From 1ada27916fa4575f6b093db17f4165d8cce16088 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 11 Feb 2010 05:24:16 -0800
Subject: Use the admin/users/edit_user_form version of the user editing form
 right after initial install so that we're not requiring the user to re-enter
 the auto-generated password to change their password and email.

Fixes ticket #1007
---
 modules/gallery/views/welcome_message.html.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/views/welcome_message.html.php b/modules/gallery/views/welcome_message.html.php
index caeeff66..4d6ed726 100644
--- a/modules/gallery/views/welcome_message.html.php
+++ b/modules/gallery/views/welcome_message.html.php
@@ -15,12 +15,15 @@
   </p>
 
   <p>
-    <a href="<?= url::site("user_profile/show/{$user->id}") ?>"
+    <a href="<?= url::site("admin/users/edit_user_form/{$user->id}") ?>"
       title="<?= t("Edit your profile")->for_html_attr() ?>"
       id="g-after-install-change-password-link"
       class="g-button ui-state-default ui-corners-all">
       <?= t("Change password and email now") ?>
     </a>
+    <script type="text/javascript">
+      $("#g-after-install-change-password-link").gallery_dialog();
+    </script>
   </p>
 
   <p>
-- 
cgit v1.2.3


From d53f6d0e052fb455059170a311640fcd06cad798 Mon Sep 17 00:00:00 2001
From: Andy Staudacher <andy.st@gmail.com>
Date: Fri, 12 Feb 2010 16:40:44 -0800
Subject: Fix for tickets 1009 and 603: Show a themed error page to guests /
 registered users (not to admins though). And show a login form to guests for
 404 (incl. insufficient view permissions) errors.

---
 modules/gallery/controllers/albums.php            |  13 +--
 modules/gallery/controllers/items.php             |   2 +-
 modules/gallery/controllers/movies.php            |   2 +-
 modules/gallery/controllers/photos.php            |   2 +-
 modules/gallery/helpers/access.php                |   2 +-
 modules/gallery/helpers/auth.php                  |  14 ---
 modules/gallery/libraries/MY_Kohana_Exception.php |  59 +++++++++-
 modules/gallery/views/error.html.php              |  12 ++
 modules/gallery/views/error_404.html.php          |  21 ++++
 modules/gallery/views/kohana_error_page.php       | 127 ----------------------
 10 files changed, 97 insertions(+), 157 deletions(-)
 create mode 100644 modules/gallery/views/error.html.php
 create mode 100644 modules/gallery/views/error_404.html.php
 delete mode 100644 modules/gallery/views/kohana_error_page.php

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/controllers/albums.php b/modules/gallery/controllers/albums.php
index c2b474ee..1cc3b1ec 100644
--- a/modules/gallery/controllers/albums.php
+++ b/modules/gallery/controllers/albums.php
@@ -26,19 +26,10 @@ class Albums_Controller extends Items_Controller {
     if (!is_object($album)) {
       // show() must be public because we route to it in url::parse_url(), so make
       // sure that we're actually receiving an object
-      throw new Kohana_404_Exception();
+      Event::run('system.404');
     }
 
-    if (!access::can("view", $album)) {
-      if ($album->id == 1) {
-        // Even show the login page to logged in users.
-        // It's a better user experience than a "Dang" error page.
-        print auth::login_page();
-        return;
-      } else {
-        access::required("view", $album);
-      }
-    }
+    access::required("view", $album);
 
     $page_size = module::get_var("gallery", "page_size", 9);
     $input = Input::instance();
diff --git a/modules/gallery/controllers/items.php b/modules/gallery/controllers/items.php
index f261e3a9..0bd47b2d 100644
--- a/modules/gallery/controllers/items.php
+++ b/modules/gallery/controllers/items.php
@@ -21,7 +21,7 @@ class Items_Controller extends Controller {
   public function __call($function, $args) {
     $item = ORM::factory("item", (int)$function);
     if (!$item->loaded()) {
-      throw new Kohana_404_Exception();
+      Event::run('system.404');
     }
 
     // Redirect to the more specific resource type, since it will render
diff --git a/modules/gallery/controllers/movies.php b/modules/gallery/controllers/movies.php
index 78a56e81..1dbcb481 100644
--- a/modules/gallery/controllers/movies.php
+++ b/modules/gallery/controllers/movies.php
@@ -22,7 +22,7 @@ class Movies_Controller extends Items_Controller {
     if (!is_object($movie)) {
       // show() must be public because we route to it in url::parse_url(), so make
       // sure that we're actually receiving an object
-      throw new Kohana_404_Exception();
+      Event::run('system.404');
     }
 
     access::required("view", $movie);
diff --git a/modules/gallery/controllers/photos.php b/modules/gallery/controllers/photos.php
index f2d47eec..2a77aea4 100644
--- a/modules/gallery/controllers/photos.php
+++ b/modules/gallery/controllers/photos.php
@@ -22,7 +22,7 @@ class Photos_Controller extends Items_Controller {
     if (!is_object($photo)) {
       // show() must be public because we route to it in url::parse_url(), so make
       // sure that we're actually receiving an object
-      throw new Kohana_404_Exception();
+      Event::run('system.404');
     }
   
