\n";
+echo ''."\n";
// Step 3: we display the forum_categories first
-foreach ($forum_categories_list as $forum_category_key => $forum_category)
+if(is_array($forum_categories_list))
{
- echo "\t\n\t\t";
- echo ''.prepare4display($forum_category['cat_title']).'
';
- if ($forum_category['cat_comment']<>'' AND trim($forum_category['cat_comment'])<>' ')
+ foreach ($forum_categories_list as $forum_category_key => $forum_category)
{
- echo ''.prepare4display($forum_category['cat_comment']).'';
- }
- echo " | \n";
- if (api_is_allowed_to_edit())
- {
- echo "\t\t";
- echo "".icon('../img/edit.gif',get_lang('Edit'))."";
- echo "".icon('../img/delete.gif',get_lang('Delete'))."";
- display_visible_invisible_icon('forumcategory', prepare4display($forum_category['cat_id']), prepare4display($forum_category['visibility']));
- display_lock_unlock_icon('forumcategory',prepare4display($forum_category['cat_id']), prepare4display($forum_category['locked']));
- display_up_down_icon('forumcategory',prepare4display($forum_category['cat_id']), $forum_categories_list);
+ echo "\t |
\n\t\t";
+ echo ''.prepare4display($forum_category['cat_title']).'
';
+ if ($forum_category['cat_comment']<>'' AND trim($forum_category['cat_comment'])<>' ')
+ {
+ echo ''.prepare4display($forum_category['cat_comment']).'';
+ }
echo " | \n";
- }
- echo "\t
\n";
-
- // step 4: the interim headers (for the forum)
- echo "\t\n";
-
- // the forums in this category
- $forums_in_category=get_forums_in_category($forum_category['cat_id']);
-
- // step 5: we display all the forums in this category.
- $forum_count=0;
- foreach ($forum_list as $key=>$forum)
- {
- // Here we clean the whatnew_post_info array a little bit because to display the icon we
- // test if $whatsnew_post_info[$forum['forum_id']] is empty or not.
- foreach ($whatsnew_post_info[$forum['forum_id']] as $key_thread_id => $new_post_array)
+ if (api_is_allowed_to_edit())
{
- if (empty($whatsnew_post_info[$forum['forum_id']][$key_thread_id]))
- {
- unset($whatsnew_post_info[$forum['forum_id']][$key_thread_id]);
- unset($_SESSION['whatsnew_post_info'][$forum['forum_id']][$key_thread_id]);
- }
+ echo "\t\t";
+ echo "".icon('../img/edit.gif',get_lang('Edit'))."";
+ echo "".icon('../img/delete.gif',get_lang('Delete'))."";
+ display_visible_invisible_icon('forumcategory', prepare4display($forum_category['cat_id']), prepare4display($forum_category['visibility']));
+ display_lock_unlock_icon('forumcategory',prepare4display($forum_category['cat_id']), prepare4display($forum_category['locked']));
+ display_up_down_icon('forumcategory',prepare4display($forum_category['cat_id']), $forum_categories_list);
+ echo " | \n";
}
-
- // note: this can be speeded up if we transform the $forum_list to an array that uses the forum_category as the key.
- if (prepare4display($forum['forum_category'])==prepare4display($forum_category['cat_id']))
+ echo "\t\n";
+
+ // step 4: the interim headers (for the forum)
+ echo "\t\n";
+
+ // the forums in this category
+ $forums_in_category=get_forums_in_category($forum_category['cat_id']);
+
+ // step 5: we display all the forums in this category.
+ $forum_count=0;
+ foreach ($forum_list as $key=>$forum)
+ {
+ // Here we clean the whatnew_post_info array a little bit because to display the icon we
+ // test if $whatsnew_post_info[$forum['forum_id']] is empty or not.
