Changeset 569

Timestamp:

07/29/08 16:01:29 (4 months ago)

Author:

sidtheduck

Message:

+ Fix for ticket #185 - special characters in album name
+ Fix for ticket #181 - Edit comment form
+ Fix for ticket #180 - Manage Feedback notification issues
+ Fix for possible SQL injection vulnerability found by security tester (Thanks James of GulfTech?!)
+ Redirect to plog-upload if already logged in and navigating to plog-admin/index.php

Location:

trunk

Files:

• plog-admin/index.php (modified) (1 diff)
• plog-admin/plog-admin-functions.php (modified) (24 diffs)
• plog-admin/plog-admin.php (modified) (2 diffs)
• plog-admin/plog-feedback.php (modified) (1 diff)
• plog-admin/plog-manage.php (modified) (12 diffs)
• plog-admin/plog-upload.php (modified) (1 diff)
• plog-download.php (modified) (5 diffs)
• plog-includes/plog-functions.php (modified) (11 diffs)
• plog-remote.php (modified) (3 diffs)

trunk/plog-admin/index.php

@@ -2 +2 @@
 // load configuration variables from database, plog-globals, & plog-includes/plog-functions
 require_once(dirname(dirname(__FILE__))."/plog-load-config.php");
+
+// if we're already logged in, redirect to the upload page
+if (isset($_SESSION['plogger_logged_in']) && $_SESSION['plogger_logged_in'] === true) {
+        header("Location: plog-upload.php");
+        exit;
+}
 
 $output = '';

trunk/plog-admin/plog-admin-functions.php

@@ -33 +33 @@
 }
 
+function generate_pagination_view_menu() {
+        $url_query = "?";
+        $url_parts = parse_url($_SERVER['REQUEST_URI']);
+        if (isset($url_parts['query'])) {
+                // if entries_per_page is already present in URL, remove it
+                if (strpos($url_parts['query'], "entries_per_page") !== false || strpos($url_parts['query'], "plog_page") !== false) {
+                        parse_str($url_parts['query'], $query_parts);
+                        foreach ($query_parts as $qkey => $qval) {
+                                if ($qkey != "entries_per_page" && $qkey != "plog_page") {
+                                        $url_query .= $qkey."=".$qval."&";
+                                }
+                        }
+                } else {
+                        $url_query .= $url_parts['query']."&";
+                }
+        }
+
+        $java = 'document.location.href = \''.$url_parts['path'].$url_query.'entries_per_page=\'+this.options[this.selectedIndex].value';
+
+        $possible_values = array("1"=>1, "5"=>5, "10"=>10, "20"=>20, "50"=>50, "100"=>100, "250"=>250, "500"=>500);
+        $output= "\n\t\t\t" . '<label accesskey="e" for="entries_on_page">' .plog_tr('<em>E</em>ntries per page') . '</label>
+                        <select class="entries-page" onchange="'.$java.'" name="entries_per_page" style="width: 60px;">';
+        foreach ($possible_values as $key => $value) {
+                if ($_SESSION['entries_per_page'] == $key) {
+                        $output .= "\n\t\t\t\t".'<option value="'.$value.'" selected="selected">'.$key.'</option>';
+                } else {
+                        $output .= "\n\t\t\t\t".'<option value="'.$value.'">'.$key.'</option>';
+                }
+        }
+        $output.= "\n\t\t\t".'</select>';
+        return $output;
+}
+
 function add_picture($album_id,$tmpname,$filename,$caption,$desc) {
         global $config;
@@ -72 +105 @@
 
         while (is_file($config['basedir'].'plog-content/images/'.$create_path."/".$unique_filename_base.".".$filename_ext)){
-                $unique_filename_base = SmartStripSlashes($filename_base)." (" . ++$i .")";
-        }
-
-        $final_filename = $unique_filename_base . "." . $filename_ext;
+                $unique_filename_base = SmartStripSlashes($filename_base)."(" . ++$i .")";
+        }
+
+        $final_filename = sanitize_filename($unique_filename_base) . "." . $filename_ext;
 
