diff -ruN mantisbt-1.2.4/account_prefs_inc.php mantis_patched/account_prefs_inc.php --- mantisbt-1.2.4/account_prefs_inc.php 2010-12-15 03:26:31.000000000 +0100 +++ mantis_patched/account_prefs_inc.php 2011-02-03 15:54:46.000000000 +0100 @@ -290,6 +290,8 @@ + +
diff -ruN mantisbt-1.2.4/avatar_file_add.php mantis_patched/avatar_file_add.php --- mantisbt-1.2.4/avatar_file_add.php 1970-01-01 01:00:00.000000000 +0100 +++ mantis_patched/avatar_file_add.php 2011-02-03 15:54:51.000000000 +0100 @@ -0,0 +1,67 @@ +. + + /** + * Add the image file to b used as avatar + * + * @package MantisBT + * @copyright Copyright (C) 2000 - 2002 Kenzaburo Ito - kenito@300baud.org + * @copyright Copyright (C) 2002 - 2010 MantisBT Team - mantisbt-dev@lists.sourceforge.net + * @link http://www.mantisbt.org + */ + /** + * MantisBT Core API's + */ + require_once( 'core.php' ); + + require_once( 'file_api.php' ); + + $f_avatar_id = gpc_get_int ( 'avatar_id', -1 ); + $f_file = gpc_get_file( 'file' , -1 ); + + if ( $f_avatar_id == -1 && $f_file == -1 ) { + # _POST/_FILES does not seem to get populated if you exceed size limit so check if avatar_id is -1 + trigger_error( ERROR_FILE_TOO_BIG, ERROR ); + } + + form_security_validate( 'avatar_file_add' ); + + if ( !file_is_uploading_enabled() ) { + access_denied(); + } + + access_ensure_global_level( config_get( 'upload_avatar_file_threshold' ) ); + + file_add( $f_avatar_id, $f_file, 'avatar' ); + + form_security_purge( 'avatar_file_add' ); + + # Determine which view page to redirect back to. + $t_redirect_url = 'account_prefs_page.php'; + + html_page_top( null, $t_redirect_url ); + +?> +
+
+'; + print_bracket_link( $t_redirect_url, lang_get( 'proceed' ) ); +?> +
+ +. + + /** + * Delete a file from a bug and then view the bug + * + * @package MantisBT + * @copyright Copyright (C) 2000 - 2002 Kenzaburo Ito - kenito@300baud.org + * @copyright Copyright (C) 2002 - 2010 MantisBT Team - mantisbt-dev@lists.sourceforge.net + * @link http://www.mantisbt.org + */ + /** + * MantisBT Core API's + */ + require_once( 'core.php' ); + + require_once( 'file_api.php' ); + + /** + * Get array of attachments associated with the specified avatar id. The array will be + * sorted in terms of date added (ASC). The array will include the following fields: + * id, title, diskfile, filename, filesize, file_type, date_added. For now one user has + * only one avatar which has his avatar_id set equal to user_id. + * @param int p_avatar_id integer representing avatar id + * @return array array of results or null + * @access public + * @uses database_api.php + * @uses file_api.php + */ + function get_avatar ( $p_avatar_id ) { + $c_avatar_id = db_prepare_int( $p_avatar_id ); + + $t_avatar_file_table = db_get_table( 'mantis_avatar_file_table' ); + + $query = "SELECT id, title, diskfile, filename, filesize, file_type, date_added + FROM $t_avatar_file_table + WHERE avatar_id=" . db_param() . " + ORDER BY date_added"; + $db_result = db_query_bound( $query, Array( $c_avatar_id ) ); + $num_files = db_num_rows( $db_result ); + + $t_result = array(); + + for( $i = 0;$i < $num_files;$i++ ) { + $t_result[] = db_fetch_array( $db_result ); + } + + return $t_result; + } + + form_security_validate( 'avatar_file_delete' ); + + $f_avatar_id = gpc_get_int( 'avatar_id' ); + $f_file_id = get_avatar ( $f_avatar_id ); + + access_ensure_global_level( config_get( 'update_avatar_threshold' ) ); + + helper_ensure_confirmed( lang_get( 'delete_attachment_sure_msg' ), lang_get( 'delete_attachment_button' ) ); + + file_delete( $f_file_id[0]['id'], 'avatar' ); + + form_security_purge( 'avatar_file_delete' ); + + print_header_redirect( 'account_prefs_page.php' ); diff -ruN mantisbt-1.2.4/avatar_file_upload_inc.php mantis_patched/avatar_file_upload_inc.php --- mantisbt-1.2.4/avatar_file_upload_inc.php 1970-01-01 01:00:00.000000000 +0100 +++ mantis_patched/avatar_file_upload_inc.php 2011-02-03 15:54:51.000000000 +0100 @@ -0,0 +1,103 @@ +. + + /** + * This include file prints out the avatar file upload form + * It POSTs to avatar_file_add.php + * @package MantisBT + * @copyright Copyright (C) 2000 - 2002 Kenzaburo Ito - kenito@300baud.org + * @copyright Copyright (C) 2002 - 2010 MantisBT Team - mantisbt-dev@lists.sourceforge.net + * @link http://www.mantisbt.org + */ + + require_once( 'file_api.php' ); + + # check if we can allow the upload... bail out if we can't + if ( !file_is_uploading_enabled() ) { + return false; + } + + $t_max_file_size = (int)min( ini_get_number( 'upload_max_filesize' ), ini_get_number( 'post_max_size' ), config_get( 'max_file_size' ) ); +?> +
+ + +
+ + + + + + + + + + + + + + + +
+ +
+ + + + + + + +
+ + + +
+
+
+ (' . lang_get( 'max_file_size' ) . ': ' . number_format( $t_max_file_size/1000 ) . 'k)'?> +
+ + + + +
+
+ + + + + +
+ +
+ +User avatar'; + $t_href = $t_avatar[3]; + echo 'User avatar'; } } } diff -ruN mantisbt-1.2.4/core/user_api.php mantis_patched/core/user_api.php --- mantisbt-1.2.4/core/user_api.php 2010-12-15 03:26:31.000000000 +0100 +++ mantis_patched/core/user_api.php 2011-02-03 15:54:46.000000000 +0100 @@ -797,34 +797,50 @@ * @return array|bool an array( URL, width, height ) or false when the given user has no avatar */ function user_get_avatar( $p_user_id, $p_size = 80 ) { - $t_email = utf8_strtolower( user_get_email( $p_user_id ) ); - if( is_blank( $t_email ) ) { - $t_result = false; - } else { - $t_default_image = config_get( 'default_avatar' ); - $t_size = $p_size; - - $t_use_ssl = false; - if( isset( $_SERVER['HTTPS'] ) && ( utf8_strtolower( $_SERVER['HTTPS'] ) != 'off' ) ) { - $t_use_ssl = true; - } - - if( !$t_use_ssl ) { - $t_gravatar_domain = 'http://www.gravatar.com/'; - } else { - $t_gravatar_domain = 'https://secure.gravatar.com/'; - } - - $t_avatar_url = $t_gravatar_domain . 'avatar.php?gravatar_id=' . md5( $t_email ) . '&default=' . urlencode( $t_default_image ) . '&size=' . $t_size . '&rating=G'; - $t_result = array( - $t_avatar_url, - $t_size, - $t_size, - ); - } - - return $t_result; -} + $c_user_id = db_prepare_int ( $p_user_id ); + $t_avatar_table = db_get_table ( 'mantis_avatar_file_table' ); + $query = "SELECT id + FROM $t_avatar_table + WHERE avatar_id='$c_user_id'"; + $t_db_result = db_query ( $query ); + if ( 1 == db_num_rows( $t_db_result )) { + $t_found_local_avatar = true; + $t_avatar_id = db_result ( $t_db_result ); + $t_avatar_url = "file_download.php?type=avatar&file_id=".$t_avatar_id."&show_inline=1".form_security_param( 'file_show_inline' ); + $t_avatar_ref = "manage_user_edit_page.php?user_id=".