+ if(is_array($whatsnew_post_info[$forum['forum_id']]))
{
- //echo 'teacher';
- $show_forum=true;
+ foreach ($whatsnew_post_info[$forum['forum_id']] as $key_thread_id => $new_post_array)
+ {
+ if (empty($whatsnew_post_info[$forum['forum_id']][$key_thread_id]))
+ {
+ unset($whatsnew_post_info[$forum['forum_id']][$key_thread_id]);
+ unset($_SESSION['whatsnew_post_info'][$forum['forum_id']][$key_thread_id]);
+ }
+ }
}
- // you are not a teacher
- else
+ // note: this can be speeded up if we transform the $forum_list to an array that uses the forum_category as the key.
+ if (prepare4display($forum['forum_category'])==prepare4display($forum_category['cat_id']))
{
- //echo 'student';
- // it is not a group forum => show forum (invisible forums are already left out see get_forums function)
- if ($forum['forum_of_group']=='0')
+ // the forum has to be showed if
+ // 1.v it is a not a group forum (teacher and student)
+ // 2.v it is a group forum and it is public (teacher and student)
+ // 3. it is a group forum and it is private (always for teachers only if the user is member of the forum
+ // if the forum is private and it is a group forum and the user is not a member of the group forum then it cannot be displayed
+ //if (!($forum['forum_group_public_private']=='private' AND !is_null($forum['forum_of_group']) AND !in_array($forum['forum_of_group'], $groups_of_user)))
+ //{
+ $show_forum=false;
+
+ // SHOULD WE SHOW THIS PARTICULAR FORUM
+ // you are teacher => show forum
+
+ if (api_is_allowed_to_edit())
{
- //echo '-gewoon forum';
+ //echo 'teacher';
$show_forum=true;
}
- // it is a group forum
+ // you are not a teacher
else
{
- //echo '-groepsforum';
- // it is a group forum but it is public => show
- if ($forum['forum_group_public_private']=='public')
+ //echo 'student';
+ // it is not a group forum => show forum (invisible forums are already left out see get_forums function)
+ if ($forum['forum_of_group']=='0')
{
+ //echo '-gewoon forum';
$show_forum=true;
- //echo '-publiek';
}
- // it is a group forum and it is private
+ // it is a group forum
else
{
- //echo '-prive';
- // it is a group forum and it is private but the user is member of the group
- if (in_array($forum['forum_of_group'],$groups_of_user))
+ //echo '-groepsforum';
+ // it is a group forum but it is public => show
+ if ($forum['forum_group_public_private']=='public')
{
- //echo '-is lid';
$show_forum=true;
+ //echo '-publiek';
}
+ // it is a group forum and it is private
else
{
- //echo '-is GEEN lid';
- $show_forum=false;
+ //echo '-prive';
+ // it is a group forum and it is private but the user is member of the group
+ if (in_array($forum['forum_of_group'],$groups_of_user))
+ {
+ //echo '-is lid';
+ $show_forum=true;
+ }
+ else
+ {
+ //echo '-is GEEN lid';
+ $show_forum=false;
+ }
}
+
}
-
}
- }
- //echo '
';
-
- if ($show_forum)
- {
- $form_count++;
- echo "\t\n";
- echo "\t\t";
- if ($forum['forum_of_group']!=='0')
+ //echo '
';
+
+ if ($show_forum)
{
- if (is_array($whatsnew_post_info[$forum['forum_id']]) and !empty($whatsnew_post_info[$forum['forum_id']]))
+ $form_count++;
+ echo "\t |
\n";
+ echo "\t\t| ";
+ if ($forum['forum_of_group']!=='0')
+ {
+ if (is_array($whatsnew_post_info[$forum['forum_id']]) and !empty($whatsnew_post_info[$forum['forum_id']]))
+ {
+ echo icon('../img/forumgroupnew.gif');
+ }
+ else
+ {
+ echo icon('../img/forumgroup.gif');
+ }
+ }
+ else
+ {
+ if (is_array($whatsnew_post_info[$forum['forum_id']]) and !empty($whatsnew_post_info[$forum['forum_id']]))
+ {
+ echo icon('../img/forum.gif');
+ }
+ else
+ {
+ echo icon('../img/forum.gif');
+ }
+
+ }
+ echo " | \n";
+ if ($forum['forum_of_group']<>'0')
{
- echo icon('../img/forumgroupnew.gif');
+ $group_title=substr($all_groups[$forum['forum_of_group']]['name'],0,30);
+ $forum_title_group_addition=' ('.$group_title.')';
}
else
{
- echo icon('../img/forumgroup.gif');
+ $forum_title_group_addition='';
}
- }
- else
- {
- if (is_array($whatsnew_post_info[$forum['forum_id']]) and !empty($whatsnew_post_info[$forum['forum_id']]))
+
+ echo "\t\t".prepare4display($forum['forum_title']).''.$forum_title_group_addition.'
