Preserve HTML in sitedownmessage when WYSIWYG is active

.gitignore

@@ -10,15 +10,17 @@ moduleinfo.ini
 *OLD
 UNUSED*
 HIDE*
-MANIFEST*
+#MANIFEST*
 uploads/
 #work in progress
 build.ini
 build_release.ini
+create_langdiff.ini
 create_manifest.ini
-create_manifest.ini.bak
 assets/resources/
-phar_installer/out/
+#phar_installer/out/*
 phar_installer/assets/install/uploadfiles/
 #non-en translations
-ext/
+**/lang/ext/*.php
+**/lang/**/ext/*.php
+.svn

README.md

@@ -1,2 +1,12 @@
 # CMSMS22XDev
-Development work on the CMSMS 2.2.x series
+Here be no dragons. Merely an effective, good-looking, bugfixed, extensively-tested version of [CMS Made Simple](https://www.cmsmadesimple.org) version 2.2.
+
+Suitable for PHP's 7.1 to 8.5.
+
+Formerly destined to become a CMSMS 2.2 micro-release.
+
+The one that got away. Anyone interested, put a line in the water and reel this one in.
+
+Installers are available [here](https://www.dropbox.com/scl/fo/e1v1s5n8ng4c4cxhycm8y/h?rlkey=wbp3d4v1qb7vpq7k2a8w31q03&st=6vbso91j&dl=0).
+
+To be completely clear **this is not a CMSMS release, actual or official or any other status**.

admin/addbookmark.php

@@ -1,7 +1,6 @@
 <?php
-#CMS - CMS Made Simple
-#(c)2004 by Ted Kulp (wishy@users.sf.net)
-#Visit our homepage at: http://www.cmsmadesimple.org
+#CMS Made Simple admin console script
+#(c) 2004 CMS Made Simple Foundation Inc <foundation@cmsmadesimple.org>
 #
 #This program is free software; you can redistribute it and/or modify
 #it under the terms of the GNU General Public License as published by
@@ -16,103 +15,106 @@
 #along with this program; if not, write to the Free Software
 #Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 #
-#$Id: addbookmark.php 12671 2021-12-13 03:05:01Z tomphantoo $
+#$Id$
 
-$CMS_ADMIN_PAGE=1;
+$CMS_ADMIN_PAGE = 1;
 
-require_once("../lib/include.php");
-$urlext='?'.CMS_SECURE_PARAM_NAME.'='.$_SESSION[CMS_USER_KEY];
+require_once '../lib/include.php';
+$secureparm = CMS_SECURE_PARAM_NAME.'='.$_SESSION[CMS_USER_KEY];
 
 check_login();
 
-$error = "";
+if (isset($_POST['cancel'])) {
+	redirect('listbookmarks.php?'.$secureparm);
+}
 
-$title= "";
-if (isset($_POST["title"])) $title = trim(cleanValue($_POST["title"]));
-$url = "";
-if (isset($_POST["url"])) $url = trim(cleanValue($_POST["url"]));
+$title = '';
+if (isset($_POST['title'])) {
+	$title = trim(cleanValue($_POST['title']));
+}
+elseif (isset($_GET['title'])) {
+	// adding an admin url from the bookmarks popup
+	$tmp = trim($_GET['title']); //TODO support cleanValue()
+	$title = urldecode($tmp);
+}
 
-if (isset($_POST["cancel"])) {
-	redirect("listbookmarks.php".$urlext);
-	return;
+$error = '';
+$url = '';
+if (isset($_POST['url'])) {
+	$url = trim(cleanValue($_POST['url']));
 }
+elseif (isset($_GET['ref'])) {
+	// adding an admin url
+	$tmp = trim(cleanValue($_GET['ref']));
+	$url = base64_decode($tmp, true);
+}
+if ($url) {
+	$url = html_entity_decode($url);
+	$url = urldecode($url);
+	$url = str_replace('[ROOT_URL]', CMS_ROOT_URL, $url);
+	if (strpos($url, '[SECURITYTAG]') !== false) { // deprecated
+		$url = str_replace('[SECURITYTAG]', $secureparm, $url); // allow parsing
+	}
 
