Commit Graph

279 Commits

Author SHA1 Message Date
Bharat Mediratta
2bfcec9620 Prevent brute force login attacks by reducing login attempts to 1 per
minute after there have been 5 consecutive failed login attempts.

Fix for ticket #589.
2010-01-30 19:48:57 -08:00
Bharat Mediratta
aacafaaf35 Add @todo. 2010-01-28 23:17:32 -08:00
Bharat Mediratta
3ed81869cb Cast the SafeString $task->status to (string) so that it doesn't come
down to the JS as an object.
2010-01-28 20:44:10 -08:00
Tim Almdal
cedbc82dcc Do all the html::clean|purify calls in the views and not the controller. Also clean the subject line and email message body of the contact user email. 2010-01-28 07:44:58 -08:00
Bharat Mediratta
1606961153 Merge branch 'master' of git@github.com:gallery/gallery3 into bharat_dev
Conflicts:
	modules/gallery/libraries/MY_ORM.php
2010-01-25 19:49:17 -08:00
Tim Almdal
6023f2bb46 Remove the return url and change the return button on the user profile page to use javascript to return to the previous page. 2010-01-25 08:10:28 -08:00
Tim Almdal
865995305c Add the active notifications and rest api key to user profile page. 2010-01-24 20:14:01 -08:00
Tim Almdal
26eb000637 add CSRF protection to the user profile send method. 2010-01-24 15:49:02 -08:00
Tim Almdal
7c06e21ec4 Refactor creating the user profile page content into the the event module. The show_user_profile is used to provide content to the user profile page. Add the list of the users comments to the profile page. 2010-01-24 15:27:33 -08:00
Tim Almdal
ed5b07b335 Create a user profile page that is used as a landing page when referencing a user in messages or pages.
Partial fix for ticket #889 and a fix for #931.
2010-01-23 21:38:01 -08:00
Bharat Mediratta
fecac4a859 Merge branch 'master' of git@github.com:gallery/gallery3 into bharat_dev
Conflicts:
	modules/gallery/tests/xss_data.txt
2010-01-23 16:29:10 -08:00
Tim Almdal
ece403877f If the userid/password combination, render the full page instead of just printing the form. Fixes ticket #980. 2010-01-22 18:12:30 -08:00
Tim Almdal
eabeeeb126 Trap any errors that may occur when trying to install a new identity provider and then reinstall the current one. 2010-01-22 13:38:05 -08:00
Tim Almdal
df313cac56 Change the check_environment method in the module helper and the module installers to can_activate to reflect that it is doing more than just checking the environment. 2010-01-22 12:30:17 -08:00
Tim Almdal
dabd5b84b2 Remove the identity manager screens and controller as alterntive identity providers are installed in the admin module screen. 2010-01-22 12:22:31 -08:00
Bharat Mediratta
318c86ab56 Merge branch 'master' of git@github.com:gallery/gallery3 into bharat_dev 2010-01-21 20:38:25 -08:00
Tim Almdal
d59c6ed4f1 The admin module controller allows modules to provide a check_environment method
which is called prior to installation.  The method allows the module to provide
an error message or warnings if the module can not be installed or activated
without issues.  The admin module controller also will fire a pre_deactivate
event, which allows modules to indicate issues that may arise be deactivating the
specified module.

These messages are displayed in a dialog box prior to installation in order to
allow the gallery administrator to determine the appropriate action before proceeding.

Lays the foundation for implementing a fix for ticket #937
2010-01-21 12:57:45 -08:00
Andy Staudacher
6dd92cfa1c Fix maintenance tasks / language admin for bug introduced earlier by no longer casting in ORM.
Task->done is now a string, boolean false is stored as integer 0 and loaded as string "0". On the client side that's interpreted as truthy in JavaScript.
Fix: cast "0" to (bool) before encoding to JSON.
2010-01-20 23:12:36 -08:00
Bharat Mediratta
e02675b730 Change "filename" to "name" in the edit album form. I'd rather have
consistency between field names than deal with underlying issues with
Forge bitching about the "name" property.
2010-01-19 19:31:01 -08:00
Bharat Mediratta
512910962d Change "dirname" to "name" in the edit album form. I'd rather have
consistency between field names than deal with underlying issues with
Forge bitching about the "name" property.
2010-01-19 19:24:46 -08:00
Bharat Mediratta
5c49c041e7 Use "(string) $form" instead of "$form->__toString()" 2010-01-16 22:42:02 -08:00
Bharat Mediratta
8ce11ac970 Convert Movies_Controller::update() over to model based validation. 2010-01-16 12:07:36 -08:00
Bharat Mediratta
efdb73cb98 Make movie creation use model based validation. Move movie related
logic from movie::create() into Item_Model
2010-01-16 12:00:50 -08:00
Bharat Mediratta
5a8449f16d Convert Photos_Controller::update() to use model based validation. 2010-01-16 11:12:27 -08:00
Bharat Mediratta
bf085a1a17 Convert photo uploading over to the new model based validation
approach.

- Rearrange Simple_Uploader_Controller::add_photo() to validate
  the form early in the process, and switch to using model based
  validation.

- Move thumbnail generation into gallery_event::item_created() so
  that it's decoupled from the model.

- Delete photo::create() and move all of its logic into
  Item_Model::save().

- Add Item_Model::$data_file to track the data file associated
  with new movies and photos.