         // final fully qualified file name
-        $final_fqfn = $config["basedir"].'plog-content/images/'.$create_path.'/'.$final_filename;
+        $final_fqfn = $config['basedir'].'plog-content/images/'.$create_path.'/'.$final_filename;
 
         if (!makeDirs($config['basedir'].'plog-content/images/'.$create_path, 0777)) {
@@ -164 +197 @@
 };
 
-function update_picture($id,$caption,$allow_comments,$description) {
+function update_picture($id, $caption, $allow_comments, $description) {
         $id = intval($id);
         $caption = mysql_real_escape_string($caption);
@@ -175 +208 @@
                 WHERE id='$id'";
         $result = mysql_query($query);
-        if ($result) 
+        if ($result) {
                 return array('output' => plog_tr('You have successfully modified the selected picture.'));
-        else
+        } else {
                 return array('errors' => mysql_error());
+        }
 }
 
@@ -235 +269 @@
         $i = 0;
         while ($to_album != $picture['parent_album'] && is_file($config['basedir'].'plog-content/images/'.$target_path."/".$unique_filename_base.".".$filename_ext)){
-                $unique_filename_base = $filename_base." (" . ++$i . ")";
+                $unique_filename_base = $filename_base."(" . ++$i . ")";
         }
 
         // final fully qualified file name
-        $picture_path = $target_path.'/'.$unique_filename_base.".".$filename_ext;
+        $picture_path = $target_path.'/'.sanitize_filename($unique_filename_base).".".$filename_ext;
         $final_fqfn = $config['basedir'].'plog-content/images/'.$picture_path;
 
@@ -392 +426 @@
         $target_path = $config["basedir"] . "plog-content/images/".$target_name;
 
-        // do not allow collections with duplicate names, otherwise mod_rewritten links will start
-        // to behave weird.
-        if ($row["name"] != $name && is_dir($target_path)) {
-                // if there is already a directory, check to see if it's in the database
-                $collection_data = get_collection_by_name($name);
-                if ($collection_data){
-                        // it's in the database, so throw duplicate collection error
-                        return array("errors" => sprintf(plog_tr('Collection `%s` could not be renamed to `%s`, because there is another collection with that name'),$row['name'],$name));
-                } else{
-                        // it's not in the database so attempt to delete the directory
-                        if (!@rmdir($target_path)){
-                                // could not delete the directory, so prompt the user to delete it manually
-                                return array("errors" => sprintf(plog_tr('Collection directory `%s` exists, but no collection exists in the database. Attempt to delete automatically failed. Please delete folder via FTP manually and try again.'), $target_path));
+        // check for self-re-naming collection instance
+        if ($source_path != $target_path) {
+                // do not allow collections with duplicate names, otherwise mod_rewritten links will start
+                // to behave weird.
+                if (is_dir($target_path)) {
+                        // if there is already a directory, check to see if it's in the database
+                        $collection_data = get_collection_by_name($name);
+                        if ($collection_data){
+                                // it's in the database, so throw duplicate collection error
+                                return array("errors" => sprintf(plog_tr('Collection `%s` could not be renamed to `%s`, because there is another collection with that name'),$row['name'],$name));
+                        } else{
+                                // it's not in the database so attempt to delete the directory
+                                if (!@rmdir($target_path)){
+                                        // could not delete the directory, so prompt the user to delete it manually
+                                        return array("errors" => sprintf(plog_tr('Collection directory `%s` exists, but no collection exists in the database. Attempt to delete automatically failed. Please delete folder via FTP manually and try again.'), $target_path));
+                                }
                         }
                 }
-        }
-
-        // perform the rename on the directory
-        if (!rename($source_path, $target_path)) {
-                return array("errors" => sprintf(plog_tr("Error renaming directory! (%s to %s)"),$source_path,$target_path));
+
+                // perform the rename on the directory
+                if (!rename($source_path, $target_path)) {
+                        return array("errors" => sprintf(plog_tr("Error renaming directory! (%s to %s)"),$source_path,$target_path));
+                }
         }
 
