Merge branch '1.8' of git://github.com/Elgg/Elgg into lorea-preprod

13 files changed, 253 insertions, 92 deletions

diff --git a/engine/classes/ElggBatch.php b/engine/classes/ElggBatch.php
index 0cb13eb32..c1a77a0d9 100644
--- a/engine/classes/ElggBatch.php
+++ b/engine/classes/ElggBatch.php
@@ -16,7 +16,7 @@
  *
  * Results from the callback are stored in callbackResult. If the callback
  * returns only booleans, callbackResults will be the combined result of
- * all calls.
+ * all calls. If no entities are processed, callbackResults will be null.
  *
  * If the callback returns anything else, callbackresult will be an indexed
  * array of whatever the callback returns.  If returning error handling
diff --git a/engine/classes/ElggEntity.php b/engine/classes/ElggEntity.php
index dc38dafbe..77c2bbf4d 100644
--- a/engine/classes/ElggEntity.php
+++ b/engine/classes/ElggEntity.php
@@ -24,7 +24,6 @@
  *
  * @package    Elgg.Core
  * @subpackage DataModel.Entities
- * @link       http://docs.elgg.org/DataModel/ElggEntity
  * 
  * @property string $type           object, user, group, or site (read-only after save)
  * @property string $subtype        Further clarifies the nature of the entity (read-only after save)
@@ -201,8 +200,11 @@ abstract class ElggEntity extends ElggData implements
 	/**
 	 * Sets the value of a property.
 	 *
-	 * If $name is defined in $this->attributes that value is set, otherwise it will
-	 * set the appropriate item of metadata.
+	 * If $name is defined in $this->attributes that value is set, otherwise it is
+	 * saved as metadata.
+	 *
+	 * @warning Metadata set this way will inherit the entity's owner and access ID. If you want
+	 * to set metadata with a different owner, use create_metadata().
 	 *
 	 * @warning It is important that your class populates $this->attributes with keys
 	 * for all base attributes, anything not in their gets set as METADATA.
@@ -248,7 +250,12 @@ abstract class ElggEntity extends ElggData implements
 	public function getMetaData($name) {
 		if ((int) ($this->guid) == 0) {
 			if (isset($this->temp_metadata[$name])) {
-				return $this->temp_metadata[$name];
+				// md is returned as an array only if more than 1 entry
+				if (count($this->temp_metadata[$name]) == 1) {
+					return $this->temp_metadata[$name][0];
+				} else {
+					return $this->temp_metadata[$name];
+				}
 			} else {
 				return null;
 			}
@@ -291,80 +298,78 @@ abstract class ElggEntity extends ElggData implements
 	/**
 	 * Set a piece of metadata.
 	 *
-	 * @tip Plugin authors should use the magic methods.
+	 * Plugin authors should use the magic methods or create_metadata().
+	 *
+	 * @warning The metadata will inherit the parent entity's owner and access ID.
+	 * If you want to write metadata with a different owner, use create_metadata().
 	 *
 	 * @access private
 	 *
 	 * @param string $name       Name of the metadata
-	 * @param mixed  $value      Value of the metadata
+	 * @param mixed  $value      Value of the metadata (doesn't support assoc arrays)
 	 * @param string $value_type Types supported: integer and string. Will auto-identify if not set
 	 * @param bool   $multiple   Allow multiple values for a single name (doesn't support assoc arrays)
 	 *
 	 * @return bool
 	 */
-	public function setMetaData($name, $value, $value_type = "", $multiple = false) {
-		$delete_first = false;
-		// if multiple is set that always means don't delete.
-		// if multiple isn't set it means override. set it to true on arrays for the foreach.
-		if (!$multiple) {
-			$delete_first = true;
-			$multiple = is_array($value);
-		}
-
-		if (!$this->guid) {
-			// real metadata only returns as an array if there are multiple elements
-			if (is_array($value) && count($value) == 1) {
-				$value = $value[0];
-			}
+	public function setMetaData($name, $value, $value_type = null, $multiple = false) {
 