'.prepare4display($forum['forum_comment'])." | \n";
+ //$number_forum_topics_and_posts=get_post_topics_of_forum($forum['forum_id']); // deprecated
+ // the number of topics and posts
+ echo "\t\t".$forum['number_of_threads']." | \n";
+ echo "\t\t".$forum['number_of_posts']." | \n";
+ // the last post in the forum
+ if ($forum['last_poster_name']<>'')
{
- echo icon('../img/forum.gif');
+ $name=$forum['last_poster_name'];
+ $poster_id=0;
}
else
{
- echo icon('../img/forum.gif');
+ $name=$forum['last_poster_firstname'].' '.$forum['last_poster_lastname'];
+ $poster_id=$forum['last_poster_id'];
+ }
+ echo "\t\t";
+ if (!empty($forum['last_post_id']))
+ {
+ echo $forum['last_post_date']."
".get_lang('By').' '.display_user_link($poster_id, $name);
}
-
- }
- echo " | \n";
- if ($forum['forum_of_group']<>'0')
- {
- $group_title=substr($all_groups[$forum['forum_of_group']]['name'],0,30);
- $forum_title_group_addition=' ('.$group_title.')';
- }
- else
- {
- $forum_title_group_addition='';
- }
-
- echo "\t\t".prepare4display($forum['forum_title']).''.$forum_title_group_addition.'
'.prepare4display($forum['forum_comment'])." | \n";
- //$number_forum_topics_and_posts=get_post_topics_of_forum($forum['forum_id']); // deprecated
- // the number of topics and posts
- echo "\t\t".$forum['number_of_threads']." | \n";
- echo "\t\t".$forum['number_of_posts']." | \n";
- // the last post in the forum
- if ($forum['last_poster_name']<>'')
- {
- $name=$forum['last_poster_name'];
- $poster_id=0;
- }
- else
- {
- $name=$forum['last_poster_firstname'].' '.$forum['last_poster_lastname'];
- $poster_id=$forum['last_poster_id'];
- }
- echo "\t\t";
- if (!empty($forum['last_post_id']))
- {
- echo $forum['last_post_date']."
".get_lang('By').' '.display_user_link($poster_id, $name);
- }
- echo " | \n";
-
-
- if (api_is_allowed_to_edit())
- {
- echo "\t\t";
- echo "".icon('../img/edit.gif',get_lang('Edit'))."";
- echo "".icon('../img/delete.gif',get_lang('Delete'))."";
- display_visible_invisible_icon('forum',$forum['forum_id'], $forum['visibility']);
- display_lock_unlock_icon('forum',$forum['forum_id'], $forum['locked']);
- display_up_down_icon('forum',$forum['forum_id'], $forums_in_category);
echo " | \n";
+
+
+ if (api_is_allowed_to_edit())
+ {
+ echo "\t\t";
+ echo "".icon('../img/edit.gif',get_lang('Edit'))."";
+ echo "".icon('../img/delete.gif',get_lang('Delete'))."";
+ display_visible_invisible_icon('forum',$forum['forum_id'], $forum['visibility']);
+ display_lock_unlock_icon('forum',$forum['forum_id'], $forum['locked']);
+ display_up_down_icon('forum',$forum['forum_id'], $forums_in_category);
+ echo " | \n";
+ }
+ echo "\t
";
}
- echo "\t";
}
}
- }
- if (count($forum_list)==0)
- {
- echo "\t| ".get_lang('NoForumInThisCategory')." |
\n";
+ if (count($forum_list)==0)
+ {
+ echo "\t| ".get_lang('NoForumInThisCategory')." | ".(api_is_allowed_to_edit()?' | ':' | ')."
