Merged 1.8.13 release into master

Conflicts:
	README.md
	mod/twitter/languages/en.php
	version.php

CHANGES.txt

@@ -1,3 +1,28 @@
+Version 1.8.13
+(January 29, 2013 from https://github.com/Elgg/Elgg/tree/1.8)
+  Contributing Developers:
+   * Cash Costello
+   * Juho Jaakkola
+   * Kevin Jardine
+   * Krzysztof Różalski
+   * Steve Clay
+
+  Security Fixes:
+   * Added validation of Twitter usernames in Twitter widget
+
+  Bugfixes:
+   * CLI usages with walled garden fixed
+   * Upgrading from < 1.8 to 1.8 fixed
+   * Default widgets fixed
+   * Quotes in object titles no longer result in "qout" in URLs
+   * List of my groups is ordered now
+   * Language string river:comment:object:default is defined now
+   * Added language string for comments: generic_comment:on
+
+  Enhancements:
+   * Added confirm dialog for resetting profile fields (adds language string profile:resetdefault:confirm)
+
+
 Version 1.8.12
 (January 4th, 2013 from https://github.com/Elgg/Elgg/tree/1.8)
   Contributing Developers:
@@ -7,7 +32,6 @@ Version 1.8.12
    * Matt Beckett
    * Paweł Sroka
    * Sem
-   * Srokap
    * Steve Clay
 
   Bugfixes:
@@ -34,6 +58,7 @@ Version 1.8.12
    * Twitter: Login with twitter supports persistent login and correctly forwards
      after login.
 
+
 Version 1.8.11
 (December 5th, 2012 from https://github.com/Elgg/Elgg/tree/1.8)
 

README.md

@@ -1,7 +1,7 @@
 Elgg [![Build Status](https://secure.travis-ci.org/Elgg/Elgg.png?branch=master)](https://travis-ci.org/Elgg/Elgg)
 ====
 
-Copyright (c) 2008-2012, see COPYRIGHT.txt
+Copyright (c) 2008-2013, see COPYRIGHT.txt
 
 For development credits, see CONTRIBUTORS.txt.
 

engine/classes/ElggPlugin.php

@@ -303,10 +303,7 @@ public function getAllSettings() {
 			$return = array();
 
 			foreach ($private_settings as $setting) {
-				$name = substr($setting->name, $ps_prefix_len);
-				$value = $setting->value;
-
-				$return[$name] = $value;
+				$return[$setting->name] = $setting->value;
 			}
 
 			return $return;

engine/classes/ElggSite.php

@@ -405,6 +405,11 @@ public function getExportableValues() {
 	public function checkWalledGarden() {
 		global $CONFIG;
 
+		// command line calls should not invoke the walled garden check
+		if (PHP_SAPI === 'cli') {
+			return;
+		}
+
 		if ($CONFIG->walled_garden) {
 			if ($CONFIG->default_access == ACCESS_PUBLIC) {
 				$CONFIG->default_access = ACCESS_LOGGED_IN;

engine/lib/output.php

@@ -287,6 +287,8 @@ function elgg_get_friendly_title($title) {
 
 	// handle some special cases
 	$title = str_replace('&', 'and', $title);
+	// quotes and angle brackets stored in the database as html encoded
+	$title = htmlspecialchars_decode($title);
 
 	$title = ElggTranslit::urlize($title);
 

engine/lib/private_settings.php

@@ -349,11 +349,6 @@ function set_private_setting($entity_guid, $name, $value) {
 	$name = sanitise_string($name);
 	$value = sanitise_string($value);
 
-	$entity = get_entity($entity_guid);
-	if (!$entity instanceof ElggEntity) {
-		return false;
-	}
-
 	$result = insert_data("INSERT into {$CONFIG->dbprefix}private_settings
 		(entity_guid, name, value) VALUES
 		($entity_guid, '$name', '$value')

engine/lib/upgrades/2011010101.php

@@ -93,4 +93,6 @@
 $processed_upgrades = array_unique($processed_upgrades);
 elgg_set_processed_upgrades($processed_upgrades);
 
