Added missing merged changes from 2.9

thorsten · Aug 25, 2018 · ddff0f0 · ddff0f0
1 parent 564b527
commit ddff0f0
Show file tree

Hide file tree

Showing 10 changed files with 185 additions and 109 deletions.
diff --git a/CHANGELOG b/CHANGELOG
@@ -5,7 +5,7 @@ CHANGELOG
 
 This is a log of major user-visible changes in each phpMyFAQ release.
 
-Version 3.0.0-alpha.3 - 2018-
+Version 3.0.0-alpha.3 - 2018-08-
 - changed PHP requirement to PHP 5.6.6 and PHP 7+ (Thorsten)
 - added PHP namespaces (Thorsten)
 - added Docker support (Adrien Estanove)
@@ -45,6 +45,18 @@ Version 3.0.0-alpha.3 - 2018-
 - removed Bower, now using Yarn only (Thorsten)
 - removed Modernizr (Thorsten)
 
+Version 2.9.11 - 2018-08-
+- fixed multiple vulnerabilities (Thorsten)
+- updated bundled jQuery to version 1.12.4 (Thorsten)
+- updated bundled Handlebars to version 4.0.11 (Thorsten)
+
+Version 2.9.10 - 2018-02-17
+- updated Dutch translation (https://github.com/joskevos)
+- updated bundled SwiftMailer to version 5.4.9 (Thorsten)
+- updated bundled phpseclib to version 2.0.9 (Thorsten)
+- updated bundled TinyMCE to version 4.6.7 (Thorsten)
+- fixed minor bugs (Thorsten)
+
 Version 2.9.9 - 2017-10-19
 - fixed multiple XSS and CSRF vulnerabilities (Thorsten)
 - updated bundled Bootstrap to version 3.3.7 (Thorsten)

diff --git a/phpmyfaq/admin/category.translate.php b/phpmyfaq/admin/category.translate.php
@@ -65,9 +65,9 @@
                     <input type="hidden" name="parent_id" value="<?php echo $category->categoryName[$id]['parent_id'] ?>">
                     <input type="hidden" name="showcat" value="<?php echo $showcat ?>">
                     <?php if ($faqConfig->get('security.permLevel') !== 'basic'): ?>
-                    <input type="hidden" name="restricted_groups" value="<?php echo $groupPermission[0] ?>">
+                    <input type="hidden" name="restricted_groups[]" value="<?php echo $groupPermission[0] ?>">
                     <?php else: ?>
-                    <input type="hidden" name="restricted_groups" value="-1">
+                    <input type="hidden" name="restricted_groups[]" value="-1">
                     <?php endif; ?>
                     <input type="hidden" name="restricted_users" value="<?php echo $userPermission[0] ?>">
                     <input type="hidden" name="csrf" value="<?php echo $user->getCsrfTokenFromSession() ?>">

diff --git a/phpmyfaq/admin/footer.php b/phpmyfaq/admin/footer.php
@@ -38,12 +38,12 @@
     <div class="row">
         <div class="col-lg-12">
             <p class="copyright text-right">
-                Proudly powered by <strong>phpMyFAQ <?php echo $faqConfig->get('main.currentVersion'); ?></strong> |
+                Proudly powered by <strong>phpMyFAQ <?= $faqConfig->get('main.currentVersion'); ?></strong> |
                 <a href="https://www.phpmyfaq.de/documentation" target="_blank">phpMyFAQ documentation</a> |
                 Follow us on <a href="http://twitter.com/phpMyFAQ">Twitter</a> |
                 <i aria-hidden="true" class="fa fa-apple"></i> Available on the
                 <a target="_blank" href="https://itunes.apple.com/app/phpmyfaq/id977896957">App Store</a> |
-                &copy; 2001-<?php echo date('Y') ?> <a href="https://www.phpmyfaq.de/" target="_blank">phpMyFAQ Team</a>
+                &copy; 2001-<?= date('Y') ?> <a href="https://www.phpmyfaq.de/" target="_blank">phpMyFAQ Team</a>
             </p>
         </div>
     </div>
@@ -57,14 +57,14 @@
 
