--- flexinode.module	13 May 2004 01:24:36 -0000	1.18
+++ flexinode.module	10 Jun 2004 21:20:24 -0000
@@ -1,6 +1,26 @@
 <?php
 // $Id: flexinode.module,v 1.18 2004/05/13 01:24:36 killes Exp $
 
+/*
+See flexinode issue list at http://drupal.org/project/issues/5737
+
+bugs fixed by mda:
+  1. A case of "flexinode/" instead of "flexinode-"
+  2. Two cases of creating bad sql by implode on empty selected fields.
+  3. flexinode_page_table not doing correct sql for default $ctype_id = 0.
+  4. stop using quotes in perms, because i end up with backslashes in the permission column, which won't match. 
+     this is because fix_gpc_magic only changes values, not keys, which are necessary for checkboxes. 
+     so magic_quotes escapes once, then db_query does again.
+  5. flexinode_page_table was not creating table columns for empty values, shifting column cells.
+  6. no error detection of a file upload error (for example exceeding size). 
+     this fix involves changes to file.inc and common.inc which are distinct patches: http://drupal.org/node/view/8430 http://drupal.org/node/view/8429
+  7. qualify saved files by nid, so users can't cause other user's files to get deleted.
+*/
+define(FLEXI_NODE_TYPE_PREFIX, 'flexinode-');
+define(FLEXI_LIKE_ALL, FLEXI_NODE_TYPE_PREFIX . '%');
+define(FLEXI_FIELD_NAME_PREFIX, 'flexinode_');
+define(FLEXI_FIELD_TYPE_THEME_PREFIX, 'flexinode_');
+
 #################### Core Hooks ####################
 
 function flexinode_help($section) {
@@ -59,11 +79,12 @@
   }
   
   foreach (flexinode_content_types() as $type => $name) {
-    if ($section == 'node/add#flexinode-' . $type) {
+    $nodetype =  _ctypeid_to_nodetype($type);
+    if ($section == 'node/add#' . $nodetype) {
       $ctype = flexinode_load_content_type($type);
       $output .= $ctype->description;
     }
-    if ($section == 'node/add/flexinode-' . $type) {
+    if ($section == 'node/add/' . $nodetype) {
       $ctype = flexinode_load_content_type($type);
       $output .= t($ctype->help);
     }
@@ -76,8 +97,8 @@
 function flexinode_perm() {
   $perms = array("administer content types");
   foreach (flexinode_content_types() as $ctype) {
-    $perms[] = "create '$ctype->name' content";
-    $perms[] = "edit own '$ctype->name' content";
+    $perms[] = _ctypename_create_perm($ctype->name);
+    $perms[] = _ctypename_edit_own_perm($ctype->name);
   }
   return $perms;
 }
@@ -88,8 +109,8 @@
   
   if ($type == "system") {
     foreach (flexinode_content_types() as $ctype) {
-      if (user_access("create '$ctype->name' content")) {
-        menu("node/add/flexinode-" . $ctype->ctype_id, t("create %type", array("%type" => t($ctype->name))), "node_page");
+      if (user_access(_ctypename_create_perm($ctype->name))) {
+        menu("node/add/" . _ctypeid_to_nodetype($ctype->ctype_id), t("create %type", array("%type" => t($ctype->name))), "node_page");
       }
     }
     if (user_access("access content")) {
@@ -106,7 +127,7 @@
     }
   }
     
-  if ($type == 'node' && strpos($node->type, 'flexinode-') === 0) {
+  if ($type == 'node' && strpos($node->type, FLEXI_NODE_TYPE_PREFIX) === 0) {
     /* Don't display a redundant edit link if they are node administrators */
     if (flexinode_access("update", $node) && !user_access('administer nodes')) {
       $links[] = l(t('edit this %nodename', array('%nodename' => flexinode_node_name($node))), "node/edit/$node->nid");
@@ -123,12 +144,8 @@
   $output = "";
   $ctype = flexinode_load_content_type($ctype_id);
   
-  if ($ctype_id) {
-    $type = "flexinode/" . check_query($ctype_id);
-  } else {
-    $type = "flexinode/%";
-  }
-  $result = pager_query("SELECT nid, type FROM {node} WHERE status = '1' AND type LIKE '$type' ORDER BY static DESC, created DESC", variable_get("default_nodes_main", 10));
+  $where = _where_ctype_id($ctype_id);
+  $result = pager_query("SELECT nid, type FROM {node} WHERE status = '1' AND $where ORDER BY static DESC, created DESC", variable_get("default_nodes_main", 10));
 
   while ($node = db_fetch_object($result)) {
     $output .= node_view(node_load(array("nid" => $node->nid, "type" => $node->type)), 1);
@@ -157,7 +174,9 @@
   print theme("page", form($output), t("search %type", array("%type" => t($ctype->name))));  
 }
 