     access::required("view", $photo);
diff --git a/modules/gallery/helpers/access.php b/modules/gallery/helpers/access.php
index 7e8b079a..c4c100ca 100644
--- a/modules/gallery/helpers/access.php
+++ b/modules/gallery/helpers/access.php
@@ -120,7 +120,7 @@ class access_Core {
     if (!self::can($perm_name, $item)) {
       if ($perm_name == "view") {
         // Treat as if the item didn't exist, don't leak any information.
-        throw new Kohana_404_Exception();
+        Event::run('system.404');
       } else {
         self::forbidden();
       }
diff --git a/modules/gallery/helpers/auth.php b/modules/gallery/helpers/auth.php
index 8b0ce470..c3e9e6e9 100644
--- a/modules/gallery/helpers/auth.php
+++ b/modules/gallery/helpers/auth.php
@@ -130,18 +130,4 @@ class auth_Core {
     $session->set("admin_area_activity_timestamp", time());
     return false;
   }
-
-  /**
-   * Returns the themed login page.
-   */
-  static function login_page($continue_url=null) {
-    $view = new Theme_View("page.html", "other", "login");
-    $view->page_title = t("Log in to Gallery");
-    $view->content = new View("login_ajax.html");
-    $view->content->form = auth::get_login_form("login/auth_html");
-    // Avoid anti-phishing protection by passing the url as session variable.
-    $continue_url or $continue_url = url::current(true);
-    Session::instance()->set("continue_url", $continue_url);
-    return $view;
-  }
 }
\ No newline at end of file
diff --git a/modules/gallery/libraries/MY_Kohana_Exception.php b/modules/gallery/libraries/MY_Kohana_Exception.php
index 1c40091a..d6f1f467 100644
--- a/modules/gallery/libraries/MY_Kohana_Exception.php
+++ b/modules/gallery/libraries/MY_Kohana_Exception.php
@@ -33,6 +33,63 @@ class Kohana_Exception extends Kohana_Exception_Core {
     if ($e instanceof ORM_Validation_Exception) {
       Kohana_Log::add("error", "Validation errors: " . print_r($e->validation->errors(), 1));
     }
-    return parent::handle($e);
+    try {
+      $user = identity::active_user();
+      $try_themed_view = $user && !$user->admin;
+    } catch (Exception $e2) {
+      $try_themed_view = false;
+    }
+
+    if ($try_themed_view) {
+      try {
+        return self::_show_themed_error_page($e);
+      } catch (Exception $e3) {
+        Kohana_Log::add("error", "Exception in exception handling code: " . self::text($e3));
+        return parent::handle($e);
+      }
+    } else {
+      return parent::handle($e);
+    }
+  }
+
+  /**
+   * Shows a themed error page.
+   * @see Kohana_Exception::handle
+   */
+  private static function _show_themed_error_page(Exception $e) {
+    // Create a text version of the exception
+    $error = Kohana_Exception::text($e);
+    
+    // Add this exception to the log
+    Kohana_Log::add('error', $error);
+
+    // Manually save logs after exceptions
+    Kohana_Log::save();
+
+    if (!headers_sent()) {
+      if ($e instanceof Kohana_Exception) {
+        $e->sendHeaders();
+      } else {
+        header("HTTP/1.1 500 Internal Server Error");
+      }
+    }
+
+    $view = new Theme_View("page.html", "other", "error");
+    if ($e instanceof Kohana_404_Exception) {
+      $view->page_title = t("Dang...  Page not found!");
+      $view->content = new View("error_404.html");
+      $user = identity::active_user();
+      $view->content->is_guest = $user && $user->guest;
+      if ($view->content->is_guest) {
+        $view->content->login_form = new View("login_ajax.html");
+        $view->content->login_form->form = auth::get_login_form("login/auth_html");
+        // Avoid anti-phishing protection by passing the url as session variable.
+        Session::instance()->set("continue_url", url::current(true));
+      }
+    } else {
+      $view->page_title = t("Dang...  Something went wrong!");
+      $view->content = new View("error.html");
+    }
+    print $view;
   }
 }
\ No newline at end of file
diff --git a/modules/gallery/views/error.html.php b/modules/gallery/views/error.html.php
new file mode 100644
index 00000000..5d81b651
--- /dev/null
+++ b/modules/gallery/views/error.html.php
@@ -0,0 +1,12 @@
+<?php defined("SYSPATH") or die("No direct script access.") ?>
+<div id="g-error">
+  <h1>
+    <?= t("Dang...  Something went wrong!") ?>
+  </h1>
+  <h2>
+    <?= t("We tried really hard, but it's broken.") ?>
+  </h2>
+  <p>
+    <?= t("Talk to your Gallery administrator for help fixing this!") ?>
+  </p>
+</div>
\ No newline at end of file
diff --git a/modules/gallery/views/error_404.html.php b/modules/gallery/views/error_404.html.php
new file mode 100644
index 00000000..e5846e65
--- /dev/null
+++ b/modules/gallery/views/error_404.html.php
@@ -0,0 +1,21 @@
+<?php defined("SYSPATH") or die("No direct script access.") ?>
+<div id="g-error">
+  <h1>
+    <?= t("Dang...  Page not found!") ?>
+  </h1>
+  <? if ($is_guest): ?>
+    <h2>
+      <?= t("Hey wait, you're not signed in yet!") ?>
+    </h2>
+    <p>
+       <?= t("Maybe the page exists, but is only visible to authorized users.") ?>
+       <?= t("Please sign in to find out.") ?>
+    </p>
+    <?= $login_form ?>
+  <? else: ?>
+    <p>
+      <?= t("Maybe the page exists, but is only visible to authorized users.") ?>
+      <?= t("Talk to your Gallery administrator if you think this is an error for help fixing this!") ?>
+    </p>
+ <? endif; ?>
+</div>
\ No newline at end of file
diff --git a/modules/gallery/views/kohana_error_page.php b/modules/gallery/views/kohana_error_page.php
deleted file mode 100644
index b9fdcc19..00000000
--- a/modules/gallery/views/kohana_error_page.php
+++ /dev/null
@@ -1,127 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.") ?>
-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
-  <head>
-    <style type="text/css">
-      body {
-        background: #fff;
-        font-size: 14px;
-        line-height: 130%;
-      }
-
-      div.big_box {
-        padding: 10px;
-        background: #eee;
-        border: solid 1px #ccc;
-        font-family: sans-serif;
-        color: #111;
-        width: 42em;
-        margin: 20px auto;
-      }
-
-      div#framework_error {
-        text-align: center;
-      }
-
-      div#error_details {
-        text-align: left;
-      }
-
-      code {
-        font-family: monospace;
-        font-size: 12px;
-        margin: 20px;
-        color: #333;
-        white-space: pre-wrap;
-        white-space: -moz-pre-wrap;
-        word-wrap: break-word;
-      }
-
-      h3 {
-        font-family: sans-serif;
-        margin: 2px 0px 0px 0px;
-        padding: 8px 0px 0px 0px;
-        border-top: 1px solid #ddd;
-      }
-
-      p {
-        padding: 0px;
-        margin: 0px 0px 10px 0px;
-      }
-
-      li, pre {
-        padding: 0px;
-        margin: 0px;
-      }
-    </style>
-    <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
-    <title><?= t("Something went wrong!") ?></title>
-  </head>
-  <body>
-    <? try { $user = identity::active_user(); } catch (Exception $e) { } ?>
-    <? $admin = php_sapi_name() == "cli" || isset($user) && $user->admin ?>
-    <div class="big_box" id="framework_error">
-      <h1>
-        <?= t("Dang...  Something went wrong!") ?>
-      </h1>
-      <h2>
-        <?= t("We tried really hard, but it's broken.") ?>
-      </h2>
-      <? if (!$admin): ?>
-      <p>
-        <?= t("Talk to your Gallery administrator for help fixing this!") ?>
-      </p>
-      <? endif ?>
-    </div>
-    <? if ($admin): ?>
-    <div class="big_box" id="error_details">
-      <h2>
-        <?= t("Hey wait, you're an admin!  We can tell you stuff.") ?>
-      </h2>
-      <script type="text/javascript">
-        var show_details = function() {
-          document.getElementById("stuff").style.display = "block";
-          document.getElementById("toggle").style.display = "none";
-        }
-      </script>
-      <a id="toggle" href="#" onclick="javascript:show_details(); return false;">
-        <b><?= t("Ok.. tell me stuff!") ?></b>
-      </a>
-      <div id="stuff" style="display: none">
-        <? if (!empty($line) and !empty($file)): ?>
-        <div id="summary">
-          <h3>
-            <?= t("Help!") ?>
-          </h3>
-          <p>
-            <?= t("If this stuff doesn't make any sense to you, <a href=\"%url\">ask for help in the Gallery forums</a>!", array("url" => "http://gallery.menalto.com/forum/96")) ?>
-          </p>
-          <h3>
-            <?= t("So here's the error:") ?>
-          </h3>
-
-          <code class="block"><?= $message ?></code>
-          <p>
-            <?= t("File: <b>%file</b>, line: <b>%line</b>", array("file" => $file, "line" => $line)) ?>
-          </p>
-        </div>
-        <? endif ?>
-
-        <? $trace = $PHP_ERROR ? array_slice(debug_backtrace(), 1) : $exception->getTrace(); ?>
-        <? $trace = Kohana::backtrace($trace); ?>
-        <? if (!empty($trace)): ?>
-        <div id="stack_trace">
-          <h3>
-            <?= t("And here's how we got there:") ?>
-          </h3>
-          <?= $trace ?>
-          <? endif ?>
-        </div>
-      </div>
-      <? else: ?>
-      <? $trace = $PHP_ERROR ? array_slice(debug_backtrace(), 1) : $exception->getTraceAsString(); ?>
-      <? if (!empty($trace)): ?>
-      <? Kohana_Log::add("error", print_r($trace, 1)); ?>
-      <? endif ?>
-      <? endif ?>
-  </body>
-</html>
-- 
cgit v1.2.3


From e88e976fc4255d323a1f5919453604ecf467ed0d Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 12 Feb 2010 13:49:14 -0800
Subject: Tighten up the text.

---
 modules/gallery/views/error_404.html.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/views/error_404.html.php b/modules/gallery/views/error_404.html.php
index e5846e65..4b037a79 100644
--- a/modules/gallery/views/error_404.html.php
+++ b/modules/gallery/views/error_404.html.php
@@ -15,7 +15,7 @@
   <? else: ?>
     <p>
       <?= t("Maybe the page exists, but is only visible to authorized users.") ?>
-      <?= t("Talk to your Gallery administrator if you think this is an error for help fixing this!") ?>
+      <?= t("If you think this is an error, talk to your Gallery administrator!") ?>
     </p>
  <? endif; ?>
 </div>
\ No newline at end of file
-- 
cgit v1.2.3


From 2dad1d7cd15bed3c89de11cadf4b3b5c43134f69 Mon Sep 17 00:00:00 2001
From: Andy Staudacher <andy.st@gmail.com>
Date: Fri, 12 Feb 2010 20:59:26 -0800
Subject: Some HTML validation fixes (don't render empty <ul> lists, empty id
 attributes, use &amp; not &)

---
 modules/gallery/helpers/gallery_event.php     |  6 +++---
 modules/gallery/libraries/Menu.php            | 13 +++++++++++++
 modules/gallery/views/menu.html.php           |  4 ++--
 modules/gallery/views/menu_ajax_link.html.php |  2 +-
 modules/gallery/views/menu_dialog.html.php    |  2 +-
 modules/gallery/views/menu_link.html.php      |  2 +-
 themes/wind/views/page.html.php               |  2 +-
 7 files changed, 22 insertions(+), 9 deletions(-)