 <?php
 if (isset($auth)) {
-    ?>
-<iframe id="keepPMFSessionAlive" src="session.keepalive.php?lang=<?php echo $LANGCODE ?>" width="0" height="0"
+?>
+<iframe id="keepPMFSessionAlive" src="session.keepalive.php?lang=<?= $LANGCODE ?>" width="0" height="0"
         style="display: none;"></iframe>
 <?php
     if (isset($auth) && (('takequestion' == $action) || ('editentry' == $action) || ('editpreview'  == $action) ||
                          ('addnews' == $action) || ('editnews' == $action) || ('copyentry' == $action))) {
         if ($faqConfig->get('main.enableWysiwygEditor') == true) {
-            ?>
+?>
 <script>
 
   // Bootstrap tooltips
@@ -74,17 +74,18 @@
   tinyMCE.init({
     // General options
     mode: 'exact',
-    language: '<?php echo(Language::isASupportedTinyMCELanguage($LANGCODE) ? $LANGCODE : 'en') ?>',
-    elements: '<?php echo ('addnews' == $action || 'editnews' == $action) ? 'news' : 'answer' ?>',
+    language: '<?=(Language::isASupportedTinyMCELanguage($LANGCODE) ? $LANGCODE : 'en') ?>',
+    elements: '<?= ('addnews' == $action || 'editnews' == $action) ? 'news' : 'answer' ?>',
     theme: 'modern',
     plugins: [
       'advlist autolink lists link image charmap print preview hr anchor pagebreak',
       'searchreplace wordcount visualblocks visualchars code codesample fullscreen',
       'insertdatetime media nonbreaking save table contextmenu directionality',
-      'emoticons template paste textcolor autosave phpmyfaq imageupload'
+      'emoticons template paste textcolor autosave phpmyfaq imageupload save'
     ],
     relative_urls: false,
     convert_urls: false,
+    document_base_url: '<?= $faqConfig->getDefaultUrl() ?>',
     remove_linebreaks: false,
     use_native_selects: true,
     paste_remove_spans: true,
@@ -140,15 +141,15 @@
     importcss_append: true,
 
     // Save function
-    save_onsavecallback: "phpMyFAQSave",
+    save_onsavecallback: () => { phpMyFAQSave(); },
 
     // phpMyFAQ CSS
-    content_css: '../assets/themes/<?php echo Template::getTplSetName() ?>/css/style.min.css?<?php echo time(); ?>',
+    content_css: '../assets/themes/<?= Template::getTplSetName() ?>/css/style.min.css?<?= time(); ?>',
 
     // Replace values for the template plugin
     template_replace_values: {
-      username: '<?php echo addslashes($user->userdata->get('display_name')) ?>',
-      user_id: '<?php echo $user->userdata->get('user_id') ?>'
+      username: '<?= addslashes($user->userdata->get('display_name')) ?>',
+      user_id: '<?= $user->userdata->get('user_id') ?>'
     },
 
     templates: [
@@ -201,7 +202,7 @@ function phpMyFAQSave() {
     });
 
     $.post('index.php', data, null);
-    indicator.html('<?php echo $PMF_LANG['ad_entry_savedsuc'] ?>');
+    indicator.html('<?= $PMF_LANG['ad_entry_savedsuc'] ?>');
     $('#temporarySaveButton').remove();
     indicator.fadeOut(5000);
   }

diff --git a/phpmyfaq/ajaxservice.php b/phpmyfaq/ajaxservice.php
@@ -470,8 +470,8 @@
     case 'savequestion':
 
         if (!$faqConfig->get('records.allowQuestionsForGuests') &&
-            $user->perm->checkRight($user->getUserId(), 'addquestion')) {
-            $message = array('error' => $PMF_LANG['err_NotAuth']);
+            !$user->perm->checkRight($user->getUserId(), 'addquestion')) {
+            $message = ['error' => $PMF_LANG['err_NotAuth']];
             break;
         }
 

diff --git a/phpmyfaq/faq.php b/phpmyfaq/faq.php
@@ -230,7 +230,8 @@
     );
 }
 
-if ($user->perm->checkRight($user->getUserId(), 'addtranslation')) {
+if ($user->perm->checkRight($user->getUserId(), 'addtranslation') &&
+    !empty($availableLanguages) && count($availableLanguages) > 1) {
     $tpl->parseBlock(
         'writeContent',
         'addTranslation',