9 files changed, 299 insertions, 0 deletions
diff --git a/views/failsafe/input/button.php b/views/failsafe/input/button.php
new file mode 100644
index 000000000..9a72f38b0
--- /dev/null
+++ b/views/failsafe/input/button.php
@@ -0,0 +1,41 @@
+<?php
+	/**
+	 * Create a input button
+	 * Use this view for forms rather than creating a submit/reset button tag in the wild as it provides
+	 * extra security which help prevent CSRF attacks.
+	 * 
+	 * @package Elgg
+	 * @subpackage Core
+	 * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
+	 * @author Curverider Ltd
+	 * @copyright Curverider Ltd 2008
+	 * @link http://elgg.org/
+	 * 
+	 * @uses $vars['value'] The current value, if any
+	 * @uses $vars['js'] Any Javascript to enter into the input tag
+	 * @uses $vars['internalname'] The name of the input field
+	 * @uses $vars['type'] Submit or reset, defaults to submit.
+	 * @uses $vars['src'] Src of an image
+	 * 
+	 */
+
+	global $CONFIG;
+	
+	$class = $vars['class'];
+	if (!$class) $class = "submit_button";
+
+	if (isset($vars['type'])) { $type = strtolower($vars['type']); } else { $type = 'submit'; }
+	switch ($type)
+	{
+		case 'button' : $type='button'; break;
+		case 'reset' : $type='reset'; break;
+		case 'submit':
+		default: $type = 'submit';
+	}
+	
+	$value = htmlentities($vars['value'], null, 'UTF-8');
+	$name = $vars['internalname'];
+	$src = $vars['src'];
+	if (strpos($src,$CONFIG->wwwroot)===false) $src = ""; // blank src if trying to access an offsite image.
+?>
+<input type="<?php echo $type; ?>" class="<?php echo $type; ?>_button" <?php echo $vars['js']; ?> value="<?php echo $value; ?>" src="<?php echo $src; ?>" class="<?php echo $class; ?>" />
+\ No newline at end of file
diff --git a/views/failsafe/input/checkboxes.php b/views/failsafe/input/checkboxes.php
new file mode 100644
index 000000000..ff3ab8523
--- /dev/null
+++ b/views/failsafe/input/checkboxes.php
@@ -0,0 +1,49 @@
+<?php
+
+	/**
+	 * Elgg checkbox input
+	 * Displays a checkbox input field
+	 * 
+	 * @package Elgg
+	 * @subpackage Core
+	 * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
+	 * @author Curverider Ltd
+	 * @copyright Curverider Ltd 2008
+	 * @link http://elgg.org/
+	 * 
+	 * @uses $vars['value'] The current value, if any
+	 * @uses $vars['js'] Any Javascript to enter into the input tag
+	 * @uses $vars['internalname'] The name of the input field
+	 * @uses $vars['options'] An array of strings representing the options for the checkbox field
+	 * 
+	 */
+
+	$class = $vars['class'];
+	if (!$class) $class = "input-checkboxes";
+
+    foreach($vars['options'] as $label => $option) {
+        //if (!in_array($option,$vars['value'])) {
+        if (is_array($vars['value'])) {
+        	if (!in_array($option,$vars['value'])) {
+	            $selected = "";
+	        } else {
+	            $selected = "checked = \"checked\"";
+	        }
+        } else {
+	    	if ($option != $vars['value']) {
+	            $selected = "";
+	        } else {
+	            $selected = "checked = \"checked\"";
+	        }
+        }
+        $labelint = (int) $label;
+        if ("{$label}" == "{$labelint}") {
+        	$label = $option;
+        }
+        
+        $disabled = "";
+        if ($vars['disabled']) $disabled = ' disabled="yes" '; 
+        echo "<label><input type=\"checkbox\" $disabled {$vars['js']} name=\"{$vars['internalname']}[]\" {$selected} value=\"".htmlentities($option, null, 'UTF-8')."\" {$selected} class=\"$class\" />{$label}</label><br />";
+    }
+
+?> 
+\ No newline at end of file
diff --git a/views/failsafe/input/form.php b/views/failsafe/input/form.php
new file mode 100644
index 000000000..a640619bb
--- /dev/null
+++ b/views/failsafe/input/form.php
@@ -0,0 +1,31 @@
+<?php
+	/**
+	 * Create a form for data submission.
+	 * Use this view for forms rather than creating a form tag in the wild as it provides
+	 * extra security which help prevent CSRF attacks.
