diff -ruN mantisbt-1.2.4/account_prefs_inc.php mantis_patched/account_prefs_inc.php
--- mantisbt-1.2.4/account_prefs_inc.php 2010-12-15 03:26:31.000000000 +0100
+++ mantis_patched/account_prefs_inc.php 2011-02-03 15:54:46.000000000 +0100
@@ -290,6 +290,8 @@
+
+
diff -ruN mantisbt-1.2.4/avatar_file_add.php mantis_patched/avatar_file_add.php
--- mantisbt-1.2.4/avatar_file_add.php 1970-01-01 01:00:00.000000000 +0100
+++ mantis_patched/avatar_file_add.php 2011-02-03 15:54:51.000000000 +0100
@@ -0,0 +1,67 @@
+.
+
+ /**
+ * Add the image file to b used as avatar
+ *
+ * @package MantisBT
+ * @copyright Copyright (C) 2000 - 2002 Kenzaburo Ito - kenito@300baud.org
+ * @copyright Copyright (C) 2002 - 2010 MantisBT Team - mantisbt-dev@lists.sourceforge.net
+ * @link http://www.mantisbt.org
+ */
+ /**
+ * MantisBT Core API's
+ */
+ require_once( 'core.php' );
+
+ require_once( 'file_api.php' );
+
+ $f_avatar_id = gpc_get_int ( 'avatar_id', -1 );
+ $f_file = gpc_get_file( 'file' , -1 );
+
+ if ( $f_avatar_id == -1 && $f_file == -1 ) {
+ # _POST/_FILES does not seem to get populated if you exceed size limit so check if avatar_id is -1
+ trigger_error( ERROR_FILE_TOO_BIG, ERROR );
+ }
+
+ form_security_validate( 'avatar_file_add' );
+
+ if ( !file_is_uploading_enabled() ) {
+ access_denied();
+ }
+
+ access_ensure_global_level( config_get( 'upload_avatar_file_threshold' ) );
+
+ file_add( $f_avatar_id, $f_file, 'avatar' );
+
+ form_security_purge( 'avatar_file_add' );
+
+ # Determine which view page to redirect back to.
+ $t_redirect_url = 'account_prefs_page.php';
+
+ html_page_top( null, $t_redirect_url );
+
+?>
+
+
+';
+ print_bracket_link( $t_redirect_url, lang_get( 'proceed' ) );
+?>
+
+
+.
+
+ /**
+ * Delete a file from a bug and then view the bug
+ *
+ * @package MantisBT
+ * @copyright Copyright (C) 2000 - 2002 Kenzaburo Ito - kenito@300baud.org
+ * @copyright Copyright (C) 2002 - 2010 MantisBT Team - mantisbt-dev@lists.sourceforge.net
+ * @link http://www.mantisbt.org
+ */
+ /**
+ * MantisBT Core API's
+ */
+ require_once( 'core.php' );
+
+ require_once( 'file_api.php' );
+
+ /**
+ * Get array of attachments associated with the specified avatar id. The array will be
+ * sorted in terms of date added (ASC). The array will include the following fields:
+ * id, title, diskfile, filename, filesize, file_type, date_added. For now one user has
+ * only one avatar which has his avatar_id set equal to user_id.