\n";
+ }
}
}
echo "
\n";
diff -Naur --exclude='*~' --exclude='*.bak' dokeosorig/main/forum/newthread.php dokeosmod/main/forum/newthread.php
--- dokeosorig/main/forum/newthread.php 2007-05-04 05:00:20.000000000 -0500
+++ dokeosmod/main/forum/newthread.php 2008-02-05 01:12:06.000000000 -0500
@@ -103,7 +103,7 @@
$origin = '';
if(isset($_GET['origin']))
{
- $origin = $_GET['origin'];
+ $origin = Security::remove_XSS($_GET['origin']);
}
@@ -127,8 +127,8 @@
*/
$interbreadcrumb[]=array("url" => "index.php","name" => $nameTools);
$interbreadcrumb[]=array("url" => "viewforumcategory.php?forumcategory=".$current_forum_category['cat_id'],"name" => $current_forum_category['cat_title']);
-$interbreadcrumb[]=array("url" => "viewforum.php?forum=".$_GET['forum'],"name" => $current_forum['forum_title']);
-$interbreadcrumb[]=array("url" => "newthread.php?forum=".$_GET['forum'],"name" => get_lang('NewTopic'));
+$interbreadcrumb[]=array("url" => "viewforum.php?forum=".Security::remove_XSS($_GET['forum']),"name" => $current_forum['forum_title']);
+$interbreadcrumb[]=array("url" => "newthread.php?forum=".Security::remove_XSS($_GET['forum']),"name" => get_lang('NewTopic'));
/*
-----------------------------------------------------------
diff -Naur --exclude='*~' --exclude='*.bak' dokeosorig/main/forum/reply.php dokeosmod/main/forum/reply.php
--- dokeosorig/main/forum/reply.php 2007-05-04 05:00:20.000000000 -0500
+++ dokeosmod/main/forum/reply.php 2008-02-05 01:12:13.000000000 -0500
@@ -94,7 +94,7 @@
$origin = '';
if(isset($_GET['origin']))
{
- $origin = $_GET['origin'];
+ $origin = Security::remove_XSS($_GET['origin']);
$origin_string = '&origin='.$origin;
}
@@ -130,9 +130,9 @@
*/
$interbreadcrumb[]=array("url" => "index.php","name" => $nameTools);
$interbreadcrumb[]=array("url" => "viewforumcategory.php?forumcategory=".$current_forum_category['cat_id'],"name" => $current_forum_category['cat_title']);
-$interbreadcrumb[]=array("url" => "viewforum.php?forum=".$_GET['forum'],"name" => $current_forum['forum_title']);
-$interbreadcrumb[]=array("url" => "viewthread.php?forum=".$_GET['forum']."&thread=".$_GET['thread'],"name" => $current_thread['thread_title']);
-$interbreadcrumb[]=array("url" => "reply.php?forum=".$_GET['forum']."&thread=".$_GET['thread'],"name" => get_lang('Reply'));
+$interbreadcrumb[]=array("url" => "viewforum.php?forum=".Security::remove_XSS($_GET['forum']),"name" => $current_forum['forum_title']);
+$interbreadcrumb[]=array("url" => "viewthread.php?forum=".Security::remove_XSS($_GET['forum'])."&thread=".Security::remove_XSS($_GET['thread']),"name" => $current_thread['thread_title']);
+$interbreadcrumb[]=array("url" => "reply.php?forum=".Security::remove_XSS($_GET['forum'])."&thread=".Security::remove_XSS($_GET['thread']),"name" => get_lang('Reply'));
/*
-----------------------------------------------------------
@@ -160,7 +160,8 @@
}
else
{
- Display :: display_header();
+ // the last element of the breadcrumb navigation is already set in interbreadcrumb, so give empty string
+ Display :: display_header('');
api_display_tool_title($nameTools);
}
//echo '';
diff -Naur --exclude='*~' --exclude='*.bak' dokeosorig/main/forum/viewforumcategory.php dokeosmod/main/forum/viewforumcategory.php
