Merge branch '5.7.x' of github.com:concrete5/concrete5 into 5.7.x

concretecms · Dec 6, 2016 · d16f74f · d16f74f
2 parents 111b82f + 21bc3c4
commit d16f74f
Show file tree

Hide file tree

Showing 19 changed files with 239 additions and 142 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,9 @@
+# 5.7.5.10
+
+* Minor bug fixes
+* Fixed insecure use of non-random str_shuffle when creating user tokens
+* Improvements to update process for version 8.
+
 # 5.7.5.9
 
 ## New Features

diff --git a/build/tasks/build-release/download.js b/build/tasks/build-release/download.js
@@ -1,5 +1,5 @@
 module.exports = function(grunt, config, parameters, done) {
-	var zipUrl = parameters.releaseSourceZip || 'https://github.com/concrete5/concrete5/archive/5.7.x.zip';
+	var zipUrl = parameters.releaseSourceZip || 'https://github.com/concrete5/concrete5/archive/release/5.7.5.10.zip';
 	var workFolder = parameters.releaseWorkFolder || './release';
 	function endForError(e) {
 		process.stderr.write(e.message || e);

diff --git a/web/concrete/attributes/select/option.php b/web/concrete/attributes/select/option.php
@@ -113,9 +113,9 @@ public static function exportTranslations()
         $r = $db->Execute('select ID from atSelectOptions order by ID asc');
         while ($row = $r->FetchRow()) {
             $opt = static::getByID($row['ID']);
-            $translations->insert('SelectAttributeValue', $opt->getSelectAttributeOptionValue());
+            $translations->insert('SelectAttributeValue', $opt->getSelectAttributeOptionValue(false));
         }
         return $translations;
     }
 
-}
+}
diff --git a/web/concrete/blocks/core_stack_display/controller.php b/web/concrete/blocks/core_stack_display/controller.php
@@ -78,6 +78,10 @@ public function isValidControllerTask($method, $parameters = array())
 
     public function runAction($action, $parameters = array())
     {
+        if ('on_page_view' === $action) {
+            $this->on_page_view($parameters[0]);
+        }
+
         $b = $this->findBlockForAction($action, $parameters);
         if (empty($b)) {
             return;

diff --git a/web/concrete/blocks/share_this_page/controller.php b/web/concrete/blocks/share_this_page/controller.php
@@ -15,9 +15,9 @@ class Controller extends BlockController
     public $helpers = array('form');
 
     protected $btInterfaceWidth = 400;
-    protected $btCacheBlockOutput = true;
-    protected $btCacheBlockOutputOnPost = true;
-    protected $btCacheBlockOutputForRegisteredUsers = true;
+    protected $btCacheBlockOutput = false;
+    protected $btCacheBlockOutputOnPost = false;
+    protected $btCacheBlockOutputForRegisteredUsers = false;
     protected $btInterfaceHeight = 400;
     protected $btTable = 'btShareThisPage';
 
@@ -60,7 +60,7 @@ public function addService($service)
 
     protected function getSelectedServices()
     {
-        $links = array();
+        $this->services = array();
         $db = Database::get();
         $services = $db->GetCol('select service from btShareThisPage where bID = ? order by displayOrder asc',
             array($this->bID)

diff --git a/web/concrete/blocks/switch_language/controller.php b/web/concrete/blocks/switch_language/controller.php
@@ -80,18 +80,20 @@ public function view()
         $c = \Page::getCurrentPage();
         $al = Section::getBySectionOfSite($c);
         $languages = array();
-        $locale = \Localization::activeLocale();
-        if (is_object($al)) {
+        $locale = null;
+        if ($al) {
             $locale = $al->getLanguage();
         }
+        if (!$locale) {
+            $locale = \Localization::activeLocale();
+            $al = Section::getByLocale($locale);
+        }
         foreach ($ml as $m) {
             $languages[$m->getCollectionID()] = $m->getLanguageText($locale);
         }
         $this->set('languages', $languages);
         $this->set('languageSections', $ml);
-        if (is_object($al)) {
-            $this->set('activeLanguage', $al->getCollectionID());
-        }
+        $this->set('activeLanguage', $al? $al->getCollectionID() : null);
         $dl = \Core::make('multilingual/detector');
         $this->set('defaultLocale', $dl->getPreferredSection());
         $this->set('locale', $locale);