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php
index 63f33c12..faf1c0c6 100644
--- a/modules/gallery/helpers/gallery_event.php
+++ b/modules/gallery/helpers/gallery_event.php
@@ -336,7 +336,7 @@ class gallery_event_Core {
             ->css_class("ui-icon-rotate-ccw")
             ->ajax_handler("function(data) { " .
                            "\$.gallery_replace_image(data, \$('$thumb_css_selector')) }")
-            ->url(url::site("quick/rotate/$item->id/ccw?csrf=$csrf&from_id=$theme_item->id&page_type=$page_type")))
+            ->url(url::site("quick/rotate/$item->id/ccw?csrf=$csrf&amp;from_id=$theme_item->id&amp;page_type=$page_type")))
           ->append(
             Menu::factory("ajax_link")
             ->id("rotate_cw")
@@ -344,7 +344,7 @@ class gallery_event_Core {
             ->css_class("ui-icon-rotate-cw")
             ->ajax_handler("function(data) { " .
                            "\$.gallery_replace_image(data, \$('$thumb_css_selector')) }")
-            ->url(url::site("quick/rotate/$item->id/cw?csrf=$csrf&from_id=$theme_item->id&page_type=$page_type")));
+            ->url(url::site("quick/rotate/$item->id/cw?csrf=$csrf&amp;from_id=$theme_item->id&amp;page_type=$page_type")));
       }
 
       // @todo Don't move photos from the photo page; we don't yet have a good way of redirecting
@@ -384,7 +384,7 @@ class gallery_event_Core {
                    ->label($delete_title)
                    ->css_class("ui-icon-trash")
                    ->css_id("g-quick-delete")
-                   ->url(url::site("quick/form_delete/$item->id?csrf=$csrf&from_id=$theme_item->id&page_type=$page_type")));
+                   ->url(url::site("quick/form_delete/$item->id?csrf=$csrf&amp;from_id=$theme_item->id&amp;page_type=$page_type")));
       }
 
       if ($item->is_album()) {
diff --git a/modules/gallery/libraries/Menu.php b/modules/gallery/libraries/Menu.php
index e2b68d1a..7c76ab04 100644
--- a/modules/gallery/libraries/Menu.php
+++ b/modules/gallery/libraries/Menu.php
@@ -216,6 +216,19 @@ class Menu_Core extends Menu_Element {
     return null;
   }
 
+  public function is_empty() {
+    foreach ($this->elements as $element) {
+      if ($element instanceof Menu) {
+        if (!$element->is_empty()) {
+          return false;
+        }
+      } else {
+        return false;
+      }
+    }
+    return true;
+  }
+
   public function render() {
     $view = new View(isset($this->view) ? $this->view : "menu.html");
     $view->menu = $this;
diff --git a/modules/gallery/views/menu.html.php b/modules/gallery/views/menu.html.php
index cb49bcdf..17a249dd 100644
--- a/modules/gallery/views/menu.html.php
+++ b/modules/gallery/views/menu.html.php
@@ -1,7 +1,7 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
-<? if ($menu->elements): // Don't show the menu if it has no choices ?>
+<? if (!$menu->is_empty()): // Don't show the menu if it has no choices ?>
 <? if ($menu->is_root): ?>
-<ul <?= isset($menu->css_id) ? "id='$menu->css_id'" : "" ?> class="<?= $menu->css_class ?>">
+<ul <?= $menu->css_id ? "id='$menu->css_id'" : "" ?> class="<?= $menu->css_class ?>">
   <? foreach ($menu->elements as $element): ?>
   <?= $element->render() ?>
   <? endforeach ?>
diff --git a/modules/gallery/views/menu_ajax_link.html.php b/modules/gallery/views/menu_ajax_link.html.php
index 00a394bc..06cd6f92 100644
--- a/modules/gallery/views/menu_ajax_link.html.php
+++ b/modules/gallery/views/menu_ajax_link.html.php
@@ -1,6 +1,6 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <li>
-  <a id="<?= $menu->css_id ?>"
+  <a <?= $menu->css_id ? "id='{$menu->css_id}'" : "" ?>
      class="g-ajax-link <?= $menu->css_class ?>"
      href="<?= $menu->url ?>"
      title="<?= $menu->label->for_html_attr() ?>"
diff --git a/modules/gallery/views/menu_dialog.html.php b/modules/gallery/views/menu_dialog.html.php
index 99b1b013..b44080c3 100644
--- a/modules/gallery/views/menu_dialog.html.php
+++ b/modules/gallery/views/menu_dialog.html.php
@@ -1,6 +1,6 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <li>
-  <a id="<?= $menu->css_id ?>"
+  <a <?= $menu->css_id ? "id='{$menu->css_id}'" : "" ?>
      class="g-dialog-link <?= $menu->css_class ?>"
      href="<?= $menu->url ?>"
      title="<?= $menu->label->for_html_attr() ?>">
diff --git a/modules/gallery/views/menu_link.html.php b/modules/gallery/views/menu_link.html.php
index 8e4cdb95..a36d2754 100644
--- a/modules/gallery/views/menu_link.html.php
+++ b/modules/gallery/views/menu_link.html.php
@@ -1,6 +1,6 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <li>
-  <a id="<?= $menu->css_id ?>"
+  <a <?= $menu->css_id ? "id='{$menu->css_id}'" : "" ?>
      class="g-menu-link <?= $menu->css_class ?>"
      href="<?= $menu->url ?>"
      title="<?= $menu->label->for_html_attr() ?>">
diff --git a/themes/wind/views/page.html.php b/themes/wind/views/page.html.php
index 2dcc5d70..61e34145 100644
--- a/themes/wind/views/page.html.php
+++ b/themes/wind/views/page.html.php
@@ -91,7 +91,7 @@
           <div id="g-site-menu" style="visibility: hidden">
           <?= $theme->site_menu() ?>
           </div>
-          <script> $(document).ready(function() { $("#g-site-menu").css("visibility", "visible"); }) </script>
+          <script type="text/javascript"> $(document).ready(function() { $("#g-site-menu").css("visibility", "visible"); }) </script>
 
           <?= $theme->header_bottom() ?>
         </div>
-- 
cgit v1.2.3


From 1a951cb7f61b33437c2e9b04da0565393d072c03 Mon Sep 17 00:00:00 2001
From: Andy Staudacher <andy.st@gmail.com>
Date: Sat, 13 Feb 2010 12:35:39 -0800
Subject: HTML validation fix (<script>)

---
 modules/gallery/views/user_profile.html.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/views/user_profile.html.php b/modules/gallery/views/user_profile.html.php
index 1c3e4ea2..1c346c26 100644
--- a/modules/gallery/views/user_profile.html.php
+++ b/modules/gallery/views/user_profile.html.php
@@ -22,7 +22,7 @@
     padding: 0;
   }
 </style>
-<script>
+<script type="text/javascript">
   $(document).ready(function() {
     $("#g-profile-return").click(function(event) {
       history.go(-1);
-- 
cgit v1.2.3


From 409121942590e12692eaf4e6e9e8b71bfe5ed60c Mon Sep 17 00:00:00 2001
From: Andy Staudacher <andy.st@gmail.com>
Date: Sun, 14 Feb 2010 19:26:34 -0800
Subject: Fix for ticket #491: Make user and group names translatable. Also
 fixed a UI bug: No longer showing the edit user buttons to admins in the
 profile view (to be consistent with the requirements in the controller).

