Merge branch 'seeddms-4.3.x' into seeddms-5.0.x

CHANGELOG

@@ -1,3 +1,8 @@
+--------------------------------------------------------------------------------
+                     Changes in version 5.0.1
+--------------------------------------------------------------------------------
+- merged changes from 4.3.24
+
 --------------------------------------------------------------------------------
                      Changes in version 5.0.0
 --------------------------------------------------------------------------------
@@ -6,6 +11,13 @@
 - add .xml to online file types by default
 - add home folder for users
 
+--------------------------------------------------------------------------------
+                     Changes in version 4.3.24
+--------------------------------------------------------------------------------
+- fixed possible XSS attack in user substitution
+- users can have than 1 mandatory workflow, in that case the user can select one
+- completed MyDocuments page for advanced workflows
+
 --------------------------------------------------------------------------------
                      Changes in version 4.3.23
 --------------------------------------------------------------------------------

SeedDMS_Core/Core/inc.ClassUser.php

@@ -1059,7 +1059,7 @@ class SeedDMS_Core_User { /* {{{ */
 	function getWorkflowStatus($documentID=null, $version=null) { /* {{{ */
 		$db = $this->_dms->getDB();
 
-		$queryStr = 'SELECT d.*, c.userid FROM tblWorkflowTransitions a LEFT JOIN tblWorkflows b ON a.workflow=b.id LEFT JOIN tblWorkflowTransitionUsers c ON a.id=c.transition LEFT JOIN tblWorkflowDocumentContent d ON b.id=d.workflow WHERE d.document IS NOT NULL AND a.state=d.state AND c.userid='.$this->_id;
+		$queryStr = 'SELECT DISTINCT d.*, c.userid FROM tblWorkflowTransitions a LEFT JOIN tblWorkflows b ON a.workflow=b.id LEFT JOIN tblWorkflowTransitionUsers c ON a.id=c.transition LEFT JOIN tblWorkflowDocumentContent d ON b.id=d.workflow WHERE d.document IS NOT NULL AND a.state=d.state AND c.userid='.$this->_id;
 		if($documentID) {
 			$queryStr .= ' AND d.document='.(int) $documentID;
 			if($version)
@@ -1075,7 +1075,7 @@ class SeedDMS_Core_User { /* {{{ */
 			}
 		}
 
-		$queryStr = 'select d.*, c.groupid from tblWorkflowTransitions a left join tblWorkflows b on a.workflow=b.id left join tblWorkflowTransitionGroups c on a.id=c.transition left join tblWorkflowDocumentContent d on b.id=d.workflow left join tblGroupMembers e on c.groupid = e.groupID where d.document is not null and a.state=d.state and e.userID='.$this->_id;
+		$queryStr = 'select distinct d.*, c.groupid from tblWorkflowTransitions a left join tblWorkflows b on a.workflow=b.id left join tblWorkflowTransitionGroups c on a.id=c.transition left join tblWorkflowDocumentContent d on b.id=d.workflow left join tblGroupMembers e on c.groupid = e.groupID where d.document is not null and a.state=d.state and e.userID='.$this->_id;
 		if($documentID) {
 			$queryStr .= ' AND d.document='.(int) $documentID;
 			if($version)
@@ -1151,6 +1151,32 @@ class SeedDMS_Core_User { /* {{{ */
 		return $workflow;
 	} /* }}} */
 
+	/**
+	 * Get the mandatory workflows
+	 * A user which isn't trusted completely may have assigned mandatory
+	 * workflow
+	 * Whenever the user inserts a new document the mandatory workflow is
+	 * filled in as the workflow.
+	 *
+	 * @return object workflow
+	 */
+	function getMandatoryWorkflows() { /* {{{ */
+		$db = $this->_dms->getDB();
+
+		$queryStr = "SELECT * FROM tblWorkflowMandatoryWorkflow WHERE userid = " . $this->_id;
+		$resArr = $db->getResultArray($queryStr);
+		if (is_bool($resArr) && !$resArr) return false;
+
+		if(!$resArr)
+			return null;
+
+		$workflows = array();
+		foreach($resArr as $res) {
+			$workflows[] = $this->_dms->getWorkflow($res['workflow']);
+		}
+		return $workflows;
+	} /* }}} */
+
 	/**
 	 * Set a mandatory reviewer
 	 * This function sets a mandatory reviewer if it isn't already set.
@@ -1237,6 +1263,36 @@ class SeedDMS_Core_User { /* {{{ */
 		if (is_bool($resArr) && !$resArr) return false;
 	} /* }}} */
 
+	/**
+	 * Set a mandatory workflows
+	 * This function sets a list of mandatory workflows.
+	 *
+	 * @param array $workflows list of workflow objects
+	 * @return boolean true on success, otherwise false
+	 */
+	function setMandatoryWorkflows($workflows) { /* {{{ */
+		$db = $this->_dms->getDB();
+
+		$db->startTransaction();
+		$queryStr = "DELETE FROM tblWorkflowMandatoryWorkflow WHERE userid = " . $this->_id;
+		if (!$db->getResult($queryStr)) {
+			$db->rollbackTransaction();
+			return false;
+		}
+
+		foreach($workflows as $workflow) {
+			$queryStr = "INSERT INTO tblWorkflowMandatoryWorkflow (userid, workflow) VALUES (" . $this->_id . ", " . $workflow->getID() .")";
+			$resArr = $db->getResult($queryStr);
+			if (is_bool($resArr) && !$resArr) {
+				$db->rollbackTransaction();
+				return false;
+			}
+		}
+
+		$db->commitTransaction();
+		return true;
+	} /* }}} */
+
 	/**
 	 * Deletes all mandatory reviewers
 	 *

inc/inc.ClassUI_Default.php

@@ -27,7 +27,7 @@ class UI_Default {
 		$this->theme = $theme;
 	}
 
-	static function getStyles() { /* {{{ */
+	static function __getStyles() { /* {{{ */
 		global $settings;
 
 		$themes = array();
@@ -52,12 +52,14 @@ class UI_Default {
 		} else {
 			echo "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\"\n".
 				"\"http://www.w3.org/TR/html4/strict.dtd\">\n";
-			echo "<html>\n<head>\n";
+			echo "<html lang=\"en\">\n<head>\n";
 			echo "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n";
-			echo "<link rel=\"STYLESHEET\" type=\"text/css\" href=\"../styles/".$theme."/style.css\"/>\n";
+			echo "<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n";
-			echo "<link rel=\"STYLESHEET\" type=\"text/css\" href=\"../styles/print.css\" media=\"print\"/>\n";
+			echo "<link rel=\"stylesheet\" type=\"text/css\" href=\"../styles/".$theme."/bootstrap/css/bootstrap.css\"/>\n";
+			echo "<link rel=\"stylesheet\" type=\"text/css\" href=\"../styles/".$theme."/bootstrap/css/bootstrap-responsive.css\"/>\n";
 			echo "<link rel='shortcut icon' href='../styles/".$theme."/favicon.ico' type='image/x-icon'/>\n";
-			echo "<script type='text/javascript' src='../js/jquery.min.js'></script>\n";
+			echo "<script type='text/javascript' src='../styles/".$theme."/jquery/jquery.min.js'></script>\n";
+			echo "<script type='text/javascript' src='../styles/".$theme."/bootstrap/js/bootstrap.min.js'></script>\n";
 			echo "<title>".(strlen($settings->_siteName)>0 ? $settings->_siteName : "SeedDMS").(strlen($title)>0 ? ": " : "").htmlspecialchars($title)."</title>\n";
 			echo "</head>\n";
 			echo "<body".(strlen($bodyClass)>0 ? " class=\"".$bodyClass."\"" : "").">\n";
@@ -78,6 +80,9 @@ class UI_Default {
 	function footNote() { /* {{{ */
 		global $settings;
 		
