summaryrefslogtreecommitdiff
path: root/modules/user
AgeCommit message (Collapse)Author
2009-09-05Revert previous edit. Prefer « none » (sweet, nice Unicode characters) ↵Andy Staudacher
instead of HTML entities.
2009-09-05Add missing view for language selectionAndy Staudacher
2009-09-04placeholder for a missing viewBharat Mediratta
2009-09-04Shorten the name in the block so that it doesn't wrap.Bharat Mediratta
Use &laquo; and &raquo; in the << none >> text.
2009-09-04When changing user preferences, reset the session based locale preferences.Andy Staudacher
2009-09-04Add new locale preferences: Adding per session (cookie) locale preferences ↵Andy Staudacher
and check the browser's / OS' locale preferences. Ticket 582.
2009-09-01XSS / style fixes for newly detected issues (after fixing XSS scanner)Andy Staudacher
2009-08-31Fix XSS vectors in HTML attributes (mostly t() calls)Andy Staudacher
2009-08-31Rename mark_safe() to mark_clean()Andy Staudacher
2009-08-30Change all instances of SafeString::of_safe_html() to html::mark_safe() in ↵Andy Staudacher
views.
2009-08-29Update all code to use helper method html::clean(), html::purify(), ... ↵Andy Staudacher
instead of SafeString directly.
2009-08-29Undo url helper changes - url methods no longer return a SafeString.Andy Staudacher
Adding SafeString::of_safe_html() calls where urls are passed as parameters to t() and t2().
2009-08-29Merge commit 'upstream/master'Andy Staudacher
Conflicts: modules/akismet/views/admin_akismet.html.php modules/comment/helpers/comment_rss.php modules/gallery/helpers/gallery_rss.php modules/gallery/libraries/I18n.php modules/gallery/views/permissions_browse.html.php modules/gallery/views/simple_uploader.html.php modules/info/views/info_block.html.php modules/organize/controllers/organize.php modules/organize/views/organize.html.php modules/organize/views/organize_album.html.php themes/default/views/album.html.php themes/default/views/movie.html.php themes/default/views/photo.html.php
2009-08-29Refactor all calls of p::clean() to SafeString::of() and p::purify() to ↵Andy Staudacher
SafeString::purify(). Removing any p::clean() calls for arguments to t() and t2() since their args are wrapped in a SafeString anyway.
2009-08-29Fix active() to not use user::guest() as the fallback for our Session::get() ↵Bharat Mediratta
call.
2009-08-29Adding SafeString which is going to replace p::clean() and p::purify().Andy Staudacher
Refactoring of Xss_Security_Test. t() and t2() return a SafeString instance. TODO: - Update all code to use SafeString where appropriate. - Update golden fole of Xss_Security_Test - Stop reporting CLEAN vars in Xss_Security_Test
2009-08-27Remove 'ENGINE=InnoDB' specification from tables that we create. UseBharat Mediratta
the system's default table specification. Fixes ticket #597.
2009-08-27Don't ask for csrf when we're resetting passwords. They're not gonna have ↵Bharat Mediratta
one. Duh! Fixes #642.
2009-08-09Require a valid url for users. Fixes ticket #612.Bharat Mediratta
2009-08-08Change galleryPanel and galleryDialog widgets to gallery_panel and ↵Tim Almdal
gallery_dialog respectively Signed-off-by: Bharat Mediratta <bharat@menalto.com>
2009-08-08Refactor the gallery dialog into a jQuery widgetTim Almdal
Signed-off-by: Bharat Mediratta <bharat@menalto.com>
2009-08-08Don't show the ajaxy login link in the top right corner if we're on the ↵Bharat Mediratta
login page itself. Signed-off-by: Bharat Mediratta <bharat@menalto.com>
2009-08-06Cleanup the javascript for enabling dialog or panel links.Tim Almdal
1) We don't need to loop over the elements to bind the event handler. 2) Just include gallery.panel.js for all the admin pages. Signed-off-by: Tim Almdal <tnalmdal@shaw.ca>
2009-08-02Change the API for getting to the original state of an ORM.Bharat Mediratta
Old API: $obj->original("field_name") New API: $obj->original()->field_name This allows us to revert the varous xxx_updated events back to passing an original ORM as well as the the updated one. This makes for a cleaner event API. Old API: comment_updated($comment) { $comment->original("field_name") } Old API: comment_updated($old, $new) { $old->field_name }
2009-07-29Clean up user form events. Thanks to Ben Smith (glooper).Bharat Mediratta
2009-07-28Use events to generate menus, instead of having xxx_menu helpers.Bharat Mediratta
This is the first step towards having a simple, lightweight and unified API for module interaction.
2009-07-25fix for ticket #574. The user->url database wasn't being set when the user ↵Tim Almdal
was updated via the admin panel.