$p_user_id; + $t_size = $p_size; + $t_result = array( $t_avatar_url, $t_size, $t_size, $t_avatar_ref ); + } else { + $t_email = utf8_strtolower( user_get_email( $p_user_id ) ); + if( is_blank( $t_email ) ) { + $t_result = false; + } else { + $t_default_image = config_get( 'default_avatar' ); + $t_size = $p_size; + + $t_use_ssl = false; + if( isset( $_SERVER['HTTPS'] ) && ( utf8_strtolower( $_SERVER['HTTPS'] ) != 'off' ) ) { + $t_use_ssl = true; + } + + if( !$t_use_ssl ) { + $t_gravatar_domain = 'http://www.gravatar.com/'; + } else { + $t_gravatar_domain = 'https://secure.gravatar.com/'; + } + + $t_avatar_url = $t_gravatar_domain . 'avatar.php?gravatar_id=' . md5( $t_email ) . '&default=' . urlencode( $t_default_image ) . '&size=' . $t_size . '&rating=G'; + $t_result = array( + $t_avatar_url, + $t_size, + $t_size, + 'http://site.gravatar.com' + ); + } + } + + return $t_result; + } # -------------------- # return the user's access level diff -ruN mantisbt-1.2.4/file_download.php mantis_patched/file_download.php --- mantisbt-1.2.4/file_download.php 2010-12-15 03:26:31.000000000 +0100 +++ mantis_patched/file_download.php 2011-02-03 15:54:46.000000000 +0100 @@ -55,51 +55,51 @@ $f_file_id = gpc_get_int( 'file_id' ); $f_type = gpc_get_string( 'type' ); + // allow only tables we can handle + $t_allowed_tables = array ( 'bug', 'doc', 'avatar' ); + if ( ! in_array ($f_type, $t_allowed_tables) ) { + access_denied(); + } + + // later on either change the table name mantis_project_file_table to + // mantis_doc_file_table or change the code on all places with file_download.php + // reference to use type='project' instead of type='doc'. + if ( $f_type == 'doc' ) { + $f_type = 'project'; + } + $c_file_id = (integer)$f_file_id; # we handle the case where the file is attached to a bug # or attached to a project as a project doc. $query = ''; - switch ( $f_type ) { - case 'bug': - $t_bug_file_table = db_get_table( 'mantis_bug_file_table' ); - $query = "SELECT * - FROM $t_bug_file_table - WHERE id=" . db_param(); - break; - case 'doc': - $t_project_file_table = db_get_table( 'mantis_project_file_table' ); - $query = "SELECT * - FROM $t_project_file_table - WHERE id=" . db_param(); - break; - default: - access_denied(); - } + $t_file_table = db_get_table( 'mantis_'.$f_type.'_file_table' ); + $query = "SELECT * + FROM $t_file_table + WHERE id=" . db_param(); + $result = db_query_bound( $query, Array( $c_file_id ) ); $row = db_fetch_array( $result ); extract( $row, EXTR_PREFIX_ALL, 'v' ); - if ( $f_type == 'bug' ) { - $t_project_id = bug_get_field( $v_bug_id, 'project_id' ); - } else { - $t_project_id = $v_project_id; - } - # Check access rights switch ( $f_type ) { case 'bug': if ( !file_can_download_bug_attachments( $v_bug_id ) ) { access_denied(); } + $t_project_id = bug_get_field( $v_bug_id, 'project_id' ); break; - case 'doc': + case 'project': # Check if project documentation feature is enabled. if ( OFF == config_get( 'enable_project_documentation' ) ) { access_denied(); } - access_ensure_project_level( config_get( 'view_proj_doc_threshold' ), $v_project_id ); + $t_project_id = $v_project_id; + break; + case 'avatar': + $t_project_id = $v_avatar_id; break; }