+		echo '<div class="row-fluid" style="padding-top: 20px;">'."\n";
+		echo '<div class="span12">'."\n";
+		echo '<div class="alert alert-info">'."\n";
 		if ($settings->_printDisclaimer){
 			echo "<div class=\"disclaimer\">".getMLText("disclaimer")."</div>";
 		}
@@ -85,31 +90,38 @@ class UI_Default {
 		if (isset($settings->_footNote) && strlen((string)$settings->_footNote)>0) {
 			echo "<div class=\"footNote\">".(string)$settings->_footNote."</div>";
 		}
+		echo "</div>\n";
+		echo "</div>\n";
+		echo "</div>\n";
 	
 		return;
 	} /* }}} */
 
 	function contentStart() { /* {{{ */
+		echo "<div class=\"container-fluid\" style=\"margin-top: 50px;\">\n";
+		echo " <div class=\"row-fluid\">\n";
 	} /* }}} */
 
 	function contentEnd() { /* {{{ */
+		echo " </div>\n";
+		echo "</div>\n";
 	} /* }}} */
 
 	function globalBanner() { /* {{{ */
 		global $settings;
 
-		echo "<div class=\"globalBox\" id=\"noNav\">\n";
+		echo "<div class=\"navbar navbar-inverse navbar-fixed-top\">\n";
-		echo "<div class=\"globalTR\"></div>\n";
+		echo " <div class=\"navbar-inner\">\n";
-		echo "<div id=\"logo\"><img src='../styles/logo.png'></div>\n";
+		echo "  <div class=\"container-fluid\">\n";
-		echo "<div class=\"siteNameLogin\">".
+		echo "   <a class=\"brand\">".(strlen($settings->_sitename)>0 ? $settings->_sitename : "SeedDMS")."</a>\n";
-			(strlen($settings->_siteName)>0 ? $settings->_siteName : "SeedDMS").
+		echo "  </div>\n";
-			"</div>\n";
+		echo " </div>\n";
-		echo "<div style=\"clear: both; height: 0px; font-size:0;\">&nbsp;</div>\n".
+		echo "</div>\n";
-			"</div>\n";
+
 		return;
 	} /* }}} */
 
-	function globalNavigation($folder=null) { /* {{{ */
+	function __globalNavigation($folder=null) { /* {{{ */
 	
 		global $settings, $user;
 
@@ -150,7 +162,7 @@ class UI_Default {
 		return;
 	} /* }}} */
 
-	function pageNavigation($pageTitle, $pageType=null, $extra=null) { /* {{{ */
+	function __pageNavigation($pageTitle, $pageType=null, $extra=null) { /* {{{ */
 		global $settings, $user;
 
 		echo "<div class=\"headingContainer\">\n";
@@ -188,7 +200,7 @@ class UI_Default {
 		return;
 	} /* }}} */
 
-	function folderNavigationBar($folder) { /* {{{ */
+	function __folderNavigationBar($folder) { /* {{{ */
 	
 		global $user, $settings, $theme;
 
@@ -222,7 +234,7 @@ class UI_Default {
 		return;
 	} /* }}} */
 
-	function documentNavigationBar()	{ /* {{{ */
+	function __documentNavigationBar()	{ /* {{{ */
 	
 		global $user, $settings, $document;
 
@@ -259,7 +271,7 @@ class UI_Default {
 		return;
 	} /* }}} */
 
-	function accountNavigationBar() { /* {{{ */
+	function __accountNavigationBar() { /* {{{ */
 	
 		global $settings,$user;
 		
@@ -279,7 +291,7 @@ class UI_Default {
 		return;
 	} /* }}} */
 
-	function myDocumentsNavigationBar() { /* {{{ */
+	function __myDocumentsNavigationBar() { /* {{{ */
 
 		echo "<ul class=\"localNav\">\n";
 		echo "<li id=\"first\"><a href=\"../out/out.MyDocuments.php?inProcess=1\">".getMLText("documents_in_process")."</a></li>\n";
@@ -290,7 +302,7 @@ class UI_Default {
 		return;
 	} /* }}} */
 
-	function adminToolsNavigationBar() { /* {{{ */
+	function __adminToolsNavigationBar() { /* {{{ */
 	
 		global $settings;
 
@@ -305,7 +317,7 @@ class UI_Default {
 		return;
 	} /* }}} */
 	
-	function calendarNavigationBar($d){ /* {{{ */
+	function __calendarNavigationBar($d){ /* {{{ */
 
 		global $settings,$user;
 
@@ -321,7 +333,7 @@ class UI_Default {
 	
 	} /* }}} */
 
-	function pageList($pageNumber, $totalPages, $baseURI, $params) { /* {{{ */
+	function __pageList($pageNumber, $totalPages, $baseURI, $params) { /* {{{ */
 
 		if (!is_numeric($pageNumber) || !is_numeric($totalPages) || $totalPages<2) {
 			return;
@@ -364,7 +376,7 @@ class UI_Default {
 		return;
 	} /* }}} */
 
-	function contentContainer($content) { /* {{{ */
+	function __contentContainer($content) { /* {{{ */
 		echo "<div class=\"contentContainer\">\n";
 		echo "<div class=\"content\">\n";
 		echo "<div class=\"content-l\"><div class=\"content-r\"><div class=\"content-br\"><div class=\"content-bl\">\n";
@@ -375,34 +387,32 @@ class UI_Default {
 
 	function contentContainerStart() { /* {{{ */
 
-		echo "<div class=\"contentContainer\">\n";
+		echo "<div class=\"well".($class ? " ".$class : "")."\">\n";
-		echo "<div class=\"content\">\n";
-		echo "<div class=\"content-l\"><div class=\"content-r\"><div class=\"content-br\"><div class=\"content-bl\">\n";
 		return;
 	} /* }}} */
 
 	function contentContainerEnd() { /* {{{ */
 
-		echo "</div></div></div></div>\n</div>\n</div>\n";
+		echo "</div>\n";
 		return;
 	} /* }}} */
 
 	function contentHeading($heading, $noescape=false) { /* {{{ */
 
 		if($noescape)
-			echo "<div class=\"contentHeading\">".$heading."</div>\n";
+			echo "<legend>".$heading."</legend>\n";
 		else
-			echo "<div class=\"contentHeading\">".htmlspecialchars($heading)."</div>\n";
+			echo "<legend>".htmlspecialchars($heading)."</legend>\n";
 		return;
 	} /* }}} */
 
 	function contentSubHeading($heading, $first=false) { /* {{{ */
 
-		echo "<div class=\"contentSubHeading\"".($first ? " id=\"first\"" : "").">".htmlspecialchars($heading)."</div>\n";
+		echo "<h5>".$heading."</h5>";
 		return;
 	} /* }}} */
 
-	function getMimeIcon($fileType) { /* {{{ */
+	function __getMimeIcon($fileType) { /* {{{ */
 		// for extension use LOWER CASE only
 		$icons = array();
 		$icons["txt"]  = "txt.png";
@@ -483,7 +493,7 @@ class UI_Default {
 		}
 	} /* }}} */
 
-	function printDateChooser($defDate = -1, $varName) { /* {{{ */
+	function __printDateChooser($defDate = -1, $varName) { /* {{{ */
 	
 		if ($defDate == -1)
 			$defDate = mktime();
@@ -520,7 +530,7 @@ class UI_Default {
 		print "</select>";
 	} /* }}} */
 
-	function printSequenceChooser($objArr, $keepID = -1) { /* {{{ */
+	function __printSequenceChooser($objArr, $keepID = -1) { /* {{{ */
 		if (count($objArr) > 0) {
 			$max = $objArr[count($objArr)-1]->getSequence() + 1;
 			$min = $objArr[0]->getSequence() - 1;
@@ -546,7 +556,7 @@ class UI_Default {
 		print "</select>";
 	} /* }}} */
 	