+_elgg_upgrade_unlock();
+
 forward('upgrade.php');

js/lib/languages.js

@@ -4,6 +4,9 @@
  */
 elgg.provide('elgg.config.translations');
 
+// default language - required by unit tests
+elgg.config.language = 'en';
+
 /**
  * Analagous to the php version.  Merges translations for a
  * given language into the current translations map.

languages/en.php

@@ -407,7 +407,8 @@
 	'profile:editdefault:delete:fail' => 'Removed default profile item field failed',
 	'profile:editdefault:delete:success' => 'Profile field deleted',
 	'profile:defaultprofile:reset' => 'Profile fields reset to the system default',
-	'profile:resetdefault' => 'Reset default profile',
+	'profile:resetdefault' => 'Reset profile fields to system defaults',
+	'profile:resetdefault:confirm' => 'Are you sure you want to delete your custom profile fields?',
 	'profile:explainchangefields' => "You can replace the existing profile fields with your own using the form below. \n\n Give the new profile field a label, for example, 'Favorite team', then select the field type (eg. text, url, tags), and click the 'Add' button. To re-order the fields drag on the handle next to the field label. To edit a field label - click on the label's text to make it editable. \n\n At any time you can revert back to the default profile set up, but you will lose any information already entered into custom fields on profile pages.",
 	'profile:editdefault:success' => 'New profile field added',
 	'profile:editdefault:fail' => 'Default profile could not be saved',
@@ -665,6 +666,7 @@
 
 
 	'admin:notices:could_not_delete' => 'Could not delete notice.',
+	'item:object:admin_notice' => 'Admin notice',
 
 	'admin:options' => 'Admin options',
 
@@ -690,7 +692,7 @@
 	'admin:plugins:label:author' => "Author",
 	'admin:plugins:label:copyright' => "Copyright",
 	'admin:plugins:label:categories' => 'Categories',
-	'admin:plugins:label:licence' => "Licence",
+	'admin:plugins:label:licence' => "License",
 	'admin:plugins:label:website' => "URL",
 	'admin:plugins:label:repository' => "Code",
 	'admin:plugins:label:bugtracker' => "Report issue",
@@ -1156,7 +1158,7 @@
 
 	'comments:count' => "%s comments",
 
-	'riveraction:annotation:generic_comment' => '%s commented on %s',
+	'river:comment:object:default' => '%s commented on %s',
 
 	'generic_comments:add' => "Leave a comment",
 	'generic_comments:post' => "Post comment",
@@ -1170,6 +1172,7 @@
 	'generic_comment:failure' => "An unexpected error occurred when adding your comment.",
 	'generic_comment:none' => 'No comments',
 	'generic_comment:title' => 'Comment by %s',
+	'generic_comment:on' => '%s on %s',
 
 	'generic_comment:email:subject' => 'You have a new comment!',
 	'generic_comment:email:body' => "You have a new comment on your item \"%s\" from %s. It reads:

mod/blog/start.php

@@ -124,9 +124,12 @@ function blog_page_handler($page) {
 			$params = blog_get_page_content_archive($user->guid, $page[2], $page[3]);
 			break;
 		case 'view':
-		case 'read': // Elgg 1.7 compatibility
 			$params = blog_get_page_content_read($page[1]);
 			break;
+		case 'read': // Elgg 1.7 compatibility
+			register_error(elgg_echo("changebookmark"));
+			forward("blog/view/{$page[1]}");
+			break;
 		case 'add':
 			gatekeeper();
 			$params = blog_get_page_content_edit($page_type, $page[1]);

mod/bookmarks/start.php

@@ -125,11 +125,14 @@ function bookmarks_page_handler($page) {
 			include "$pages/friends.php";
 			break;
 
