Merge branch '2.2.x'

README.markdown

@@ -1,15 +1,15 @@
 # Symphony 2 #
 
-- Version: 2.2.4
-- Date: October 22nd, 2011
-- Release Notes: <http://symphony-cms.com/download/releases/version/2.2.4/>
-- Github Repository: <http://github.com/symphonycms/symphony-2/tree/2.2.4>
+- Version: 2.2.5
+- Date: November 13th, 2011
+- Release Notes: <http://symphony-cms.com/download/releases/version/2.2.5/>
+- Github Repository: <http://github.com/symphonycms/symphony-2/tree/2.2.5>
 
 
 ## Overview
 
 Symphony is a `PHP` & `MySQL` based CMS that utilises `XML` and `XSLT` as
-its core technologies. This repository represents version "2.2.4" and is considered stable.
+its core technologies. This repository represents version "2.2.5" and is considered stable.
 
 Visit the forum at <http://symphony-cms.com/discuss/>
 
@@ -23,19 +23,19 @@ Visit the forum at <http://symphony-cms.com/discuss/>
 
 ### A note for Windows developers
 
-While Windows is not officially supported for production, we understand many 
+While Windows is not officially supported for production, we understand many
 developers use WAMP for Symphony development before deploying to a production
-server. The Symphony team recommends that while using WAMP, developers use 
+server. The Symphony team recommends that while using WAMP, developers use
 the latest PHP 5.3.x version during development to minimise any potential issues.
-PHP5.3 provides numerous fixes and improvements to help minimise and standardise 
+PHP5.3 provides numerous fixes and improvements to help minimise and standardise
 the result of several functions that behave slightly differently depending on the OS
 
 ## Updating From an Older Version
 
 #### Versions Prior to 2.2
 
-2.2 introduces numerous improvements that may affect extension compatibility. 
-Before updating, be sure to consult the [extension compatibility table](http://symphony-cms.com/download/extensions/compatibility/) to 
+2.2 introduces numerous improvements that may affect extension compatibility.
+Before updating, be sure to consult the [extension compatibility table](http://symphony-cms.com/download/extensions/compatibility/) to
 verify that the extensions you're using have all been updated for Symphony 2.2.
 
 #### Versions Prior to 2.1
@@ -181,7 +181,7 @@ details for establishing a database connection and about your server environment
 
 3. Remove installer files (unless you're fine with revealing all your trade secrets):
 
-	`rm install.php install.sql workspace/install.sql update.php`
+	`rm install.php install.sql workspace/install.sql update.php install-log.txt`
 
 4. Dance like it's 2012!
 
@@ -192,4 +192,4 @@ Thanks to @DavidOliver for these quick scripts.
 To recursively chmod directories only:
 	`find /your/site/root -type d -exec chmod 755 {} \;`
 To recursively chmod files only:
- 	`find /your/site/root -type f -exec chmod 644 {} \;`. 
+ 	`find /your/site/root -type f -exec chmod 644 {} \;`.

install.php

@@ -37,7 +37,7 @@ function __errorHandler($errno=NULL, $errstr, $errfile=NULL, $errline=NULL, $err
 	}
 
 	// Defines
-	define('kVERSION', '2.2.4');
+	define('kVERSION', '2.2.5');
 	define('kINSTALL_ASSET_LOCATION', './symphony/assets/installer');
 	define('kINSTALL_FILENAME', basename(__FILE__));
 	define('DOCROOT', rtrim(dirname(__FILE__), '\\/'));
@@ -195,7 +195,7 @@ function getDynamicConfiguration(){
 		$conf['database']['character_set'] = 'utf8';
 		$conf['database']['character_encoding'] = 'utf8';
 		$conf['database']['runtime_character_set_alter'] = '1';
-		$conf['database']['query_caching'] = 'default';
+		$conf['database']['query_caching'] = 'on';
 		$conf['public']['display_event_xml_in_source'] = 'yes';
 		$conf['region']['time_format'] = 'H:i';
 		$conf['region']['date_format'] = 'd F Y';