-	function printDocumentChooser($formName) { /* {{{ */
+	function __printDocumentChooser($formName) { /* {{{ */
 		global $settings;
 		?>
 		<script language="JavaScript">
@@ -561,7 +571,7 @@ class UI_Default {
 		print "&nbsp;&nbsp;<input type=\"Button\" value=\"".getMLText("document")."...\" onclick=\"chooseDoc".$formName."();\">";
 	} /* }}} */
 
-	function printFolderChooser($formName, $accessMode, $exclude = -1, $default = false) { /* {{{ */
+	function __printFolderChooser($formName, $accessMode, $exclude = -1, $default = false) { /* {{{ */
 		global $settings;
 		?>
 		<script language="JavaScript">
@@ -576,7 +586,7 @@ class UI_Default {
 		print "&nbsp;&nbsp;<input type=\"Button\" value=\"".getMLText("folder")."...\" onclick=\"chooseFolder".$formName."();\">";
 	} /* }}} */
 
-	function printCategoryChooser($formName, $categories=array()) { /* {{{ */
+	function __printCategoryChooser($formName, $categories=array()) { /* {{{ */
 		global $settings;
 ?>
 		<script language="JavaScript">
@@ -604,7 +614,7 @@ class UI_Default {
 		print "&nbsp;&nbsp;<input type=\"Button\" value=\"".getMLText("category")."...\" onclick=\"chooseCategory".$formName."();\">";
 	} /* }}} */
 
-	function printAttributeEditField($attrdef, $objvalue, $fieldname='attributes') { /* {{{ */
+	function __printAttributeEditField($attrdef, $objvalue, $fieldname='attributes') { /* {{{ */
 		if($valueset = $attrdef->getValueSetAsArray()) {
 			echo "<select name=\"".$fieldname."[".$attrdef->getId()."]\">";
 			if($attrdef->getMinValues() < 1) {
@@ -622,7 +632,7 @@ class UI_Default {
 		}
 	} /* }}} */
 
-	function getImgPath($img) { /* {{{ */
+	function __getImgPath($img) { /* {{{ */
 		global $theme;
 
 		if ( is_file("../styles/$theme/images/$img") ) {
@@ -634,10 +644,16 @@ class UI_Default {
 		return "../out/images/$img";
 	} /* }}} */
 
-	function printImgPath($img) { /* {{{ */
+	function __printImgPath($img) { /* {{{ */
 		print UI::getImgPath($img);
 	} /* }}} */
 
+	function errorMsg($msg) { /* {{{ */
+		echo "<div class=\"alert alert-error\">\n";
+		echo $msg;
+		echo "</div>\n";
+	} /* }}} */
+
 	static function exitError($pagetitle,$error) { /* {{{ */
 	
 		UI::htmlStartPage($pagetitle);
@@ -655,7 +671,7 @@ class UI_Default {
 	} /* }}} */
 
 	// navigation flag is used for items links (navigation or selection)
-	function printFoldersTree($accessMode, $exclude, $folderID, $currentFolderID=-1, $navigation=false) {	/* {{{ */
+	function __printFoldersTree($accessMode, $exclude, $folderID, $currentFolderID=-1, $navigation=false) {	/* {{{ */
 		global $dms, $user, $form, $settings;
 		
 		if ($settings->_expandFolderTree==2){
@@ -745,7 +761,7 @@ class UI_Default {
 		if ($folderID == $settings->_rootFolderID) print "</ul>\n";
 	} /* }}} */
 
-	function printTreeNavigation($folderid,$showtree){ /* {{{ */
+	function __printTreeNavigation($folderid,$showtree){ /* {{{ */
 		global $settings;
 		
 ?>
@@ -799,7 +815,7 @@ class UI_Default {
 	 * @param integer $maxfiles maximum number of files allowed to upload
 	 * @param array $fields list of post fields
 	 */
-	function printUploadApplet($uploadurl, $attributes, $maxfiles=0, $fields=array()){ /* {{{ */
+	function __printUploadApplet($uploadurl, $attributes, $maxfiles=0, $fields=array()){ /* {{{ */
 		global $settings;
 ?>
 <applet id="jumpLoaderApplet" name="jumpLoaderApplet"

install/install.php

@@ -64,8 +64,7 @@ function openDBConnection($settings) { /* {{{ */
 } /* }}} */
 
 function printError($error) { /* {{{ */
-	print "<div class=\"install_error\">";
+	print "<div class=\"alert alert-error\">\n";
-	print "Error<br />";
 	print $error;
 	print "</div>";
 } /* }}} */
@@ -167,6 +166,11 @@ if(!$settings->_contentDir) {
 	$settings->_contentDir = $settings->_rootDir . 'data/';
 	$settings->_luceneDir = $settings->_rootDir . 'data/lucene/';
 	$settings->_stagingDir = $settings->_rootDir . 'data/staging/';
+	$settings->_cacheDir = $settings->_rootDir . 'data/cache/';
+} else {
+	if(!$settings->_cacheDir) {
+		$settings->_cacheDir = $settings->_contentDir . 'cache/';
+	}
 }
 $settings->_httpRoot = $httpRoot;
 
@@ -176,13 +180,15 @@ if(isset($settings->_extraPath))
 /**
  * Include GUI + Language
  */
-$theme = "blue";
+$theme = "bootstrap";
 include("../inc/inc.Language.php");
 include "../languages/en_GB/lang.inc";
 include("../inc/inc.ClassUI.php");
 
 
 UI::htmlStartPage("INSTALL");
+UI::globalBanner();
+UI::contentStart();
 UI::contentHeading("SeedDMS Installation for version ".SEEDDMS_VERSION);
 UI::contentContainerStart();
 
