- merge changes from 3.4.0RC2

LetoDMS_Core/Core.php

@@ -15,7 +15,7 @@
 /**
  * @uses LetoDMS_DatabaseAccess
  */
-define('USE_PDO', 1);
+//define('USE_PDO', 1);
 if(defined('USE_PDO'))
 	require_once('Core/inc.DBAccessPDO.php');
 else
@@ -26,6 +26,11 @@ else
  */
 require_once('Core/inc.ClassDMS.php');
 
+/**
+ * @uses LetoDMS_Object
+ */
+require_once('Core/inc.ClassObject.php');
+
 /**
  * @uses LetoDMS_Folder
  */
@@ -36,6 +41,11 @@ require_once('Core/inc.ClassFolder.php');
  */
 require_once('Core/inc.ClassDocument.php');
 
+/**
+ * @uses LetoDMS_Attribute
+ */
+require_once('Core/inc.ClassAttribute.php');
+
 /**
  * @uses LetoDMS_Group
  */

LetoDMS_Core/Core/inc.ClassAttribute.php

@@ -0,0 +1,382 @@
+<?php
+/**
+ * Implementation of the attribute object in the document management system
+ *
+ * @category   DMS
+ * @package    LetoDMS_Core
+ * @license    GPL 2
+ * @version    @version@
+ * @author     Uwe Steinmann <uwe@steinmann.cx>
+ * @copyright  Copyright (C) 2012 Uwe Steinmann
+ * @version    Release: @package_version@
+ */
+
+/**
+ * Class to represent an attribute in the document management system
+ *
+ * @category   DMS
+ * @package    LetoDMS_Core
+ * @author     Markus Westphal, Malcolm Cowe, Uwe Steinmann <uwe@steinmann.cx>
+ * @copyright  Copyright (C) 2012 Uwe Steinmann
+ * @version    Release: @package_version@
+ */
+class LetoDMS_Core_Attribute {
+	/**
+	 * @var integer id of attribute
+	 *
+	 * @access protected
+	 */
+	var $_id;
+
+	/**
+	 * @var object folder or document this attribute belongs to
+	 *
+	 * @access protected
+	 */
+	var $_obj;
+
+	/**
+	 * @var object definition of this attribute
+	 *
+	 * @access protected
+	 */
+	var $_attrdef;
+
+	/**
+	 * @var mixed value of this attribute
+	 *
+	 * @access protected
+	 */
+	var $_value;
+
+	/**
+	 * @var object reference to the dms instance this attribute belongs to
+	 *
+	 * @access protected
+	 */
+	var $_dms;
+
+	function LetoDMS_Core_Attribute($id, $obj, $attrdef, $value) {
+		$this->_id = $id;
+		$this->_obj = $obj;
+		$this->_attrdef = $attrdef;
+		$this->_value = $value;
+		$this->_dms = null;
+	}
+
+	function setDMS($dms) {
+		$this->_dms = $dms;
+	}
+
+	function getID() { return $this->_id; }
+
+	function getValue() { return $this->_value; }
+
+	/**
+	 * Set a value of an attribute
+	 * The attribute is deleted completely if the value is the empty string
+	 *
+	 * @param string $value value to be set
+	 * @return boolean true if operation was successfull, otherwise false
+	 */
+	function setValue($value) { /* {{{*/
+		$db = $this->_dms->getDB();
+
+		switch(get_class($this->_obj)) {
+			case "LetoDMS_Core_Document":
+				if(trim($value) === '')
+					$queryStr = "DELETE FROM tblDocumentAttributes WHERE `document` = " . $this->_obj->getID() . " AND `attrdef` = " . $this->_attrdef->getId();
+				else
+					$queryStr = "UPDATE tblDocumentAttributes SET value = ".$db->qstr($value)." WHERE `document` = " . $this->_obj->getID() .	" AND `attrdef` = " . $this->_attrdef->getId();
+				break;
+			case "LetoDMS_Core_DocumentContent":
+				if(trim($value) === '')
+					$queryStr = "DELETE FROM tblDocumentContentAttributes WHERE `content` = " . $this->_obj->getID() . " AND `attrdef` = " . $this->_attrdef->getId();
+				else
+					$queryStr = "UPDATE tblDocumentContentAttributes SET value = ".$db->qstr($value)." WHERE `content` = " . $this->_obj->getID() .	" AND `attrdef` = " . $this->_attrdef->getId();
+				break;
+			case "LetoDMS_Core_Folder":
+				if(trim($value) === '')
+					$queryStr = "DELETE FROM tblFolderAttributes WHERE `folder` = " . $this->_obj->getID() .	" AND `attrdef` = " . $this->_attrdef->getId();
+				else
+					$queryStr = "UPDATE tblFolderAttributes SET value = ".$db->qstr($value)." WHERE `folder` = " . $this->_obj->getID() .	" AND `attrdef` = " . $this->_attrdef->getId();
+				break;
+			default:
+				return false;
+		}
+		if (!$db->getResult($queryStr))
+			return false;
+
+		$this->_value = $value;
+
+		return true;
+	} /* }}} */
+
+	function getAttributeDefinition() { return $this->_attrdef; }
+
+}
+
+/**
+ * Class to represent an attribute definition in the document management system
+ *
+ * @category   DMS
+ * @package    LetoDMS_Core
+ * @author     Markus Westphal, Malcolm Cowe, Uwe Steinmann <uwe@steinmann.cx>
+ * @copyright  Copyright (C) 2012 Uwe Steinmann
+ * @version    Release: @package_version@
+ */
+class LetoDMS_Core_AttributeDefinition {
+	/**
+	 * @var integer id of attribute definition
+	 *
+	 * @access protected
+	 */
+	var $_id;
+
+	/**
+	 * @var string name of attribute definition
+	 *
+	 * @access protected
+	 */
+	var $_name;
+
+	/**
+	 * @var object reference to the dms instance this attribute definition belongs to
+	 *
+	 * @access protected
+	 */
+	var $_dms;
+
+	const type_int = '1';
+	const type_float = '2';
+	const type_string = '3';
+	const type_boolean = '4';
+
+	const objtype_all = '0';
+	const objtype_folder = '1';
+	const objtype_document = '2';
+	const objtype_documentcontent = '3';
+
+	function LetoDMS_Core_AttributeDefinition($id, $name, $objtype, $type, $multiple, $minvalues, $maxvalues, $valueset) {
+		$this->_id = $id;
+		$this->_name = $name;
+		$this->_type = $type;
+		$this->_objtype = $objtype;
+		$this->_multiple = $multiple;
+		$this->_minvalues = $minvalues;
+		$this->_maxvalues = $maxvalues;
+		$this->_valueset = $valueset;
+		$this->_separator = '';
+		$this->_dms = null;
+	}
+
+	function setDMS($dms) {
+		$this->_dms = $dms;
+	}
+
+	function getID() { return $this->_id; }
+
+	function getName() { return $this->_name; }
+
+	function setName($name) {
+		$db = $this->_dms->getDB();
+
+		$queryStr = "UPDATE tblAttributeDefinitions SET name =".$db->qstr($name)." WHERE id = " . $this->_id;
+		$res = $db->getResult($queryStr);
+		if (!$res)
+			return false;
+
+		$this->_name = $name;
+		return true;
+	}
+
+	function getObjType() { return $this->_objtype; }
+
+	function setObjType($objtype) {
+		$db = $this->_dms->getDB();
+
+		$queryStr = "UPDATE tblAttributeDefinitions SET objtype =".intval($objtype)." WHERE id = " . $this->_id;
+		$res = $db->getResult($queryStr);
+		if (!$res)
+			return false;
+
+		$this->_objtype = $objtype;
+		return true;
+	}
+
+	function getType() { return $this->_type; }
+
+	function setType($type) {
+		$db = $this->_dms->getDB();
+
+		$queryStr = "UPDATE tblAttributeDefinitions SET type =".intval($type)." WHERE id = " . $this->_id;
+		$res = $db->getResult($queryStr);
+		if (!$res)
+			return false;
+
+		$this->_type = $type;
+		return true;
+	}
+
+	function hasMultipleValues() { return $this->_multiple; }
+
+	function setMultipleValues($mv) {
+		$db = $this->_dms->getDB();
+
+		$queryStr = "UPDATE tblAttributeDefinitions SET multiple =".intval($mv)." WHERE id = " . $this->_id;
+		$res = $db->getResult($queryStr);
+		if (!$res)
+			return false;
+
+		$this->_multiple = $mv;
+		return true;
+	}
+
+	function getMinValues() { return $this->_minvalues; }
+
+	function setMinValues($minvalues) {
+		$db = $this->_dms->getDB();
+
+		$queryStr = "UPDATE tblAttributeDefinitions SET minvalues =".intval($minvalues)." WHERE id = " . $this->_id;
+		$res = $db->getResult($queryStr);
+		if (!$res)
+			return false;
+
+		$this->_minvalues = $minvalues;
+		return true;
+	}
+
+	function getMaxValues() { return $this->_maxvalues; }
+
+	function setMaxValues($maxvalues) { /* {{{ */
+		$db = $this->_dms->getDB();
+
+		$queryStr = "UPDATE tblAttributeDefinitions SET maxvalues =".intval($maxvalues)." WHERE id = " . $this->_id;
+		$res = $db->getResult($queryStr);
+		if (!$res)
+			return false;
+
+		$this->_maxvalues = $maxvalues;
+		return true;
+	} /* }}} */
+
+	/**
+	 * Get the value set as saved in the database
+	 *
+	 * @return string value set
+	 */
+	function getValueSet() { /* {{{ */
+		return $this->_valueset;
+	} /* }}} */
+
+	/**
+	 * Get the whole value set as an array
+	 *
+	 * @return array values of value set or false if the value set has
+	 *         less than 2 chars
+	 */
+	function getValueSetAsArray() { /* {{{ */
+		if(strlen($this->_valueset) > 1)
+			return explode($this->_valueset[0], substr($this->_valueset, 1));
+		else
+			return false;
+	} /* }}} */
+
+	/**
+	 * Get the n'th value of a value set
+	 *
+	 * @param interger $index
+	 * @return string n'th value of value set or false if the index is
+	 *         out of range or the value set has less than 2 chars
+	 */
+	function getValueSetValue($ind) { /* {{{ */
+		if(strlen($this->_valueset) > 1) {
+			$tmp = explode($this->_valueset[0], substr($this->_valueset, 1));
+			if(isset($tmp[$ind]))
+				return $tmp[$ind];
+			else
+				return false;
+		} else
+			return false;
+	} /* }}} */
+
+	/**
+	 * Set the value set
+	 *
+	 * A value set is a list of values allowed for an attribute. The values
+	 * are separated by a char which must also be the first char of the
+	 * value set string.
+	 *
+	 * @param string $valueset
+	 * @return boolean true if value set could be set, otherwise false
+	 */
+	function setValueSet($valueset) { /* {{{ */
+	/*
+		$tmp = array();
+		foreach($valueset as $value) {
+			$tmp[] = str_replace('"', '""', $value);
+		}
+		$valuesetstr = implode(",", $tmp);
+	*/
+		$valuesetstr = $valueset;
+
+		$db = $this->_dms->getDB();
+
+		$queryStr = "UPDATE tblAttributeDefinitions SET valueset =".$db->qstr($valuesetstr)." WHERE id = " . $this->_id;
+		$res = $db->getResult($queryStr);
+		if (!$res)
+			return false;
+
+		$this->_valueset = $valueset;
+		$this->_separator = substr($valueset, 0, 1);
+		return true;
+	} /* }}} */
+
+	/**
+	 * Check if the attribute definition is used
+	 *
+	 * Checks all attributes whether at least one of them referenceѕ
+	 * this attribute definition
+	 *
+	 * @return boolean true if attribute definition is used, otherwise false
+	 */
+	function isUsed() { /* {{{ */
+		$db = $this->_dms->getDB();
+		
+		$queryStr = "SELECT * FROM tblDocumentAttributes WHERE attrdef=".$this->_id;
+		$resArr = $db->getResultArray($queryStr);
+		if (is_array($resArr) && count($resArr) == 0) {
+			$queryStr = "SELECT * FROM tblFolderAttributes WHERE attrdef=".$this->_id;
+			$resArr = $db->getResultArray($queryStr);
+			if (is_array($resArr) && count($resArr) == 0) {
+				$queryStr = "SELECT * FROM tblDocumentContentAttributes WHERE attrdef=".$this->_id;
+				$resArr = $db->getResultArray($queryStr);
+				if (is_array($resArr) && count($resArr) == 0) {
+
+					return false;
+				}
+			}
+		}
+		return true;
+	} /* }}} */
+
+	/**
+	 * Remove the attribute definition
+	 * Removal is only executed when the definition is not used anymore.
+	 *
+	 * @return boolean true on success or false in case of an error
+	 */
+	function remove() { /* {{{ */
+		$db = $this->_dms->getDB();
+
+		if($this->isUsed())
+			return false;
+
+		// Delete user itself
+		$queryStr = "DELETE FROM tblAttributeDefinitions WHERE id = " . $this->_id;
+		if (!$db->getResult($queryStr)) return false;
+
+		return true;
+	} /* }}} */
+}
+?>

LetoDMS_Core/Core/inc.ClassDMS.php

@@ -17,12 +17,14 @@
 require_once("inc.AccessUtils.php");
 require_once("inc.FileUtils.php");
 require_once("inc.ClassAccess.php");
+require_once("inc.ClassObject.php");
 require_once("inc.ClassFolder.php");
 require_once("inc.ClassDocument.php");
 require_once("inc.ClassGroup.php");
 require_once("inc.ClassUser.php");
 require_once("inc.ClassKeywords.php");
 require_once("inc.ClassNotification.php");
+require_once("inc.ClassAttribute.php");
 
 /**
  * Class to represent the complete document management system.
@@ -443,9 +445,49 @@ class LetoDMS_Core_DMS {
 		return $document;
 	} /* }}} */
 
+	function makeTimeStamp($hour, $min, $sec, $year, $month, $day) {
+		$thirtyone = array (1, 3, 5, 7, 8, 10, 12);
+		$thirty = array (4, 6, 9, 11);
+
+		// Very basic check that the terms are valid. Does not fail for illegal
+		// dates such as 31 Feb.
+		if (!is_numeric($hour) || !is_numeric($min) || !is_numeric($sec) || !is_numeric($year) || !is_numeric($month) || !is_numeric($day) || $month<1 || $month>12 || $day<1 || $day>31 || $hour<0 || $hour>23 || $min<0 || $min>59 || $sec<0 || $sec>59) {
+			return false;
+		}
+		$year = (int) $year;
+		$month = (int) $month;
+		$day = (int) $day;
+
+		if (array_search($month, $thirtyone)) {
+			$max=31;
+		}
+		else if (array_search($month, $thirty)) {
+			$max=30;
+		}
+		else {
+			$max=(($year % 4 == 0) && ($year % 100 != 0 || $year % 400 == 0)) ? 29 : 28;
+		}
+
+		// If the date falls out of bounds, set it to the maximum for the given
+		// month. Makes assumption about the user's intention, rather than failing
+		// for absolutely everything.
+		if ($day>$max) {
+			$day=$max;
+		}
+
+		return mktime($hour, $min, $sec, $month, $day, $year);
+	}
+
 	/*
 	 * Search the database for documents
 	 *
+	 * Note: the creation date will be used to check againts the
+	 * date saved with the document
+	 * or folder. The modification date will only be used for documents. It
+	 * is checked against the creation date of the document content. This
+	 * meanѕ that updateѕ of a document will only result in a searchable
+	 * modification if a new version is uploaded.
+	 *
 	 * @param query string seach query with space separated words
 	 * @param limit integer number of items in result set
 	 * @param offset integer index of first item in result set
@@ -457,14 +499,17 @@ class LetoDMS_Core_DMS {
 	 * @param status array list of status
 	 * @param creationstartdate array search for documents created after this date
 	 * @param creationenddate array search for documents created before this date
+	 * @param modificationstartdate array search for documents modified after this date
+	 * @param modificationenddate array search for documents modified before this date
 	 * @param categories array list of categories the documents must have assigned
+	 * @param attributes array list of attributes
 	 * @param mode int decide whether to search for documents/folders
 	 *        0x1 = documents only
 	 *        0x2 = folders only
 	 *        0x3 = both
 	 * @return array containing the elements total and docs
 	 */
-	function search($query, $limit=0, $offset=0, $logicalmode='AND', $searchin=array(), $startFolder=null, $owner=null, $status = array(), $creationstartdate=array(), $creationenddate=array(), $categories=array(), $mode=0x3) { /* {{{ */
+	function search($query, $limit=0, $offset=0, $logicalmode='AND', $searchin=array(), $startFolder=null, $owner=null, $status = array(), $creationstartdate=array(), $creationenddate=array(), $modificationstartdate=array(), $modificationenddate=array(), $categories=array(), $attributes=array(), $mode=0x3) { /* {{{ */
 		// Split the search string into constituent keywords.
 		$tkeys=array();
 		if (strlen($query)>0) {
@@ -473,29 +518,25 @@ class LetoDMS_Core_DMS {
 
 		// if none is checkd search all
 		if (count($searchin)==0)
-			$searchin=array( 0, 1, 2, 3);
+			$searchin=array( 0, 1, 2, 3, 4);
 
 		/*--------- Do it all over again for folders -------------*/
 		if($mode & 0x2) {
 			$searchKey = "";
-			// Assemble the arguments for the concatenation function. This allows the
-			// search to be carried across all the relevant fields.
-			$concatFunction = "";
 			if (in_array(2, $searchin)) {
-				$concatFunction = (strlen($concatFunction) == 0 ? "" : $concatFunction.", ")."`tblFolders`.`name`";
 				$searchFields[] = "`tblFolders`.`name`";
 			}
 			if (in_array(3, $searchin)) {
-				$concatFunction = (strlen($concatFunction) == 0 ? "" : $concatFunction.", ")."`tblFolders`.`comment`";
 				$searchFields[] = "`tblFolders`.`comment`";
 			}
+			if (in_array(4, $searchin)) {
+				$searchFields[] = "`tblFolderAttributes`.`value`";
+			}
 
-			if (strlen($concatFunction)>0 && count($tkeys)>0) {
+			if (count($searchFields)>0) {
-				$concatFunction = "CONCAT_WS(' ', ".$concatFunction.")";
 				foreach ($tkeys as $key) {
 					$key = trim($key);
 					if (strlen($key)>0) {
-						//$searchKey = (strlen($searchKey)==0 ? "" : $searchKey." ".$logicalmode." ").$concatFunction." LIKE ".$this->db->qstr('%'.$key.'%');
 						$searchKey = (strlen($searchKey)==0 ? "" : $searchKey." ".$logicalmode." ")."(".implode(" like ".$this->db->qstr("%".$key."%")." OR ", $searchFields)." like ".$this->db->qstr("%".$key."%").")";
 					}
 				}
@@ -518,13 +559,13 @@ class LetoDMS_Core_DMS {
 			// Is the search restricted to documents created between two specific dates?
 			$searchCreateDate = "";
 			if ($creationstartdate) {
-				$startdate = makeTimeStamp(0, 0, 0, $creationstartdate['year'], $creationstartdate["month"], $creationstartdate["day"]);
+				$startdate = LetoDMS_Core_DMS::makeTimeStamp($creationstartdate['hour'], $creationstartdate['minute'], $creationstartdate['second'], $creationstartdate['year'], $creationstartdate["month"], $creationstartdate["day"]);
 				if ($startdate) {
 					$searchCreateDate .= "`tblFolders`.`date` >= ".$startdate;
 				}
 			}
 			if ($creationenddate) {
-				$stopdate = makeTimeStamp(23, 59, 59, $creationenddate["year"], $creationenddate["month"], $creationenddate["day"]);
+				$stopdate = LetoDMS_Core_DMS::makeTimeStamp($creationenddate['hour'], $creationstartdate['minute'], $creationstartdate['second'], $creationenddate["year"], $creationenddate["month"], $creationenddate["day"]);
 				if ($stopdate) {
 					if($startdate)
 						$searchCreateDate .= " AND ";
@@ -532,7 +573,7 @@ class LetoDMS_Core_DMS {
 				}
 			}
 
-			$searchQuery = "FROM `tblFolders` WHERE 1=1";
+			$searchQuery = "FROM `tblFolders` LEFT JOIN `tblFolderAttributes` on `tblFolders`.`id`=`tblFolderAttributes`.`folder` WHERE 1=1";
 
 			if (strlen($searchKey)>0) {
 				$searchQuery .= " AND (".$searchKey.")";
@@ -547,41 +588,48 @@ class LetoDMS_Core_DMS {
 				$searchQuery .= " AND (".$searchCreateDate.")";
 			}
 
-			// Count the number of rows that the search will produce.
+			/* Do not search for folders if not at least a search for a key,
-			$resArr = $this->db->getResultArray("SELECT COUNT(*) AS num ".$searchQuery);
+			 * an owner, or creation date is requested.
-			$totalFolders = 0;
+			 */
-			if (is_numeric($resArr[0]["num"]) && $resArr[0]["num"]>0) {
+			if($searchKey || $searchOwner || $searchCreateDate) {
-				$totalFolders = (integer)$resArr[0]["num"];
+				// Count the number of rows that the search will produce.
-			}
+				$resArr = $this->db->getResultArray("SELECT COUNT(*) AS num ".$searchQuery." GROUP BY `tblFolders`.`id`");
-
+				$totalFolders = 0;
-			// If there are no results from the count query, then there is no real need
+				if (is_numeric($resArr[0]["num"]) && $resArr[0]["num"]>0) {
-			// to run the full query. TODO: re-structure code to by-pass additional
+					$totalFolders = (integer)$resArr[0]["num"];
-			// queries when no initial results are found.
-
-			// Only search if the offset is not beyond the number of folders
-			if($totalFolders > $offset) {
-				// Prepare the complete search query, including the LIMIT clause.
-				$searchQuery = "SELECT `tblFolders`.* ".$searchQuery;
-
-				if($limit) {
-					$searchQuery .= " LIMIT ".$offset.",".$limit;
 				}
 
-				// Send the complete search query to the database.
+				// If there are no results from the count query, then there is no real need
-				$resArr = $this->db->getResultArray($searchQuery);
+				// to run the full query. TODO: re-structure code to by-pass additional
-			} else {
+				// queries when no initial results are found.
-				$resArr = array();
-			}
 
-			// ------------------- Ausgabe der Ergebnisse ----------------------------
+				// Only search if the offset is not beyond the number of folders
-			$numResults = count($resArr);
+				if($totalFolders > $offset) {
-			if ($numResults == 0) {
+					// Prepare the complete search query, including the LIMIT clause.
-				$folderresult = array('totalFolders'=>$totalFolders, 'folders'=>array());
+					$searchQuery = "SELECT DISTINCT `tblFolders`.* ".$searchQuery;
-			} else {
+
-				foreach ($resArr as $folderArr) {
+					if($limit) {
-					$folders[] = $this->getFolder($folderArr['id']);
+						$searchQuery .= " LIMIT ".$offset.",".$limit;
+					}
+
+					// Send the complete search query to the database.
+					$resArr = $this->db->getResultArray($searchQuery);
+				} else {
+					$resArr = array();
 				}
-				$folderresult = array('totalFolders'=>$totalFolders, 'folders'=>$folders);
+
+				// ------------------- Ausgabe der Ergebnisse ----------------------------
+				$numResults = count($resArr);
+				if ($numResults == 0) {
+					$folderresult = array('totalFolders'=>$totalFolders, 'folders'=>array());
+				} else {
+					foreach ($resArr as $folderArr) {
+						$folders[] = $this->getFolder($folderArr['id']);
+					}
+					$folderresult = array('totalFolders'=>$totalFolders, 'folders'=>$folders);
+				}
+			} else {
+				$folderresult = array('totalFolders'=>0, 'folders'=>array());
 			}
 		} else {
 			$folderresult = array('totalFolders'=>0, 'folders'=>array());
@@ -591,29 +639,26 @@ class LetoDMS_Core_DMS {
 
 		if($mode & 0x1) {
 			$searchKey = "";
-			// Assemble the arguments for the concatenation function. This allows the
-			// search to be carried across all the relevant fields.
-			$concatFunction = "";
 			$searchFields = array();
 			if (in_array(1, $searchin)) {
-				$concatFunction = "`tblDocuments`.`keywords`";
 				$searchFields[] = "`tblDocuments`.`keywords`";
 			}
 			if (in_array(2, $searchin)) {
-				$concatFunction = (strlen($concatFunction) == 0 ? "" : $concatFunction.", ")."`tblDocuments`.`name`";
 				$searchFields[] = "`tblDocuments`.`name`";
 			}
 			if (in_array(3, $searchin)) {
-				$concatFunction = (strlen($concatFunction) == 0 ? "" : $concatFunction.", ")."`tblDocuments`.`comment`";
 				$searchFields[] = "`tblDocuments`.`comment`";
 			}
+			if (in_array(4, $searchin)) {
+				$searchFields[] = "`tblDocumentAttributes`.`value`";
+				$searchFields[] = "`tblDocumentContentAttributes`.`value`";
+			}
 
-			if (strlen($concatFunction)>0 && count($tkeys)>0) {
+
-				$concatFunction = "CONCAT_WS(' ', ".$concatFunction.")";
+			if (count($searchFields)>0) {
 				foreach ($tkeys as $key) {
 					$key = trim($key);
 					if (strlen($key)>0) {
-						//$searchKey = (strlen($searchKey)==0 ? "" : $searchKey." ".$logicalmode." ").$concatFunction." LIKE ".$this->db->qstr('%'.$key.'%');
 						$searchKey = (strlen($searchKey)==0 ? "" : $searchKey." ".$logicalmode." ")."(".implode(" like ".$this->db->qstr("%".$key."%")." OR ", $searchFields)." like ".$this->db->qstr("%".$key."%").")";
 					}
 				}
@@ -643,22 +688,60 @@ class LetoDMS_Core_DMS {
 				$searchCategories = "`tblDocumentCategory`.`categoryID` in (".implode(',', $catids).")";
 			}
 
+			// Check to see if the search has been restricted to a particular
+			// attribute.
+			$searchAttributes = array();
+			if ($attributes) {
+				foreach($attributes as $attrdefid=>$attribute) {
+					if($attribute) {
+						$attrdef = $this->getAttributeDefinition($attrdefid);
+						if($attrdef->getObjType() == LetoDMS_Core_AttributeDefinition::objtype_document) {
+							if($attrdef->getValueSet())
+								$searchAttributes[] = "`tblDocumentAttributes`.`attrdef`=".$attrdefid." AND `tblDocumentAttributes`.`value`='".$attribute."'";
+							else
+								$searchAttributes[] = "`tblDocumentAttributes`.`attrdef`=".$attrdefid." AND `tblDocumentAttributes`.`value` like '%".$attribute."%'";
+						} elseif($attrdef->getObjType() == LetoDMS_Core_AttributeDefinition::objtype_documentcontent) {
+							if($attrdef->getValueSet())
+								$searchAttributes[] = "`tblDocumentContentAttributes`.`attrdef`=".$attrdefid." AND `tblDocumentContentAttributes`.`value`='".$attribute."'";
+							else
+								$searchAttributes[] = "`tblDocumentContentAttributes`.`attrdef`=".$attrdefid." AND `tblDocumentContentAttributes`.`value` like '%".$attribute."%'";
+						}
+					}
+				}
+			}
+
 			// Is the search restricted to documents created between two specific dates?
 			$searchCreateDate = "";
 			if ($creationstartdate) {
-				$startdate = makeTimeStamp(0, 0, 0, $creationstartdate['year'], $creationstartdate["month"], $creationstartdate["day"]);
+				$startdate = LetoDMS_Core_DMS::makeTimeStamp($creationstartdate['hour'], $creationstartdate['minute'], $creationstartdate['second'], $creationstartdate['year'], $creationstartdate["month"], $creationstartdate["day"]);
 				if ($startdate) {
 					$searchCreateDate .= "`tblDocuments`.`date` >= ".$startdate;
 				}
 			}
 			if ($creationenddate) {
-				$stopdate = makeTimeStamp(23, 59, 59, $creationenddate["year"], $creationenddate["month"], $creationenddate["day"]);
+				$stopdate = LetoDMS_Core_DMS::makeTimeStamp($creationenddate['hour'], $creationenddate['minute'], $creationenddate['second'], $creationenddate["year"], $creationenddate["month"], $creationenddate["day"]);
 				if ($stopdate) {
-					if($startdate)
+					if($searchCreateDate)
 						$searchCreateDate .= " AND ";
 					$searchCreateDate .= "`tblDocuments`.`date` <= ".$stopdate;
 				}
 			}
+			if ($modificationstartdate) {
+				$startdate = LetoDMS_Core_DMS::makeTimeStamp($modificationstartdate['hour'], $modificationstartdate['minute'], $modificationstartdate['second'], $modificationstartdate['year'], $modificationstartdate["month"], $modificationstartdate["day"]);
+				if ($startdate) {
+					if($searchCreateDate)
+						$searchCreateDate .= " AND ";
+					$searchCreateDate .= "`tblDocumentContent`.`date` >= ".$startdate;
+				}
+			}
+			if ($modificationenddate) {
+				$stopdate = LetoDMS_Core_DMS::makeTimeStamp($modificationenddate['hour'], $modificationenddate['minute'], $modificationenddate['second'], $modificationenddate["year"], $modificationenddate["month"], $modificationenddate["day"]);
+				if ($stopdate) {
+					if($searchCreateDate)
+						$searchCreateDate .= " AND ";
+					$searchCreateDate .= "`tblDocumentContent`.`date` <= ".$stopdate;
+				}
+			}
 
 			// ---------------------- Suche starten ----------------------------------
 
@@ -672,6 +755,8 @@ class LetoDMS_Core_DMS {
 
 			$searchQuery = "FROM `tblDocumentContent` ".
 				"LEFT JOIN `tblDocuments` ON `tblDocuments`.`id` = `tblDocumentContent`.`document` ".
+				"LEFT JOIN `tblDocumentAttributes` ON `tblDocuments`.`id` = `tblDocumentAttributes`.`document` ".
+				"LEFT JOIN `tblDocumentContentAttributes` ON `tblDocumentContent`.`id` = `tblDocumentContentAttributes`.`content` ".
 				"LEFT JOIN `tblDocumentStatus` ON `tblDocumentStatus`.`documentID` = `tblDocumentContent`.`document` ".
 				"LEFT JOIN `tblDocumentStatusLog` ON `tblDocumentStatusLog`.`statusID` = `tblDocumentStatus`.`statusID` ".
 				"LEFT JOIN `ttstatid` ON `ttstatid`.`maxLogID` = `tblDocumentStatusLog`.`statusLogID` ".
@@ -696,6 +781,9 @@ class LetoDMS_Core_DMS {
 			if (strlen($searchCreateDate)>0) {
 				$searchQuery .= " AND (".$searchCreateDate.")";
 			}
+			if ($searchAttributes) {
+				$searchQuery .= " AND (".implode(" AND ", $searchAttributes).")";
+			}
 
 			// status
 			if ($status) {
@@ -703,7 +791,7 @@ class LetoDMS_Core_DMS {
 			}
 
 			// Count the number of rows that the search will produce.
-			$resArr = $this->db->getResultArray("SELECT COUNT(*) AS num ".$searchQuery);
+			$resArr = $this->db->getResultArray("SELECT COUNT(*) AS num ".$searchQuery." GROUP BY `tblDocuments`.`id`");
 			$totalDocs = 0;
 			if (is_numeric($resArr[0]["num"]) && $resArr[0]["num"]>0) {
 				$totalDocs = (integer)$resArr[0]["num"];
@@ -714,7 +802,7 @@ class LetoDMS_Core_DMS {
 			// queries when no initial results are found.
 
