1482 Commits

Author SHA1 Message Date
Garvin Hicking
cad25673cf [TASK] Adds ability to make plugins change the multi-media insertion gallery HTML 2019-12-03 15:54:24 +01:00
Garvin Hicking
2ea886396b [BUGFIX] Fixes missing referenced variable when $_GET['serendipity'] is not an array
refs #642
refs #653
2019-10-15 22:34:58 +02:00
Hanno
4a8616214f Avoid undefined index notices.
See #642.

Backported from master branch.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-10-13 18:28:53 +02:00
Thomas Hochstein
5f8744e414 Assume uninitialized constant PLUGIN_LINK_SPARTACUS.
Fixes #638.

Backported from master branch.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-10-13 18:09:08 +02:00
Thomas Hochstein
a2ad0bd9b5 Fix mangling of auto-generated mails.
s9y will encode the body of its auto-generated
mails as quoted-printable when imap_8bit() is
available. imap_8bit() will use "\r\n" as
linebreaks as mandated for SMTP transfer.
The result will be transmitted via PHP's
mail() function, using direct SMTP on
Windows and piping it to a MTA on Unix.

Most MTAs will cope just fine with those
linebreaks, while qmail will not; it will
replace all "\n" linebreaks with "\r\n",
so we get "\r\r\n" in our case. We can't
"fix" qmail (as its maintainer, if there
even is one, does not consider this
behaviour wrong), but we can replace the
line endings we get from imap_8bit().

The fix does work with qmail and Exim and
should work with sendmail and Postfix and
other MTAs, too. It may break sending
mail on Windows (i.e. lose all linebreaks),
but I think that's acceptable, as we'll
have more qmail installation than Windows
servers out there.

A workaround could be to set
serendipity['forceBase64']=true in
serendipity_config_local.inc.php, but I'd
prefer this fix.

Fixes #644.

Backported from master branch.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-10-13 18:08:59 +02:00
onli
f55c17ee4f Fix: rotate image did not rotate all thumbnails.
Backported from master branch.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-10-13 18:08:48 +02:00
Garvin Hicking
2b9616276f [TASK] Prevents PHP warnings with type differences on $_REQUEST['serendipity'].
refs #642

Backported from master branch.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-10-13 18:08:36 +02:00
Eike Rathke
7ce5408609 With MySQL use cast(okey as unsigned) instead of cast(okey as integer)
The autologin ("Save information") functionality in 2.3.1 is broken since

    commit 52a41b37d554da11acc932eeec44c5fb1414a492
    CommitDate: Fri Mar 23 18:01:32 2018 +0100

	Rework autologin to use a token approach

Although a cookie serendipity[author_autologintoken] with correct
expiration (one month) which random data content is present as value
in the serendipity_options table with name autologin_Username and
correct timestamp as okey and that is found with manually executing
the SQL statement

  SELECT name, value, okey FROM serendipity_options WHERE name = 'autologin_Username' AND okey > 1565801743 LIMIT 1

like done in include/functions_config.inc.php
serendipity_checkAutologin(), the login is forgotten after 30 minutes
or so. That was not the case with 2.1.5 where the login was valid for
weeks.

Of

    if (stristr($serendipity['dbType'], 'sqlite')) {
        $cast = "okey";
    } else {
        // Adds explicits casting for mysql, postgresql and others.
        $cast = "cast(okey as integer)";
    }

from which $cast then is used in the SQL statement instead of a plain
okey; when doing that manually with

  SELECT name, value, okey FROM serendipity_options WHERE name = 'autologin_Username' AND cast(okey as integer) > 1565801743 LIMIT 1

it produces the MySQL error

  #1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'integer) > 1565801743 LIMIT 1' at line 1

This also with $serendipity['dbType'] = 'mysqli' for the above code.

