_tickets DESC' : $order;
+        $order = Database::escape_string($order);
         $projectId = (int) $projectId;
 
         $sql = "SELECT 
@@ -89,9 +90,9 @@ class TicketManager
         if (!in_array($direction, ['ASC', 'DESC'])) {
             $direction = 'ASC';
         }
-        $column = intval($column);
-        $from = intval($from);
-        $numberItems = intval($numberItems);
+        $column = (int) $column;
+        $from = (int) $from;
+        $numberItems = (int) $numberItems;
 
         //$sql .= " ORDER BY col$column $direction ";
         $sql .= " LIMIT $from,$numberItems";
@@ -166,7 +167,7 @@ class TicketManager
      */
     public static function deleteCategory($id)
     {
-        $id = intval($id);
+        $id = (int) $id;
         if (empty($id)) {
             return false;
         }
@@ -260,7 +261,7 @@ class TicketManager
     public static function get_all_tickets_status()
     {
         $table = Database::get_main_table(TABLE_TICKET_STATUS);
-        $sql = "SELECT * FROM ".$table;
+        $sql = "SELECT * FROM $table";
         $result = Database::query($sql);
         $types = [];
         while ($row = Database::fetch_assoc($result)) {
@@ -590,11 +591,11 @@ class TicketManager
             return false;
         }
 
-        $table_support_tickets = Database::get_main_table(TABLE_TICKET_TICKET);
         $ticket = self::get_ticket_detail_by_id($ticketId);
 
         if ($ticket) {
-            $sql = "UPDATE $table_support_tickets
+            $table = Database::get_main_table(TABLE_TICKET_TICKET);
+            $sql = "UPDATE $table
                     SET assigned_last_user = $userId
                     WHERE id = $ticketId";
             Database::query($sql);
@@ -641,10 +642,13 @@ class TicketManager
         $table_support_messages = Database::get_main_table(TABLE_TICKET_MESSAGE);
         $table_support_tickets = Database::get_main_table(TABLE_TICKET_TICKET);
         if ($sendConfirmation) {
-            $form = '<form action="ticket_details.php?ticket_id='.$ticketId.'" id="confirmticket" method="POST" >
+            $form =
+                '<form action="ticket_details.php?ticket_id='.$ticketId.'" id="confirmticket" method="POST" >
                          <p>'.get_lang('TicketWasThisAnswerSatisfying').'</p>
-                         <button class="btn btn-primary responseyes" name="response" id="responseyes" value="1">'.get_lang('Yes').'</button>
-                         <button class="btn btn-danger responseno" name="response" id="responseno" value="0">'.get_lang('No').'</button>
+                     <button class="btn btn-primary responseyes" name="response" id="responseyes" value="1">'.
+                get_lang('Yes').'</button>
+                     <button class="btn btn-danger responseno" name="response" id="responseno" value="0">'.
+                get_lang('No').'</button>
                      </form>';
             $content .= $form;
         }
@@ -713,7 +717,7 @@ class TicketManager
     ) {
         $now = api_get_utc_datetime();
         $userId = api_get_user_id();
-        $ticketId = intval($ticketId);
+        $ticketId = (int) $ticketId;
         $new_file_name = add_ext_on_mime(
             stripslashes($file_attach['name']),
             $file_attach['type']
@@ -986,7 +990,7 @@ class TicketManager
             }
             if ($isAdmin) {
                 $ticket['0'] .= '&nbsp;&nbsp;<a  href="javascript:void(0)" onclick="load_history_ticket(\'div_'.$row['ticket_id'].'\','.$row['ticket_id'].')">
-					<img onclick="load_course_list(\'div_'.$row['ticket_id'].'\','.$row['ticket_id'].')" onmouseover="clear_course_list (\'div_'.$row['ticket_id'].'\')" src="'.Display::returnIconPath('history.png').'" title="'.get_lang('Historial').'" alt="'.get_lang('Historial').'"/>
+					<img onclick="load_course_list(\'div_'.$row['ticket_id'].'\','.$row['ticket_id'].')" onmouseover="clear_course_list (\'div_'.$row['ticket_id'].'\')" src="'.Display::returnIconPath('history.gif').'" title="'.get_lang('Historial').'" alt="'.get_lang('Historial').'"/>
 					<div class="blackboard_hide" id="div_'.$row['ticket_id'].'">&nbsp;&nbsp;</div>
 					</a>&nbsp;&nbsp;';
             }
@@ -1144,7 +1148,7 @@ class TicketManager
      */
     public static function get_ticket_detail_by_id($ticketId)
     {
-        $ticketId = intval($ticketId);
+        $ticketId = (int) $ticketId;
         $table_support_category = Database::get_main_table(TABLE_TICKET_CATEGORY);
         $table_support_tickets = Database::get_main_table(TABLE_TICKET_TICKET);
         $table_support_priority = Database::get_main_table(TABLE_TICKET_PRIORITY);
@@ -1232,7 +1236,8 @@ class TicketManager
                 $result_attach = Database::query($sql);
                 while ($row2 = Database::fetch_assoc($result_attach)) {
                     $archiveURL = $webPath.'ticket/download.php?ticket_id='.$ticketId.'&id='.$row2['id'];
-                    $row2['attachment_link'] = $attach_icon.'&nbsp;<a href="'.$archiveURL.'">'.$row2['filename'].'</a>&nbsp;('.$row2['size'].')';
+                    $row2['attachment_link'] = $attach_icon.
+                        '&nbsp;<a href="'.$archiveURL.'">'.$row2['filename'].'</a>&nbsp;('.$row2['size'].')';
                     $message['attachments'][] = $row2;
                 }
                 $ticket['messages'][] = $message;
@@ -1250,11 +1255,9 @@ class TicketManager
      */
     public static function update_message_status($ticketId, $userId)
     {
-        $ticketId = intval($ticketId);
-        $userId = intval($userId);
-        $table_support_messages = Database::get_main_table(
-            TABLE_TICKET_MESSAGE
-        );
+        $ticketId = (int) $ticketId;
+        $userId = (int) $userId;
+        $table_support_messages = Database::get_main_table(TABLE_TICKET_MESSAGE);
         $table_support_tickets = Database::get_main_table(TABLE_TICKET_TICKET);
         $now = api_get_utc_datetime();
         $sql = "UPDATE $table_support_messages
@@ -1433,11 +1436,11 @@ class TicketManager
     ) {
         $table_support_tickets = Database::get_main_table(TABLE_TICKET_TICKET);
 
