6 files changed, 90 insertions, 46 deletions

diff --git a/mod/groups/actions/discussion/save.php b/mod/groups/actions/discussion/save.php
index de4afadfb..b3e9da654 100644
--- a/mod/groups/actions/discussion/save.php
+++ b/mod/groups/actions/discussion/save.php
@@ -4,7 +4,7 @@
  */
 
 // Get variables
-$title = get_input("title");
+$title = htmlspecialchars(get_input('title', '', false), ENT_QUOTES, 'UTF-8');
 $desc = get_input("description");
 $status = get_input("status");
 $access_id = (int) get_input("access_id");
diff --git a/mod/groups/actions/groups/edit.php b/mod/groups/actions/groups/edit.php
index df2464a65..2d7e1f023 100644
--- a/mod/groups/actions/groups/edit.php
+++ b/mod/groups/actions/groups/edit.php
@@ -8,15 +8,15 @@
 // Load configuration
 global $CONFIG;
 
+elgg_make_sticky_form('groups');
+
 /**
  * wrapper for recursive array walk decoding
  */
 function profile_array_decoder(&$v) {
-	$v = html_entity_decode($v, ENT_COMPAT, 'UTF-8');
+	$v = _elgg_html_decode($v);
 }
 
-elgg_make_sticky_form('groups');
-
 // Get group fields
 $input = array();
 foreach ($CONFIG->group as $shortname => $valuetype) {
@@ -25,7 +25,7 @@ foreach ($CONFIG->group as $shortname => $valuetype) {
 	if (is_array($input[$shortname])) {
 		array_walk_recursive($input[$shortname], 'profile_array_decoder');
 	} else {
-		$input[$shortname] = html_entity_decode($input[$shortname], ENT_COMPAT, 'UTF-8');
+		$input[$shortname] = _elgg_html_decode($input[$shortname]);
 	}
 
 	if ($valuetype == 'tags') {
@@ -33,8 +33,7 @@ foreach ($CONFIG->group as $shortname => $valuetype) {
 	}
 }
 
-$input['name'] = get_input('name');
-$input['name'] = html_entity_decode($input['name'], ENT_COMPAT, 'UTF-8');
+$input['name'] = htmlspecialchars(get_input('name', '', false), ENT_QUOTES, 'UTF-8');
 
 $user = elgg_get_logged_in_user_entity();
 
diff --git a/mod/groups/lib/groups.php b/mod/groups/lib/groups.php
index dfbb1154b..505cacd01 100644
--- a/mod/groups/lib/groups.php
+++ b/mod/groups/lib/groups.php
@@ -497,3 +497,65 @@ function groups_register_profile_buttons($group) {
 		}
 	}
 }
+
+/**
+ * Prepares variables for the group edit form view.
+ *
+ * @param mixed $group ElggGroup or null. If a group, uses values from the group.
+ * @return array
+ */
+function groups_prepare_form_vars($group = null) {
+	$values = array(
+		'name' => '',
+		'membership' => ACCESS_PUBLIC,
+		'vis' => ACCESS_PUBLIC,
+		'guid' => null,
+		'entity' => null
+	);
+
+	// handle customizable profile fields
+	$fields = elgg_get_config('group');
+
+	if ($fields) {
+		foreach ($fields as $name => $type) {
+			$values[$name] = '';
+		}
+	}
+
+	// handle tool options
+	$tools = elgg_get_config('group_tool_options');
+	if ($tools) {
+		foreach ($tools as $group_option) {
+			$option_name = $group_option->name . "_enable";
+			$values[$option_name] = $group_option->default_on ? 'yes' : 'no';
+		}
+	}
+
+	// get current group settings
+	if ($group) {
+		foreach (array_keys($values) as $field) {
+			if (isset($group->$field)) {
+				$values[$field] = $group->$field;
+			}
+		}
+
+		if ($group->access_id != ACCESS_PUBLIC && $group->access_id != ACCESS_LOGGED_IN) {
+			// group only access - this is done to handle access not created when group is created
+			$values['vis'] = ACCESS_PRIVATE;
+		}
+
+		$values['entity'] = $group;
+	}
+
+	// get any sticky form settings
+	if (elgg_is_sticky_form('groups')) {
+		$sticky_values = elgg_get_sticky_values('groups');
+		foreach ($sticky_values as $key => $value) {
+			$values[$key] = $value;
+		}
+	}
+
+	elgg_clear_sticky_form('groups');
+
+	return $values;
+}
diff --git a/mod/groups/start.php b/mod/groups/start.php
index c591410c5..9dca7dc16 100644
--- a/mod/groups/start.php
+++ b/mod/groups/start.php
@@ -194,6 +194,15 @@ function groups_setup_sidebar_menus() {
  */
 function groups_page_handler($page) {
 
+	// forward old profile urls
+	if (is_numeric($page[0])) {
+		$group = get_entity($page[0]);
+		if (elgg_instanceof($group, 'group', '', 'ElggGroup')) {
+			system_message(elgg_echo('changebookmark'));
+			forward($group->getURL());
+		}
+	}
+	
 	elgg_load_library('elgg:groups');
 
 	if (!isset($page[0])) {
diff --git a/mod/groups/views/default/forms/groups/edit.php b/mod/groups/views/default/forms/groups/edit.php
index 7540d1bf9..532e89c35 100644
--- a/mod/groups/views/default/forms/groups/edit.php
+++ b/mod/groups/views/default/forms/groups/edit.php
@@ -5,26 +5,9 @@
  * @package ElggGroups
  */
 
