- {% set REMAINDER = contact.S_ROW_COUNT % 4 %}
-
-
+
+
+
diff --git a/core/ucp/main_module.php b/core/ucp/main_module.php
index 581b4ca80..71bf95fdf 100644
--- a/core/ucp/main_module.php
+++ b/core/ucp/main_module.php
@@ -64,7 +64,7 @@ function main($id, $mode)
$mode = $request->variable('mode', 'manage_albums');
$action = $request->variable('action', '');
- $cancel = (isset($_POST['cancel'])) ? true : false;
+ $cancel = $request->is_set_post('cancel');
$phpbb_ext_gallery_core_auth->load_user_permissions($user->data['user_id']);
if ($cancel)
{
@@ -158,6 +158,10 @@ function initialise_album()
{
global $cache, $db, $user, $phpbb_ext_gallery_core_auth, $phpbb_ext_gallery_core_album, $phpbb_ext_gallery_config, $albums_table, $phpbb_ext_gallery_user;
global $request, $users_table, $phpbb_container;
+ if (!$request->is_set_post('submit') || !check_form_key('ucp_gallery'))
+ {
+ trigger_error('FORM_INVALID');
+ }
// we will have to initialise $phpbb_ext_gallery_user
$phpbb_ext_gallery_user->set_user_id($user->data['user_id']);
@@ -276,8 +280,8 @@ function manage_albums()
'U_ALBUM' => $this->u_action . '&action=manage&parent_id=' . $album[$i]['album_id'],
'ALBUM_NAME' => $album[$i]['album_name'],
'ALBUM_DESCRIPTION' => generate_text_for_display($album[$i]['album_desc'], $album[$i]['album_desc_uid'], $album[$i]['album_desc_bitfield'], $album[$i]['album_desc_options']),
- 'U_MOVE_UP' => $this->u_action . '&action=move&move=move_up&album_id=' . $album[$i]['album_id'],
- 'U_MOVE_DOWN' => $this->u_action . '&action=move&move=move_down&album_id=' . $album[$i]['album_id'],
+ 'U_MOVE_UP' => $this->u_action . '&action=move&move=move_up&album_id=' . $album[$i]['album_id'] . '&hash=' . generate_link_hash('ucp_gallery'),
+ 'U_MOVE_DOWN' => $this->u_action . '&action=move&move=move_down&album_id=' . $album[$i]['album_id'] . '&hash=' . generate_link_hash('ucp_gallery'),
'U_EDIT' => $this->u_action . '&action=edit&album_id=' . $album[$i]['album_id'],
'U_DELETE' => $this->u_action . '&action=delete&album_id=' . $album[$i]['album_id'],
));
@@ -324,7 +328,7 @@ function create_album()
trigger_error('NO_MORE_SUBALBUMS_ALLOWED');
}
- $submit = (isset($_POST['submit'])) ? true : false;
+ $submit = $request->is_set_post('submit');
$redirect = $request->variable('redirect', '');
if (!$submit)
@@ -455,7 +459,7 @@ function edit_album()
$album_id = $request->variable('album_id', 0);
$phpbb_ext_gallery_core_album->check_user($album_id);
- $submit = (isset($_POST['submit'])) ? true : false;
+ $submit = $request->is_set_post('submit');
$redirect = $request->variable('redirect', '');
if (!$submit)
{
@@ -880,9 +884,17 @@ function move_album()
global $cache, $db, $user, $phpbb_ext_gallery_core_album, $albums_table, $request, $phpbb_gallery_url, $users_table;
$album_id = $request->variable('album_id', 0);
+ if (!check_link_hash($request->variable('hash', ''), 'ucp_gallery'))
+ {
+ trigger_error('FORM_INVALID');
+ }
$phpbb_ext_gallery_core_album->check_user($album_id);
$move = $request->variable('move', '', true);
+ if (!in_array($move, array('move_up', 'move_down'), true))
+ {
+ trigger_error('NO_MODE');
+ }
$moving = $phpbb_ext_gallery_core_album->get_info($album_id);
$sql = 'SELECT album_id, left_id, right_id
@@ -961,6 +973,10 @@ function manage_subscriptions()
$album_id_ary = $request->variable('album_id_ary', array(0));
if (($image_id_ary || $album_id_ary) && ($action == 'unsubscribe'))
{
+ if (!$request->is_set_post('action') || !check_form_key('ucp_gallery'))