--- dokeosorig/main/forum/viewforumcategory.php 2007-09-26 21:13:10.000000000 -0500
+++ dokeosmod/main/forum/viewforumcategory.php 2008-02-05 01:12:26.000000000 -0500
@@ -83,7 +83,6 @@
-----------------------------------------------------------
*/
include('forumconfig.inc.php');
-include('sanity.inc.php');
include('forumfunction.inc.php');
@@ -177,7 +176,7 @@
if (api_is_allowed_to_edit())
{
//echo ''.get_lang('AddForumCategory').' | ';
- echo ''.Display::return_icon('forum_new.gif').' '.get_lang('AddForum').'';
+ echo ''.Display::return_icon('forum_new.gif').' '.get_lang('AddForum').'';
}
/*
@@ -193,8 +192,8 @@
if (api_is_allowed_to_edit())
{
echo "\t\t";
- echo "".icon('../img/edit.gif',get_lang('Edit'))."";
- echo "".icon('../img/delete.gif',get_lang('Delete'))."";
+ echo "".icon('../img/edit.gif',get_lang('Edit'))."";
+ echo "".icon('../img/delete.gif',get_lang('Delete'))."";
display_visible_invisible_icon('forumcategory', $forum_category['cat_id'], $forum_category['visibility'], array("forumcategory"=>$_GET['forumcategory']));
display_lock_unlock_icon('forumcategory',$forum_category['cat_id'], $forum_category['locked'], array("forumcategory"=>$_GET['forumcategory']));
display_up_down_icon('forumcategory',$forum_category['cat_id'], $forum_categories_list);
@@ -333,8 +332,8 @@
if (api_is_allowed_to_edit())
{
echo "\t\t | ";
- echo "".icon('../img/edit.gif',get_lang('Edit'))."";
- echo "".icon('../img/delete.gif',get_lang('Delete'))."";
+ echo "".icon('../img/edit.gif',get_lang('Edit'))."";
+ echo "".icon('../img/delete.gif',get_lang('Delete'))."";
display_visible_invisible_icon('forum',$forum['forum_id'], $forum['visibility'], array("forumcategory"=>$_GET['forumcategory']));
display_lock_unlock_icon('forum',$forum['forum_id'], $forum['locked'], array("forumcategory"=>$_GET['forumcategory']));
display_up_down_icon('forum',$forum['forum_id'], $forums_in_category);
diff -Naur --exclude='*~' --exclude='*.bak' dokeosorig/main/forum/viewforum.php dokeosmod/main/forum/viewforum.php
--- dokeosorig/main/forum/viewforum.php 2007-09-26 21:13:10.000000000 -0500
+++ dokeosmod/main/forum/viewforum.php 2008-02-05 01:12:32.000000000 -0500
@@ -83,7 +83,7 @@
$origin = '';
if(isset($_GET['origin']))
{
- $origin = $_GET['origin'];
+ $origin = Security::remove_XSS($_GET['origin']);
$origin_string = '&origin='.$origin;
}
@@ -123,13 +123,14 @@
*/
$interbreadcrumb[]=array("url" => "index.php","name" => $nameTools);
$interbreadcrumb[]=array("url" => "viewforumcategory.php?forumcategory=".$current_forum_category['cat_id'],"name" => prepare4display($current_forum_category['cat_title']));
-$interbreadcrumb[]=array("url" => "viewforum.php?forum=".$_GET['forum'],"name" => prepare4display($current_forum['forum_title']));
+$interbreadcrumb[]=array("url" => "viewforum.php?forum=".Security::remove_XSS($_GET['forum']),"name" => prepare4display($current_forum['forum_title']));
if($origin=='learnpath')
{
include(api_get_path(INCLUDE_PATH).'reduced_header.inc.php');
} else
{
- Display :: display_header();
+ // the last element of the breadcrumb navigation is already set in interbreadcrumb, so give empty string
+ Display :: display_header('');
api_display_tool_title($nameTools);
}
@@ -196,7 +197,7 @@
{