-			$value_is_array = is_array($value);
-
-			if (!isset($this->temp_metadata[$name]) || $delete_first) {
-				// need to remove the indexes because real metadata doesn't have them.
-				if ($value_is_array) {
-					$this->temp_metadata[$name] = array_values($value);
-				} else {
-					$this->temp_metadata[$name] = $value;
-				}
-			} else {
-				// multiple is always true at this point.
-				// if we're setting multiple and temp isn't array, it needs to be.
-				if (!is_array($this->temp_metadata[$name])) {
-					$this->temp_metadata[$name] = array($this->temp_metadata[$name]);
-				}
-
-				if ($value_is_array) {
-					$this->temp_metadata[$name] = array_merge($this->temp_metadata[$name], array_values($value));
-				} else {
-					$this->temp_metadata[$name][] = $value;
-				}
-			}
+		// normalize value to an array that we will loop over
+		// remove indexes if value already an array.
+		if (is_array($value)) {
+			$value = array_values($value);
 		} else {
-			if ($delete_first) {
+			$value = array($value);
+		}
+
+		// saved entity. persist md to db.
+		if ($this->guid) {
+			// if overwriting, delete first.
+			if (!$multiple) {
 				$options = array(
 					'guid' => $this->getGUID(),
 					'metadata_name' => $name,
 					'limit' => 0
 				);
-				// @todo this doesn't check if it exists so we can't handle failed deletes
-				// is it worth the overhead of more SQL calls to check?
-				elgg_delete_metadata($options);
-			}
-			// save into real metadata
-			if (!is_array($value)) {
-				$value = array($value);
+				// @todo in 1.9 make this return false if can't add metadata
+				// http://trac.elgg.org/ticket/4520
+				// 
+				// need to remove access restrictions right now to delete
+				// because this is the expected behavior
+				$ia = elgg_set_ignore_access(true);
+				if (false === elgg_delete_metadata($options)) {
+					return false;
+				}
+				elgg_set_ignore_access($ia);
 			}
-			foreach ($value as $v) {
-				$result = create_metadata($this->getGUID(), $name, $v, $value_type,
-					$this->getOwnerGUID(), $this->getAccessId(), $multiple);
 
-				if (!$result) {
+			// add new md
+			$result = true;
+			foreach ($value as $value_tmp) {
+				// at this point $value should be appended because it was cleared above if needed.
+				$md_id = create_metadata($this->getGUID(), $name, $value_tmp, $value_type,
+						$this->getOwnerGUID(), $this->getAccessId(), true);
+				if (!$md_id) {
 					return false;
 				}
 			}
+
+			return $result;
 		}
 
-		return true;
+		// unsaved entity. store in temp array
+		// returning single entries instead of an array of 1 element is decided in
+		// getMetaData(), just like pulling from the db.
+		else {
+			// if overwrite, delete first
+			if (!$multiple || !isset($this->temp_metadata[$name])) {
+				$this->temp_metadata[$name] = array();
+			}
+
+			// add new md
+			$this->temp_metadata[$name] = array_merge($this->temp_metadata[$name], $value);
+			return true;
+		}
 	}
 
 	/**
@@ -575,7 +580,6 @@ abstract class ElggEntity extends ElggData implements
 	 * @param mixed  $value Value of private setting
 	 *
 	 * @return bool
-	 * @link http://docs.elgg.org/DataModel/Entities/PrivateSettings
 	 */
 	function setPrivateSetting($name, $value) {
 		if ((int) $this->guid > 0) {
@@ -734,8 +738,6 @@ abstract class ElggEntity extends ElggData implements
 	 * @param string $vartype   The type of annotation value
 	 *
 	 * @return bool
-	 *
-	 * @link http://docs.elgg.org/DataModel/Annotations
 	 */
 	function annotate($name, $value, $access_id = ACCESS_PRIVATE, $owner_id = 0, $vartype = "") {
 		if ((int) $this->guid > 0) {
diff --git a/engine/classes/ElggPlugin.php b/engine/classes/ElggPlugin.php
index 33f14ae37..8c9093834 100644
--- a/engine/classes/ElggPlugin.php
+++ b/engine/classes/ElggPlugin.php
@@ -79,6 +79,68 @@ class ElggPlugin extends ElggObject {
 	}
 