+ {
+ trigger_error('FORM_INVALID');
+ }
if ($album_id_ary)
{
$phpbb_gallery_notification->remove_albums($album_id_ary);
diff --git a/core/ucp/settings_module.php b/core/ucp/settings_module.php
index ba775435f..2429d742d 100644
--- a/core/ucp/settings_module.php
+++ b/core/ucp/settings_module.php
@@ -88,6 +88,11 @@ protected function set_personal_settings()
$this->language = $phpbb_container->get('language');
if ($this->request->is_set_post('submit'))
{
+ if (!check_form_key('ucp_gallery'))
+ {
+ trigger_error('FORM_INVALID');
+ }
+
$gallery_settings = array(
'watch_own' => $this->request->variable('watch_own', false),
'watch_com' => $this->request->variable('watch_com', false),
diff --git a/core/upload.php b/core/upload.php
index db1733d0b..b39a445a2 100644
--- a/core/upload.php
+++ b/core/upload.php
@@ -239,7 +239,7 @@ public function upload_zip()
include_once($this->root_path . 'includes/functions_compress.' . $this->php_ext);
}
- $tmp_dir = $this->gallery_url->path('import') . 'tmp_' . md5(unique_id()) . '/';
+ $tmp_dir = $this->gallery_url->path('import') . 'tmp_' . unique_id() . '/';
$this->zip_file->clean_filename('unique_ext');
$this->zip_file->move_file(substr($this->gallery_url->path('import_noroot'), 0, -1), false, false, CHMOD_ALL);
@@ -441,7 +441,7 @@ public function prepare_file()
$this->new_error($this->language->lang('UPLOAD_ERROR', $this->file->get('uploadname'), implode('
» ', $this->file->error)));
return false;
}
- @chmod($this->file->get('destination_file'), 0655);
+ @chmod($this->file->get('destination_file'), 0644);
$additional_sql_data = array();
$file = $this->file;
@@ -541,7 +541,7 @@ public function prepare_file_update($image_id)
*/
public function file_to_database($additional_sql_ary)
{
- $image_name = str_replace("_", "_", utf8_substr($this->file->get('uploadname'), 0, utf8_strrpos($this->file->get('uploadname'), '.')));
+ $image_name = utf8_htmlspecialchars(utf8_substr($this->file->get('uploadname'), 0, utf8_strrpos($this->file->get('uploadname'), '.')));
$sql_ary = array_merge(array(
'image_name' => $image_name,
@@ -748,12 +748,14 @@ public function get_images($uploaded_ids)
$sql = 'SELECT *
FROM ' . $this->images_table . '
WHERE image_status = ' . (int) $this->block->get_image_status_orphan() . '
+ AND image_user_id = ' . (int) $this->user->data['user_id'] . '
+ AND image_album_id = ' . (int) $this->album_id . '
AND ' . $this->db->sql_in_set('image_id', $image_ids);
$result = $this->db->sql_query($sql);
while ($row = $this->db->sql_fetchrow($result))
{
- if ($filenames[$row['image_id']] == substr($row['image_filename'], 0, 8))
+ if (isset($filenames[$row['image_id']]) && $filenames[$row['image_id']] == substr($row['image_filename'], 0, 8))
{
$this->images[] = (int) $row['image_id'];
$this->image_data[(int) $row['image_id']] = $row;
diff --git a/tests/core/album/core_display_test.php b/tests/core/album/core_display_test.php
index b1fc0b31f..0df6e0493 100644
--- a/tests/core/album/core_display_test.php
+++ b/tests/core/album/core_display_test.php
@@ -303,5 +303,58 @@ public function test_get_branch($branch_user_id, $album_id, $type, $order, $incl
$this->assertEquals($expected, $this->display->get_branch($branch_user_id, $album_id, $type, $order, $include_album));
}
+ public function test_get_parents_uses_json_cache()
+ {
+ $expected = array(
+ 1 => array('Parent album', 1),
+ );
+ $album_data = array(
+ 'parent_id' => 1,
+ 'album_parents' => json_encode($expected),