-
+/*
+Only a single column "Title" if ctype_id = 0, because then no $ctype.
+ */
 function flexinode_page_table($ctype_id = 0) {
   $output = "";
   $ctype = flexinode_load_content_type($ctype_id);
@@ -169,15 +188,16 @@
   $where_clauses = array();
 
   foreach ($ctype->fields as $field) {
-    $fieldname = "flexinode_". $field->field_id;
-    
+    $fieldname = _fieldid_to_fieldname($field->field_id);
     $fields_to_select[] = flexinode_invoke("db_select", $field);
     $table_joins[] = "LEFT JOIN {flexinode_data} ". $fieldname ." ON n.nid = ". $fieldname .".nid";
     $where_clauses[] = $fieldname .".field_id = ". $field->field_id;
   }
 
-  $type = "flexinode/" . check_query($ctype_id);  
-  $sql = "SELECT n.title, n.nid, ". implode(", ", $fields_to_select) ." FROM {node} n ". implode(" ", $table_joins) ." WHERE n.type = '$type' AND ". implode(" AND ", $where_clauses);
+  $where = _where_ctype_id(check_query($ctype_id), 'n.type');
+  $extra_fields = count($fields_to_select) > 0 ? ', ' . implode(", ", $fields_to_select) : '';
+  $extra_where = count($where_clauses) > 0 ? ' AND ' . implode(" AND ", $where_clauses) : '';
+  $sql = "SELECT n.title, n.nid$extra_fields FROM {node} n ". implode(" ", $table_joins) ." WHERE $where$extra_where";
 
   if ($_POST['op'] == t("Search")) {
     $edit = $_POST['edit'];
@@ -192,7 +212,7 @@
       $sql .= " AND (n.title LIKE '%". $edit["search"] ."%'";
       $sql .= " OR n.body LIKE '%". $edit["search"] ."%'";
       foreach ($ctype->fields as $field) {
-        $sql .= "OR flexinode_". $field->field_id .".textual_data LIKE '%". $edit["search"] ."%'";
+        $sql .= 'OR ' . _fieldid_to_fieldname($field->field_id) .".textual_data LIKE '%". $edit["search"] ."%'";
       }
       $sql .= ")";
     }
@@ -201,7 +221,7 @@
   // build the columns  
   $header[] = array("data" => t("title"), "field" => "n.title");
   foreach ($ctype->fields as $field) {
-    $fieldname = "flexinode_". $field->field_id;
+    $fieldname = _fieldid_to_fieldname($field->field_id);
     
     $sort_column = flexinode_invoke("db_sort_column", $field);
     if ($sort_column) {
@@ -219,12 +239,12 @@
     $row = array(l($node->title, "node/view/" . $node->nid));
     foreach ($ctype->fields as $field) {
       $data = flexinode_invoke("format", $field, $node, TRUE);
-      if ($data) {
-        $row[] = $data;
-      }
+      // this is a table, we have to add a column regardless of whether $data is set
+      $row[] = $data;
     }
     $rows[] = $row;
   }
+  // print("got " . count($rows) . " from sql: " . $sql);
   
   $output .= theme("table", $header, $rows);
   $output .= theme("pager", "", 20, 0, "default", tablesort_pager());
@@ -371,15 +391,14 @@
 function flexinode_node_types() {
   $types = array();
   foreach (flexinode_content_types() as $type => $name) {
-    $types[] = "flexinode-" . $type;
+    $types[] = _ctypeid_to_nodetype($type);
   }
   return $types;
 }
 
-
 function flexinode_node_name($node) {
   $type = is_string($node) ? $node : (is_array($node) ? $node[type] : $node->type);
-  $ctype = flexinode_load_content_type(substr($type, 10));
+  $ctype = flexinode_load_content_type(_nodetype_to_ctypeid($type));
   return $ctype->name ? t($ctype->name) : t("flexible content");
 }
 
@@ -392,28 +411,28 @@
   }
 
   if ($op == "create") {
-    return user_access("create '". flexinode_node_name($node) ."' content");
+    return user_access(_ctypename_create_perm(flexinode_node_name($node)) );
   }
   
   if ($op == "update") {
-    return user_access("edit own '". flexinode_node_name($node) ."' content") && ($user->uid == $node->uid);
+    return user_access(_ctypename_edit_own_perm(flexinode_node_name($node))) && ($user->uid == $node->uid);
   }
 
   if ($op == "delete") {
-    return user_access("edit own '". flexinode_node_name($node) ."' content") && ($user->uid == $node->uid);
+    return user_access(_ctypename_edit_own_perm(flexinode_node_name($node))) && ($user->uid == $node->uid);
   }
 }
 
 
 function flexinode_load($node) {
-  $ctype = flexinode_load_content_type(substr($node->type, 10));
+  $ctype = flexinode_load_content_type(_nodetype_to_ctypeid($node->type));
   