- Do some cleanup on the validation callbacks -- it turns out the
  2nd argument is the field name not the value.
2010-01-16 00:51:31 -08:00
Bharat Mediratta
916da15cbb Merge branch 'master' of git@github.com:gallery/gallery3 into bharat_dev 2010-01-15 13:36:16 -08:00
Bharat Mediratta
50e3cc5837 Move model business logic out of album::create() and into
Item_Model::save().  This makes creating albums similar to editing
them and makes it difficult to create an album poorly.  I expect to be
able to remove a lot of code from the photo and movie helper because
it's duplicated here.

In order to do this, I refactored ORM_MPTT::add_to_parent() into
ORM_MPTT::save() so we now add it to the parent when we do save.  This
allows us to call save() only once which saves a database call per
add.

The Albums_Controller logic is roughly the same as before.

Haven't updated the tests yet, they're going to fail miserably since
many of them depend on album::create() which is now gone.
2010-01-15 12:15:20 -08:00
Bharat Mediratta
5809949ae8 Don't use Input directly to get album names, etc. Use the form fields. 2010-01-15 11:28:05 -08:00
Bharat Mediratta
b3e328c9ff Begin the process of converting to model based validation. Right
now only Albums_Controller::update() supports the pattern.  All
form and controller based validation happening when editing an
album has been moved over.

Model based validation means that our REST controllers share the
same validation as web controllers.  We'll have consistency
enforced at the model level, which is a Good Thing.

The basic pattern is now:
1) Rules are in the model

2) ORM::validate() (which is called by ORM::save() but you can
   call it directly, too) checks the model for all the rules and
   throws an ORM_Validation_Exception if there are failures

3) Actions are no longer taken when you call Item_Model::__set().
   Instead, they're all queued up and executed when you call
   Item_Model::save().

Notes:
- item::validate_xxx() functions are now in Item_Model::
- We still call $form->validate() because the form can have
 rules (and forms triggered by events will likely continue to
 have rules.
2010-01-14 21:04:09 -08:00
Tim Almdal
260660b2f6 Somemore K24 migration holdovers. need to specify the where statement with operands. '=' is no longer assumed. Fixes ticket #979 2010-01-13 12:08:56 -08:00
Tim Almdal
2b283f4d01 Remove the translation submit button from translation search form. Fixes ticket #975 2010-01-11 13:26:10 -08:00
Tim Almdal
2ab6eda728 Change file proxy to url encode the path components instead of the entire path. Otherwise, we will encode the slashes and won't find the item. 2010-01-08 12:18:46 -08:00
Tim Almdal
58620c5faa Use rawurlencode to remove any encoding that the browser may have added. Fixes ticket #954. 2010-01-07 10:55:43 -08:00
Bharat Mediratta
6b8a52d328 Fix the logout link to send you back to the current url. The old
approach depended on having an $item, which is not the case on all
pages (eg: tag pages).  Also, check the CSRF in the logout controller,
else you can use the logout link as a blind forwarder.
2010-01-04 21:37:51 -08:00
Tim Almdal
cbf9754922 Send an empty Pragma header and use the item-updated time in the last-modified header 2010-01-04 09:10:12 -08:00
Bharat Mediratta
df001700dd Don't enable the rest module by default yet; we should make sure that
we do a more thorough security audit on it first.
2010-01-01 12:17:04 -08:00
Tim Almdal
c4ba5b6f65 Correct the sql so that the guest and admin passwords are actually blanked as part of the export 2010-01-01 09:54:10 -08:00
Bharat Mediratta
20bd09ff00 A more thorough fix for #745 and #940. Stop using the referer to
guess how to send the user back.  Instead, proxy the originating item
id through the edit forms so that we can tell exactly what page we
were on when we began editing.  If we were viewing the item, then
redirect to its new url (in case it changed) to fix ticket #745.  But
if we were viewing some other item, then just stay on the current page
to fix #940.

The page_type approach didn't work because you'd have the same
"collection" page_type when doing a context menu edit for an album.
2009-12-31 17:21:19 -08:00
Tim Almdal
55eeb8336f Change the file proxy to use the expires helper to manage content expiration. Fixes ticket #953. 2009-12-30 09:55:28 -08:00
Bharat Mediratta
057e8d09af Convert a bunch of leftover kohana::show_404 calls to throw
Kohana_404_Exception instead.  These are the ones where we used a
lower-case 'k' so my previous filter didn't catch it.
2009-12-23 20:51:33 -08:00
Bharat Mediratta
8b9a02084a Updates for the latest version of Kohana 2.4:
1) Controller::$input is gone -- use Input::instance() now
2) Handle new 'database.<default>.connection.params' parameter
3) Handle new 'cache.<default>.prefix' parameter
2009-12-21 21:27:43 -08:00
Bharat Mediratta
8883d1605a Convert some more database queries. 2009-12-17 21:16:37 -08:00
Bharat Mediratta
9b75b85e71 Update all database queries such that we can run "php index.php
package" and generate the same SQL as before.
2009-12-17 21:05:58 -08:00
Bharat Mediratta
c99a75b5d1 Improve the exception error message. 2009-12-17 09:16:44 -08:00
Bharat Mediratta
f431d7e12e Convert a database call. 2009-12-16 18:04:44 -08:00
Bharat Mediratta
86467363c2 Convert a database call. 2009-12-16 18:03:23 -08:00
Bharat Mediratta
9b3b9c6da6 Merge branch 'master' of git@github.com:gallery/gallery3 into bharat_dev 2009-12-16 17:58:49 -08:00
Bharat Mediratta
b4a35a8e2c Show the right edit form for movies. 2009-12-16 09:37:28 -08:00
Bharat Mediratta
4566c299c1 Convert some database calls. 2009-12-16 09:24:38 -08:00
Bharat Mediratta
064a24b897 Convert a database call. 2009-12-13 17:15:59 -08:00