diff --git a/web/concrete/config/concrete.php b/web/concrete/config/concrete.php
@@ -7,8 +7,8 @@
      *
      * @var string
      */
-    'version'           => '5.7.5.10b1',
-    'version_installed' => '5.7.5.10b1',
+    'version'           => '5.7.5.10',
+    'version_installed' => '5.7.5.10',
     'version_db' => '20160615000000', // the key of the latest database migration
 
     /**

diff --git a/web/concrete/elements/page_controls_header.php b/web/concrete/elements/page_controls_header.php
@@ -29,8 +29,11 @@
 
 	$editMode = $c->isEditMode();
 	$tools = REL_DIR_FILES_TOOLS_REQUIRED;
+	$htmlTagClasses = 'ccm-toolbar-visible';
+
 	if ($c->isEditMode()) {
 		$startEditMode = 'new Concrete.EditMode();';
+		$htmlTagClasses .= ' ccm-edit-mode';
 	} else {
         $startEditMode = '';
     }
@@ -51,7 +54,7 @@
 
 	$js = <<<EOL
 <script type="text/javascript">$(function() {
-	$('html').addClass('ccm-toolbar-visible');
+	$('html').addClass('$htmlTagClasses');
 	ConcretePanelManager.register({'identifier': 'dashboard', 'position': 'right', url: '{$panelDashboard}'});
 	ConcretePanelManager.register({'identifier': 'page', url: '{$panelPage}'});
 	ConcretePanelManager.register({'identifier': 'sitemap', 'position': 'right', url: '{$panelSitemap}'});

diff --git a/web/concrete/src/Application/Application.php b/web/concrete/src/Application/Application.php
@@ -292,6 +292,8 @@ public function setupPackages()
             }
             $pkg->setupPackageLocalization();
         }
+        $config->set('app.bootstrap.packages_loaded', true);
+        \Localization::setupSiteLocalization();
         foreach($this->packages as $pkg) {
             if (method_exists($pkg, 'on_start')) {
                 $pkg->on_start();
@@ -300,8 +302,6 @@ public function setupPackages()
                 $checkAfterStart = true;
             }
         }
-        $config->set('app.bootstrap.packages_loaded', true);
-        \Localization::setupSiteLocalization();
 
         if ($checkAfterStart) {
             foreach($this->packages as $pkg) {

diff --git a/web/concrete/src/Block/BlockController.php b/web/concrete/src/Block/BlockController.php
@@ -480,7 +480,11 @@ public function isValidControllerTask($method, $parameters = array())
                 // how do we get <= 1? If it's 1, that means that the method has one fewer param. That's ok because
                 // certain older blocks don't know that the last param ought to be a $bID. If they're equal it's zero
                 // which is best. and if they're greater that's ok too.
-                return true;
+                // Now let's see if the action is for this block instance
+                $bID = array_pop($parameters);
+                if ((is_string($bID) || is_int($bID)) && $bID == $this->bID) {
+                    return true;
+                }
             }
         }
 

diff --git a/web/concrete/src/File/Image/BasicThumbnailer.php b/web/concrete/src/File/Image/BasicThumbnailer.php
@@ -107,7 +107,7 @@ public function getThumbnail($obj, $maxWidth, $maxHeight, $crop = false) {
         $src = REL_DIR_FILES_CACHE . '/' . $filename;
         $abspath = Config::get('concrete.cache.directory') . '/' . $filename;
         $thumb = new \stdClass;
-        if (isset($abspath) && file_exists($abspath)) {
+        if (isset($abspath) && is_file($abspath)) {
             $thumb->src = $src;
             $dimensions = getimagesize($abspath);
             $thumb->width = $dimensions[0];