symphony/assets/symphony.tags.js

@@ -67,7 +67,7 @@
 
 			// Multiple
 			else {
-				var exp = new RegExp('^' + tag + '$', 'i'),
+				var exp = new RegExp('^' + tag.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&") + '$', 'i'),
 					tags = value.split(/,\s*/),
 					removed = false;
 

symphony/content/content.blueprintsdatasources.php

@@ -436,7 +436,7 @@ public function __form(){
 			);
 
 			foreach($field_groups as $section_id => $section_data){
-				$optgroup = array('label' => $section_data['section']->get('name'), 'options' => array(
+				$optgroup = array('label' => General::sanitize($section_data['section']->get('name')), 'options' => array(
 					array('system:id', ($fields['source'] == $section_data['section']->get('id') && $fields['sort'] == 'system:id'), __('System ID')),
 					array('system:date', ($fields['source'] == $section_data['section']->get('id') && $fields['sort'] == 'system:date'), __('System Date')),
 				));
@@ -446,7 +446,11 @@ public function __form(){
 
 						if(!$input->isSortable()) continue;
 
-						$optgroup['options'][] = array($input->get('element_name'), ($fields['source'] == $section_data['section']->get('id') && $input->get('element_name') == $fields['sort']), $input->get('label'));
+						$optgroup['options'][] = array(
+							$input->get('element_name'),
+							($fields['source'] == $section_data['section']->get('id') && $input->get('element_name') == $fields['sort']),
+							$input->get('label')
+						);
 					}
 				}
 
@@ -939,7 +943,7 @@ public function __formAction(){
 			if(empty($classname)) $this->_errors['name'] = __('Please ensure name contains at least one Latin-based alphabet.', array($classname));
 
 			$file = DATASOURCES . '/data.' . $classname . '.php';
-			
+
 			$isDuplicate = false;
 			$queueForDeletion = NULL;
 

symphony/lib/core/class.administration.php

@@ -392,7 +392,7 @@ public function display($page){
 			 *  extends HTMLPage. The Symphony backend uses a convention of contentPageName
 			 *  as the class that extends the HTMLPage
 			 */
-			$this->ExtensionManager->notifyMembers('AdminPagePreGenerate', '/backend/', array('oPage' => &$this->Page));
+			Symphony::ExtensionManager()->notifyMembers('AdminPagePreGenerate', '/backend/', array('oPage' => &$this->Page));
 
 			$output = $this->Page->generate();
 
@@ -404,7 +404,7 @@ public function display($page){
 			 * @param string $output
 			 *  The resulting backend page HTML as a string, passed by reference
 			 */
-			$this->ExtensionManager->notifyMembers('AdminPagePostGenerate', '/backend/', array('output' => &$output));
+			Symphony::ExtensionManager()->notifyMembers('AdminPagePostGenerate', '/backend/', array('output' => &$output));
 
 			$this->Profiler->sample('Page built');
 

symphony/lib/core/class.errorhandler.php

@@ -68,15 +68,6 @@ protected static function __nearbyLines($line, $file, $window=5){
 		 */
 		public static function handler(Exception $e){
 			try{
-				// Exceptions should be logged if they are not caught.
-				if(self::$_Log instanceof Log){
-					self::$_Log->pushToLog(
-						sprintf(
-							'%s%s%s', $e->getMessage(), ($e->getFile() ? " in file " .  $e->getFile() : null), ($e->getLine() ? " on line " . $e->getLine() : null)
-						), $e->getCode(), true
-					);
-				}
-
 				// Instead of just throwing an empty page, return a 404 page.
 				if(self::$enabled !== true){
 					require_once(CORE . '/class.frontend.php');
@@ -91,6 +82,20 @@ public static function handler(Exception $e){
 					$class = __CLASS__;
 				}
 
