Commits · 4325e9e62484521a5f9509bed8e91714c12c1aab · mahara / mahara

04 Jul, 2010 9 commits
- Enable auto_escape in remaining blog & file templates · 4325e9e6
  Richard Mansfield authored May 24, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  4325e9e6
- Remove old templates · 07528841
  Richard Mansfield authored May 18, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  07528841
- Use form.tpl for new blog template · 92df6b97
  Richard Mansfield authored May 18, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  92df6b97
- Remove old templates · e7b403a5
  Richard Mansfield authored May 18, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  e7b403a5
- Turn on auto_escape, minor fixes to resume/profile blocktype templates · d7279b85
  Richard Mansfield authored May 18, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  d7279b85
- Move image block output to template · 4e73f30b
  Richard Mansfield authored May 18, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  4e73f30b
- Turn on auto_escape in more templates · 2795f939
  Richard Mansfield authored May 18, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  2795f939
- Use template for output from filedownload block · 76e5d0c7
  Richard Mansfield authored May 18, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  76e5d0c7
- Escape comment author's name in comments; turn auto_escape off in comment list · c02b19aa
  Richard Mansfield authored May 11, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  c02b19aa
01 Jul, 2010 4 commits
- Add checkbox for overall view setting to moderate comments and hide it when comments are disabled · 81c918ec
  Richard Mansfield authored Jul 01, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  81c918ec
- Fix warning in logs & use better variable name · 5bf27f6d
  Richard Mansfield authored Jul 01, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  5bf27f6d
- Add note to comment form when moderated; set moderated comments to private and... · d90afcb5
  Richard Mansfield authored Jul 01, 2010
```
Add note to comment form when moderated; set moderated comments to private and notify the view owner to moderate
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  d90afcb5
- Add function to get comment redirect url · 8aa40aa3
  Richard Mansfield authored Jul 01, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  8aa40aa3
30 Jun, 2010 3 commits
- Change string to 'Moderate' and use less space for comment checkboxes · 6894c876
  Richard Mansfield authored Jul 01, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  6894c876
- Add approvecomments property to view,artefact classes · 07340b03
  Richard Mansfield authored Jul 01, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  07340b03
- Check view access records before displaying the comment form · 8bbeef80
  Richard Mansfield authored Jun 30, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  8bbeef80
09 Jun, 2010 1 commit
- Set multipleblogs correctly for imported users · 4b8fce89
  Richard Mansfield authored Jun 09, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  4b8fce89
08 Jun, 2010 2 commits
- Make sure recentposts query has a limit for existing blocktypes · 84b1d6b7
  Richard Mansfield authored Jun 08, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  84b1d6b7
- Recent Blog Posts to limit the number of posts to be displayed (Bug #547967) · 334dbbbe
  Lorena Paoletti authored Jun 03, 2010
```
Signed-off-by: Lorena Paoletti <lorena.paoletti@gmail.com>
```
  334dbbbe
04 Jun, 2010 1 commit
- Move filetype upgrade into file plugin to avoid failure in upgrade from pre-2008101602 · f9ebcaba
  Richard Mansfield authored Jun 04, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  f9ebcaba
03 Jun, 2010 1 commit
- Show number of posts in blog listing · 50f944c3
  Richard Mansfield authored Jun 03, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  50f944c3
02 Jun, 2010 1 commit
- Fix export error due to overzealous quote escaping · b6b53d5d
  Richard Mansfield authored Jun 02, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  b6b53d5d
27 May, 2010 1 commit
- Fix lang string key in feedback notifications (bug #585613) · b9340235
  Richard Mansfield authored May 27, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  b9340235
26 May, 2010 5 commits

Remove the ability for blocktypes to inject straight SQL into a query · 2e2f34ab

Francois Marier authored May 26, 2010



This was not exploitable, but will reduce the risk that a SQL injection
will be accidentally introduced in the future.
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

2e2f34ab

Extra validation for inline parameters (e.g. intval) · a62cb836
Francois Marier authored May 25, 2010
```
Signed-off-by: Francois Marier <francois@catalyst.net.nz>
```
a62cb836
Explicit typecasts to harden these queries · 408afd36
Francois Marier authored May 25, 2010
```
Signed-off-by: Francois Marier <francois@catalyst.net.nz>
```
408afd36

Convert inline parameters to a placeholders · a8129be9

Francois Marier authored May 20, 2010



These parameters were already sanitised.
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

a8129be9

Escape some reserved words · 5295e94a

Francois Marier authored May 20, 2010

(based on http://www.petefreitag.com/tools/sql_reserved_words_checker/

)
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

5295e94a

25 May, 2010 1 commit
- Fix comment links in self search · d54195f6
  Richard Mansfield authored May 25, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  d54195f6
17 May, 2010 1 commit
- Don't throw parameter error on My Blog page when user has one non-empty blog · b8279143
  Richard Mansfield authored May 17, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  b8279143
14 May, 2010 1 commit
- Losslessly optimise all images · efe861a4
  Francois Marier authored May 14, 2010
```
Signed-off-by: Francois Marier <francois@catalyst.net.nz>
```
  efe861a4
10 May, 2010 2 commits
- Require confirmation before deleting a comment · 49d47e43
  Richard Mansfield authored May 10, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  49d47e43
- Allow html in feedback emails, shorten internal feedback notifications · d5cc8db4
  Richard Mansfield authored May 10, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  d5cc8db4
07 May, 2010 1 commit

lib/htmloutput.php: move all HTML output to a single file · 484a4f87

Francois Marier authored May 07, 2010



All HTML output (i.e. all echo/print statements going to the browser) should
now be in this file.

This is so that we can easily review all areas of Mahara where XSS bugs could
hide (other than templates and PHP pieforms).

Note that lib/errors.php echo statements can't be moved here since we want
that file to always work and can't include other code/files.
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

484a4f87

06 May, 2010 2 commits
- Fix new templates to cope with auto_escape · 4869832e
  Richard Mansfield authored May 06, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  4869832e
- Split resume into subtabs & remove contact info · 6dce0dc4
  Richard Mansfield authored May 06, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  6dce0dc4
05 May, 2010 4 commits
- Restore message on about me part of the edit profile page · 1aa745ed
  Richard Mansfield authored May 05, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  1aa745ed
- Add more useful link text for the rest of the notifications · eac65fdb
  Richard Mansfield authored May 05, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  eac65fdb
- Add link text to feedback notifications · e20e5280
  Richard Mansfield authored May 05, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  e20e5280
- Fix sql error when deleting artefacts · 7ca53aa7
  Richard Mansfield authored May 05, 2010
```
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>
```
  7ca53aa7