---
 modules/gallery/controllers/user_profile.php    | 5 +++--
 modules/gallery/helpers/gallery_event.php       | 3 +++
 modules/gallery/views/permissions_form.html.php | 2 +-
 modules/user/helpers/user_installer.php         | 8 ++++----
 modules/user/models/user.php                    | 2 +-
 modules/user/views/admin_users.html.php         | 2 +-
 modules/user/views/admin_users_group.html.php   | 6 +++---
 7 files changed, 16 insertions(+), 12 deletions(-)

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/controllers/user_profile.php b/modules/gallery/controllers/user_profile.php
index 327d2ff1..05373466 100644
--- a/modules/gallery/controllers/user_profile.php
+++ b/modules/gallery/controllers/user_profile.php
@@ -23,7 +23,8 @@ class User_Profile_Controller extends Controller {
     $user = identity::lookup_user($id);
     $active_user = identity::active_user();
     $is_current_active = $active_user->id == $id;
-    $display_all =  $active_user->admin || ($is_current_active && !$active_user->guest);
+    $can_edit = $is_current_active && !$active_user->guest;
+    $display_all = $active_user->admin || $can_edit;
 
     $v = new Theme_View("page.html", "other", "profile");
     $v->page_title = t("%name Profile", array("name" => $user->display_name()));
@@ -32,7 +33,7 @@ class User_Profile_Controller extends Controller {
     // @todo modify user_home to supply a link to their album,
     $v->content->user = $user;
     $v->content->not_current = !$is_current_active;
-    $v->content->editable = identity::is_writable() && $display_all;
+    $v->content->editable = identity::is_writable() && $can_edit;
 
     $event_data = (object)array("user" => $user, "display_all" => $display_all, "content" => array());
     module::event("show_user_profile", $event_data);
diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php
index faf1c0c6..3f77bc42 100644
--- a/modules/gallery/helpers/gallery_event.php
+++ b/modules/gallery/helpers/gallery_event.php
@@ -423,6 +423,9 @@ class gallery_event_Core {
         if ($field == "locale") {
           $value = locales::display_name($value);
         }
+        if ($field == "full_name") {
+          $value = t($value);
+        }
         $v->user_profile_data[(string) $label] = $value;
       }
     }
diff --git a/modules/gallery/views/permissions_form.html.php b/modules/gallery/views/permissions_form.html.php
index f1714119..b486acb7 100644
--- a/modules/gallery/views/permissions_form.html.php
+++ b/modules/gallery/views/permissions_form.html.php
@@ -5,7 +5,7 @@
     <tr>
       <th> </th>
       <? foreach ($groups as $group): ?>
-      <th> <?= html::clean($group->name) ?> </th>
+      <th> <?= html::clean(t($group->name)) ?> </th>
       <? endforeach ?>
     </tr>
 
diff --git a/modules/user/helpers/user_installer.php b/modules/user/helpers/user_installer.php
index 729f087a..c57ad010 100644
--- a/modules/user/helpers/user_installer.php
+++ b/modules/user/helpers/user_installer.php
@@ -98,25 +98,25 @@ class user_installer {
                DEFAULT CHARSET=utf8;");
 
     $everybody = ORM::factory("group");
-    $everybody->name = "Everybody";
+    $everybody->name = t("Everybody", array("locale" => "root"));
     $everybody->special = true;
     $everybody->save();
 
     $registered = ORM::factory("group");
-    $registered->name = "Registered Users";
+    $registered->name = t("Registered Users", array("locale" => "root"));
     $registered->special = true;
     $registered->save();
 
     $guest = ORM::factory("user");
     $guest->name = "guest";
-    $guest->full_name = "Guest User";
+    $guest->full_name = t("Guest User", array("locale" => "root"));
     $guest->password = "";
     $guest->guest = true;
     $guest->save();
 
     $admin = ORM::factory("user");
     $admin->name = "admin";
-    $admin->full_name = "Gallery Administrator";
+    $admin->full_name = t("Gallery Administrator", array("locale" => "root"));
     $admin->password = "admin";
     $admin->email = "unknown@unknown.com";
     $admin->admin = true;
diff --git a/modules/user/models/user.php b/modules/user/models/user.php
index 4404ee63..aa752203 100644
--- a/modules/user/models/user.php
+++ b/modules/user/models/user.php
@@ -113,7 +113,7 @@ class User_Model extends ORM implements User_Definition {
    * @return string
    */
   public function display_name() {
-    return empty($this->full_name) ? $this->name : $this->full_name;
+    return empty($this->full_name) ? $this->name : t($this->full_name);
   }
 
   /**
diff --git a/modules/user/views/admin_users.html.php b/modules/user/views/admin_users.html.php
index 270a7207..69d97547 100644
--- a/modules/user/views/admin_users.html.php
+++ b/modules/user/views/admin_users.html.php
@@ -78,7 +78,7 @@
               <?= html::clean($user->name) ?>
             </td>
             <td>
-              <?= html::clean($user->full_name) ?>
+            <?= t(html::clean($user->full_name)) ?>
             </td>
             <td>
               <?= html::clean($user->email) ?>
diff --git a/modules/user/views/admin_users_group.html.php b/modules/user/views/admin_users_group.html.php
index 6c6c341e..8317d393 100644
--- a/modules/user/views/admin_users_group.html.php
+++ b/modules/user/views/admin_users_group.html.php
@@ -1,9 +1,9 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <h4>
-  <?= html::clean($group->name) ?>
+  <?= t(html::clean($group->name)) ?>
   <? if (!$group->special): ?>
   <a href="<?= url::site("admin/users/delete_group_form/$group->id") ?>"
-    title="<?= t("Delete the %name group", array("name" => $group->name))->for_html_attr() ?>"
+    title="<?= t("Delete the %name group", array("name" => t(html::clean($group->name))))->for_html_attr() ?>"
     class="g-dialog-link g-button g-right">
     <span class="ui-icon ui-icon-trash"><?= t("Delete") ?></span></a>
   <? else: ?>
@@ -22,7 +22,7 @@
     <a href="javascript:remove_user(<?= $user->id ?>, <?= $group->id ?>)"
        class="g-button g-right ui-state-default ui-corner-all ui-icon-left"
        title="<?= t("Remove %user from %group group",
-              array("user" => $user->name, "group" => $group->name))->for_html_attr() ?>">
+              array("user" => $user->name, "group" => t(html::clean($group->name))))->for_html_attr() ?>">
       <span class="ui-icon ui-icon-closethick"><?= t("Remove") ?></span>
     </a>
     <? endif ?>
-- 
cgit v1.2.3


From 5e25d2f7f11a75386e3c7f3d1d0c496eb3287cac Mon Sep 17 00:00:00 2001
From: Andy Staudacher <andy.st@gmail.com>
Date: Mon, 15 Feb 2010 14:27:48 -0800
Subject: Put focus on password field in reauthenticate dialog.

---
 modules/gallery/views/reauthenticate.html.php | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/views/reauthenticate.html.php b/modules/gallery/views/reauthenticate.html.php
index 8611d0f7..9a6696fb 100644
--- a/modules/gallery/views/reauthenticate.html.php
+++ b/modules/gallery/views/reauthenticate.html.php
@@ -7,4 +7,9 @@
     <?= t("You are currently logged in as %user_name.", array("user_name" => $user_name)) ?>
   </p>
   <?= $form ?>
+  <script type="text/javascript">
+  $("#g-reauthenticate-form").ready(function() {
+    $("#g-password").focus();
+  });
+  </script>
 </div>
\ No newline at end of file
-- 
cgit v1.2.3


From 7d98d4b7b9d16f32ed98c8eeb051be4149468dc6 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 18 Feb 2010 16:20:59 -0800
Subject: Revert "Fix for ticket #491: Make user and group names translatable."

This reverts commit 409121942590e12692eaf4e6e9e8b71bfe5ed60c.
---
 modules/gallery/controllers/user_profile.php    | 5 ++---
 modules/gallery/helpers/gallery_event.php       | 3 ---
 modules/gallery/views/permissions_form.html.php | 2 +-
 modules/user/helpers/user_installer.php         | 8 ++++----
 modules/user/models/user.php                    | 2 +-
 modules/user/views/admin_users.html.php         | 2 +-
 modules/user/views/admin_users_group.html.php   | 6 +++---
 7 files changed, 12 insertions(+), 16 deletions(-)

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/controllers/user_profile.php b/modules/gallery/controllers/user_profile.php
index 05373466..327d2ff1 100644
--- a/modules/gallery/controllers/user_profile.php
+++ b/modules/gallery/controllers/user_profile.php
@@ -23,8 +23,7 @@ class User_Profile_Controller extends Controller {
     $user = identity::lookup_user($id);
     $active_user = identity::active_user();
     $is_current_active = $active_user->id == $id;
-    $can_edit = $is_current_active && !$active_user->guest;
-    $display_all = $active_user->admin || $can_edit;
+    $display_all =  $active_user->admin || ($is_current_active && !$active_user->guest);
 
     $v = new Theme_View("page.html", "other", "profile");
     $v->page_title = t("%name Profile", array("name" => $user->display_name()));
@@ -33,7 +32,7 @@ class User_Profile_Controller extends Controller {
     // @todo modify user_home to supply a link to their album,
     $v->content->user = $user;
     $v->content->not_current = !$is_current_active;
-    $v->content->editable = identity::is_writable() && $can_edit;
+    $v->content->editable = identity::is_writable() && $display_all;
 