@@ -470 +507 @@
         } else {
                 return array('errors' => plog_tr('Could not modify selected collection'));
-        };
+        }
 
 }
@@ -541 +578 @@
         // first try to create the directory to hold the images, if that fails, then the album
         // will be unusable anyway
-        $create_path = $config["basedir"] . "plog-content/images/".SmartStripSlashes($row["collection_path"])."/".$album_folder;
+        $create_path = $config['basedir'] . "plog-content/images/".SmartStripSlashes($row['collection_path'])."/".$album_folder;
 
         // check path so we are not creating duplicate albums within the same collection
@@ -582 +619 @@
 }
 
-function update_album($album_id,$name,$description,$thumbnail_id = 0) {
-        global $config;
-
+function update_album($album_id, $name, $description, $thumbnail_id = 0) {
+        global $config;
         $errors = $output = "";
-
-        $target_name = strtolower(sanitize_filename(SmartStripSlashes($name)));
-
+        
         $album_id = intval($album_id);
         $thumbnail_id = intval($thumbnail_id);
-        $name = mysql_real_escape_string(SmartStripSlashes($name));
+        $name = mysql_real_escape_string(SmartStripSlashes(trim($name)));
         $description = mysql_real_escape_string(SmartStripSlashes($description));
+        if (empty($name)) {
+                return array("errors" => plog_tr("Please enter a valid name for the album"));
+        }
+
+        $target_name = strtolower(sanitize_filename(SmartStripSlashes($name)));
 
          // first, get the album name and collection name of our source album
-        $sql = "SELECT c.path AS collection_path, a.path AS album_path
+        $sql = "SELECT c.path AS collection_path, a.path AS album_path, a.parent_id AS collection_id
                         FROM ".TABLE_PREFIX."albums a, ".TABLE_PREFIX."collections c
-                        WHERE c.id = a.parent_id AND a.id = '$album_id'";
+                        WHERE c.id = a.parent_id AND a.id = ".$album_id;
 
         $result = run_query($sql);
         $row = mysql_fetch_assoc($result);
 
-        $source_album_name = SmartStripSlashes($row["album_path"]);
-        $source_collection_name = SmartStripSlashes($row["collection_path"]);     
+        $source_album_name = SmartStripSlashes($row['album_path']);
+        $source_collection_name = SmartStripSlashes($row['collection_path']);     
 
         $source_path = $config['basedir'] . "plog-content/images/".$source_collection_name."/".$source_album_name;
         $target_path = $config['basedir'] . "plog-content/images/".$source_collection_name."/".$target_name;
 
-        // check path so we are not creating duplicate albums within the same collection
-        if (is_dir($target_path)){
-                // if there is already a directory, check to see if it's in the database
-                $album_data = get_album_by_name($album_name, $to_collection);
-                if ($album_data) {
-                        // it's in the database, so throw duplicate album error
-                        return array("errors" => sprintf(plog_tr('New album could not be created, because there already is one named `%s` in the collection `%s`!'), $target_name, $source_collection_name));
-                } else {
-                        // it's not in the database so attempt to delete the directory
-                        if (!@rmdir($target_path)){
-                                // could not delete the directory, so prompt the user to delete it manually
-                                return array("errors" => sprintf(plog_tr('Album directory `%s` exists, but no album exists in the database. Attempt to delete automatically failed. Please delete folder via FTP manually and try again.'), $target_path));
+        // check for self-re-naming album instance
+        if ($source_path != $target_path) {
+                // check path so we are not creating duplicate albums within the same collection
+                if (is_dir($target_path)) {
+                        // if there is already a directory, check to see if it's in the database
+                        $album_data = get_album_by_name($name, $row['collection_id']);
+                        if ($album_data) {
+                                // it's in the database, so throw duplicate album error
+                                return array("errors" => sprintf(plog_tr('New album could not be created, because there already is one named `%s` in the collection `%s`!'), $target_name, $source_collection_name));
+                        } else {
+                                // it's not in the database so attempt to delete the directory
+                                if (!@rmdir($target_path)){
+                                        // could not delete the directory, so prompt the user to delete it manually
+                                        return array("errors" => sprintf(plog_tr('Album directory `%s` exists, but no album exists in the database. Attempt to delete automatically failed. Please delete folder via FTP manually and try again.'), $target_path));
+                                }
                         }
                 }
-        }
-
-        // perform the rename on the directory
-        if (!rename($source_path, $target_path))
-        {
-                return array(
-                        "errors" => sprintf(plog_tr("Error renaming directory! (%s to %s)"),$source_path,$target_path));
+
+                // perform the rename on the directory
+                if (!rename($source_path, $target_path))
+                {
+                        return array(
+                                "errors" => sprintf(plog_tr("Error renaming directory! (%s to %s)"),$source_path,$target_path));
+                }
         }
 