-		case "read":
 		case "view":
 			set_input('guid', $page[1]);
 			include "$pages/view.php";
 			break;
+		case 'read': // Elgg 1.7 compatibility
+			register_error(elgg_echo("changebookmark"));
+			forward("bookmarks/view/{$page[1]}");
+			break;
 
 		case "add":
 			gatekeeper();

mod/file/start.php

@@ -121,8 +121,11 @@ function file_page_handler($page) {
 			file_register_toggle();
 			include "$file_dir/friends.php";
 			break;
-		case 'view':
 		case 'read': // Elgg 1.7 compatibility
+			register_error(elgg_echo("changebookmark"));
+			forward("file/view/{$page[1]}");
+			break;
+		case 'view':
 			set_input('guid', $page[1]);
 			include "$file_dir/view.php";
 			break;

mod/file/views/default/object/file.php

@@ -68,6 +68,7 @@
 
 	$params = array(
 		'entity' => $file,
+		'title' => false,
 		'metadata' => $metadata,
 		'subtitle' => $subtitle,
 	);
@@ -79,7 +80,6 @@
 
 	echo elgg_view('object/elements/full', array(
 		'entity' => $file,
-		'title' => false,
 		'icon' => $file_icon,
 		'summary' => $summary,
 		'body' => $body,

mod/groups/views/default/groups/css.php

@@ -10,8 +10,8 @@
 	margin-right: 10px;
 }
 .groups-profile img {
-    width: 100%;
-    height: auto;
+	width: 100%;
+	height: auto;
 }
 .groups-stats {
 	background: #eeeeee;

mod/groups/views/default/groups/profile/summary.php

@@ -16,7 +16,9 @@
 $owner = $group->getOwnerEntity();
 
 if (!$owner) {
-	return true;
+	// not having an owner is very bad so we throw an exception
+	$msg = elgg_echo('InvalidParameterException:IdNotExistForGUID', array('group owner', $group->guid));
+	throw new InvalidParameterException($msg);
 }
 
 ?>

mod/notifications/actions/groupsave.php

@@ -30,14 +30,11 @@
 	}
 }
 
-// Load important global vars
-global $NOTIFICATION_HANDLERS;
-foreach($NOTIFICATION_HANDLERS as $method => $foo) {
-	$subscriptions[$method] = get_input($method.'subscriptions');
-	$personal[$method] = get_input($method.'personal');
-	$collections[$method] = get_input($method.'collections');
-	if (!empty($groups)) {
-		foreach($groups as $group) {
+if (!empty($groups)) {
+	global $NOTIFICATION_HANDLERS;
+	foreach ($NOTIFICATION_HANDLERS as $method => $foo) {
+		$subscriptions[$method] = get_input($method.'subscriptions', array());
+		foreach ($groups as $group) {
 			if (in_array($group, $subscriptions[$method])) {
 				add_entity_relationship($user->guid, 'notify'.$method, $group);
 			} else {

mod/twitter/languages/en.php

@@ -7,8 +7,10 @@
 
 	'twitter:title' => 'Twitter',
 	'twitter:info' => 'Display your latest tweets',
-	'twitter:username' => 'Enter your twitter username.',
-	'twitter:num' => 'The number of tweets to show.',
+	'twitter:username' => 'Your twitter username',
+	'twitter:num' => 'Number of tweets to show*',
 	'twitter:visit' => 'visit my twitter',
-	'twitter:notset' => 'This Twitter widget is not yet set to go. To display your latest tweets, click on - edit - and fill in your details',
+	'twitter:notset' => 'This widget needs to be configured. To display your latest tweets, click the customize icon and fill in your Twitter username.',
+	'twitter:invalid' => 'This widget is configured with an invalid Twitter username. Click the customize icon to correct it.',
+	'twitter:apibug' => "*Due to a bug in the Twitter 1.0 API, you may see fewer tweets than you ask for.",
 );

mod/twitter/views/default/widgets/twitter/content.php

@@ -6,26 +6,37 @@
  * @package ElggTwitter
  */
 
-//some required params
-
 $username = $vars['entity']->twitter_username;
+
+if (empty($username)) {
+	echo "<p>" . elgg_echo("twitter:notset") . "</p>";
+	return;
+}
+
+$username_is_valid = preg_match('~^[a-zA-Z0-9_]{1,20}$~', $username);
+if (!$username_is_valid) {
+	echo "<p>" . elgg_echo("twitter:invalid") . "</p>";
+	return;
+}
+
+
 $num = $vars['entity']->twitter_num;
+if (empty($num)) {
+	$num = 5;
+}
 