     $event_data = (object)array("user" => $user, "display_all" => $display_all, "content" => array());
     module::event("show_user_profile", $event_data);
diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php
index 3f77bc42..faf1c0c6 100644
--- a/modules/gallery/helpers/gallery_event.php
+++ b/modules/gallery/helpers/gallery_event.php
@@ -423,9 +423,6 @@ class gallery_event_Core {
         if ($field == "locale") {
           $value = locales::display_name($value);
         }
-        if ($field == "full_name") {
-          $value = t($value);
-        }
         $v->user_profile_data[(string) $label] = $value;
       }
     }
diff --git a/modules/gallery/views/permissions_form.html.php b/modules/gallery/views/permissions_form.html.php
index b486acb7..f1714119 100644
--- a/modules/gallery/views/permissions_form.html.php
+++ b/modules/gallery/views/permissions_form.html.php
@@ -5,7 +5,7 @@
     <tr>
       <th> </th>
       <? foreach ($groups as $group): ?>
-      <th> <?= html::clean(t($group->name)) ?> </th>
+      <th> <?= html::clean($group->name) ?> </th>
       <? endforeach ?>
     </tr>
 
diff --git a/modules/user/helpers/user_installer.php b/modules/user/helpers/user_installer.php
index c57ad010..729f087a 100644
--- a/modules/user/helpers/user_installer.php
+++ b/modules/user/helpers/user_installer.php
@@ -98,25 +98,25 @@ class user_installer {
                DEFAULT CHARSET=utf8;");
 
     $everybody = ORM::factory("group");
-    $everybody->name = t("Everybody", array("locale" => "root"));
+    $everybody->name = "Everybody";
     $everybody->special = true;
     $everybody->save();
 
     $registered = ORM::factory("group");
-    $registered->name = t("Registered Users", array("locale" => "root"));
+    $registered->name = "Registered Users";
     $registered->special = true;
     $registered->save();
 
     $guest = ORM::factory("user");
     $guest->name = "guest";
-    $guest->full_name = t("Guest User", array("locale" => "root"));
+    $guest->full_name = "Guest User";
     $guest->password = "";
     $guest->guest = true;
     $guest->save();
 
     $admin = ORM::factory("user");
     $admin->name = "admin";
-    $admin->full_name = t("Gallery Administrator", array("locale" => "root"));
+    $admin->full_name = "Gallery Administrator";
     $admin->password = "admin";
     $admin->email = "unknown@unknown.com";
     $admin->admin = true;
diff --git a/modules/user/models/user.php b/modules/user/models/user.php
index aa752203..4404ee63 100644
--- a/modules/user/models/user.php
+++ b/modules/user/models/user.php
@@ -113,7 +113,7 @@ class User_Model extends ORM implements User_Definition {
    * @return string
    */
   public function display_name() {
-    return empty($this->full_name) ? $this->name : t($this->full_name);
+    return empty($this->full_name) ? $this->name : $this->full_name;
   }
 
   /**
diff --git a/modules/user/views/admin_users.html.php b/modules/user/views/admin_users.html.php
index 69d97547..270a7207 100644
--- a/modules/user/views/admin_users.html.php
+++ b/modules/user/views/admin_users.html.php
@@ -78,7 +78,7 @@
               <?= html::clean($user->name) ?>
             </td>
             <td>
-            <?= t(html::clean($user->full_name)) ?>
+              <?= html::clean($user->full_name) ?>
             </td>
             <td>
               <?= html::clean($user->email) ?>
diff --git a/modules/user/views/admin_users_group.html.php b/modules/user/views/admin_users_group.html.php
index 8317d393..6c6c341e 100644
--- a/modules/user/views/admin_users_group.html.php
+++ b/modules/user/views/admin_users_group.html.php
@@ -1,9 +1,9 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <h4>
-  <?= t(html::clean($group->name)) ?>
+  <?= html::clean($group->name) ?>
   <? if (!$group->special): ?>
   <a href="<?= url::site("admin/users/delete_group_form/$group->id") ?>"
-    title="<?= t("Delete the %name group", array("name" => t(html::clean($group->name))))->for_html_attr() ?>"
+    title="<?= t("Delete the %name group", array("name" => $group->name))->for_html_attr() ?>"
     class="g-dialog-link g-button g-right">
     <span class="ui-icon ui-icon-trash"><?= t("Delete") ?></span></a>
   <? else: ?>
@@ -22,7 +22,7 @@
     <a href="javascript:remove_user(<?= $user->id ?>, <?= $group->id ?>)"
        class="g-button g-right ui-state-default ui-corner-all ui-icon-left"
        title="<?= t("Remove %user from %group group",
-              array("user" => $user->name, "group" => t(html::clean($group->name))))->for_html_attr() ?>">
+              array("user" => $user->name, "group" => $group->name))->for_html_attr() ?>">
       <span class="ui-icon ui-icon-closethick"><?= t("Remove") ?></span>
     </a>
     <? endif ?>
-- 
cgit v1.2.3


From 2846d81171c7101e5015995f848d4cc3a9ddebf6 Mon Sep 17 00:00:00 2001
From: Chad Kieffer <ckieffer@gmail.com>
Date: Thu, 18 Feb 2010 23:00:58 -0700
Subject: First pass at user profile formatting updates. Moved buttons to the
 top, simplified HTML and CSS.

---
 modules/gallery/css/gallery.css                  | 34 +++++++++-
 modules/gallery/views/user_profile.html.php      | 84 ++++++++----------------
 modules/gallery/views/user_profile_info.html.php |  2 +-
 3 files changed, 62 insertions(+), 58 deletions(-)

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/css/gallery.css b/modules/gallery/css/gallery.css
index e06c4dd9..f3e5ec6d 100644
--- a/modules/gallery/css/gallery.css
+++ b/modules/gallery/css/gallery.css
@@ -55,6 +55,34 @@
   margin: 0;
 }
 