+				// Exceptions should be logged if they are not caught.
+				if(self::$_Log instanceof Log){
+					self::$_Log->pushToLog(sprintf(
+							'%s %s - %s%s%s',
+							$class,
+							$e->getCode(),
+							$e->getMessage(),
+							($e->getFile() ? " in file " .  $e->getFile() : null),
+							($e->getLine() ? " on line " . $e->getLine() : null)
+						),
+						$e->getCode(), true
+					);
+				}
+
 				$output = call_user_func(array($class, 'render'), $e);
 
 				if(!headers_sent()) {
@@ -318,8 +323,7 @@ public static function handler($code, $message, $file = null, $line = null){
 
 			// Only log if the error won't be raised to an exception and the error is not `E_STRICT`
 			if(!self::$raise && !self::$logDisabled && !in_array($code, array(E_STRICT)) && self::$_Log instanceof Log){
-				self::$_Log->pushToLog(
-					sprintf(
+				self::$_Log->pushToLog(sprintf(
 						'%s %s - %s%s%s',
 						__CLASS__, $code, $message, ($file ? " in file $file" : null), ($line ? " on line $line" : null)
 					), $code, true

symphony/lib/core/class.symphony.php

@@ -561,7 +561,7 @@ public function customError($heading, $message, $template='error', array $additi
 		 * @return string
 		 *  An HTML string
 		 */
-		public static function render($e){
+		public static function render(Exception $e){
 			if($e->getTemplate() === false){
 				echo '<h1>Symphony Fatal Error</h1><p>'.$e->getMessage().'</p>';
 				exit;
@@ -704,7 +704,7 @@ public function getTemplate(){
 		 * @return string
 		 *  An HTML string
 		 */
-		public static function render($e){
+		public static function render(Exception $e){
 
 			$trace = NULL;
 			$odd = true;

symphony/lib/toolkit/class.entrymanager.php

@@ -452,10 +452,15 @@ public function __buildEntries(Array $rows, $section_id, $element_names = null){
 					if(count($parts) == 1) continue;
 
 					unset($element_names[$index]);
+
+					// Prevent attempting to look up 'system', which will arise
+					// from `system:pagination`, `system:id` etc.
+					if($parts[0] == 'system') continue;
+
 					$element_names[] = trim($parts[0]);
 				}
 
-				$schema_sql = sprintf(
+				$schema_sql = empty($element_names) ? null : sprintf(
 					"SELECT `id` FROM `tbl_fields` WHERE `parent_section` = %d AND `element_name` IN ('%s')",
 					$section_id,
 					implode("', '", array_unique($element_names))
@@ -469,8 +474,7 @@ public function __buildEntries(Array $rows, $section_id, $element_names = null){
 				);
 			}
 
-			$schema = Symphony::Database()->fetch($schema_sql);
-
+			$schema = is_null($schema_sql) ? array() : Symphony::Database()->fetch($schema_sql);
 			$raw = array();
 			$rows_string = '';
 

symphony/lib/toolkit/class.extensionmanager.php

@@ -606,7 +606,7 @@ public function listAll($filter='/^((?![-^?%:*|"<>]).)*$/') {
 		 *  The name of the Extension Class minus the extension prefix.
 		 * @return Extension
 		 */
-		public function create($name){
+		public function &create($name){
 			if(!is_array(self::$_pool)) $this->flush();
 
 			if(!isset(self::$_pool[$name])){

symphony/lib/toolkit/class.field.php

@@ -286,8 +286,10 @@ public function allowDatasourceOutputGrouping(){
 		}
 
 		/**
-		 * Test whether this field requires grouping. This default implementation
-		 * returns false.
+		 * Test whether this field requires grouping. If this function returns true
+		 * SQL statements generated in the `EntryManager` will include the `DISTINCT` keyword
+		 * to only return a single row for an entry regardless of how many 'matches' it
+		 * might have. This default implementation returns false.
 		 *
 		 * @return boolean
 		 *	true if this field requires grouping, false otherwise.
@@ -1089,7 +1091,7 @@ public function commit(){
 			$fields['element_name'] = Lang::createHandle($this->get('label'));
 			if(is_numeric($fields['element_name']{0})) $fields['element_name'] = 'field-' . $fields['element_name'];
 