@@ -925 +967 @@
                 return false;
         }
-        $output .= "\n\t" . '<form class="edit" action="'.$_SERVER["PHP_SELF"].'" method="post">
-                <table>';
+        $query = "";
+        if (strpos($_SERVER['PHP_SELF'], "plog-manage") !== false) {
+                $query = "?level=comments&amp;id=".$comment['parent_id'];
+        }
+
+        $output .= "\n\t" . '<form class="edit" action="'.$_SERVER['PHP_SELF'].$query.'" method="post">';
+
+        // get the thumbnail
+        $photo = get_picture_by_id($comment['parent_id']);
+        $thumbpath = generate_thumb(SmartStripSlashes($photo['path']), $photo['id'],THUMB_SMALL);
+        $output .= "\n\t\t" . '<div style="float: right;"><img src="'.$thumbpath.'" alt="" /></div>';
+
+        $output .= "\n\t\t<table>";
         $output .= "\n\t\t\t" . '<tr>
                                 <td>' . plog_tr('Author:') . '<br /><input size="30" name="author" id="author" value="'.SmartStripSlashes($comment['author']).'"/ ></td>
@@ -940 +993 @@
                         <input type="hidden" name="pid" value="'.$comment['id'].'" >
                         <input type="hidden" name="action" value="update-comment" >
-                        <button class="submit" type="submit">' . plog_tr('Update') . '</button>';
-
-                if (isset($_REQUEST["level"]))
-                {
-                        $output .= "\n\t\t\t" . '<input type="hidden" name="level" value="'.$_REQUEST['level'].'" />';
-                }
-
-                if (isset($_REQUEST["id"]))
-                {
-                        $output .= "\n\t\t\t" . '<input type="hidden" name="id" value="'.$_REQUEST['id'].'" />';
-                }
+                        <input class="submit" name="update" value="' . plog_tr('Update') . '" type="submit" />
+                        <input class="submit" name="cancel" value="' . plog_tr('Cancel') . '" type="submit" />';
 
                         $output .= "\n\n\t\t" . '</form>';
@@ -1135 +1179 @@
 
 /// XXX: something for the future: perhaps hooks for plugins should be implemented,
-// so plugis could add new fields to all those forms.
+// so plugins could add new fields to all those forms.
 function plog_add_collection_form() {
         $output = "\n\t\t" . '<input type="button" class="submit" id="show-collection" onclick="toggle(\'create-collection\'); toggle(\'show-collection\')" value="' . plog_tr('Create a Collection') . '" />';
@@ -1178 +1222 @@
         $output = '';
         $collection_id = intval($collection_id);
-        $output .= "\n\t\t" . '<form class="edit" action="'.$_SERVER["REQUEST_URI"].'" method="post">';
+        $output .= "\n\t\t" . '<form class="edit" action="'.$_SERVER['PHP_SELF'].'" method="post">';
         $collection = get_collection_by_id($collection_id);
 
