3 files changed, 67 insertions, 46 deletions

diff --git a/mod/blog/actions/blog/auto_save_revision.php b/mod/blog/actions/blog/auto_save_revision.php
index d400dda90..e33edfaab 100644
--- a/mod/blog/actions/blog/auto_save_revision.php
+++ b/mod/blog/actions/blog/auto_save_revision.php
@@ -6,8 +6,8 @@
  */
 
 $guid = get_input('guid');
-$user = get_loggedin_user();
-$title = get_input('title');
+$user = elgg_get_logged_in_user_entity();
+$title = htmlspecialchars(get_input('title', '', false), ENT_QUOTES, 'UTF-8');
 $description = get_input('description');
 $excerpt = get_input('excerpt');
 
@@ -38,8 +38,6 @@ if ($title && $description) {
 		$blog->title = $title;
 		$blog->description = $description;
 		$blog->excerpt = elgg_get_excerpt($excerpt);
-		// must be present or doesn't show up when metadata sorting.
-		$blog->publish_date = time();
 
 		// mark this as a brand new post so we can work out the
 		// river / revision logic in the real save action.
@@ -65,7 +63,7 @@ if ($title && $description) {
 		if (!$auto_save) {
 			$annotation_id = $blog->annotate('blog_auto_save', $description);
 		} elseif ($auto_save instanceof ElggAnnotation && $auto_save->value != $description) {
-			$blog->clearAnnotations('blog_auto_save');
+			$blog->deleteAnnotations('blog_auto_save');
 			$annotation_id = $blog->annotate('blog_auto_save', $description);
 		} elseif ($auto_save instanceof ElggAnnotation && $auto_save->value == $description) {
 			// this isn't an error because we have an up to date annotation.
diff --git a/mod/blog/actions/blog/delete.php b/mod/blog/actions/blog/delete.php
index a4606f17f..ca4eb8a7f 100644
--- a/mod/blog/actions/blog/delete.php
+++ b/mod/blog/actions/blog/delete.php
@@ -12,7 +12,11 @@ if (elgg_instanceof($blog, 'object', 'blog') && $blog->canEdit()) {
 	$container = get_entity($blog->container_guid);
 	if ($blog->delete()) {
 		system_message(elgg_echo('blog:message:deleted_post'));
-		forward("pg/blog/owner/$container->username/");
+		if (elgg_instanceof($container, 'group')) {
+			forward("blog/group/$container->guid/all");
+		} else {
+			forward("blog/owner/$container->username");
+		}
 	} else {
 		register_error(elgg_echo('blog:error:cannot_delete_post'));
 	}
diff --git a/mod/blog/actions/blog/save.php b/mod/blog/actions/blog/save.php
index 4e6e9133b..82a9e6c51 100644
--- a/mod/blog/actions/blog/save.php
+++ b/mod/blog/actions/blog/save.php
@@ -2,16 +2,25 @@
 /**
  * Save blog entity
  *
+ * Can be called by clicking save button or preview button. If preview button,
+ * we automatically save as draft. The preview button is only available for
+ * non-published drafts.
+ *
+ * Drafts are saved with the access set to private.
+ *
  * @package Blog
  */
 
 // start a new sticky form session in case of failure
-//elgg_make_sticky_form();
+elgg_make_sticky_form('blog');
+
+// save or preview
+$save = (bool)get_input('save');
 
 // store errors to pass along
 $error = FALSE;
 $error_forward_url = REFERER;
-$user = get_loggedin_user();
+$user = elgg_get_logged_in_user_entity();
 
 // edit or create a new entity
 $guid = get_input('guid');
@@ -34,6 +43,9 @@ if ($guid) {
 	$new_post = TRUE;
 }
 
+// set the previous status for the hooks to update the time_created and river entries
+$old_status = $blog->status;
+
 // set defaults and required values.
 $values = array(
 	'title' => '',
@@ -51,7 +63,11 @@ $required = array('title', 'description');
 