if ($current_forum['locked'] <> 1 AND $current_forum['locked'] <> 1)
{
- echo ''.Display::return_icon('forumthread_new.gif').' '.get_lang('NewTopic').'';
+ echo ''.Display::return_icon('forumthread_new.gif').' '.get_lang('NewTopic').'';
}
else
{
@@ -248,96 +249,99 @@
$whatsnew_post_info=$_SESSION['whatsnew_post_info'];
$counter=0;
-foreach ($threads as $row)
+if(is_array($threads))
{
- // thread who have no replies yet and the only post is invisible should not be displayed to students.
- if (api_is_allowed_to_edit() OR !($row['thread_replies']=='0' AND $row['visible']=='0'))
+ foreach ($threads as $row)
{
- if($counter%2==0)
- {
- $class="row_odd";
- }
- else
- {
- $class="row_even";
- }
- echo "\t | \n";
- echo "\t\t| ";
- if (is_array($whatsnew_post_info[$_GET['forum']][$row['thread_id']]) and !empty($whatsnew_post_info[$_GET['forum']][$row['thread_id']]))
- {
- echo icon('../img/forumthread.gif');
- }
- else
- {
- echo icon('../img/forumthread.gif');
- }
-
- if ($row['thread_sticky']==1)
- {
- echo icon('../img/exclamation.gif');
- }
- echo " | \n";
- echo "\t\t".prepare4display($row['thread_title'])." | \n";
- echo "\t\t".$row['thread_replies']." | \n";
- if ($row['user_id']=='0')
- {
- $name=prepare4display($row['thread_poster_name']);
- }
- else
- {
- $name=$row['firstname'].' '.$row['lastname'];
- }
- if($origin != 'learnpath')
- {
- echo "\t\t".display_user_link($row['user_id'], $name)." | \n";
- }
- else
- {
- echo "\t\t".$name." | \n";
- }
- echo "\t\t".$row['thread_views']." | \n";
- if ($row['last_poster_user_id']=='0')
- {
- $name=$row['poster_name'];
- }
- else
- {
- $name=$row['last_poster_firstname'].' '.$row['last_poster_lastname'];
- }
- // if the last post is invisible and it is not the teacher who is looking then we have to find the last visible post of the thread
- if (($row['visible']=='1' OR api_is_allowed_to_edit()) && $origin!='learnpath')
- {
- $last_post=$row['thread_date']." ".get_lang('By').' '.display_user_link($row['last_poster_user_id'], $name);
- }
- else if($origin!='learnpath')
- {
- $last_post_sql="SELECT post.*, user.firstname, user.lastname FROM $table_posts post, $table_users user WHERE post.poster_id=user.user_id AND visible='1' AND thread_id='".$row['thread_id']."' ORDER BY post_id DESC";
- $last_post_result=api_sql_query($last_post_sql, __LINE__, __FILE__);
- $last_post_row=mysql_fetch_array($last_post_result);
- $name=$last_post_row['firstname'].' '.$last_post_row['lastname'];
- $last_post=$last_post_row['post_date']." ".get_lang('By').' '.display_user_link($last_post_row['poster_id'], $name);
- }
- else
- {
- $last_post_sql="SELECT post.*, user.firstname, user.lastname FROM $table_posts post, $table_users user WHERE post.poster_id=user.user_id AND visible='1' AND thread_id='".$row['thread_id']."' ORDER BY post_id DESC";
- $last_post_result=api_sql_query($last_post_sql, __LINE__, __FILE__);
- $last_post_row=mysql_fetch_array($last_post_result);
- $name=$last_post_row['firstname'].' '.$last_post_row['lastname'];
- $last_post=$last_post_row['post_date']." ".get_lang('By').' '.$name;
- }
- echo "\t\t".$last_post." | \n";
- if (api_is_allowed_to_edit())
+ // thread who have no replies yet and the only post is invisible should not be displayed to students.
