GitLab

Change-Id: I080a3f5bc7f8ac193da467d6082e542bee45b396
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>

As the string is hardcoded in lang file and does NOT take any variables
it is ok to pass into form error as unescaped.

Change-Id: Ibc0b9d7ed872abb7c4ba77d3d2bb5abcde110abc
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>

In some cases the $user->urlid may not be present - this checks for it
before accessing it otherwise it falls back to the $id to get info

Change-Id: I989e68321402f458b167879e994150213c3e4893
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>

Bug 974855: It's not great that the helpfile doesn't actually contain the URL for your sitemap,
but we'd need to implement the ability to put parameters or variables into help files to make that happen.

Change-Id: I7cc414510ffe78432a4e21d61a829f67ff1d9929

Bug 996337

Change-Id: I9a6f5b94fb05511ef0497a60fb133a390f3db46e

Bug 996337: We always treat it as an integer, so it makes the most sense
to just show the user this config's integer value.

Change-Id: Ia4b198b0f642b94e36995f91a5826125bd64434e

Currently, if a site admin tries to edit an institution page and
attach a file to a block (eg image block) and they don't belong to
that institution, the process fails.

Have altered the can_publish_artefact() to allow those that can edit
institutions to be allowed to also publish.

Change-Id: I05a2160e84814add067019e4bde654a6ebd561b1
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>

in the paginator

Change-Id: I362704b27761c334be712a32f3b3e5f73c3b3b37
Signed-off-by: Son Nguyen <son.nguyen@catalyst.net.nz>

Change-Id: Ic554b94fa20f5978108b0c828c70834246c9c9c9
Signed-off-by: Son Nguyen <son.nguyen@catalyst.net.nz>

Signed-off-by: Son Nguyen <son.nguyen@catalyst.net.nz>

Signed-off-by: Son Nguyen <son.nguyen@catalyst.net.nz>

- when the importing of a too big leap2a file the form error message
was wrong

- have got it to give the 'file too big' message

Change-Id: Ied2770b057a4fd7c51cc71db98e43808139b5985
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>

Bug1234487

This reverts commit ef57a701.

Change-Id: I214f827101b6ebea2826f5ef38d0f93392ebf77d

Bug1234487

Change-Id: I56f1504bdc7d3f38abe254362d59998a84b62531

Once the members have been added and the change has been commited
to the database, logout each user who has been added.

Change-Id: I732c7fcbb5ea5913c5e3def8a7a3950c5e83e554
Signed-off-by: Nitish Bezzala <nbezzala@yahoo.com>

Bug 1236128

Folder was not staying selected when re-editing the block
due to it being not ArtefactTypeFile - have adjusted the check to
include ArtefactTypeFolder as well

Change-Id: I9b8cbe786b0d35109f05a664f04665e9a9967d92
Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>

Bug 1236636

Change-Id: I69deb64a5113806ec89145c1213f6a1d10038d78
Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>

Currently if there is html in an error message used by pieforms it
escapes the html so the link becomes not usable.

I have made a change where you can tell pieforms not to escape the
error message.

So instead of using:
$form->set_error($field, $message);

you can use:
$form->set_error($field, $message, false);

Where false means do not escape the message.

As the terms and conditions are displayed on the page already I've
updated the link to jump to the terms section

Change-Id: Ia8650a9f2284fb007cbe81a4a94223f127c4f6cd
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>

Bug 1223063: ArtefactTypeCachedProfileField was only updating
the session cache when you updated a value, not when you deleted it.
Of course, the only one that can get deleted and that is shown
anywhere is the PreferredName (aka display name) so only this
one shows the problem.

Change-Id: I55f9c96b59c91ced5cba3cf6443ba2e222201ef7
Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>

Signed-off-by: Son Nguyen <son.nguyen@catalyst.net.nz>

Signed-off-by: Son Nguyen <son.nguyen@catalyst.net.nz>

Bug1158625: If the user hasn't made their profile public, don't even show their pic and name
to logged-out users.

And in order to prevent enumeration attacks, show the same access denied screen to a
logged-out user, whether they hit the URL for an exising profile or whether they entered
an invalid URL.

Change-Id: Ic926fde3e04a59728868fffecc9272136fb83855

Change-Id: I262b2460195c663fd461964b9bd5a60efd8b297a
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>

When editing a page, check the ownership of blocks before
1. update the configuration data
2. delete/move them

Change-Id: I0eab3d99ffe908db3b7c2e852dfdaabeafce1497
Signed-off-by: Son Nguyen <son.nguyen@catalyst.net.nz>

IE only picks up the alt and not the title
tag. I added both so that users will see the
description.

Change-Id: I2f1c9342363d3372e5aa1549da7fcfc3086177b1
Signed-off-by: Kristina D.C. Hoeppner <kristina@catalyst.net.nz>

Lang string was missing for "Allowed iframe sources"

Change-Id: I1cab612134a334fac7f0ca54fcf406b4a08f3226
Signed-off-by: Kristina D.C. Hoeppner <kristina@catalyst.net.nz>

A user should not be able to view/publish an artefact if
- they don't have view/publish permission of that artefact
- they don't have view permission of all parents of that artefact

A user should not be able to edit an artefact if
- they don't have edit permission of that artefact
- they don't have edit permission of the immediate parent of that artefact
- they don't have view permission of any parents below the immediate

This is similar to the UNIX permissions, you shouldn't be able to view
a directory unless all directories below have read (r) and executeable (x)
bits set. The same for editing, you need write (w) permissions of the
immediate parent, and rx for all parents.

In Mahara, there are no executeable bits, but it can be assumed
that view is basically the same as rw for container artefacts, and the same
as r for non container artefacts.

Change-Id: I4f84aca05dd08d02b05fbe084e4724f78c8681a0
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>

Bug #1175446

Change-Id: Ide5cf394fe1c0d7ebd062bd28f4497f3c2c830d2

Bug1195269

Change-Id: Ia0652570c7fc495b34e04716a6b339956e5ff017

Bug 1215190

Change-Id: I9cc40f1a528bd92398b16df833fcaf8aaf314ff7
Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>