 			// Prepare the complete search query, including the LIMIT clause.
-			$searchQuery = "SELECT `tblDocuments`.*, ".
+			$searchQuery = "SELECT DISTINCT `tblDocuments`.*, ".
 				"`tblDocumentContent`.`version`, ".
 				"`tblDocumentStatusLog`.`status`, `tblDocumentLocks`.`userID` as `lockUser` ".$searchQuery;
 
@@ -935,12 +1023,13 @@ class LetoDMS_Core_DMS {
 	 * @return object of LetoDMS_Core_User
 	 */
 	function addUser($login, $pwd, $fullName, $email, $language, $theme, $comment, $role='0', $isHidden=0, $isDisabled=0, $pwdexpiration='') { /* {{{ */
+		$db = $this->db;
 		if (is_object($this->getUserByLogin($login))) {
 			return false;
 		}
 		if($role == '')
 			$role = '0';
-		$queryStr = "INSERT INTO tblUsers (login, pwd, fullName, email, language, theme, comment, role, hidden, disabled, pwdExpiration) VALUES ('".$login."', '".$pwd."', '".$fullName."', '".$email."', '".$language."', '".$theme."', '".$comment."', '".$role."', '".$isHidden."', '".$isDisabled."', '".$pwdexpiration."')";
+		$queryStr = "INSERT INTO tblUsers (login, pwd, fullName, email, language, theme, comment, role, hidden, disabled, pwdExpiration) VALUES (".$db->qstr($login).", ".$db->qstr($pwd).", ".$db->qstr($fullName).", ".$db->qstr($email).", '".$language."', '".$theme."', ".$db->qstr($comment).", '".intval($role)."', '".intval($isHidden)."', '".intval($isDisabled)."', ".$db->qstr($pwdexpiration).")";
 		$res = $this->db->getResult($queryStr);
 		if (!$res)
 			return false;
@@ -1032,7 +1121,7 @@ class LetoDMS_Core_DMS {
 			return false;
 		}
 
-		$queryStr = "INSERT INTO tblGroups (name, comment) VALUES ('".$name."', '" . $comment . "')";
+		$queryStr = "INSERT INTO tblGroups (name, comment) VALUES (".$this->db->qstr($name).", ".$this->db->qstr($comment).")";
 		if (!$this->db->getResult($queryStr))
 			return false;
 
@@ -1111,7 +1200,7 @@ class LetoDMS_Core_DMS {
 		if (is_object($this->getKeywordCategoryByName($name, $userID))) {
 			return false;
 		}
-		$queryStr = "INSERT INTO tblKeywordCategories (owner, name) VALUES (".(int) $userID.", '$name')";
+		$queryStr = "INSERT INTO tblKeywordCategories (owner, name) VALUES (".(int) $userID.", ".$this->db->qstr($name).")";
 		if (!$this->db->getResult($queryStr))
 			return false;
 
@@ -1176,7 +1265,7 @@ class LetoDMS_Core_DMS {
 		if (is_object($this->getDocumentCategoryByName($name))) {
 			return false;
 		}
-		$queryStr = "INSERT INTO tblCategory (name) VALUES ('$name')";
+		$queryStr = "INSERT INTO tblCategory (name) VALUES (".$this->db->qstr($name).")";
 		if (!$this->db->getResult($queryStr))
 			return false;
 
@@ -1248,7 +1337,7 @@ class LetoDMS_Core_DMS {
 	 */
 	function createPasswordRequest($user) { /* {{{ */
 		$hash = md5(uniqid(time()));
-		$queryStr = "INSERT INTO tblUserPasswordRequest (userID, hash, `date`) VALUES (" . $user->getId() . ", '" . $hash ."', now())";
+		$queryStr = "INSERT INTO tblUserPasswordRequest (userID, hash, `date`) VALUES (" . $user->getId() . ", " . $this->db->qstr($hash) .", now())";
 		$resArr = $this->db->getResult($queryStr);
 		if (is_bool($resArr) && !$resArr) return false;
 		return $hash;
@@ -1288,6 +1377,111 @@ class LetoDMS_Core_DMS {
 		if (!$this->db->getResult($queryStr))
 			return false;
 		return true;
-	}
+	} /* }}} */
+
+	/**
+	 * Return a attribute definition by its id
+	 *
+	 * This function retrieves a attribute definitionr from the database by
+	 * its id.
+	 *
+	 * @param integer $id internal id of attribute defintion
+	 * @return object instance of LetoDMS_Core_AttributeDefinition or false
+	 */
+	function getAttributeDefinition($id) { /* {{{ */
+		if (!is_numeric($id))
+			return false;
+
+		$queryStr = "SELECT * FROM tblAttributeDefinitions WHERE id = " . (int) $id;
+		$resArr = $this->db->getResultArray($queryStr);
+
+		if (is_bool($resArr) && $resArr == false) return false;
+		if (count($resArr) != 1) return false;
+
+		$resArr = $resArr[0];
+
+		$attrdef = new LetoDMS_Core_AttributeDefinition($resArr["id"], $resArr["name"], $resArr["objtype"], $resArr["type"], $resArr["multiple"], $resArr["minvalues"], $resArr["maxvalues"], $resArr["valueset"]);
+		$attrdef->setDMS($this);
+		return $attrdef;
+	} /* }}} */
+
+	/**
+	 * Return a attribute definition by its name
+	 *
+	 * This function retrieves an attribute def. from the database by its name.
+	 *
+	 * @param string $name internal name of attribute def.
+	 * @return object instance of LetoDMS_Core_AttributeDefinition or false
+	 */
+	function getAttributeDefinitionByName($name) { /* {{{ */
+		$queryStr = "SELECT * FROM tblAttributeDefinitions WHERE name = " . $this->db->qstr($name);
+		$resArr = $this->db->getResultArray($queryStr);
+
+		if (is_bool($resArr) && $resArr == false) return false;
+		if (count($resArr) != 1) return false;
+
+		$resArr = $resArr[0];
+
+		$attrdef = new LetoDMS_Core_AttributeDefinition($resArr["id"], $resArr["name"], $resArr["objtype"], $resArr["type"], $resArr["multiple"], $resArr["minvalues"], $resArr["maxvalues"], $resArr["valueset"]);
+		$attrdef->setDMS($this);
+		return $attrdef;
+	} /* }}} */
+
+	/**
+	 * Return list of all attributes definitions
+	 *
+	 * @param integer $objtype select those attributes defined for an object type
+	 * @return array of instances of LetoDMS_Core_AttributeDefinition or false
+	 */
+	function getAllAttributeDefinitions($objtype=0) { /* {{{ */
+		$queryStr = "SELECT * FROM tblAttributeDefinitions";
+		if($objtype) {
+			if(is_array($objtype))
+				$queryStr .= ' WHERE objtype in (\''.implode("','", $objtype).'\')';
+			else
+				$queryStr .= ' WHERE objtype='.intval($objtype);
+		}
+		$queryStr .= ' ORDER BY name';
+		$resArr = $this->db->getResultArray($queryStr);
+
+		if (is_bool($resArr) && $resArr == false)
+			return false;
+
+		$attrdefs = array();
+
+		for ($i = 0; $i < count($resArr); $i++) {
+			$attrdef = new LetoDMS_Core_AttributeDefinition($resArr[$i]["id"], $resArr[$i]["name"], $resArr[$i]["objtype"], $resArr[$i]["type"], $resArr[$i]["multiple"], $resArr[$i]["minvalues"], $resArr[$i]["maxvalues"], $resArr[$i]["valueset"]);
+			$attrdef->setDMS($this);
+			$attrdefs[$i] = $attrdef;
+		}
+
+		return $attrdefs;
+	} /* }}} */
+
+	/**
+	 * Add a new attribute definition
+	 *
+	 * @param string $name name of attribute
+	 * @param string $type type of attribute
+	 * @param boolean $multiple set to 1 if attribute has multiple attributes
+	 * @param integer $minvalues minimum number of values
+	 * @param integer $maxvalues maximum number of values if multiple is set
+	 * @param string $valueset list of allowed values (csv format)
+	 * @return object of LetoDMS_Core_User
+	 */
+	function addAttributeDefinition($name, $objtype, $type, $multiple=0, $minvalues=0, $maxvalues=1, $valueset='') { /* {{{ */
+		if (is_object($this->getAttributeDefinitionByName($name))) {
+			return false;
+		}
+		if(!$type)
+			return false;
+		$queryStr = "INSERT INTO tblAttributeDefinitions (name, objtype, type, multiple, minvalues, maxvalues, valueset) VALUES (".$this->db->qstr($name).", ".intval($objtype).", ".intval($type).", ".intval($multiple).", ".intval($minvalues).", ".intval($maxvalues).", ".$this->db->qstr($valueset).")";
+		$res = $this->db->getResult($queryStr);
+		if (!$res)
+			return false;
+
+		return $this->getAttributeDefinition($this->db->getInsertID());
+	} /* }}} */
+
 }
 ?>

LetoDMS_Core/Core/inc.ClassDocument.php

@@ -43,12 +43,7 @@ define("S_EXPIRED",  -3);
  *             2010 Matteo Lucarelli, 2010 Uwe Steinmann
  * @version    Release: @package_version@
  */
-class LetoDMS_Core_Document { /* {{{ */
+class LetoDMS_Core_Document extends LetoDMS_Core_Object { /* {{{ */
-	/**
-	 * @var integer unique id of document
-	 */
-	var $_id;
-
 	/**
 	 * @var string name of document
 	 */
@@ -114,13 +109,8 @@ class LetoDMS_Core_Document { /* {{{ */
 	 */
 	var $_sequence;
 
-	/**
-	 * @var object back reference to document management system
-	 */
-	var $_dms;
-
 	function LetoDMS_Core_Document($id, $name, $comment, $date, $expires, $ownerID, $folderID, $inheritAccess, $defaultAccess, $locked, $keywords, $sequence) { /* {{{ */
-		$this->_id = $id;
+		parent::__construct($id);
 		$this->_name = $name;
 		$this->_comment = $comment;
 		$this->_date = $date;
@@ -134,21 +124,6 @@ class LetoDMS_Core_Document { /* {{{ */
 		$this->_sequence = $sequence;
 		$this->_categories = array();
 		$this->_notifyList = array();
-		$this->_dms = null;
-	} /* }}} */
-
-	/*
-	 * Set dms this document belongs to.
-	 *
-	 * Each document needs a reference to the dms it belongs to. It will be
-	 * set when the folder is created by LetoDMS::getDocument() or
-	 * LetoDMS::search(). The dms has a
-	 * references to the currently logged in user and the database connection.
-	 *
-	 * @param object $dms reference to dms
-	 */
-	function setDMS($dms) { /* {{{ */
-		$this->_dms = $dms;
 	} /* }}} */
 
 	/*
@@ -1067,9 +1042,11 @@ class LetoDMS_Core_Document { /* {{{ */
 	 * @param array $reviewers list of reviewers
 	 * @param array $approvers list of approvers
 	 * @param integer $version version number of content or 0 if next higher version shall be used.
+	 * @param array $attributes list of version attributes. The element key
+	 *        must be the id of the attribute definition.
 	 * @return bool/array false in case of an error or a result set
 	 */
-	function addContent($comment, $user, $tmpFile, $orgFileName, $fileType, $mimeType, $reviewers=array(), $approvers=array(), $version=0) { /* {{{ */
+	function addContent($comment, $user, $tmpFile, $orgFileName, $fileType, $mimeType, $reviewers=array(), $approvers=array(), $version=0, $attributes=array()) { /* {{{ */
 		$db = $this->_dms->getDB();
 
 		// the doc path is id/version.filetype
@@ -1094,13 +1071,26 @@ class LetoDMS_Core_Document { /* {{{ */
 						"(".$this->_id.", ".(int)$version.",".$db->qstr($comment).", ".$date.", ".$user->getID().", ".$db->qstr($dir).", ".$db->qstr($orgFileName).", ".$db->qstr($fileType).", ".$db->qstr($mimeType).")";
 		if (!$db->getResult($queryStr)) return false;
 
+		$contentID = $db->getInsertID();
+
 		// copy file
 		if (!LetoDMS_Core_File::makeDir($this->_dms->contentDir . $dir)) return false;
 		if (!LetoDMS_Core_File::copyFile($tmpFile, $this->_dms->contentDir . $dir . $version . $fileType)) return false;
 
 		unset($this->_content);
 		unset($this->_latestContent);
-		$docResultSet = new LetoDMS_Core_AddContentResultSet(new LetoDMS_Core_DocumentContent($this, $version, $comment, $date, $user->getID(), $dir, $orgFileName, $fileType, $mimeType));
+		$content = new LetoDMS_Core_DocumentContent($contentID, $this, $version, $comment, $date, $user->getID(), $dir, $orgFileName, $fileType, $mimeType);
+		$docResultSet = new LetoDMS_Core_AddContentResultSet($content);
+
+		if($attributes) {
+			foreach($attributes as $attrdefid=>$attribute) {
+				if(trim($attribute))
+					if(!$content->setAttributeValue($this->_dms->getAttributeDefinition($attrdefid), $attribute)) {
+						$this->removeContent($content);
+						return false;
+					}
+			}
+		}
 
 		// TODO - verify
 		if ($this->_dms->enableConverting && in_array($docResultSet->_content->getFileType(), array_keys($this->_dms->convertFileTypes)))
@@ -1191,7 +1181,7 @@ class LetoDMS_Core_Document { /* {{{ */
 
 			$this->_content = array();
 			foreach ($resArr as $row)
-				array_push($this->_content, new LetoDMS_Core_DocumentContent($this, $row["version"], $row["comment"], $row["date"], $row["createdBy"], $row["dir"], $row["orgFileName"], $row["fileType"], $row["mimeType"]));
+				array_push($this->_content, new LetoDMS_Core_DocumentContent($row["id"], $this, $row["version"], $row["comment"], $row["date"], $row["createdBy"], $row["dir"], $row["orgFileName"], $row["fileType"], $row["mimeType"]));
 		}
 
 		return $this->_content;
@@ -1223,7 +1213,7 @@ class LetoDMS_Core_Document { /* {{{ */
 			return false;
 
 		$resArr = $resArr[0];
-		return new LetoDMS_Core_DocumentContent($this, $resArr["version"], $resArr["comment"], $resArr["date"], $resArr["createdBy"], $resArr["dir"], $resArr["orgFileName"], $resArr["fileType"], $resArr["mimeType"]);
+		return new LetoDMS_Core_DocumentContent($resArr["id"], $this, $resArr["version"], $resArr["comment"], $resArr["date"], $resArr["createdBy"], $resArr["dir"], $resArr["orgFileName"], $resArr["fileType"], $resArr["mimeType"]);
 	} /* }}} */
 
 	function getLatestContent() { /* {{{ */
@@ -1237,7 +1227,7 @@ class LetoDMS_Core_Document { /* {{{ */
 				return false;
 
 			$resArr = $resArr[0];
-			$this->_latestContent = new LetoDMS_Core_DocumentContent($this, $resArr["version"], $resArr["comment"], $resArr["date"], $resArr["createdBy"], $resArr["dir"], $resArr["orgFileName"], $resArr["fileType"], $resArr["mimeType"]);
+			$this->_latestContent = new LetoDMS_Core_DocumentContent($resArr["id"], $this, $resArr["version"], $resArr["comment"], $resArr["date"], $resArr["createdBy"], $resArr["dir"], $resArr["orgFileName"], $resArr["fileType"], $resArr["mimeType"]);
 		}
 		return $this->_latestContent;
 	} /* }}} */
@@ -1259,6 +1249,10 @@ class LetoDMS_Core_Document { /* {{{ */
 		if (!$db->getResult($queryStr))
 			return false;
 
+		$queryStr = "DELETE FROM tblDocumentContentAttributes WHERE content = " . $version->getId();
+		if (!$db->getResult($queryStr))
+			return false;
+
 		$queryStr = "DELETE FROM `tblDocumentStatusLog` WHERE `statusID` = '".$stID."'";
 		if (!$db->getResult($queryStr))
 			return false;
@@ -1275,6 +1269,7 @@ class LetoDMS_Core_Document { /* {{{ */
 				$emailList[] = $st["required"];
 			}
 		}
+
 		if (strlen($stList)>0) {
 			$queryStr = "DELETE FROM `tblDocumentReviewLog` WHERE `tblDocumentReviewLog`.`reviewID` IN (".$stList.")";
 			if (!$db->getResult($queryStr))
@@ -1463,6 +1458,9 @@ class LetoDMS_Core_Document { /* {{{ */
 				return false;
 
 		$queryStr = "DELETE FROM tblDocuments WHERE id = " . $this->_id;
+		if (!$db->getResult($queryStr))
+			return false;
+		$queryStr = "DELETE FROM tblDocumentAttributes WHERE document = " . $this->_id;
 		if (!$db->getResult($queryStr))
 			return false;
 		$queryStr = "DELETE FROM tblACLs WHERE target = " . $this->_id . " AND targetType = " . T_DOCUMENT;
@@ -1493,7 +1491,6 @@ class LetoDMS_Core_Document { /* {{{ */
 		$db = $this->_dms->getDB();
 
 		if (!isset($this->_approversList)) {
-
 			$this->_approversList = array("groups" => array(), "users" => array());
 			$userIDs = "";
 			$groupIDs = "";
@@ -1525,37 +1522,37 @@ class LetoDMS_Core_Document { /* {{{ */
 			$queryStr="";
 			if ($defAccess < M_READ) {
 				if (strlen($groupIDs)>0) {
-					$queryStr = "SELECT `tblUsers`.* FROM `tblUsers` ".
+					$queryStr = "(SELECT `tblUsers`.* FROM `tblUsers` ".
 						"LEFT JOIN `tblGroupMembers` ON `tblGroupMembers`.`userID`=`tblUsers`.`id` ".
 						"WHERE `tblGroupMembers`.`groupID` IN (". $groupIDs .") ".
-						"AND `tblUsers`.`role` != ".LetoDMS_Core_User::role_guest."";
+						"AND `tblUsers`.`role` != ".LetoDMS_Core_User::role_guest.")";
 				}
 				$queryStr .= (strlen($queryStr)==0 ? "" : " UNION ").
-					"SELECT `tblUsers`.* FROM `tblUsers` ".
+					"(SELECT `tblUsers`.* FROM `tblUsers` ".
 					"WHERE (`tblUsers`.`role` != ".LetoDMS_Core_User::role_guest.") ".
 					"AND ((`tblUsers`.`id` = ". $this->_ownerID . ") ".
 					"OR (`tblUsers`.`role` = ".LetoDMS_Core_User::role_admin.")".
 					(strlen($userIDs) == 0 ? "" : " OR (`tblUsers`.`id` IN (". $userIDs ."))").
-					")";
+					")) ORDER BY `login`";
 			}
 			else {
 				if (strlen($groupIDs)>0) {
-					$queryStr = "SELECT `tblUsers`.* FROM `tblUsers` ".
+					$queryStr = "(SELECT `tblUsers`.* FROM `tblUsers` ".
 						"LEFT JOIN `tblGroupMembers` ON `tblGroupMembers`.`userID`=`tblUsers`.`id` ".
 						"WHERE `tblGroupMembers`.`groupID` NOT IN (". $groupIDs .")".
 						"AND `tblUsers`.`role` != ".LetoDMS_Core_User::role_guest .
-						(strlen($userIDs) == 0 ? "" : " AND (`tblUsers`.`id` NOT IN (". $userIDs ."))");
+						(strlen($userIDs) == 0 ? ")" : " AND (`tblUsers`.`id` NOT IN (". $userIDs .")))");
 				}
 				$queryStr .= (strlen($queryStr)==0 ? "" : " UNION ").
-					"SELECT `tblUsers`.* FROM `tblUsers` ".
+					"(SELECT `tblUsers`.* FROM `tblUsers` ".
 					"WHERE (`tblUsers`.`id` = ". $this->_ownerID . ") ".
-					"OR (`tblUsers`.`role` = ".LetoDMS_Core_User::role_admin.") ".
+					"OR (`tblUsers`.`role` = ".LetoDMS_Core_User::role_admin."))".
 					"UNION ".
-					"SELECT `tblUsers`.* FROM `tblUsers` ".
+					"(SELECT `tblUsers`.* FROM `tblUsers` ".
 					"WHERE `tblUsers`.`role` != ".LetoDMS_Core_User::role_guest .
-					(strlen($userIDs) == 0 ? "" : " AND (`tblUsers`.`id` NOT IN (". $userIDs ."))");
+					(strlen($userIDs) == 0 ? ")" : " AND (`tblUsers`.`id` NOT IN (". $userIDs .")))").
+					" ORDER BY `login`";
 			}
-			$queryStr = "SELECT * FROM (".$queryStr.") ORDER BY `login`";
 			$resArr = $db->getResultArray($queryStr);
 			if (!is_bool($resArr)) {
 				foreach ($resArr as $row) {
@@ -1663,7 +1660,7 @@ class LetoDMS_Core_Document { /* {{{ */
  *             2010 Uwe Steinmann
  * @version    Release: @package_version@
  */
-class LetoDMS_Core_DocumentContent { /* {{{ */
+class LetoDMS_Core_DocumentContent extends LetoDMS_Core_Object { /* {{{ */
 
 	// if status is released and there are reviewers set status draft_rev
 	// if status is released or draft_rev and there are approves set status draft_app
@@ -1677,7 +1674,7 @@ class LetoDMS_Core_DocumentContent { /* {{{ */
 
 		$pendingReview=false;
 		unset($this->_reviewStatus);  // force to be reloaded from DB
-		$reviewStatus=$this->getReviewStatus(true);
+		$reviewStatus=$this->getReviewStatus();
 		if (is_array($reviewStatus) && count($reviewStatus)>0) {
 			foreach ($reviewStatus as $r){
 				if ($r["status"]==0){
@@ -1688,7 +1685,7 @@ class LetoDMS_Core_DocumentContent { /* {{{ */
 		}
 		$pendingApproval=false;
 		unset($this->_approvalStatus);  // force to be reloaded from DB
-		$approvalStatus=$this->getApprovalStatus(true);
+		$approvalStatus=$this->getApprovalStatus();
 		if (is_array($approvalStatus) && count($approvalStatus)>0) {
 			foreach ($approvalStatus as $a){
 				if ($a["status"]==0){
@@ -1697,12 +1694,14 @@ class LetoDMS_Core_DocumentContent { /* {{{ */
 				}
 			}
 		}
+
 		if ($pendingReview) $this->setStatus(S_DRAFT_REV,"",$user);
 		else if ($pendingApproval) $this->setStatus(S_DRAFT_APP,"",$user);
 		else $this->setStatus(S_RELEASED,"",$user);
 	} /* }}} */
 
-	function LetoDMS_Core_DocumentContent($document, $version, $comment, $date, $userID, $dir, $orgFileName, $fileType, $mimeType) { /* {{{ */
+	function LetoDMS_Core_DocumentContent($id, $document, $version, $comment, $date, $userID, $dir, $orgFileName, $fileType, $mimeType) { /* {{{ */
+		parent::__construct($id);
 		$this->_document = $document;
 		$this->_version = (int) $version;
 		$this->_comment = $comment;
@@ -1712,6 +1711,7 @@ class LetoDMS_Core_DocumentContent { /* {{{ */
 		$this->_orgFileName = $orgFileName;
 		$this->_fileType = $fileType;
 		$this->_mimeType = $mimeType;
+		$this->_dms = $document->_dms;
 	} /* }}} */
 
 	function getVersion() { return $this->_version; }
@@ -1722,11 +1722,14 @@ class LetoDMS_Core_DocumentContent { /* {{{ */
 	function getFileName(){ return "data" . $this->_fileType; }
 	function getDir() { return $this->_dir; }
 	function getMimeType() { return $this->_mimeType; }
+	function getDocument() { return $this->_document; }
+
 	function getUser() { /* {{{ */
 		if (!isset($this->_user))
 			$this->_user = $this->_document->_dms->getUser($this->_userID);
 		return $this->_user;
 	} /* }}} */
+
 	function getPath() { return $this->_document->getDir() . $this->_version . $this->_fileType; }
 
 	function setComment($newComment) { /* {{{ */
@@ -1927,7 +1930,7 @@ class LetoDMS_Core_DocumentContent { /* {{{ */
 			if($recs) {
 				foreach($recs as $rec) {
 					$queryStr=
-						"SELECT `tblDocumentReviewers`.*, `tblDocumentReviewLog`.`status`, ".
+						"SELECT `tblDocumentReviewers`.*, `tblDocumentReviewLog`.`reviewLogID`, `tblDocumentReviewLog`.`status`, ".
 						"`tblDocumentReviewLog`.`comment`, `tblDocumentReviewLog`.`date`, ".
 						"`tblDocumentReviewLog`.`userID`, `tblUsers`.`fullName`, `tblGroups`.`name` AS `groupName` ".
 						"FROM `tblDocumentReviewers` ".
@@ -2134,8 +2137,10 @@ class LetoDMS_Core_DocumentContent { /* {{{ */
 		$res=$db->getResult($queryStr);
 		if (is_bool($res) && !$res)
 			return -1;
-		else
+		else {
-			return 0;
+			$reviewLogID = $db->getInsertID();
+			return $reviewLogID;
+		}
  } /* }}} */
 
 	function setReviewByGrp($group, $requestUser, $status, $comment) { /* {{{ */
@@ -2168,8 +2173,10 @@ class LetoDMS_Core_DocumentContent { /* {{{ */
 		$res=$db->getResult($queryStr);
 		if (is_bool($res) && !$res)
 			return -1;
-		else
+		else {
-			return 0;
+			$reviewLogID = $db->getInsertID();
+			return $reviewLogID;
+		}
  } /* }}} */
 
 	function addIndApprover($user, $requestUser) { /* {{{ */
@@ -2224,7 +2231,8 @@ class LetoDMS_Core_DocumentContent { /* {{{ */
 			return -1;
 		}
 
-		return 0;
+		$approveLogID = $db->getInsertID();
+		return $approveLogID;
 	} /* }}} */
 
 	function addGrpApprover($group, $requestUser) { /* {{{ */
@@ -2282,7 +2290,8 @@ class LetoDMS_Core_DocumentContent { /* {{{ */
 		// Add approver to event notification table.
 		//$this->_document->addNotify($groupID, false);
 
-		return 0;
+		$approveLogID = $db->getInsertID();
+		return $approveLogID;
 	} /* }}} */
 
 	/**

LetoDMS_Core/Core/inc.ClassFolder.php

@@ -27,12 +27,7 @@
  *             2010 Matteo Lucarelli, 2010 Uwe Steinmann
  * @version    Release: @package_version@
  */
-class LetoDMS_Core_Folder {
+class LetoDMS_Core_Folder extends LetoDMS_Core_Object {
-	/**
-	 * @var integer unique id of folder
-	 */
-	var $_id;
-
 	/**
 	 * @var string name of folder
 	 */
@@ -73,12 +68,8 @@ class LetoDMS_Core_Folder {
 	 */
 	var $_sequence;
 
-	/**
-	 * @var object back reference to document management system
-	 */
-	var $_dms;
-
 	function LetoDMS_Core_Folder($id, $name, $parentID, $comment, $date, $ownerID, $inheritAccess, $defaultAccess, $sequence) { /* {{{ */
+		parent::__construct($id);
 		$this->_id = $id;
 		$this->_name = $name;
 		$this->_parentID = $parentID;
@@ -89,20 +80,6 @@ class LetoDMS_Core_Folder {
 		$this->_defaultAccess = $defaultAccess;
 		$this->_sequence = $sequence;
 		$this->_notifyList = array();
-		$this->_dms = null;
-	} /* }}} */
-
-	/*
-	 * Set dms this folder belongs to.
-	 *
-	 * Each folder needs a reference to the dms it belongs to. It will be
-	 * set when the folder is created by LetoDMS::getFolder(). The dms has a
-	 * references to the currently logged in user and the database connection.
-	 *
-	 * @param object $dms reference to dms
-	 */
-	function setDMS($dms) { /* {{{ */
-		$this->_dms = $dms;
 	} /* }}} */
 
 	/*
@@ -370,7 +347,19 @@ class LetoDMS_Core_Folder {
 		return $this->_subFolders;
 	} /* }}} */
 
-	function addSubFolder($name, $comment, $owner, $sequence) { /* {{{ */
+	/**
+	 * Add a new subfolder
+	 *
+	 * @param string $name name of folder
+	 * @param string $comment comment of folder
+	 * @param object $owner owner of folder
+	 * @param integer $sequence position of folder in list of sub folders.
+	 * @param array $attributes list of document attributes. The element key
+	 *        must be the id of the attribute definition.
+	 * @return object object of type LetoDMS_Core_Folder or false in case of
+	 *         an error.
+	 */
+	function addSubFolder($name, $comment, $owner, $sequence, $attributes) { /* {{{ */
 		$db = $this->_dms->getDB();
 
 		// Set the folderList of the folder
@@ -390,6 +379,16 @@ class LetoDMS_Core_Folder {
 		$newFolder = $this->_dms->getFolder($db->getInsertID());
 		unset($this->_subFolders);
 
+		if($attributes) {
+			foreach($attributes as $attrdefid=>$attribute) {
+				if(trim($attribute))
+					if(!$newFolder->setAttributeValue($this->_dms->getAttributeDefinition($attrdefid), $attribute)) {
+						$newFolder->remove();
+						return false;
+					}
+			}
+		}
+
 		return $newFolder;
 	} /* }}} */
 
@@ -503,11 +502,15 @@ class LetoDMS_Core_Folder {
 	 * @param string $reqversion version number of the content
 	 * @param string $version_comment comment of the content. If left empty
 	 *        the $comment will be used.
+	 * @param array $attributes list of document attributes. The element key
+	 *        must be the id of the attribute definition.
+	 * @param array $version_attributes list of document version attributes.
+	 *        The element key must be the id of the attribute definition.
 	 * @return array/boolean false in case of error, otherwise an array
 	 *        containing two elements. The first one is the new document, the
 	 *        second one is the result set returned when inserting the content.
 	 */
-	function addDocument($name, $comment, $expires, $owner, $keywords, $categories, $tmpFile, $orgFileName, $fileType, $mimeType, $sequence, $reviewers=array(), $approvers=array(),$reqversion,$version_comment="") { /* {{{ */
+	function addDocument($name, $comment, $expires, $owner, $keywords, $categories, $tmpFile, $orgFileName, $fileType, $mimeType, $sequence, $reviewers=array(), $approvers=array(),$reqversion,$version_comment="", $attributes=array(), $version_attributes=array()) { /* {{{ */
 		$db = $this->_dms->getDB();
 
 		$expires = (!$expires) ? 0 : $expires;
@@ -530,8 +533,8 @@ class LetoDMS_Core_Folder {
 		$document = $this->_dms->getDocument($db->getInsertID());
 
 		if ($version_comment!="")
-			$res = $document->addContent($version_comment, $owner, $tmpFile, $orgFileName, $fileType, $mimeType, $reviewers, $approvers,$reqversion);
+			$res = $document->addContent($version_comment, $owner, $tmpFile, $orgFileName, $fileType, $mimeType, $reviewers, $approvers,$reqversion, $version_attributes);
-		else $res = $document->addContent($comment, $owner, $tmpFile, $orgFileName, $fileType, $mimeType, $reviewers, $approvers,$reqversion);
+		else $res = $document->addContent($comment, $owner, $tmpFile, $orgFileName, $fileType, $mimeType, $reviewers, $approvers,$reqversion, $version_attributes);
 
 		if (is_bool($res) && !$res) {
 			$queryStr = "DELETE FROM tblDocuments WHERE id = " . $document->getID();
@@ -542,6 +545,17 @@ class LetoDMS_Core_Folder {
 		if($categories) {
 			$document->setCategories($categories);
 		}
+
+		if($attributes) {
+			foreach($attributes as $attrdefid=>$attribute) {
+				if(trim($attribute))
+					if(!$document->setAttributeValue($this->_dms->getAttributeDefinition($attrdefid), $attribute)) {
+						$document->remove();
+						return false;
+					}
+			}
+		}
+
 		return array($document, $res);
 	} /* }}} */
 
@@ -560,17 +574,20 @@ class LetoDMS_Core_Folder {
 		if (is_bool($res) && !$res) return false;
 
 		foreach ($this->_subFolders as $subFolder) {
-			$res = $subFolder->remove(FALSE);
+			$res = $subFolder->remove();
 			if (!$res) return false;
 		}
 
 		foreach ($this->_documents as $document) {
-			$res = $document->remove(FALSE);
+			$res = $document->remove();
 			if (!$res) return false;
 		}
 
 		//Entfernen der Datenbankeinträge
 		$queryStr = "DELETE FROM tblFolders WHERE id =  " . $this->_id;
+		if (!$db->getResult($queryStr))
+			return false;
+		$queryStr = "DELETE FROM tblFolderAttributes WHERE folder =  " . $this->_id;
 		if (!$db->getResult($queryStr))
 			return false;
 		$queryStr = "DELETE FROM tblACLs WHERE target = ". $this->_id. " AND targetType = " . T_FOLDER;