@@ -1205 +1249 @@
         $output .= "\n\t\t\t" . '<div>
                         <label accesskey="n" for="name">' . plog_tr('<em>N</em>ame') . ':</label><br />
-                        <input size="30" name="name" id="name" value="'.SmartStripSlashes($collection['name']).'" /><br />
+                        <input size="30" name="name" id="name" value="'.htmlspecialchars(SmartStripSlashes($collection['name'])).'" /><br />
                         <label accesskey="d" for="description">' . plog_tr('<em>D</em>escription') . ':</label><br />
-                        <input size="80" name="description" id="description" value="'.SmartStripSlashes($collection['description']).'" /><br />
+                        <input size="80" name="description" id="description" value="'.htmlspecialchars(SmartStripSlashes($collection['description'])).'" /><br />
                         Thumbnail:<br />
                                 <select name="thumbnail_id" onchange="updateThumbPreview(this)" class="thumbselect" id="thumbselect">
@@ -1216 +1260 @@
                                 <input type="hidden" name="action" value="update-collection" />
                                 <br />
-                                <button class="submit" type="submit">' . plog_tr('Update') . '</button>
+                                <input class="submit" name="update" value="' . plog_tr('Update') . '" type="submit" />
+                                <input class="submit" name="cancel" value="' . plog_tr('Cancel') . '" type="submit" />
                         </div>';
 
@@ -1231 +1276 @@
         $auto_graphic = $config['gallery_url']."plog-admin/images/auto.gif";
 
-        $output = "\n\t\t" . '<form class="edit" action="'.$_SERVER["PHP_SELF"].'?level=albums&amp;id='.$album["parent_id"].'" method="post">';
+        $output = "\n\t\t" . '<form class="edit" action="'.$_SERVER['PHP_SELF'].'?level=albums&amp;id='.$album['parent_id'].'" method="post">';
 
         $images = '<option class="thumboption" value="0" style="padding-left: 100px; background-image: url('.$auto_graphic.'); background-repeat: no-repeat;">' . plog_tr('automatic') . '</option>';
@@ -1242 +1287 @@
                         $style = 'class="thumboption" style="padding-left: '.($thumbnail_config[THUMB_SMALL]["size"] + 5).'px; background-image: url('.generate_thumb(SmartStripSlashes($row["path"]), $row["id"]).'); background-repeat: no-repeat;"';
 
