Commit Graph

460 Commits

Author SHA1 Message Date
ckieffer
f1076590f1 Add page_title to admin views. Closes #1038. 2010-04-30 00:08:37 -06:00
Bharat Mediratta
6d81feacae Change the key for invalid passwords from "invalid" to
"invalid_password" to remove ambiguity.
2010-04-17 12:28:46 -07:00
Bharat Mediratta
ca45341361 Trigger the album_add_form_completed event after creating a new album. 2010-04-17 12:10:01 -07:00
Bharat Mediratta
c3c2b45280 Update the copyright to 2010. It's only 3 months into the year :-) 2010-03-03 10:15:34 -08:00
Andy Staudacher
a19b97f8d6 First step towards fixing ticket #1038: Allowing for custom page <title> in admin pages, just like in non-admin pages.
TODO: Set $view->page_title in the many admin controllers we have. I just set it for admin_maintenance.php to show how it's intended to be used. I copied the title from views/admin_maintenance.html.php to the controller.
2010-02-28 13:35:58 -08:00
Andy Staudacher
dacb58ceed Additional fixes for plural handling when deleting translations / marking them as untranslated. 2010-02-27 20:06:37 -08:00
Andy Staudacher
48193371e4 Incremental fix for ticket #1042: Delete translation from outgoing_translations when the user submits a form with an empty translation. 2010-02-27 18:54:36 -08:00
Andy Staudacher
6ce0132842 Fix for ticket #1027: Add index on cache key column.
(and fix the packager to truncate the cache table before packaging)
2010-02-22 00:30:54 -08:00
Andy Staudacher
334cd2368d Performance improvement: Load all translations of a locale as one serialized array from the Cache.
Until now, we loaded hundreds of translation messages row by row, and unserializing one by one at bootstrap time. That amounted to a significant percentage of the complete request time. This approach is more than 10x faster.
2010-02-21 23:50:01 -08:00
Andy Staudacher
8e7eda9cc6 Fix progress bar / maintenance tasks for locales that use comma as decimal separator, such as German. 2010-02-21 23:23:48 -08:00
Bharat Mediratta
d388e4bb86 Refactor away the "display_all" construct in User_Profile_Controller.
"display_all" is too coarse, and we should be letting event handlers
make the appropriate decision on what to display and when.  This
duplicates some code, but it's now very clear in the event handlers
what's getting shown.

Throw a 404 if we try to view the user profile for a missing user.

The only feature change in this should be that we now display the
name, full name and website for a user to any other registered user,
which makes sense since these are typically public fields.

Don't show any of the edit buttons unless identity::is_writable()
2010-02-19 11:40:49 -08:00
Andy Staudacher
4091219425 Fix for ticket #491: Make user and group names translatable.
Also fixed a UI bug: No longer showing the edit user buttons to admins in the profile view (to be consistent with the requirements in the controller).
2010-02-14 19:26:34 -08:00
Andy Staudacher
0f66db51ef Change JavaScript reauthentication check to check via XHR.
Benefit: Getting the real deadline this way, not interfering with an ongoing maintenance task.
2010-02-14 07:15:59 -08:00
Andy Staudacher
8412aeb133 For consistency, use straight Kohana_404_Exception instead of the event system. 2010-02-14 07:15:57 -08:00
Andy Staudacher
d53f6d0e05 Fix for tickets 1009 and 603: Show a themed error page to guests / registered users (not to admins though). And show a login form to guests for 404 (incl. insufficient view permissions) errors. 2010-02-12 16:40:44 -08:00
Andy Staudacher
6353a7c2de Security: Fix leaking of album / photo names. Reject previous fix for ticket 1009.
Side effect: Renaming auth::required_login() to login_page().
2010-02-11 14:28:32 -08:00
Tim Almdal
8ef08d2088 Refactor the code to display the login page if the user does not have view
permission into the common auth::require_login() method.
2010-02-10 08:53:39 -08:00
Tim Almdal
17f0a1b10f If the user does not have permission to view the album, photo or movie, redirect
to a logon page to allow the user to login.  Pass the target url as a session
variable to allow the user to be redirected where they want to go if the login
was successful.  Fixes ticket #1009.
2010-02-10 08:45:14 -08:00
Tim Almdal
f6c615c379 Use the helper ulr:current instead of manually creating the continue url. 2010-02-10 08:32:30 -08:00
Andy Staudacher
f9d00aa742 Fix for ticket 1008: Redirect to destination after re-auth. 2010-02-08 00:30:36 -08:00
Tim Almdal
b8047db539 Revert "Add the scheduler component to the admin maintenance screen."
This reverts commit 48cb5021c6.
2010-02-07 21:40:34 -08:00
Tim Almdal
316b0583b3 Revert "Refactor the admin maintenance screen so that events are used to
populate the action buttons and other content such as the list of scheduled
tasks."

Leaving this api out of RC1.

This reverts commit 19fee6b5e4.

Conflicts:

	modules/gallery/views/admin_maintenance.html.php
2010-02-07 21:38:51 -08:00
Andy Staudacher
f93528ffab Last partial fix for ticket 585: Compartmentalize the admin area and require active authentication every 20 minutes to access the admin area.
Also renaming auth::validate_too_many_failed_password_changes to validate_too_many_failed_auth_attempts since it's used in this generalized way in 3 places now.
2010-02-07 15:37:32 -08:00
Bharat Mediratta
eda6e3af06 Rename user_authenticate_xxx events to user_auth_xxx for brevity. 2010-02-07 08:49:37 -08:00
Bharat Mediratta
aff5d1cef4 Create the concept of a "failed authentication" as semantically
separate from a successful or failed login.