 // load from POST and do sanity and access checking
 foreach ($values as $name => $default) {
-	$value = get_input($name, $default);
+	if ($name === 'title') {
+		$value = htmlspecialchars(get_input('title', $default, false), ENT_QUOTES, 'UTF-8');
+	} else {
+		$value = get_input($name, $default);
+	}
 
 	if (in_array($name, $required) && empty($value)) {
 		$error = elgg_echo("blog:error:missing:$name");
@@ -63,20 +79,13 @@ foreach ($values as $name => $default) {
 
 	switch ($name) {
 		case 'tags':
-			if ($value) {
-				$values[$name] = string_to_tag_array($value);
-			} else {
-				unset ($values[$name]);
-			}
+			$values[$name] = string_to_tag_array($value);
 			break;
 
 		case 'excerpt':
 			if ($value) {
-				$value = elgg_get_excerpt($value);
-			} else {
-				$value = elgg_get_excerpt($values['description']);
+				$values[$name] = elgg_get_excerpt($value);
 			}
-			$values[$name] = $value;
 			break;
 
 		case 'container_guid':
@@ -92,36 +101,27 @@ foreach ($values as $name => $default) {
 			}
 			break;
 
-		// don't try to set the guid
-		case 'guid':
-			unset($values['guid']);
-			break;
-
 		default:
 			$values[$name] = $value;
 			break;
 	}
 }
 
-// build publish_date
-//$publish_month = get_input('publish_month');
-//$publish_day = get_input('publish_day');
-//$publish_year = get_input('publish_year');
-//$publish_hour = get_input('publish_hour');
-//$publish_minute = get_input('publish_minute');
-//$datetime = "$publish_year-$publish_month-$publish_day $publish_hour:$publish_minute:00";
-//$values['publish_date'] = date('U', strtotime($datetime));
+// if preview, force status to be draft
+if ($save == false) {
+	$values['status'] = 'draft';
+}
 
-// setting publish_date to now until the problems with locale dates can be resolved.
-$values['publish_date'] = time();
+// if draft, set access to private and cache the future access
+if ($values['status'] == 'draft') {
+	$values['future_access'] = $values['access_id'];
+	$values['access_id'] = ACCESS_PRIVATE;
+}
 
 // assign values to the entity, stopping on error.
 if (!$error) {
 	foreach ($values as $name => $value) {
-		if (FALSE === ($blog->$name = $value)) {
-			$error = elgg_echo('blog:error:cannot_save' . "$name=$value");
-			break;
-		}
+		$blog->$name = $value;
 	}
 }
 
@@ -129,13 +129,13 @@ if (!$error) {
 if (!$error) {
 	if ($blog->save()) {
 		// remove sticky form entries
-		elgg_clear_sticky_form();
+		elgg_clear_sticky_form('blog');
 
 		// remove autosave draft if exists
-		$blog->clearAnnotations('blog_auto_save');
+		$blog->deleteAnnotations('blog_auto_save');
 
 		// no longer a brand new post.
-		$blog->clearMetadata('new_post');
+		$blog->deleteMetadata('new_post');
 
 		// if this was an edit, create a revision annotation
 		if (!$new_post && $revision_text) {
@@ -144,14 +144,33 @@ if (!$error) {
 
 		system_message(elgg_echo('blog:message:saved'));
 
-		// @todo do we want to alert on updates?
-		if ($new_post && $blog->status == 'published') {
-			add_to_river('river/object/blog/create', 'create', get_loggedin_userid(), $blog->getGUID());
+		$status = $blog->status;
+
+		// add to river if changing status or published, regardless of new post
+		// because we remove it for drafts.
+		if (($new_post || $old_status == 'draft') && $status == 'published') {
+			add_to_river('river/object/blog/create', 'create', $blog->owner_guid, $blog->getGUID());
+
+			// we only want notifications sent when post published
+			register_notification_object('object', 'blog', elgg_echo('blog:newpost'));
+			elgg_trigger_event('publish', 'object', $blog);
+
+			// reset the creation time for posts that move from draft to published
+			if ($guid) {
+				$blog->time_created = time();
+				$blog->save();
+			}
+		} elseif ($old_status == 'published' && $status == 'draft') {
+			elgg_delete_river(array(
+				'object_guid' => $blog->guid,
+				'action_type' => 'create',
+			));
 		}
-		if ($blog->status == 'published') {
+
+		if ($blog->status == 'published' || $save == false) {
 			forward($blog->getURL());
 		} else {
-			forward("pg/blog/edit/$blog->guid");
+			forward("blog/edit/$blog->guid");
 		}
 	} else {
 		register_error(elgg_echo('blog:error:cannot_save'));
@@ -160,4 +179,4 @@ if (!$error) {
 } else {
 	register_error($error);
 	forward($error_forward_url);
-}
\ No newline at end of file
+}