-                        $images .= "\n\t\t\t\t<option $style value='" . $row["id"] . "'" . $selected . ">";
+                        $images .= "\n\t\t\t\t<option ".$style." value='" . $row["id"] . "'" . $selected . ">";
                         $images .= !empty($row["caption"]) ? SmartStripSlashes($row["caption"]) : SmartStripSlashes(basename($row["path"]));
                         $images .= "</option>";
@@ -1249 +1294 @@
                 $output .= "\n\t\t\t" . '<div>
                         <label for="name" accesskey="n">' . plog_tr('<em>N</em>ame') . ':</label><br />
-                        <input size="30" name="name" id="name" value="'.SmartStripSlashes($album['name']).'" /><br />
+                        <input size="30" name="name" id="name" value="'.htmlspecialchars(SmartStripSlashes($album['name'])).'" /><br />
                         <label for="description" accesskey="d">' . plog_tr('<em>D</em>escription') . ':</label><br />
-                        <input size="80" name="description" id="description" value="'.SmartStripSlashes($album['description']).'" /><br />
+                        <input size="80" name="description" id="description" value="'.htmlspecialchars(SmartStripSlashes($album['description'])).'" /><br />
                         Thumbnail:<br />
                                 <select name="thumbnail_id" class="thumbselect" id="thumbselect" onchange="updateThumbPreview(this)">
@@ -1260 +1305 @@
                                 <input type="hidden" name="action" value="update-album" />
                                 <br />
-                                <button class="submit" type="submit">' . plog_tr('Update') . '</button>
+                                <input class="submit" name="update" value="' . plog_tr('Update') . '" type="submit" />
+                                <input class="submit" name="cancel" value="' . plog_tr('Cancel') . '" type="submit" />
                         </div>';
                 $output .= "\n\t\t" . '</form>' . "\n";
@@ -1331 +1377 @@
                         //$java = "javascript:this.ThumbPreviewPopup('$target')";
                         $output .= "\n\t\t\t\t" . '<td><div class="img-shadow"><a href="'.plogger_get_picture_thumb(THUMB_LARGE).'" rel="lightbox" title="'.plogger_get_picture_caption().'">'.$imgtag.'</a></div></td>';
-                        $output .= "\n\t\t\t\t<td><strong><a class='folder' href='?level=comments&amp;id=" . $id . "'>" . basename(plogger_get_source_picture_path()) . "</a></strong></td>";
+                        $output .= "\n\t\t\t\t".'<td><strong><a class="folder" href="'.$_SERVER['PHP_SELF'].'?level=comments&amp;id=' . $id . '">' . basename(plogger_get_source_picture_path()) . '</a></strong> &#8212; ' . sprintf(plog_tr('contains %d comment(s)'), plogger_picture_comment_count()) . '</td>';
                         $output .= "\n\t\t\t\t<td><p id=\"picture-caption-" . plogger_get_picture_id() ."\">" . plogger_get_picture_caption() . "&nbsp;</p></td>";
                         $output .= "\n\t\t\t\t<td><p id=\"picture-description-" . plogger_get_picture_id() ."\">" . plogger_get_picture_description() . "&nbsp;</p></td>";
@@ -1342 +1388 @@
 
                         $parent_id = $_REQUEST["id"];
-                        $output .= '<a href="?action=1&amp;selected%5B%5D=' . $id . '&amp;level=pictures&amp;delete_checked=1&amp;id='.$parent_id;
-                        if (isset($_GET["entries_per_page"])) $output .= '&amp;entries_per_page=' . intval($_GET["entries_per_page"]);
-                        if (isset($_GET["plog_page"])) $output .= '&amp;plog_page=' . intval($_GET["plog_page"]);
+                        $output .= '<a href="?action=move-delete&amp;selected%5B%5D=' . $id . '&amp;level=pictures&amp;delete_checked=1&amp;id='.$parent_id;
+                        if (isset($_GET['plog_page'])) $output .= '&amp;plog_page=' . intval($_GET['plog_page']);
                         $output .= '" onclick="return confirm(\'' . plog_tr('Are you sure you want to delete this item?') . '\');"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/x.gif" alt="' . plog_tr('Delete') . '" title="' . plog_tr('Delete') . '" /></a></td>';
                         $output .= "\n\t\t\t</tr>";
@@ -1415 +1460 @@
                         $counter++;
 
