The "nl" language file should have the
Dutch-Netherlands locale (as "de" has
"de_DE" and not "de_AT"). We could add a
"be" language file, if need be.
Signed-off-by: Thomas Hochstein <thh@inter.net>
The "website" property fo the plugin bag used
to contain a link to external documentation,
but there is none left. So in future it may
point to a plugin website (or the website
of the plugin's author, if there is no
special page about the plugin).
Change language and translations accordingly.
Signed-off-by: Thomas Hochstein <thh@inter.net>
If serendipity_event_unstrip_tags is active, we
don't want to strip HTML tags from comments; we
want to keep and encode them with entities. So
we should do that here, too.
As the frontend_display hook - that is catched by
serendipity_event_unstrip_tags - is called quite
late, we have to skip the strip_tags() call
before truncatin the entry.
(I'm not sure why we first strip _all_ tags and
later on keep _some_ tags (that have already
been removed), but that's maybe because the
frontend_display hook may have re-added some
tags? Be it as it may, we do that for 14
years, so I don't want to change that now.)
Signed-off-by: Thomas Hochstein <thh@inter.net>
Was mostly fixed by 8b51c37b98 (see #261),
but which missed 03cc73d77e and the other
older code before the foreach() loop.
Later on, 7fe8d91bc2 did the check for
'propertyform' the wrong way around.
Signed-off-by: Thomas Hochstein <thh@inter.net>
Since merging #665 `serendipity_plugin_history`
breaks with a SQL error message on every archive
page but the first one; see #693 for reason
and context.
Unset `$serendipity['GET']['page']` before
calling `serendipity_fetchEntries(`)` (and
reset afterwards) to fix that. That's the
correct way, I think, as
`serendipity_fetchEntries()` is not called
in page context here.
Signed-off-by: Thomas Hochstein <thh@inter.net>
See #655.
I don't understand the code either (I don't even see
where this code path belongs to - do we have a
facitlity to show comments "from ... to"?), but
the current regexp is obviously wrong, and the
one suggested by @hannob is obviously
(syntactically) correct, so it should be no
problem to change that.
Fixes#655.
Signed-off-by: Thomas Hochstein <thh@inter.net>
We don't need to check against the filename
without extension, because it's only the
extension that may be problematic.
Signed-off-by: Thomas Hochstein <thh@inter.net>
Steps to reproduce:
1) Upload a PHP script to the Media Libray,
naming it "test" (or any other name
without extension).
2) Rename it to "exploit.php." (trailing dot!)
On Linux, the file will be renamed to
"exploit.php..", which is safe and
cannot be exploited.
On Windows though, the file will be
renemad to "exploit.php" and is then
remotely executable by calling it
from "/uploads/exploit.php".
Thanks to Junyu Zhang <rgdz.eye@gmail.com>
for spotting this!
Signed-off-by: Thomas Hochstein <thh@inter.net>
After fixing the other ML file renaming bugs,
it was now possible to rename a file without
extension into a file that *does* have an
extension - so we need to check against
active content.
Signed-off-by: Thomas Hochstein <thh@inter.net>
The renaming code added a dot '.' to the
filename on disk even if the file hat no
extension. Therefore, the file name on disk was
different from the name in the database,
triggering the database purging code on the
next ML display.
(serendipity_displayImageList() will delete
files from the database that don't exist
any longer on disk.)
This code won't add spurious dots for
empty extensions, keeping disk and
database in sync.
Signed-off-by: Thomas Hochstein <thh@inter.net>
Completing 1ed4b9e7ec
As we already have an (unused) language
constant for this error, we seem to have
had this kind of check before ...
Signed-off-by: Thomas Hochstein <thh@inter.net>
* plugin_api.inc.php:
- Add static list of bundled plugins.
- Add function to check if plugin is
bundled.
* plugins.inc.php:
- Set source of plugin
(Spartacus, bundled or local).
* plugins.inc.tpl:
- Display plugin source.
* Add language constants.
Signed-off-by: Thomas Hochstein <thh@inter.net>
When installing / updating plugins, plugin data
is fetched from Spartacus first; those plugins
will habe "Spartacus" as "pluginlocation".