+/* User profile ~~~~~~~~~~~~~~~~~~~~~~~~~ */
+
+#g-user-profile h1 {
+  margin: 1em 0;
+}
+
+#g-user-profile .g-avatar {
+  margin-right: .6em;
+}
+
+#g-user-profile .g-block {
+  margin-top: 0;
+}
+
+#g-user-profile .g-block-content {
+  margin-top: 0;
+}
+
+#g-user-profile th,
+#g-user-profile td {
+  border: none;
+}
+
+#g-user-profile th {
+  white-space: nowrap;
+  width: 1%;
+}
+
 /** *******************************************************************
  * 2) Admin
  **********************************************************************/
@@ -96,4 +124,8 @@
 .rtl #g-block-admin .g-left {
   margin-left: 1em;
   margin-right: 0;
-}
\ No newline at end of file
+}
+
+.rtl #g-user-profile .g-avatar {
+  margin-left: .6em;
+}
diff --git a/modules/gallery/views/user_profile.html.php b/modules/gallery/views/user_profile.html.php
index 1c346c26..53e8dc1e 100644
--- a/modules/gallery/views/user_profile.html.php
+++ b/modules/gallery/views/user_profile.html.php
@@ -1,27 +1,4 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
-<style>
-  #g-user-profile div {
-    margin-top: 1em;
-  }
-
-  #g-user-profile fieldset {
-    border: 1px solid #CCCCCC;
-    padding: 0 1em 0.8em;
-  }
-
-  #g-user-profile fieldset label {
-    font-weight: bold;
-  }
-
-  #g-user-profile fieldset div {
-    padding-left: 1em;
-  }
-
-  #g-user-profile td {
-    border: none;
-    padding: 0;
-  }
-</style>
 <script type="text/javascript">
   $(document).ready(function() {
     $("#g-profile-return").click(function(event) {
@@ -31,45 +8,40 @@
   });
 </script>
 <div id="g-user-profile">
-  <h1>
-    <a href="#">
-      <img src="<?= $user->avatar_url(40, $theme->url("images/avatar.jpg", true)) ?>"
-           alt="<?= html::clean_attribute($user->display_name()) ?>"
-           class="g-avatar" width="40" height="40" />
-    </a>
-    <?= t("%name Profile", array("name" => $user->display_name())) ?>
-  </h1>
-  <? foreach ($info_parts as $info): ?>
-  <div>
-    <fieldset>
-    <label><?= html::purify($info->title) ?></label>
-    <div>
-    <?= $info->view ?>
-    </div>
-    </fieldset>
-  </div>
-  <? endforeach ?>
-  <div id="g-profile-buttons" class="ui-helper-clearfix g-right">
-    <? if (!$user->guest && $not_current && !empty($user->email)): ?>
-    <a class="g-button ui-icon-right ui-state-default ui-corner-all g-dialog-link"
-       href="<?= url::site("user_profile/contact/{$user->id}") ?>">
-      <?= t("Contact") ?>
+  <div class="ui-helper-clearfix">
+    <a id="g-profile-return" class="g-button g-right ui-state-default ui-corner-all" href="#">
+      <?= t("Return") ?>
     </a>
-    <? endif ?>
-    <? if ($editable): ?>
-    <a class="g-button ui-icon-right ui-state-default ui-corner-all g-dialog-link" href="<?= url::site("form/edit/users/{$user->id}") ?>">
-      <?= t("Edit") ?>
+    <a class="g-button g-right ui-state-default ui-corner-all g-dialog-link" href="<?= url::site("users/form_change_email/{$user->id}") ?>">
+      <?= t("Change email") ?>
     </a>
-    <a class="g-button ui-icon-right ui-state-default ui-corner-all g-dialog-link" href="<?= url::site("users/form_change_password/{$user->id}") ?>">
+    <a class="g-button g-right ui-state-default ui-corner-all g-dialog-link" href="<?= url::site("users/form_change_password/{$user->id}") ?>">
       <?= t("Change password") ?>
     </a>
-    <a class="g-button ui-icon-right ui-state-default ui-corner-all g-dialog-link" href="<?= url::site("users/form_change_email/{$user->id}") ?>">
-      <?= t("Change email") ?>
+    <? if ($editable): ?>
+    <a class="g-button g-right ui-state-default ui-corner-all g-dialog-link" href="<?= url::site("form/edit/users/{$user->id}") ?>">
+      <?= t("Edit") ?>
     </a>
     <? endif ?>
-
-    <a id="g-profile-return" class="g-button ui-icon-right ui-state-default ui-corner-all" href="#">
-      <?= t("Return") ?>
+    <? if (!$user->guest && $not_current && !empty($user->email)): ?>
+    <a class="g-button g-right ui-state-default ui-corner-all g-dialog-link"
+       href="<?= url::site("user_profile/contact/{$user->id}") ?>">
+      <?= t("Contact") ?>
     </a>
+    <? endif ?>
   </div>
+  <h1>
+    <img src="<?= $user->avatar_url(40, $theme->url("images/avatar.jpg", true)) ?>"
+       alt="<?= html::clean_attribute($user->display_name()) ?>"
+       class="g-avatar g-left" width="40" height="40" />
+    <?= t("User profile: %name", array("name" => $user->display_name())) ?>
+  </h1>
+  <? foreach ($info_parts as $info): ?>
+  <div class="g-block">
+    <h2><?= html::purify($info->title) ?></h2>
+    <div class="g-block-content">
+    <?= $info->view ?>
+    </div>
+  </div>
+  <? endforeach ?>
 </div>
diff --git a/modules/gallery/views/user_profile_info.html.php b/modules/gallery/views/user_profile_info.html.php
index 58e134bb..e559abda 100644
--- a/modules/gallery/views/user_profile_info.html.php
+++ b/modules/gallery/views/user_profile_info.html.php
@@ -2,7 +2,7 @@
 <table>
   <? foreach ($user_profile_data as $label => $value): ?>
   <tr>
-    <td><?= html::clean($label) ?></td>
+    <th><?= html::clean($label) ?></th>
     <td><?= html::purify($value) ?></td>
   </tr>
   <? endforeach ?>
-- 
cgit v1.2.3


From 643fffdba0e595e4e3c4777a52088f81bafded40 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 19 Feb 2010 09:49:05 -0800
Subject: Add spaces around %name in the "create a file" text so that
 double-clicking the token only selects that one word, not the word on the
 line before (which happens on Chrome/Linux)

---
 modules/gallery/views/upgrader.html.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/views/upgrader.html.php b/modules/gallery/views/upgrader.html.php
index 55731440..c7a96cb5 100644
--- a/modules/gallery/views/upgrader.html.php
+++ b/modules/gallery/views/upgrader.html.php
@@ -112,7 +112,7 @@
         <? else: // can_upgrade ?>
         <h1> <?= t("Who are you?") ?> </h1>
         <p>
-          <?= t("You're not logged in as an administrator, so we have to verify you to make sure it's ok for you to do an upgrade.  To prove you can run an upgrade, create a file called <b>%name</b> in your <b>%tmp_dir_path</b> directory.",
+          <?= t("You're not logged in as an administrator, so we have to verify you to make sure it's ok for you to do an upgrade.  To prove you can run an upgrade, create a file called <b> %name </b> in your <b>%tmp_dir_path</b> directory.",
                 array("name" => "$upgrade_token",
                       "tmp_dir_path" => "gallery3/var/tmp")) ?>
         </p>
-- 
cgit v1.2.3


From d388e4bb868602f293b73918981bee1de6176a24 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 19 Feb 2010 11:40:49 -0800
Subject: Refactor away the "display_all" construct in User_Profile_Controller.
 "display_all" is too coarse, and we should be letting event handlers make the
 appropriate decision on what to display and when.  This duplicates some code,
 but it's now very clear in the event handlers what's getting shown.

Throw a 404 if we try to view the user profile for a missing user.

The only feature change in this should be that we now display the
name, full name and website for a user to any other registered user,
which makes sense since these are typically public fields.

Don't show any of the edit buttons unless identity::is_writable()
---
 modules/gallery/controllers/user_profile.php       | 16 +++++-----
 modules/gallery/helpers/gallery_event.php          |  2 +-
 modules/gallery/views/user_profile.html.php        |  4 +--
 .../notification/helpers/notification_event.php    | 36 +++++++++++++---------
 modules/rest/helpers/rest_event.php                | 28 +++++++++++------
 5 files changed, 51 insertions(+), 35 deletions(-)

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/controllers/user_profile.php b/modules/gallery/controllers/user_profile.php
index 05373466..b89bc358 100644
--- a/modules/gallery/controllers/user_profile.php
+++ b/modules/gallery/controllers/user_profile.php
@@ -21,21 +21,21 @@ class User_Profile_Controller extends Controller {
   public function show($id) {
     // If we get here, then we should have a user id other than guest.
     $user = identity::lookup_user($id);
-    $active_user = identity::active_user();
-    $is_current_active = $active_user->id == $id;
-    $can_edit = $is_current_active && !$active_user->guest;
-    $display_all = $active_user->admin || $can_edit;
+    if (!$user) {
+      throw new Kohana_404_Exception();
+    }
 
     $v = new Theme_View("page.html", "other", "profile");
     $v->page_title = t("%name Profile", array("name" => $user->display_name()));
     $v->content = new View("user_profile.html");
 
-    // @todo modify user_home to supply a link to their album,
     $v->content->user = $user;
-    $v->content->not_current = !$is_current_active;
-    $v->content->editable = identity::is_writable() && $can_edit;
+    $v->content->contactable =
+      !$user->guest && $user->id != identity::active_user()->id && $user->email;
+    $v->content->editable =
+      identity::is_writable() && !$user->guest && $user->id == identity::active_user()->id;
 
-    $event_data = (object)array("user" => $user, "display_all" => $display_all, "content" => array());
+    $event_data = (object)array("user" => $user, "content" => array());
     module::event("show_user_profile", $event_data);
     $v->content->info_parts = $event_data->content;
 
diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php
index faf1c0c6..36f91142 100644
--- a/modules/gallery/helpers/gallery_event.php
+++ b/modules/gallery/helpers/gallery_event.php
@@ -413,7 +413,7 @@ class gallery_event_Core {
 