diff --git a/web/concrete/src/Foundation/EnvironmentDetector.php b/web/concrete/src/Foundation/EnvironmentDetector.php
@@ -21,14 +21,14 @@ class EnvironmentDetector {
      */
     public function detect($environments, $consoleArgs = null)
     {
-        if ($consoleArgs)
-        {
-            return $this->detectConsoleEnvironment($environments, $consoleArgs);
-        }
-        else
-        {
-            return $this->detectVariableEnvironment($environments);
+        if ($consoleArgs && $env = $this->detectConsoleEnvironment($environments, $consoleArgs)) {
+            return $env;
+        } elseif ($env = $this->detectClosureEnvironment($environments)) {
+            return $env;
+        } elseif ($env = $this->detectVariableEnvironment($environments)) {
+            return $env;
         }
+        return $this->detectWebEnvironment($environments);
     }
 
     /**
@@ -39,14 +39,6 @@ public function detect($environments, $consoleArgs = null)
      */
     protected function detectWebEnvironment($environments)
     {
-        // If the given environment is just a Closure, we will defer the environment check
-        // to the Closure the developer has provided, which allows them to totally swap
-        // the webs environment detection logic with their own custom Closure's code.
-        if ($environments instanceof Closure)
-        {
-            return call_user_func($environments);
-        }
-
         foreach ($environments as $environment => $hosts)
         {
             // To determine the current environment, we'll simply iterate through the possible
@@ -77,10 +69,6 @@ protected function detectConsoleEnvironment($environments, array $args)
         {
             return head(array_slice(explode('=', $value), 1));
         }
-        else
-        {
-            return $this->detectVariableEnvironment($environments);
-        }
     }
 
     /**
@@ -93,11 +81,28 @@ protected function detectVariableEnvironment($environments)
     {
         if (($env = $this->getEnvironmentFromVariable()) !== false) {
             return $env;
-        } else {
-            return $this->detectWebEnvironment($environments);
         }
     }
 
+    /**
+     * Set the application environment from the passed closure in case a closure
+     * was passed.
+     *
+     * @param mixed $environments
+     *
+     * @return string|null
+     */
+    protected function detectClosureEnvironment($environments)
+    {
+        // If the given environment is just a Closure, we will defer the environment check
+        // to the Closure the developer has provided, which allows them to totally swap
+        // the webs environment detection logic with their own custom Closure's code.
+        if ($environments instanceof Closure) {
+            return call_user_func($environments);
+        }
+    }
+
+
     /**
      * Get the environment argument from the console.
      *
@@ -114,7 +119,7 @@ protected function getEnvironmentArgument(array $args)
 
     /**
      * Gets the environment from the CONCRETE5_ENV environment variable.
-     * 
+     *
      * @return string|bool
      */
     protected function getEnvironmentFromVariable()

diff --git a/web/concrete/src/Mail/Service.php b/web/concrete/src/Mail/Service.php
@@ -395,6 +395,8 @@ public function setAdditionalHeaders($headers)
      * @param bool $resetData Whether or not to reset the service to its default values.
      *
      * @throws \Exception
+     *
+     * @return bool
      */
     public function sendMail($resetData = true)
     {
@@ -492,10 +494,12 @@ public function sendMail($resetData = true)
         }
         $mail->setBody($body);
 
+        $sent = false;
         try {
             if (Config::get('concrete.email.enabled')) {
                 $transport->send($mail);
             }
+            $sent = true;
         } catch (Exception $e) {
             if ($this->getTesting()) {
                 throw $e;
@@ -533,5 +537,7 @@ public function sendMail($resetData = true)
         if ($resetData) {
             $this->reset();
         }
+
+        return $sent;
     }
 }
diff --git a/web/concrete/src/Multilingual/Service/Detector.php b/web/concrete/src/Multilingual/Service/Detector.php
@@ -71,32 +71,37 @@ public static function getPreferredSection()
 