LetoDMS_Core/Core/inc.ClassObject.php

@@ -0,0 +1,162 @@
+<?php
+/**
+ * Implementation of an generic object in the document management system
+ *
+ * @category   DMS
+ * @package    LetoDMS_Core
+ * @license    GPL2
+ * @author     Uwe Steinmann <uwe@steinmann.cx>
+ * @copyright  Copyright (C) 2010-2012 Uwe Steinmann
+ * @version    Release: @package_version@
+ */
+
+
+/**
+ * Class to represent a generic object in the document management system
+ *
+ * This is the base class for generic objects in LetoDMS.
+ *
+ * @category   DMS
+ * @package    LetoDMS_Core
+ * @author     Uwe Steinmann <uwe@steinmann.cx>
+ * @copyright  Copyright (C) 2010-2012 Uwe Steinmann
+ * @version    Release: @package_version@
+ */
+class LetoDMS_Core_Object { /* {{{ */
+	/**
+	 * @var integer unique id of object
+	 */
+	var $_id;
+
+	/**
+	 * @var array list of attributes
+	 */
+	var $_attributes;
+
+	/**
+	 * @var object back reference to document management system
+	 */
+	var $_dms;
+
+	function LetoDMS_Core_Object($id) { /* {{{ */
+		$this->_id = $id;
+		$this->_dms = null;
+	} /* }}} */
+
+	/*
+	 * Set dms this object belongs to.
+	 *
+	 * Each object needs a reference to the dms it belongs to. It will be
+	 * set when the object is created.
+	 * The dms has a references to the currently logged in user
+	 * and the database connection.
+	 *
+	 * @param object $dms reference to dms
+	 */
+	function setDMS($dms) { /* {{{ */
+		$this->_dms = $dms;
+	} /* }}} */
+
+	/*
+	 * Return the internal id of the document
+	 *
+	 * @return integer id of document
+	 */
+	function getID() { return $this->_id; }
+
+	/**
+	 * Returns all attributes set for the object
+	 *
+	 * @return array list of objects of class LetoDMS_Core_Attribute
+	 */
+	function getAttributes() { /* {{{ */
+		if (!$this->_attributes) {
+			$db = $this->_dms->getDB();
+
+			switch(get_class($this)) {
+				case "LetoDMS_Core_Document":
+					$queryStr = "SELECT * FROM tblDocumentAttributes WHERE document = " . $this->_id." ORDER BY `id`";
+					break;
+				case "LetoDMS_Core_DocumentContent":
+					$queryStr = "SELECT * FROM tblDocumentContentAttributes WHERE content = " . $this->_id." ORDER BY `id`";
+					break;
+				case "LetoDMS_Core_Folder":
+					$queryStr = "SELECT * FROM tblFolderAttributes WHERE folder = " . $this->_id." ORDER BY `id`";
+					break;
+				default:
+					return false;
+			}
+			$resArr = $db->getResultArray($queryStr);
+			if (is_bool($resArr) && !$resArr) return false;
+
+			$this->_attributes = array();
+
+			foreach ($resArr as $row) {
+				$attrdef = $this->_dms->getAttributeDefinition($row['attrdef']);
+				$attr = new LetoDMS_Core_Attribute($row["id"], $this, $attrdef, $row["value"]);
+				$attr->setDMS($this->_dms);
+				$this->_attributes[$attrdef->getId()] = $attr;
+			}
+		}
+		return $this->_attributes;
+
+	} /* }}} */
+
+	/**
+	 * Returns an attribute of the object for the given attribute definition
+	 *
+	 * @return object object of class LetoDMS_Core_Attribute or false
+	 */
+	function getAttributeValue($attrdef) { /* {{{ */
+		if (!$this->_attributes) {
+			$this->getAttributes();
+		}
+
+		if (isset($this->_attributes[$attrdef->getId()]))
+			return $this->_attributes[$attrdef->getId()]->getValue();
+		else
+			return false;
+
+	} /* }}} */
+
+	/**
+	 * Set an attribute of the object for the given attribute definition
+	 *
+	 * @return boolean true if operation was successful, otherwise false
+	 */
+	function setAttributeValue($attrdef, $value) { /* {{{ */
+		$db = $this->_dms->getDB();
+		if (!$this->_attributes) {
+			$this->getAttributes();
+		}
+		if(!isset($this->_attributes[$attrdef->getId()])) {
+			switch(get_class($this)) {
+				case "LetoDMS_Core_Document":
+					$queryStr = "INSERT INTO tblDocumentAttributes (document, attrdef, value) VALUES (".$this->_id.", ".$attrdef->getId().", ".$db->qstr($value).")";
+					break;
+				case "LetoDMS_Core_DocumentContent":
+					$queryStr = "INSERT INTO tblDocumentContentAttributes (content, attrdef, value) VALUES (".$this->_id.", ".$attrdef->getId().", ".$db->qstr($value).")";
+					break;
+				case "LetoDMS_Core_Folder":
+					$queryStr = "INSERT INTO tblFolderAttributes (folder, attrdef, value) VALUES (".$this->_id.", ".$attrdef->getId().", ".$db->qstr($value).")";
+					break;
+				default:
+					return false;
+			}
+			$res = $db->getResult($queryStr);
+			if (!$res)
+				return false;
+
+			$attr = new LetoDMS_Core_Attribute($db->getInsertID(), $this, $attrdef, $value);
+			$attr->setDMS($this->_dms);
+			$this->_attributes[$attrdef->getId()] = $attr;
+			return true;
+		}
+
+		$this->_attributes[$attrdef->getId()]->setValue($value);
+
+		return true;
+	} /* }}} */
+
+} /* }}} */
+?>

LetoDMS_Core/Core/inc.ClassUser.php

@@ -359,7 +359,7 @@ class LetoDMS_Core_User {
 	 * to a different user.
 	 *
 	 * @param object $user the user doing the removal (needed for entry in
-	 *        review log.
+	 *        review and approve log).
 	 * @param object $assignToUser the user who is new owner of folders and
 	 *        documents which previously were owned by the delete user.
 	 * @return boolean true on success or false in case of an error
@@ -547,6 +547,7 @@ class LetoDMS_Core_User {
 			$this->_groups = array();
 			foreach ($resArr as $row) {
 				$group = new LetoDMS_Core_Group($row["id"], $row["name"], $row["comment"]);
+				$group->setDMS($this->_dms);
 				array_push($this->_groups, $group);
 			}
 		}

LetoDMS_Core/package.xml

@@ -18,11 +18,11 @@
   <email></email>
   <active>no</active>
  </lead>
- <date>2012-02-13</date>
+ <date>2012-10-17</date>
- <time>08:05:38</time>
+ <time>09:12:59</time>
  <version>
-  <release>3.4.0</release>
+  <release>3.4.0RC2</release>
-  <api>3.4.0</api>
+  <api>3.4.0RC2</api>
  </version>
  <stability>
   <release>beta</release>
@@ -30,7 +30,7 @@
  </stability>
  <license uri="http://opensource.org/licenses/gpl-license">GPL License</license>
  <notes>
-- added PDO database driver, several sql changes for better compatiblity
+- fixed bug when adding a new document category
  </notes>
  <contents>
   <dir baseinstalldir="LetoDMS" name="/">
@@ -53,6 +53,9 @@
     <file name="inc.DBAccess.php" role="php">
      <tasks:replace from="@package_version@" to="version" type="package-info" />
     </file>
+    <file name="inc.DBAccessPDO.php" role="php">
+     <tasks:replace from="@package_version@" to="version" type="package-info" />
+    </file>
     <file name="inc.AccessUtils.php" role="php">
      <tasks:replace from="@package_version@" to="version" type="package-info" />
     </file>
@@ -71,6 +74,12 @@
     <file name="inc.ClassDocumentCategory.php" role="php">
      <tasks:replace from="@package_version@" to="version" type="package-info" />
     </file>
+    <file name="inc.ClassObject.php" role="php">
+     <tasks:replace from="@package_version@" to="version" type="package-info" />
+    </file>
+    <file name="inc.ClassAttribute.php" role="php">
+     <tasks:replace from="@package_version@" to="version" type="package-info" />
+    </file>
    </dir> <!-- /DTD -->
    <dir name="tests">
     <file name="getfoldertree.php" role="test" />
@@ -239,5 +248,69 @@ New release
 - no changes, just keep same version as letodms application
    </notes>
   </release>
+  <release>
+   <date>2012-08-25</date>
+   <time>22:07:58</time>
+   <version>
+    <release>3.3.7</release>
+    <api>3.3.7</api>
+   </version>
+   <stability>
+    <release>beta</release>
+    <api>stable</api>
+   </stability>
+   <license uri="http://opensource.org/licenses/gpl-license">GPL License</license>
+   <notes>
+- no changes, just keep same version as letodms application
+   </notes>
+  </release>
+  <release>
+   <date>2012-09-16</date>
+   <time>22:14:08</time>
+   <version>
+    <release>3.3.8</release>
+    <api>3.3.8</api>
+   </version>
+   <stability>
+    <release>beta</release>
+    <api>stable</api>
+   </stability>
+   <license uri="http://opensource.org/licenses/gpl-license">GPL License</license>
+   <notes>
+- more sql injection protection in LetoDMS_Core_User
+   </notes>
+  </release>
+  <release>
+   <date>2012-09-19</date>
+   <time>08:43:18</time>
+   <version>
+    <release>3.3.9</release>
+    <api>3.3.9</api>
+   </version>
+   <stability>
+    <release>beta</release>
+    <api>stable</api>
+   </stability>
+   <license uri="http://opensource.org/licenses/gpl-license">GPL License</license>
+   <notes>
+- version update to be in sync with letodms application
+   </notes>
+  </release>
+  <release>
+   <date>2012-10-08</date>
+   <time>08:05:38</time>
+   <version>
+    <release>3.4.0RC1</release>
+    <api>3.4.0RC1</api>
+   </version>
+   <stability>
+    <release>beta</release>
+    <api>stable</api>
+   </stability>
+   <license uri="http://opensource.org/licenses/gpl-license">GPL License</license>
+   <notes>
+- added PDO database driver, several sql changes for better compatiblity
+   </notes>
+  </release>
  </changelog>
 </package>

LetoDMS_Lucene/Lucene/IndexedDocument.php

@@ -27,9 +27,9 @@ class LetoDMS_Lucene_IndexedDocument extends Zend_Search_Lucene_Document {
 	 * Constructor. Creates our indexable document and adds all
 	 * necessary fields to it using the passed in document
 	 */
-	public function __construct($dms, $document, $convcmd=null) {
+	public function __construct($dms, $document, $convcmd=null, $nocontent=false) {
 		$_convcmd = array(
-			'application/pdf' => 'pdftotext -nopgbrk %s - |sed -e \'s/ [a-zA-Z0-9.]\{1\} / /g\' -e \'s/[0-9.]//g\'',
+			'application/pdf' => 'pdftotext -enc UTF-8 -nopgbrk %s - |sed -e \'s/ [a-zA-Z0-9.]\{1\} / /g\' -e \'s/[0-9.]//g\'',
 			'application/msword' => 'catdoc %s',
 			'application/vnd.ms-excel' => 'ssconvert -T Gnumeric_stf:stf_csv -S %s fd://1',
 			'audio/mp3' => "id3 -l -R %s | egrep '(Title|Artist|Album)' | sed 's/^[^:]*: //g'",
@@ -39,10 +39,24 @@ class LetoDMS_Lucene_IndexedDocument extends Zend_Search_Lucene_Document {
 		if($convcmd) {
 			$_convcmd = $convcmd;
 		}
+
 		$version = $document->getLatestContent();
 		$this->addField(Zend_Search_Lucene_Field::Keyword('document_id', $document->getID()));
-		$this->addField(Zend_Search_Lucene_Field::Keyword('mimetype', $version->getMimeType()));
+		if($version) {
-		$this->addField(Zend_Search_Lucene_Field::UnIndexed('created', $version->getDate()));
+			$this->addField(Zend_Search_Lucene_Field::Keyword('mimetype', $version->getMimeType()));
+			$this->addField(Zend_Search_Lucene_Field::Keyword('origfilename', $version->getOriginalFileName()));
+			if(!$nocontent)
+				$this->addField(Zend_Search_Lucene_Field::UnIndexed('created', $version->getDate()));
+			if($attributes = $version->getAttributes()) {
+				foreach($attributes as $attribute) {
+					$attrdef = $attribute->getAttributeDefinition();
+					if($attrdef->getValueSet() != '')
+						$this->addField(Zend_Search_Lucene_Field::Keyword('attr_'.str_replace(' ', '_', $attrdef->getName()), $attribute->getValue()));
+					else
+						$this->addField(Zend_Search_Lucene_Field::Text('attr_'.str_replace(' ', '_', $attrdef->getName()), $attribute->getValue()));
+				}
+			}
+		}
 		$this->addField(Zend_Search_Lucene_Field::Text('title', $document->getName()));
 		if($categories = $document->getCategories()) {
 			$names = array();
@@ -51,6 +65,16 @@ class LetoDMS_Lucene_IndexedDocument extends Zend_Search_Lucene_Document {
 			}
 			$this->addField(Zend_Search_Lucene_Field::Text('category', implode(' ', $names)));
 		}
+		if($attributes = $document->getAttributes()) {
+			foreach($attributes as $attribute) {
+				$attrdef = $attribute->getAttributeDefinition();
+				if($attrdef->getValueSet() != '')
+					$this->addField(Zend_Search_Lucene_Field::Keyword('attr_'.str_replace(' ', '_', $attrdef->getName()), $attribute->getValue()));
+				else
+					$this->addField(Zend_Search_Lucene_Field::Text('attr_'.str_replace(' ', '_', $attrdef->getName()), $attribute->getValue()));
+			}
+		}
+
 		$owner = $document->getOwner();
 		$this->addField(Zend_Search_Lucene_Field::Text('owner', $owner->getLogin()));
 		if($keywords = $document->getKeywords()) {
@@ -59,22 +83,24 @@ class LetoDMS_Lucene_IndexedDocument extends Zend_Search_Lucene_Document {
 		if($comment = $document->getComment()) {
 			$this->addField(Zend_Search_Lucene_Field::Text('comment', $comment));
 		}
-		$path = $dms->contentDir . $version->getPath();
+		if($version && !$nocontent) {
-		$content = '';
+			$path = $dms->contentDir . $version->getPath();
-		$fp = null;
+			$content = '';
-		$mimetype = $version->getMimeType();
+			$fp = null;
-		if(isset($_convcmd[$mimetype])) {
+			$mimetype = $version->getMimeType();
-			$cmd = sprintf($_convcmd[$mimetype], $path);
+			if(isset($_convcmd[$mimetype])) {
-			$fp = popen($cmd, 'r');
+				$cmd = sprintf($_convcmd[$mimetype], $path);
-			if($fp) {
+				$fp = popen($cmd, 'r');
-				$content = '';
+				if($fp) {
-				while(!feof($fp)) {
+					$content = '';
-					$content .= fread($fp, 2048);
+					while(!feof($fp)) {
+						$content .= fread($fp, 2048);
+					}
+					pclose($fp);
+				}
+				if($content) {
+					$this->addField(Zend_Search_Lucene_Field::UnStored('content', $content, 'utf-8'));
 				}
-				pclose($fp);
-			}
-			if($content) {
-				$this->addField(Zend_Search_Lucene_Field::UnStored('content', $content, 'utf-8'));
 			}
 		}
 	}

LetoDMS_Lucene/Lucene/Indexer.php

@@ -22,22 +22,36 @@
  * @copyright  Copyright (C) 2011, Uwe Steinmann
  * @version    Release: @package_version@
  */
-class LetoDMS_Lucene_Indexer extends Zend_Search_Lucene {
+class LetoDMS_Lucene_Indexer {
 	/**
 	 * @var string $indexname name of lucene index
 	 * @access protected
 	 */
 	protected $indexname;
 
+	function open($luceneDir) { /* {{{ */
+		$index = Zend_Search_Lucene::open($luceneDir);
+		return($index);
+	} /* }}} */
+
+	function create($luceneDir) { /* {{{ */
+		$index = Zend_Search_Lucene::create($luceneDir);
+		return($index);
+	} /* }}} */
+
 	/**
-	 * Create a new index
+	 * Do some initialization
 	 *
-	 * @return object instance of LetoDMS_Lucene_Search
 	 */
-	function __construct() { /* {{{ */
+	function init($stopWordsFile='') { /* {{{ */
-		$this->version = '@package_version@';
+		$analyzer = new Zend_Search_Lucene_Analysis_Analyzer_Common_Utf8_CaseInsensitive();
-		if($this->version[0] == '@')
+		if($stopWordsFile && file_exists($stopWordsFile)) {
-			$this->version = '3.0.0';
+			$stopWordsFilter = new Zend_Search_Lucene_Analysis_TokenFilter_StopWords();
+			$stopWordsFilter->loadFromFile($stopWordsFile);
+			$analyzer->addFilter($stopWordsFilter);
+		}
+		 
+		Zend_Search_Lucene_Analysis_Analyzer::setDefault($analyzer);
 	} /* }}} */
 
 

LetoDMS_Lucene/Lucene/Search.php

@@ -48,10 +48,13 @@ class LetoDMS_Lucene_Search {
 	 * @param object $index lucene index
 	 * @return object instance of LetoDMS_Lucene_Search
 	 */
-	function search($term, $owner, $status='', $categories=array()) { /* {{{ */
+	function search($term, $owner, $status='', $categories=array(), $fields=array()) { /* {{{ */
 		$query = '';
-		if($term)
+		if($fields) {
-			$query .= trim($term);
+		} else {
+			if($term)
+				$query .= trim($term);
+		}
 		if($owner) {
 			if($query)
 				$query .= ' && ';

LetoDMS_Lucene/package.xml

@@ -14,8 +14,8 @@
  <date>2011-11-06</date>
  <time>08:05:38</time>
  <version>
-  <release>1.0.1</release>
+  <release>1.1.0</release>
-  <api>1.0.0</api>
+  <api>1.1.0</api>
  </version>
  <stability>
   <release>beta</release>
@@ -23,7 +23,8 @@
  </stability>
  <license uri="http://opensource.org/licenses/gpl-license">GPL License</license>
  <notes>
-- New Release
+use a configurable list of mime type converters, fixed indexing and searching
+of special chars like german umlaute.
  </notes>
  <contents>
   <dir baseinstalldir="LetoDMS" name="/">
@@ -71,5 +72,21 @@
    <notes>
    </notes>
   </release>
+  <release>
+   <date>2011-11-06</date>
+   <time>08:05:38</time>
+   <version>
+    <release>1.0.1</release>
+    <api>1.0.0</api>
+   </version>
+   <stability>
+    <release>beta</release>
+    <api>beta</api>
+   </stability>
+   <license uri="http://opensource.org/licenses/gpl-license">GPL License</license>
+   <notes>
+- New Release
+   </notes>
+  </release>
  </changelog>
 </package>

Makefile

@@ -1,5 +1,5 @@
-VERSION=3.4.0-pre1
+VERSION=3.4.0RC2
-SRC=CHANGELOG* inc conf utils index.php languages op out README README.Notification reset_db.sql drop-tables-innodb.sql delete_all_contents.sql styles js TODO LICENSE Makefile webdav install
+SRC=CHANGELOG* inc conf utils index.php languages op out README README.Notification drop-tables-innodb.sql delete_all_contents.sql styles js TODO LICENSE Makefile webdav install
 
 dist:
 	mkdir -p tmp/letoDMS-$(VERSION)

conf/stopwords.txt

@@ -1 +1,679 @@
-a an ab auf und im in zu of to
+a
+ab
+aber
+als
+am
+an
+auch
+auf
+aus
+bei
+bin
+bis
+ist
+da
+dadurch
+daher
+darum
+das
+daß
+dass
+dass
+dein
+deine
+dem
+den
+der
+des
+dessen
+deshalb
+die
+dies
+dieser
+dieses
+doch
+dort
+du
+durch
+ein
+eine
+einem
+einen
+einer
+eines
+er
+es
+euer
+eure
+für
+hatte
+hatten
+hattest
+hattet
+hier
+hinter
+ich
+ihr
+ihre
+im
+in
+ist
+ja
+jede
+jedem
+jeden
+jeder 
+jedes
+jener
+jenes
+jetzt 
+kann
+kannst
+können
+könnt
+machen
+mein
+meine
+mit
+muß
+muss
+mußt
+musst
+musst
+müssen
+müßt
+müsst
+nach
+nachdem
+nein
+ncht
+nun
+oder
+seid
+sein
+seine
+sich
+sie
+sind
+soll
+sollen
+sollst
+sollt
+sonst
+soweit
+sowie
+und
+unser
+unsere
+unter
+vom
+von
+vor
+wann
+warum
+was
+weiter
+weitere
+wenn
+wer
+werde
+werden
+werdet
+weshalb
+wie
+wieder
+wieso
+wir
+wird
+wirst
+wo
+woher
+wohin
+zu
+zum
+zur
+über
+a's
+able
+about
+above
+according
+accordingly
+across
+actually
+after
+afterwards
+again
+against
+ain't
+all
+allow
+allows
+almost
+alone
+along
+already
+also
+although
+always
+am
+among
+amongst
+an
+and
+another
+any
+anybody
+anyhow
+anyone
+anything
+anyway
+anyways
+anywhere
+apart
+appear
+appreciate
+appropriate
+are
+aren't
+around
+as
+aside
+ask
+asking
+associated
+at
+available
+away
+awfully
+be
+became
+because
+become
+becomes
+becoming
+been
+before
+beforehand
+behind
+being
+believe
+below
+beside
+besides
+best
+better
+between
+beyond
+both
+brief
+but
+by
+c'mon
+c's
+came
+can
+can't
+cannot
+cant
+cause
+causes
+certain
+certainly
+changes
+clearly
+co
+com
+come
+comes
+concerning
+consequently
+consider
+considering
+contain
+containing
+contains
+corresponding
+could
+couldn't
+course
+currently
+definitely
+described
+despite
+did
+didn't
+different
+do
+does
+doesn't
+doing
+don't
+done
+down
+downwards
+during
+each
+edu
+eg
+eight
+either
+else
+elsewhere
+enough
+entirely
+especially
+et
+etc
+even
+ever
+every
+everybody
+everyone
+everything
+everywhere
+ex
+exactly
+example
+except
+far
+few
+fifth
+first
+five
+followed
+following
+follows
+for
+former
+formerly
+forth
+four
+from
+further
+furthermore
+get
+gets
+getting
+given
+gives
+go
+goes
+going
+gone
+got
+gotten
+greetings
+had
+hadn't
+happens
+hardly
+has
+hasn't
+have
+haven't
+having
+he
+he's
+hello
+help
+hence
+her
+here
+here's
+hereafter
+hereby
+herein
+hereupon
+hers
+herself
+hi
+him
+himself
+his
+hither
+hopefully
+how
+howbeit
+however
+i'd
+i'll
+i'm
+i've
+ie
+if
+ignored
+immediate
+in
+inasmuch
+inc
+indeed
+indicate
+indicated
+indicates
+inner
+insofar
+instead
+into
+inward
+is
+isn't
+it
+it'd
+it'll
+it's
+its
+itself
+just
+keep
+keeps
+kept
+know
+knows
+known
+last
+lately
+later
+latter
+latterly
+least
+less
+lest
+let
+let's
+like
+liked
+likely
+little
+look
+looking
+looks
+ltd
+mainly
+many
+may
+maybe
+me
+mean
+meanwhile
+merely
+might
+more
+moreover
+most
+mostly
+much
+must
+my
+myself
+name
+namely
+nd
+near
+nearly
+necessary
+need
+needs
+neither
+never
+nevertheless
+new
+next
+nine
+no
+nobody
+non
+none
+noone
+nor
+normally
+not
+nothing
+novel
+now
+nowhere
+obviously
+of
+off
+often
+oh
+ok
+okay
+old
+on
+once
+one
+ones
+only
+onto
+or
+other
+others
+otherwise
+ought
+our
+ours
+ourselves
+out
+outside
+over
+overall
+own
+particular
+particularly
+per
+perhaps
+placed
+please
+plus
+possible
+presumably
+probably
+provides
+que
+quite
+qv
+rather
+rd
+re
+really
+reasonably
+regarding
+regardless
+regards
+relatively
+respectively
+right
+said
+same
+saw
+say
+saying
+says
+second
+secondly
+see
+seeing
+seem
+seemed
+seeming
+seems
+seen
+self
+selves
+sensible
+sent
+serious
+seriously
+seven
+several
+shall
+she
+should
+shouldn't
+since
+six
+so
+some
+somebody
+somehow
+someone
+something
+sometime
+sometimes
+somewhat
+somewhere
+soon
+sorry
+specified
+specify
+specifying
+still
+sub
+such
+sup
+sure
+t's
+take
+taken
+tell
+tends
+th
+than
+thank
+thanks
+thanx
+that
+that's
+thats
+the
+their
+theirs
+them
+themselves
+then
+thence
+there
+there's
+thereafter
+thereby
+therefore
+therein
+theres
+thereupon
+these
+they
+they'd
+they'll
+they're
+they've
+think
+third
+this
+thorough
+thoroughly
+those
+though
+three
+through
+throughout
+thru
+thus
+to
+together
+too
+took
+toward
+towards
+tried
+tries
+truly
+try
+trying
+twice
+two
+un
+under
+unfortunately
+unless
+unlikely
+until
+unto
+up
+upon
+us
+use
+used
+useful
+uses
+using
+usually
+value
+various
+very
+via
+viz
+vs
+want
+wants
+was
+wasn't
+way
+we
+we'd
+we'll
+we're
+we've
+welcome
+well
+went
+were
+weren't
+what
+what's
+whatever
+when
+whence
+whenever
+where
+where's
+whereafter
+whereas
+whereby
+wherein
+whereupon
+wherever
+whether
+which
+while
+whither
+who
+who's
+whoever
+whole
+whom
+whose
+why
+will
+willing
+wish
+with
+within
+without
+won't
+wonder
+would
+would
+wouldn't
+yes
+yet
+you
+you'd
+you'll
+you're
+you've
+your
+yours
+yourself
+yourselves
+zero

drop-tables-innodb.sql

@@ -9,24 +9,34 @@ DROP TABLE IF EXISTS `tblDocumentReviewers`;
 DROP TABLE IF EXISTS `tblDocumentStatusLog`;
 DROP TABLE IF EXISTS `tblDocumentStatus`;
 
+DROP TABLE IF EXISTS `tblDocumentAttributes`;
+DROP TABLE IF EXISTS `tblDocumentContentAttributes`;
 DROP TABLE IF EXISTS `tblDocumentContent`;
 DROP TABLE IF EXISTS `tblDocumentLinks`;
 DROP TABLE IF EXISTS `tblDocumentFiles`;
 DROP TABLE IF EXISTS `tblDocumentLocks`;
+DROP TABLE IF EXISTS `tblDocumentCategory`;
 DROP TABLE IF EXISTS `tblDocuments`;
 
+DROP TABLE IF EXISTS `tblFolderAttributes`;
 DROP TABLE IF EXISTS `tblFolders`;
 
+DROP TABLE IF EXISTS `tblAttributeDefinitions`;
+
 DROP TABLE IF EXISTS `tblGroupMembers`;
 DROP TABLE IF EXISTS `tblGroups`;
 
 DROP TABLE IF EXISTS `tblKeywords`;
 DROP TABLE IF EXISTS `tblKeywordCategories`;
 
+DROP TABLE IF EXISTS `tblCategory`;
+
 DROP TABLE IF EXISTS `tblNotify`;
 DROP TABLE IF EXISTS `tblSessions`;
 
 DROP TABLE IF EXISTS `tblUserImages`;
+DROP TABLE IF EXISTS `tblUserPasswordRequest`;
+DROP TABLE IF EXISTS `tblUserPasswordHistory`;
 DROP TABLE IF EXISTS `tblUsers`;
 
 DROP TABLE IF EXISTS `tblDirPath`;
@@ -36,3 +46,5 @@ DROP TABLE IF EXISTS `tblMandatoryReviewers`;
 DROP TABLE IF EXISTS `tblMandatoryApprovers`;
 
 DROP TABLE IF EXISTS `tblEvents`;
+
+DROP TABLE IF EXISTS `tblVersion`;

inc/inc.ClassAccessOperation.php

@@ -0,0 +1,168 @@
+<?php
+/**
+ * Implementation of access restricitions
+ *
+ * @category   DMS
+ * @package    LetoDMS
+ * @license    GPL 2
+ * @version    @version@
+ * @author     Uwe Steinmann <uwe@steinmann.cx>
+ * @copyright  Copyright (C) 2010-2012 Uwe Steinmann
+ * @version    Release: @package_version@
+ */
+
+/**
+ * Class to check certain access restrictions
+ *
+ * @category   DMS
+ * @package    LetoDMS
+ * @author     Uwe Steinmann <uwe@steinmann.cx>
+ * @copyright  Copyright (C) 2010-2012 Uwe Steinmann
+ * @version    Release: @package_version@
+ */
+class LetoDMS_AccessOperation {
+	/**
+	 * @var object $obj object being accessed
+	 * @access protected
+	 */
+	private $obj;
+
+	/**
+	 * @var object $user user requesting the access
+	 * @access protected
+	 */
+	private $user;
+
+	/**
+	 * @var object $settings LetoDMS Settings
+	 * @access protected
+	 */
+	private $settings;
+
+	function __construct($obj, $user, $settings) { /* {{{ */
+		$this->obj = $obj;
+		$this->user = $user;
+		$this->settings = $settings;
+	} /* }}} */
+
+	/**
+	 * Check if removal of version is allowed
+	 *
+	 * This check can only be done for documents. Removal of versions is
+	 * only allowed if this is turned on in the settings and there are
+	 * at least 2 versions avaiable. Everybody with write access on the
+	 * document may delete versions. The admin may even delete a version
+	 * even if is disallowed in the settings.
+	 */
+	function mayRemoveVersion() { /* {{{ */
+		if(get_class($this->obj) == 'LetoDMS_Core_Document') {
+			$versions = $this->obj->getContent();
+			if ((($this->settings->_enableVersionDeletion && ($this->obj->getAccessMode($this->user) == M_ALL)) || $this->user->isAdmin() ) && (count($versions) > 1)) {
+				return true;
+			}
+		}
+		return false;
+	} /* }}} */
+
+	/**
+	 * Check if document status may be overwritten
+	 *
+	 * This check can only be done for documents. Overwriting the document
+	 * status is
+	 * only allowed if this is turned on in the settings and the current
+	 * status is either 'releaѕed' or 'obsoleted'.
+	 * The admin may even modify the status
+	 * even if is disallowed in the settings.
+	 */
+	function mayOverwriteStatus() { /* {{{ */
+		if(get_class($this->obj) == 'LetoDMS_Core_Document') {
+			$latestContent = $this->obj->getLatestContent();
+			$status = $latestContent->getStatus();
+			if ((($this->settings->_enableVersionModification && ($this->obj->getAccessMode($this->user) == M_ALL)) || $this->user->isAdmin()) && ($status["status"]==S_RELEASED || $status["status"]==S_OBSOLETE )) {
+				return true;
+			}
+		}
+		return false;
+	} /* }}} */
+
+	/**
+	 * Check if reviewers/approvers may be edited
+	 *
+	 * This check can only be done for documents. Overwriting the document
+	 * reviewers/approvers is only allowed if version modification is turned on
+	 * in the settings and the document is in 'draft review' status.  The
+	 * admin may even set reviewers/approvers even if is disallowed in the
+	 * settings.
+	 */
+	function maySetReviewersApprovers() { /* {{{ */
+		if(get_class($this->obj) == 'LetoDMS_Core_Document') {
+			$latestContent = $this->obj->getLatestContent();
+			$status = $latestContent->getStatus();
+			if ((($this->settings->_enableVersionModification && ($this->obj->getAccessMode($this->user) == M_ALL)) || $this->user->isAdmin()) && ($status["status"]==S_DRAFT_REV)) {
+				return true;
+			}
+		}
+		return false;
+	} /* }}} */
+
+	/**
+	 * Check if expiration date may be set
+	 *
+	 * This check can only be done for documents. Setting the documents
+	 * expiration date is only allowed if version modification is turned on in
+	 * the settings and the document is in 'draft review', 'draft approval', or
+	 * 'expired' status.  The admin may set the expiration date even if is
+	 * disallowed in the settings.
+	 */
+	function maySetExpires() { /* {{{ */
+		if(get_class($this->obj) == 'LetoDMS_Core_Document') {
+			$latestContent = $this->obj->getLatestContent();
+			$status = $latestContent->getStatus();
+			if ((($this->settings->_enableVersionModification && ($this->obj->getAccessMode($this->user) == M_ALL)) || $this->user->isAdmin()) && ($status["status"]==S_DRAFT_REV || $status["status"]==S_DRAFT_APP || $status["status"]==S_EXPIRED)) {
+				return true;
+			}
+		}
+		return false;
+	} /* }}} */
+
+	/**
+	 * Check if comment may be edited
+	 *
+	 * This check can only be done for documents. Setting the documents
+	 * comment date is only allowed if version modification is turned on in
+	 * the settings and the document has not been obsoleted.
+	 * The admin may set the comment even if is
+	 * disallowed in the settings.
+	 */
+	function mayEditComment() { /* {{{ */
+		if(get_class($this->obj) == 'LetoDMS_Core_Document') {
+			$latestContent = $this->obj->getLatestContent();
+			$status = $latestContent->getStatus();
+			if ((($this->settings->_enableVersionModification && ($this->obj->getAccessMode($this->user) >= M_READWRITE)) || $this->user->isAdmin()) && ($status["status"]!=S_OBSOLETE)) {
+				return true;
+			}
+		}
+		return false;
+	} /* }}} */
+
+	/**
+	 * Check if attributes may be edited
+	 *
+	 * Setting the object attributes
+	 * is only allowed if version modification is turned on in
+	 * the settings and the document has not been obsoleted.
+	 * The admin may set the comment even if is
+	 * disallowed in the settings.
+	 */
+	function mayEditAttributes() { /* {{{ */
+		if(get_class($this->obj) == 'LetoDMS_Core_Document') {
+			$latestContent = $this->obj->getLatestContent();
+			$status = $latestContent->getStatus();
+			if ((($this->settings->_enableVersionModification && ($this->obj->getAccessMode($this->user) >= M_READWRITE)) || $this->user->isAdmin()) && ($status["status"]==S_DRAFT_REV)) {
+				return true;
+			}
+		}
+		return false;
+	} /* }}} */
+}
+?>

inc/inc.ClassSettings.php

@@ -99,6 +99,14 @@ class Settings { /* {{{ */
 	var $_enableUsersView = true;
 	// enable/disable listing administrator as reviewer/approver
 	var $_enableAdminRevApp = false;
+	// enable/disable default notification for owner
+	var $_enableOwnerNotification = false;
+	// enable/disable deleting of versions for regular users
+	var $_enableVersionDeletion = false;
+	// enable/disable to overwrite the status of a version for regular users
+	var $_enableVersionModification = false;
+	// enable/disable notification when added as a reviewer/approver
+	var $_enableNotificationAppRev = true;
 	// the name of the versioning info file created by the backup tool
 	var $_versioningFileName = "versioning_info.txt";
 	// enable/disable log system
@@ -394,6 +402,16 @@ class Settings { /* {{{ */
 		$tab = $node[0]->attributes();
 		$this->_enableAdminRevApp = Settings::boolval($tab["enableAdminRevApp"]);
 		$this->_versioningFileName = strval($tab["versioningFileName"]);
+		$this->_enableVersionDeletion = Settings::boolval($tab["enableVersionDeletion"]);
+		$this->_enableVersionModification = Settings::boolval($tab["enableVersionModification"]);
+
+		// XML Path: /configuration/advanced/notification
+		$node = $xml->xpath('/configuration/advanced/notification');
+		if($node) {
+			$tab = $node[0]->attributes();
+			$this->_enableNotificationAppRev = Settings::boolval($tab["enableNotificationAppRev"]);
+			$this->_enableOwnerNotification = Settings::boolval($tab["enableOwnerNotification"]);
+		}
 