@@ -194,6 +200,7 @@ if (isset($_GET['phpinfo'])) {
 	echo '<a href="install.php">' . getMLText("back") . '</a>';
   phpinfo();
 	UI::contentContainerEnd();
+	UI::contentEnd();
 	UI::htmlEndPage();
   exit();
 }
@@ -218,6 +225,7 @@ if (isset($_GET['disableinstall'])) { /* {{{ */
 		echo '<a href="install.php">' . getMLText("back") . '</a>';
 	}
 	UI::contentContainerEnd();
+	UI::contentEnd();
 	UI::htmlEndPage();
   exit();
 } /* }}} */
@@ -258,6 +266,7 @@ if ($action=="setSettings") {
 	$settings->_contentDir = $_POST["contentDir"];
 	$settings->_luceneDir = $_POST["luceneDir"];
 	$settings->_stagingDir = $_POST["stagingDir"];
+	$settings->_cacheDir = $_POST["cacheDir"];
 	$settings->_extraPath = $_POST["extraPath"];
 	$settings->_dbDriver = $_POST["dbDriver"];
 	$settings->_dbHostname = $_POST["dbHostname"];
@@ -398,54 +407,58 @@ if($showform) {
 	      <tr ><td><b> <?php printMLText("settings_Server");?></b></td> </tr>
 	      <tr title="<?php printMLText("settings_rootDir_desc");?>">
 	        <td><?php printMLText("settings_rootDir");?>:</td>
-	        <td><input name="rootDir" value="<?php echo $settings->_rootDir ?>" size="100" /></td>
+	        <td><input type="text" name="rootDir" value="<?php echo $settings->_rootDir ?>" size="100" /></td>
 	      </tr>
 	      <tr title="<?php printMLText("settings_httpRoot_desc");?>">
 	        <td><?php printMLText("settings_httpRoot");?>:</td>
-	        <td><input name="httpRoot" value="<?php echo $settings->_httpRoot ?>" size="100" /></td>
+	        <td><input type="text" name="httpRoot" value="<?php echo $settings->_httpRoot ?>" size="100" /></td>
 	      </tr>
 	      <tr title="<?php printMLText("settings_contentDir_desc");?>">
 	        <td><?php printMLText("settings_contentDir");?>:</td>
-	        <td><input name="contentDir" value="<?php echo $settings->_contentDir ?>" size="100" style="background:yellow" /></td>
+	        <td><input type="text" name="contentDir" value="<?php echo $settings->_contentDir ?>" size="100" style="background:yellow" /></td>
 	      </tr>
 	      <tr title="<?php printMLText("settings_luceneDir_desc");?>">
 	        <td><?php printMLText("settings_luceneDir");?>:</td>
-	        <td><input name="luceneDir" value="<?php echo $settings->_luceneDir ?>" size="100" style="background:yellow" /></td>
+	        <td><input type="text" name="luceneDir" value="<?php echo $settings->_luceneDir ?>" size="100" style="background:yellow" /></td>
 	      </tr>
 	      <tr title="<?php printMLText("settings_stagingDir_desc");?>">
 	        <td><?php printMLText("settings_stagingDir");?>:</td>
-	        <td><input name="stagingDir" value="<?php echo $settings->_stagingDir ?>" size="100" style="background:yellow" /></td>
+	        <td><input type="text" name="stagingDir" value="<?php echo $settings->_stagingDir ?>" size="100" style="background:yellow" /></td>
+	      </tr>
+	      <tr title="<?php printMLText("settings_cacheDir_desc");?>">
+	        <td><?php printMLText("settings_cacheDir");?>:</td>
+	        <td><input type="text" name="cacheDir" value="<?php echo $settings->_cacheDir ?>" size="100" style="background:yellow" /></td>
 	      </tr>
 	      <tr title="<?php printMLText("settings_coreDir_desc");?>">
 	        <td><?php printMLText("settings_coreDir");?>:</td>
-	        <td><input name="coreDir" value="<?php echo $settings->_coreDir ?>" size="100" /></td>
+	        <td><input type="text" name="coreDir" value="<?php echo $settings->_coreDir ?>" size="100" /></td>
 	      </tr>
 	      <tr title="<?php printMLText("settings_luceneClassDir_desc");?>">
 	        <td><?php printMLText("settings_luceneClassDir");?>:</td>
-	        <td><input name="luceneClassDir" value="<?php echo $settings->_luceneClassDir ?>" size="100" /></td>
+	        <td><input type="text" name="luceneClassDir" value="<?php echo $settings->_luceneClassDir ?>" size="100" /></td>
 	      </tr>
 	      <tr title="<?php printMLText("settings_extraPath_desc");?>">
 	        <td><?php printMLText("settings_extraPath");?>:</td>
-	        <td><input name="extraPath" value="<?php echo $settings->_extraPath ?>" size="100" /></td>
+	        <td><input type="text" name="extraPath" value="<?php echo $settings->_extraPath ?>" size="100" /></td>
 	      </tr>
 
 	 	    <!-- SETTINGS - SYSTEM - DATABASE -->
 	      <tr ><td><b> <?php printMLText("settings_Database");?></b></td> </tr>
 	      <tr title="<?php printMLText("settings_dbDriver_desc");?>">
 	        <td><?php printMLText("settings_dbDriver");?>:</td>
-	        <td><input name="dbDriver" value="<?php echo $settings->_dbDriver ?>" /></td>
+	        <td><input type="text" name="dbDriver" value="<?php echo $settings->_dbDriver ?>" /></td>
 	      </tr>
 	      <tr title="<?php printMLText("settings_dbHostname_desc");?>">
 	        <td><?php printMLText("settings_dbHostname");?>:</td>
-	        <td><input name="dbHostname" value="<?php echo $settings->_dbHostname ?>" /></td>
+	        <td><input type="text" name="dbHostname" value="<?php echo $settings->_dbHostname ?>" /></td>
 	      </tr>
 	      <tr title="<?php printMLText("settings_dbDatabase_desc");?>">
 	        <td><?php printMLText("settings_dbDatabase");?>:</td>
-	        <td><input name="dbDatabase" value="<?php echo $settings->_dbDatabase ?>" style="background:yellow" /></td>
+	        <td><input type="text" name="dbDatabase" value="<?php echo $settings->_dbDatabase ?>" style="background:yellow" /></td>
 	      </tr>
 	      <tr title="<?php printMLText("settings_dbUser_desc");?>">
 	        <td><?php printMLText("settings_dbUser");?>:</td>
-	        <td><input name="dbUser" value="<?php echo $settings->_dbUser ?>" style="background:yellow" /></td>
+	        <td><input type="text" name="dbUser" value="<?php echo $settings->_dbUser ?>" style="background:yellow" /></td>
 	      </tr>
 	      <tr title="<?php printMLText("settings_dbPass_desc");?>">
 	        <td><?php printMLText("settings_dbPass");?>:</td>
@@ -457,9 +470,12 @@ if($showform) {
 	        <td><?php printMLText("settings_createdatabase");?>:</td>
 	        <td><input name="createDatabase" type="checkbox" style="background:yellow"/></td>
 	      </tr>
+	      <tr>
+	        <td></td>
+      	  <td><input type="submit" class="btn btn-primary" value="<?php printMLText("apply");?>" /></td>
+	      </tr>
 	    </table>
 
-	   <input type="Submit" value="<?php printMLText("apply");?>" />
 	</form>
 	<?php
 
@@ -474,5 +490,6 @@ $settings->_printDisclaimer = false;
 $settings->_footNote = false;
 // end of the page
 UI::contentContainerEnd();
+UI::contentEnd();
 UI::htmlEndPage();
 ?>

install/settings.xml.template_install

@@ -36,7 +36,7 @@
       strictFormCheck = "false"
       viewOnlineFileTypes = ".txt;.text;.html;.htm;.xml;.pdf;.gif;.png;.jpg;.jpeg"
       enableConverting = "true"
-      enableEmail = "true"	
+      enableEmail = "true"
       enableUsersView = "true"
       enableFullSearch = "false"
       enableFolderTree = "true"
@@ -44,7 +44,7 @@
       enableLanguageSelector = "true"
       stopWordsFile = ""
       sortUsersInList = ""
-			sortFoldersDefault="s"
+      sortFoldersDefault="s"
     >
     </edition> 
     <!-- enableCalendar: enable/disable calendar
@@ -63,12 +63,12 @@
     <!-- rootDir: Path to where SeedDMS is located
        - httpRoot: The relative path in the URL, after the domain part. Do not include the
        -           http:// prefix or the web host name. e.g. If the full URL is
-	     -           http://www.example.com/seeddms/, set $_httpRoot = "/seeddms/".
+       -           http://www.example.com/seeddms/, set $_httpRoot = "/seeddms/".
-	     -           If the URL is http://www.example.com/, set $_httpRoot = "/".
+       -           If the URL is http://www.example.com/, set $_httpRoot = "/".
        - contentDir: Where the uploaded files are stored (best to choose a directory that
        -             is not accessible through your web-server)
-			 - stagingDir: Where partial file uploads are saved
+       - stagingDir: Where partial file uploads are saved
-			 - luceneDir: Where the lucene fulltext index iѕ saved
+       - luceneDir: Where the lucene fulltext index iѕ saved
        - logFileEnable: set false to disable log system
        - logFileRotation: the log file rotation (h=hourly, d=daily, m=monthly)
     -->
@@ -82,20 +82,22 @@
       logFileRotation = "d"
       enableLargeFileUpload = "true"
       partitionSize = "2000000"
+      dropFolderDir = ""
+      cacheDir = ""
     >
     </server>
     