 	/**
+	 * Overridden from ElggEntity and ElggObject::load(). Core always inits plugins with
+	 * a query joined to the objects_entity table, so all the info is there.
+	 *
+	 * @param mixed $guid GUID of an ElggObject or the stdClass object from entities table
+	 *
+	 * @return bool
+	 * @throws InvalidClassException
+	 */
+	protected function load($guid) {
+
+		$expected_attributes = $this->attributes;
+		unset($expected_attributes['tables_split']);
+		unset($expected_attributes['tables_loaded']);
+
+		// this was loaded with a full join
+		$needs_loaded = false;
+
+		if ($guid instanceof stdClass) {
+			$row = (array) $guid;
+			$missing_attributes = array_diff_key($expected_attributes, $row);
+			if ($missing_attributes) {
+				$needs_loaded = true;
+				$old_guid = $guid;
+				$guid = $row['guid'];
+			} else {
+				$this->attributes = $row;
+			}
+		} else {
+			$needs_loaded = true;
+		}
+
+		if ($needs_loaded) {
+			$entity = (array) get_entity_as_row($guid);
+			$object = (array) get_object_entity_as_row($guid);
+
+			if (!$entity || !$object) {
+				return false;
+			}
+			
+			$this->attributes = array_merge($this->attributes, $entity, $object);
+		}
+
+		$this->attributes['tables_loaded'] = 2;
+
+		// Check the type
+		if ($this->attributes['type'] != 'object') {
+			$msg = elgg_echo('InvalidClassException:NotValidElggStar', array($guid, get_class()));
+			throw new InvalidClassException($msg);
+		}
+
+		// guid needs to be an int  http://trac.elgg.org/ticket/4111
+		$this->attributes['guid'] = (int)$this->attributes['guid'];
+
+		// cache the entity
+		if ($this->attributes['guid']) {
+			cache_entity($this);
+		}
+
+		return true;
+	}
+
+	/**
 	 * Save the plugin object.  Make sure required values exist.
 	 *
 	 * @see ElggObject::save()
diff --git a/engine/lib/access.php b/engine/lib/access.php
index 6be252c6a..e8b3b0d52 100644
--- a/engine/lib/access.php
+++ b/engine/lib/access.php
@@ -31,7 +31,7 @@ function get_access_list($user_id = 0, $site_id = 0, $flush = false) {
 	global $CONFIG, $init_finished;
 	static $access_list;
 
-	if (!isset($access_list) || !$init_finished) {
+	if (!isset($access_list)) {
 		$access_list = array();
 	}
 
@@ -49,9 +49,16 @@ function get_access_list($user_id = 0, $site_id = 0, $flush = false) {
 		return $access_list[$user_id];
 	}
 
-	$access_list[$user_id] = "(" . implode(",", get_access_array($user_id, $site_id, $flush)) . ")";
+	$access = "(" . implode(",", get_access_array($user_id, $site_id, $flush)) . ")";
 
-	return $access_list[$user_id];
+	// only cache if done with init and access is enabled (unless admin user)
+	// session is loaded before init is finished, so don't need to check for user session
+	if ($init_finished && (elgg_is_admin_logged_in() || !elgg_get_ignore_access())) {
+		$access_list[$user_id] = $access;
+		return $access_list[$user_id];
+	} else {
+		return $access;
+	}
 }
 
 /**
@@ -83,7 +90,7 @@ function get_access_array($user_id = 0, $site_id = 0, $flush = false) {
 	// this cache might be redundant. But db cache is flushed on every db write.
 	static $access_array;
 
-	if (!isset($access_array) || (!isset($init_finished)) || (!$init_finished)) {
+	if (!isset($access_array)) {
 		$access_array = array();
 	}
 
@@ -137,12 +144,12 @@ function get_access_array($user_id = 0, $site_id = 0, $flush = false) {
 				$tmp_access_array[] = ACCESS_PRIVATE;
 			}
 
-			$access_array[$user_id] = $tmp_access_array;
-		} else {
-			// No user id logged in so we can only access public info
-			$tmp_return = $tmp_access_array;
+			// only cache if done with init and access is enabled (unless admin user)
+			// session is loaded before init is finished, so don't need to check for user session
+			if ($init_finished && (elgg_is_admin_logged_in() || !elgg_get_ignore_access())) {
+				$access_array[$user_id] = $tmp_access_array;
+			}
 		}
-
 	} else {
 		$tmp_access_array = $access_array[$user_id];
 	}
@@ -946,7 +953,8 @@ function elgg_get_access_object() {
  *
  * @global bool $init_finished
  * @access private
- * @todo investigate why this is needed
+ * @todo This is required to tell the access system to start caching because
+ * calls are made while in ignore access mode and before the user is logged in.
  */
 $init_finished = false;
 