 		// XML Path: /configuration/advanced/server
 		$node = $xml->xpath('/configuration/advanced/server');
@@ -455,7 +473,7 @@ class Settings { /* {{{ */
 		$node = $rootNode->xpath($parentNodeName . '/' . $name);
 
 		if (empty($node)) {
-			$node = $xml->xpath($parentNodeName);
+			$node = $rootNode->xpath($parentNodeName);
 			$node = $node[0]->addChild($name);
 		} else {
 			$node = $node[0];
@@ -614,6 +632,13 @@ class Settings { /* {{{ */
     $node = $this->getXMLNode($xml, '/configuration/advanced', 'edition');
     $this->setXMLAttributValue($node, "enableAdminRevApp", $this->_enableAdminRevApp);
     $this->setXMLAttributValue($node, "versioningFileName", $this->_versioningFileName);
+    $this->setXMLAttributValue($node, "enableVersionDeletion", $this->_enableVersionDeletion);
+    $this->setXMLAttributValue($node, "enableVersionModification", $this->_enableVersionModification);
+
+    // XML Path: /configuration/advanced/notification
+    $node = $this->getXMLNode($xml, '/configuration/advanced', 'notification');
+    $this->setXMLAttributValue($node, "enableNotificationAppRev", $this->_enableNotificationAppRev);
+    $this->setXMLAttributValue($node, "enableOwnerNotification", $this->_enableOwnerNotification);
 
     // XML Path: /configuration/advanced/server
     $node = $this->getXMLNode($xml, '/configuration/advanced', 'server');

inc/inc.ClassUI.php

@@ -598,6 +598,24 @@ class UI {
 		print "&nbsp;&nbsp;<input type=\"Button\" value=\"".getMLText("category")."...\" onclick=\"chooseCategory".$formName."();\">";
 	} /* }}} */
 
+	function printAttributeEditField($attrdef, $objvalue, $fieldname='attributes') { /* {{{ */
+		if($valueset = $attrdef->getValueSetAsArray()) {
+			echo "<select name=\"".$fieldname."[".$attrdef->getId()."]\">";
+			if($attrdef->getMinValues() < 1) {
+				echo "<option value=\"\"></option>";
+			}
+			foreach($valueset as $value) {
+				echo "<option value=\"".htmlspecialchars($value)."\"";
+				if($value == $objvalue)
+					echo " selected";
+				echo ">".htmlspecialchars($value)."</option>";
+			}
+			echo "</select>";
+		} else {
+			echo "<input type=\"text\" name=\"".$fieldname."[".$attrdef->getId()."]\" value=\"".htmlspecialchars($objvalue)."\" />";
+		}
+	} /* }}} */
+
 	function getImgPath($img) { /* {{{ */
 		global $theme;
 
@@ -693,7 +711,7 @@ class UI {
 			if ($folderID != $currentFolderID){
 			
 				if ($navigation) print "<a href=\"../out/out.ViewFolder.php?folderid=" . $folderID . "&showtree=1\">";
-				else print "<a class=\"foldertree_selectable\" href=\"javascript:folderSelected(" . $folderID . ", '" . str_replace("'", "\\'", $folder->getName()) . "')\">";
+				else print "<a class=\"foldertree_selectable\" href=\"javascript:folderSelected(" . $folderID . ", '" . str_replace("'", "\\'", htmlspecialchars($folder->getName())) . "')\">";
 
 			}else print "<span class=\"selectedfoldertree\">";
 			

inc/inc.Version.php

@@ -19,7 +19,7 @@
 
 class LetoDMS_Version {
 
-	var $_number = "3.4.0";
+	var $_number = "3.4.0RC2";
 	var $_string = "LetoDMS";
 
 	function LetoDMS_Version() {

install/create_tables-innodb.sql

@@ -14,6 +14,37 @@ CREATE TABLE `tblACLs` (
 
 -- --------------------------------------------------------
 
+-- 
+-- Table structure for table `tblCategory`
+-- 
+
+CREATE TABLE `tblCategory` (
+  `id` int(11) NOT NULL auto_increment,
+  `name` text NOT NULL,
+  PRIMARY KEY  (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+-- --------------------------------------------------------
+
+-- 
+-- Table structure for table `tblAttributeDefinitions`
+-- 
+
+CREATE TABLE `tblAttributeDefinitions` (
+  `id` int(11) NOT NULL auto_increment,
+  `name` varchar(100) default NULL,
+  `objtype` tinyint(4) NOT NULL default '0',
+  `type` tinyint(4) NOT NULL default '0',
+  `multiple` tinyint(4) NOT NULL default '0',
+  `minvalues` int(11) NOT NULL default '0',
+  `maxvalues` int(11) NOT NULL default '0',
+  `valueset` text default NULL,
+	UNIQUE(`name`),
+  PRIMARY KEY  (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+-- --------------------------------------------------------
+
 -- 
 -- Table structure for table `tblUsers`
 -- 
@@ -29,7 +60,7 @@ CREATE TABLE `tblUsers` (
   `comment` text NOT NULL,
   `role` smallint(1) NOT NULL default '0',
   `hidden` smallint(1) NOT NULL default '0',
-  `pwdExpiration` datetime NOT NULL default '0000-00-00 00:00:00';
+  `pwdExpiration` datetime NOT NULL default '0000-00-00 00:00:00',
   `loginfailures` tinyint(4) NOT NULL default '0',
   `disabled` smallint(1) NOT NULL default '0',
   PRIMARY KEY  (`id`)
@@ -104,6 +135,23 @@ CREATE TABLE `tblFolders` (
 
 -- --------------------------------------------------------
 
+-- 
+-- Table structure for table `tblFolderAttributes`
+-- 
+
+CREATE TABLE `tblFolderAttributes` (
+  `id` int(11) NOT NULL auto_increment,
+  `folder` int(11) default NULL,
+  `attrdef` int(11) default NULL,
+  `value` text default NULL,
+  PRIMARY KEY  (`id`),
+	UNIQUE (folder, attrdef),
+  CONSTRAINT `tblFolderAttr_folder` FOREIGN KEY (`folder`) REFERENCES `tblFolders` (`id`) ON DELETE CASCADE,
+  CONSTRAINT `tblFolderAttr_attrdef` FOREIGN KEY (`attrdef`) REFERENCES `tblAttributeDefinitions` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+-- --------------------------------------------------------
+
 -- 
 -- Table structure for table `tblDocuments`
 -- 
@@ -129,6 +177,23 @@ CREATE TABLE `tblDocuments` (
 
 -- --------------------------------------------------------
 
+-- 
+-- Table structure for table `tblDocumentAttributes`
+-- 
+
+CREATE TABLE `tblDocumentAttributes` (
+  `id` int(11) NOT NULL auto_increment,
+  `document` int(11) default NULL,
+  `attrdef` int(11) default NULL,
+  `value` text default NULL,
+  PRIMARY KEY  (`id`),
+	UNIQUE (document, attrdef),
+  CONSTRAINT `tblDocumentAttributes_document` FOREIGN KEY (`document`) REFERENCES `tblDocuments` (`id`) ON DELETE CASCADE,
+  CONSTRAINT `tblDocumentAttributes_attrdef` FOREIGN KEY (`attrdef`) REFERENCES `tblAttributeDefinitions` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+-- --------------------------------------------------------
+
 -- 
 -- Table structure for table `tblDocumentApprovers`
 -- 
@@ -169,6 +234,7 @@ CREATE TABLE `tblDocumentApproveLog` (
 -- 
 
 CREATE TABLE `tblDocumentContent` (
+  `id` int(11) NOT NULL auto_increment,
   `document` int(11) NOT NULL default '0',
   `version` smallint(5) unsigned NOT NULL,
   `comment` text,
@@ -178,12 +244,30 @@ CREATE TABLE `tblDocumentContent` (
   `orgFileName` varchar(150) NOT NULL default '',
   `fileType` varchar(10) NOT NULL default '',
   `mimeType` varchar(100) NOT NULL default '',
+  PRIMARY KEY  (`id`),
   UNIQUE (`document`, `version`),
   CONSTRAINT `tblDocumentDocument_document` FOREIGN KEY (`document`) REFERENCES `tblDocuments` (`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 
 -- --------------------------------------------------------
 
+-- 
+-- Table structure for table `tblDocumentContentAttributes`
+-- 
+
+CREATE TABLE `tblDocumentContentAttributes` (
+  `id` int(11) NOT NULL auto_increment,
+  `content` int(11) default NULL,
+  `attrdef` int(11) default NULL,
+  `value` text default NULL,
+  PRIMARY KEY  (`id`),
+	UNIQUE (content, attrdef),
+  CONSTRAINT `tblDocumentContentAttributes_document` FOREIGN KEY (`content`) REFERENCES `tblDocumentContent` (`id`) ON DELETE CASCADE,
+  CONSTRAINT `tblDocumentContentAttributes_attrdef` FOREIGN KEY (`attrdef`) REFERENCES `tblAttributeDefinitions` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+-- --------------------------------------------------------
+
 -- 
 -- Table structure for table `tblDocumentLinks`
 -- 
@@ -360,25 +444,15 @@ CREATE TABLE `tblKeywords` (
 
 -- --------------------------------------------------------
 
--- 
--- Table structure for table `tblCategory`
--- 
-
-CREATE TABLE `tblCategory` (
-  `id` int(11) NOT NULL auto_increment,
-  `name` text NOT NULL,
-  PRIMARY KEY  (`id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
-
--- --------------------------------------------------------
-
 -- 
 -- Table structure for table `tblDocumentCategory`
 -- 
 
 CREATE TABLE `tblDocumentCategory` (
   `categoryID` int(11) NOT NULL default 0,
-  `documentID` int(11) NOT NULL default 0
+  `documentID` int(11) NOT NULL default 0,
+  CONSTRAINT `tblDocumentCategory_category` FOREIGN KEY (`categoryID`) REFERENCES `tblCategory` (`id`) ON DELETE CASCADE,
+  CONSTRAINT `tblDocumentCategory_document` FOREIGN KEY (`documentID`) REFERENCES `tblDocuments` (`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 
 -- --------------------------------------------------------
@@ -490,8 +564,8 @@ CREATE TABLE `tblVersion` (
 -- Initial content for database
 --
 
-INSERT INTO tblUsers VALUES (1, 'admin', '21232f297a57a5a743894a0e4a801fc3', 'Administrator', 'address@server.com', '', '', '', 1, 0);
+INSERT INTO tblUsers VALUES (1, 'admin', '21232f297a57a5a743894a0e4a801fc3', 'Administrator', 'address@server.com', '', '', '', 1, 0, '', 0, 0);
-INSERT INTO tblUsers VALUES (2, 'guest', NULL, 'Guest User', NULL, '', '', '', 2, 0);
+INSERT INTO tblUsers VALUES (2, 'guest', NULL, 'Guest User', NULL, '', '', '', 2, 0, '', 0, 0);
 INSERT INTO tblFolders VALUES (1, 'DMS', 0, '', 'DMS root', UNIX_TIMESTAMP(), 1, 0, 2, 0);
 INSERT INTO tblVersion VALUES (NOW(), 3, 4, 0);
 INSERT INTO tblCategory VALUES (0, '');

install/create_tables.sql

@@ -14,6 +14,25 @@ CREATE TABLE `tblACLs` (
 
 -- --------------------------------------------------------
 
+-- 
+-- Table structure for table `tblAttributeDefinitions`
+-- 
+
+CREATE TABLE `tblAttributeDefinitions` (
+  `id` int(11) NOT NULL auto_increment,
+  `name` varchar(100) default NULL,
+  `objtype` tinyint(4) NOT NULL default '0',
+  `type` tinyint(4) NOT NULL default '0',
+  `multiple` tinyint(4) NOT NULL default '0',
+  `minvalues` int(11) NOT NULL default '0',
+  `maxvalues` int(11) NOT NULL default '0',
+  `valueset` text default NULL,
+	UNIQUE(`name`),
+  PRIMARY KEY  (`id`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8;
+
+-- --------------------------------------------------------
+
 -- 
 -- Table structure for table `tblUsers`
 -- 
@@ -29,7 +48,7 @@ CREATE TABLE `tblUsers` (
   `comment` text NOT NULL,
   `role` smallint(1) NOT NULL default '0',
   `hidden` smallint(1) NOT NULL default '0',
-  `pwdExpiration` datetime NOT NULL default '0000-00-00 00:00:00';
+  `pwdExpiration` datetime NOT NULL default '0000-00-00 00:00:00',
   `loginfailures` tinyint(4) NOT NULL default '0',
   `disabled` smallint(1) NOT NULL default '0',
   PRIMARY KEY  (`id`)
@@ -100,6 +119,21 @@ CREATE TABLE `tblFolders` (
 
 -- --------------------------------------------------------
 
+-- 
+-- Table structure for table `tblFolderAttributes`
+-- 
+
+CREATE TABLE `tblFolderAttributes` (
+  `id` int(11) NOT NULL auto_increment,
+  `folder` int(11) default NULL,
+  `attrdef` int(11) default NULL,
+  `value` text default NULL,
+	UNIQUE (folder, attrdef),
+  PRIMARY KEY  (`id`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8;
+
+-- --------------------------------------------------------
+
 -- 
 -- Table structure for table `tblDocuments`
 -- 
@@ -123,6 +157,21 @@ CREATE TABLE `tblDocuments` (
 
 -- --------------------------------------------------------
 
+-- 
+-- Table structure for table `tblDocumentAttributes`
+-- 
+
+CREATE TABLE `tblDocumentAttributes` (
+  `id` int(11) NOT NULL auto_increment,
+  `document` int(11) default NULL,
+  `attrdef` int(11) default NULL,
+  `value` text default NULL,
+	UNIQUE (document, attrdef),
+  PRIMARY KEY  (`id`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8;
+
+-- --------------------------------------------------------
+
 -- 
 -- Table structure for table `tblDocumentApprovers`
 -- 
@@ -160,6 +209,7 @@ CREATE TABLE `tblDocumentApproveLog` (
 -- 
 
 CREATE TABLE `tblDocumentContent` (
+  `id` int(11) NOT NULL auto_increment,
   `document` int(11) NOT NULL default '0',
   `version` smallint(5) unsigned NOT NULL,
   `comment` text,
@@ -169,11 +219,27 @@ CREATE TABLE `tblDocumentContent` (
   `orgFileName` varchar(150) NOT NULL default '',
   `fileType` varchar(10) NOT NULL default '',
   `mimeType` varchar(100) NOT NULL default '',
+  PRIMARY KEY  (`id`),
   UNIQUE (`document`,`version`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8;
 
 -- --------------------------------------------------------
 
+-- 
+-- Table structure for table `tblDocumentContentAttributes`
+-- 
+
+CREATE TABLE `tblDocumentContentAttributes` (
+  `id` int(11) NOT NULL auto_increment,
+  `content` int(11) default NULL,
+  `attrdef` int(11) default NULL,
+  `value` text default NULL,
+  PRIMARY KEY  (`id`),
+	UNIQUE (content, attrdef)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8;
+
+-- --------------------------------------------------------
+
 -- 
 -- Table structure for table `tblDocumentLinks`
 -- 
@@ -467,8 +533,8 @@ CREATE TABLE `tblVersion` (
 -- Initial content for database
 --
 
-INSERT INTO tblUsers VALUES (1, 'admin', '21232f297a57a5a743894a0e4a801fc3', 'Administrator', 'address@server.com', '', '', '', 1, 0);
+INSERT INTO tblUsers VALUES (1, 'admin', '21232f297a57a5a743894a0e4a801fc3', 'Administrator', 'address@server.com', '', '', '', 1, 0, '', 0, 0);
-INSERT INTO tblUsers VALUES (2, 'guest', NULL, 'Guest User', NULL, '', '', '', 2, 0);
+INSERT INTO tblUsers VALUES (2, 'guest', NULL, 'Guest User', NULL, '', '', '', 2, 0, '', 0, 0);
 INSERT INTO tblFolders VALUES (1, 'DMS', 0, '', 'DMS root', UNIX_TIMESTAMP(), 1, 0, 2, 0);
 INSERT INTO tblVersion VALUES (NOW(), 3, 4, 0);
 INSERT INTO tblCategory VALUES (0, '');

install/settings.xml.template_install

@@ -198,6 +198,12 @@
       versioningFileName = "versioning_info.txt"
     >
     </edition>
+		<!-- enableNotificationAppRev: true to send notifation if a user is added as a reviewer or approver
+		-->
+    <notification
+      enableNotificationAppRev = "true"
+    >
+    </notification>
     <!-- coreDir: Path to LetoDMS_Core (optional)
        - luceneClassDir: Path to LetoDMS_Lucene (optional)
        - contentOffsetDir: To work around limitations in the underlying file system, a new 

install/update-3.3.0/update.php

@@ -3,6 +3,7 @@
 //    Copyright (C) 2002-2005  Markus Westphal
 //    Copyright (C) 2006-2008 Malcolm Cowe
 //    Copyright (C) 2010 Matteo Lucarelli
+//    Copyright (C) 2010-2012 Uwe Steinmann
 //
 //    This program is free software; you can redistribute it and/or modify
 //    it under the terms of the GNU General Public License as published by

install/update-3.4.0/update.sql

@@ -1,3 +1,46 @@
+CREATE TABLE `tblAttributeDefinitions` (
+  `id` int(11) NOT NULL auto_increment,
+  `name` varchar(100) default NULL,
+  `objtype` tinyint(4) NOT NULL default '0',
+  `type` tinyint(4) NOT NULL default '0',
+  `multiple` tinyint(4) NOT NULL default '0',
+  `minvalues` int(11) NOT NULL default '0',
+  `maxvalues` int(11) NOT NULL default '0',
+  `valueset` text default NULL,
+	UNIQUE(`name`),
+  PRIMARY KEY  (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+CREATE TABLE `tblFolderAttributes` (
+  `id` int(11) NOT NULL auto_increment,
+  `folder` int(11) default NULL,
+  `attrdef` int(11) default NULL,
+  `value` text default NULL,
+  PRIMARY KEY  (`id`),
+	UNIQUE (folder, attrdef),
+  CONSTRAINT `tblFolderAttr_folder` FOREIGN KEY (`folder`) REFERENCES `tblFolders` (`id`) ON DELETE CASCADE,
+  CONSTRAINT `tblFolderAttr_attrdef` FOREIGN KEY (`attrdef`) REFERENCES `tblAttributeDefinitions` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+CREATE TABLE `tblDocumentAttributes` (
+  `id` int(11) NOT NULL auto_increment,
+  `document` int(11) default NULL,
+  `attrdef` int(11) default NULL,
+  `value` text default NULL,
+  PRIMARY KEY  (`id`),
+	UNIQUE (document, attrdef),
+  CONSTRAINT `tblDocumentAttributes_document` FOREIGN KEY (`document`) REFERENCES `tblDocuments` (`id`) ON DELETE CASCADE,
+  CONSTRAINT `tblDocumentAttributes_attrdef` FOREIGN KEY (`attrdef`) REFERENCES `tblAttributeDefinitions` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+ALTER TABLE tblDocumentContent ADD COLUMN `id` int(11) NOT NULL auto_increment PRIMARY KEY FIRST;
+CREATE TABLE `tblDocumentContentAttributes` (
+  `id` int(11) NOT NULL auto_increment,
+  `content` int(11) default NULL,
+  `attrdef` int(11) default NULL,
+  `value` text default NULL,
+  PRIMARY KEY  (`id`),
+	UNIQUE (content, attrdef),
+  CONSTRAINT `tblDocumentContentAttributes_document` FOREIGN KEY (`content`) REFERENCES `tblDocumentContent` (`id`) ON DELETE CASCADE,
+  CONSTRAINT `tblDocumentContentAttributes_attrdef` FOREIGN KEY (`attrdef`) REFERENCES `tblAttributeDefinitions` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 CREATE TABLE `tblUserPasswordHistory` (
   `id` int(11) NOT NULL auto_increment,
   `userID` int(11) NOT NULL default '0',
@@ -5,7 +48,7 @@ CREATE TABLE `tblUserPasswordHistory` (
   `date` datetime NOT NULL default '0000-00-00 00:00:00',
   PRIMARY KEY  (`id`),
   CONSTRAINT `tblUserPasswordHistory_user` FOREIGN KEY (`userID`) REFERENCES `tblUsers` (`id`) ON DELETE CASCADE
-) DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 ALTER TABLE tblUsers ADD COLUMN `pwdExpiration` datetime NOT NULL default '0000-00-00 00:00:00';
 ALTER TABLE tblUsers ADD COLUMN `loginfailures` tinyint(4) NOT NULL default '0';
 ALTER TABLE tblUsers ADD COLUMN `disabled` smallint(4) NOT NULL default '0';

install/update-3.4.0/update.txt

@@ -0,0 +1,7 @@
+Release information for 3.4.0
+-------------------------------------
+
+This release contains various database changes which can all be done
+within the automatic upgrade process. Besides some new tables the most
+noteable change is the addition of a new primary id field to the
+document content table (tblDocumentContent).

languages/English/help.htm

@@ -1,7 +1,7 @@
 <h1>General Notes</h1>
 
 <p>
-A DMS (Document Management System) is designed to allow documents share
+A DMS (Document Management System) is designed to share documents,
 controlling the workflow, access permissions and organization in general.
 </p>
 

languages/English/lang.inc

@@ -45,6 +45,7 @@ $text["add_user"] = "Add new user";
 $text["add_user_to_group"] = "Add user to group";
 $text["admin"] = "Administrator";
 $text["admin_tools"] = "Admin-Tools";
+$text["all"] = "All";
 $text["all_categories"] = "All categories";
 $text["all_documents"] = "All Documents";
 $text["all_pages"] = "All";
@@ -67,6 +68,17 @@ $text["assign_approvers"] = "Assign Approvers";
 $text["assign_reviewers"] = "Assign Reviewers";
 $text["assign_user_property_to"] = "Assign user's properties to";
 $text["assumed_released"] = "Assumed released";
+$text["attrdef_management"] = "Attribute definition management";
+$text["attrdef_exists"] = "Attribute definition already exists";
+$text["attrdef_in_use"] = "Attribute definition still in use";
+$text["attrdef_name"] = "Name";
+$text["attrdef_multiple"] = "Allow multiple values";
+$text["attrdef_objtype"] = "Object type";
+$text["attrdef_type"] = "Type";
+$text["attrdef_minvalues"] = "Min. number of values";
+$text["attrdef_maxvalues"] = "Max. number of values";
+$text["attrdef_valueset"] = "Set of values";
+$text["attributes"] = "Attributes";
 $text["august"] = "August";
 $text["automatic_status_update"] = "Automatic status change";
 $text["back"] = "Go back";
@@ -93,6 +105,7 @@ $text["change_assignments"] = "Change Assignments";
 $text["change_password"] = "Change password";
 $text["change_password_message"] = "Your password has been changed.";
 $text["change_status"] = "Change Status";
+$text["choose_attrdef"] = "Please choose attribute definition";
 $text["choose_category"] = "Please choose";
 $text["choose_group"] = "Choose group";
 $text["choose_target_category"] = "Choose category";
@@ -145,6 +158,7 @@ $text["document_renamed_email"] = "Document renamed";
 $text["documents"] = "Documents";
 $text["documents_in_process"] = "Documents In Process";
 $text["documents_locked_by_you"] = "Documents locked by you";
+$text["documents_only"] = "Documents only";
 $text["document_status_changed_email"] = "Document status changed";
 $text["documents_to_approve"] = "Documents awaiting your approval";
 $text["documents_to_review"] = "Documents awaiting your Review";
@@ -160,6 +174,7 @@ $text["dump_creation"] = "DB dump creation";
 $text["dump_creation_warning"] = "With this operation you can create a dump file of your database content. After the creation the dump file will be saved in the data folder of your server.";
 $text["dump_list"] = "Existings dump files";
 $text["dump_remove"] = "Remove dump file";
+$text["edit_attributes"] = "Edit attributes";
 $text["edit_comment"] = "Edit comment";
 $text["edit_default_keywords"] = "Edit keywords";
 $text["edit_document_access"] = "Edit Access";
@@ -209,6 +224,7 @@ $text["from"] = "From";
 $text["fullsearch"] = "Full text search";
 $text["fullsearch_hint"] = "Use fulltext index";
 $text["fulltext_info"] = "Fulltext index info";
+$text["global_attributedefinitions"] = "Attribute definitions";
 $text["global_default_keywords"] = "Global keywords";
 $text["global_document_categories"] = "Categories";
 $text["group_approval_summary"] = "Group approval summary";
@@ -305,12 +321,14 @@ $text["move"] = "Move";
 $text["my_account"] = "My Account";
 $text["my_documents"] = "My Documents";
 $text["name"] = "Name";
+$text["new_attrdef"] = "Add attribute defintion";
 $text["new_default_keyword_category"] = "Add category";
 $text["new_default_keywords"] = "Add keywords";
 $text["new_document_category"] = "Add category";
 $text["new_document_email"] = "New document";
 $text["new_file_email"] = "New attachment";
 $text["new_folder"] = "New folder";
+$text["new_password"] = "New password";
 $text["new"] = "New"; 
 $text["new_subfolder_email"] = "New folder";
 $text["new_user_image"] = "New image";
@@ -374,6 +392,7 @@ $text["review_status"] = "Review Status";
 $text["review_submit_email"] = "Submitted review";
 $text["review_summary"] = "Review Summary";
 $text["review_update_failed"] = "Error updating review status. Update failed.";
+$text["rm_attrdef"] = "Remove attribute definition";
 $text["rm_default_keyword_category"] = "Delete category";
 $text["rm_document"] = "Remove document";
 $text["rm_document_category"] = "Delete category";
@@ -474,6 +493,12 @@ $text["settings_enableCalendar_desc"] = "Enable/disable calendar";
 $text["settings_enableCalendar"] = "Enable Calendar";
 $text["settings_enableConverting_desc"] = "Enable/disable converting of files";
 $text["settings_enableConverting"] = "Enable Converting";
+$text["settings_enableNotificationAppRev_desc"] = "Check to send a notification to the reviewer/approver when a new document version is added";
+$text["settings_enableNotificationAppRev"] = "Enable reviewer/approver notification";
+$text["settings_enableVersionModification_desc"] = "Enable/disable modification of a document versions by regular users after a version was uploaded. Admin may always modify the version after upload.";
+$text["settings_enableVersionModification"] = "Enable modification of versions";
+$text["settings_enableVersionDeletion_desc"] = "Enable/disable deletion of previous document versions by regular users. Admin may always delete old versions.";
+$text["settings_enableVersionDeletion"] = "Enable deletion of previous versions";
 $text["settings_enableEmail_desc"] = "Enable/disable automatic email notification";
 $text["settings_enableEmail"] = "Enable E-mail";
 $text["settings_enableFolderTree_desc"] = "False to don't show the folder tree";
@@ -484,6 +509,8 @@ $text["settings_enableGuestLogin_desc"] = "If you want anybody to login as guest
 $text["settings_enableGuestLogin"] = "Enable Guest Login";
 $text["settings_enableLargeFileUpload_desc"] = "If set, file upload is also available through a java applet called jumploader without a file size limit set by the browser. It also allows to upload several files in one step.";
 $text["settings_enableLargeFileUpload"] = "Enable large file upload";
+$text["settings_enableOwnerNotification_desc"] = "Check for adding a notification for the owner if a document when it is added.";
+$text["settings_enableOwnerNotification"] = "Enable owner notification by default";
 $text["settings_enablePasswordForgotten_desc"] = "If you want to allow user to set a new password and send it by mail, check this option.";
 $text["settings_enablePasswordForgotten"] = "Enable Password forgotten";
 $text["settings_enableUserImage_desc"] = "Enable users images";
@@ -523,6 +550,7 @@ $text["settings_maxDirID"] = "Max Directory ID";
 $text["settings_maxExecutionTime_desc"] = "This sets the maximum time in seconds a script is allowed to run before it is terminated by the parse";
 $text["settings_maxExecutionTime"] = "Max Execution Time (s)";
 $text["settings_more_settings"] = "Configure more settings. Default login: admin/admin";
+$text["settings_Notification"] = "Notification settings";
 $text["settings_no_content_dir"] = "Content directory";
 $text["settings_notfound"] = "Not found";
 $text["settings_notwritable"] = "The configuration cannot be saved because the configuration file is not writable.";
@@ -585,8 +613,8 @@ $text["settings_viewOnlineFileTypes_desc"] = "Files with one of the following en
 $text["settings_viewOnlineFileTypes"] = "View Online File Types";
 $text["settings_zendframework"] = "Zend Framework";
 $text["signed_in_as"] = "Signed in as";
-$text["sign_in"] = "sign in";
+$text["sign_in"] = "Sign in";
-$text["sign_out"] = "sign out";
+$text["sign_out"] = "Sign out";
 $text["space_used_on_data_folder"] = "Space used on data folder";
 $text["status_approval_rejected"] = "Draft rejected";
 $text["status_approved"] = "Approved";
@@ -611,7 +639,7 @@ $text["thursday"] = "Thursday";
 $text["toggle_manager"] = "Toggle manager";
 $text["to"] = "To";
 $text["tuesday"] = "Tuesday";
-$text["under_folder"] = "In folder";
+$text["under_folder"] = "In Folder";
 $text["unknown_command"] = "Command not recognized.";
 $text["unknown_document_category"] = "Unknown category";
 $text["unknown_group"] = "Unknown group id";

languages/German/help.htm

@@ -1,7 +1,27 @@
-<h1>TODO</h1>
+<h1>LetoDMS - Dokumentenmanagement</h1>
-
+<p>LetoDMS ist ein Dokumentenmanagement mit webbasierter Bedienschnittstelle.
-
+Das Konzept entspricht weitgehend der üblichen Organisation von Dokumenten
-
+eines regulären Dateisystems und dessen hierarchischer Ordnung mittels
-
+Ordnern. Im Vergleich zum Dateisystem bietet LetoDMS jedoch weitere
+Metadaten und einen vollständigen Workflow zur Prüfung und Freigabe von
+Dokumenten. 
+
+<h1>Erste Schritte</h1>
+<p>Ein Zugriff auf die von LetoDMS verwalteten Dokumenten erfordert
+die Anmeldung auf der Startseite von LetoDMS. Sofern der Gastzugang
+freigeschaltet ist, kann über den Verweis unterhalb des Anmeldeformulars
+ein eingeschränkter Zugang ohne Eingabe von Anmeldedaten genutzt werden.</p>
+
+<p>Nach erfolgreicher Anmeldung erscheint eine Seite mit der Ordnerhierarchie
+und man befindet sich im Wurzelverzeichnis, dass üblicherweise mit DMS
+bezeichnet wird.</p>
+
+<h1>Zugriffsrechte</h1>
+
+<h1>Prüfung und Freigabe</h1>
+
+<h1>Administration</h1>
+
+<h1>Installation</h1>
 