Indeed, cast(okey as integer) is invalid in MySQL and should be
cast(okey as unsigned) instead which then also works manually, see
https://stackoverflow.com/a/12127022 and
https://dev.mysql.com/doc/refman/5.7/en/cast-functions.html#function_cast

Same in serendipity_issueAutologin().

Changing those two places accordingly resolves the autologin not
persistent problem.

Additionally, inspecting the serendipity_options table revealed loads
of old serendipity[author_authorinformation] cookie information that
was never deleted in serendipity_issueAutologin() with the

  OR (okey LIKE 'l_%' AND $cast < " . (time() - 1814400) . ")")

expression producing a MySQL error. This has to be done manually
once as also 2.3.1 will not delete it anymore.

Backported from master branch.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-10-13 18:06:50 +02:00
Thomas Hochstein
2e5e601ea2 Fix ML mass delete, enhance i18n.
* Fix media library (mass) delete.

* I18n for multimove.
  + Add MEDIA_DIRECTORY_MOVE.
  + Change German translation of "Move" to
    "Verschieben".

Cherry-picked from master.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-08-17 13:57:54 +02:00
Thomas Hochstein
4e662bf17c Fix pagination and links for "stable archives".
* Fix core pagination for "stable archives".

  The current page will always be the current page,
  regardless of archive sorting order. Page 76 of
  86 pages will remain page 76, even if the archive
  sorting is changed; it won't become page 10.

* Fix pagination for "stable archives" in themes.

  Timeline and Bulletproof have pagination.
  Both need to swap the prev/next links for
  stable archives, as the sorting order has
  been reversed.

* Fix prev/next page links for stable archives.

  We shouldn't swap prev/next links for archive
  pages. With stable archives, the title page is
  the last page of the archive, not the first, so
  all other pages are "previos", and we should
  display it like that.

Cherry-picked from master.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-08-17 01:02:38 +02:00
Thomas Hochstein
b88f789655 Add Spartacus links to plugin lists.
Quite some information is missing from
the list of installed plugins; and the
list of installable plugins has some
more information, but not everything
that is present on Spartacus, i.e.
the last modification date.

So let's add a link to the plugin entry
on Spartacus (in the chosen language
version).

Fixes #471.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-08-17 00:58:32 +02:00
Thomas Hochstein
2d4285bd52 Fix typo / unify PHP and smarty variable names.
"requirement_failures" from PHP is saved in
"requirements_failues" - "requirements" as
in plural, and with a typo. That doesn't make
sense. Let's use "requirement_failures"
everywhere.

Backported from master.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-08-11 03:01:18 +02:00
Thomas Hochstein
71331f5e07 Wording changes for plugin version display.
"Version" should be capitalized in German -
and anywhere at the start of a sentence or
line.

Furthermore, "UPGRADE_TO_VERSION" is not
the current version ("aktuelle version"),
but the version one could upgrade to.

Backported from master.