     <!-- enableGuestLogin: If you want anybody to login as guest, set the following line to true
        -                   note: guest login should be used only in a trusted environment
-			 - enablePasswordForgotten: Allow users to reset their password
+       - enablePasswordForgotten: Allow users to reset their password
        - restricted: Restricted access: only allow users to log in if they have an entry in the local database (irrespective of successful authentication with LDAP).
        - enableUserImage: enable users images
        - disableSelfEdit: if true user cannot edit his own profile
-			 - passwordStrength: minimum strength of password, set to 0 to disable
+       - passwordStrength: minimum strength of password, set to 0 to disable
-			 - passwordExpiration: number of days after password expires
+       - passwordExpiration: number of days after password expires
-			 - passwordHistory: number of remembered passwords
+       - passwordHistory: number of remembered passwords
-			 - passwordStrengthAlgorithm: algorithm used to calculate password strenght (simple or advanced)
+       - passwordStrengthAlgorithm: algorithm used to calculate password strenght (simple or advanced)
-			 - encryptionKey: arbitrary string used for creating identifiers
+       - encryptionKey: arbitrary string used for creating identifiers
     -->    
     <authentication
       enableGuestLogin = "false"
@@ -103,12 +105,12 @@
       restricted = "true"
       enableUserImage = "false"
       disableSelfEdit = "false"
-			passwordStrength="0"
+      passwordStrength="0"
-			passwordExpiration="0"
+      passwordExpiration="0"
-			passwordHistory="0"
+      passwordHistory="0"
-			passwordStrengthAlgorithm="simple"
+      passwordStrengthAlgorithm="simple"
-			loginFailure="0"
+      loginFailure="0"
-			encryptionKey=""
+      encryptionKey=""
     >
       <connectors>
         <!-- ***** CONNECTOR LDAP  *****
@@ -146,8 +148,8 @@
           port = "389"
           baseDN = ""
           accountDomainName = "example.com"
-	  bindDN="" 
+          bindDN="" 
-	  bindPw=""
+          bindPw=""
         >
         </connector>
       </connectors>
@@ -217,8 +219,8 @@
       enableDuplicateDocNames = "true"
     >
     </edition>
-		<!-- enableNotificationAppRev: true to send notifation if a user is added as a reviewer or approver
+    <!-- enableNotificationAppRev: true to send notifation if a user is added as a reviewer or approver
-		-->
+    -->
     <notification
       enableNotificationAppRev = "true"
     >
@@ -229,7 +231,7 @@
        -                   directory structure has been devised that exists within the content 
        -                   directory ($_contentDir). This requires a base directory from which 
        -                   to begin. Usually leave this to the default setting, 1048576, but can 
-       -                   be any number or string that does not already exist within $_contentDir.	
+       -                   be any number or string that does not already exist within $_contentDir.
        - maxDirID: Maximum number of sub-directories per parent directory. Default: 0, use 31998 (maximum number of dirs in ext3) for a multi level content directory.
        - updateNotifyTime: users are notified about document-changes that took place within the last "updateNotifyTime" seconds
        - extraPath: Path to addtional software. This is the directory containing additional software like the adodb directory, or the pear Log package. This path will be added to the php include path
@@ -240,13 +242,14 @@
       contentOffsetDir = "1048576"
       maxDirID = "0"
       updateNotifyTime = "86400"
-			extraPath = ""
+      extraPath = ""
+      cmdTimeout = "5"
     >
     </server>
     <converters>
-		 <converter mimeType="application/pdf">
+     <converter mimeType="application/pdf">
-		  pdftotext -enc UTF-8 -nopgbrk %s - | sed -e 's/ [a-zA-Z0-9.]\{1\} / /g' -e 's/[0-9.]//g'
+      pdftotext -enc UTF-8 -nopgbrk %s - | sed -e 's/ [a-zA-Z0-9.]\{1\} / /g' -e 's/[0-9.]//g'
-		 </converter>
+     </converter>
      <converter mimeType="application/msword">
        catdoc %s
      </converter>

op/op.AddDocument.php

@@ -208,11 +208,19 @@ if($settings->_workflowMode == 'traditional' || $settings->_workflowMode == 'tra
 		}
 	}
 } elseif($settings->_workflowMode == 'advanced') {
-	if(!$workflow = $user->getMandatoryWorkflow()) {
+	if(!$workflows = $user->getMandatoryWorkflows()) {
 		if(isset($_POST["workflow"]))
 			$workflow = $dms->getWorkflow($_POST["workflow"]);
 		else
 			$workflow = null;
+	} else {
+		/* If there is excactly 1 mandatory workflow, then set no matter what has
+		 * been posted in 'workflow', otherwise check if the posted workflow is in the
+		 * list of mandatory workflows. If not, then take the first one.
+		 */
+		$workflow = array_shift($workflows);
+		foreach($workflows as $mw)
+			if($mw->getID() == $_POST['workflow']) {$workflow = $mw; break;}
 	}
 }
 

op/op.UpdateDocument.php

@@ -187,11 +187,19 @@ if ($_FILES['userfile']['error'] == 0) {
 			}
 		}
 	} elseif($settings->_workflowMode == 'advanced') {
-		if(!$workflow = $user->getMandatoryWorkflow()) {
+		if(!$workflows = $user->getMandatoryWorkflows()) {
 			if(isset($_POST["workflow"]))
 				$workflow = $dms->getWorkflow($_POST["workflow"]);
 			else
 				$workflow = null;
+		} else {
+			/* If there is excactly 1 mandatory workflow, then set no matter what has
+			 * been posted in 'workflow', otherwise check if the posted workflow is in the
+			 * list of mandatory workflows. If not, then take the first one.
+			 */
+			$workflow = array_shift($workflows);
+			foreach($workflows as $mw)
+				if($mw->getID() == $_POST['workflow']) {$workflow = $mw; break;}
 		}
 	}
 

op/op.UsrMgr.php

@@ -98,10 +98,13 @@ if ($action == "adduser") {
 	}
 	else UI::exitError(getMLText("admin_tools"),getMLText("access_denied"));
 	
-	if(isset($_POST["workflow"])) {
+	if(isset($_POST["workflows"]) && $_POST["workflows"]) {
-		$workflow = $dms->getWorkflow($_POST["workflow"]);
+		$workflows = array();
-		if($workflow)
+		foreach($_POST["workflows"] as $workflowid)
-			$newUser->setMandatoryWorkflow($workflow);
+			if($tmp = $dms->getWorkflow($workflowid))
+				$workflows[] = $tmp;
+		if($workflows)
+			$newUser->setMandatoryWorkflows($workflows);
 	}
 
 	if (isset($_POST["usrReviewers"])){
@@ -255,13 +258,14 @@ else if ($action == "edituser") {
 		$editedUser->setHomeFolder($homefolder);
 	if ($editedUser->getQuota() != $quota)
 		$editedUser->setQuota($quota);
-	if(isset($_POST["workflow"]) && $_POST["workflow"]) {
+	if(isset($_POST["workflows"]) && $_POST["workflows"]) {
-		$currworkflow = $editedUser->getMandatoryWorkflow();
+		$workflows = array();
-		if (!$currworkflow || ($currworkflow->getID() != $_POST["workflow"])) {
+		foreach($_POST["workflows"] as $workflowid) {
-			$workflow = $dms->getWorkflow($_POST["workflow"]);
+			if($tmp = $dms->getWorkflow($workflowid))
-			if($workflow)
+				$workflows[] = $tmp;
-				$editedUser->setMandatoryWorkflow($workflow);
 		}
+		if($workflows)
+			$editedUser->setMandatoryWorkflows($workflows);
 	} else {
 		$editedUser->delMandatoryWorkflow();
 	}