 

languages/German/lang.inc

@@ -2,6 +2,7 @@
 //    MyDMS. Document Management System
 //    Copyright (C) 2002-2005  Markus Westphal
 //    Copyright (C) 2006-2008 Malcolm Cowe
+//    Copyright (C) 2010 Matteo Lucarelli
 //    Copyright (C) 2012 Uwe Steinmann
 //
 //    This program is free software; you can redistribute it and/or modify
@@ -44,6 +45,7 @@ $text["add_user"] = "Neuen Benutzer anlegen";
 $text["add_user_to_group"] = "Benutzer in Gruppe einfügen";
 $text["admin"] = "Administrator";
 $text["admin_tools"] = "Administrationsbereich";
+$text["all"] = "Alle";
 $text["all_categories"] = "Alle Kategorien";
 $text["all_documents"] = "alle Dokumente";
 $text["all_pages"] = "Alle";
@@ -66,6 +68,17 @@ $text["assign_approvers"] = "Freigebende zuweisen";
 $text["assign_reviewers"] = "Prüfer zuweisen";
 $text["assign_user_property_to"] = "Assign user's properties to";
 $text["assumed_released"] = "Angenommen, freigegeben";
+$text["attrdef_management"] = "Attributdefinitions-Management";
+$text["attrdef_in_use"] = "Definition des Attributs wird noch verwendet";
+$text["attrdef_in_use"] = "Definition des Attributs noch in Gebrauch";
+$text["attrdef_name"] = "Name";
+$text["attrdef_multiple"] = "Mehrfachwerte erlaubt";
+$text["attrdef_objtype"] = "Objekttyp";
+$text["attrdef_type"] = "Typ";
+$text["attrdef_minvalues"] = "Min. Anzahl Werte";
+$text["attrdef_maxvalues"] = "Max. Anzahl Werte";
+$text["attrdef_valueset"] = "Werteauswahl";
+$text["attributes"] = "Attribute";
 $text["august"] = "August";
 $text["automatic_status_update"] = "Automatischer Statuswechsel";
 $text["back"] = "Zurück";
@@ -92,7 +105,8 @@ $text["change_assignments"] = "Zuweisungen ändern";
 $text["change_password"] = "Password ändern";
 $text["change_password_message"] = "Ihr Passwort wurde geändert.";
 $text["change_status"] = "Status ändern";
-$text["choose_category"] = "--Bitte wählen--";
+$text["choose_attrdef"] = "--Attributdefinition wählen--";
+$text["choose_category"] = "--Kategorie wählen--";
 $text["choose_group"] = "--Gruppe wählen--";
 $text["choose_target_category"] = "Kategorie wählen";
 $text["choose_target_document"] = "Dokument wählen";
@@ -129,7 +143,7 @@ $text["default_keywords"] = "Verfügbare Schlüsselworte";
 $text["delete"] = "Löschen";
 $text["details"] = "Details";
 $text["details_version"] = "Details für Version:[version]";
-$text["disclaimer"] = "Dies ist ein geschützter Bereich. Nur authorisiertes Personal hat Zugriff. Jegliche Verstösse werden nach geltendem Recht (Englisch und International) verfolgt.";
+$text["disclaimer"] = "Dies ist ein geschützter Bereich. Nur authorisiertes Personal hat Zugriff. Jegliche Verstöße werden nach geltendem Recht (Englisch und International) verfolgt.";
 $text["do_object_repair"] = "Repariere alle Ordner und Dokumente.";
 $text["document_already_locked"] = "Dieses Dokument ist bereits gesperrt";
 $text["document_deleted"] = "Dokument gelöscht"; 
@@ -144,13 +158,14 @@ $text["document_renamed_email"] = "Dokument umbenannt";
 $text["documents"] = "Dokumente";
 $text["documents_in_process"] = "Dokumente in Bearbeitung";
 $text["documents_locked_by_you"] = "Von mir gesperrte Dokumente";
+$text["documents_only"] = "Nur Dokumente";
 $text["document_status_changed_email"] = "Dokumentenstatus geändert";
 $text["documents_to_approve"] = "Freigabe erforderlich";
 $text["documents_to_review"] = "Prüfung erforderlich";
 $text["documents_user_requiring_attention"] = "Diese Dokumente sollte ich mal nachsehen";
 $text["document_title"] = "Dokument '[documentname]'";
 $text["document_updated_email"] = "Dokument aktualisiert";
-$text["does_not_expire"] = "Keine Gültigkeit";
+$text["does_not_expire"] = "Kein Ablaufdatum";
 $text["does_not_inherit_access_msg"] = "Berechtigungen wieder erben";
 $text["download"] = "Download";
 $text["draft_pending_approval"] = "Entwurf - bevorstehende Freigabe";
@@ -159,6 +174,7 @@ $text["dump_creation"] = "DB dump erzeugen";
 $text["dump_creation_warning"] = "Mit dieser Operation können Sie einen Dump der Datenbank erzeugen. Nach der Erstellung wird der Dump im Datenordner Ihres Servers gespeichert.";
 $text["dump_list"] = "Vorhandene DB dumps";
 $text["dump_remove"] = "DB dump löschen";
+$text["edit_attributes"] = "Edit attributes";
 $text["edit_comment"] = "Kommentar bearbeiten";
 $text["edit_default_keywords"] = "Schlüsselworte bearbeiten";
 $text["edit_document_access"] = "Zugriffsrechte bearbeiten";
@@ -186,8 +202,8 @@ $text["error_no_folder_selected"] = "Kein Ordner ausgewählt";
 $text["error_occured"] = "Ein Fehler ist aufgetreten.<br />Bitte Administrator benachrichtigen.<p>";
 $text["event_details"] = "Ereignisdetails";
 $text["expired"] = "abgelaufen";
-$text["expires"] = "Gültigkeit";
+$text["expires"] = "Ablaufdatum";
-$text["expiry_changed_email"] = "Verfallsdatum geändert";
+$text["expiry_changed_email"] = "Ablaufdatum geändert";
 $text["february"] = "Februar";
 $text["file"] = "Datei";
 $text["files_deletion"] = "Dateien löschen"; 
@@ -208,6 +224,7 @@ $text["from"] = "von";
 $text["fullsearch"] = "Volltextsuche";
 $text["fullsearch_hint"] = "Volltextindex benutzen";
 $text["fulltext_info"] = "Volltext-Index Info";
+$text["global_attributedefinitions"] = "Attributdefinitionen";
 $text["global_default_keywords"] = "Globale Stichwortlisten";
 $text["global_document_categories"] = "Kategorien";
 $text["group_approval_summary"] = "Freigabe-Gruppen";
@@ -304,12 +321,14 @@ $text["move"] = "verschieben";
 $text["my_account"] = "Mein Profil";
 $text["my_documents"] = "Meine Dokumente";
 $text["name"] = "Name";
+$text["new_attrdef"] = "Neue Attributdefinition";
 $text["new_default_keyword_category"] = "Neue Kategorie";
 $text["new_default_keywords"] = "Neue Vorlage";
 $text["new_document_category"] = "Neue Kategorie";
 $text["new_document_email"] = "Neues Dokument";
 $text["new_file_email"] = "Neuer Anhang";
 $text["new_folder"] = "Neuer Ordner";
+$text["new_password"] = "Neues Passwort";
 $text["new"] = "Neu"; 
 $text["new_subfolder_email"] = "Neuer Ordner";
 $text["new_user_image"] = "Neues Bild";
@@ -373,6 +392,7 @@ $text["review_status"] = "Status: prüfen";
 $text["review_submit_email"] = "Prüfung ausgeführt";
 $text["review_summary"] = "Übersicht Prüfungen";
 $text["review_update_failed"] = "Störung bei Aktualisierung des Prüfstatus. Aktualisierung gescheitert.";
+$text["rm_attrdef"] = "Attributdefinition löschen";
 $text["rm_default_keyword_category"] = "Kategorie löschen";
 $text["rm_document"] = "Löschen";
 $text["rm_document_category"] = "Lösche Kategorie";
@@ -407,7 +427,7 @@ $text["seq_end"] = "Ans Ende";
 $text["seq_keep"] = "Beibehalten";
 $text["seq_start"] = "An den Anfang";
 $text["sequence"] = "Reihenfolge";
-$text["set_expiry"] = "Gültigkeit festlegen";
+$text["set_expiry"] = "Ablaufdatum festlegen";
 $text["set_owner_error"] = "Fehler beim Setzen des Besitzers";
 $text["set_owner"] = "Besitzer festlegen";
 $text["set_password"] = "Passwort setzen";
@@ -473,6 +493,12 @@ $text["settings_enableCalendar_desc"] = "Kalender ein/ausschalten";
 $text["settings_enableCalendar"] = "Kalender einschalten";
 $text["settings_enableConverting_desc"] = "Ein/Auschalten der automatischen Konvertierung von Dokumenten";
 $text["settings_enableConverting"] = "Dokumentenkonvertierung einschalten";
+$text["settings_enableNotificationAppRev_desc"] = "Setzen Sie diese Option, wenn die Prüfer und Freigeber eines Dokuments beim Hochladen einer neuen Version benachrichtigt werden sollen.";
+$text["settings_enableNotificationAppRev"] = "Prűfer/Freigeber benachrichtigen";
+$text["settings_enableVersionModification_desc"] = "Setzen Sie diese Option, wenn Versionen eines Dokuments nach dem Hochladen noch durch reguläre Benutzer verändert werden dürfen. Administratoren dürfen dies immer.";
+$text["settings_enableVersionModification"] = "Erlaube Modifikation von Versionen";
+$text["settings_enableVersionDeletion_desc"] = "Setzen Sie diese Option, wenn frühere Versionen eines Dokuments durch reguläre Benutzer gelöscht werden können. Administratoren dürfen dies immer.";
+$text["settings_enableVersionDeletion"] = "Erlaube Löschen alter Versionen";
 $text["settings_enableEmail_desc"] = "Automatische E-Mail-Benachrichtigung ein-/ausschalten";
 $text["settings_enableEmail"] = "E-mail aktivieren";
 $text["settings_enableFolderTree_desc"] = "Schaltet den Verzeichnisbaum ein oder aus";
@@ -483,12 +509,16 @@ $text["settings_enableGuestLogin_desc"] = "Wenn Sie Gast-Logins erlauben wollen,
 $text["settings_enableGuestLogin"] = "Anmeldung als Gast";
 $text["settings_enableLargeFileUpload_desc"] = "Wenn dies gesetzt ist, dann ist ebenfalls der Upload von Dokumenten durch ein java applet mit Namen 'jumploader' ohne Begrenzung der maximalen Dateigröße möglich. Auch das Hochladen mehrerer Dokumente in einem Schritt wird dadurch ermöglicht.";
 $text["settings_enableLargeFileUpload"] = "Hochladen von sehr großen Dateien ermöglichen";
+$text["settings_enableOwnerNotification_desc"] = "Setzen Sie diese Option, wenn der Besitzer eines Dokuments nach dem Hochladen in die Liste der Beobachter eingetragen werden soll.";
+$text["settings_enableOwnerNotification"] = "Besitzer als Beobachter eintragen";
 $text["settings_enablePasswordForgotten_desc"] = "Setzen Sie diese Option, wenn Benutzer ein neues Password per E-Mail anfordern dürfen.";
 $text["settings_enablePasswordForgotten"] = "Passwort-Vergessen Funktion einschalten";
 $text["settings_enableUserImage_desc"] = "Foto der Benutzer ein-/ausschalten";
 $text["settings_enableUserImage"] = "Benutzerbilder einschalten";
 $text["settings_enableUsersView_desc"] = "Gruppen- und Benutzeransicht für alle Benutzer ein-/ausschalten";
 $text["settings_enableUsersView"] = "Benutzeransicht aktivieren";
+$text["settings_encryptionKey"] = "Verschlüsselungs-Sequenz";
+$text["settings_encryptionKey_desc"] = "Diese Zeichenkette wird verwendet um eine eindeutige Kennung zu erzeugen, die als verstecktes Feld in einem Formular untergebracht wird. Sie dient zur Verhinderung von CSRF-Attacken.";
 $text["settings_error"] = "Fehler";
 $text["settings_encryptionKey"] = "Verschlüsselungs-Sequenz";
 $text["settings_encryptionKey_desc"] = "Diese Zeichenkette wird verwendet um eine eindeutige Kennung zu erzeugen, die als verstecktes Feld in einem Formular untergebracht wird. Sie dient zur Verhinderung von CSRF-Attacken.";
@@ -522,6 +552,7 @@ $text["settings_maxDirID"] = "Max. Anzahl Unterverzeichnisse";
 $text["settings_maxExecutionTime_desc"] = "Maximale Zeit in Sekunden bis ein Skript beendet wird.";
 $text["settings_maxExecutionTime"] = "Max. Ausführungszeit (s)";
 $text["settings_more_settings"] = "Weitere Einstellungen. Login mit admin/admin";
+$text["settings_Notification"] = "Benachrichtigungen-Einstellungen";
 $text["settings_no_content_dir"] = "Content directory";
 $text["settings_notfound"] = "Nicht gefunden";
 $text["settings_notwritable"] = "Die Konfiguration kann nicht gespeichert werden, weil die Konfigurationsdatei nicht schreibbar ist.";

languages/Spanish/lang.inc

@@ -2,6 +2,8 @@
 //    MyDMS. Document Management System
 //    Copyright (C) 2002-2005  Markus Westphal
 //    Copyright (C) 2006-2008 Malcolm Cowe
+//    Copyright (C) 2010 Matteo Lucarelli
+//    Copyright (C) 2012 Uwe Steinmann
 //
 //    This program is free software; you can redistribute it and/or modify
 //    it under the terms of the GNU General Public License as published by
@@ -22,6 +24,10 @@
 //    Reviewed : 15-sept-2011.  Francisco M. Garcia Claramonte
 //    Reviewed (for 3.2.0) : 22-sept-2011.   Francisco M. Garcia Claramonte
 //    Reviewed (for 3.3.0) : 3-mar-2012.   Francisco M. Garcia Claramonte
+//    Reviewed (for 3.3.7) : 04-sept-2012.   Francisco M. Garcia Claramonte
+//    Reviewed (for 3.3.8) : 13 sept-2012. Francisco M. García Claramonte
+//                           18 sept 2012. Francisco M. García Claramonte
+//    Reviewed (for 3.4.0RC1): 15 oct 2012. Francisco M. García Claramonte
 
 $text = array();
 $text["accept"] = "Aceptar";
@@ -33,7 +39,7 @@ $text["access_mode_none"] = "No hay acceso";
 $text["access_mode_read"] = "Leer";
 $text["access_mode_readwrite"] = "Lectura-Escritura";
 $text["access_permission_changed_email"] = "Permisos cambiados";
-$text["according_settings"] = "translate: according settings";
+$text["according_settings"] = "Conforme a configuración";
 $text["actions"] = "Acciones";
 $text["add"] = "Añadir";
 $text["add_doc_reviewer_approver_warning"] = "Documentos N.B. se marcan automáticamente como publicados si no hay revisores o aprobadores asignados.";
@@ -71,6 +77,16 @@ $text["assign_approvers"] = "Asignar aprobadores";
 $text["assign_reviewers"] = "Asignar revisores";
 $text["assign_user_property_to"] = "Asignar propiedades de usuario a";
 $text["assumed_released"] = "Supuestamente publicado";
+$text["attrdef_management"] = "Gestión de definición de atributos";
+$text["attrdef_in_use"] = "Definición de atributo todavía en uso";
+$text["attrdef_name"] = "Nombre";
+$text["attrdef_multiple"] = "Permitir múltiples valores";
+$text["attrdef_objtype"] = "Tipo de objeto";
+$text["attrdef_type"] = "Tipo";
+$text["attrdef_minvalues"] = "Núm. mínimo de valores";
+$text["attrdef_maxvalues"] = "Núm. máximo de valores";
+$text["attrdef_valueset"] = "Conjunto de valores";
+$text["attributes"] = "Atributos";
 $text["august"] = "Agosto";
 $text["automatic_status_update"] = "Cambio automático de estado";
 $text["back"] = "Atrás";
@@ -97,6 +113,7 @@ $text["change_assignments"] = "Cambiar asignaciones";
 $text["change_password"] = "Cambiar contraseña";
 $text["change_password_message"] = "Su contraseña se ha modificado.";
 $text["change_status"] = "Cambiar estado";
+$text["choose_attrdef"] = "Por favor, seleccione definición de atributo";
 $text["choose_category"] = "Seleccione categoría";
 $text["choose_group"] = "Seleccione grupo";
 $text["choose_target_category"] = "Seleccione categoría";
@@ -124,6 +141,7 @@ $text["continue"] = "Continuar";
 $text["create_fulltext_index"] = "Crear índice de texto completo";
 $text["create_fulltext_index_warning"] = "Usted va a regenerar el índice te texto completo. Esto puede tardar un tiempo considerable y consumir capacidad de su equipo. Si realmente quiere regenerar el índice, por favor confirme la operación.";
 $text["creation_date"] = "Creación";
+$text["current_password"] = "Contraseña actual";
 $text["current_version"] = "Versión actual";
 $text["daily"] = "Diaria";
 $text["databasesearch"] = "Búsqueda en base de datos";
@@ -148,6 +166,7 @@ $text["document_renamed_email"] = "Documento renombrado";
 $text["documents"] = "Documentos";
 $text["documents_in_process"] = "Documentos en proceso";
 $text["documents_locked_by_you"] = "Documentos bloqueados por usted";
+$text["documents_only"] = "Solo documentos";
 $text["document_status_changed_email"] = "Estado del documento modificado";
 $text["documents_to_approve"] = "Documentos en espera de aprobación de usuarios";
 $text["documents_to_review"] = "Documentos en espera de revisión de usuarios";
@@ -163,6 +182,7 @@ $text["dump_creation"] = "Creación de volcado de BDD";
 $text["dump_creation_warning"] = "Con esta operación se creará un volcado a fichero del contenido de la base de datos. Después de la creación del volcado el fichero se guardará en la carpeta de datos de su servidor.";
 $text["dump_list"] = "Ficheros de volcado existentes";
 $text["dump_remove"] = "Eliminar fichero de volcado";
+$text["edit_attributes"] = "Editar atributos";
 $text["edit_comment"] = "Editar comentario";
 $text["edit_default_keywords"] = "Editar palabras clave";
 $text["edit_document_access"] = "Editar acceso";
@@ -212,6 +232,7 @@ $text["from"] = "Desde";
 $text["fullsearch"] = "Búsqueda en texto completo";
 $text["fullsearch_hint"] = "Utilizar índice de texto completo";
 $text["fulltext_info"] = "Información de índice de texto completo";
+$text["global_attributedefinitions"] = "Definición de atributos";
 $text["global_default_keywords"] = "Palabras clave globales";
 $text["global_document_categories"] = "Categorías";
 $text["group_approval_summary"] = "Resumen del grupo aprobador";
@@ -228,7 +249,7 @@ $text["hourly"] = "Horaria";
 $text["human_readable"] = "Archivo legible por humanos"; 
 $text["include_documents"] = "Incluir documentos";
 $text["include_subdirectories"] = "Incluir subdirectorios";
-$text["index_converters"] = "translate: Index document conversion";
+$text["index_converters"] = "Conversión de índice de documentos";
 $text["individuals"] = "Individuales";
 $text["inherits_access_msg"] = "Acceso heredado.";
 $text["inherits_access_copy_msg"] = "Copiar lista de acceso heredado";
@@ -253,7 +274,7 @@ $text["invalid_target_doc_id"] = "ID de documento destino no válido";
 $text["invalid_target_folder"] = "ID de carpeta destino no válido";
 $text["invalid_user_id"] = "ID de usuario no válido";
 $text["invalid_version"] = "Versión de documento no válida";
-$text["is_disabled"] = "translate: Disable account";
+$text["is_disabled"] = "Deshabilitar cuenta";
 $text["is_hidden"] = "Ocultar de la lista de usuarios";
 $text["january"] = "Enero";
 $text["js_no_approval_group"] = "Por favor, seleccione grupo de aprobación";
@@ -287,8 +308,8 @@ $text["lock_document"] = "Bloquear";
 $text["lock_message"] = "Este documento ha sido bloqueado por <a href=\"mailto:[email]\">[username]</a>.<br />Solo usuarios autorizados pueden desbloquear este documento (vea el final de la página).";
 $text["lock_status"] = "Estado";
 $text["login"] = "Iniciar sesión";
-$text["login_disabled_text"] = "translate: Your account is disabled, probably because of too many failed logins.";
+$text["login_disabled_text"] = "Su cuenta está deshabilitada, probablemente es debido a demasiados intentos de acceso fallidos.";
-$text["login_disabled_title"] = "translate: Account is disabled";
+$text["login_disabled_title"] = "La cuenta está deshabilitada";
 $text["login_error_text"] = "Error de acceso. ID de usuario o contraseña incorrectos.";
 $text["login_error_title"] = "Error de acceso";
 $text["login_not_given"] = "Nombre de usuario no facilitado.";
@@ -308,12 +329,14 @@ $text["move"] = "Mover";
 $text["my_account"] = "Mi cuenta";
 $text["my_documents"] = "Mis documentos";
 $text["name"] = "Nombre";
+$text["new_attrdef"] = "Nueva definición de atributo";
 $text["new_default_keyword_category"] = "Nueva categoría";
 $text["new_default_keywords"] = "Agregar palabras claves";
 $text["new_document_category"] = "Añadir categoría";
 $text["new_document_email"] = "Nuevo documento";
 $text["new_file_email"] = "Nuevo adjunto";
 $text["new_folder"] = "Nueva carpeta";
+$text["new_password"] = "Nueva contraseña";
 $text["new"] = "Nuevo"; 
 $text["new_subfolder_email"] = "Nueva carpeta";
 $text["new_user_image"] = "Nueva imagen";
@@ -336,7 +359,7 @@ $text["notify_deleted_email"] = "Se le ha eliminado de la lista de notificación
 $text["no_update_cause_locked"] = "No puede actualizar este documento. Contacte con el usuario que lo bloqueó.";
 $text["no_user_image"] = "No se encontró imagen";
 $text["november"] = "Noviembre";
-$text["now"] = "translate: now";
+$text["now"] = "ahora";
 $text["objectcheck"] = "Chequeo de carpeta/documento";
 $text["obsolete"] = "Obsoleto";
 $text["october"] = "Octubre";
@@ -345,17 +368,18 @@ $text["only_jpg_user_images"] = "Solo puede usar imágenes .jpg como imágenes d
 $text["owner"] = "Propietario";
 $text["ownership_changed_email"] = "Propietario cambiado";
 $text["password"] = "Contraseña";
-$text["password_already_used"] = "translate: Password already used";
+$text["password_already_used"] = "La contraseña ya está en uso";
 $text["password_repeat"] = "Repetir contraseña";
-$text["password_expiration"] = "translate: Password expiration";
+$text["password_expiration"] = "Caducidad de la contraseña";
-$text["password_expiration_text"] = "translate: Your password has expired. Please choose a new one before you can proceed using LetoDMS.";
+$text["password_expiration_text"] = "Su contraseña ha caducado. Por favor seleccione una nueva para seguir usando LetoDMS.";
 $text["password_forgotten"] = "Recordar contraseña";
 $text["password_forgotten_email_subject"] = "Recordatorio de contraseña";
 $text["password_forgotten_email_body"] = "Estimado usuario de LetoDMS,\n\nhemos recibido una petición para cambiar su contraseña.\n\nPuede modificarla haciendo click en el siguiente enlace:\n\n###URL_PREFIX###out/out.ChangePassword.php?hash=###HASH###\n\nSi continua teniendo problemas de acceso, por favor contacte con el administrador del sistema."; 
 $text["password_forgotten_send_hash"] = "Las instrucciones para proceder al cambio se han enviado a la dirección de correo de usuario";
 $text["password_forgotten_text"] = "Rellene el siguiente formulario y siga las instrucciones del correo que se le enviará.";
 $text["password_forgotten_title"] = "Envío de contraseña";
-$text["password_strength_insuffient"] = "translate: Insuffient password strength";
+$text["password_wrong"] = "Contraseña incorrecta";
+$text["password_strength_insuffient"] = "Fortaleza de la contraseña insuficiente";
 $text["personal_default_keywords"] = "Listas de palabras clave personales";
 $text["previous_versions"] = "Versiones anteriores";
 $text["refresh"] = "Actualizar";
@@ -376,6 +400,7 @@ $text["review_status"] = "Estado de revisión";
 $text["review_submit_email"] = "Revisión enviada";
 $text["review_summary"] = "Resumen de revisión";
 $text["review_update_failed"] = "Error actualizando el estado de la revisión. La actualización ha fallado.";
+$text["rm_attrdef"] = "Eliminar definición de atributo";
 $text["rm_default_keyword_category"] = "Eliminar categoría";
 $text["rm_document"] = "Eliminar documento";
 $text["rm_document_category"] = "Eliminar categoría";
@@ -396,7 +421,7 @@ $text["search_mode_and"] = "todas las palabras";
 $text["search_mode_or"] = "al menos una palabra";
 $text["search_no_results"] = "No hay documentos que coinciden con su búsqueda";
 $text["search_query"] = "Buscar";
-$text["search_report"] = "Encontrados [doccount] documentos y [foldercount] carpetas";
+$text["search_report"] = "Encontrados [doccount] documentos y [foldercount] carpetas en [searchtime] s.";
 $text["search_report_fulltext"] = "Encontrados [doccount] documentos";
 $text["search_results_access_filtered"] = "Los resultados de la búsqueda podrían incluir contenidos cuyo acceso ha sido denegado.";
 $text["search_results"] = "Resultados de la búsqueda";
@@ -413,16 +438,16 @@ $text["sequence"] = "Secuencia";
 $text["set_expiry"] = "Establecer caducidad";
 $text["set_owner_error"] = "Error estableciendo propietario";
 $text["set_owner"] = "Establecer propietario";
-$text["set_password"] = "translate: Set Password";
+$text["set_password"] = "Establecer contraseña";
 $text["settings_install_welcome_title"] = "Bienvenido a la instalación de letoDMS";
 $text["settings_install_welcome_text"] = "<p>Antes de instalar letoDMS asegúrese de haber creado un archivo «ENABLE_INSTALL_TOOL» en su directorio de instalación, en otro caso la instalación no funcionará. En sistemas Unix puede hacerse fácilmente con «touch conf/ENABLE_INSTALL_TOOL». Después de terminar la instalación elimine el archivo.</p><p>letoDMS tiene unos requisitos mínimos. Necesitará una base de datos y un servidor web con soporte para php. Para la búsqueda de texto completo lucene, necesitará tener instalado también el framework Zend donde pueda ser utilizado por php. Desde la versión 3.2.0 de letoDMS ADObd ya no forma parte de la distribución. Consiga una copia de él desde <a href=\"http://adodb.sourceforge.net/\">http://adodb.sourceforge.net</a> e instálelo. La ruta hacia él podrá ser establecida durante la instalación.</p><p> Si prefiere crear la base de datos antes de comenzar la instalación, simplemente créela manualmente con su herramienta preferida, opcionalmente cree un usuario de base de datos con acceso a esta base de datos e importe uno de los volcados del directorio de configuración. El script de instalación puede hacer esto también, pero necesitará acceso con privilegios suficientes para crear bases de datos.</p>";
 $text["settings_start_install"] = "Comenzar instalación";
-$text["settings_sortUsersInList"] = "translate: Sort users in list";
+$text["settings_sortUsersInList"] = "Ordenar los usuarios en la lista";
-$text["settings_sortUsersInList_desc"] = "translate: Sets if users in selection menus are ordered by login or by its full name";
+$text["settings_sortUsersInList_desc"] = "Establecer si los menús de selección de usuarios se ordenan por nombre de acceso o por nombre completo";
-$text["settings_sortUsersInList_val_login"] = "translate: Sort by login";
+$text["settings_sortUsersInList_val_login"] = "Ordenar por nombre de acceso";
-$text["settings_sortUsersInList_val_fullname"] = "translate: Sort by full name";
+$text["settings_sortUsersInList_val_fullname"] = "Ordernar por nombre completo";
-$text["settings_stopWordsFile"] = "Path to stop words file";
+$text["settings_stopWordsFile"] = "Ruta al fichero de palabras comunes";
-$text["settings_stopWordsFile_desc"] = "translate: If fulltext search is enabled, this file will contain stop words not being indexed";
+$text["settings_stopWordsFile_desc"] = "Si la búsqueda de texto completo está habilitada, este fichero contendrá palabras comunes que no se indexarán";
 $text["settings_activate_module"] = "Activar módulo";
 $text["settings_activate_php_extension"] = "Activar extensión PHP";
 $text["settings_adminIP"] = "IP de administración";
@@ -441,8 +466,8 @@ $text["settings_contentOffsetDir"] = "Directorio de contenidos de desplazamiento
 $text["settings_contentOffsetDir_desc"] = "Para tratar las limitaciones del sistema de ficheros subyacente, se ha ideado una estructura de directorios dentro del directorio de contenido. Esto requiere un directorio base desde el que comenzar. Normalmente puede dejar este valor por omisión, 1048576, pero puede ser cualquier número o cadena que no exista ya dentro él (directorio de contenido).";
 $text["settings_coreDir"] = "Directorio de letoDMS Core";
 $text["settings_coreDir_desc"] = "Ruta hacia LetoDMS_Core (opcional)";
-$text["settings_loginFailure_desc"] = "translate: Disable account after n login failures.";
+$text["settings_loginFailure_desc"] = "Deshabilitar cuenta después de n intentos de acceso.";
-$text["settings_loginFailure"] = "translate: Login failure";
+$text["settings_loginFailure"] = "Fallo de acceso";
 $text["settings_luceneClassDir"] = "Directorio de LetoDMS Lucene";
 $text["settings_luceneClassDir_desc"] = "Ruta hacia LetoDMS_Lucene (opcional)";
 $text["settings_luceneDir"] = "Directorio índice de Lucene";
@@ -476,6 +501,12 @@ $text["settings_enableCalendar_desc"] = "Habilitar/Deshabilitar calendario";
 $text["settings_enableCalendar"] = "Habilitar calendario";
 $text["settings_enableConverting_desc"] = "Habilitar/Deshabilitar conversión de ficheros";
 $text["settings_enableConverting"] = "Habilitar conversión";
+$text["settings_enableNotificationAppRev_desc"] = "Habilitar para enviar notificación a revisor/aprobador cuando se añade una nueva versión de documento";
+$text["settings_enableNotificationAppRev"] = "Habilitar notificación a revisor/aprobador";
+$text["settings_enableVersionModification_desc"] = "Habilitar/Deshabilitar la modificación de versiones de documentos por parte de usuarios después de añadir una nueva versión. El administrador siempre podrá modificar la versión después de añadida.";
+$text["settings_enableVersionModification"] = "Habilitar la modificación de versiones";
+$text["settings_enableVersionDeletion_desc"] = "Habilitar/Deshabilitar la eliminación de versiones anteriores de documentos por parte de usuarios. El administrador siempre podrá eliminar versiones antiguas.";
+$text["settings_enableVersionDeletion"] = "Habilitar la eliminación de versiones anteriores";
 $text["settings_enableEmail_desc"] = "Habilitar/Deshabilitar notificación automática por correo electrónico";
 $text["settings_enableEmail"] = "Habilitar E-mail";
 $text["settings_enableFolderTree_desc"] = "Falso para no mostrar el árbol de carpetas";
@@ -485,9 +516,11 @@ $text["settings_enableFullSearch_desc"] = "Habilitar búsqueda de texto completo
 $text["settings_enableGuestLogin_desc"] = "Si quiere que cualquiera acceda como invitado, chequee esta opción. Nota: El acceso de invitado debería permitirse solo en entornos de confianza";
 $text["settings_enableGuestLogin"] = "Habilitar acceso de invitado";
 $text["settings_enableLargeFileUpload_desc"] = "Si se habilita, la carga de ficheros también estará disponible a través de un applet java llamado jumploader, sin límite de tamaño de fichero fijado por el navegador. También permite la carga de múltiples ficheros de una sola vez.";
-$text["settings_enableLargeFileUpload"] = "Enable large file upload";
+$text["settings_enableLargeFileUpload"] = "Habilitar la carga de ficheros grandes";
-$text["settings_enablePasswordForgotten_desc"] = "If you want to allow user to set a new password and send it by mail, check this option.";
+$text["settings_enablePasswordForgotten_desc"] = "Si quiere permitir a los usuarios fijar una nueva contraseña recibiendo un correo electrónico, active esta opción.";
-$text["settings_enablePasswordForgotten"] = "Enable Password forgotten";
+$text["settings_enableOwnerNotification_desc"] = "Marcar para añadir una notificación al propietario del documento cuando es añadido.";
+$text["settings_enableOwnerNotification"] = "Habilitar notificación al propietario por omisión";
+$text["settings_enablePasswordForgotten"] = "Habilitar recordatorio de contraseña";
 $text["settings_enableUserImage_desc"] = "Habilitar imágenes de usuario";
 $text["settings_enableUserImage"] = "Habilitar imágenes de usuario";
 $text["settings_enableUsersView_desc"] = "Habilitar/Deshabilitar vista de usuario y grupo por todos los usuarios";
@@ -508,9 +541,9 @@ $text["settings_httpRoot_desc"] = "La ruta relativa de la URL, después de la pa
 $text["settings_httpRoot"] = "Raíz Http";
 $text["settings_installADOdb"] = "Instalar ADOdb";
 $text["settings_install_success"] = "La instalación ha terminado con éxito";
-$text["settings_install_pear_package_log"] = "translate: Install Pear package 'Log'";
+$text["settings_install_pear_package_log"] = "Instale el paquete Pear 'Log'";
-$text["settings_install_pear_package_webdav"] = "translate: Install Pear package 'HTTP_WebDAV_Server', if you intend to use the webdav interface";
+$text["settings_install_pear_package_webdav"] = "Instale el paquete Pear 'HTTP_WebDAV_Server', si quiere utilizar el interfaz webdav";
-$text["settings_install_zendframework"] = "translate: Install Zend Framework, if you intend to use the full text search engine";
+$text["settings_install_zendframework"] = "Instale Zend Framework, si quiere usar el sistema de búsqueda de texto completo";
 $text["settings_language"] = "Idioma por omisión";
 $text["settings_language_desc"] = "Idioma por omisión (nombre de un subdirectorio en el directorio \"languages\")";
 $text["settings_logFileEnable_desc"] = "Habilitar/Deshabilitar archivo de registro";
@@ -523,21 +556,22 @@ $text["settings_maxDirID"] = "ID máximo de directorio";
 $text["settings_maxExecutionTime_desc"] = "Esto configura el tiempo máximo en segundos que un script puede estar ejectutándose antes de que el analizador lo pare";
 $text["settings_maxExecutionTime"] = "Tiempo máximo de ejecución (s)";
 $text["settings_more_settings"] = "Configure más parámetros. Acceso por omisión: admin/admin";
+$text["settings_Notification"] = "Parámetros de notificación";
 $text["settings_no_content_dir"] = "Directorio de contenidos";
 $text["settings_notfound"] = "No encontrado";
 $text["settings_notwritable"] = "La configuración no se puede guardar porque el fichero de configuración no es escribible.";
 $text["settings_partitionSize"] = "Tamaño de fichero parcial";
 $text["settings_partitionSize_desc"] = "Tamaño de ficheros parciales en bytes, subidos por jumploader. No configurar un valor mayor que el tamaño máximo de subida configurado en el servidor.";
-$text["settings_passwordExpiration"] = "translate: Password expiration";
+$text["settings_passwordExpiration"] = "Caducidad de contraseña";
-$text["settings_passwordExpiration_desc"] = "translate: The number of days after which a password expireѕ and must be reset. 0 turns password expiration off.";
+$text["settings_passwordExpiration_desc"] = "El número de días tras los cuales una contraseña caduca y debe configurarse. 0 deshabilita la caducidad de contraseña.";
-$text["settings_passwordHistory"] = "translate: Password history";
+$text["settings_passwordHistory"] = "Historial de contraseñas";
-$text["settings_passwordHistory_desc"] = "translate: The number of passwords a user must have been used before a password can be reused. 0 turns the password history off.";
+$text["settings_passwordHistory_desc"] = "El número de contraseñas que un usuario debe usar antes de que una contraseña pueda volver a ser utilizada. 0 deshabilita el historial de contraseñas.";
-$text["settings_passwordStrength"] = "translate: Min. password strength";
+$text["settings_passwordStrength"] = "Min. fortaleza de contraseña";
-$text["settings_passwordЅtrength_desc"] = "translate: The minimum password strength is an integer value from 0 to 100. Setting it to 0 will turn off checking for the minimum password strength.";
+$text["settings_passwordЅtrength_desc"] = "La fortaleza mínima de contraseña es un valor numérico de 0 a 100. Configurándolo a 0 deshabilita la validación de fortaleza mínima.";
-$text["settings_passwordStrengthAlgorithm"] = "translate: Algorithm for password strength";
+$text["settings_passwordStrengthAlgorithm"] = "Algoritmo de fortaleza de contraseña";
-$text["settings_passwordStrengthAlgorithm_desc"] = "translate: The algorithm used for calculating the password strength. The 'simple' algorithm just checks for at least eight chars total, a lower case letter, an upper case letter, a number and a special char. If those conditions are met the returned score is 100 otherwise 0.";
+$text["settings_passwordStrengthAlgorithm_desc"] = "El algoritmo utilizado para calcular la fortaleza de contraseña. El algoritmo «simple» solo chequea que haya al menos 8 caracteres en total, una letra minúscula y una mayúscula, un número y un caracter especial. Si se cumplen estas condiciones la puntuación devuelta es 100 de otro modo es 0."; 
-$text["settings_passwordStrengthAlgorithm_valsimple"] = "translate: simple";
+$text["settings_passwordStrengthAlgorithm_valsimple"] = "simple";
-$text["settings_passwordStrengthAlgorithm_valadvanced"] = "translate: advanced";
+$text["settings_passwordStrengthAlgorithm_valadvanced"] = "avanzada";
 $text["settings_perms"] = "Permisos";
 $text["settings_pear_log"] = "Paquete Pear : Log";
 $text["settings_pear_webdav"] = "Paquete Pear : HTTP_WebDAV_Server";
@@ -604,7 +638,7 @@ $text["submit_login"] = "Conectar";
 $text["submit_password"] = "Fijar nueva contraseña";
 $text["submit_password_forgotten"] = "Comenzar el proceso";
 $text["submit_review"] = "Enviar revisión";
-$text["submit_userinfo"] = "translate: Submit info";
+$text["submit_userinfo"] = "Enviar información";
 $text["sunday"] = "Domingo";
 $text["theme"] = "Tema gráfico";
 $text["thursday"] = "Jueves";