+	 * 
+	 * @package Elgg
+	 * @subpackage Core
+	 * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
+	 * @author Curverider Ltd
+	 * @copyright Curverider Ltd 2008
+	 * @link http://elgg.org/
+	 * 
+	 * @uses $vars['body'] The body of the form (made up of other input/xxx views and html
+	 * @uses $vars['method'] Method (default POST)
+	 * @uses $vars['enctype'] How the form is encoded, default blank
+	 * @uses $vars['action'] URL of the action being called
+	 * 
+	 */
+	
+	if (isset($vars['internalid'])) { $id = $vars['internalid']; } else { $id = ''; }
+	if (isset($vars['internalname'])) { $name = $vars['internalname']; } else { $name = ''; }
+	$body = $vars['body'];
+	$action = $vars['action'];
+	if (isset($vars['enctype'])) { $enctype = $vars['enctype']; } else { $enctype = ''; }
+	if (isset($vars['method'])) { $method = $vars['method']; } else { $method = 'POST'; }
+
+?>
+<form <?php if ($id) { ?>id="<?php echo $id; ?>" <?php } ?> <?php if ($name) { ?>name="<?php echo $name; ?>" <?php } ?> action="<?php echo $action; ?>" method="<?php echo $method; ?>" <?php if ($enctype!="") echo "enctype=\"$enctype\""; ?>>
+<?php echo $body; ?>
+</form>
+\ No newline at end of file
diff --git a/views/failsafe/input/hidden.php b/views/failsafe/input/hidden.php
new file mode 100644
index 000000000..4ff9f31da
--- /dev/null
+++ b/views/failsafe/input/hidden.php
@@ -0,0 +1,20 @@
+<?php
+	/**
+	 * Create a hidden data field
+	 * Use this view for forms rather than creating a hidden tag in the wild as it provides
+	 * extra security which help prevent CSRF attacks.
+	 * 
+	 * @package Elgg
+	 * @subpackage Core
+	 * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
+	 * @author Curverider Ltd
+	 * @copyright Curverider Ltd 2008
+	 * @link http://elgg.org/
+	 * 
+	 * @uses $vars['value'] The current value, if any
+	 * @uses $vars['js'] Any Javascript to enter into the input tag
+	 * @uses $vars['internalname'] The name of the input field
+	 * 
+	 */
+?>
+<input type="hidden" <?php echo $vars['js']; ?> name="<?php echo $vars['internalname']; ?>" value="<?php echo htmlentities($vars['value'], null, 'UTF-8'); ?>" /> 
+\ No newline at end of file
diff --git a/views/failsafe/input/longtext.php b/views/failsafe/input/longtext.php
new file mode 100644
index 000000000..85c3f8186
--- /dev/null
+++ b/views/failsafe/input/longtext.php
@@ -0,0 +1,25 @@
+<?php
+
+	/**
+	 * Elgg long text input
+	 * Displays a long text input field
+	 * 
+	 * @package Elgg
+	 * @subpackage Core
+	 * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
+	 * @author Curverider Ltd
+	 * @copyright Curverider Ltd 2008
+	 * @link http://elgg.org/
+	 * 
+	 * @uses $vars['value'] The current value, if any
+	 * @uses $vars['js'] Any Javascript to enter into the input tag
+	 * @uses $vars['internalname'] The name of the input field
+	 * 
+	 */
+
+	$class = $vars['class'];
+	if (!$class) $class = "input-textarea";
+	
+?>
+
+<textarea class="<?php echo $class; ?>" name="<?php echo $vars['internalname']; ?>" <?php if ($vars['disabled']) echo ' disabled="yes" '; ?> <?php echo $vars['js']; ?>><?php echo $vars['value']; ?></textarea> 
+\ No newline at end of file
diff --git a/views/failsafe/input/pulldown.php b/views/failsafe/input/pulldown.php
new file mode 100644
index 000000000..96b4d19aa
--- /dev/null
+++ b/views/failsafe/input/pulldown.php
@@ -0,0 +1,52 @@
+<?php
+
+	/**
+	 * Elgg pulldown input
+	 * Displays a pulldown input field
+	 * 
+	 * @package Elgg
+	 * @subpackage Core
+	 * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
+	 * @author Curverider Ltd
+	 * @copyright Curverider Ltd 2008
+	 * @link http://elgg.org/
+	 * 
+	 * @uses $vars['value'] The current value, if any
+	 * @uses $vars['js'] Any Javascript to enter into the input tag
+	 * @uses $vars['internalname'] The name of the input field
+	 * @uses $vars['options'] An array of strings representing the options for the pulldown field
+	 * @uses $vars['options_values'] An associative array of "value" => "option" where "value" is an internal name and "option" is 
+	 * 								 the value displayed on the button. Replaces $vars['options'] when defined. 