     public static function setupSiteInterfaceLocalization(Page $c = null)
     {
-        if (\User::isLoggedIn() && Config::get('concrete.multilingual.keep_users_locale')) {
-            return;
-        }
-        if (!$c) {
-            $c = Page::getCurrentPage();
-        }
-        // don't translate dashboard pages
-        $dh = \Core::make('helper/concrete/dashboard');
-        if ($dh->inDashboard($c)) {
-            return;
-        }
-
-        $ms = Section::getBySectionOfSite($c);
-        if (!is_object($ms)) {
-            $ms = static::getPreferredSection();
-        }
-
-        if (!$ms) {
-            return;
-        }
-
-        $locale = $ms->getLocale();
-
-        if (strlen($locale)) {
-            \Localization::changeLocale($locale);
+        $loc = \Localization::getInstance();
+        if (!(\User::isLoggedIn() && Config::get('concrete.multilingual.keep_users_locale'))) {
+            if (!$c) {
+                $c = Page::getCurrentPage();
+            }
+            // don't translate dashboard pages
+            $dh = \Core::make('helper/concrete/dashboard');
+            if ($dh->inDashboard($c)) {
+                return;
+            }
+            $locale = null;
+            $ms = Section::getBySectionOfSite($c);
+            if ($ms) {
+                $locale = $ms->getLocale();
+            }
+            if (!$locale) {
+                if (Config::get('concrete.multilingual.use_previous_locale') && Session::has('previous_locale')) {
+                    $locale = Session::get('previous_locale');
+                }
+                if (!$locale) {
+                    $ms = static::getPreferredSection();
+                    if ($ms) {
+                        $locale = $ms->getLocale();
+                    }
+                }
+            }
+            if ($locale) {
+                $loc->setLocale($locale);
+            }
         }
+        Session::set('previous_locale', $loc->getLocale());
     }
 
     public static function isEnabled()

diff --git a/web/concrete/src/Page/CustomStyle.php b/web/concrete/src/Page/CustomStyle.php
@@ -15,9 +15,9 @@ class CustomStyle
     protected $presetHandle;
     protected $sccRecordID;
 
-    public function setThemeID($ptThemeID)
+    public function setThemeID($pThemeID)
     {
-        $this->ptThemeID = $ptThemeID;
+        $this->pThemeID = $pThemeID;
     }
 
     public function setValueListID($valueListID)

diff --git a/web/concrete/src/Page/Page.php b/web/concrete/src/Page/Page.php
@@ -48,6 +48,9 @@ class Page extends Collection implements \Concrete\Core\Permission\ObjectInterfa
     protected $blocksAliasedFromMasterCollection = null;
     protected $cIsSystemPage = false;
     protected $cPointerOriginalID = null;
+
+    public $cParentID;
+
     /**
      * @param string $path /path/to/page
      * @param string $version ACTIVE or RECENT
@@ -401,16 +404,21 @@ public function isCheckedOut()
             return $this->isCheckedOutCache;
         }
 
-        $dh = Core::make('helper/date');
-
-        $q = 'select cIsCheckedOut, '.$dh->getOverridableNow(true)." - UNIX_TIMESTAMP(cCheckedOutDatetimeLastEdit) as timeout from Pages where cID = '{$this->cID}'";
+        $q = "select cIsCheckedOut, cCheckedOutDatetimeLastEdit from Pages where cID = '{$this->cID}'";
         $r = $db->executeQuery($q);
+
+        // If cCheckedOutDatetimeLastEdit is present, get the time span in seconds since it's last edit.
+        if (! empty($row['cCheckedOutDatetimeLastEdit'])) {
+            $dh = Core::make('helper/date');
+            $timeSinceCheckout = ($dh->getOverridableNow(true) - strtotime($row['cCheckedOutDatetimeLastEdit']));
+        }
+
         if ($r) {
             $row = $r->fetchRow();
             if ($row['cIsCheckedOut'] == 0) {
                 return false;
             } else {
-                if ($row['timeout'] > CHECKOUT_TIMEOUT) {
+                if (isset($timeSinceCheckout) && $timeSinceCheckout > CHECKOUT_TIMEOUT) {
                     $this->forceCheckIn();
                     $this->isCheckedOutCache = false;