-        $ticketId = intval($ticketId);
-        $status_id = intval($status_id);
-        $userId = intval($userId);
-
+        $ticketId = (int) $ticketId;
+        $status_id = (int) $status_id;
+        $userId = (int) $userId;
         $now = api_get_utc_datetime();
+
         $sql = "UPDATE $table_support_tickets
                 SET
                     status_id = '$status_id',
@@ -1465,9 +1468,7 @@ class TicketManager
     public static function getNumberOfMessages()
     {
         $table_support_tickets = Database::get_main_table(TABLE_TICKET_TICKET);
-        $table_support_messages = Database::get_main_table(
-            TABLE_TICKET_MESSAGE
-        );
+        $table_support_messages = Database::get_main_table(TABLE_TICKET_MESSAGE);
         $table_main_user = Database::get_main_table(TABLE_MAIN_USER);
         $table_main_admin = Database::get_main_table(TABLE_MAIN_ADMIN);
         $user_info = api_get_user_info();
@@ -1520,8 +1521,8 @@ class TicketManager
      */
     public static function close_ticket($ticketId, $userId)
     {
-        $ticketId = intval($ticketId);
-        $userId = intval($userId);
+        $ticketId = (int) $ticketId;
+        $userId = (int) $userId;
 
         $table_support_tickets = Database::get_main_table(TABLE_TICKET_TICKET);
         $now = api_get_utc_datetime();
@@ -1570,7 +1571,7 @@ class TicketManager
     public static function get_assign_log($ticketId)
     {
         $table = Database::get_main_table(TABLE_TICKET_ASSIGNED_LOG);
-        $ticketId = intval($ticketId);
+        $ticketId = (int) $ticketId;
 
         $sql = "SELECT * FROM $table
                 WHERE ticket_id = $ticketId
@@ -1612,8 +1613,8 @@ class TicketManager
         $direction,
         $userId = null
     ) {
-        $from = intval($from);
-        $number_of_items = intval($number_of_items);
+        $from = (int) $from;
+        $number_of_items = (int) $number_of_items;
         $table_support_category = Database::get_main_table(
             TABLE_TICKET_CATEGORY
         );
@@ -2274,7 +2275,6 @@ class TicketManager
      */
     public static function getSettingsMenuItems($exclude = null)
     {
-        $items = [];
         $project = [
             'icon' => 'project.png',
             'url' => 'projects.php',
diff --git a/main/lp/learnpath.class.php b/main/lp/learnpath.class.php
index 111b213b36..9f1f66f0c1 100755
--- a/main/lp/learnpath.class.php
+++ b/main/lp/learnpath.class.php
@@ -6941,24 +6941,21 @@ class learnpath
         $creatorId = empty($creatorId) ? api_get_user_id() : $creatorId;
 
         $folder = false;
-        //if (!is_dir($filepath.'/'.$dir)) {
         $folderData = create_unexisting_directory(
-                $course,
-                $creatorId,
-                0,
-                null,
-                0,
-                $filepath,
-                $dir,
-                get_lang('LearningPaths'),
-                0
-            );
+            $course,
+            $creatorId,
+            0,
+            null,
+            0,
+            $filepath,
+            $dir,
+            get_lang('LearningPaths'),
+            0
+        );
+
         if (!empty($folderData)) {
             $folder = true;
         }
-        /*} else {
-            $folder = true;
-        }*/
 
         return $folder;
     }
@@ -6990,17 +6987,16 @@ class learnpath
         $documentId = null;
         if ($folder) {
             $filepath = api_get_path(SYS_COURSE_PATH).$course['path'].'/document';
-            //if (!is_dir($filepath.'/'.$dir)) {
             $folderData = create_unexisting_directory(
-                    $course,
-                    $creatorId,
-                    0,
-                    0,
-                    0,
-                    $filepath,
-                    $dir,
-                    $lp_name
-                );
+                $course,
+                $creatorId,
+                0,
+                0,
+                0,
+                $filepath,
+                $dir,
+                $lp_name
+            );
             if (!empty($folderData)) {
                 $folder = true;
             }
diff --git a/src/CoreBundle/Component/Editor/Driver/CourseDriver.php b/src/CoreBundle/Component/Editor/Driver/CourseDriver.php
index cb41be1205..101b78a124 100644
--- a/src/CoreBundle/Component/Editor/Driver/CourseDriver.php
+++ b/src/CoreBundle/Component/Editor/Driver/CourseDriver.php
@@ -39,7 +39,6 @@ class CourseDriver extends Driver implements DriverInterface
             if (!file_exists($baseDir.'/shared_folder')) {
                 $title = get_lang('UserFolders');
                 $folderName = '/shared_folder';
-
                 $visibility = 0;
                 create_unexisting_directory(
                     $courseInfo,