+ * @param int p_avatar_id integer representing avatar id
+ * @return array array of results or null
+ * @access public
+ * @uses database_api.php
+ * @uses file_api.php
+ */
+ function get_avatar ( $p_avatar_id ) {
+ $c_avatar_id = db_prepare_int( $p_avatar_id );
+
+ $t_avatar_file_table = db_get_table( 'mantis_avatar_file_table' );
+
+ $query = "SELECT id, title, diskfile, filename, filesize, file_type, date_added
+ FROM $t_avatar_file_table
+ WHERE avatar_id=" . db_param() . "
+ ORDER BY date_added";
+ $db_result = db_query_bound( $query, Array( $c_avatar_id ) );
+ $num_files = db_num_rows( $db_result );
+
+ $t_result = array();
+
+ for( $i = 0;$i < $num_files;$i++ ) {
+ $t_result[] = db_fetch_array( $db_result );
+ }
+
+ return $t_result;
+ }
+
+ form_security_validate( 'avatar_file_delete' );
+
+ $f_avatar_id = gpc_get_int( 'avatar_id' );
+ $f_file_id = get_avatar ( $f_avatar_id );
+
+ access_ensure_global_level( config_get( 'update_avatar_threshold' ) );
+
+ helper_ensure_confirmed( lang_get( 'delete_attachment_sure_msg' ), lang_get( 'delete_attachment_button' ) );
+
+ file_delete( $f_file_id[0]['id'], 'avatar' );
+
+ form_security_purge( 'avatar_file_delete' );
+
+ print_header_redirect( 'account_prefs_page.php' );
diff -ruN mantisbt-1.2.4/avatar_file_upload_inc.php mantis_patched/avatar_file_upload_inc.php
--- mantisbt-1.2.4/avatar_file_upload_inc.php 1970-01-01 01:00:00.000000000 +0100
+++ mantis_patched/avatar_file_upload_inc.php 2011-02-03 15:54:51.000000000 +0100
@@ -0,0 +1,103 @@
+.
+
+ /**
+ * This include file prints out the avatar file upload form
+ * It POSTs to avatar_file_add.php
+ * @package MantisBT
+ * @copyright Copyright (C) 2000 - 2002 Kenzaburo Ito - kenito@300baud.org
+ * @copyright Copyright (C) 2002 - 2010 MantisBT Team - mantisbt-dev@lists.sourceforge.net
+ * @link http://www.mantisbt.org
+ */
+
+ require_once( 'file_api.php' );
+
+ # check if we can allow the upload... bail out if we can't
+ if ( !file_is_uploading_enabled() ) {
+ return false;
+ }
+
+ $t_max_file_size = (int)min( ini_get_number( 'upload_max_filesize' ), ini_get_number( 'post_max_size' ), config_get( 'max_file_size' ) );
+?>
+
+
+
+
+
+
+
+
';
+ $t_href = $t_avatar[3];
+ echo '
';
}
}
}
diff -ruN mantisbt-1.2.4/core/user_api.php mantis_patched/core/user_api.php
--- mantisbt-1.2.4/core/user_api.php 2010-12-15 03:26:31.000000000 +0100
+++ mantis_patched/core/user_api.php 2011-02-03 15:54:46.000000000 +0100
@@ -797,34 +797,50 @@
* @return array|bool an array( URL, width, height ) or false when the given user has no avatar
*/
function user_get_avatar( $p_user_id, $p_size = 80 ) {
- $t_email = utf8_strtolower( user_get_email( $p_user_id ) );
- if( is_blank( $t_email ) ) {
- $t_result = false;
- } else {
- $t_default_image = config_get( 'default_avatar' );
- $t_size = $p_size;
-
- $t_use_ssl = false;
- if( isset( $_SERVER['HTTPS'] ) && ( utf8_strtolower( $_SERVER['HTTPS'] ) != 'off' ) ) {
- $t_use_ssl = true;
- }
-
- if( !$t_use_ssl ) {
- $t_gravatar_domain = 'http://www.gravatar.com/';
- } else {
- $t_gravatar_domain = 'https://secure.gravatar.com/';
- }
-
- $t_avatar_url = $t_gravatar_domain . 'avatar.php?gravatar_id=' . md5( $t_email ) . '&default=' . urlencode( $t_default_image ) . '&size=' . $t_size . '&rating=G';
- $t_result = array(
- $t_avatar_url,
- $t_size,
- $t_size,
- );
- }
-
- return $t_result;
-}
+ $c_user_id = db_prepare_int ( $p_user_id );
+ $t_avatar_table = db_get_table ( 'mantis_avatar_file_table' );
+ $query = "SELECT id
+ FROM $t_avatar_table
+ WHERE avatar_id='$c_user_id'";