-// if the twitter username is empty, then do not show
-if ($username) {
+// @todo upgrade to 1.1 API https://dev.twitter.com/docs/api/1.1/get/statuses/home_timeline
+$script_url = "https://api.twitter.com/1/statuses/user_timeline/" . urlencode($username) . ".json"
+            . "?callback=twitterCallback2&count=" . (int) $num;
 
 ?>
-
 <div id="twitter_widget">
 	<ul id="twitter_update_list"></ul>
-	<p class="visit_twitter"><a href="http://twitter.com/<?php echo $username; ?>"><?php echo elgg_echo("twitter:visit"); ?></a></p>
+	<p class="visit_twitter"><?php echo elgg_view('output/url', array(
+		'text' => elgg_echo("twitter:visit"),
+		'href' => 'http://twitter.com/' . urlencode($username),
+		'is_trusted' => true,
+	)) ?></p>
 	<script type="text/javascript" src="http://twitter.com/javascripts/blogger.js"></script>
-	<script type="text/javascript" src="https://api.twitter.com/1/statuses/user_timeline/<?php echo $username; ?>.json?callback=twitterCallback2&count=<?php echo $num; ?>"></script>
+	<script type="text/javascript" src="<?php echo htmlspecialchars($script_url, ENT_QUOTES, 'UTF-8') ?>"></script>
 </div>
-
-<?php
-} else {
-
-	echo "<p>" . elgg_echo("twitter:notset") . ".</p>";
-
-}

mod/twitter/views/default/widgets/twitter/edit.php

@@ -1,16 +1,24 @@
 <?php
 
-    /**
-	 * Elgg twitter edit page
-	 *
-	 * @package ElggTwitter
-	 */
+/**
+ * Elgg twitter edit page
+ *
+ * @package ElggTwitter
+ */
 
 ?>
-	<p>
-		<?php echo elgg_echo("twitter:username"); ?>
-		<input type="text" name="params[twitter_username]" value="<?php echo htmlentities($vars['entity']->twitter_username); ?>" />	
-		<br /><?php echo elgg_echo("twitter:num"); ?>
-		<input type="text" name="params[twitter_num]" value="<?php echo htmlentities($vars['entity']->twitter_num); ?>" />	
-
-	</p>
+<div>
+	<?php echo elgg_echo("twitter:username"); ?>
+	<?php echo elgg_view('input/text', array(
+		'name' => 'params[twitter_username]',
+		'value' => $vars['entity']->twitter_username,
+	)) ?>
+</div>
+<div>
+	<?php echo elgg_echo("twitter:num"); ?>
+	<?php echo elgg_view('input/text', array(
+		'name' => 'params[twitter_num]',
+		'value' => $vars['entity']->twitter_num,
+	)) ?>
+	<span class="elgg-text-help"><?php echo elgg_echo("twitter:apibug"); ?></span>
+</div>

version.php

@@ -11,7 +11,7 @@
 
 // YYYYMMDD = Elgg Date
 // XX = Interim incrementer
-$version = 2011110700;
+$version = 2013012600;
 
 // Human-friendly version name
 $release = '1.9.0-dev';

views/default/admin/appearance/profile_fields.php

@@ -5,12 +5,20 @@
 
 $add = elgg_view_form('profile/fields/add', array('class' => 'elgg-form-settings'), array());
 $list = elgg_view('admin/appearance/profile_fields/list');
-$reset = elgg_view_form('profile/fields/reset', array(), array());
+
+$reset = elgg_view('output/confirmlink', array(
+	'text' => elgg_echo('reset'),
+	'href' => 'action/profile/fields/reset',
+	'title' => elgg_echo('profile:resetdefault'),
+	'confirm' => elgg_echo('profile:resetdefault:confirm'),
+	'class' => 'elgg-button elgg-button-cancel',
+	'is_trusted' => 'true',
+));
 
 $body = <<<__HTML
 $add
 $list
-$reset
+<div class="mtl">$reset</div>
 __HTML;
 
 echo $body;