     $fields = array("name" => t("Name"), "locale" => t("Language Preference"),
                     "email" => t("Email"), "full_name" => t("Full name"), "url" => "Web site");
-    if (!$data->display_all) {
+    if (!$data->user->guest) {
       $fields = array("name" => t("Name"), "full_name" => t("Full name"), "url" => "Web site");
     }
     $v->user_profile_data = array();
diff --git a/modules/gallery/views/user_profile.html.php b/modules/gallery/views/user_profile.html.php
index 53e8dc1e..257bd7ca 100644
--- a/modules/gallery/views/user_profile.html.php
+++ b/modules/gallery/views/user_profile.html.php
@@ -12,18 +12,18 @@
     <a id="g-profile-return" class="g-button g-right ui-state-default ui-corner-all" href="#">
       <?= t("Return") ?>
     </a>
+    <? if ($editable): ?>
     <a class="g-button g-right ui-state-default ui-corner-all g-dialog-link" href="<?= url::site("users/form_change_email/{$user->id}") ?>">
       <?= t("Change email") ?>
     </a>
     <a class="g-button g-right ui-state-default ui-corner-all g-dialog-link" href="<?= url::site("users/form_change_password/{$user->id}") ?>">
       <?= t("Change password") ?>
     </a>
-    <? if ($editable): ?>
     <a class="g-button g-right ui-state-default ui-corner-all g-dialog-link" href="<?= url::site("form/edit/users/{$user->id}") ?>">
       <?= t("Edit") ?>
     </a>
     <? endif ?>
-    <? if (!$user->guest && $not_current && !empty($user->email)): ?>
+    <? if ($contactable): ?>
     <a class="g-button g-right ui-state-default ui-corner-all g-dialog-link"
        href="<?= url::site("user_profile/contact/{$user->id}") ?>">
       <?= t("Contact") ?>
diff --git a/modules/notification/helpers/notification_event.php b/modules/notification/helpers/notification_event.php
index c8628ae4..19e8dedb 100644
--- a/modules/notification/helpers/notification_event.php
+++ b/modules/notification/helpers/notification_event.php
@@ -128,23 +128,31 @@ class notification_event_Core {
   }
 
   static function show_user_profile($data) {
-    if ($data->display_all) {
-      $view = new View("user_profile_notification.html");
-      $view->subscriptions = array();
-      foreach(ORM::factory("subscription")
-              ->where("user_id", "=", $data->user->id)
-              ->find_all() as $subscription) {
-        $item = ORM::factory("item")
+    // Guests don't see comment listings
+    if (identity::active_user()->guest) {
+      return;
+    }
+
+    // Only logged in users can see their comment listings
+    if (identity::active_user()->id != $data->user->id) {
+      return;
+    }
+
+    $view = new View("user_profile_notification.html");
+    $view->subscriptions = array();
+    foreach(ORM::factory("subscription")
+            ->where("user_id", "=", $data->user->id)
+            ->find_all() as $subscription) {
+      $item = ORM::factory("item")
           ->where("id", "=", $subscription->item_id)
           ->find();
-        if ($item->loaded()) {
-          $view->subscriptions[] = (object)array("id" => $subscription->id, "title" => $item->title,
-                                                 "url" => $item->url());
-        }
-      }
-      if (count($view->subscriptions) > 0) {
-        $data->content[] = (object)array("title" => t("Watching"), "view" => $view);
+      if ($item->loaded()) {
+        $view->subscriptions[] = (object)array("id" => $subscription->id, "title" => $item->title,
+                                               "url" => $item->url());
       }
     }
+    if (count($view->subscriptions) > 0) {
+      $data->content[] = (object)array("title" => t("Watching"), "view" => $view);
+    }
   }
 }
\ No newline at end of file
diff --git a/modules/rest/helpers/rest_event.php b/modules/rest/helpers/rest_event.php
index f9aa34e3..c46e65c4 100644
--- a/modules/rest/helpers/rest_event.php
+++ b/modules/rest/helpers/rest_event.php
@@ -76,19 +76,27 @@ class rest_event {
   }
 
   static function show_user_profile($data) {
-    if ($data->display_all) {
-      $view = new View("user_profile_rest.html");
-      $key = ORM::factory("user_access_token")
+    // Guests can't see a REST key
+    if (identity::active_user()->guest) {
+      return;
+    }
+
+    // Only logged in users can see their own REST key
+    if (identity::active_user()->id != $data->user->id) {
+      return;
+    }
+
+    $view = new View("user_profile_rest.html");
+    $key = ORM::factory("user_access_token")
         ->where("user_id", "=", $data->user->id)
         ->find();
 
-      if (!$key->loaded()) {
-        $key->user_id = $data->user->id;
-        $key->access_key = md5($data->user->name . rand());
-        $key->save();
-      }
-      $view->rest_key = $key->access_key;
-      $data->content[] = (object)array("title" => t("Rest api"), "view" => $view);
+    if (!$key->loaded()) {
+      $key->user_id = $data->user->id;
+      $key->access_key = md5($data->user->name . rand());
+      $key->save();
     }
+    $view->rest_key = $key->access_key;
+    $data->content[] = (object)array("title" => t("Rest api"), "view" => $view);
   }
 }
-- 
cgit v1.2.3


From 39b8810c3b37538e015c9d8cb7b46c59d87fb8c7 Mon Sep 17 00:00:00 2001
From: Andy Staudacher <andy.st@gmail.com>
Date: Wed, 24 Feb 2010 16:39:18 -0800
Subject: Fix multi-column layout of language admin.

---
 modules/gallery/views/admin_languages.html.php | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/views/admin_languages.html.php b/modules/gallery/views/admin_languages.html.php
index 07134475..d4b7b0c1 100644
--- a/modules/gallery/views/admin_languages.html.php
+++ b/modules/gallery/views/admin_languages.html.php
@@ -49,13 +49,14 @@
             </tr>
             <? $i = 0 ?>
             <? foreach ($available_locales as $code => $display_name):  ?>
-            <? if ($i == (count($available_locales)/2)): ?>
-            <table>
-              <tr>
-                <th> <?= t("Installed") ?> </th>
-                <th> <?= t("Language") ?> </th>
-                <th> <?= t("Default language") ?> </th>
-              </tr>
+            <? if ($i == (int) (count($available_locales)/2)): ?>
+          </table>
+          <table>
+            <tr>
+              <th> <?= t("Installed") ?> </th>
+              <th> <?= t("Language") ?> </th>
+              <th> <?= t("Default language") ?> </th>
+            </tr>
             <? endif ?>
             <tr class="<?= (isset($installed_locales[$code])) ? "g-available" : "" ?><?= ($default_locale == $code) ? " g-selected" : "" ?>">
               <td> <?= form::checkbox("installed_locales[]", $code, isset($installed_locales[$code])) ?> </td>
-- 
cgit v1.2.3


From d9707ae749df2770370dc4eeeeaddda28f092d4d Mon Sep 17 00:00:00 2001
From: Andy Staudacher <andy.st@gmail.com>
Date: Sat, 27 Feb 2010 02:37:39 -0800
Subject: Fix for ticket #1036 - Don't echo any sensitive information such as
 passwords, hashes or personally identifiable information.

---
 modules/gallery/libraries/MY_Kohana_Exception.php |  57 ++++++++
 modules/gallery/tests/Kohana_Exception_Test.php   | 170 ++++++++++++++++++++++
 modules/gallery/views/kohana/error.php            |   4 +-
 3 files changed, 229 insertions(+), 2 deletions(-)
 create mode 100644 modules/gallery/tests/Kohana_Exception_Test.php