@@ -1014,8 +1022,9 @@ function access_test($hook, $type, $value, $params) {
 	return $value;
 }
 
-// This function will let us know when 'init' has finished
-elgg_register_event_handler('init', 'system', 'access_init', 9999);
+// Tell the access functions the system has booted, plugins are loaded,
+// and the user is logged in so it can start caching
+elgg_register_event_handler('ready', 'system', 'access_init');
 
 // For overrided permissions
 elgg_register_plugin_hook_handler('permissions_check', 'all', 'elgg_override_permissions');
diff --git a/engine/lib/annotations.php b/engine/lib/annotations.php
index f32dee0f0..2036ccd61 100644
--- a/engine/lib/annotations.php
+++ b/engine/lib/annotations.php
@@ -95,8 +95,6 @@ $owner_guid = 0, $access_id = ACCESS_PRIVATE) {
 	$entity = get_entity($entity_guid);
 
 	if (elgg_trigger_event('annotate', $entity->type, $entity)) {
-		system_log($entity, 'annotate');
-
 		// If ok then add it
 		$result = insert_data("INSERT into {$CONFIG->dbprefix}annotations
 			(entity_guid, name_id, value_id, value_type, owner_guid, time_created, access_id) VALUES
@@ -222,7 +220,7 @@ function elgg_delete_annotations(array $options) {
 	}
 
 	$options['metastring_type'] = 'annotations';
-	return elgg_batch_metastring_based_objects($options, 'elgg_batch_delete_callback');
+	return elgg_batch_metastring_based_objects($options, 'elgg_batch_delete_callback', false);
 }
 
 /**
@@ -240,7 +238,7 @@ function elgg_disable_annotations(array $options) {
 	}
 
 	$options['metastring_type'] = 'annotations';
-	return elgg_batch_metastring_based_objects($options, 'elgg_batch_disable_callback');
+	return elgg_batch_metastring_based_objects($options, 'elgg_batch_disable_callback', false);
 }
 
 /**
diff --git a/engine/lib/languages.php b/engine/lib/languages.php
index bf6829a39..7a508d298 100644
--- a/engine/lib/languages.php
+++ b/engine/lib/languages.php
@@ -344,7 +344,7 @@ function get_missing_language_keys($language) {
  */
 function elgg_languages_init() {
 	$lang = get_current_language();
-	elgg_register_simplecache_view("cache/js/languages/$lang");
+	elgg_register_simplecache_view("js/languages/$lang");
 }
 
 elgg_register_event_handler('init', 'system', 'elgg_languages_init');
diff --git a/engine/lib/metadata.php b/engine/lib/metadata.php
index 34a36d86e..0ff3a43dc 100644
--- a/engine/lib/metadata.php
+++ b/engine/lib/metadata.php
@@ -297,6 +297,8 @@ function elgg_get_metadata(array $options = array()) {
  *          This requires at least one constraint: metadata_owner_guid(s),
  *          metadata_name(s), metadata_value(s), or guid(s) must be set.
  *
+ * @warning This returns null on no ops.
+ *
  * @param array $options An options array. {@see elgg_get_metadata()}
  * @return mixed Null if the metadata name is invalid. Bool on success or fail.
  * @since 1.8.0
@@ -307,8 +309,7 @@ function elgg_delete_metadata(array $options) {
 	}
 
 	$options['metastring_type'] = 'metadata';
-	$result = elgg_batch_metastring_based_objects($options, 'elgg_batch_delete_callback');
-	return $result;
+	return elgg_batch_metastring_based_objects($options, 'elgg_batch_delete_callback', false);
 }
 
 /**
@@ -316,6 +317,8 @@ function elgg_delete_metadata(array $options) {
  *
  * @warning Unlike elgg_get_metadata() this will not accept an empty options array!
  *
+ * @warning This returns null on no ops.
+ *
  * @param array $options An options array. {@See elgg_get_metadata()}
  * @return mixed
  * @since 1.8.0
@@ -326,7 +329,7 @@ function elgg_disable_metadata(array $options) {
 	}
 
