? Copy of audio.install_to_core
? Copy of views_audio.inc
? ____audio_images.module
? audio.install______
? audio.module_____________
? getid3
? players/Thumbs.db
Index: audio.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/audio/audio.module,v
retrieving revision 1.129
diff -u -p -u -p -r1.129 audio.module
--- audio.module	9 Oct 2007 19:05:03 -0000	1.129
+++ audio.module	26 Oct 2007 17:14:00 -0000
@@ -394,7 +394,7 @@ function audio_validate(&$node, &$form) 
 
   // Build the title from metadata. If there's not title format use the default.
   if (empty($node->title_format)) {
-    $node->title_format = variable_get('audio_default_title_format', '[audio-tag-title] by [audio-tag-artist]');
+    $node->title_format = variable_get('audio_default_title_format', '[audio-tag-title-raw] by [audio-tag-artist-raw]');
   }
   $node->title = token_replace($node->title_format, 'node', $node);
   form_set_value($form['title'], $node->title);
@@ -644,8 +644,8 @@ function audio_form(&$node) {
     $form['title']['title_format'] = array(
       '#type' => 'textfield',
       '#title' => check_plain($type->title_label),
-      '#default_value' => !empty($node->title_format) ? $node->title_format : variable_get('audio_default_title_format', '[audio-tag-title] by [audio-tag-artist]'),
-      '#description' => t("The title can use the file's metadata. You can use the tokens listed below to insert information into the title."),
+      '#default_value' => !empty($node->title_format) ? $node->title_format : variable_get('audio_default_title_format', '[audio-tag-title-raw] by [audio-tag-artist-raw]'),
+      '#description' => t("The title can use the file's metadata. You can use the tokens listed below to insert information into the title. <strong>Note:</strong> the node title is escaped so it is safe to use the -raw tokens."),
       '#required' => TRUE,
     );
     $form['title']['token_help'] = array(
@@ -943,15 +943,15 @@ function audio_admin_settings() {
     '#type' => 'textfield',
     '#title' => t('Default node title format'),
     '#maxlength' => 128,
-    '#default_value' => variable_get('audio_default_title_format', '[audio-tag-artist] - [audio-tag-title]'),
-    '#description' => t("The audio node's title can use the file's metadata as variables. This will be used as the default title for all new audio nodes. By using the tokens listed below, you can automatically create titles from things like a song's artist or title."),
+    '#default_value' => variable_get('audio_default_title_format', '[audio-tag-title-raw] by [audio-tag-artist-raw]'),
+    '#description' => t("The audio node's title can use the file's metadata as variables. This will be used as the default title for all new audio nodes. By using the tokens listed below, you can automatically create titles from things like a song's artist or title. <strong>Note:</strong> the node title is escaped so it is safe to use the -raw tokens."),
   );
   $form['audio_teaser_format'] = array(
     '#type' => 'textfield',
     '#title' => t('Node teaser format'),
     '#maxlength' => 128,
     '#default_value' => variable_get('audio_teaser_format', '[audio-player]<br />[audio-length]'),
-    '#description' => t("Use this setting to customize the teasers for audio nodes. Using the tokens listed below you can select what information about the file will be displayed."),
+    '#description' => t("Use this setting to customize the teasers for audio nodes. Using the tokens listed below you can select what information about the file will be displayed. <strong>Note: the teaser is not escaped so it is unsafe to use the -raw tokens.</strong>"),
   );
   $form['token_help'] = array(
     '#title' => t('List of available tokens'),
@@ -978,6 +978,13 @@ function audio_admin_settings() {
   return system_settings_form($form);
 }
 
+function audio_admin_settings_validate($form_id, $form_values) {
+  // Ensure they don't try to slip raw tokens in.
+  if (preg_match("/\[.*?\-raw\s*?\]/i", $form_values['audio_teaser_format'])) {
+    form_set_error('audio_teaser_format', t('Raw tokens are not allowed.'));
+  }
+}
+
 /**
  * The ID3 tag settings page.
  */
@@ -1657,7 +1664,7 @@ function audio_api_insert($filepath, $ti
   // Build the title manually (since we don't call node_validate()).
   $node->title_format = $title_format;
   if (empty($node->title_format)) {
-    $node->title_format = variable_get('audio_default_title_format', '[audio-tag-title] by [audio-tag-artist]');
+    $node->title_format = variable_get('audio_default_title_format', '[audio-tag-title-raw] by [audio-tag-artist-raw]');
   }
   $node->title = token_replace($node->title_format, 'node', $node);
 
@@ -1766,7 +1773,9 @@ function audio_token_values($type, $obje
     // Tags.
     foreach (audio_get_tags_allowed() as $tag) {
       if (isset($node->audio_tags[$tag])) {
-        $tokens['audio-tag-'. strtr($tag, '_', '-')] = check_plain($node->audio_tags[$tag]);
+        $name = strtr($tag, '_', '-');
+        $tokens['audio-tag-'. $name] = check_plain($node->audio_tags[$tag]);
+        $tokens['audio-tag-'. $name .'-raw'] = $node->audio_tags[$tag];
       }
     }
 
@@ -1808,7 +1817,9 @@ function audio_token_list($type = 'all')
   if ($type == 'node' || $type == 'all') {
     // Tags.
     foreach (audio_get_tags_allowed() as $tag) {
-      $tokens['node']['audio-tag-'. strtr($tag, '_', '-')] = t("Audio node @tag tag value.", array('@tag' => $tag));
+      $name = strtr($tag, '_', '-');
+      $tokens['node']['audio-tag-'. $name] = t("Audio node @tag tag value.", array('@tag' => $tag));
+      $tokens['node']['audio-tag-'. $name .'-raw'] = t("Audio node @tag tag value. WARNING - raw user input.", array('@tag' => $tag));
     }
 
     // Formatted file info.