views/bootstrap/class.AddDocument.php

@@ -248,12 +248,25 @@ $(document).ready(function() {
       </td>
       <td>
 <?php
-				$mandatoryworkflow = $user->getMandatoryWorkflow();
+				$mandatoryworkflows = $user->getMandatoryWorkflows();
-				if($mandatoryworkflow) {
+				if($mandatoryworkflows) {
+					if(count($mandatoryworkflows) == 1) {
 ?>
-				<?php echo $mandatoryworkflow->getName(); ?>
+				<?php echo htmlspecialchars($mandatoryworkflows[0]->getName()); ?>
-				<input type="hidden" name="workflow" value="<?php echo $mandatoryworkflow->getID(); ?>">
+				<input type="hidden" name="workflow" value="<?php echo $mandatoryworkflows[0]->getID(); ?>">
 <?php
+					} else {
+?>
+        <select class="_chzn-select-deselect span9" name="workflow" data-placeholder="<?php printMLText('select_workflow'); ?>">
+<?php
+					foreach ($mandatoryworkflows as $workflow) {
+						print "<option value=\"".$workflow->getID()."\"";
+						print ">". htmlspecialchars($workflow->getName())."</option>";
+					}
+?>
+        </select>
+<?php
+					}
 				} else {
 ?>
         <select class="_chzn-select-deselect span9" name="workflow" data-placeholder="<?php printMLText('select_workflow'); ?>">
@@ -262,8 +275,6 @@ $(document).ready(function() {
 					print "<option value=\"\">"."</option>";
 					foreach ($workflows as $workflow) {
 						print "<option value=\"".$workflow->getID()."\"";
-						if($mandatoryworkflow && $mandatoryworkflow->getID() == $workflow->getID())
-							echo " selected=\"selected\"";
 						print ">". htmlspecialchars($workflow->getName())."</option>";
 					}
 ?>

views/bootstrap/class.MyDocuments.php

@@ -395,6 +395,238 @@ class SeedDMS_View_MyDocuments extends SeedDMS_Bootstrap_Style {
 				}
 				else printMLText("no_docs_to_look_at");
 				