-                        $output .= "\n\t\t\t<tr class='$table_row_color'>";
-                        $output .= "\n\t\t\t\t<td><input type='checkbox' name='selected[]' value='" . $id . "' /></td>";
-                        $output .= "\n\t\t\t\t<td><a class='folder' href='?level=pictures&amp;id=" .$id . "'><span id='album-name-" . plogger_get_album_id(). "'><strong>" . plogger_get_album_name() . "</strong></span></a> &#8212; " . sprintf(plog_tr('contains %d picture(s)'),plogger_album_picture_count()) . "</td>";
-                        $output .= "\n\t\t\t\t<td><p id='album-description-" . plogger_get_album_id() . "'>" . plogger_get_album_description() . "&nbsp;</p></td>";
-                        $output .= "\n\t\t\t\t" . '<td><a href="?action=edit-album&amp;id=' . $id . '"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/edit.gif" alt="' . plog_tr('Edit') . '" title="' . plog_tr('Edit') . '" /></a>';
-                        $output .= '<a href="?action=1&amp;selected%5B%5D=' . $id . '&amp;level=albums&amp;delete_checked=1&amp;id='.$_REQUEST["id"].'" onclick="return confirm(\'' . plog_tr('Are you sure you want to delete this item?') . '\');"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/x.gif" alt="' . plog_tr('Delete') . '" title="' . plog_tr('Delete') . '" /></a></td>';
+                        $output .= "\n\t\t\t".'<tr class="'.$table_row_color.'">';
+                        $output .= "\n\t\t\t\t".'<td><input type="checkbox" name="selected[]" value="'.$id.'" /></td>';
+                        $output .= "\n\t\t\t\t".'<td><a class="folder" href="'.$_SERVER['PHP_SELF'].'?level=pictures&amp;id='.$id.'"><span id="album-name-'.plogger_get_album_id().'"><strong>'.plogger_get_album_name().'</strong></span></a> &#8212; ' . sprintf(plog_tr('contains %d picture(s)'), plogger_album_picture_count()) . '</td>';
+                        $output .= "\n\t\t\t\t".'<td><p id="album-description-'.plogger_get_album_id().'">'.plogger_get_album_description().'&nbsp;</p></td>';
+                        $output .= "\n\t\t\t\t".'<td><a href="'.$_SERVER['PHP_SELF'].'?action=edit-album&amp;id='.$id.'"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/edit.gif" alt="' . plog_tr('Edit') . '" title="' . plog_tr('Edit') . '" /></a>';
+                        $output .= '<a href="'.$_SERVER['PHP_SELF'].'?action=move-delete&amp;selected%5B%5D='.$id.'&amp;level=albums&amp;delete_checked=1&amp;id='.$_REQUEST['id'];
+                        if (isset($_GET['plog_page'])) { $output .= '&amp;plog_page='.intval($_GET['plog_page']); }
+                        $output .= '" onclick="return confirm(\'' . plog_tr('Are you sure you want to delete this item?') . '\');"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/x.gif" alt="' . plog_tr('Delete') . '" title="' . plog_tr('Delete') . '" /></a></td>';
                         $output .= "\n\t\t\t</tr>";
 
-                };
-                $output .= "\n\t\t\t" . '<tr class="footer">
+                }
+                $output .= "\n\t\t\t".'<tr class="footer">
                                 <td colspan="7"></td>
                         </tr>
-                </table>' . "\n";
+                </table>'."\n";
         } else {
                 $output .= "\n\n\t\t<p class=\"actions\">" . plog_tr("There are no albums in this collection yet, why don't you create one?") . "</p>\n";
-        };
+        }
         return $output;
 