Later on, information about installed plugins
is fetched from cache / database, overwriting
the previously fetched data for all installed
plugins. After that, "pluginlocation" is
"local" even for plugins that live on
Spartacus if they have been installed.
So we save "pluginlocation" data to a new
"pluginsource" field before merging /
overwriting so we can detect plugins that
are available on Spartacus.
This data is present in plugins.inc.tpl
and can be used there.
Signed-off-by: Thomas Hochstein <thh@inter.net>
If $limit is empty(), no limit is set, so we can
set the LIMIT statement to "" to achieve the same.
But an empty() $limit can be "0", so the
generated SQL statement could end with "0"
instead of the LIMIT statement. We catch this
with forcing an empty() $limit to "".
Fixes#636.
(No matter that this shouldn't even happen.)
Signed-off-by: Thomas Hochstein <thh@inter.net>
When renaming objects in the Media Library,
s9y didn't check if a file with the same
name already exists, resulting in a file
name collision deleting both files from
the database _and_ from disk.
Add a check to avoid that.
An error message would be nice, too, but
that may be added later on.
Tested on s9y-stable test instance.
Signed-off-by: Thomas Hochstein <thh@inter.net>
Those plugins will only be released with
s9y proper - so we could and should announce
changes with the release.
Signed-off-by: Thomas Hochstein <thh@inter.net>
The number of entries shown onm the title
page and in the feed has to be at least "1",
as s9y can't cope with "0" or negative
values (and it shouldn't).
May be related to #636.
Signed-off-by: Thomas Hochstein <thh@inter.net>
s9y will encode the body of its auto-generated
mails as quoted-printable when imap_8bit() is
available. imap_8bit() will use "\r\n" as
linebreaks as mandated for SMTP transfer.
The result will be transmitted via PHP's
mail() function, using direct SMTP on
Windows and piping it to a MTA on Unix.
Most MTAs will cope just fine with those
linebreaks, while qmail will not; it will
replace all "\n" linebreaks with "\r\n",
so we get "\r\r\n" in our case. We can't
"fix" qmail (as its maintainer, if there
even is one, does not consider this
behaviour wrong), but we can replace the
line endings we get from imap_8bit().
The fix does work with qmail and Exim and
should work with sendmail and Postfix and
other MTAs, too. It may break sending
mail on Windows (i.e. lose all linebreaks),
but I think that's acceptable, as we'll
have more qmail installation than Windows
servers out there.
A workaround could be to set
serendipity['forceBase64']=true in
serendipity_config_local.inc.php, but I'd
prefer this fix.
Fixes#644.
Signed-off-by: Thomas Hochstein <thh@inter.net>
This reverts commit d9b3333556.
With this - now reverted - commit, the prev/next
arrows in pagination were swapped because they
were the wrong way around. Unfortunately, later on,
in ebb852d400, the
root cause was fixes by "unswapping" the prev/next
links in core, so now the pagination arrows were
... eh ... wrongly swapped. So this commit has to
be reverted.
Should fix#625 for good this time.
Signed-off-by: Thomas Hochstein <thh@inter.net>
"serendipity_lang_pt_PT.inc.php" is mixed
case and won't be found if languages are
normalized to lowercase.
Signed-off-by: Thomas Hochstein <thh@inter.net>
The plugin name was derived from its
install path - but bundled sidebar and
event plugins may share a path. So use
the name instead (and strip the instance
hash from it).
Signed-off-by: Thomas Hochstein <thh@inter.net>
If you have the additional_plugins repo handy,
you can just change the base path to check all
that plugins, too.
We shouldn't forget to check the UTF-8
directories.
And we just have to catch all, even fatal,
errors, due to missing function dependencies.
Signed-off-by: Thomas Hochstein <thh@inter.net>
Unconditionally setting $serendipity['csuccess']
to 'true' will override a "moderate" flag set by
another (spamblock) plugin.
Signed-off-by: Thomas Hochstein <thh@inter.net>
Thomas Hochstein