op/op.AddDocument.php

@@ -27,6 +27,11 @@ include("../inc/inc.Language.php");
 include("../inc/inc.ClassUI.php");
 include("../inc/inc.Authentication.php");
 
+/* Check if the form data comes for a trusted request */
+if(!checkFormKey('adddocument')) {
+	UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_request_token"))),getMLText("invalid_request_token"));
+}
+
 if (!isset($_POST["folderid"]) || !is_numeric($_POST["folderid"]) || intval($_POST["folderid"])<1) {
 	UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_folder_id"))),getMLText("invalid_folder_id"));
 }
@@ -49,6 +54,8 @@ $version_comment = $_POST["version_comment"];
 
 $keywords = $_POST["keywords"];
 $categories = preg_replace('/[^0-9,]+/', '', $_POST["categoryidform1"]);
+$attributes = $_POST["attributes"];
+$attributes_version = $_POST["attributes_version"];
 
 $reqversion = (int)$_POST["reqversion"];
 if ($reqversion<1) $reqversion=1;
@@ -160,10 +167,12 @@ for ($file_num=0;$file_num<count($_FILES["userfile"]["tmp_name"]);$file_num++){
 			$cats[] = $dms->getDocumentCategory($catid);
 		}
 	}
+
 	$res = $folder->addDocument($name, $comment, $expires, $user, $keywords,
 															$cats, $userfiletmp, basename($userfilename),
 	                            $fileType, $userfiletype, $sequence,
-	                            $reviewers, $approvers, $reqversion,$version_comment);
+	                            $reviewers, $approvers, $reqversion,
+	                            $version_comment, $attributes, $attributes_version);
 
 	if (is_bool($res) && !$res) {
 		UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("error_occured"));
@@ -176,9 +185,39 @@ for ($file_num=0;$file_num<count($_FILES["userfile"]["tmp_name"]);$file_num++){
 				}
 			}
 		}
-		// Send notification to subscribers.
+		if($settings->_enableFullSearch) {
+			if(!empty($settings->_luceneClassDir))
+				require_once($settings->_luceneClassDir.'/Lucene.php');
+			else
+				require_once('LetoDMS/Lucene.php');
+
+			$index = LetoDMS_Lucene_Indexer::open($settings->_luceneDir);
+			LetoDMS_Lucene_Indexer::init($settings->_stopWordsFile);
+			$index->addDocument(new LetoDMS_Lucene_IndexedDocument($dms, $document, $settings->_convcmd ? $settings->_convcmd : null, true));
+		}
+
+		/* Add a default notification for the owner of the document */
+		if($settings->_enableOwnerNotification) {
+			$res = $document->addNotify($user->getID(), true);
+		}
+		// Send notification to subscribers of folder.
 		if($notifier) {
-			$folder->getNotifyList();
+			$notifyList = $folder->getNotifyList();
+			if($settings->_enableNotificationAppRev) {
+				/* Reviewers and approvers will be informed about the new document */
+				foreach($reviewers['i'] as $reviewerid) {
+					$notifyList['users'][] = $dms->getUser($reviewerid);
+				}
+				foreach($approvers['i'] as $approverid) {
+					$notifyList['users'][] = $dms->getUser($approverid);
+				}
+				foreach($reviewers['g'] as $reviewergrpid) {
+					$notifyList['groups'][] = $dms->getGroup($reviewergrpid);
+				}
+				foreach($approvers['g'] as $approvergrpid) {
+					$notifyList['groups'][] = $dms->getGroup($approvergrpid);
+				}
+			}
 			$subject = "###SITENAME###: ".$folder->_name." - ".getMLText("new_document_email");
 			$message = getMLText("new_document_email")."\r\n";
 			$message .= 
@@ -188,11 +227,9 @@ for ($file_num=0;$file_num<count($_FILES["userfile"]["tmp_name"]);$file_num++){
 				getMLText("comment_for_current_version").": ".$version_comment."\r\n".
 				"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."\r\n";
 
-			$subject=$subject;
-			$message=$message;
 			
-			$notifier->toList($user, $folder->_notifyList["users"], $subject, $message);
+			$notifier->toList($user, $notifyList["users"], $subject, $message);
-			foreach ($folder->_notifyList["groups"] as $grp) {
+			foreach ($notifyList["groups"] as $grp) {
 				$notifier->toGroup($user, $grp, $subject, $message);
 			}
 		}

op/op.AddSubFolder.php

@@ -27,6 +27,11 @@ include("../inc/inc.ClassUI.php");
 include("../inc/inc.ClassEmail.php");
 include("../inc/inc.Authentication.php");
 
+/* Check if the form data comes for a trusted request */
+if(!checkFormKey('addsubfolder')) {
+	UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_request_token"))),getMLText("invalid_request_token"));
+}
+
 if (!isset($_POST["folderid"]) || !is_numeric($_POST["folderid"]) || intval($_POST["folderid"])<1) {
 	UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_folder_id"))),getMLText("invalid_folder_id"));
 }
@@ -51,7 +56,8 @@ if (!is_numeric($sequence)) {
 
 $name = $_POST["name"];
 $comment = $_POST["comment"];
-$subFolder = $folder->addSubFolder($name, $comment, $user, $sequence);
+$attributes = $_POST["attributes"];
+$subFolder = $folder->addSubFolder($name, $comment, $user, $sequence, $attributes);
 
 if (is_object($subFolder)) {
 	// Send notification to subscribers.

op/op.AttributeMgr.php

@@ -0,0 +1,147 @@
+<?php
+//    MyDMS. Document Management System
+//    Copyright (C) 2002-2005 Markus Westphal
+//    Copyright (C) 2006-2008 Malcolm Cowe
+//    Copyright (C) 2009-2012 Uwe Steinmann
+//
+//    This program is free software; you can redistribute it and/or modify
+//    it under the terms of the GNU General Public License as published by
+//    the Free Software Foundation; either version 2 of the License, or
+//    (at your option) any later version.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU General Public License for more details.
+//
+//    You should have received a copy of the GNU General Public License
+//    along with this program; if not, write to the Free Software
+//    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+
+include("../inc/inc.Settings.php");
+include("../inc/inc.DBInit.php");
+include("../inc/inc.Language.php");
+include("../inc/inc.ClassUI.php");
+include("../inc/inc.ClassEmail.php");
+include("../inc/inc.Authentication.php");
+
+if (!$user->isAdmin()) {
+	UI::exitError(getMLText("admin_tools"),getMLText("access_denied"));
+}
+
+if (isset($_POST["action"])) $action=$_POST["action"];
+else $action=NULL;
+
+// add new attribute definition ---------------------------------------------
+if ($action == "addattrdef") {
+	
+	/* Check if the form data comes for a trusted request */
+	if(!checkFormKey('addattrdef')) {
+		UI::exitError(getMLText("admin_tools"),getMLText("invalid_request_token"));
+	}
+
+	$name = trim($_POST["name"]);
+	$type = intval($_POST["type"]);
+	$objtype = intval($_POST["objtype"]);
+	if(isset($_POST["multiple"]))
+		$multiple = trim($_POST["multiple"]);
+	else
+		$multiple = 0;
+	$minvalues = intval($_POST["minvalues"]);
+	$maxvalues = intval($_POST["maxvalues"]);
+	$valueset = trim($_POST["valueset"]);
+
+	if($name == '') {
+		UI::exitError(getMLText("admin_tools"),getMLText("attrdef_noname"));
+	}
+	if (is_object($dms->getAttributeDefinitionByName($name))) {
+		UI::exitError(getMLText("admin_tools"),getMLText("attrdef_exists"));
+	}
+	$newAttrdef = $dms->addAttributeDefinition($name, $objtype, $type, $multiple, $minvalues, $maxvalues, $valueset);
+	if (!$newAttrdef) {
+		UI::exitError(getMLText("admin_tools"),getMLText("error_occured"));
+	}
+	$attrdefid=$newAttrdef->getID();
+}
+
+// delet attribute definition -----------------------------------------------
+else if ($action == "removeattrdef") {
+
+	/* Check if the form data comes for a trusted request */
+	if(!checkFormKey('removeattrdef')) {
+		UI::exitError(getMLText("admin_tools"),getMLText("invalid_request_token"));
+	}
+
+	if (!isset($_POST["attrdefid"]) || !is_numeric($_POST["attrdefid"]) || intval($_POST["attrdefid"])<1) {
+		UI::exitError(getMLText("admin_tools"),getMLText("unknown_attrdef"));
+	}
+	$attrdefid = $_POST["attrdefid"];
+	$attrdef = $dms->getAttributeDefinition($attrdefid);
+	if (!is_object($attrdef)) {
+		UI::exitError(getMLText("admin_tools"),getMLText("unknown_attrdef"));
+	}
+
+	if (!$attrdef->remove()) {
+		UI::exitError(getMLText("admin_tools"),getMLText("error_occured"));
+	}
+	$attrdefid=-1;
+}
+
+// edit attribute definition -----------------------------------------------
+else if ($action == "editattrdef") {
+
+	/* Check if the form data comes for a trusted request */
+	if(!checkFormKey('editattrdef')) {
+		UI::exitError(getMLText("admin_tools"),getMLText("invalid_request_token"));
+	}
+
+	if (!isset($_POST["attrdefid"]) || !is_numeric($_POST["attrdefid"]) || intval($_POST["attrdefid"])<1) {
+		UI::exitError(getMLText("admin_tools"),getMLText("unknown_attrdef"));
+	}
+	$attrdefid = $_POST["attrdefid"];
+	$attrdef = $dms->getAttributeDefinition($attrdefid);
+	if (!is_object($attrdef)) {
+		UI::exitError(getMLText("admin_tools"),getMLText("unknown_attrdef"));
+	}
+
+	$name = $_POST["name"];
+	$type = intval($_POST["type"]);
+	$objtype = intval($_POST["objtype"]);
+	if(isset($_POST["multiple"]))
+		$multiple = trim($_POST["multiple"]);
+	else
+		$multiple = 0;
+	$minvalues = intval($_POST["minvalues"]);
+	$maxvalues = intval($_POST["maxvalues"]);
+	$valueset = trim($_POST["valueset"]);
+	if (!$attrdef->setName($name)) {
+		UI::exitError(getMLText("admin_tools"),getMLText("error_occured"));
+	}
+	if (!$attrdef->setType($type)) {
+		UI::exitError(getMLText("admin_tools"),getMLText("error_occured"));
+	}
+	if (!$attrdef->setObjType($objtype)) {
+		UI::exitError(getMLText("admin_tools"),getMLText("error_occured"));
+	}
+	if (!$attrdef->setMultipleValues($multiple)) {
+		UI::exitError(getMLText("admin_tools"),getMLText("error_occured"));
+	}
+	if (!$attrdef->setMinValues($minvalues)) {
+		UI::exitError(getMLText("admin_tools"),getMLText("error_occured"));
+	}
+	if (!$attrdef->setMaxValues($maxvalues)) {
+		UI::exitError(getMLText("admin_tools"),getMLText("error_occured"));
+	}
+	if (!$attrdef->setValueSet($valueset)) {
+		UI::exitError(getMLText("admin_tools"),getMLText("error_occured"));
+	}
+}
+
+else {
+	UI::exitError(getMLText("admin_tools"),getMLText("unknown_command"));
+}
+
+header("Location:../out/out.AttributeMgr.php?attrdefid=".$attrdefid);
+
+?>
+

op/op.DocumentNotify.php

@@ -46,13 +46,15 @@ if (isset($_GET["userid"]) && (!is_numeric($_GET["userid"]) || $_GET["userid"]<-
 	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("unknown_user"));
 }
 
-$userid = $_GET["userid"];
+if(isset($_GET["userid"]))
+	$userid = $_GET["userid"];
 
 if (isset($_GET["groupid"]) && (!is_numeric($_GET["groupid"]) || $_GET["groupid"]<-1)) {
 	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("unknown_group"));
 }
 
-$groupid = $_GET["groupid"];
+if(isset($_GET["groupid"]))
+	$groupid = $_GET["groupid"];
 
 if (isset($_GET["groupid"])&&$_GET["groupid"]!=-1){
 	$group=$dms->getGroup($groupid);
@@ -114,10 +116,12 @@ if ($action == "delnotify"){
 //				$subject=mydmsDecodeString($subject);
 //				$message=mydmsDecodeString($message);
 		
-				if ($isUser) {
+				if (isset($userid)) {
+					$obj = $dms->getUser($userid);
 					$notifier->toIndividual($user, $obj, $subject, $message);
 				}
-				else {
+				else if (isset($groupid)) {
+					$obj = $dms->getGroup($groupid);
 					$notifier->toGroup($user, $obj, $subject, $message);
 				}
 			}

op/op.EditAttributes.php

@@ -0,0 +1,101 @@
+<?php
+//    MyDMS. Document Management System
+//    Copyright (C) 2002-2005  Markus Westphal
+//    Copyright (C) 2006-2008 Malcolm Cowe
+//    Copyright (C) 2010 Matteo Lucarelli
+//
+//    This program is free software; you can redistribute it and/or modify
+//    it under the terms of the GNU General Public License as published by
+//    the Free Software Foundation; either version 2 of the License, or
+//    (at your option) any later version.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU General Public License for more details.
+//
+//    You should have received a copy of the GNU General Public License
+//    along with this program; if not, write to the Free Software
+//    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+
+include("../inc/inc.Settings.php");
+include("../inc/inc.LogInit.php");
+include("../inc/inc.Utils.php");
+include("../inc/inc.DBInit.php");
+include("../inc/inc.Language.php");
+include("../inc/inc.ClassUI.php");
+include("../inc/inc.ClassEmail.php");
+include("../inc/inc.Authentication.php");
+
+/* Check if the form data comes for a trusted request */
+if(!checkFormKey('editattributes')) {
+	UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_request_token"))),getMLText("invalid_request_token"));
+}
+
+if (!isset($_POST["documentid"]) || !is_numeric($_POST["documentid"]) || intval($_POST["documentid"])<1) {
+	UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
+}
+
+$documentid = $_POST["documentid"];
+$document = $dms->getDocument($documentid);
+
+if (!is_object($document)) {
+	UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
+}
+
+$folder = $document->getFolder();
+$docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".$document->getName()."</a>";
+
+if ($document->getAccessMode($user) < M_READWRITE) {
+	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+}
+
+$versionid = $_POST["version"];
+$version = $document->getContentByVersion($versionid);
+
+if (!is_object($version)) {
+	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+}
+
+$attributes = $_POST["attributes"];
+
+if($attributes) {
+	$oldattributes = $version->getAttributes();
+	foreach($attributes as $attrdefid=>$attribute) {
+		if(!isset($oldattributes[$attrdefid]) || $attribute != $oldattributes[$attrdefid]->getValue()) {
+			if(!$version->setAttributeValue($dms->getAttributeDefinition($attrdefid), $attribute)) {
+				UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("error_occured"));
+			} else {
+				$document->getNotifyList();
+				if($notifier) {
+					$subject = "###SITENAME###: ".$document->getName().", v.".$version->_version." - ".getMLText("attribute_changed_email");
+					$message = getMLText("attribute_changed_email")."\r\n";
+					$message .= 
+						getMLText("document").": ".$document->getName()."\r\n".
+						getMLText("version").": ".$version->_version."\r\n".
+						getMLText("attribute").": ".$attribute."\r\n".
+						getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".
+						"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."&version=".$version->_version."\r\n";
+
+		//			$subject=mydmsDecodeString($subject);
+		//			$message=mydmsDecodeString($message);
+
+					if(isset($document->_notifyList["users"])) {
+						$notifier->toList($user, $document->_notifyList["users"], $subject, $message);
+					}
+					if(isset($document->_notifyList["groups"])) {
+						foreach ($document->_notifyList["groups"] as $grp) {
+							$notifier->toGroup($user, $grp, $subject, $message);
+						}
+					}
+				}
+			}
+		}
+	}
+}
+
+add_log_line("?documentid=".$documentid);
+
+header("Location:../out/out.DocumentVersionDetail.php?documentid=".$documentid."&version=".$versionid);
+
+?>

op/op.EditComment.php

@@ -27,6 +27,11 @@ include("../inc/inc.ClassUI.php");
 include("../inc/inc.ClassEmail.php");
 include("../inc/inc.Authentication.php");
 
+/* Check if the form data comes for a trusted request */
+if(!checkFormKey('editcomment')) {
+	UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_request_token"))),getMLText("invalid_request_token"));
+}
+
 if (!isset($_POST["documentid"]) || !is_numeric($_POST["documentid"]) || intval($_POST["documentid"])<1) {
 	UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
 }

op/op.EditDocument.php

@@ -52,6 +52,7 @@ $sequence = $_POST["sequence"];
 if (!is_numeric($sequence)) {
 	$sequence="keep";
 }
+$attributes = $_POST["attributes"];
 
 if (($oldname = $document->getName()) != $name) {
 	if($document->setName($name)) {
@@ -154,6 +155,16 @@ if($categories) {
 	}
 }
 
+if($attributes) {
+	$oldattributes = $document->getAttributes();
+	foreach($attributes as $attrdefid=>$attribute) {
+		if(!isset($oldattributes[$attrdefid]) || $attribute != $oldattributes[$attrdefid]->getValue()) {
+			if(!$document->setAttributeValue($dms->getAttributeDefinition($attrdefid), $attribute))
+				UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("error_occured"));
+		}
+	}
+}
+
 if($sequence != "keep") {
  	if($document->setSequence($sequence)) {
 	}

op/op.EditFolder.php

@@ -49,6 +49,7 @@ $sequence = $_POST["sequence"];
 if (!is_numeric($sequence)) {
 	$sequence = "keep";
 }
+$attributes = $_POST["attributes"];
 
 $wasupdated = false;
 if(($oldname = $folder->getName()) != $name) {
@@ -102,6 +103,17 @@ if(($oldcomment = $folder->getComment()) != $comment) {
 		UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("error_occured"));	
 	}
 }
+
+if($attributes) {
+	$oldattributes = $folder->getAttributes();
+	foreach($attributes as $attrdefid=>$attribute) {
+		if(!isset($oldattributes[$attrdefid]) || $attribute != $oldattributes[$attrdefid]->getValue()) {
+			if(!$folder->setAttributeValue($dms->getAttributeDefinition($attrdefid), $attribute))
+				UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("error_occured"));
+		}
+	}
+}
+
 if(strcasecmp($sequence, "keep")) {
 	if($folder->setSequence($sequence)) {
 	} else {

op/op.EditUserData.php

@@ -2,6 +2,7 @@
 //    MyDMS. Document Management System
 //    Copyright (C) 2002-2005  Markus Westphal
 //    Copyright (C) 2006-2008 Malcolm Cowe
+//    Copyright (C) 2009-2012 Uwe Steinmann
 //
 //    This program is free software; you can redistribute it and/or modify
 //    it under the terms of the GNU General Public License as published by
@@ -88,27 +89,27 @@ if ($user->getEmail() != $email)
 if ($user->getComment() != $comment)
 	$user->setComment($comment);
 
-if (is_uploaded_file($_FILES["userfile"]["tmp_name"]) && $_FILES["userfile"]["size"] > 0 && $_FILES['userfile']['error']==0)
+if (isset($_FILES["userfile"]) && is_uploaded_file($_FILES["userfile"]["tmp_name"]) && $_FILES["userfile"]["size"] > 0 && $_FILES['userfile']['error']==0)
 {
-	$lastDotIndex = strrpos(basename($_FILES["userfile"]["name"]), ".");
+	$finfo = new finfo(FILEINFO_MIME);
-	$fileType = substr($_FILES["userfile"]["name"], $lastDotIndex);
+	echo $finfo->file($_FILES["userfile"]["tmp_name"]);
-	if ($fileType != ".jpg" && $filetype != ".jpeg") {
+	if(substr($finfo->file($_FILES["userfile"]["tmp_name"]), 0, 10) != "image/jpeg") {;
 		UI::exitError(getMLText("user_info"),getMLText("only_jpg_user_images"));
 	}
-	//verkleinern des Bildes, so dass es 150 Pixel hoch ist
+	// shrink the image to a max height of 150 px
-	// Originalbild einlesen
+	// read original image
 	$origImg = imagecreatefromjpeg($_FILES["userfile"]["tmp_name"]);
 	$width = imagesx($origImg);
 	$height = imagesy($origImg);
-	// Thumbnail im Speicher erzeugen
+	// create thumbnail in memory
 	$newHeight = 150;
 	$newWidth = ($width/$height) * $newHeight;
 	$newImg = imagecreatetruecolor($newWidth, $newHeight);
-	// Verkleinern
+	// shrink image
 	imagecopyresized($newImg, $origImg, 0, 0, 0, 0, $newWidth, $newHeight, $width, $height);
-	// In File speichern 
+	// save image to file
 	imagejpeg($newImg, $_FILES["userfile"]["tmp_name"]);
-	// Aufräumen
+	// clean up
 	imagedestroy($origImg);
 	imagedestroy($newImg);
 	$user->setImage($_FILES["userfile"]["tmp_name"], $_FILES["userfile"]["type"]);

op/op.FolderAccess.php

@@ -43,6 +43,12 @@ if ($folder->getAccessMode($user) < M_ALL) {
 	UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("access_denied"));
 }
 
+/* Check if the form data comes for a trusted request */
+/* FIXME: Currently GET request are allowed. */
+if(!checkFormKey('folderaccess', 'GET')) {
+	UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("invalid_request_token"));
+}
+
 switch ($_GET["action"]) {
 	case "setowner":
 	case "delaccess":

op/op.FolderNotify.php

@@ -25,33 +25,37 @@ include("../inc/inc.ClassUI.php");
 include("../inc/inc.ClassEmail.php");
 include("../inc/inc.Authentication.php");
 
-if (!isset($_GET["folderid"]) || !is_numeric($_GET["folderid"]) || intval($_GET["folderid"])<1) {
+if(!checkFormKey('foldernotify')) {
+	UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("invalid_request_token"));
+}
+
+if (!isset($_POST["folderid"]) || !is_numeric($_POST["folderid"]) || intval($_POST["folderid"])<1) {
 	UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_folder_id"))),getMLText("invalid_folder_id"));
 }
 
-$folderid = $_GET["folderid"];
+$folderid = $_POST["folderid"];
 $folder = $dms->getFolder($folderid);
 
 if (!is_object($folder)) {
 	UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_folder_id"))),getMLText("invalid_folder_id"));
 }
 
-if (!isset($_GET["action"]) || (strcasecmp($_GET["action"], "delnotify") && strcasecmp($_GET["action"], "addnotify"))) {
+if (!isset($_POST["action"]) || (strcasecmp($_POST["action"], "delnotify") && strcasecmp($_POST["action"], "addnotify"))) {
 	UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("invalid_action"));
 }
-$action = $_GET["action"];
+$action = $_POST["action"];
 
-if (isset($_GET["userid"]) && (!is_numeric($_GET["userid"]) || $_GET["userid"]<-1)) {
+if (isset($_POST["userid"]) && (!is_numeric($_POST["userid"]) || $_POST["userid"]<-1)) {
 	UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("unknown_user"));
 }
-$userid = $_GET["userid"];
+$userid = $_POST["userid"];
 
-if (isset($_GET["groupid"]) && (!is_numeric($_GET["groupid"]) || $_GET["groupid"]<-1)) {
+if (isset($_POST["groupid"]) && (!is_numeric($_POST["groupid"]) || $_POST["groupid"]<-1)) {
 	UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("unknown_group"));
 }
-$groupid = $_GET["groupid"];
+$groupid = $_POST["groupid"];
 