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/libraries/MY_Kohana_Exception.php b/modules/gallery/libraries/MY_Kohana_Exception.php
index d6f1f467..1712d895 100644
--- a/modules/gallery/libraries/MY_Kohana_Exception.php
+++ b/modules/gallery/libraries/MY_Kohana_Exception.php
@@ -92,4 +92,61 @@ class Kohana_Exception extends Kohana_Exception_Core {
     }
     print $view;
   }
+
+  /**
+   * @see Kohana_Exception::dump()
+   */
+  public static function dump($value, $length=128, $max_level=5) {
+    return self::safe_dump($value, null, $length, $max_level);
+  }
+
+  /**
+   * A safer version of dump(), eliding sensitive information in the dumped
+   * data, such as session ids and passwords / hashes.
+   */
+  public static function safe_dump($value, $key, $length=128, $max_level=5) {
+    return parent::dump(self::_sanitize_for_dump($value, $key), $length, $max_level);
+  }
+
+  /**
+   * Elides sensitive data which shouldn't be echoed to the client,
+   * such as passwords, and other secrets.
+   */
+  /* Visible for testing*/ static function _sanitize_for_dump($value, $key=null) {
+    // Better elide too much than letting something through.
+    // Note: unanchored match is intended.
+    $sensitive_info_pattern =
+      '/(password|pass|email|hash|private_key|session_id|session|g3sid|csrf|secret)/i';
+    if (preg_match($sensitive_info_pattern, $key) ||
+        (is_string($value) && preg_match('/[a-f0-9]{20,}/i', $value))) {
+      return 'removed for display';
+    } else if (is_object($value)) {
+      if ($value instanceof Database) {
+        // Elide database password, host, name, user, etc.
+        return get_class($value) . ' object - details omitted for display';
+      } else if ($value instanceof User_Model) {
+        return get_class($value) . ' object for "' . $value->name . '" - details omitted for display';
+      }
+      return self::_sanitize_for_dump((array) $value, $key);
+    } else if (is_array($value)) {
+      $result = array();
+      foreach ($value as $k => $v) {
+        $actual_key = $k;
+        $key_for_display = $k;
+        if ($k[0] === "\x00") {
+          // Remove the access level from the variable name
+          $actual_key = substr($k, strrpos($k, "\x00") + 1);
+          $access = $k[1] === '*' ? 'protected' : 'private';
+          $key_for_display = "$access: $actual_key";
+        }
+        if (is_object($v)) {
+          $key_for_display .= ' (type: ' . get_class($v) . ')';
+        }
+        $result[$key_for_display] = self::_sanitize_for_dump($v, $actual_key);
+      }
+    } else {
+      $result = $value;
+    }
+    return $result;
+  }
 }
\ No newline at end of file
diff --git a/modules/gallery/tests/Kohana_Exception_Test.php b/modules/gallery/tests/Kohana_Exception_Test.php
new file mode 100644
index 00000000..d2dbb4dc
--- /dev/null
+++ b/modules/gallery/tests/Kohana_Exception_Test.php
@@ -0,0 +1,170 @@
+<?php defined("SYSPATH") or die("No direct script access.");
+/**
+ * Gallery - a web based photo album viewer and editor
+ * Copyright (C) 2000-2009 Bharat Mediratta
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+class Kohana_Exception_Test extends Gallery_Unit_Test_Case {
+
+  public function dump_test() {
+    // Verify the override.
+    $this->assert_equal('<small>string</small><span>(19)</span> "removed for display"',
+        Kohana_Exception::dump("1a62761b836138c6198313911"));
+    $this->assert_equal('<small>string</small><span>(14)</span> "original value"',
+        Kohana_Exception::dump("original value"));
+  }
+
+  public function safe_dump_test() {
+    // Verify the delegation.
+    $this->assert_equal('<small>string</small><span>(19)</span> "removed for display"',
+        Kohana_Exception::safe_dump("original value", "password"));
+    $this->assert_equal('<small>string</small><span>(14)</span> "original value"',
+        Kohana_Exception::safe_dump("original value", "meow"));
+  }
+
+  public function sanitize_for_dump_match_key_test() {
+    $this->assert_equal("removed for display",
+        Kohana_Exception::_sanitize_for_dump("original value", "password"));
+    $this->assert_equal("original value",
+        Kohana_Exception::_sanitize_for_dump("original value", "meow"));
+  }
+
+  public function sanitize_for_dump_match_key_loosely_test() {
+    $this->assert_equal("removed for display",
+        Kohana_Exception::_sanitize_for_dump("original value", "this secret key"));
+  }
+
+  public function sanitize_for_dump_match_value_test() {
+    // Looks like a hash / secret value.
+    $this->assert_equal("removed for display",
+        Kohana_Exception::_sanitize_for_dump("p$2a178b841c6391d6368f131", "meow"));
+    $this->assert_equal("original value",
+        Kohana_Exception::_sanitize_for_dump("original value", "meow"));
+  }
+
+  public function sanitize_for_dump_array_test() {
+    $var = array("safe" => "original value 1",
+                 "some hash" => "original value 2",
+                 "three" => "2a3728788982938293b9292");
+    $expected = array("safe" => "original value 1",
+                      "some hash" => "removed for display",
+                      "three" => "removed for display");
+
+    $this->assert_equal($expected,
+        Kohana_Exception::_sanitize_for_dump($var, "ignored"));
+  }
+
+  public function sanitize_for_dump_nested_array_test() {
+    $var = array("safe" => "original value 1",
+                 "safe 2" => array("some hash" => "original value 2"));
+    $expected = array("safe" => "original value 1",
+                      "safe 2" => array("some hash" => "removed for display"));
+    $this->assert_equal($expected,
+        Kohana_Exception::_sanitize_for_dump($var, "ignored"));
+  }
+
+  public function sanitize_for_dump_user_test() {
+    $user = new User_Model();
+    $user->name = "john";
+    $user->hash = "value 1";
+    $user->email = "value 2";
+    $user->full_name = "value 3";
+    $this->assert_equal('User_Model object for "john" - details omitted for display',
+        Kohana_Exception::_sanitize_for_dump($user, "ignored"));
+  }
+
+  public function sanitize_for_dump_database_test() {
+    $db = new Kohana_Exception_Test_Database(
+        array("connection" => array("user" => "john", "name" => "gallery_3"),
+              "cache" => array()));
+    $this->assert_equal("Kohana_Exception_Test_Database object - details omitted for display",
+        Kohana_Exception::_sanitize_for_dump($db, "ignored"));
+  }
+
+  public function sanitize_for_dump_nested_database_test() {
+    $db = new Kohana_Exception_Test_Database(
+        array("connection" => array("user" => "john", "name" => "gallery_3"),
+              "cache" => array()));
+    $var = array("some" => "foo",
+                 "bar" => $db);
+    $this->assert_equal(
+        array("some" => "foo",
+              "bar (type: Kohana_Exception_Test_Database)" =>
+              "Kohana_Exception_Test_Database object - details omitted for display"),
+        Kohana_Exception::_sanitize_for_dump($var, "ignored"));
+  }
+
+  public function sanitize_for_dump_object_test() {
+    $obj = new Kohana_Exception_Test_Class();
+    $obj->password = "original value";
+    $expected = array("var_1" => "val 1",
+                      "protected: var_2" => "val 2",
+                      "private: var_3" => "val 3",
+                      "protected: hash" => "removed for display",
+                      "private: email_address" => "removed for display",
+                      "password" => "removed for display");
+    $this->assert_equal($expected,
+        Kohana_Exception::_sanitize_for_dump($obj, "ignored"));
+  }
+
+  public function sanitize_for_dump_nested_object_test() {
+    $user = new User_Model();
+    $user->name = "john";
+    $obj = new Kohana_Exception_Test_Class();
+    $obj->meow = new Kohana_Exception_Test_Class();
+    $obj->woof = "original value";
+    $obj->foo = array("bar" => $user);
+    $expected = array("var_1" => "val 1",
+                      "protected: var_2" => "val 2",
+                      "private: var_3" => "val 3",
+                      "protected: hash" => "removed for display",
+                      "private: email_address" => "removed for display",
+                      "meow (type: Kohana_Exception_Test_Class)" =>
+                          array("var_1" => "val 1",
+                                "protected: var_2" => "val 2",
+                                "private: var_3" => "val 3",
+                                "protected: hash" => "removed for display",
+                                "private: email_address" => "removed for display"),
+                      "woof" => "original value",
+                      "foo" => array("bar (type: User_Model)" =>
+                                     'User_Model object for "john" - details omitted for display'));
+    $this->assert_equal($expected,
+        Kohana_Exception::_sanitize_for_dump($obj, "ignored"));
+  }
+}
+
+class Kohana_Exception_Test_Database extends Database {
+  function __construct($config) { parent::__construct($config); }
+  public function connect() {}
+  public function disconnect() {}
+  public function set_charset($charset) {}
+  public function query_execute($sql) {}
+  public function escape($value) {}
+  public function list_constraints($table) {}
+  public function list_fields($table) {}
+  public function list_tables() {}
+}
+
+class Kohana_Exception_Test_Class {
+  public $var_1 = "val 1";
+  protected $var_2 = "val 2";
+  private $var_3 = "val 3";
+  protected $hash = "val 4";
+  private $email_address = "val 5";
+  function __set($name, $val) {
+    $this->$name = $val;
+  }
+}
\ No newline at end of file
diff --git a/modules/gallery/views/kohana/error.php b/modules/gallery/views/kohana/error.php
index 26628cf2..d55105a0 100644
--- a/modules/gallery/views/kohana/error.php
+++ b/modules/gallery/views/kohana/error.php
@@ -204,7 +204,7 @@
                       <pre><?= $name?></pre>
                     </td>
                     <td class="value">
-                      <pre><?= Kohana_Exception::dump($arg) ?></pre>
+                      <pre><?= Kohana_Exception::safe_dump($arg, $name) ?></pre>
                     </td>
                   </tr>
                   <? endforeach?>
@@ -265,7 +265,7 @@
                   </code>
                 </td>
                 <td class="value">
-                  <pre><?= Kohana_Exception::dump($value) ?></pre>
+                  <pre><?= Kohana_Exception::safe_dump($value, $key) ?></pre>
                 </td>
               </tr>
               <? endforeach?>
-- 
cgit v1.2.3