-			$fields['label'] = $this->get('label');
+			$fields['label'] = General::sanitize($this->get('label'));
 			$fields['parent_section'] = $this->get('parent_section');
 			$fields['location'] = $this->get('location');
 			$fields['required'] = $this->get('required');

symphony/lib/toolkit/class.fieldmanager.php

@@ -188,10 +188,7 @@ public function delete($id) {
 		 */
 		public function fetch($id = null, $section_id = null, $order = 'ASC', $sortfield = 'sortorder', $type = null, $location = null, $where = null, $restrict=Field::__FIELD_ALL__){
 			$ret = array();
-
-			if(!is_null($id) && is_numeric($id)){
-				$returnSingle = true;
-			}
+			$returnSingle = (!is_null($id) && is_numeric($id));
 
 			if(!is_null($id) && is_numeric($id) && isset(self::$_initialiased_fields[$id]) && self::$_initialiased_fields[$id] instanceof Field){
 				$ret[] = clone self::$_initialiased_fields[$id];

symphony/lib/toolkit/class.frontendpage.php

@@ -370,7 +370,12 @@ private function __buildPage(){
 					// this causes the $_GET to output they key as amp;b, which results in
 					// $url-amp;b. This pattern will remove amp; allow the correct param
 					// to be used, $url-b
-					$key = preg_replace('/^amp;/', null, $key);
+					$key = preg_replace('/(^amp;|\/)/', null, $key);
+
+					// If the key gets replaced out then it will break the XML so prevent
+					// the parameter being set.
+					if(empty($key)) continue;
+
 					$this->_param['url-' . $key] = $val;
 				}
 			}
@@ -443,7 +448,7 @@ private function __buildPage(){
 
 			$params = new XMLElement('params');
 			foreach($this->_param as $key => $value) {
-				$param = new XMLElement($key);
+				$param = new XMLElement(Lang::createHandle($key));
 
 				// DS output params get flattened to a string, so get the original pre-flattened array
 				if (isset($this->_env['pool'][$key])) $value = $this->_env['pool'][$key];

symphony/lib/toolkit/events/event.section.php

@@ -419,7 +419,7 @@ function __sendEmailFindFormValue($needle, $haystack, $discard_field_name=true,
 	$success = true;
 
 	if (in_array('expect-multiple', $this->eParamFILTERS)) {
-		if (is_array($post['fields']) && isset($post['fields'][0])) {
+		if (is_array($post['fields'])) {
 			foreach ($post['fields'] as $position => $fields) {
 				if (isset($post['id'][$position]) && is_numeric($post['id'][$position])) {
 					$entry_id = $post['id'][$position];

symphony/lib/toolkit/fields/field.taglist.php

@@ -116,7 +116,6 @@ public function displaySettingsPanel(&$wrapper, $errors = null) {
 				foreach($sections as $section) $field_groups[$section->get('id')] = array('fields' => $section->fetchFields(), 'section' => $section);
 
 			$options = array(
-				//array('none', false, __('None')),
 				array('existing', (in_array('existing', $this->get('pre_populate_source'))), __('Existing Values')),
 			);
 
@@ -170,7 +169,9 @@ public function displayPublishPanel(&$wrapper, $data=NULL, $flagWithError=NULL,
 
 			$label = Widget::Label($this->get('label'));
 