-if (isset($_GET["groupid"])&&$_GET["groupid"]!=-1){
+if (isset($_POST["groupid"])&&$_POST["groupid"]!=-1){
 	$group=$dms->getGroup($groupid);
 	if (!$group->isMember($user,true) && !$user->isAdmin())
 		UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("access_denied"));

op/op.RemoveDocument.php

@@ -51,6 +51,22 @@ $nl =	$document->getNotifyList();
 if (!$document->remove()) {
 	UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("error_occured"));
 } else {
+
+	/* Remove the document from the fulltext index */
+	if($settings->_enableFullSearch) {
+		if(!empty($settings->_luceneClassDir))
+			require_once($settings->_luceneClassDir.'/Lucene.php');
+		else
+			require_once('LetoDMS/Lucene.php');
+
+		$index = LetoDMS_Lucene_Indexer::open($settings->_luceneDir);
+		if($hits = $index->find('document_id:'.$documentid)) {
+			$hit = $hits[0];
+			$index->delete($hit->id);
+			$index->commit();
+		}
+	}
+
 	if ($notifier){
 		$path = "";
 		$folderPath = $folder->getPath();

op/op.RemoveFolder.php

@@ -62,9 +62,6 @@ if ($folder->remove()) {
 			getMLText("comment").": ".$folder->_comment."\r\n".
 			"URL: ###URL_PREFIX###out/out.ViewFolder.php?folderid=".$folder->_id."\r\n";
 
-//		$subject=mydmsDecodeString($subject);
-//		$message=mydmsDecodeString($message);
-		
 		$notifier->toList($user, $folder->_notifyList["users"], $subject, $message);
 		foreach ($folder->_notifyList["groups"] as $grp) {
 			$notifier->toGroup($user, $grp, $subject, $message);

op/op.RemoveVersion.php

@@ -25,6 +25,11 @@ include("../inc/inc.Language.php");
 include("../inc/inc.ClassUI.php");
 include("../inc/inc.Authentication.php");
 
+/* Check if the form data comes for a trusted request */
+if(!checkFormKey('removeversion')) {
+	UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_request_token"))),getMLText("invalid_request_token"));
+}
+
 if (!isset($_POST["documentid"]) || !is_numeric($_POST["documentid"]) || intval($_POST["documentid"])<1) {
 	UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
 }
@@ -35,6 +40,10 @@ if (!is_object($document)) {
 	UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
 }
 
+if (!$settings->_enableVersionDeletion && !$user->isAdmin()) {
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
+}
+
 if ($document->getAccessMode($user) < M_ALL) {
 	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
 }

op/op.ReviewDocument.php

@@ -26,6 +26,11 @@ include("../inc/inc.Language.php");
 include("../inc/inc.ClassUI.php");
 include("../inc/inc.Authentication.php");
 
+/* Check if the form data comes for a trusted request */
+if(!checkFormKey('reviewdocument')) {
+	UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_request_token"))),getMLText("invalid_request_token"));
+}
+
 if (!isset($_POST["documentid"]) || !is_numeric($_POST["documentid"]) || intval($_POST["documentid"])<1) {
 	UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
 }
@@ -71,7 +76,8 @@ if (!isset($_POST["reviewStatus"]) || !is_numeric($_POST["reviewStatus"]) ||
 if ($_POST["reviewType"] == "ind") {
 
 	$comment = $_POST["comment"];
-	if(0 > $latestContent->setReviewByInd($user, $user, $_POST["reviewStatus"], $comment)) {
+	$reviewLogID = $latestContent->setReviewByInd($user, $user, $_POST["reviewStatus"], $comment);
+	if(0 > $reviewLogID) {
 		UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("review_update_failed"));
 	}
 	else {
@@ -104,7 +110,8 @@ if ($_POST["reviewType"] == "ind") {
 else if ($_POST["reviewType"] == "grp") {
 	$comment = $_POST["comment"];
 	$group = $dms->getGroup($_POST['reviewGroup']);
-	if(0 > $latestContent->setReviewByGrp($group, $user, $_POST["reviewStatus"], $comment)) {
+	$reviewLogID = $latestContent->setReviewByGrp($group, $user, $_POST["reviewStatus"], $comment);
+	if(0 > $reviewLogID) {
 		UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("review_update_failed"));
 	}
 	else {

op/op.Search.php

@@ -43,42 +43,6 @@ if (isset($_GET["navBar"])) {
 	}
 }
 
-//
-// Supporting functions.
-//
-
-function makeTimeStamp($hour, $min, $sec, $year, $month, $day) {
-	$thirtyone = array (1, 3, 5, 7, 8, 10, 12);
-	$thirty = array (4, 6, 9, 11);
-
-	// Very basic check that the terms are valid. Does not fail for illegal
-	// dates such as 31 Feb.
-	if (!is_numeric($hour) || !is_numeric($min) || !is_numeric($sec) || !is_numeric($year) || !is_numeric($month) || !is_numeric($day) || $month<1 || $month>12 || $day<1 || $day>31 || $hour<0 || $hour>23 || $min<0 || $min>59 || $sec<0 || $sec>59) {
-		return false;
-	}
-	$year = (int) $year;
-	$month = (int) $month;
-	$day = (int) $day;
-
-	if (array_search($month, $thirtyone)) {
-		$max=31;
-	}
-	else if (array_search($month, $thirty)) {
-		$max=30;
-	}
-	else {
-		$max=(($year % 4 == 0) && ($year % 100 != 0 || $year % 400 == 0)) ? 29 : 28;
-	}
-
-	// If the date falls out of bounds, set it to the maximum for the given
-	// month. Makes assumption about the user's intention, rather than failing
-	// for absolutely everything.
-	if ($day>$max) {
-		$day=$max;
-	}
-
-	return mktime($hour, $min, $sec, $month, $day, $year);
-}
 
 function getTime() {
 	if (function_exists('microtime')) {
@@ -128,6 +92,7 @@ if (isset($_GET['searchin']) && is_array($_GET["searchin"])) {
 				case 1: // keywords
 				case 2: // name
 				case 3: // comment
+				case 4: // attributes
 					$searchin[$si] = $si;
 					break;
 			}
@@ -136,7 +101,7 @@ if (isset($_GET['searchin']) && is_array($_GET["searchin"])) {
 }
 
 // if none is checkd search all
-if (count($searchin)==0) $searchin=array( 0, 1, 2, 3);
+if (count($searchin)==0) $searchin=array( 0, 1, 2, 3, 4);
 
 // Check to see if the search has been restricted to a particular sub-tree in
 // the folder hierarchy.
@@ -176,13 +141,13 @@ if (isset($_GET["ownerid"]) && is_numeric($_GET["ownerid"]) && $_GET["ownerid"]!
 $startdate = array();
 $stopdate = array();
 if (isset($_GET["creationdate"]) && $_GET["creationdate"]!=null) {
-	$startdate = array('year'=>$_GET["createstartyear"], 'month'=>$_GET["createstartmonth"], 'day'=>$_GET["createstartday"]);
+	$startdate = array('year'=>$_GET["createstartyear"], 'month'=>$_GET["createstartmonth"], 'day'=>$_GET["createstartday"], 'hour'=>0, 'minute'=>0, 'second'=>0);
 	if (!checkdate($startdate['month'], $startdate['day'], $startdate['year'])) {
 		UI::contentContainer(getMLText("invalid_create_date_start"));
 		UI::htmlEndPage();
 		exit;
 	}
-	$stopdate = array('year'=>$_GET["createendyear"], 'month'=>$_GET["createendmonth"], 'day'=>$_GET["createendday"]);
+	$stopdate = array('year'=>$_GET["createendyear"], 'month'=>$_GET["createendmonth"], 'day'=>$_GET["createendday"], 'hour'=>23, 'minute'=>59, 'second'=>59);
 	if (!checkdate($stopdate['month'], $stopdate['day'], $stopdate['year'])) {
 		UI::contentContainer(getMLText("invalid_create_date_end"));
 		UI::htmlEndPage();
@@ -220,6 +185,11 @@ if(isset($_GET['categoryids']) && $_GET['categoryids']) {
 	}
 }
 
+if (isset($_GET["attributes"]))
+	$attributes = $_GET["attributes"];
+else
+	$attributes = array();
+
 //
 // Get the page number to display. If the result set contains more than
 // 25 entries, it is displayed across multiple pages.
@@ -240,9 +210,9 @@ if (isset($_GET["pg"])) {
 }
 
 
-// ------------------------------------- Suche starten --------------------------------------------
+// ---------------- Start searching -----------------------------------------
 $startTime = getTime();
-$resArr = $dms->search($query, $limit, ($pageNumber-1)*$limit, $mode, $searchin, $startFolder, $owner, $status, $startdate, $stopdate, $categories);
+$resArr = $dms->search($query, $limit, ($pageNumber-1)*$limit, $mode, $searchin, $startFolder, $owner, $status, $startdate, $stopdate, array(), array(), $categories, $attributes);
 $searchTime = getTime() - $startTime;
 $searchTime = round($searchTime, 2);
 
@@ -261,7 +231,7 @@ if($resArr['docs']) {
 		}
 	}
 }
-// -------------- Ausgabe der Ergebnisse --------------------------------
+// -------------- Output results --------------------------------------------
 
 UI::contentContainerStart();
 UI::pageList($pageNumber, $resArr['totalPages'], "../op/op.Search.php", $_GET);
@@ -270,6 +240,7 @@ print "<table class=\"folderView\">";
 print "<thead>\n<tr>\n";
 print "<th></th>\n";
 print "<th>".getMLText("name")."</th>\n";
+print "<th>".getMLText("attributes")."</th>\n";
 print "<th>".getMLText("owner")."</th>\n";
 print "<th>".getMLText("status")."</th>\n";
 print "<th>".getMLText("version")."</th>\n";
@@ -288,29 +259,42 @@ foreach ($entries as $entry) {
 			print "<tr>";
 			//print "<td><img src=\"../out/images/file.gif\" class=\"mimeicon\"></td>";
 			if (in_array(2, $searchin)) {
-				$docName = markQuery($document->getName(), "i");
+				$docName = markQuery(htmlspecialchars($document->getName()), "i");
 			} else {
-				$docName = $document->getName();
+				$docName = htmlspecialchars($document->getName());
 			}
 			print "<td><a class=\"standardText\" href=\"../out/out.ViewDocument.php?documentid=".$document->getID()."\"><img class=\"mimeicon\" src=\"../out/images/icons/".UI::getMimeIcon($lc->getFileType())."\" title=\"".$lc->getMimeType()."\"></a></td>";
 			print "<td><a class=\"standardText\" href=\"../out/out.ViewDocument.php?documentid=".$document->getID()."\">/";
 			$folder = $document->getFolder();
 			$path = $folder->getPath();
 			for ($i = 1; $i  < count($path); $i++) {
-				print $path[$i]->getName()."/";
+				print htmlspecialchars($path[$i]->getName())."/";
 			}
 			print $docName;
 			print "</a></td>";
-			
+
+			$attributes = $lc->getAttributes();
+			print "<td>";
+			print "<ul class=\"documentDetail\">\n";
+			$attributes = $lc->getAttributes();
+			if($attributes) {
+				foreach($attributes as $attribute) {
+					$attrdef = $attribute->getAttributeDefinition();
+					print "<li>".htmlspecialchars($attrdef->getName()).": ".htmlspecialchars($attribute->getValue())."</li>\n";
+				}
+			}
+			print "</ul>\n";
+			print "</td>";
+
 			$owner = $document->getOwner();
-			print "<td>".$owner->getFullName()."</td>";
+			print "<td>".htmlspecialchars($owner->getFullName())."</td>";
 			$display_status=$lc->getStatus();
 			print "<td>".getOverallStatusText($display_status["status"]). "</td>";
 
 			print "<td class=\"center\">".$lc->getVersion()."</td>";
 			
-			if (in_array(3, $searchin)) $comment = markQuery($document->getComment());
+			if (in_array(3, $searchin)) $comment = markQuery(htmlspecialchars($document->getComment()));
-			else $comment = $document->getComment();
+			else $comment = htmlspecialchars($document->getComment());
 			if (strlen($comment) > 50) $comment = substr($comment, 0, 47) . "...";
 			print "<td>".$comment."</td>";
 			print "</tr>\n";
@@ -318,25 +302,27 @@ foreach ($entries as $entry) {
 		$folder = $entry;
 			$foldercount++;
 			if (in_array(2, $searchin)) {
-				$folderName = markQuery($folder->getName(), "i");
+				$folderName = markQuery(htmlspecialchars($folder->getName()), "i");
 			} else {
-				$folderName = $folder->getName();
+				$folderName = htmlspecialchars($folder->getName());
 			}
 			print "<td><a class=\"standardText\" href=\"../out/out.ViewFolder.php?folderid=".$folder->getID()."\"><img src=\"../out/images/folder_closed.gif\" width=18 height=18 border=0></a></td>";
 			print "<td><a class=\"standardText\" href=\"../out/out.ViewFolder.php?folderid=".$folder->getID()."\">";
 			$path = $folder->getPath();
-			for ($i = 1; $i  < count($path); $i++) {
+			print "/";
-				print "/".$path[$i]->getName();
+			for ($i = 1; $i  < count($path)-1; $i++) {
+				print htmlspecialchars($path[$i]->getName())."/";
 			}
-			print $foldername;
+			print $folderName;
 			print "</a></td>";
+			print "<td></td>";
 			
 			$owner = $folder->getOwner();
-			print "<td>".$owner->getFullName()."</td>";
+			print "<td>".htmlspecialchars($owner->getFullName())."</td>";
 			print "<td></td>";
 			print "<td></td>";
-			if (in_array(3, $searchin)) $comment = markQuery($folder->getComment());
+			if (in_array(3, $searchin)) $comment = markQuery(htmlspecialchars($folder->getComment()));
-			else $comment = $folder->getComment();
+			else $comment = htmlspecialchars($folder->getComment());
 			if (strlen($comment) > 50) $comment = substr($comment, 0, 47) . "...";
 			print "<td>".$comment."</td>";
 			print "</tr>\n";

op/op.SearchFulltext.php

@@ -122,6 +122,8 @@ if($settings->_enableFullSearch) {
 	else
 		require_once('LetoDMS/Lucene.php');
 }
+
+Zend_Search_Lucene_Search_QueryParser::setDefaultEncoding('utf-8');
 $index = Zend_Search_Lucene::open($settings->_luceneDir);
 $lucenesearch = new LetoDMS_Lucene_Search($index);
 $hits = $lucenesearch->search($query, $owner ? $owner->getLogin() : '', '', $categories);
@@ -198,23 +200,23 @@ foreach ($resArr['docs'] as $document) {
 	else {
 		$lc = $document->getLatestContent();
 		print "<tr>";
-		$docName = $document->getName();
+		$docName = htmlspecialchars($document->getName());
 		print "<td><a class=\"standardText\" href=\"../out/out.ViewDocument.php?documentid=".$document->getID()."\">/";
 		$folder = $document->getFolder();
 		$path = $folder->getPath();
 		for ($i = 1; $i  < count($path); $i++) {
-			print $path[$i]->getName()."/";
+			print htmlspecialchars($path[$i]->getName())."/";
 		}
 		print $docName;
 		print "</a></td>";
 		
 		$owner = $document->getOwner();
-		print "<td>".$owner->getFullName()."</td>";
+		print "<td>".htmlspecialchars($owner->getFullName())."</td>";
 		print "<td>".getOverallStatusText($lc->getStatus()). "</td>";
 
 		print "<td class=\"center\">".$lc->getVersion()."</td>";
 		
-		$comment = $document->getComment();
+		$comment = htmlspecialchars($document->getComment());
 		if (strlen($comment) > 50) $comment = substr($comment, 0, 47) . "...";
 		print "<td>".$comment."</td>";
 		print "</tr>\n";

op/op.SetReviewersApprovers.php

@@ -116,20 +116,19 @@ foreach ($pIndRev as $p) {
 				switch ($res) {
 					case 0:
 						// Send an email notification to the new reviewer.
-						if ($notifier) {
+						if($settings->_enableNotificationAppRev) {
-							$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("review_request_email");
+							if ($notifier) {
-							$message = getMLText("review_request_email")."\r\n";
+								$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("review_request_email");
-							$message .= 
+								$message = getMLText("review_request_email")."\r\n";
-								getMLText("document").": ".$document->getName()."\r\n".
+								$message .= 
-								getMLText("version").": ".$content->_version."\r\n".
+									getMLText("document").": ".$document->getName()."\r\n".
-								getMLText("comment").": ".$content->getComment()."\r\n".
+									getMLText("version").": ".$content->_version."\r\n".
-								getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".
+									getMLText("comment").": ".$content->getComment()."\r\n".
-								"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."&version=".$content->_version."\r\n";
+									getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".
-
+									"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."&version=".$content->_version."\r\n";
-//							$subject=mydmsDecodeString($subject);
+								
-//							$message=mydmsDecodeString($message);
+								$notifier->toIndividual($user, $docAccess["users"][$accessIndex["i"][$p]], $subject, $message);
-							
+							}
-							$notifier->toIndividual($user, $docAccess["users"][$accessIndex["i"][$p]], $subject, $message);
 						}
 						break;
 					case -1:
@@ -164,7 +163,6 @@ if (count($reviewIndex["i"]) > 0) {
 				// revision or does not exist.
 				$queryStr = "INSERT INTO `tblDocumentReviewLog` (`reviewID`, `status`, `comment`, `date`, `userID`) ".
 					"VALUES ('". $reviewStatus[$rv["idx"]]["reviewID"] ."', '-2', '".getMLText("removed_reviewer")."', NOW(), '". $user->getID() ."')";
-				echo $queryStr;
 				$res = $db->getResult($queryStr);
 			}
 			else {
@@ -174,20 +172,19 @@ if (count($reviewIndex["i"]) > 0) {
 				switch ($res) {
 					case 0:
 						// Send an email notification to the reviewer.
-						if ($notifier) {
+						if($settings->_enableNotificationAppRev) {
-							$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("review_deletion_email");
+							if ($notifier) {
-							$message = getMLText("review_deletion_email")."\r\n";
+								$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("review_deletion_email");
-							$message .= 
+								$message = getMLText("review_deletion_email")."\r\n";
-								getMLText("document").": ".$document->getName()."\r\n".
+								$message .= 
-								getMLText("version").": ".$content->_version."\r\n".
+									getMLText("document").": ".$document->getName()."\r\n".
-								getMLText("comment").": ".$content->getComment()."\r\n".
+									getMLText("version").": ".$content->_version."\r\n".
-								getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".			
+									getMLText("comment").": ".$content->getComment()."\r\n".
-								"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."\r\n";
+									getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".			
-
+									"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."\r\n";
-//							$subject=mydmsDecodeString($subject);
+								
-//							$message=mydmsDecodeString($message);
+								$notifier->toIndividual($user, $docAccess["users"][$accessIndex["i"][$rx]], $subject, $message);
-							
+							}
-							$notifier->toIndividual($user, $docAccess["users"][$accessIndex["i"][$rx]], $subject, $message);
 						}
 						break;
 					case -1:
@@ -219,20 +216,19 @@ foreach ($pGrpRev as $p) {
 				switch ($res) {
 					case 0:
 						// Send an email notification to the new reviewer.
-						if ($notifier) {
+						if($settings->_enableNotificationAppRev) {
-							$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("review_request_email");
+							if ($notifier) {
-							$message = getMLText("review_request_email")."\r\n";
+								$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("review_request_email");
-							$message .=
+								$message = getMLText("review_request_email")."\r\n";
-								getMLText("document").": ".$document->getName()."\r\n".
+								$message .=
-								getMLText("version").": ".$content->_version."\r\n".
+									getMLText("document").": ".$document->getName()."\r\n".
-								getMLText("comment").": ".$content->getComment()."\r\n".
+									getMLText("version").": ".$content->_version."\r\n".
-								getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".
+									getMLText("comment").": ".$content->getComment()."\r\n".
-								"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."&version=".$content->_version."\r\n";
+									getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".
-
+									"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."&version=".$content->_version."\r\n";
-//							$subject=mydmsDecodeString($subject);
-//							$message=mydmsDecodeString($message);
 							
-							$notifier->toGroup($user, $docAccess["groups"][$accessIndex["g"][$p]], $subject, $message);
+								$notifier->toGroup($user, $docAccess["groups"][$accessIndex["g"][$p]], $subject, $message);
+							}
 						}
 						break;
 					case -1:
@@ -265,7 +261,6 @@ if (count($reviewIndex["g"]) > 0) {
 				// revision or does not exist.
 				$queryStr = "INSERT INTO `tblDocumentReviewLog` (`reviewID`, `status`, `comment`, `date`, `userID`) ".
 					"VALUES ('". $reviewStatus[$rv["idx"]]["reviewID"] ."', '-2', '".getMLText("removed_reviewer")."', NOW(), '". $user->getID() ."')";
-				echo $queryStr;
 				$res = $db->getResult($queryStr);
 			}
 			else {
@@ -274,21 +269,20 @@ if (count($reviewIndex["g"]) > 0) {
 				switch ($res) {
 					case 0:
 						// Send an email notification to the review group.
-						if ($notifier) {
+						if($settings->_enableNotificationAppRev) {
-						
+							if ($notifier) {
-							$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("review_deletion_email");
-							$message = getMLText("review_deletion_email")."\r\n";
-							$message .= 
-								getMLText("document").": ".$document->getName()."\r\n".
-								getMLText("version").": ".$content->_version."\r\n".
-								getMLText("comment").": ".$content->getComment()."\r\n".
-								getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".			
-								"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."\r\n";
-
-//							$subject=mydmsDecodeString($subject);
-//							$message=mydmsDecodeString($message);
 							
-							$notifier->toGroup($user, $docAccess["groups"][$accessIndex["g"][$rx]], $subject, $message);
+								$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("review_deletion_email");
+								$message = getMLText("review_deletion_email")."\r\n";
+								$message .= 
+									getMLText("document").": ".$document->getName()."\r\n".
+									getMLText("version").": ".$content->_version."\r\n".
+									getMLText("comment").": ".$content->getComment()."\r\n".
+									getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".			
+									"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."\r\n";
+
+								$notifier->toGroup($user, $docAccess["groups"][$accessIndex["g"][$rx]], $subject, $message);
+							}
 						}
 						break;
 					case -1:
@@ -325,20 +319,19 @@ foreach ($pIndApp as $p) {
 				switch ($res) {
 					case 0:
 						// Send an email notification to the new approver.
-						if ($overallStatus["status"]!=0 && $notifier) {
+						if($settings->_enableNotificationAppRev) {
-							$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("approval_request_email");
+							if ($overallStatus["status"]!=0 && $notifier) {
-							$message = getMLText("approval_request_email")."\r\n";
+								$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("approval_request_email");
-							$message .= 
+								$message = getMLText("approval_request_email")."\r\n";
-								getMLText("document").": ".$document->getName()."\r\n".
+								$message .= 
-								getMLText("version").": ".$content->_version."\r\n".
+									getMLText("document").": ".$document->getName()."\r\n".
-								getMLText("comment").": ".$content->getComment()."\r\n".
+									getMLText("version").": ".$content->_version."\r\n".
-								getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".			
+									getMLText("comment").": ".$content->getComment()."\r\n".
-								"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."&version=".$content->_version."\r\n";
+									getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".			
+									"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."&version=".$content->_version."\r\n";
 
-//							$subject=mydmsDecodeString($subject);
+								$notifier->toIndividual($user, $docAccess["users"][$accessIndex["i"][$p]], $subject, $message);
-//							$message=mydmsDecodeString($message);
+							}
-							
-							$notifier->toIndividual($user, $docAccess["users"][$accessIndex["i"][$p]], $subject, $message);
 						}
 						break;
 					case -1:
@@ -380,20 +373,19 @@ if (count($approvalIndex["i"]) > 0) {
 				switch ($res) {
 					case 0:
 						// Send an email notification to the approver.
-						if ($notifier) {
+						if($settings->_enableNotificationAppRev) {
-							$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("approval_deletion_email");
+							if ($notifier) {
-							$message = getMLText("approval_deletion_email")."\r\n";
+								$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("approval_deletion_email");
-							$message .= 
+								$message = getMLText("approval_deletion_email")."\r\n";
-								getMLText("document").": ".$document->getName()."\r\n".
+								$message .= 
-								getMLText("version").": ".$content->_version."\r\n".
+									getMLText("document").": ".$document->getName()."\r\n".
-								getMLText("comment").": ".$content->getComment()."\r\n".
+									getMLText("version").": ".$content->_version."\r\n".
-								getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".			
+									getMLText("comment").": ".$content->getComment()."\r\n".
-								"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."\r\n";
+									getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".			
+									"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."\r\n";
 
-//							$subject=mydmsDecodeString($subject);
+								$notifier->toIndividual($user, $docAccess["users"][$accessIndex["i"][$rx]], $subject, $message);
-//							$message=mydmsDecodeString($message);
+							}
-							
-							$notifier->toIndividual($user, $docAccess["users"][$accessIndex["i"][$rx]], $subject, $message);
 						}
 						break;
 					case -1:
@@ -425,20 +417,19 @@ foreach ($pGrpApp as $p) {
 				switch ($res) {
 					case 0:
 						// Send an email notification to the new approver.
-						if ($overallStatus["status"]!=0 && $notifier) {
+						if($settings->_enableNotificationAppRev) {
-							$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("approval_request_email");
+							if ($overallStatus["status"]!=0 && $notifier) {
-							$message = getMLText("approval_request_email")."\r\n";
+								$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("approval_request_email");
-							$message .=
+								$message = getMLText("approval_request_email")."\r\n";
-								getMLText("document").": ".$document->getName()."\r\n".
+								$message .=
-								getMLText("version").": ".$content->_version."\r\n".
+									getMLText("document").": ".$document->getName()."\r\n".
-								getMLText("comment").": ".$content->getComment()."\r\n".
+									getMLText("version").": ".$content->_version."\r\n".
-								getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".			
+									getMLText("comment").": ".$content->getComment()."\r\n".
-								"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."&version=".$content->_version."\r\n";
+									getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".			
+									"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."&version=".$content->_version."\r\n";
 
-//							$subject=mydmsDecodeString($subject);
+								$notifier->toGroup($user, $docAccess["groups"][$accessIndex["g"][$p]], $subject, $message);
-//							$message=mydmsDecodeString($message);
+							}
-							
-							$notifier->toGroup($user, $docAccess["groups"][$accessIndex["g"][$p]], $subject, $message);
 						}
 						break;
 					case -1:
@@ -480,21 +471,20 @@ if (count($approvalIndex["g"]) > 0) {
 				switch ($res) {
 					case 0:
 						// Send an email notification to the approval group.
-						if ($notifier) {
+						if($settings->_enableNotificationAppRev) {
-						
+							if ($notifier) {
-							$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("approval_deletion_email");
-							$message = getMLText("approval_deletion_email")."\r\n";
-							$message .= 
-								getMLText("document").": ".$document->getName()."\r\n".
-								getMLText("version").": ".$content->_version."\r\n".
-								getMLText("comment").": ".$content->getComment()."\r\n".
-								getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".			
-								"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."\r\n";
-
-//							$subject=mydmsDecodeString($subject);
-//							$message=mydmsDecodeString($message);
 							
-							$notifier->toGroup($user, $docAccess["groups"][$accessIndex["g"][$rx]], $subject, $message);
+								$subject = "###SITENAME###: ".$document->getName().", v.".$content->_version." - ".getMLText("approval_deletion_email");
+								$message = getMLText("approval_deletion_email")."\r\n";
+								$message .= 
+									getMLText("document").": ".$document->getName()."\r\n".
+									getMLText("version").": ".$content->_version."\r\n".
+									getMLText("comment").": ".$content->getComment()."\r\n".
+									getMLText("user").": ".$user->getFullName()." <". $user->getEmail() .">\r\n".			
+									"URL: ###URL_PREFIX###out/out.ViewDocument.php?documentid=".$document->getID()."\r\n";
+
+								$notifier->toGroup($user, $docAccess["groups"][$accessIndex["g"][$rx]], $subject, $message);
+							}
 						}
 						break;
 					case -1:

op/op.Settings.php

@@ -126,6 +126,12 @@ if ($action == "saveSettings")
   // SETTINGS - ADVANCED - EDITION
   $settings->_versioningFileName = $_POST["versioningFileName"];
   $settings->_enableAdminRevApp = getBoolValue("enableAdminRevApp");
+  $settings->_enableVersionDeletion = getBoolValue("enableVersionDeletion");
+  $settings->_enableVersionModification = getBoolValue("enableVersionModification");
+
+  // SETTINGS - ADVANCED - NOTIFICATION
+  $settings->_enableOwnerNotification = getBoolValue("enableOwnerNotification");
+  $settings->_enableNotificationAppRev = getBoolValue("enableNotificationAppRev");
 
   // SETTINGS - ADVANCED - SERVER
   $settings->_coreDir = $_POST["coreDir"];

op/op.UpdateDocument.php

@@ -135,8 +135,9 @@ if (is_uploaded_file($_FILES["userfile"]["tmp_name"]) && $_FILES["userfile"]["si
 		}
 	}
 
+	$attributes = $_POST["attributes"];
 
-	$contentResult=$document->addContent($comment, $user, $userfiletmp, basename($userfilename), $fileType, $userfiletype, $reviewers, $approvers);
+	$contentResult=$document->addContent($comment, $user, $userfiletmp, basename($userfilename), $fileType, $userfiletype, $reviewers, $approvers, $version=0, $attributes);
 	if (is_bool($contentResult) && !$contentResult) {
 		UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("error_occured"));
 	}

op/op.UsrMgr.php

@@ -45,7 +45,10 @@ if ($action == "adduser") {
 
 	$login   = $_POST["login"];
 	$pwd     = $_POST["pwd"];
-	$pwdexpiration = $_POST["pwdexpiration"];
+	if(!isset($_POST["pwdexpiration"]))
+		$pwdexpiration = '';
+	else
+		$pwdexpiration = $_POST["pwdexpiration"];
 	$name    = $_POST["name"];
 	$email   = $_POST["email"];
 	$comment = $_POST["comment"];

out/out.AddDocument.php

@@ -102,29 +102,14 @@ $docAccess = $folder->getApproversList();
 <?php
 	}
 ?>
-</table><br>
+</table>
+<?php UI::contentSubHeading(getMLText("document_infos")); ?>
 