+				$this->contentContainerEnd();
+			} elseif($workflowmode == 'advanced') {
+				// Get document list for the current user.
+				$workflowStatus = $user->getWorkflowStatus();
+
+				// Create a comma separated list of all the documentIDs whose information is
+				// required.
+				$dList = array();
+				foreach ($workflowStatus["u"] as $st) {
+					if (!in_array($st["document"], $dList)) {
+						$dList[] = $st["document"];
+					}
+				}
+				foreach ($workflowStatus["g"] as $st) {
+					if (!in_array($st["document"], $dList)) {
+						$dList[] = $st["document"];
+					}
+				}
+				$docCSV = "";
+				foreach ($dList as $d) {
+					$docCSV .= (strlen($docCSV)==0 ? "" : ", ")."'".$d."'";
+				}
+				
+				if (strlen($docCSV)>0) {
+					// Get the document information.
+					$queryStr = "SELECT `tblDocuments`.*, `tblDocumentLocks`.`userID` as `lockUser`, ".
+						"`tblDocumentContent`.`version`, `tblDocumentStatus`.*, `tblDocumentStatusLog`.`status`, ".
+						"`tblDocumentStatusLog`.`comment` AS `statusComment`, `tblDocumentStatusLog`.`date` as `statusDate`, ".
+						"`tblDocumentStatusLog`.`userID`, `oTbl`.`fullName` AS `ownerName`, `sTbl`.`fullName` AS `statusName` ".
+						"FROM `tblDocumentContent` ".
+						"LEFT JOIN `tblDocuments` ON `tblDocuments`.`id` = `tblDocumentContent`.`document` ".
+						"LEFT JOIN `tblDocumentStatus` ON `tblDocumentStatus`.`documentID` = `tblDocumentContent`.`document` ".
+						"LEFT JOIN `tblDocumentStatusLog` ON `tblDocumentStatusLog`.`statusID` = `tblDocumentStatus`.`statusID` ".
+						"LEFT JOIN `ttstatid` ON `ttstatid`.`maxLogID` = `tblDocumentStatusLog`.`statusLogID` ".
+						"LEFT JOIN `ttcontentid` ON `ttcontentid`.`maxVersion` = `tblDocumentStatus`.`version` AND `ttcontentid`.`document` = `tblDocumentStatus`.`documentID` ".
+						"LEFT JOIN `tblDocumentLocks` ON `tblDocuments`.`id`=`tblDocumentLocks`.`document` ".
+						"LEFT JOIN `tblUsers` AS `oTbl` on `oTbl`.`id` = `tblDocuments`.`owner` ".
+						"LEFT JOIN `tblUsers` AS `sTbl` on `sTbl`.`id` = `tblDocumentStatusLog`.`userID` ".
+						"WHERE `ttstatid`.`maxLogID`=`tblDocumentStatusLog`.`statusLogID` ".
+						"AND `ttcontentid`.`maxVersion` = `tblDocumentContent`.`version` ".
+						"AND `tblDocumentStatusLog`.`status` IN (".S_IN_WORKFLOW.", ".S_EXPIRED.") ".
+						"AND `tblDocuments`.`id` IN (" . $docCSV . ") ".
+						"ORDER BY `statusDate` DESC";
+
+					$resArr = $db->getResultArray($queryStr);
+					if (is_bool($resArr) && !$resArr) {
+						$this->contentHeading(getMLText("warning"));
+						$this->contentContainer(getMLText("internal_error_exit"));
+						$this->htmlEndPage();
+						exit;
+					}
+					
+					// Create an array to hold all of these results, and index the array by
+					// document id. This makes it easier to retrieve document ID information
+					// later on and saves us having to repeatedly poll the database every time
+					// new document information is required.
+					$docIdx = array();
+					foreach ($resArr as $res) {
+						
+						// verify expiry
+						if ( $res["expires"] && time()>$res["expires"]+24*60*60 ){
+							if  ( $res["status"]==S_IN_WORKFLOW ){
+								$res["status"]=S_EXPIRED;
+							}
+						}
+
+						$docIdx[$res["id"]][$res["version"]] = $res;
+					}
+
+					// List the documents where a review has been requested.
+					$this->contentHeading(getMLText("documents_to_check"));
+					$this->contentContainerStart();
+					$printheader=true;
+					$iRev = array();
+					$dList = array();
+					foreach ($workflowStatus["u"] as $st) {
+					
+						if ( isset($docIdx[$st["document"]][$st["version"]]) && !in_array($st["document"], $dList) ) {
+							$dList[] = $st["document"];
+							$document = $dms->getDocument($st["document"]);
+						
+							if ($printheader){
+								print "<table class=\"table table-condensed\">";
+								print "<thead>\n<tr>\n";
+								print "<th></th>\n";
+								print "<th>".getMLText("name")."</th>\n";
+								print "<th>".getMLText("owner")."</th>\n";
+								print "<th>".getMLText("version")."</th>\n";
+								print "<th>".getMLText("last_update")."</th>\n";
+								print "<th>".getMLText("expires")."</th>\n";
+								print "</tr>\n</thead>\n<tbody>\n";
+								$printheader=false;
+							}
+						
+							print "<tr>\n";
+							$latestContent = $document->getLatestContent();
+							$previewer->createPreview($latestContent);
+							print "<td><a href=\"../op/op.Download.php?documentid=".$st["document"]."&version=".$st["version"]."\">";
+							if($previewer->hasPreview($latestContent)) {
+								print "<img class=\"mimeicon\" width=\"".$previewwidth."\"src=\"../op/op.Preview.php?documentid=".$document->getID()."&version=".$latestContent->getVersion()."&width=".$previewwidth."\" title=\"".htmlspecialchars($latestContent->getMimeType())."\">";
+							} else {
+								print "<img class=\"mimeicon\" src=\"".$this->getMimeIcon($latestContent->getFileType())."\" title=\"".htmlspecialchars($latestContent->getMimeType())."\">";
+							}
+							print "</a></td>";
+							print "<td><a href=\"out.ViewDocument.php?documentid=".$st["document"]."&currenttab=workflow\">".htmlspecialchars($docIdx[$st["document"]][$st["version"]]["name"])."</a></td>";
+							print "<td>".htmlspecialchars($docIdx[$st["document"]][$st["version"]]["ownerName"])."</td>";
+							print "<td>".$st["version"]."</td>";
+							print "<td>".$st["date"]." ". htmlspecialchars($docIdx[$st["document"]][$st["version"]]["statusName"]) ."</td>";
+							print "<td".($docIdx[$st["document"]][$st["version"]]['status']!=S_EXPIRED?"":" class=\"warning\"").">".(!$docIdx[$st["document"]][$st["version"]]["expires"] ? "-":getReadableDate($docIdx[$st["document"]][$st["version"]]["expires"]))."</td>";				
+							print "</tr>\n";
+						}
+					}
+					foreach ($workflowStatus["g"] as $st) {
+					
+						if (!in_array($st["document"], $iRev) && isset($docIdx[$st["document"]][$st["version"]]) && !in_array($st["document"], $dList) /* && $docIdx[$st["documentID"]][$st["version"]]['owner'] != $user->getId() */) {
+							$dList[] = $st["document"];
+							$document = $dms->getDocument($st["document"]);
+
+							if ($printheader){
+								print "<table class=\"table table-condensed\">";
+								print "<thead>\n<tr>\n";
+								print "<th></th>\n";
+								print "<th>".getMLText("name")."</th>\n";
+								print "<th>".getMLText("owner")."</th>\n";
+								print "<th>".getMLText("version")."</th>\n";
+								print "<th>".getMLText("last_update")."</th>\n";
+								print "<th>".getMLText("expires")."</th>\n";
+								print "</tr>\n</thead>\n<tbody>\n";
+								$printheader=false;
+							}
+
+							print "<tr>\n";
+							$latestContent = $document->getLatestContent();
+							$previewer->createPreview($latestContent);
+							print "<td><a href=\"../op/op.Download.php?documentid=".$st["document"]."&version=".$st["version"]."\">";
+							if($previewer->hasPreview($latestContent)) {
+								print "<img class=\"mimeicon\" width=\"".$previewwidth."\"src=\"../op/op.Preview.php?documentid=".$document->getID()."&version=".$latestContent->getVersion()."&width=".$previewwidth."\" title=\"".htmlspecialchars($latestContent->getMimeType())."\">";
+							} else {
+								print "<img class=\"mimeicon\" src=\"".$this->getMimeIcon($latestContent->getFileType())."\" title=\"".htmlspecialchars($latestContent->getMimeType())."\">";
+							}
+							print "</a></td>";
+							print "<td><a href=\"out.ViewDocument.php?documentid=".$st["document"]."&currenttab=workflow\">".htmlspecialchars($docIdx[$st["document"]][$st["version"]]["name"])."</a></td>";
+							print "<td>".htmlspecialchars($docIdx[$st["document"]][$st["version"]]["ownerName"])."</td>";
+							print "<td>".$st["version"]."</td>";
+							print "<td>".$st["date"]." ". htmlspecialchars($docIdx[$st["document"]][$st["version"]]["statusName"])."</td>";
+							print "<td".($docIdx[$st["document"]][$st["version"]]['status']!=S_EXPIRED?"":" class=\"warning\"").">".(!$docIdx[$st["document"]][$st["version"]]["expires"] ? "-":getReadableDate($docIdx[$st["document"]][$st["version"]]["expires"]))."</td>";				
+							print "</tr>\n";
+						}
+					}
+					if (!$printheader){
+						echo "</tbody>\n</table>";
+					}else{
+						printMLText("no_docs_to_check");
+					}
+					$this->contentContainerEnd();
+				}
+
+				// Get list of documents owned by current user that are pending review or
+				// pending approval.
+				$queryStr = "SELECT `tblDocuments`.*, `tblDocumentLocks`.`userID` as `lockUser`, ".
+					"`tblDocumentContent`.`version`, `tblDocumentStatus`.*, `tblDocumentStatusLog`.`status`, ".
+					"`tblDocumentStatusLog`.`comment` AS `statusComment`, `tblDocumentStatusLog`.`date` as `statusDate`, ".
+					"`tblDocumentStatusLog`.`userID`, `oTbl`.`fullName` AS `ownerName`, `sTbl`.`fullName` AS `statusName` ".
+					"FROM `tblDocumentContent` ".
+					"LEFT JOIN `tblDocuments` ON `tblDocuments`.`id` = `tblDocumentContent`.`document` ".
+					"LEFT JOIN `tblDocumentStatus` ON `tblDocumentStatus`.`documentID` = `tblDocumentContent`.`document` ".
+					"LEFT JOIN `tblDocumentStatusLog` ON `tblDocumentStatusLog`.`statusID` = `tblDocumentStatus`.`statusID` ".
+					"LEFT JOIN `ttstatid` ON `ttstatid`.`maxLogID` = `tblDocumentStatusLog`.`statusLogID` ".
+					"LEFT JOIN `ttcontentid` ON `ttcontentid`.`maxVersion` = `tblDocumentStatus`.`version` AND `ttcontentid`.`document` = `tblDocumentStatus`.`documentID` ".
+					"LEFT JOIN `tblDocumentLocks` ON `tblDocuments`.`id`=`tblDocumentLocks`.`document` ".
+					"LEFT JOIN `tblUsers` AS `oTbl` on `oTbl`.`id` = `tblDocuments`.`owner` ".
+					"LEFT JOIN `tblUsers` AS `sTbl` on `sTbl`.`id` = `tblDocumentStatusLog`.`userID` ".
+					"WHERE `ttstatid`.`maxLogID`=`tblDocumentStatusLog`.`statusLogID` ".
+					"AND `ttcontentid`.`maxVersion` = `tblDocumentContent`.`version` ".
+					"AND `tblDocuments`.`owner` = '".$user->getID()."' ".
+					"AND `tblDocumentStatusLog`.`status` IN (".S_IN_WORKFLOW.") ".
+					"ORDER BY `statusDate` DESC";
+
+				$resArr = $db->getResultArray($queryStr);
+				if (is_bool($resArr) && !$resArr) {
+					$this->contentHeading(getMLText("warning"));
+					$this->contentContainer("Internal error. Unable to complete request. Exiting.");
+					$this->htmlEndPage();
+					exit;
+				}
+
+				$this->contentHeading(getMLText("documents_user_requiring_attention"));
+				$this->contentContainerStart();
+				if (count($resArr)>0) {
+
+					print "<table class=\"table table-condensed\">";
+					print "<thead>\n<tr>\n";
+					print "<th></th>";
+					print "<th>".getMLText("name")."</th>\n";
+					print "<th>".getMLText("status")."</th>\n";
+					print "<th>".getMLText("version")."</th>\n";
+					print "<th>".getMLText("last_update")."</th>\n";
+					print "<th>".getMLText("expires")."</th>\n";
+					print "</tr>\n</thead>\n<tbody>\n";
+
+					foreach ($resArr as $res) {
+						$document = $dms->getDocument($res["documentID"]);
+					
+						// verify expiry
+						if ( $res["expires"] && time()>$res["expires"]+24*60*60 ){
+							if  ( $res["status"]==S_DRAFT_APP || $res["status"]==S_DRAFT_REV ){
+								$res["status"]=S_EXPIRED;
+							}
+						}
+					
+						print "<tr>\n";
+						$latestContent = $document->getLatestContent();
+						$previewer->createPreview($latestContent);
+						print "<td><a href=\"../op/op.Download.php?documentid=".$res["documentID"]."&version=".$res["version"]."\">";
+						if($previewer->hasPreview($latestContent)) {
+							print "<img class=\"mimeicon\" width=\"".$previewwidth."\"src=\"../op/op.Preview.php?documentid=".$document->getID()."&version=".$latestContent->getVersion()."&width=".$previewwidth."\" title=\"".htmlspecialchars($latestContent->getMimeType())."\">";
+						} else {
+							print "<img class=\"mimeicon\" src=\"".$this->getMimeIcon($latestContent->getFileType())."\" title=\"".htmlspecialchars($latestContent->getMimeType())."\">";
+						}
+						print "</a></td>";
+						print "<td><a href=\"out.ViewDocument.php?documentid=".$res["documentID"]."&currenttab=revapp\">" . htmlspecialchars($res["name"]) . "</a></td>\n";
+						print "<td>".getOverallStatusText($res["status"])."</td>";
+						print "<td>".$res["version"]."</td>";
+						print "<td>".$res["statusDate"]." ".htmlspecialchars($res["statusName"])."</td>";
+						print "<td>".(!$res["expires"] ? "-":getReadableDate($res["expires"]))."</td>";				
+						print "</tr>\n";
+					}		
+					print "</tbody></table>";	
+					
+				}
+				else printMLText("no_docs_to_look_at");
+
 				$this->contentContainerEnd();
 			}
 			