@@ -1488 +1535 @@
                         $output .= "\n\t\t\t<tr class=\"$table_row_color\">";
                         $output .= "\n\t\t\t\t<td><input type='checkbox' name='selected[]' value='" . $id . "' /></td>";
-                        $output .= "\n\t\t\t\t<td><a class='folder' href='?level=albums&amp;id=" .$id . "'><span id='collection-name-" . plogger_get_collection_id() . "'><strong>" . plogger_get_collection_name() . "</strong></span></a> &#8212; " . sprintf(plog_tr('contains %d albums'),plogger_collection_album_count()) . "</td>";
-                        $output .= "\n\t\t\t\t<td><p id='collection-description-" . plogger_get_collection_id() . "'>" . plogger_get_collection_description() . "&nbsp;</p></td>";
+                        $output .= "\n\t\t\t\t<td><a class='folder' href='?level=albums&amp;id=" .$id . "'><span id='collection-name-" . plogger_get_collection_id()."'><strong>".plogger_get_collection_name()."</strong></span></a> &#8212; " . sprintf(plog_tr('contains %d albums'), plogger_collection_album_count()) . "</td>";
+                        $output .= "\n\t\t\t\t<td><p id='collection-description-" . plogger_get_collection_id() . "'>" . plogger_get_collection_description()."&nbsp;</p></td>";
                         $output .= "\n\t\t\t\t" . '<td><a href="?action=edit-collection&amp;id=' . $id . '"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/edit.gif" alt="' . plog_tr('Edit') . '" title="' . plog_tr('Edit') . '" /></a>';
-                        $output .= '<a href="?action=1&amp;selected%5B%5D=' . $id . '&amp;level=collections&amp;delete_checked=1&amp;id='.@$_REQUEST["id"].'" onclick="return confirm(\'' . plog_tr('Are you sure you want to delete this item?') . '\');"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/x.gif" alt="' . plog_tr('Delete') . '" title="' . plog_tr('Delete') . '" /></a></td>';
+                        $output .= '<a href="?action=move-delete&amp;selected%5B%5D=' . $id . '&amp;level=collections&amp;delete_checked=1&amp;';
+                        if (isset($_REQUEST['id'])) { $output .= 'id='.intval($_REQUEST['id']); }
+                        if (isset($_GET['plog_page'])) { $output .= '&amp;plog_page=' . intval($_GET['plog_page']); }
+                        $output .= '" onclick="return confirm(\'' . plog_tr('Are you sure you want to delete this item?') . '\');"><img style="display: inline;" src="'.$config['gallery_url'].'plog-admin/images/x.gif" alt="' . plog_tr('Delete') . '" title="' . plog_tr('Delete') . '" /></a></td>';
                         $output .= "\n\t\t\t</tr>";
-                };
+                }
                 $output .= "\n\t\t\t" . '<tr class="footer">
                                 <td colspan="7"></td>
@@ -1500 +1550 @@
         } else {
                 $output .= "\n\n\t\t<p class=\"actions\">" . plog_tr('There are no collections yet') . "</p>\n";
-        };
+        }
         return $output;
 }

trunk/plog-admin/plog-admin.php

@@ -22 +22 @@
 }
 
-if (!isset($_SESSION["plogger_logged_in"])){ 
+if (!isset($_SESSION['plogger_logged_in']) || $_SESSION['plogger_logged_in'] !== true){ 
         header("Location: index.php");
         exit;
@@ -63 +63 @@
         <script type="text/javascript" src="'.$config['gallery_url'].'plog-admin/js/plogger.js"></script>
         <script type="text/javascript" src="'.$config['gallery_url'].'plog-admin/js/lightbox.js"></script>
-        <script type="text/javascript" src="'.$config['gallery_url'].'plog-admin/js/AmiJS.js"></script>
-        <script type="text/javascript" src="'.$config['gallery_url'].'plog-admin/js/greybox.js"></script>
         '.$inHead.'
-        <script type="text/javascript">
-                //GreyBox configuration
-                //Use animation?
-                var GB_ANIMATION = true;
-                var GB_IMG_DIR = "'.$config['gallery_url'].'plog-admin/images/";
-                //Clicking on the transparent overlay closes the GreyBox window?
-                var GB_overlay_click_close = false;
-        </script>
 </head>
 

trunk/plog-admin/plog-feedback.php

@@ -9 +9 @@
 $inHead = '<script src="js/ajax_editing.js" type="text/javascript"></script>';
 
-function generate_pagination_view_menu() {
-
-        $java = 'document.location.href = \''.$_SERVER["PHP_SELF"].'?'.'&amp;entries_per_page=\'+this.options[this.selectedIndex].value';
-
-        $possible_values = array("5"=>5, "10"=>10, "20"=>20, "50"=>50);
-        $output = "\n\t\t\t\t\t" . '<label accesskey="e" for="entries_on_page">' .plog_tr('<em>E</em>ntries per page') . '</label>
-                                        <select class="entries-page" onchange="'.$java.'" name="entries_per_page" style="width: 60px;">';
-        foreach ($possible_values as $key => $value)
-                if ($_SESSION['entries_per_page'] == $key)
-                        $output .= "\n\t\t\t\t\t\t<option value=\"$value\" selected=\"selected\">$key</option>";
-                else
-                        $output .= "\n\t\t\t\t\t\t<option value=\"$value\">$key</option>";
-        $output.= "\n\t\t\t\t\t</select>";
-
-        return $output;
-