 	$options['metastring_type'] = 'metadata';
-	return elgg_batch_metastring_based_objects($options, 'elgg_batch_disable_callback');
+	return elgg_batch_metastring_based_objects($options, 'elgg_batch_disable_callback', false);
 }
 
 /**
@@ -334,6 +337,8 @@ function elgg_disable_metadata(array $options) {
  *
  * @warning Unlike elgg_get_metadata() this will not accept an empty options array!
  *
+ * @warning This returns null on no ops.
+ *
  * @param array $options An options array. {@See elgg_get_metadata()}
  * @return mixed
  * @since 1.8.0
diff --git a/engine/lib/metastrings.php b/engine/lib/metastrings.php
index d7cc4e0bc..cf6dd4d98 100644
--- a/engine/lib/metastrings.php
+++ b/engine/lib/metastrings.php
@@ -716,22 +716,23 @@ function elgg_set_metastring_based_object_enabled_by_id($id, $enabled, $type) {
  * @warning Unlike elgg_get_metastring_based_objects() this will not accept an
  * empty options array!
  *
- * @param array  $options  An options array. {@See elgg_get_metastring_based_objects()}
- * @param string $callback The callback to pass each result through
- * @return mixed
+ * @warning This returns null on no ops.
+ *
+ * @param array  $options    An options array. {@See elgg_get_metastring_based_objects()}
+ * @param string $callback   The callback to pass each result through
+ * @param bool   $inc_offset Increment the offset? Pass false for callbacks that delete / disable
+ *
+ * @return bool|null true on success, false on failure, null if no objects are found.
  * @since 1.8.0
  * @access private
  */
-function elgg_batch_metastring_based_objects(array $options, $callback) {
+function elgg_batch_metastring_based_objects(array $options, $callback, $inc_offset = true) {
 	if (!$options || !is_array($options)) {
 		return false;
 	}
 
-	// @todo restore once ElggBatch supports callbacks that delete rows.
-	$batch = new ElggBatch('elgg_get_metastring_based_objects', $options, $callback, 50, false);
-	$r = $batch->callbackResult;
-
-	return $r;
+	$batch = new ElggBatch('elgg_get_metastring_based_objects', $options, $callback, 50, $inc_offset);
+	return $batch->callbackResult;
 }
 
 /**
diff --git a/engine/lib/plugins.php b/engine/lib/plugins.php
index 123fb18d8..39a76db5d 100644
--- a/engine/lib/plugins.php
+++ b/engine/lib/plugins.php
@@ -93,10 +93,13 @@ function elgg_get_plugin_ids_in_dir($dir = null) {
 function elgg_generate_plugin_entities() {
 	$site = get_config('site');
 	$dir = elgg_get_plugins_path();
+	$db_prefix = elgg_get_config('dbprefix');
 
 	$options = array(
 		'type' => 'object',
 		'subtype' => 'plugin',
+		'selects' => array('plugin_oe.*'),
+		'joins' => array("JOIN {$db_prefix}objects_entity plugin_oe on plugin_oe.guid = e.guid"),
 		'limit' => ELGG_ENTITIES_NO_VALUE
 	);
 
@@ -352,7 +355,11 @@ function elgg_get_plugins($status = 'active', $site_guid = null) {
 		'type' => 'object',
 		'subtype' => 'plugin',
 		'limit' => ELGG_ENTITIES_NO_VALUE,
-		'joins' => array("JOIN {$db_prefix}private_settings ps on ps.entity_guid = e.guid"),
+		'selects' => array('plugin_oe.*'),
+		'joins' => array(
+			"JOIN {$db_prefix}private_settings ps on ps.entity_guid = e.guid",
+			"JOIN {$db_prefix}objects_entity plugin_oe on plugin_oe.guid = e.guid"
+			),
 		'wheres' => array("ps.name = '$priority'"),
 		'order_by' => "CAST(ps.value as unsigned), e.guid"
 	);
diff --git a/engine/lib/users.php b/engine/lib/users.php
index 6a881777e..e209f2c38 100644
--- a/engine/lib/users.php
+++ b/engine/lib/users.php
@@ -1551,7 +1551,7 @@ function users_init() {
 	elgg_register_plugin_hook_handler('register', 'menu:user_hover', 'elgg_user_hover_menu');
 
 	elgg_register_action('register', '', 'public');
-	elgg_register_action('useradd', '', 'public');
+	elgg_register_action('useradd', '', 'admin');
 	elgg_register_action('friends/add');
 	elgg_register_action('friends/remove');
 	elgg_register_action('avatar/upload');
diff --git a/engine/lib/views.php b/engine/lib/views.php
index ca0ce7196..1b013be6f 100644
--- a/engine/lib/views.php
+++ b/engine/lib/views.php
@@ -103,7 +103,10 @@ function elgg_get_viewtype() {
 