+	 */
+
+
+	$class = $vars['class'];
+	if (!$class) $class = "input-pulldown";
+
+?>
+
+
+<select name="<?php echo $vars['internalname']; ?>" <?php echo $vars['js']; ?> <?php if ($vars['disabled']) echo ' disabled="yes" '; ?> class="<?php echo $class; ?>">
+<?php
+	if ($vars['options_values'])
+	{
+		foreach($vars['options_values'] as $value => $option) {
+	        if ($value != $vars['value']) {
+	            echo "<option value=\"$value\">{$option}</option>";
+	        } else {
+	            echo "<option value=\"$value\" selected=\"selected\">{$option}</option>";
+	        }
+	    }
+	}
+	else
+	{
+	    foreach($vars['options'] as $option) {
+	        if ($option != $vars['value']) {
+	            echo "<option>{$option}</option>";
+	        } else {
+	            echo "<option selected=\"selected\">{$option}</option>";
+	        }
+	    }
+	}
+?> 
+</select>
+\ No newline at end of file
diff --git a/views/failsafe/input/reset.php b/views/failsafe/input/reset.php
new file mode 100644
index 000000000..6aa9d1c82
--- /dev/null
+++ b/views/failsafe/input/reset.php
@@ -0,0 +1,27 @@
+<?php
+	/**
+	 * Create a reset input button
+	 * Use this view for forms rather than creating a submit/reset button tag in the wild as it provides
+	 * extra security which help prevent CSRF attacks.
+	 * 
+	 * @package Elgg
+	 * @subpackage Core
+	 * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
+	 * @author Curverider Ltd
+	 * @copyright Curverider Ltd 2008
+	 * @link http://elgg.org/
+	 * 
+	 * @uses $vars['value'] The current value, if any
+	 * @uses $vars['js'] Any Javascript to enter into the input tag
+	 * @uses $vars['internalname'] The name of the input field
+	 * @uses $vars['type'] Submit or reset, defaults to submit.
+	 * 
+	 */
+
+	$vars['type'] = 'reset';
+	$class = $vars['class'];
+	if (!$class) $class = "submit_button";
+	$vars['class'] = $class;
+	
+	echo elgg_view('input/button', $vars);
+?>
+\ No newline at end of file
diff --git a/views/failsafe/input/submit.php b/views/failsafe/input/submit.php
new file mode 100644
index 000000000..591a43998
--- /dev/null
+++ b/views/failsafe/input/submit.php
@@ -0,0 +1,27 @@
+<?php
+	/**
+	 * Create a submit input button
+	 * Use this view for forms rather than creating a submit/reset button tag in the wild as it provides
+	 * extra security which help prevent CSRF attacks.
+	 * 
+	 * @package Elgg
+	 * @subpackage Core
+	 * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
+	 * @author Curverider Ltd
+	 * @copyright Curverider Ltd 2008
+	 * @link http://elgg.org/
+	 * 
+	 * @uses $vars['value'] The current value, if any
+	 * @uses $vars['js'] Any Javascript to enter into the input tag
+	 * @uses $vars['internalname'] The name of the input field
+	 * @uses $vars['type'] Submit or reset, defaults to submit.
+	 * 
+	 */
+
+	$vars['type'] = 'submit';
+	$class = $vars['class'];
+	if (!$class) $class = "submit_button";
+	$vars['class'] = $class;
+	
+	echo elgg_view('input/button', $vars);
+?>
+\ No newline at end of file
diff --git a/views/failsafe/input/text.php b/views/failsafe/input/text.php
new file mode 100644
index 000000000..a6045cf4c
--- /dev/null
+++ b/views/failsafe/input/text.php
@@ -0,0 +1,27 @@
+<?php
+
+	/**
+	 * Elgg text input
+	 * Displays a text input field
+	 * 
+	 * @package Elgg
+	 * @subpackage Core
+	 * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
+	 * @author Curverider Ltd
+	 * @copyright Curverider Ltd 2008
+	 * @link http://elgg.org/
+	 * 
+	 * @uses $vars['value'] The current value, if any
+	 * @uses $vars['js'] Any Javascript to enter into the input tag
+	 * @uses $vars['internalname'] The name of the input field
+	 * @uses $vars['disabled'] If true then control is read-only
+	 * @uses $vars['class'] Class override
+	 */
+
+	
+	$class = $vars['class'];
+	if (!$class) $class = "input-text";
+	
+?>
+
+<input type="text" <?php if ($vars['disabled']) echo ' disabled="yes" '; ?> <?php echo $vars['js']; ?> name="<?php echo $vars['internalname']; ?>" value="<?php echo htmlentities($vars['value'], null, 'UTF-8'); ?>" class="<?php echo $class ?>"/> 
+\ No newline at end of file