-$userid = get_userid();
+	$res = cms_utils::validate_url($url, '!'.CMSMS\FileType::TYPE_EXECUTABLE);
+	if ($res !== true) {
+		$error = $res;
+		unset($_POST['addbookmark']);
+	}
 
-if (isset($_POST["addbookmark"]))
-	{
-	$validinfo = true;
+	// reinstate placeholder if any
+	$url = str_replace($secureparm, '[SECURITYTAG]', $url);
+	$config = cms_config::get_instance();
+	if (startswith($url, $config['admin_url'])) {
+		//TODO somewhere apply a permission-check akin to admin menu generation
+		if (strpos($url, '[SECURITYTAG]') === false) {
+			unset($_POST['addbookmark']);
+			$error = lang('error_badfield', lang('url')); //repetition ok
+		}
+	}
+	elseif (strpos($url, '[SECURITYTAG]') !== false) {
+		unset($_POST['addbookmark']);
+		$error = lang('error_badfield', lang('url')); //repetition ok
+	}
+} // url
 
-	if ( $title == "" )
-		{
-		$error .= lang('nofieldgiven', array(lang('title')));
+if (isset($_POST['addbookmark'])) {
+	$validinfo = true;
+	if ($title == '') {
+		$error .= lang('nofieldgiven', lang('title'));
 		$validinfo = false;
-		}
-		else if ( $url == "" )
-		{
-		$error .= lang('nofieldgiven', array(lang('url')));
+	}
+	elseif ($url == '') {
+		$error .= lang('nofieldgiven', lang('url')); // joined error string?
 		$validinfo = false;
-		}
+	}
 
-	if ($validinfo)
-		{
-		  $gCms = cmsms();
-		$gCms->GetBookmarkOperations();
+	if ($validinfo) {
 		$markobj = new Bookmark();
 		$markobj->title = $title;
-		$markobj->url = $url;
-		$markobj->user_id=$userid;
+		$markobj->url = $url; // revert any encoding removed during parsing ?
+		$markobj->user_id = get_userid();
 
 		$result = $markobj->save();
 
-		if ($result)
-			{
-			redirect("listbookmarks.php".$urlext);
-			return;
-			}
-		else
-			{
+		if ($result) {
+			redirect('listbookmarks.php?'.$secureparm);
+		}
+		else {
 			$error .= lang('errorinsertingbookmark');
-			}
 		}
 	}
+}
 
-include_once("header.php");
-
-if ($error != "")
-	{
-		echo '<div class="pageerrorcontainer"><p class="pageerror">'.$error.'</p></div>';
-	}
-?>
-
-<div class="pagecontainer">
-	<div class="pageoverflow">
-		<?php echo $themeObject->ShowHeader('addbookmark'); ?>
-		<form method="post" action="addbookmark.php<?php echo $urlext?>">
-			<div>
-				<input type="hidden" name="<?php echo CMS_SECURE_PARAM_NAME ?>" value="<?php echo $_SESSION[CMS_USER_KEY] ?>" />
-			</div>
-			<div class="pageoverflow">
-				<p class="pagetext"><?php echo lang('title')?>:</p>
-				<p class="pageinput"><input type="text" name="title" maxlength="255" value="<?php echo $title?>" /></p>
-			</div>
-			<div class="pageoverflow">
-				<p class="pagetext"><?php echo lang('url')?>:</p>
-				<p class="pageinput"><input type="text" name="url" size="50" maxlength="255" value="<?php echo $url ?>" class="standard" /></p>
-			</div>
-			<div class="pageoverflow">
-				<p class="pagetext">&nbsp;</p>
-				<p class="pageinput">
-					<input type="hidden" name="addbookmark" value="true" />
-					<input type="submit" value="<?php echo lang('submit')?>" class="pagebutton" />
-					<input type="submit" name="cancel" value="<?php echo lang('cancel')?>" class="pagebutton" />
-				</p>
-			</div>
-		</form>
-	</div>
-</div>
+require_once 'header.php';
+$themeObject->set_value('pagetitle', 'addbookmark');
 
