1
0
Commit Graph

1482 Commits

Author SHA1 Message Date
cad25673cf [TASK] Adds ability to make plugins change the multi-media insertion gallery HTML 2019-12-03 15:54:24 +01:00
2ea886396b [BUGFIX] Fixes missing referenced variable when $_GET['serendipity'] is not an array
refs #642
refs #653
2019-10-15 22:34:58 +02:00
4a8616214f Avoid undefined index notices.
See #642.

Backported from master branch.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-10-13 18:28:53 +02:00
5f8744e414 Assume uninitialized constant PLUGIN_LINK_SPARTACUS.
Fixes #638.

Backported from master branch.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-10-13 18:09:08 +02:00
a2ad0bd9b5 Fix mangling of auto-generated mails.
s9y will encode the body of its auto-generated
mails as quoted-printable when imap_8bit() is
available. imap_8bit() will use "\r\n" as
linebreaks as mandated for SMTP transfer.
The result will be transmitted via PHP's
mail() function, using direct SMTP on
Windows and piping it to a MTA on Unix.

Most MTAs will cope just fine with those
linebreaks, while qmail will not; it will
replace all "\n" linebreaks with "\r\n",
so we get "\r\r\n" in our case. We can't
"fix" qmail (as its maintainer, if there
even is one, does not consider this
behaviour wrong), but we can replace the
line endings we get from imap_8bit().

The fix does work with qmail and Exim and
should work with sendmail and Postfix and
other MTAs, too. It may break sending
mail on Windows (i.e. lose all linebreaks),
but I think that's acceptable, as we'll
have more qmail installation than Windows
servers out there.

A workaround could be to set
serendipity['forceBase64']=true in
serendipity_config_local.inc.php, but I'd
prefer this fix.

Fixes #644.

Backported from master branch.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-10-13 18:08:59 +02:00
f55c17ee4f Fix: rotate image did not rotate all thumbnails.
Backported from master branch.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-10-13 18:08:48 +02:00
2b9616276f [TASK] Prevents PHP warnings with type differences on $_REQUEST['serendipity'].
refs #642

Backported from master branch.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-10-13 18:08:36 +02:00
7ce5408609 With MySQL use cast(okey as unsigned) instead of cast(okey as integer)
The autologin ("Save information") functionality in 2.3.1 is broken since

    commit 52a41b37d5
    CommitDate: Fri Mar 23 18:01:32 2018 +0100

	Rework autologin to use a token approach

Although a cookie serendipity[author_autologintoken] with correct
expiration (one month) which random data content is present as value
in the serendipity_options table with name autologin_Username and
correct timestamp as okey and that is found with manually executing
the SQL statement

  SELECT name, value, okey FROM serendipity_options WHERE name = 'autologin_Username' AND okey > 1565801743 LIMIT 1

like done in include/functions_config.inc.php
serendipity_checkAutologin(), the login is forgotten after 30 minutes
or so. That was not the case with 2.1.5 where the login was valid for
weeks.

Of

    if (stristr($serendipity['dbType'], 'sqlite')) {
        $cast = "okey";
    } else {
        // Adds explicits casting for mysql, postgresql and others.
        $cast = "cast(okey as integer)";
    }

from which $cast then is used in the SQL statement instead of a plain
okey; when doing that manually with

  SELECT name, value, okey FROM serendipity_options WHERE name = 'autologin_Username' AND cast(okey as integer) > 1565801743 LIMIT 1

it produces the MySQL error

  #1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'integer) > 1565801743 LIMIT 1' at line 1

This also with $serendipity['dbType'] = 'mysqli' for the above code.

Indeed, cast(okey as integer) is invalid in MySQL and should be
cast(okey as unsigned) instead which then also works manually, see
https://stackoverflow.com/a/12127022 and
https://dev.mysql.com/doc/refman/5.7/en/cast-functions.html#function_cast

Same in serendipity_issueAutologin().

Changing those two places accordingly resolves the autologin not
persistent problem.

Additionally, inspecting the serendipity_options table revealed loads
of old serendipity[author_authorinformation] cookie information that
was never deleted in serendipity_issueAutologin() with the

  OR (okey LIKE 'l_%' AND $cast < " . (time() - 1814400) . ")")

expression producing a MySQL error. This has to be done manually
once as also 2.3.1 will not delete it anymore.

Backported from master branch.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-10-13 18:06:50 +02:00
2e5e601ea2 Fix ML mass delete, enhance i18n.
* Fix media library (mass) delete.

* I18n for multimove.
  + Add MEDIA_DIRECTORY_MOVE.
  + Change German translation of "Move" to
    "Verschieben".

Cherry-picked from master.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-08-17 13:57:54 +02:00
4e662bf17c Fix pagination and links for "stable archives".
* Fix core pagination for "stable archives".

  The current page will always be the current page,
  regardless of archive sorting order. Page 76 of
  86 pages will remain page 76, even if the archive
  sorting is changed; it won't become page 10.

* Fix pagination for "stable archives" in themes.

  Timeline and Bulletproof have pagination.
  Both need to swap the prev/next links for
  stable archives, as the sorting order has
  been reversed.

* Fix prev/next page links for stable archives.

  We shouldn't swap prev/next links for archive
  pages. With stable archives, the title page is
  the last page of the archive, not the first, so
  all other pages are "previos", and we should
  display it like that.