+ if (api_is_allowed_to_edit() OR !($row['thread_replies']=='0' AND $row['visible']=='0'))
{
+ if($counter%2==0)
+ {
+ $class="row_odd";
+ }
+ else
+ {
+ $class="row_even";
+ }
+ echo "\t
\n";
echo "\t\t| ";
- echo "".icon('../img/delete.gif',get_lang('Delete'))."";
- display_visible_invisible_icon('thread', $row['thread_id'], $row['visibility'], array("forum"=>$_GET['forum'],'origin'=>$origin));
- display_lock_unlock_icon('thread',$row['thread_id'], $row['locked'], array("forum"=>$_GET['forum'],'origin'=>$origin));
- echo "".icon('../img/deplacer_fichier.gif',get_lang('MoveThread'))."";
+ if (is_array($whatsnew_post_info[$_GET['forum']][$row['thread_id']]) and !empty($whatsnew_post_info[$_GET['forum']][$row['thread_id']]))
+ {
+ echo icon('../img/forumthread.gif');
+ }
+ else
+ {
+ echo icon('../img/forumthread.gif');
+ }
+
+ if ($row['thread_sticky']==1)
+ {
+ echo icon('../img/exclamation.gif');
+ }
echo " | \n";
+ echo "\t\t".prepare4display($row['thread_title'])." | \n";
+ echo "\t\t".$row['thread_replies']." | \n";
+ if ($row['user_id']=='0')
+ {
+ $name=prepare4display($row['thread_poster_name']);
+ }
+ else
+ {
+ $name=$row['firstname'].' '.$row['lastname'];
+ }
+ if($origin != 'learnpath')
+ {
+ echo "\t\t".display_user_link($row['user_id'], $name)." | \n";
+ }
+ else
+ {
+ echo "\t\t".$name." | \n";
+ }
+ echo "\t\t".$row['thread_views']." | \n";
+ if ($row['last_poster_user_id']=='0')
+ {
+ $name=$row['poster_name'];
+ }
+ else
+ {
+ $name=$row['last_poster_firstname'].' '.$row['last_poster_lastname'];
+ }
+ // if the last post is invisible and it is not the teacher who is looking then we have to find the last visible post of the thread
+ if (($row['visible']=='1' OR api_is_allowed_to_edit()) && $origin!='learnpath')
+ {
+ $last_post=$row['thread_date']." ".get_lang('By').' '.display_user_link($row['last_poster_user_id'], $name);
+ }
+ else if($origin!='learnpath')
+ {
+ $last_post_sql="SELECT post.*, user.firstname, user.lastname FROM $table_posts post, $table_users user WHERE post.poster_id=user.user_id AND visible='1' AND thread_id='".$row['thread_id']."' ORDER BY post_id DESC";
+ $last_post_result=api_sql_query($last_post_sql, __LINE__, __FILE__);
+ $last_post_row=mysql_fetch_array($last_post_result);
+ $name=$last_post_row['firstname'].' '.$last_post_row['lastname'];
+ $last_post=$last_post_row['post_date']." ".get_lang('By').' '.display_user_link($last_post_row['poster_id'], $name);
+ }
+ else
+ {
+ $last_post_sql="SELECT post.*, user.firstname, user.lastname FROM $table_posts post, $table_users user WHERE post.poster_id=user.user_id AND visible='1' AND thread_id='".$row['thread_id']."' ORDER BY post_id DESC";