2009-07-25Pass the variable when the "user_edit_form" event is fired.Tim Almdal
2009-07-23Add form processing events:Bharat Mediratta
user_add_form_admin admin adding a user user_edit_form_admin admin editing a user user_add_form_admin_completed successfully added a user (admin) user_edit_form user editing their own settings user_edit_form_completed successfully edited a user (admin and user editing own settings)
2009-07-23Convert instances of theme_url() to just url() to match the API changeBharat Mediratta
made in dbeadc1407293d0c7af36723db6fe5699890b845
2009-07-22Use the Kohana cascading filesystem to locate resources loaded by theBharat Mediratta
theme. Because the theme comes first, this means that themes can override any module resources, at the cost that we no longer have namespacing for JS and CSS files. The only file getting used outside of this model is themes/default/screen.css which is used in the admin theme. I fixed that by copying screen.css into admin_default and renaming its screen.css to admin_screen.css. I also copied over all the images that it was referencing. Fixes tickets #48 and #539. Theme API changes: - theme_script(), theme_url() and theme_css() are no longer needed - script(), url() and css() now refer to the first matching asset in the module load path, where gallery3/lib is at the end of the path
2009-07-21In the logout link, urlencode the continue url so that ampersands, etcBharat Mediratta
don't break encapsulation. In the logout controller, don't run the url through url::redirect because that uses url::site(). Just set the Location header directly. This fixes ticket #483.
2009-07-21Escape bare & symbols so that we use valid entities. Fixes ticket #577.Bharat Mediratta
2009-07-19More thorough fix for #421. Create User_Model::display_name() whichBharat Mediratta
uses the full name if there is one, or falls back to the name if that's all we have.
2009-07-21Changed "Forgot Your Password" text to use capital 'Y' on the word YourShai Ben-Naphtali
Signed-off-by: Bharat Mediratta <bharat@menalto.com>
2009-07-17Rename "locale" helper to "locales" to avoid conflicting with PHP 5.3.Bharat Mediratta
Fixes ticket #194
2009-07-16Second non-trivial change to the event code. We now publish modelBharat Mediratta
related events from within the model handling code. The only exception to this currently is item_created which is challenging because we have to save the item using ORM_MPTT::add_to_parent() before the object itself is fully set up. When we get that down to one call to save() we can publish that event from within the model also.
2009-07-16Non-trivial changes to the event handling code:Bharat Mediratta
1) The item_updated event no longer takes the old and new items. Instead we overload ORM to track the original data and make that available via the item. This will allow us to move event publishing down into the API methods which in turn will give us more stability since we won't require each controller to remember to do it. 2) ORM class now tracks the original values. It doesn't track the original relationships (no need for that, yet) 3) Added new events: item_deleted group_deleted user_deleted
2009-07-16Add missing ) dropped in 8f9a943f.Bharat Mediratta
2009-07-13Add quotes around all values that contain spaces in them, and add aBharat Mediratta
test to make sure that we continue to do so. This makes sure that we don't have problems with 5.3 which treats the literal "on" as a boolean.
2009-07-02Use Unicode characters (looks better to translator, and fixes normalization ↵Andy Staudacher
issue in translation server)
2009-07-01Fix a bunch of XSS vulnerabilities turned up by manual inspectionBharat Mediratta
using the checklist in ticket #385.
2009-06-28Rename $theme->url() to $theme->theme_url() for consistency wihtBharat Mediratta
$theme->theme_script().
2009-06-28Use $theme->script() method to render module javascript filesTim Almdal
2009-06-23Refactor the install/upgrade code to be more flexible.Bharat Mediratta
Add xxx_installer::upgrade($version) method so that upgrade stanzas are separate from install stanzas. In the old code, to do an upgrade meant that you had to re-evolve everything from the initial install because we'd step through each version's changes. But what we really want is for the initial install to start off in the perfect initial state, and the upgrades to do the work behind the scenes. So now the install() function gets things set up properly the first time, and the upgrade() function does any work to catch you up to the latest code. See gallery_installer.php for a good example.
2009-06-15Add string to localizerunostar
2009-06-13Create gallery::date_time(), gallery::date() and gallery::time()Bharat Mediratta
functions that format a unix timestamp into a date+time/date/time string. Partial fix for ticket #347. Signed-off-by: <unostar@danalan.info>
2009-06-11Actually save the url when editing user information.Bharat Mediratta
Fixes ticket #363. Signed-off-by: <unostar@danalan.info>
2009-06-09Create a new method in MY_url.php "get_item_from_uri" which loads the itemTim Almdal
based on the uri. Then use this helper method in logout.php to insure that the guest user has access to the "continue" uri. If they don't redirect to the root album and let it deal with access issues.
2009-06-06Don't ask for CSRF token when trying to view the password reset form.Bharat Mediratta