 	$viewtype = get_input('view', NULL);
 	if ($viewtype) {
-		return $viewtype;
+		// only word characters allowed.
+		if (!preg_match('[\W]', $viewtype)) {
+			return $viewtype;
+		}
 	}
 
 	if (isset($CONFIG->view) && !empty($CONFIG->view)) {
diff --git a/engine/tests/api/metadata.php b/engine/tests/api/metadata.php
index be8ac269c..2461e975e 100644
--- a/engine/tests/api/metadata.php
+++ b/engine/tests/api/metadata.php
@@ -124,6 +124,80 @@ class ElggCoreMetadataAPITest extends ElggCoreUnitTest {
 		$e->delete();
 	}
 
+	// Make sure metadata with multiple values is correctly deleted when re-written
+	// by another user
+	// http://trac.elgg.org/ticket/2776
+	public function test_elgg_metadata_multiple_values() {
+		$u1 = new ElggUser();
+		$u1->username = rand();
+		$u1->save();
+
+		$u2 = new ElggUser();
+		$u2->username = rand();
+		$u2->save();
+
+		$obj = new ElggObject();
+		$obj->owner_guid = $u1->guid;
+		$obj->container_guid = $u1->guid;
+		$obj->access_id = ACCESS_PUBLIC;
+		$obj->save();
+
+		$md_values = array(
+			'one',
+			'two',
+			'three'
+		);
+
+		// need to fake different logins.
+		// good times without mocking.
+		$original_user = elgg_get_logged_in_user_entity();
+		$_SESSION['user'] = $u1;
+		
+		elgg_set_ignore_access(false);
+
+		// add metadata as one user
+		$obj->test = $md_values;
+
+		// check only these md exists
+		$db_prefix = elgg_get_config('dbprefix');
+		$q = "SELECT * FROM {$db_prefix}metadata WHERE entity_guid = $obj->guid";
+		$data = get_data($q);
+
+		$this->assertEqual(count($md_values), count($data));
+		foreach ($data as $md_row) {
+			$md = elgg_get_metadata_from_id($md_row->id);
+			$this->assertTrue(in_array($md->value, $md_values));
+			$this->assertEqual('test', $md->name);
+		}
+
+		// add md w/ same name as a different user
+		$_SESSION['user'] = $u2;
+		$md_values2 = array(
+			'four',
+			'five',
+			'six',
+			'seven'
+		);
+
+		$obj->test = $md_values2;
+
+		$q = "SELECT * FROM {$db_prefix}metadata WHERE entity_guid = $obj->guid";
+		$data = get_data($q);
+
+		$this->assertEqual(count($md_values2), count($data));
+		foreach ($data as $md_row) {
+			$md = elgg_get_metadata_from_id($md_row->id);
+			$this->assertTrue(in_array($md->value, $md_values2));
+			$this->assertEqual('test', $md->name);
+		}
+
+		$_SESSION['user'] = $original_user;
+
+		$obj->delete();
+		$u1->delete();
+		$u2->delete();
+	}
+
 
 	protected function create_metastring($string) {
 		global $CONFIG, $METASTRINGS_CACHE, $METASTRINGS_DEADNAME_CACHE;
diff --git a/engine/tests/objects/entities.php b/engine/tests/objects/entities.php
index a4dc7946c..248b85c9e 100644
--- a/engine/tests/objects/entities.php
+++ b/engine/tests/objects/entities.php
@@ -98,7 +98,7 @@ class ElggCoreEntityTest extends ElggCoreUnitTest {
 
 		// check internal metadata array
 		$metadata = $this->entity->expose_metadata();
-		$this->assertIdentical($metadata['existent'], 'testing');
+		$this->assertIdentical($metadata['existent'], array('testing'));
 	}
 
 	public function testElggEnityGetAndSetAnnotations() {