Cherry-picked from master.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-08-17 01:02:38 +02:00
b88f789655 Add Spartacus links to plugin lists.
Quite some information is missing from
the list of installed plugins; and the
list of installable plugins has some
more information, but not everything
that is present on Spartacus, i.e.
the last modification date.

So let's add a link to the plugin entry
on Spartacus (in the chosen language
version).

Fixes #471.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-08-17 00:58:32 +02:00
2d4285bd52 Fix typo / unify PHP and smarty variable names.
"requirement_failures" from PHP is saved in
"requirements_failues" - "requirements" as
in plural, and with a typo. That doesn't make
sense. Let's use "requirement_failures"
everywhere.

Backported from master.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-08-11 03:01:18 +02:00
71331f5e07 Wording changes for plugin version display.
"Version" should be capitalized in German -
and anywhere at the start of a sentence or
line.

Furthermore, "UPGRADE_TO_VERSION" is not
the current version ("aktuelle version"),
but the version one could upgrade to.

Backported from master.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-08-11 03:01:18 +02:00
60e975ee27 Fix: Don't show "Array" string under update notification 2019-08-03 21:11:53 +02:00
ba6ccb3dbb Make $entry available for templates (fix #610) 2019-07-03 17:51:36 +02:00
46c408c19b Make stablearchive default 2019-04-27 18:13:16 +02:00
92a1106405 Set distinct cache directory for voku/simple-cache (#597) 2019-03-18 21:37:56 +01:00
260efcc5a6 Make sure there is a $serendipity['lang'] defined by serendipity_getSessionLanguage() 2019-03-10 11:31:25 +01:00
f5d5b73c26 Bump required PHP version to 7.0 (#596) 2019-03-06 00:48:50 +01:00
db0f47a10a upgrader move force: array check for serendipity_db_query 2019-03-05 18:38:22 +01:00
722c1cf7f8 plugin spamblock: if forcemoderation is set, activate the new option moderation_auto 2019-03-05 18:38:22 +01:00
cd0adf5550 Set templates_c as opcache destination for voku/simple-cache 2019-03-04 11:07:32 +01:00
f948279583 Fix autologin token, form tokens failed cause session was not set 2019-02-20 23:06:13 +01:00
c737565c13 Improve autologin token security by setting httpOnly and secure flag 2019-02-20 22:24:05 +01:00
f295a3b123 Fix self-XSS on file upload
The filename was used without escaping in the scucess message shown after upload
2019-02-20 21:38:13 +01:00
153b5a37f1 Fix: Do not throw error when entry got deleted, go to 404 page 2019-02-16 14:46:46 +01:00
ba9c401697 Remove check of undefined constant (#556) 2019-02-16 13:36:15 +01:00
4c4545428d Fix internal cache, init proper functions API 2019-02-16 13:07:53 +01:00
e0f230dd15 Remove serendipity_purgeEntry
Removed pregenerated entries, but that functionality is long gone
2019-02-12 23:18:52 +01:00
d52f0004a4 Add voku/simplecache as alternative to Cache/Lite and use it cache
Cache/Lite is abandoned
2019-02-12 18:52:08 +01:00
88073e9816 Activate internal cache by default 2019-02-11 18:26:37 +01:00
98261856db Preserve manual set image link when moving/renaming image (#509) 2019-02-10 13:44:14 +01:00
f049892e39 Make serendipity_event_responsiveimages a default plugin
That means it will be activated during the s9y installation
2019-02-09 15:17:25 +01:00
4445926033 Avoid warning about non-countable var, fix #587. 2019-01-11 16:28:08 +01:00
e3aaefd2e9 ML: Add mediaproperties on rename (#509) 2018-11-18 22:57:51 +01:00
732f1ae851 ML: Update links, not just thumbnail, when renaming images (#509) 2018-11-18 21:47:45 +01:00
0dc6f620c1 [BUGFIX] Fixes media library regression, references #509
Adds missing ACL renames
Missing trailing / when managing dirs
Fix typo that did not evaluate read/write properly
Add missing NEWS entries
2018-11-05 15:59:49 +01:00
0b259ce52f [BUGFIX] Fixes broken installer due to missing serendipity_db_probe() call. 2018-10-31 09:39:31 +01:00
fdb4428191 Restore backend_media_rename (#509) 2018-10-30 19:51:37 +01:00
52838c0f7b fix: plugin page died because of non-countable object 2018-10-07 19:08:15 +02:00
10585fff80 Fix: Unknown constant error RSS 2018-10-07 19:04:22 +02:00
166b2d4658 security: Prevent XSS via multicategory pagination 2018-09-13 16:27:28 +02:00
58ed05f187 fix: missing variable orderkey was supposed to be a string 2018-09-13 14:49:15 +02:00
835b076c99 php 7.2: Remove invalid constant check (#563) 2018-09-13 14:27:51 +02:00
0a35bd4c59 Update Smarty to 3.1.32 2018-08-17 09:35:36 +02:00
2669745975 replace deprecated each() with foreach() 2018-07-31 20:58:48 +02:00
47b8a13911 Make the $view variable more reliable
t could happen that $view was not set, which lead to noindex being set to all frontpage pages. See https://board.s9y.org/viewtopic.php?f=3&t=24041
2018-07-31 20:35:52 +02:00
005a86da1c Another cast for safety 2018-07-19 09:25:18 +02:00
19513cdf14 Security fixes 2018-07-18 11:23:02 +02:00
9d1fa83a39 Allow svgs in the media library (#529) 2018-06-14 22:14:04 +02:00