-if (elgg_is_sticky_form('groups')) {
-	$sticky_values = elgg_get_sticky_values('groups');
-	elgg_clear_sticky_form('groups');
-}
-
-// new groups default to open membership
-if (isset($sticky_values)) {
-	$membership = $sticky_values['membership'];
-	$access = $sticky_values['access_id'];
-} elseif (isset($vars['entity'])) {
-	$membership = $vars['entity']->membership;
-	$access = $vars['entity']->access_id;
-	if ($access != ACCESS_PUBLIC && $access != ACCESS_LOGGED_IN) {
-		// group only - this is done to handle access not created when group is created
-		$access = ACCESS_PRIVATE;
-	}
-} else {
-	$membership = ACCESS_PUBLIC;
-	$access = ACCESS_PUBLIC;
-}
+// only extract these elements.
+$name = $membership = $vis = $entity = null;
+extract($vars, EXTR_IF_EXISTS);
 
 ?>
 <div>
@@ -35,7 +18,7 @@ if (isset($sticky_values)) {
 	<label><?php echo elgg_echo("groups:name"); ?></label><br />
 	<?php echo elgg_view("input/text", array(
 		'name' => 'name',
-		'value' => isset($sticky_values['name']) ? $sticky_values['name'] : $vars['entity']->name,
+		'value' => $name
 	));
 	?>
 </div>
@@ -53,7 +36,7 @@ if ($group_profile_fields > 0) {
 		echo "</label>$line_break";
 		echo elgg_view("input/{$valtype}", array(
 			'name' => $shortname,
-			'value' => isset($sticky_values[$shortname]) ? $sticky_values[$shortname] : $vars['entity']->$shortname,
+			'value' => elgg_extract($shortname, $vars)
 		));
 		echo '</div>';
 	}
@@ -78,10 +61,6 @@ if ($group_profile_fields > 0) {
 <?php
 
 if (elgg_get_plugin_setting('hidden_groups', 'groups') == 'yes') {
-	$this_owner = $vars['entity']->owner_guid;
-	if (!$this_owner) {
-		$this_owner = elgg_get_logged_in_user_guid();
-	}
 	$access_options = array(
 		ACCESS_PRIVATE => elgg_echo('groups:access:group'),
 		ACCESS_LOGGED_IN => elgg_echo("LOGGED_IN"),
@@ -94,7 +73,7 @@ if (elgg_get_plugin_setting('hidden_groups', 'groups') == 'yes') {
 			<?php echo elgg_echo('groups:visibility'); ?><br />
 			<?php echo elgg_view('input/access', array(
 				'name' => 'vis',
-				'value' =>  $access,
+				'value' =>  $vis,
 				'options_values' => $access_options,
 			));
 			?>
@@ -109,12 +88,7 @@ if ($tools) {
 	usort($tools, create_function('$a,$b', 'return strcmp($a->label,$b->label);'));
 	foreach ($tools as $group_option) {
 		$group_option_toggle_name = $group_option->name . "_enable";
-		if ($group_option->default_on) {
-			$group_option_default_value = 'yes';
-		} else {
-			$group_option_default_value = 'no';
-		}
-		$value = $vars['entity']->$group_option_toggle_name ? $vars['entity']->$group_option_toggle_name : $group_option_default_value;
+		$value = elgg_extract($group_option_toggle_name, $vars);
 ?>	
 <div>
 	<label>
@@ -137,17 +111,17 @@ if ($tools) {
 <div class="elgg-foot">
 <?php
 
-if (isset($vars['entity'])) {
+if (isset($entity)) {
 	echo elgg_view('input/hidden', array(
 		'name' => 'group_guid',
-		'value' => $vars['entity']->getGUID(),
+		'value' => $entity->getGUID(),
 	));
 }
 
 echo elgg_view('input/submit', array('value' => elgg_echo('save')));
 
-if (isset($vars['entity'])) {
-	$delete_url = 'action/groups/delete?guid=' . $vars['entity']->getGUID();
+if (isset($entity)) {
+	$delete_url = 'action/groups/delete?guid=' . $entity->getGUID();
 	echo elgg_view('output/confirmlink', array(
 		'text' => elgg_echo('groups:delete'),
 		'href' => $delete_url,
diff --git a/mod/groups/views/default/groups/edit.php b/mod/groups/views/default/groups/edit.php
index 24a1c3f1e..5579ad54a 100644
--- a/mod/groups/views/default/groups/edit.php
+++ b/mod/groups/views/default/groups/edit.php
@@ -11,5 +11,5 @@ $form_vars = array(
 	'enctype' => 'multipart/form-data',
 	'class' => 'elgg-form-alt',
 );
-$body_vars = array('entity' => $entity);
-echo elgg_view_form('groups/edit', $form_vars, $body_vars);
+
+echo elgg_view_form('groups/edit', $form_vars, groups_prepare_form_vars($entity));