+ );
+
+ $this->assertSame($expected, $this->display->get_parents($album_data));
+ }
+
+ public function test_get_parents_rebuilds_legacy_cache_as_json()
+ {
+ $this->db->sql_query('UPDATE phpbb_gallery_albums
+ SET left_id = 1, right_id = 6
+ WHERE album_id = 1');
+ $this->db->sql_query('UPDATE phpbb_gallery_albums
+ SET left_id = 2, right_id = 5
+ WHERE album_id = 2');
+ $this->db->sql_query("UPDATE phpbb_gallery_albums
+ SET parent_id = 2, left_id = 3, right_id = 4, album_parents = 'legacy-cache'
+ WHERE album_id = 3");
+
+ $album_data = array(
+ 'parent_id' => 2,
+ 'left_id' => 3,
+ 'right_id' => 4,
+ 'album_user_id' => 0,
+ 'album_parents' => 'legacy-cache',
+ );
+ $expected = array(
+ 1 => array('TestPublicAlbum1', 1),
+ 2 => array('TestPublicAlbumSubAlbum1', 1),
+ );
+
+ $this->assertSame($expected, $this->display->get_parents($album_data));
+
+ $sql = 'SELECT album_parents
+ FROM phpbb_gallery_albums
+ WHERE parent_id = 2';
+ $result = $this->db->sql_query($sql);
+ $cached_rows = 0;
+ while ($row = $this->db->sql_fetchrow($result))
+ {
+ $cached_rows++;
+ $this->assertSame($expected, json_decode($row['album_parents'], true));
+ }
+ $this->db->sql_freeresult($result);
+ $this->assertSame(1, $cached_rows);
+ }
+
}
diff --git a/tests/core/core_contest_test.php b/tests/core/core_contest_test.php
index 520ee760a..b3daf051f 100644
--- a/tests/core/core_contest_test.php
+++ b/tests/core/core_contest_test.php
@@ -42,6 +42,16 @@ public function test_get_contest_album_parm()
$this->assertEquals($test['contest_id'], 2);
}
+ public function test_end_handles_contest_with_fewer_than_three_images()
+ {
+ $this->gallery_contest->end(5, 1, 123456);
+ $contest = $this->gallery_contest->get_contest(1);
+
+ $this->assertSame(0, (int) $contest['contest_first']);
+ $this->assertSame(0, (int) $contest['contest_second']);
+ $this->assertSame(0, (int) $contest['contest_third']);
+ }
+
/*
* Provide data for get is_step
*/
diff --git a/tests/core/core_image_test.php b/tests/core/core_image_test.php
index 75cb4fdb6..7921b60c0 100644
--- a/tests/core/core_image_test.php
+++ b/tests/core/core_image_test.php
@@ -241,6 +241,32 @@ public function test_get_filenames($request, $expected)
$this->assertEquals($expected, $this->image->get_filenames($request));
}
+ public function test_get_image_ids_by_album_rejects_images_from_other_albums()
+ {
+ $this->assertSame(array(1, 2), $this->image->get_image_ids_by_album(array(1, 2, 4, 999), 1));
+ }
+
+ public function test_lock_images_is_scoped_to_the_checked_album()
+ {
+ $this->user->data['user_id'] = 2;
+ $this->image->lock_images(array(1, 4), 1);
+
+ $sql = 'SELECT image_id, image_status
+ FROM phpbb_gallery_images
+ WHERE ' . $this->db->sql_in_set('image_id', array(1, 4)) . '
+ ORDER BY image_id ASC';
+ $result = $this->db->sql_query($sql);
+ $statuses = array();
+ while ($row = $this->db->sql_fetchrow($result))
+ {
+ $statuses[(int) $row['image_id']] = (int) $row['image_status'];
+ }
+ $this->db->sql_freeresult($result);
+
+ $this->assertSame(\phpbbgallery\core\block::STATUS_LOCKED, $statuses[1]);
+ $this->assertSame(\phpbbgallery\core\block::STATUS_APPROVED, $statuses[4]);
+ }
+
/**
* TODO: Add test for generate_link
*/
diff --git a/tests/core/core_log_json_test.php b/tests/core/core_log_json_test.php
new file mode 100644
index 000000000..e2846b000
--- /dev/null
+++ b/tests/core/core_log_json_test.php
@@ -0,0 +1,82 @@
+gallery_auth = $this->getMockBuilder('\phpbbgallery\core\auth\auth')