+ $t_db_result = db_query ( $query );
+ if ( 1 == db_num_rows( $t_db_result )) {
+ $t_found_local_avatar = true;
+ $t_avatar_id = db_result ( $t_db_result );
+ $t_avatar_url = "file_download.php?type=avatar&file_id=".$t_avatar_id."&show_inline=1".form_security_param( 'file_show_inline' );
+ $t_avatar_ref = "manage_user_edit_page.php?user_id=".$p_user_id;
+ $t_size = $p_size;
+ $t_result = array( $t_avatar_url, $t_size, $t_size, $t_avatar_ref );
+ } else {
+ $t_email = utf8_strtolower( user_get_email( $p_user_id ) );
+ if( is_blank( $t_email ) ) {
+ $t_result = false;
+ } else {
+ $t_default_image = config_get( 'default_avatar' );
+ $t_size = $p_size;
+
+ $t_use_ssl = false;
+ if( isset( $_SERVER['HTTPS'] ) && ( utf8_strtolower( $_SERVER['HTTPS'] ) != 'off' ) ) {
+ $t_use_ssl = true;
+ }
+
+ if( !$t_use_ssl ) {
+ $t_gravatar_domain = 'http://www.gravatar.com/';
+ } else {
+ $t_gravatar_domain = 'https://secure.gravatar.com/';
+ }
+
+ $t_avatar_url = $t_gravatar_domain . 'avatar.php?gravatar_id=' . md5( $t_email ) . '&default=' . urlencode( $t_default_image ) . '&size=' . $t_size . '&rating=G';
+ $t_result = array(
+ $t_avatar_url,
+ $t_size,
+ $t_size,
+ 'http://site.gravatar.com'
+ );
+ }
+ }
+
+ return $t_result;
+ }
# --------------------
# return the user's access level
diff -ruN mantisbt-1.2.4/file_download.php mantis_patched/file_download.php
--- mantisbt-1.2.4/file_download.php 2010-12-15 03:26:31.000000000 +0100
+++ mantis_patched/file_download.php 2011-02-03 15:54:46.000000000 +0100
@@ -55,51 +55,51 @@
$f_file_id = gpc_get_int( 'file_id' );
$f_type = gpc_get_string( 'type' );
+ // allow only tables we can handle
+ $t_allowed_tables = array ( 'bug', 'doc', 'avatar' );
+ if ( ! in_array ($f_type, $t_allowed_tables) ) {
+ access_denied();
+ }
+
+ // later on either change the table name mantis_project_file_table to
+ // mantis_doc_file_table or change the code on all places with file_download.php
+ // reference to use type='project' instead of type='doc'.
+ if ( $f_type == 'doc' ) {
+ $f_type = 'project';
+ }
+
$c_file_id = (integer)$f_file_id;
# we handle the case where the file is attached to a bug
# or attached to a project as a project doc.
$query = '';
- switch ( $f_type ) {
- case 'bug':
- $t_bug_file_table = db_get_table( 'mantis_bug_file_table' );
- $query = "SELECT *
- FROM $t_bug_file_table
- WHERE id=" . db_param();
- break;
- case 'doc':
- $t_project_file_table = db_get_table( 'mantis_project_file_table' );
- $query = "SELECT *
- FROM $t_project_file_table
- WHERE id=" . db_param();
- break;
- default:
- access_denied();
- }
+ $t_file_table = db_get_table( 'mantis_'.$f_type.'_file_table' );
+ $query = "SELECT *
+ FROM $t_file_table
+ WHERE id=" . db_param();
+
$result = db_query_bound( $query, Array( $c_file_id ) );
$row = db_fetch_array( $result );
extract( $row, EXTR_PREFIX_ALL, 'v' );
- if ( $f_type == 'bug' ) {
- $t_project_id = bug_get_field( $v_bug_id, 'project_id' );
- } else {
- $t_project_id = $v_project_id;
- }
-
# Check access rights
switch ( $f_type ) {
case 'bug':
if ( !file_can_download_bug_attachments( $v_bug_id ) ) {
access_denied();
}
+ $t_project_id = bug_get_field( $v_bug_id, 'project_id' );
break;
- case 'doc':
+ case 'project':
# Check if project documentation feature is enabled.
if ( OFF == config_get( 'enable_project_documentation' ) ) {
access_denied();
}
-
access_ensure_project_level( config_get( 'view_proj_doc_threshold' ), $v_project_id );
+ $t_project_id = $v_project_id;
+ break;
+ case 'avatar':
+ $t_project_id = $v_avatar_id;
break;
}