views/bootstrap/class.SubstituteUser.php

@@ -50,17 +50,17 @@ class SeedDMS_View_SubstituteUser extends SeedDMS_Bootstrap_Style {
 		foreach ($allUsers as $currUser) {
 			echo "<tr>";
 			echo "<td>";
-			echo $currUser->getFullName()." (".$currUser->getLogin().")<br />";
+			echo htmlspecialchars($currUser->getFullName())." (".htmlspecialchars($currUser->getLogin()).")<br />";
-			echo "<small>".$currUser->getComment()."</small>";
+			echo "<small>".htmlspecialchars($currUser->getComment())."</small>";
 			echo "</td>";
 			echo "<td>";
-			echo "<a href=\"mailto:".$currUser->getEmail()."\">".$currUser->getEmail()."</a><br />";
+			echo "<a href=\"mailto:".htmlspecialchars($currUser->getEmail())."\">".htmlspecialchars($currUser->getEmail())."</a><br />";
 			echo "</td>";
 			echo "<td>";
 			$groups = $currUser->getGroups();
 			if (count($groups) != 0) {
 				for ($j = 0; $j < count($groups); $j++)	{
-					print $groups[$j]->getName();
+					print htmlspecialchars($groups[$j]->getName());
 					if ($j +1 < count($groups))
 						print ", ";
 				}
@@ -68,7 +68,7 @@ class SeedDMS_View_SubstituteUser extends SeedDMS_Bootstrap_Style {
 			echo "</td>";
 			echo "<td>";
 			if($currUser->getID() != $user->getID()) {
-				echo "<a class=\"btn\" href=\"../op/op.SubstituteUser.php?userid=".$currUser->getID()."&formtoken=".createFormKey('substituteuser')."\"><i class=\"icon-exchange\"></i> ".getMLText('substitute_user')."</a> ";
+				echo "<a class=\"btn\" href=\"../op/op.SubstituteUser.php?userid=".((int) $currUser->getID())."&formtoken=".createFormKey('substituteuser')."\"><i class=\"icon-exchange\"></i> ".getMLText('substitute_user')."</a> ";
 			}
 			echo "</td>";
 			echo "</tr>";

views/bootstrap/class.UpdateDocument.php

@@ -534,12 +534,28 @@ $(document).ready( function() {
       </td>
       <td>
 <?php
-				$mandatoryworkflow = $user->getMandatoryWorkflow();
+				$mandatoryworkflows = $user->getMandatoryWorkflows();
-				if($mandatoryworkflow) {
+				if($mandatoryworkflows) {
+					if(count($mandatoryworkflows) == 1) {
 ?>
-				<?php echo $mandatoryworkflow->getName(); ?>
+				<?php echo htmlspecialchars($mandatoryworkflows[0]->getName()); ?>
-				<input type="hidden" name="workflow" value="<?php echo $mandatoryworkflow->getID(); ?>">
+				<input type="hidden" name="workflow" value="<?php echo $mandatoryworkflows[0]->getID(); ?>">
 <?php
+					} else {
+?>
+        <select class="_chzn-select-deselect span9" name="workflow" data-placeholder="<?php printMLText('select_workflow'); ?>">
+<?php
+					$curworkflow = $latestContent->getWorkflow();
+					foreach ($mandatoryworkflows as $workflow) {
+						print "<option value=\"".$workflow->getID()."\"";
+						if($curworkflow && $curworkflow->getID() == $workflow->getID())
+							echo " selected=\"selected\"";
+						print ">". htmlspecialchars($workflow->getName())."</option>";
+					}
+?>
+        </select>
+<?php
+					}
 				} else {
 ?>
         <select class="_chzn-select-deselect span9" name="workflow" data-placeholder="<?php printMLText('select_workflow'); ?>">
@@ -548,8 +564,6 @@ $(document).ready( function() {
 					print "<option value=\"\">"."</option>";
 					foreach ($workflows as $workflow) {
 						print "<option value=\"".$workflow->getID()."\"";
-						if($mandatoryworkflow && $mandatoryworkflow->getID() == $workflow->getID())
-							echo " selected=\"selected\"";
 						print ">". htmlspecialchars($workflow->getName())."</option>";
 					}
 ?>

views/bootstrap/class.UsrMgr.php

@@ -378,12 +378,15 @@ $(document).ready( function() {
 				<div class="cbSelectTitle"><?php printMLText("workflow");?>:</div>
 			</td>
 			<td>
-        <select name="workflow" data-placeholder="<?php printMLText('select_workflow'); ?>">
+        <select class="chzn-select" name="workflows[]" multiple="multiple" data-placeholder="<?php printMLText('select_workflow'); ?>">
 <?php
 				print "<option value=\"\">"."</option>";
+				$mandatoryworkflows = $currUser ? $currUser->getMandatoryWorkflows() : array();
 				foreach ($workflows as $workflow) {
 					print "<option value=\"".$workflow->getID()."\"";
-					if($currUser && $currUser->getMandatoryWorkflow() && $currUser->getMandatoryWorkflow()->getID() == $workflow->getID())
+					$checked = false;
+					foreach($mandatoryworkflows as $mw) if($mw->getID() == $workflow->getID()) $checked = true;
+					if($checked)
 						echo " selected=\"selected\"";
 					print ">". htmlspecialchars($workflow->getName())."</option>";
 				}

views/bootstrap/class.ViewDocument.php

@@ -839,6 +839,7 @@ class SeedDMS_View_ViewDocument extends SeedDMS_Bootstrap_Style {
 					echo implode(", ", $names);
 					echo ") - ";
 					echo $wkflog->getDate();
+					echo "<br />";
 				}
 				echo "</td>";
 			}

views/bootstrap/class.WorkflowSummary.php

@@ -128,6 +128,7 @@ class SeedDMS_View_WorkflowSummary extends SeedDMS_Bootstrap_Style {
 					print "<th>".getMLText("version")."</th>\n";
 					print "<th>".getMLText("owner")."</th>\n";
 					print "<th>".getMLText("workflow")."</th>\n";
+					print "<th>".getMLText("workflow_state")."</th>\n";
 					print "<th>".getMLText("last_update")."</th>\n";
 					print "<th>".getMLText("expires")."</th>\n";
 					print "</tr>\n</thead>\n<tbody>\n";