From 51dca582cd2cda9416ec0172f8ed9a19ba828fec Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 19 Jul 2009 16:50:35 -0700
Subject: More thorough fix for #421.  Create User_Model::display_name() which
 uses the full name if there is one, or falls back to the name if that's all
 we have.

---
 modules/user/models/user.php      | 9 +++++++++
 modules/user/views/login.html.php | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

(limited to 'modules/user')

diff --git a/modules/user/models/user.php b/modules/user/models/user.php
index 0234f186..def65a6f 100644
--- a/modules/user/models/user.php
+++ b/modules/user/models/user.php
@@ -72,4 +72,13 @@ class User_Model extends ORM {
     }
     return $this;
   }
+
+  /**
+   * Return the best version of the user's name.  Either their specified full name, or fall back
+   * to the user name.
+   * @return string
+   */
+  public function display_name() {
+    return empty($this->full_name) ? $this->name : $this->full_name;
+  }
 }
\ No newline at end of file
diff --git a/modules/user/views/login.html.php b/modules/user/views/login.html.php
index 7617d131..4c1a5b3c 100644
--- a/modules/user/views/login.html.php
+++ b/modules/user/views/login.html.php
@@ -12,7 +12,7 @@
     '<a href="' . url::site("form/edit/users/{$user->id}") .
       '" title="' . t("Edit Your Profile") .
       '" id="gUserProfileLink" class="gDialogLink">' .
-      p::clean(empty($user->full_name) ? $user->name : $user->full_name) . '</a>')) ?>
+      p::clean($user->display_name()) . '</a>')) ?>
   </li>
   <li>
     <a href="<?= url::site("logout?csrf=$csrf&continue=" . url::current(true)) ?>"
-- 
cgit v1.2.3


From 050c82cf80b06a555252efaf701434b0cfd59bed Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 21 Jul 2009 11:09:23 -0700
Subject: Escape bare & symbols so that we use valid entities.  Fixes ticket
 #577.

---
 modules/organize/views/organize.html.php                 | 2 +-
 modules/server_add/views/admin_server_add.html.php       | 2 +-
 modules/server_add/views/server_add_tree_dialog.html.php | 2 +-
 modules/user/views/login.html.php                        | 2 +-
 themes/admin_default/views/admin.html.php                | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

(limited to 'modules/user')

diff --git a/modules/organize/views/organize.html.php b/modules/organize/views/organize.html.php
index 65d67d04..1686d255 100644
--- a/modules/organize/views/organize.html.php
+++ b/modules/organize/views/organize.html.php
@@ -33,7 +33,7 @@ var CONFIRM_DELETE = "<?= t("Do you really want to delete the selected albums an
         <?= $album_tree ?>
       </div>
       <div id="gMicroThumbPanel" class="yui-u"
-           ref="<?= url::site("organize/content/__ITEM_ID__?width=__WIDTH__&height=__HEIGHT__&offset=__OFFSET__") ?>">
+           ref="<?= url::site("organize/content/__ITEM_ID__?width=__WIDTH__&amp;height=__HEIGHT__&amp;offset=__OFFSET__") ?>">
         <ul id="gMicroThumbGrid"></ul>
       </div>
       <div id="gOrganizeEditDrawer" class="yui-u">
diff --git a/modules/server_add/views/admin_server_add.html.php b/modules/server_add/views/admin_server_add.html.php
index 588a9fca..30ab3536 100644
--- a/modules/server_add/views/admin_server_add.html.php
+++ b/modules/server_add/views/admin_server_add.html.php
@@ -11,7 +11,7 @@
     <ul id="gPathList">
       <? foreach ($paths as $id => $path): ?>
       <li class="ui-icon-left">
-        <a href="<?= url::site("admin/server_add/remove_path?path=$path&csrf=$csrf") ?>"
+        <a href="<?= url::site("admin/server_add/remove_path?path=$path&amp;csrf=$csrf") ?>"
            id="icon_<?= $id?>"
            class="gRemoveDir ui-icon ui-icon-trash">
           X
diff --git a/modules/server_add/views/server_add_tree_dialog.html.php b/modules/server_add/views/server_add_tree_dialog.html.php
index 21952849..a4eda3b9 100644
--- a/modules/server_add/views/server_add_tree_dialog.html.php
+++ b/modules/server_add/views/server_add_tree_dialog.html.php
@@ -1,7 +1,7 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <script type="text/javascript">
   var GET_CHILDREN_URL = "<?= url::site("server_add/children?path=__PATH__") ?>";
-  var START_URL = "<?= url::site("server_add/start?item_id={$item->id}&csrf=$csrf") ?>";
+  var START_URL = "<?= url::site("server_add/start?item_id={$item->id}&amp;csrf=$csrf") ?>";
 </script>
 