-			$label->appendChild(Widget::Input('fields'.$fieldnamePrefix.'['.$this->get('element_name').']'.$fieldnamePostfix, (strlen($value) != 0 ? $value : NULL)));
+			$label->appendChild(
+				Widget::Input('fields'.$fieldnamePrefix.'['.$this->get('element_name').']'.$fieldnamePostfix, (strlen($value) != 0 ? General::sanitize($value) : NULL))
+			);
 
 			if($flagWithError != NULL) $wrapper->appendChild(Widget::wrapFormElementWithError($label, $flagWithError));
 			else $wrapper->appendChild($label);

symphony/lib/toolkit/include.install.php

@@ -587,13 +587,16 @@ function install(&$Page, $fields){
 					$conf['settings']['symphony']['allow_page_subscription'] = '1';
 					$conf['settings']['symphony']['lang'] = Lang::get();
 					$conf['settings']['symphony']['pages_table_nest_children'] = 'no';
+					$conf['settings']['symphony']['strict_error_handling'] = 'yes';
+					$conf['settings']['symphony']['session_gc_divisor'] = '10';
 					$conf['settings']['log']['archive'] = '1';
 					$conf['settings']['log']['maxsize'] = '102400';
 					$conf['settings']['image']['cache'] = '1';
 					$conf['settings']['image']['quality'] = '90';
 					$conf['settings']['database']['character_set'] = 'utf8';
 					$conf['settings']['database']['character_encoding'] = 'utf8';
 					$conf['settings']['database']['runtime_character_set_alter'] = '1';
+					$conf['settings']['database']['query_caching'] = 'on';
 					$conf['settings']['public']['display_event_xml_in_source'] = 'no';
 				}
 

update.php

@@ -62,8 +62,8 @@ function render($output){
 
 	set_error_handler('__errorHandler');
 
-	define('kVERSION', '2.2.4');
-	define('kCHANGELOG', 'http://symphony-cms.com/download/releases/version/2.2.4/');
+	define('kVERSION', '2.2.5');
+	define('kCHANGELOG', 'http://symphony-cms.com/download/releases/version/2.2.5/');
 	define('kINSTALL_ASSET_LOCATION', './symphony/assets/installer');
 	define('kINSTALL_FILENAME', basename(__FILE__));
 
@@ -484,11 +484,11 @@ function render($output){
 
 				.
 
-				(version_compare($existing_version, '2.0.2', '<') ? '<li>Since <code>2.0.2</code>, the built-in image manipulation features have been replaced with the <a href="http://github.com/pointybeard/jit_image_manipulation/tree/master">JIT Image Manipulation</a> extension. Should you have uploaded (or cloned) this to your Extensions folder, be sure to <a href="'.URL.'/symphony/system/extensions/">enable it.</a></li>' : NULL)
+				(version_compare($existing_version, '2.0.2', '<') ? '<li>Since <code>2.0.2</code>, the built-in image manipulation features have been replaced with the <a href="http://github.com/symphonycms/jit_image_manipulation/tree/master">JIT Image Manipulation</a> extension. Should you have uploaded (or cloned) this to your Extensions folder, be sure to <a href="'.URL.'/symphony/system/extensions/">enable it.</a></li>' : NULL)
 
 				.
 
-				(!is_null($sbl_version) && version_compare($sbl_version, '1.19dev', '<') ? '<li>The "Select Box Link" field extension has been updated to 1.19, however this installation of Symphony appears to be running an older version ('.$sbl_version.'). Versions prior to 1.19 will not work correctly under Symphony <code>'.kVERSION.'</code>. The latest version can be download via the <a href="http://symphony-cms.com/download/extensions/view/20054/">Select Box Link download page</a> on the Symphony site.</li>' : NULL)
+				(!is_null($sbl_version) && version_compare($sbl_version, '1.22', '<') ? '<li>The "Select Box Link" field extension has been updated to 1.22, however this installation of Symphony appears to be running an older version ('.$sbl_version.'). Versions prior to 1.22 will not work correctly under Symphony <code>'.kVERSION.'</code>. The latest version can be download via the <a href="http://symphony-cms.com/download/extensions/view/20054/">Select Box Link download page</a> on the Symphony site.</li>' : NULL)
 
 				.'</ol>