+ $last_post_result=api_sql_query($last_post_sql, __LINE__, __FILE__);
+ $last_post_row=mysql_fetch_array($last_post_result);
+ $name=$last_post_row['firstname'].' '.$last_post_row['lastname'];
+ $last_post=$last_post_row['post_date']." ".get_lang('By').' '.$name;
+ }
+ echo "\t\t".$last_post." | \n";
+ if (api_is_allowed_to_edit())
+ {
+ echo "\t\t";
+ echo "".icon('../img/delete.gif',get_lang('Delete'))."";
+ display_visible_invisible_icon('thread', $row['thread_id'], $row['visibility'], array("forum"=>$_GET['forum'],'origin'=>$origin));
+ display_lock_unlock_icon('thread',$row['thread_id'], $row['locked'], array("forum"=>$_GET['forum'],'origin'=>$origin));
+ echo "".icon('../img/deplacer_fichier.gif',get_lang('MoveThread'))."";
+ echo " | \n";
+ }
+ echo "\t
\n";
}
- echo "\t\n";
+ $counter++;
}
- $counter++;
}
echo "
";
diff -Naur --exclude='*~' --exclude='*.bak' dokeosorig/main/forum/viewthread_flat.inc.php dokeosmod/main/forum/viewthread_flat.inc.php
--- dokeosorig/main/forum/viewthread_flat.inc.php 2007-09-26 21:13:10.000000000 -0500
+++ dokeosmod/main/forum/viewthread_flat.inc.php 2008-02-05 01:12:52.000000000 -0500
@@ -97,14 +97,14 @@
// The course admin him/herself can do this off course always
if (($current_forum['allow_edit']==1 AND $row['user_id']==$_user['user_id']) or api_is_allowed_to_edit())
{
- echo "
';
$result .= '
';
@@ -150,4 +155,4 @@
==============================================================================
*/
Display :: display_footer();
-?>
\ Pas de fin de ligne à la fin du fichier.
+?>
diff -Naur --exclude='*~' --exclude='*.bak' dokeosorig/main/admin/course_category.php dokeosmod/main/admin/course_category.php
--- dokeosorig/main/admin/course_category.php 2007-09-26 21:16:44.000000000 -0500
+++ dokeosmod/main/admin/course_category.php 2008-02-05 01:10:16.000000000 -0500
@@ -50,7 +50,7 @@
{
deleteNode($_GET['id']);
- header('Location: '.api_get_self().'?category='.$category);
+ header('Location: '.api_get_self().'?category='.Security::remove_XSS($category));
exit();
}
elseif(($action == 'add' || $action == 'edit') && $_POST['formSent'])
@@ -85,7 +85,7 @@
}
elseif($action == 'edit')
{
- $categoryCode=$_GET['id'];
+ $categoryCode=Database::escape_string($_GET['id']);
$result=api_sql_query("SELECT name,auth_course_child FROM $tbl_category WHERE code='$categoryCode'",__FILE__,__LINE__);
@@ -97,7 +97,7 @@
{
moveNodeUp($_GET['id'],$_GET['tree_pos'],$category);
- header('Location: '.api_get_self().'?category='.$category);
+ header('Location: '.api_get_self().'?category='.Security::remove_XSS($category));
exit();
}
}
@@ -125,7 +125,7 @@
list($parent_id)=mysql_fetch_row($result);
?>
-<<
+<<
-<<
+<<
-
+
-