-<?php
-include_once("footer.php");
+$tpl = $smarty->createTemplate('admin_tpl:addbookmark.tpl', null, null, $smarty, false);
+$tpl->assign('error', $error);
+$tpl->assign('securename', CMS_SECURE_PARAM_NAME); // see also $smarty-assigned var $secureparam
+$tpl->assign('secureval', $_SESSION[CMS_USER_KEY]);
+$tpl->assign('title', $title);
+$tpl->assign('url', $url);
+$tpl->display();
 
-?>
+require_once 'footer.php';

admin/addgroup.php

@@ -1,7 +1,6 @@
 <?php
-#CMS - CMS Made Simple
-#(c)2004 by Ted Kulp (wishy@users.sf.net)
-#Visit our homepage at: http://www.cmsmadesimple.org
+#CMS Made Simple admin console script
+#(c) 2004 CMS Made Simple Foundation Inc <foundation@cmsmadesimple.org>
 #
 #This program is free software; you can redistribute it and/or modify
 #it under the terms of the GNU General Public License as published by
@@ -16,106 +15,69 @@
 #along with this program; if not, write to the Free Software
 #Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 #
-#$Id: addgroup.php 12671 2021-12-13 03:05:01Z tomphantoo $
+#$Id$
 
-$CMS_ADMIN_PAGE=1;
+use CMSMS\HookManager;
 
-require_once("../lib/include.php");
-require_once("../lib/classes/class.group.inc.php");
-$urlext='?'.CMS_SECURE_PARAM_NAME.'='.$_SESSION[CMS_USER_KEY];
+$CMS_ADMIN_PAGE = 1;
 
+require_once '../lib/include.php';
 check_login();
+$urlext = '?'.CMS_SECURE_PARAM_NAME.'='.$_SESSION[CMS_USER_KEY];
 
-$error = "";
-
-$group= "";
-if (isset($_POST["group"])) $group = cleanValue($_POST["group"]);
-
-$description= "";
-if (isset($_POST["description"])) $description = cleanValue($_POST["description"]);
-
-$active = 1;
-if (!isset($_POST["active"]) && isset($_POST["addgroup"])) $active = 0;
-
-if (isset($_POST["cancel"])) {
-    redirect("listgroups.php".$urlext);
-    return;
+if (isset($_POST['cancel'])) {
+    redirect('listgroups.php'.$urlext);
 }
 
 $userid = get_userid();
 $access = check_permission($userid, 'Manage Groups');
+if (!$access) {
+    exit(lang('no_permission')); //TODO throw if can be caught
+}
 
-if ($access) {
-    if (isset($_POST["addgroup"])) {
-        try {
-            if ($group == '') throw new \CmsInvalidDataException(lang('nofieldgiven', lang('groupname')));
-
-            $groupobj = new Group();
-            $groupobj->name = $group;
-            $groupobj->description = $description;
-            $groupobj->active = $active;
+$error = '';
+$group = (isset($_POST['group'])) ? cleanValue($_POST['group']) : '';
+$description = (isset($_POST['description'])) ? cleanValue($_POST['description']) : '';
+$active = (isset($_POST['addgroup']) && empty($_POST['active'])) ? 0 : 1;
 
-            \CMSMS\HookManager::do_hook('Core::AddGroupPre', [ 'group'=>&$groupobj ] );
+if (isset($_POST['addgroup'])) {
+    try {
+        if ($group == '') throw new CmsInvalidDataException(lang('nofieldgiven', lang('groupname')));
 
-            $result = $groupobj->save();
-            if( !$result ) throw new \RuntimeException(lang('errorinsertinggroup'));
+        require_once '../lib/classes/class.Group.php'; //don't bother autoloading
+        $groupobj = new Group();
+        $groupobj->name = $group;
+        $groupobj->description = $description;
+        $groupobj->active = $active;
 