Signed-off-by: Thomas Hochstein <thh@inter.net>
2019-08-11 03:01:18 +02:00
onli
60e975ee27 Fix: Don't show "Array" string under update notification 2019-08-03 21:11:53 +02:00
onli
ba6ccb3dbb Make $entry available for templates (fix #610) 2019-07-03 17:51:36 +02:00
onli
46c408c19b Make stablearchive default 2019-04-27 18:13:16 +02:00
onli
92a1106405 Set distinct cache directory for voku/simple-cache (#597) 2019-03-18 21:37:56 +01:00
Jari Turkia
260efcc5a6 Make sure there is a $serendipity['lang'] defined by serendipity_getSessionLanguage() 2019-03-10 11:31:25 +01:00
onli
f5d5b73c26 Bump required PHP version to 7.0 (#596) 2019-03-06 00:48:50 +01:00
Stephan Brunker
db0f47a10a upgrader move force: array check for serendipity_db_query 2019-03-05 18:38:22 +01:00
Stephan Brunker
722c1cf7f8 plugin spamblock: if forcemoderation is set, activate the new option moderation_auto 2019-03-05 18:38:22 +01:00
onli
cd0adf5550 Set templates_c as opcache destination for voku/simple-cache 2019-03-04 11:07:32 +01:00
onli
f948279583 Fix autologin token, form tokens failed cause session was not set 2019-02-20 23:06:13 +01:00
onli
c737565c13 Improve autologin token security by setting httpOnly and secure flag 2019-02-20 22:24:05 +01:00
onli
f295a3b123 Fix self-XSS on file upload
The filename was used without escaping in the scucess message shown after upload
2019-02-20 21:38:13 +01:00
onli
153b5a37f1 Fix: Do not throw error when entry got deleted, go to 404 page 2019-02-16 14:46:46 +01:00
onli
ba9c401697 Remove check of undefined constant (#556) 2019-02-16 13:36:15 +01:00
onli
4c4545428d Fix internal cache, init proper functions API 2019-02-16 13:07:53 +01:00
onli
e0f230dd15 Remove serendipity_purgeEntry
Removed pregenerated entries, but that functionality is long gone
2019-02-12 23:18:52 +01:00
onli
d52f0004a4 Add voku/simplecache as alternative to Cache/Lite and use it cache
Cache/Lite is abandoned
2019-02-12 18:52:08 +01:00
onli
88073e9816 Activate internal cache by default 2019-02-11 18:26:37 +01:00
onli
98261856db Preserve manual set image link when moving/renaming image (#509) 2019-02-10 13:44:14 +01:00
onli
f049892e39 Make serendipity_event_responsiveimages a default plugin
That means it will be activated during the s9y installation
2019-02-09 15:17:25 +01:00
Hanno
4445926033 Avoid warning about non-countable var, fix #587. 2019-01-11 16:28:08 +01:00
onli
e3aaefd2e9 ML: Add mediaproperties on rename (#509) 2018-11-18 22:57:51 +01:00
onli
732f1ae851 ML: Update links, not just thumbnail, when renaming images (#509) 2018-11-18 21:47:45 +01:00
Garvin Hicking
0dc6f620c1 [BUGFIX] Fixes media library regression, references #509
Adds missing ACL renames
Missing trailing / when managing dirs
Fix typo that did not evaluate read/write properly
Add missing NEWS entries
2018-11-05 15:59:49 +01:00
Garvin Hicking
0b259ce52f [BUGFIX] Fixes broken installer due to missing serendipity_db_probe() call. 2018-10-31 09:39:31 +01:00
onli
fdb4428191 Restore backend_media_rename (#509) 2018-10-30 19:51:37 +01:00
onli
52838c0f7b fix: plugin page died because of non-countable object 2018-10-07 19:08:15 +02:00
onli
10585fff80 Fix: Unknown constant error RSS 2018-10-07 19:04:22 +02:00
onli
166b2d4658 security: Prevent XSS via multicategory pagination 2018-09-13 16:27:28 +02:00
onli
58ed05f187 fix: missing variable orderkey was supposed to be a string 2018-09-13 14:49:15 +02:00
onli
835b076c99 php 7.2: Remove invalid constant check (#563) 2018-09-13 14:27:51 +02:00
onli
0a35bd4c59 Update Smarty to 3.1.32 2018-08-17 09:35:36 +02:00
Hanno
2669745975 replace deprecated each() with foreach() 2018-07-31 20:58:48 +02:00
onli
47b8a13911 Make the $view variable more reliable
t could happen that $view was not set, which lead to noindex being set to all frontpage pages. See https://board.s9y.org/viewtopic.php?f=3&t=24041
2018-07-31 20:35:52 +02:00
Garvin Hicking
005a86da1c Another cast for safety 2018-07-19 09:25:18 +02:00
Garvin Hicking
19513cdf14 Security fixes 2018-07-18 11:23:02 +02:00
onli
9d1fa83a39 Allow svgs in the media library (#529) 2018-06-14 22:14:04 +02:00