1) Rename user_login_failed event to user_authenticate_failed

2) Rename failed_logins table to failed_auth (bump Gallery module to
   v27 to rename the table)

3) auth::too_many_failed_logins -> auth::too_many_failures

4) auth::record_failed_auth_attempts -> auth::record_failed_attempts
   auth::clear_failed_auth_attempts  -> auth::clear_failed_attempts
2010-02-07 08:45:10 -08:00
Tim Almdal
19fee6b5e4 Refactor the admin maintenance screen so that events are used to pupluate the action buttons and other content such as the list of scheduled tasks. 2010-02-02 14:34:50 -08:00
Tim Almdal
5ded9e8ac5 Refactor starting a task into the task helper so we can call it multiple times. 2010-02-01 16:31:24 -08:00
Tim Almdal
48cb5021c6 Add the scheduler component to the admin maintenance screen. 2010-02-01 16:28:52 -08:00
Bharat Mediratta
c050acf30a Fix lots of warnings that pop up when we're in E_STRICT mode. They're
mostly issues around uninitialized variables, calling non-static
functions in a static context, calling Session functions directly
instead of on its singleton, passing non-variables by reference, and
subclasses not using the same interface as the parent class.
2010-01-31 16:07:41 -08:00
Bharat Mediratta
c6676dd455 Remove obsolete call to _force_block_adder() which has been broken for over a year. 2010-01-31 15:23:37 -08:00
Bharat Mediratta
cb92e58d40 Update install.sql -- gallery version jumps from 23 to 25 due to a mistake
in the version 24 upgrade code.

Update packager to serialize files so that we can serialize the new
.htaccess files

Update init_var.php to include the newly serialized .htaccess files.

Fixes ticket #587.
2010-01-30 21:16:47 -08:00
Bharat Mediratta
2bfcec9620 Prevent brute force login attacks by reducing login attempts to 1 per
minute after there have been 5 consecutive failed login attempts.

Fix for ticket #589.
2010-01-30 19:48:57 -08:00
Bharat Mediratta
aacafaaf35 Add @todo. 2010-01-28 23:17:32 -08:00
Bharat Mediratta
3ed81869cb Cast the SafeString $task->status to (string) so that it doesn't come
down to the JS as an object.
2010-01-28 20:44:10 -08:00
Tim Almdal
cedbc82dcc Do all the html::clean|purify calls in the views and not the controller. Also clean the subject line and email message body of the contact user email. 2010-01-28 07:44:58 -08:00
Bharat Mediratta
1606961153 Merge branch 'master' of git@github.com:gallery/gallery3 into bharat_dev
Conflicts:
	modules/gallery/libraries/MY_ORM.php
2010-01-25 19:49:17 -08:00
Tim Almdal
6023f2bb46 Remove the return url and change the return button on the user profile page to use javascript to return to the previous page. 2010-01-25 08:10:28 -08:00
Tim Almdal
865995305c Add the active notifications and rest api key to user profile page. 2010-01-24 20:14:01 -08:00
Tim Almdal
26eb000637 add CSRF protection to the user profile send method. 2010-01-24 15:49:02 -08:00
Tim Almdal
7c06e21ec4 Refactor creating the user profile page content into the the event module. The show_user_profile is used to provide content to the user profile page. Add the list of the users comments to the profile page. 2010-01-24 15:27:33 -08:00
Tim Almdal
ed5b07b335 Create a user profile page that is used as a landing page when referencing a user in messages or pages.
Partial fix for ticket #889 and a fix for #931.
2010-01-23 21:38:01 -08:00
Bharat Mediratta
fecac4a859 Merge branch 'master' of git@github.com:gallery/gallery3 into bharat_dev
Conflicts:
	modules/gallery/tests/xss_data.txt
2010-01-23 16:29:10 -08:00
Tim Almdal
ece403877f If the userid/password combination, render the full page instead of just printing the form. Fixes ticket #980. 2010-01-22 18:12:30 -08:00
Tim Almdal
eabeeeb126 Trap any errors that may occur when trying to install a new identity provider and then reinstall the current one. 2010-01-22 13:38:05 -08:00
Tim Almdal
df313cac56 Change the check_environment method in the module helper and the module installers to can_activate to reflect that it is doing more than just checking the environment. 2010-01-22 12:30:17 -08:00
Tim Almdal
dabd5b84b2 Remove the identity manager screens and controller as alterntive identity providers are installed in the admin module screen. 2010-01-22 12:22:31 -08:00
Bharat Mediratta
318c86ab56 Merge branch 'master' of git@github.com:gallery/gallery3 into bharat_dev 2010-01-21 20:38:25 -08:00
Tim Almdal
d59c6ed4f1 The admin module controller allows modules to provide a check_environment method
which is called prior to installation.  The method allows the module to provide
an error message or warnings if the module can not be installed or activated
without issues.  The admin module controller also will fire a pre_deactivate
event, which allows modules to indicate issues that may arise be deactivating the
specified module.

These messages are displayed in a dialog box prior to installation in order to
allow the gallery administrator to determine the appropriate action before proceeding.

Lays the foundation for implementing a fix for ticket #937
2010-01-21 12:57:45 -08:00
Andy Staudacher
6dd92cfa1c Fix maintenance tasks / language admin for bug introduced earlier by no longer casting in ORM.
Task->done is now a string, boolean false is stored as integer 0 and loaded as string "0". On the client side that's interpreted as truthy in JavaScript.
Fix: cast "0" to (bool) before encoding to JSON.
2010-01-20 23:12:36 -08:00
Bharat Mediratta
e02675b730 Change "filename" to "name" in the edit album form. I'd rather have
consistency between field names than deal with underlying issues with
Forge bitching about the "name" property.
2010-01-19 19:31:01 -08:00