-            \CMSMS\HookManager::do_hook('Core::AddGroupPost', [ 'group'=>&$groupobj ] );
-            // put mention into the admin log
-            audit($groupobj->id, 'Admin User Group: '.$groupobj->name, 'Added');
-            redirect("listgroups.php".$urlext);
-            return;
-        }
-        catch( \Exception $e ) {
-            $error .= '<li>'.$e->GetMessage().'</li>';
-        }
-    }
-}
+        HookManager::do_hook('Core::AddGroupPre', ['group'=>$groupobj]);
 
-include_once("header.php");
+        $result = $groupobj->save();
+        if( !$result ) throw new RuntimeException(lang('errorinsertinggroup'));
 
-if (!$access) {
-    echo "<div class=\"pageerrorcontainer\"><p class=\"pageerror\">".lang('noaccessto', array(lang('addgroup')))."</p></div>";
-}
-else {
-    if ($error != "") {
-        echo "<div class=\"pageerrorcontainer\"><ul class=\"pageerror\">".$error."</ul></div>";
+        HookManager::do_hook('Core::AddGroupPost', ['group'=>$groupobj]);
+        // put mention into the admin log
+        audit($groupobj->id, 'Admin users group', "Added: $groupobj->name");
+        redirect('listgroups.php'.$urlext);
+//      return;
+    }
+    catch( Exception $e ) {
+        $error .= '<li>'.$e->GetMessage().'</li>';
     }
-?>
-
-<div class="pagecontainer">
-  <?php echo $themeObject->ShowHeader('addgroup'); ?>
-  <form method="post" action="addgroup.php">
-  <div>
-    <input type="hidden" name="<?php echo CMS_SECURE_PARAM_NAME ?>" value="<?php echo $_SESSION[CMS_USER_KEY] ?>" />
-  </div>
-     <div class="pagewarning"><?php echo lang('warn_addgroup'); ?></div>
-  <div class="pageoverflow">
-    <p class="pagetext"><label for="groupname">*<?php echo lang('name')?>:</label></p>
-    <p class="pageinput"><input type="text" id="groupname" name="group" maxlength="255" value="<?php echo $group?>" /></p>
-  </div>
-  <div class="pageoverflow">
-    <p class="pagetext"><label for="description"><?php echo lang('description')?>:</label></p>
-    <p class="pageinput"><input type="text" id="description" name="description" maxlength="255" size="80" value="<?php echo $description?>" /></p>
-  </div>
-  <div class="pageoverflow">
-    <p class="pagetext"><label for="active"><?php echo lang('active')?>:</label></p>
-    <p class="pageinput"><input class="pagecheckbox" type="checkbox" id="active" name="active" <?php echo ($active == 1?"checked=\"checked\"":"")?> /></p>
-  </div>
-  <div class="pageoverflow">
-    <p class="pagetext">&nbsp;</p>
-    <p class="pageinput">
-      <input type="hidden" name="addgroup" value="true" />
-      <input type="submit" value="<?php echo lang('submit')?>" class="pagebutton" />
-      <input type="submit" name="cancel" value="<?php echo lang('cancel')?>" class="pagebutton" />
-    </p>
-  </div>
-  </form>
-</div>
-
-<?php
 }
 
-include_once("footer.php");
-
-?>
+require_once 'header.php';
+$themeObject->set_value('pagetitle', 'addgroup');
+
+$tpl = $smarty->createTemplate('admin_tpl:addgroup.tpl', null, null, $smarty, false);
+// see also $smarty-assigned var $secureparam
+$tpl->assign('securename', CMS_SECURE_PARAM_NAME)
+ ->assign('secureval', $_SESSION[CMS_USER_KEY])
+ ->assign('access', $access)
+ ->assign('active', (bool)$active)
+ ->assign('error', $error)
+ ->assign('group', $group)
+ ->assign('description', $description);
+$tpl->display();
+
+require_once 'footer.php';