+ ->disableOriginalConstructor()
+ ->getMock();
+ $this->gallery_auth->method('acl_album_ids')->willReturn(array(1, 2));
+
+ $this->gallery_log = new \phpbbgallery\core\log(
+ $this->db,
+ $this->user,
+ $this->language,
+ $this->user_loader,
+ $this->template,
+ $this->controller_helper,
+ $this->pagination,
+ $this->gallery_auth,
+ $this->gallery_config,
+ 'phpbb_gallery_log',
+ 'phpbb_gallery_images'
+ );
+
+ $this->db->sql_query('DELETE FROM phpbb_gallery_log');
+ }
+
+ public function test_log_description_round_trip_preserves_json_characters()
+ {
+ $this->user->data['user_id'] = 2;
+ $this->user->ip = '127.0.0.1';
+ $description = array('LOG_TEST', 'C:\\gallery\\image.jpg', '"quoted"', 'caf?');
+
+ $this->gallery_log->add_log('system', 'test', 0, 0, $description);
+
+ $sql = 'SELECT description
+ FROM phpbb_gallery_log';
+ $result = $this->db->sql_query($sql);
+ $row = $this->db->sql_fetchrow($result);
+ $this->db->sql_freeresult($result);
+
+ $this->assertSame($description, json_decode($row['description'], true));
+ }
+
+ public function test_log_list_decodes_description_without_slash_mutation()
+ {
+ $this->user->data['user_id'] = 2;
+ $this->user->ip = '127.0.0.1';
+ $description = array('LOG_TEST', 'C:\\gallery\\image.jpg');
+ $this->gallery_log->add_log('system', 'test', 0, 0, $description);
+
+ $this->template->expects($this->once())
+ ->method('assign_block_vars')
+ ->with('log', $this->callback(function ($row)
+ {
+ return $row['U_LOG_ACTION'] === 'LOG_TEST';
+ }));
+
+ $this->gallery_log->build_list('system', 10, 1, -1);
+ }
+}
diff --git a/tests/core/migration_order_test.php b/tests/core/migration_order_test.php
new file mode 100644
index 000000000..0c8223e15
--- /dev/null
+++ b/tests/core/migration_order_test.php
@@ -0,0 +1,70 @@
+assertSame(
+ array('\phpbbgallery\core\migrations\release_1_2_0'),
+ \phpbbgallery\core\migrations\release_1_2_0_db_create::depends_on()
+ );
+ $this->assertSame(
+ array('\phpbbgallery\core\migrations\release_1_2_0_db_create'),
+ \phpbbgallery\core\migrations\release_1_2_0_add_bbcode::depends_on()
+ );
+ $this->assertSame(
+ array('\phpbbgallery\core\migrations\release_1_2_0_add_bbcode'),
+ \phpbbgallery\core\migrations\release_1_2_0_create_filesystem::depends_on()
+ );
+ $this->assertSame(
+ array('\phpbbgallery\core\migrations\release_1_2_0_create_filesystem'),
+ \phpbbgallery\core\migrations\split_ucp_module_settings::depends_on()
+ );
+ $this->assertSame(
+ array('\phpbbgallery\core\migrations\split_ucp_module_settings'),
+ \phpbbgallery\core\migrations\release_3_2_1_0::depends_on()
+ );
+ $this->assertSame(
+ array('\phpbbgallery\core\migrations\release_3_2_1_0'),
+ \phpbbgallery\core\migrations\release_3_2_1_1::depends_on()
+ );
+ $this->assertSame(
+ array('\phpbbgallery\core\migrations\release_3_2_1_1'),
+ \phpbbgallery\core\migrations\release_3_3_0::depends_on()
+ );
+ $this->assertSame(
+ array('\phpbbgallery\core\migrations\release_3_3_0'),
+ \phpbbgallery\core\migrations\release_3_4_0::depends_on()
+ );
+ $this->assertSame(
+ array('\phpbbgallery\core\migrations\release_3_4_0'),
+ \phpbbgallery\core\migrations\remove_gallery_version::depends_on()
+ );
+ }
+
+ public function test_upgrade_migration_persists_webp_default()
+ {
+ $this->assertArrayHasKey('allow_webp', \phpbbgallery\core\migrations\release_3_2_1_0::$configs);
+ $this->assertTrue(\phpbbgallery\core\migrations\release_3_2_1_0::$configs['allow_webp']);
+ }
+}