   // build the query
   $fields_to_select = array();
   $table_joins = array();
   
   foreach ($ctype->fields as $field) {
-    $fieldname = "flexinode_". $field->field_id;
+    $fieldname = _fieldid_to_fieldname($field->field_id);
     
     $fields_to_select[] = flexinode_invoke("db_select", $field);
     $table_joins[] = "LEFT JOIN {flexinode_data} ". $fieldname ." ON n.nid = ". $fieldname .".nid AND ". $fieldname .".field_id = " . $field->field_id;
@@ -425,7 +444,7 @@
 
     // unserialize necessary fields
     foreach ($ctype->fields as $field) {
-      $fieldname = "flexinode_". $field->field_id;
+      $fieldname = _fieldid_to_fieldname($field->field_id);
       $field_data = flexinode_invoke("load", $field, $flexinode);
       if ($field_data) {
         $flexinode->$fieldname = $field_data;
@@ -475,7 +494,7 @@
   $output = "";
 
   if (!isset($node->ctype_id)) {
-    $node->ctype_id = substr($node->type, 10);
+     $node->ctype_id = _nodetype_to_ctypeid($node->type);
   }
   
   $ctype = flexinode_load_content_type($node->ctype_id);
@@ -501,7 +520,7 @@
   
   $error = array();
   foreach ($ctype->fields as $field) {
-    $fieldname = "flexinode_". $field->field_id;
+    $fieldname = _fieldid_to_fieldname($field->field_id);
     $validation = flexinode_invoke("validate", $field, $node);
     if ($validation) {
       $node->$fieldname = $validation['value'];
@@ -536,11 +555,12 @@
   $node->original_body = $node->body = check_output($node->body);
   
   foreach ($ctype->fields as $field) {
-    $fieldname = "flexinode_". $field->field_id;
+    $fieldname = _fieldid_to_fieldname($field->field_id);
     if (isset($node->$fieldname)){
       $data = flexinode_invoke("format", $field, $node, FALSE);
+      //print("flexinode_content(fieldname=$fieldname,data=$data,label=$field->label)<br>\n");
       if (!empty($data) && $data) {
-        $node->body .= theme("flexinode_". $field->field_type, $field->field_id, $field->label, $node->$fieldname, $data);
+        $node->body .= theme(_fieldtype_to_themename($field->field_type), $field->field_id, $field->label, $node->$fieldname, $data);
       }
     }
   }
@@ -608,6 +628,30 @@
 
 #################### Private Functions ####################
 
+function _nodetype_to_ctypeid($nodetype) {
+    // 'flexinode' has 9 letters
+    return substr($nodetype, 10);
+}
+
+function _ctypename_create_perm($name) {return "create $name content";}
+function _ctypename_edit_own_perm($name) {return "edit own $name content";}
+
+function _ctypeid_to_nodetype ($ctype_id) {
+    return FLEXI_NODE_TYPE_PREFIX . check_query($ctype_id);
+}
+
+function _fieldid_to_fieldname ($field_id) {
+    return FLEXI_FIELD_NAME_PREFIX . $field_id;
+}
+
+function _fieldtype_to_themename ($field_type) {
+    return FLEXI_FIELD_TYPE_THEME_PREFIX . $field_type;
+}
+
+function _where_ctype_id($ctype_id, $colname = 'type') {
+    return $ctype_id ? "$colname = '" . _ctypeid_to_nodetype($ctype_id) . "'" : "$colname LIKE '" . FLEXI_LIKE_ALL . "'";
+}
+
 function flexinode_content_types() {
   $types = array();
   $result = db_query("SELECT * FROM {flexinode_type}");
@@ -633,6 +677,7 @@
     $ctype->fields[] = $field;
   }
   
+  //if (!$ctype) {print("no ctype for ctype_id=$ctype_id<br>\n");}
   $content_types[$ctype_id] = $ctype;
   return $ctype;
 }
@@ -737,11 +782,12 @@
   // TODO: Delete files as appropriate.
   db_query("DELETE FROM {flexinode_type} WHERE ctype_id = %d", $edit["ctype_id"]);
   db_query("DELETE FROM {flexinode_field} WHERE ctype_id = %d", $edit["ctype_id"]);
-  $result = db_query("SELECT nid FROM {node} WHERE type = '%s'", 'flexinode_' . $edit["ctype_id"]);
+  $nodetype = _ctypeid_to_nodetype($edit["ctype_id"]);
+  $result = db_query("SELECT nid FROM {node} WHERE type = '%s'", $nodetype);
   while ($node = db_fetch_object($result)) {
     db_query("DELETE FROM {flexinode_data} WHERE nid = %d", $node->nid);
   }
-  db_query("DELETE FROM {node} WHERE type = '%s'", 'flexinode_' . $edit["ctype_id"]);
+  db_query("DELETE FROM {node} WHERE type = '%s'", $nodetype);
 
   drupal_set_message(t("deleted content type '%name'.", array("%name" => $edit["name"])));
 }