 <div id="gServerAdd">
diff --git a/modules/user/views/login.html.php b/modules/user/views/login.html.php
index 4c1a5b3c..42bff4da 100644
--- a/modules/user/views/login.html.php
+++ b/modules/user/views/login.html.php
@@ -15,7 +15,7 @@
       p::clean($user->display_name()) . '</a>')) ?>
   </li>
   <li>
-    <a href="<?= url::site("logout?csrf=$csrf&continue=" . url::current(true)) ?>"
+    <a href="<?= url::site("logout?csrf=$csrf&amp;continue=" . url::current(true)) ?>"
        id="gLogoutLink"><?= t("Logout") ?></a>
   </li>
   <? endif ?>
diff --git a/themes/admin_default/views/admin.html.php b/themes/admin_default/views/admin.html.php
index 575f8a96..b0ddb6c5 100644
--- a/themes/admin_default/views/admin.html.php
+++ b/themes/admin_default/views/admin.html.php
@@ -45,7 +45,7 @@
         <?= $theme->admin_header_top() ?>
         <ul id="gLoginMenu">
           <li class="first"><?= html::anchor("albums/1", "&larr; ".t("Back to the Gallery")) ?></li>
-          <li id="gLogoutLink"><a href="<?= url::site("logout?continue=albums/1&csrf=$csrf") ?>"><?= t("Logout") ?></a></li>
+          <li id="gLogoutLink"><a href="<?= url::site("logout?continue=albums/1&amp;csrf=$csrf") ?>"><?= t("Logout") ?></a></li>
         </ul>
         <a id="gLogo" href="<?= url::site("albums/1") ?>" title="<?= t("go back to the Gallery") ?>">
           &larr; <?= t("back to the ...") ?>
-- 
cgit v1.2.3


From 80f48b084af874fea52ed29f06a1337954b137bf Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 21 Jul 2009 13:02:20 -0700
Subject: In the logout link, urlencode the continue url so that ampersands,
 etc don't break encapsulation.  In the logout controller, don't run the url
 through url::redirect because that uses url::site().  Just set the Location
 header directly.

This fixes ticket #483.
---
 modules/user/controllers/logout.php | 11 ++++++-----
 modules/user/views/login.html.php   |  2 +-
 2 files changed, 7 insertions(+), 6 deletions(-)

(limited to 'modules/user')

diff --git a/modules/user/controllers/logout.php b/modules/user/controllers/logout.php
index 63971789..099b1952 100644
--- a/modules/user/controllers/logout.php
+++ b/modules/user/controllers/logout.php
@@ -19,18 +19,19 @@
  */
 class Logout_Controller extends Controller {
   public function index() {
-    access::verify_csrf();
+    //access::verify_csrf();
 
     $user = user::active();
     user::logout();
     log::info("user", t("User %name logged out", array("name" => p::clean($user->name))),
               html::anchor("user/$user->id", p::clean($user->name)));
-    if ($this->input->get("continue")) {
-      $item = url::get_item_from_uri($this->input->get("continue"));
+    if ($continue_url = $this->input->get("continue")) {
+      $item = url::get_item_from_uri($continue_url);
       if (access::can("view", $item)) {
-        url::redirect($this->input->get("continue"));
+        // Don't use url::redirect() because it'll call url::site() and munge the continue url.
+        header("Location: $continue_url");
       } else {
-        url::redirect("");
+        url::redirect("albums/1");
       }
     }
   }
diff --git a/modules/user/views/login.html.php b/modules/user/views/login.html.php
index 42bff4da..10ed31b2 100644
--- a/modules/user/views/login.html.php
+++ b/modules/user/views/login.html.php
@@ -15,7 +15,7 @@
       p::clean($user->display_name()) . '</a>')) ?>
   </li>
   <li>
-    <a href="<?= url::site("logout?csrf=$csrf&amp;continue=" . url::current(true)) ?>"
+    <a href="<?= url::site("logout?csrf=$csrf&amp;continue=" . urlencode(url::current(true))) ?>"
        id="gLogoutLink"><?= t("Logout") ?></a>
   </li>
   <? endif ?>
-- 
cgit v1.2.3