 <form action="../op/op.AddDocument.php" enctype="multipart/form-data" method="post" name="form1" onsubmit="return checkForm();">
+<?php echo createHiddenFieldWithKey('adddocument'); ?>
 <input type="hidden" name="folderid" value="<?php print $folderid; ?>">
 <input type="hidden" name="showtree" value="<?php echo showtree();?>">
 <table>
-<tr>
-	<td><?php printMLText("sequence");?>:</td>
-	<td><?php UI::printSequenceChooser($folder->getDocuments());?></td>
-</tr>
-<tr>
-	<td><?php printMLText("version");?>:</td>
-	<td><input name="reqversion" value="1"></td>
-</tr>
-<tr>
-	<td><?php printMLText("local_file");?>:</td>
-	<td>
-	<a href="javascript:addFiles()"><?php printMLtext("add_multiple_files") ?></a>
-	<ol id="files">
-	<li><input type="File" name="userfile[]" size="60"></li>
-	</ol>
-	</td>
-</tr>
 <tr>
 	<td><?php printMLText("name");?>:</td>
 	<td><input name="name" size="60"></td>
@@ -133,10 +118,6 @@ $docAccess = $folder->getApproversList();
 	<td><?php printMLText("comment");?>:</td>
 	<td><textarea name="comment" rows="3" cols="80"></textarea></td>
 </tr>
-<tr>
-	<td><?php printMLText("comment_for_current_version");?>:</td>
-	<td><textarea name="version_comment" rows="3" cols="80"></textarea></td>
-</tr>
 <tr>
 	<td><?php printMLText("keywords");?>:</td>
 	<td>
@@ -151,10 +132,27 @@ $docAccess = $folder->getApproversList();
 	</script>
 	</td>
 </tr>
-		<tr>
+<tr>
-			<td><?php printMLText("categories")?>:</td>
+	<td><?php printMLText("categories")?>:</td>
-			<td><?php UI::printCategoryChooser("form1");?></td>
+	<td><?php UI::printCategoryChooser("form1");?></td>
-		</tr>
+</tr>
+<tr>
+	<td><?php printMLText("sequence");?>:</td>
+	<td><?php UI::printSequenceChooser($folder->getDocuments());?></td>
+</tr>
+<?php
+	$attrdefs = $dms->getAllAttributeDefinitions(array(LetoDMS_Core_AttributeDefinition::objtype_document, LetoDMS_Core_AttributeDefinition::objtype_all));
+	if($attrdefs) {
+		foreach($attrdefs as $attrdef) {
+?>
+<tr>
+	<td><?php echo htmlspecialchars($attrdef->getName()); ?></td>
+	<td><?php UI::printAttributeEditField($attrdef, '') ?></td>
+</tr>
+<?php
+		}
+	}
+?>
 <tr>
 	<td><?php printMLText("expires");?>:</td>
 	<td>
@@ -162,6 +160,41 @@ $docAccess = $folder->getApproversList();
 	<input type="radio" name="expires" value="true"><?php UI::printDateChooser(-1, "exp");?>
 	</td>
 </tr>
+
+</table>
+
+<?php UI::contentSubHeading(getMLText("version_info")); ?>
+<table>
+<tr>
+	<td><?php printMLText("version");?>:</td>
+	<td><input name="reqversion" value="1"></td>
+</tr>
+<tr>
+	<td><?php printMLText("local_file");?>:</td>
+	<td>
+	<a href="javascript:addFiles()"><?php printMLtext("add_multiple_files") ?></a>
+	<ol id="files">
+	<li><input type="File" name="userfile[]" size="60"></li>
+	</ol>
+	</td>
+</tr>
+<tr>
+	<td><?php printMLText("comment_for_current_version");?>:</td>
+	<td><textarea name="version_comment" rows="3" cols="80"></textarea></td>
+</tr>
+<?php
+	$attrdefs = $dms->getAllAttributeDefinitions(array(LetoDMS_Core_AttributeDefinition::objtype_documentcontent, LetoDMS_Core_AttributeDefinition::objtype_all));
+	if($attrdefs) {
+		foreach($attrdefs as $attrdef) {
+?>
+<tr>
+	<td><?php echo htmlspecialchars($attrdef->getName()); ?></td>
+	<td><?php UI::printAttributeEditField($attrdef, '', 'attributes_version') ?></td>
+</tr>
+<?php
+		}
+	}
+?>
 </table>
 
 <?php UI::contentSubHeading(getMLText("assign_reviewers")); ?>
@@ -180,8 +213,8 @@ $docAccess = $folder->getApproversList();
 		$mandatory=false;
 		foreach ($res as $r) if ($r['reviewerUserID']==$usr->getID()) $mandatory=true;
 
-		if ($mandatory) print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>". htmlspecialchars($usr->getFullName());
+		if ($mandatory) print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>". htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName())."</li>";
-		else print "<li class=\"cbSelectItem\"><input id='revInd".$usr->getID()."' type='checkbox' name='indReviewers[]' value='". $usr->getID() ."'>". htmlspecialchars($usr->getFullName());
+		else print "<li class=\"cbSelectItem\"><input id='revInd".$usr->getID()."' type='checkbox' name='indReviewers[]' value='". $usr->getID() ."'>". htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName())."</li>";
 	}
 ?>
 	</ul>
@@ -195,8 +228,8 @@ $docAccess = $folder->getApproversList();
 		$mandatory=false;
 		foreach ($res as $r) if ($r['reviewerGroupID']==$grp->getID()) $mandatory=true;	
 
-		if ($mandatory) print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>".htmlspecialchars($grp->getName());
+		if ($mandatory) print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>".htmlspecialchars($grp->getName())."</li>";
-		else print "<li class=\"cbSelectItem\"><input id='revGrp".$grp->getID()."' type='checkbox' name='grpReviewers[]' value='". $grp->getID() ."'>".htmlspecialchars($grp->getName());
+		else print "<li class=\"cbSelectItem\"><input id='revGrp".$grp->getID()."' type='checkbox' name='grpReviewers[]' value='". $grp->getID() ."'>".htmlspecialchars($grp->getName())."</li>";
 	}
 ?>
 	</ul>
@@ -217,8 +250,8 @@ $docAccess = $folder->getApproversList();
 		$mandatory=false;
 		foreach ($res as $r) if ($r['approverUserID']==$usr->getID()) $mandatory=true;
 		
-		if ($mandatory) print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>". htmlspecialchars($usr->getFullName());
+		if ($mandatory) print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>". htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName());
-		else print "<li class=\"cbSelectItem\"><input id='appInd".$usr->getID()."' type='checkbox' name='indApprovers[]' value='". $usr->getID() ."'>". htmlspecialchars($usr->getFullName());
+		else print "<li class=\"cbSelectItem\"><input id='appInd".$usr->getID()."' type='checkbox' name='indApprovers[]' value='". $usr->getID() ."'>". htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName());
 	}
 ?>
 	</ul>

out/out.AddFile.php

@@ -40,10 +40,10 @@ $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if ($document->getAccessMode($user) < M_READWRITE) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 

out/out.AddFile2.php

@@ -40,10 +40,10 @@ $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if ($document->getAccessMode($user) < M_READWRITE) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 

out/out.AddMultiDocument.php

@@ -41,10 +41,10 @@ if (!is_object($folder)) {
 $folderPathHTML = getFolderPathHTML($folder, true);
 
 if ($folder->getAccessMode($user) < M_READWRITE) {
-	UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))),getMLText("access_denied"));
 }
 
-UI::htmlStartPage(getMLText("folder_title", array("foldername" => $folder->getName())));
+UI::htmlStartPage(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($folderPathHTML, "view_folder", $folder);
 

out/out.AddSubFolder.php

@@ -3,6 +3,7 @@
 //    Copyright (C) 2002-2005  Markus Westphal
 //    Copyright (C) 2006-2008 Malcolm Cowe
 //    Copyright (C) 2010 Matteo Lucarelli
+//    Copyright (C) 2010-2012 Uwe Steinmann
 //
 //    This program is free software; you can redistribute it and/or modify
 //    it under the terms of the GNU General Public License as published by
@@ -37,12 +38,11 @@ if (!is_object($folder)) {
 $folderPathHTML = getFolderPathHTML($folder, true);
 
 if ($folder->getAccessMode($user) < M_READWRITE) {
-	UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))),getMLText("access_denied"));
 }
 ?>
-
 <?php
-UI::htmlStartPage(getMLText("folder_title", array("foldername" => $folder->getName())));
+UI::htmlStartPage(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($folderPathHTML, "view_folder", $folder);
 UI::contentHeading(getMLText("add_subfolder"));
@@ -71,6 +71,7 @@ function checkForm()
 </script>
 
 <form action="../op/op.AddSubFolder.php" name="form1" onsubmit="return checkForm();" method="POST">
+	<?php echo createHiddenFieldWithKey('addsubfolder'); ?>
 	<input type="Hidden" name="folderid" value="<?php print $folderid;?>">
 	<input type="Hidden" name="showtree" value="<?php echo showtree();?>">
 	<table>
@@ -86,6 +87,19 @@ function checkForm()
 			<td class="inputDescription"><?php printMLText("sequence");?>:</td>
 			<td><?php UI::printSequenceChooser($folder->getSubFolders());?></td>
 		</tr>
+<?php
+	$attrdefs = $dms->getAllAttributeDefinitions(array(LetoDMS_Core_AttributeDefinition::objtype_folder, LetoDMS_Core_AttributeDefinition::objtype_all));
+	if($attrdefs) {
+		foreach($attrdefs as $attrdef) {
+?>
+<tr>
+	<td><?php echo htmlspecialchars($attrdef->getName()); ?></td>
+	<td><?php UI::printAttributeEditField($attrdef, '') ?></td>
+</tr>
+<?php
+		}
+	}
+?>
 		<tr>
 			<td colspan="2"><br><input type="Submit" value="<?php printMLText("add_subfolder");?>"></td>
 		</tr>

out/out.AdminTools.php

@@ -41,6 +41,7 @@ UI::contentContainerStart();
 		<li><a href="../out/out.GroupMgr.php"><?php echo getMLText("group_management")?></a></li>
 		<li><a href="../out/out.DefaultKeywords.php"><?php echo getMLText("global_default_keywords")?></a></li>
 		<li><a href="../out/out.Categories.php"><?php echo getMLText("global_document_categories")?></a></li>
+		<li><a href="../out/out.AttributeMgr.php"><?php echo getMLText("global_attributedefinitions")?></a></li>
 		<li><a href="../out/out.Info.php"><?php echo getMLText("version_info")?></a></li>
 <?php
 if($settings->_enableFullSearch) {

out/out.ApprovalSummary.php

@@ -125,11 +125,11 @@ foreach ($approvalStatus["indstatus"] as $st) {
 		}
 	
 		print "<tr>\n";
-		print "<td><a href=\"out.DocumentVersionDetail.php?documentid=".$st["documentID"]."&version=".$st["version"]."\">".$docIdx[$st["documentID"]][$st["version"]]["name"]."</a></td>";
+		print "<td><a href=\"out.DocumentVersionDetail.php?documentid=".$st["documentID"]."&version=".$st["version"]."\">".htmlspecialchars($docIdx[$st["documentID"]][$st["version"]]["name"])."</a></td>";
-		print "<td>".$docIdx[$st["documentID"]][$st["version"]]["ownerName"]."</td>";
+		print "<td>".htmlspecialchars($docIdx[$st["documentID"]][$st["version"]]["ownerName"])."</td>";
 		print "<td>".getOverallStatusText($docIdx[$st["documentID"]][$st["version"]]["status"])."</td>";
 		print "<td>".$st["version"]."</td>";
-		print "<td>".$st["date"]." ". $docIdx[$st["documentID"]][$st["version"]]["statusName"] ."</td>";
+		print "<td>".$st["date"]." ". htmlspecialchars($docIdx[$st["documentID"]][$st["version"]]["statusName"]) ."</td>";
 		print "<td>".(!$docIdx[$st["documentID"]][$st["version"]]["expires"] ? "-":getReadableDate($docIdx[$st["documentID"]][$st["version"]]["expires"]))."</td>";				
 		print "</tr>\n";
 	}
@@ -166,11 +166,11 @@ foreach ($approvalStatus["grpstatus"] as $st) {
 		}	
 	
 		print "<tr>\n";
-		print "<td><a href=\"out.DocumentVersionDetail.php?documentid=".$st["documentID"]."&version=".$st["version"]."\">".$docIdx[$st["documentID"]][$st["version"]]["name"]."</a></td>";
+		print "<td><a href=\"out.DocumentVersionDetail.php?documentid=".$st["documentID"]."&version=".$st["version"]."\">".htmlspecialchars($docIdx[$st["documentID"]][$st["version"]]["name"])."</a></td>";
-		print "<td>".$docIdx[$st["documentID"]][$st["version"]]["ownerName"]."</td>";
+		print "<td>".htmlspecialchars($docIdx[$st["documentID"]][$st["version"]]["ownerName"])."</td>";
 		print "<td>".getOverallStatusText($docIdx[$st["documentID"]][$st["version"]]["status"])."</td>";
 		print "<td>".$st["version"]."</td>";
-		print "<td>".$st["date"]." ". $docIdx[$st["documentID"]][$st["version"]]["statusName"] ."</td>";
+		print "<td>".$st["date"]." ". htmlspecialchars($docIdx[$st["documentID"]][$st["version"]]["statusName"]) ."</td>";
 		print "<td>".(!$docIdx[$st["documentID"]][$st["version"]]["expires"] ? "-":getReadableDate($docIdx[$st["documentID"]][$st["version"]]["expires"]))."</td>";				
 		print "</tr>\n";
 	}

out/out.ApproveDocument.php

@@ -40,31 +40,31 @@ $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if ($document->getAccessMode($user) < M_READ) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
 if (!isset($_GET["version"]) || !is_numeric($_GET["version"]) || intval($_GET["version"])<1) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 $version = $_GET["version"];
 $content = $document->getContentByVersion($version);
 if (!is_object($content)) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 
 // operation is admitted only for last deocument version
 $latestContent = $document->getLatestContent();
 if ($latestContent->getVersion()!=$version) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 // verify if document has expired
 if ($document->hasExpired()){
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
 $approvals = $latestContent->getApprovalStatus();
 if(!$approvals) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("no_action"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("no_action"));
 }
 
 foreach($approvals as $approval) {
@@ -74,7 +74,7 @@ foreach($approvals as $approval) {
 	}
 }
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 UI::contentHeading(getMLText("submit_approval"));

out/out.AttributeMgr.php

@@ -0,0 +1,247 @@
+<?php
+//    MyDMS. Document Management System
+//    Copyright (C) 2002-2005 Markus Westphal
+//    Copyright (C) 2006-2008 Malcolm Cowe
+//    Copyright (C) 2010 Matteo Lucarelli
+//    Copyright (C) 2009-2012 Uwe Steinmann
+//
+//    This program is free software; you can redistribute it and/or modify
+//    it under the terms of the GNU General Public License as published by
+//    the Free Software Foundation; either version 2 of the License, or
+//    (at your option) any later version.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU General Public License for more details.
+//
+//    You should have received a copy of the GNU General Public License
+//    along with this program; if not, write to the Free Software
+//    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+
+include("../inc/inc.Settings.php");
+include("../inc/inc.DBInit.php");
+include("../inc/inc.Language.php");
+include("../inc/inc.ClassUI.php");
+include("../inc/inc.Authentication.php");
+
+if (!$user->isAdmin()) {
+	UI::exitError(getMLText("admin_tools"),getMLText("access_denied"));
+}
+
+$attrdefs = $dms->getAllAttributeDefinitions();
+?>
+
+<script language="JavaScript">
+obj = -1;
+function showAttributeDefinitions(selectObj) {
+	if (obj != -1)
+		obj.style.display = "none";
+	
+	id = selectObj.options[selectObj.selectedIndex].value;
+	if (id == -1)
+		return;
+	
+	obj = document.getElementById("attrdefs" + id);
+	obj.style.display = "";
+}
+</script>
+<?php
+
+UI::htmlStartPage(getMLText("admin_tools"));
+UI::globalNavigation();
+UI::pageNavigation(getMLText("admin_tools"), "admin_tools");
+UI::contentHeading(getMLText("attrdef_management"));
+UI::contentContainerStart();
+?>
+
+	<table>
+	<tr>
+		<td><?php echo getMLText("selection")?>:</td>
+		<td>
+			<select onchange="showAttributeDefinitions(this)" id="selector">
+				<option value="-1"><?php echo getMLText("choose_attrdef")?>
+				<option value="0"><?php echo getMLText("new_attrdef")?>
+
+				<?php
+				
+				$selected=0;
+				$count=2;
+				if($attrdefs) {
+					foreach ($attrdefs as $attrdef) {
+					
+						if (isset($_GET["attrdefid"]) && $attrdef->getID()==$_GET["attrdefid"]) $selected=$count;				
+						switch($attrdef->getObjType()) {
+							case LetoDMS_Core_AttributeDefinition::objtype_all:
+								$ot = getMLText("all");
+								break;
+							case LetoDMS_Core_AttributeDefinition::objtype_folder:
+								$ot = getMLText("folder");
+								break;
+							case LetoDMS_Core_AttributeDefinition::objtype_document:
+								$ot = getMLText("document");
+								break;
+							case LetoDMS_Core_AttributeDefinition::objtype_documentcontent:
+								$ot = getMLText("version");
+								break;
+						}
+						print "<option value=\"".$attrdef->getID()."\">" . htmlspecialchars($attrdef->getName() ." (".$ot.")");
+						$count++;
+					}
+				}
+				?>
+			</select>
+			&nbsp;&nbsp;
+		</td>
+
+		<td id="attrdefs0" style="display : none;">	
+			<form action="../op/op.AttributeMgr.php" method="post">
+  		<?php echo createHiddenFieldWithKey('addattrdef'); ?>
+			<input type="Hidden" name="action" value="addattrdef">
+			<table>
+				<tr>
+					<td><?php printMLText("attrdef_name");?>:</td><td><input type="text" name="name"></td>
+				</tr>
+				<tr>
+					<td><?php printMLText("attrdef_objtype");?>:</td><td><select name="objtype"><option value="<?php echo LetoDMS_Core_AttributeDefinition::objtype_all ?>">All</option><option value="<?php echo LetoDMS_Core_AttributeDefinition::objtype_folder ?>">Folder</option><option value="<?php echo LetoDMS_Core_AttributeDefinition::objtype_document ?>"><?php printMLText("document"); ?></option><option value="<?php echo LetoDMS_Core_AttributeDefinition::objtype_documentcontent ?>"><?php printMLText("version"); ?></option></select>
+				</tr>
+				<tr>
+					<td><?php printMLText("attrdef_type");?>:</td><td><select name="type"><option value="<?php echo LetoDMS_Core_AttributeDefinition::type_int ?>">Integer</option><option value="<?php echo LetoDMS_Core_AttributeDefinition::type_float ?>">Float</option><option value="<?php echo LetoDMS_Core_AttributeDefinition::type_string ?>">String</option><option value="<?php echo LetoDMS_Core_AttributeDefinition::type_boolean ?>">Boolean</option></select></td>
+				</tr>
+				<tr>
+					<td><?php printMLText("attrdef_multiple");?>:</td><td><input type="checkbox" value="1" name="multiple" /></td>
+				</tr>
+				<tr>
+					<td><?php printMLText("attrdef_minvalues");?>:</td><td><input type="text" value="" name="minvalues" /></td>
+				</tr>
+				<tr>
+					<td><?php printMLText("attrdef_maxvalues");?>:</td><td><input type="text" value="" name="maxvalues" /></td>
+				</tr>
+				<tr>
+					<td><?php printMLText("attrdef_valueset");?>:</td><td><input type="text" value="" name="valueset" /></td>
+				</tr>
+			</table>
+			<input type="Submit" value="<?php printMLText("new_attrdef"); ?>">
+			</form>
+		</td>
+	
+	<?php	
+	
+	if($attrdefs) {
+		foreach ($attrdefs as $attrdef) {
+		
+			print "<td id=\"attrdefs".$attrdef->getID()."\" style=\"display : none;\">";	
+	?>
+				<table>
+					<tr>
+						<td colspan="2">
+<?php
+			if(!$attrdef->isUsed()) {
+?>
+							<form style="display: inline-block;" method="post" action="../op/op.AttributeMgr.php" >
+							<?php echo createHiddenFieldWithKey('removeattrdef'); ?>
+							<input type="Hidden" name="attrdefid" value="<?php echo $attrdef->getID()?>">
+							<input type="Hidden" name="action" value="removeattrdef">
+							<input value="<?php echo getMLText("rm_attrdef")?>" type="submit">
+							</form>
+<?php
+			} else {
+?>
+							<p><?php echo getMLText('attrdef_in_use') ?></p>
+<?php
+			}
+?>
+						</td>
+					</tr>
+					<tr>
+						<td colspan="2">
+							<?php UI::contentSubHeading("");?>
+						</td>
+					</tr>				
+					<form action="../op/op.AttributeMgr.php" method="post">
+					<tr>
+						<td>
+								<?php echo createHiddenFieldWithKey('editattrdef'); ?>
+								<input type="Hidden" name="action" value="editattrdef">
+								<input type="Hidden" name="attrdefid" value="<?php echo $attrdef->getID()?>" />
+								<?php printMLText("attrdef_name");?>:
+						</td>
+						<td>
+							<input name="name" value="<?php echo htmlspecialchars($attrdef->getName()) ?>">
+						</td>
+					</tr>
+					<tr>
+						<td>
+							<?php printMLText("attrdef_type");?>:
+						</td>
+						<td>
+							<select name="type"><option value="<?php echo LetoDMS_Core_AttributeDefinition::type_int ?>" <?php if($attrdef->getType() == LetoDMS_Core_AttributeDefinition::type_int) echo "selected"; ?>>Integer</option><option value="<?php echo LetoDMS_Core_AttributeDefinition::type_float ?>" <?php if($attrdef->getType() == LetoDMS_Core_AttributeDefinition::type_float) echo "selected"; ?>>Float</option><option value="<?php echo LetoDMS_Core_AttributeDefinition::type_string ?>" <?php if($attrdef->getType() == LetoDMS_Core_AttributeDefinition::type_string) echo "selected"; ?>>String</option><option value="<?php echo LetoDMS_Core_AttributeDefinition::type_boolean ?>" <?php if($attrdef->getType() == LetoDMS_Core_AttributeDefinition::type_boolean) echo "selected"; ?>>Boolean</option></select><br />
+						</td>
+					</tr>
+					<tr>
+						<td>
+							<?php printMLText("attrdef_objtype");?>:
+						</td>
+						<td>
+							<select name="objtype"><option value="<?php echo LetoDMS_Core_AttributeDefinition::objtype_all ?>">All</option><option value="<?php echo LetoDMS_Core_AttributeDefinition::objtype_folder ?>" <?php if($attrdef->getObjType() == LetoDMS_Core_AttributeDefinition::objtype_folder) echo "selected"; ?>>Folder</option><option value="<?php echo LetoDMS_Core_AttributeDefinition::objtype_document ?>" <?php if($attrdef->getObjType() == LetoDMS_Core_AttributeDefinition::objtype_document) echo "selected"; ?>>Document</option><option value="<?php echo LetoDMS_Core_AttributeDefinition::objtype_documentcontent ?>" <?php if($attrdef->getObjType() == LetoDMS_Core_AttributeDefinition::objtype_documentcontent) echo "selected"; ?>>Document content</option></select><br />
+						</td>
+					</tr>
+					<tr>
+						<td>
+							<?php printMLText("attrdef_multiple");?>:
+						</td>
+						<td>
+							<input type="checkbox" value="1" name="multiple" /><br />
+						</td>
+					</tr>
+					<tr>
+						<td>
+							<?php printMLText("attrdef_minvalues");?>:
+						</td>
+						<td>
+							<input type="text" value="<?php echo $attrdef->getMinValues() ?>" name="minvalues" /><br />
+						</td>
+					</tr>
+					<tr>
+						<td>
+							<?php printMLText("attrdef_maxvalues");?>:
+						</td>
+						<td>
+							<input type="text" value="<?php echo $attrdef->getMaxValues() ?>" name="maxvalues" /><br />
+						</td>
+					</tr>
+					<tr>
+						<td>
+							<?php printMLText("attrdef_valueset");?>:
+						</td>
+						<td>
+							<input type="text" value="<?php echo $attrdef->getValueSet() ?>" name="valueset" /><br />
+						</td>
+					</tr>
+					<tr>
+						<td>
+							<input type="Submit" value="<?php printMLText("save");?>">
+						</td>
+					</tr>
+					</form>
+					
+				</table>
+			</td>
+<?php
+			}
+		}
+?>
+	</tr></table>
+	
+<script language="JavaScript">
+
+sel = document.getElementById("selector");
+sel.selectedIndex=<?php print $selected ?>;
+showAttributeDefinitions(sel);
+
+</script>
+
+<?php
+UI::contentContainerEnd();
+UI::htmlEndPage();
+?>

out/out.Categories.php

@@ -121,7 +121,7 @@ UI::contentContainerStart();
 				<tr>
 					<td><?php echo getMLText("name")?>:</td>
 					<td>
-						<form action="../op/op.Categories.php" >
+						<form action="../op/op.Categories.php" method="post">
   		        <?php echo createHiddenFieldWithKey('editcategory'); ?>
 							<input type="Hidden" name="action" value="editcategory">
 							<input type="Hidden" name="categoryid" value="<?php echo $category->getID()?>">

out/out.DocumentAccess.php

@@ -49,10 +49,10 @@ $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if ($document->getAccessMode($user) < M_ALL) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 
@@ -223,9 +223,9 @@ if (count($accessList["users"]) != 0 || count($accessList["groups"]) != 0) {
 		print "<input type=\"Hidden\" name=\"action\" value=\"delaccess\">\n";
 		print "<input type=\"Hidden\" name=\"groupid\" value=\"".$groupObj->getID()."\">\n";
 		print "<input type=\"Image\" class=\"mimeicon\" src=\"images/del.gif\">".getMLText("delete")." ";
+		print "</form>";
 		print "</span></td>\n";
 		print "</tr>\n";
-		print "</form>";
 	}
 	
 	print "</table><br>";
@@ -246,7 +246,7 @@ foreach ($allUsers as $userObj) {
 	if ($userObj->isGuest() || in_array($userObj->getID(), $memusers)) {
 		continue;
 	}
-	print "<option value=\"".$userObj->getID()."\">" . htmlspecialchars($currUser->getLogin() . " - " . $userObj->getFullName()) . "</option>\n";
+	print "<option value=\"".$userObj->getID()."\">" . htmlspecialchars($userObj->getLogin() . " - " . $userObj->getFullName()) . "</option>\n";
 }
 ?>
 </select>

out/out.DocumentChooser.php

@@ -87,7 +87,7 @@ function printTree($path, $level = 0)
 	for ($i = 0; $i < count($documents); $i++) {
 		print "<li>\n";
 		print "<img class='treeicon' src=\"images/blank.png\">";
-		print "<a  class=\"foldertree_selectable\" href=\"javascript:documentSelected(".$documents[$i]->getID().",'".str_replace("'", "\\'", $documents[$i]->getName())."');\"><img src=\"images/file.gif\" border=0>".htmlspecialchars($documents[$i]->getName())."</a>";
+		print "<a  class=\"foldertree_selectable\" href=\"javascript:documentSelected(".$documents[$i]->getID().",'".str_replace("'", "\\'", htmlspecialchars($documents[$i]->getName()))."');\"><img src=\"images/file.gif\" border=0>".htmlspecialchars($documents[$i]->getName())."</a>";
 		print "</li>";
 	}
 
@@ -126,7 +126,7 @@ var targetName;
 var targetID;
 
 function documentSelected(id, name) {
-	targetName.value = decodeString(name);
+	targetName.value = name; //decodeString(name);
 	targetID.value = id;
 	window.close();
 	return true;

out/out.DocumentNotify.php

@@ -37,15 +37,15 @@ if (!is_object($document)) {
 }
 
 $folder = $document->getFolder();
-$docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".$document->getName()."</a>";
+$docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if ($document->getAccessMode($user) < M_READ) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
 $notifyList = $document->getNotifyList();
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 
@@ -82,7 +82,7 @@ else {
 	foreach ($notifyList["users"] as $userNotify) {
 		print "<tr>";
 		print "<td><img src=\"images/usericon.gif\" class=\"mimeicon\"></td>";
-		print "<td>" . $userNotify->getFullName() . "</td>";
+		print "<td>" . htmlspecialchars($userNotify->getLogin() . " - " . $userNotify->getFullName()) . "</td>";
 		if ($user->isAdmin() || $user->getID() == $userNotify->getID()) {
 			print "<td><a href=\"../op/op.DocumentNotify.php?documentid=". $documentid . "&action=delnotify&userid=".$userNotify->getID()."\"><img src=\"images/del.gif\" class=\"mimeicon\"></a>".getMLText("delete")."</td>";
 		}else print "<td></td>";
@@ -92,7 +92,7 @@ else {
 	foreach ($notifyList["groups"] as $groupNotify) {
 		print "<tr>";
 		print "<td><img src=\"images/groupicon.gif\" width=16 height=16 border=0></td>";
-		print "<td>" . $groupNotify->getName() . "</td>";
+		print "<td>" . htmlspecialchars($groupNotify->getName()) . "</td>";
 		if ($user->isAdmin() || $groupNotify->isMember($user,true)) {
 			print "<td><a href=\"../op/op.DocumentNotify.php?documentid=". $documentid . "&action=delnotify&groupid=".$groupNotify->getID()."\"><img src=\"images/del.gif\" class=\"mimeicon\"></a>".getMLText("delete")."</td>";
 		}else print "<td></td>";
@@ -123,7 +123,7 @@ print "</table>\n";
 						}
 					}
 					elseif (!$user->isGuest() && !in_array($user->getID(), $userNotifyIDs)) {
-						print "<option value=\"".$user->getID()."\">" . $user->getFullName() . "\n";
+						print "<option value=\"".$user->getID()."\">" . htmlspecialchars($user->getLogin() . " - " . $user->getFullName()) . "\n";
 					}
 				?>
 			</select>
@@ -138,7 +138,7 @@ print "</table>\n";
 					$allGroups = $dms->getAllGroups();
 					foreach ($allGroups as $groupObj) {
 						if (($user->isAdmin() || $groupObj->isMember($user,true)) && $document->getGroupAccessMode($groupObj) >= M_READ && !in_array($groupObj->getID(), $groupNotifyIDs)) {
-							print "<option value=\"".$groupObj->getID()."\">" . $groupObj->getName() . "\n";
+							print "<option value=\"".$groupObj->getID()."\">" . htmlspecialchars($groupObj->getName()) . "\n";
 						}
 					}
 				?>

out/out.DocumentVersionDetail.php

@@ -37,21 +37,21 @@ if (!is_object($document)) {
 }
 
 $folder = $document->getFolder();
-$docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".$document->getName()."</a>";
+$docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if ($document->getAccessMode($user) < M_READ) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
 if (!isset($_GET["version"]) || !is_numeric($_GET["version"]) || intval($_GET["version"])<1) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 
 $version = $_GET["version"];
 $version = $document->getContentByVersion($version);
 
 if (!is_object($version)) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 
 // if version is last got out.ViewDocument
@@ -64,7 +64,7 @@ $status = $version->getStatus();
 $reviewStatus = $version->getReviewStatus();
 $approvalStatus = $version->getApprovalStatus();
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 UI::contentHeading(getMLText("document_infos"));
@@ -150,15 +150,22 @@ print "<td>".htmlspecialchars($version->getComment())."</td>";
 print "<td>".getOverallStatusText($status["status"])."</td>";
 print "<td>";
 
-if (($document->getAccessMode($user) >= M_READWRITE)) {
+//if (($document->getAccessMode($user) >= M_READWRITE)) {
-	print "<ul class=\"actions\">";
+print "<ul class=\"actions\">";
+if (($settings->_enableVersionModification && ($document->getAccessMode($user) >= M_READWRITE)) || $user->isAdmin()) {
 	print "<li><a href=\"out.RemoveVersion.php?documentid=".$documentid."&version=".$version->getVersion()."\">".getMLText("rm_version")."</a></li>";
-	if ($document->getAccessMode($user) == M_ALL) {
+}
-		if ( $status["status"]==S_RELEASED || $status["status"]==S_OBSOLETE ){
+if (($settings->_enableVersionModification && ($document->getAccessMode($user) == M_ALL)) || $user->isAdmin()) {
-			print "<li><a href='../out/out.OverrideContentStatus.php?documentid=".$documentid."&version=".$version->getVersion()."'>".getMLText("change_status")."</a></li>";
+	if ( $status["status"]==S_RELEASED || $status["status"]==S_OBSOLETE ){
-		}
+		print "<li><a href='../out/out.OverrideContentStatus.php?documentid=".$documentid."&version=".$version->getVersion()."'>".getMLText("change_status")."</a></li>";
 	}
-	print "<li><a href=\"out.EditComment.php?documentid=".$documentid."&version=".$version->getVersion()."\">".getMLText("edit_comment")."</a></li>";
+}
+if (($settings->_enableVersionModification && ($document->getAccessMode($user) >= M_READWRITE)) || $user->isAdmin()) {
+	if($status["status"] != S_OBSOLETE)
+		print "<li><a href=\"out.EditComment.php?documentid=".$documentid."&version=".$version->getVersion()."\">".getMLText("edit_comment")."</a></li>";
+	if ( $status["status"] == S_DRAFT_REV){
+		print "<li><a href=\"out.EditAttributes.php?documentid=".$documentid."&version=".$latestContent->getVersion()."\">".getMLText("edit_attributes")."</a></li>";
+}
 	print "</ul>";
 }
 else {

out/out.EditAttributes.php

@@ -0,0 +1,81 @@
+<?php
+//    MyDMS. Document Management System
+//    Copyright (C) 2002-2005  Markus Westphal
+//    Copyright (C) 2006-2008 Malcolm Cowe
+//    Copyright (C) 2010 Matteo Lucarelli
+//
+//    This program is free software; you can redistribute it and/or modify
+//    it under the terms of the GNU General Public License as published by
+//    the Free Software Foundation; either version 2 of the License, or
+//    (at your option) any later version.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU General Public License for more details.
+//
+//    You should have received a copy of the GNU General Public License
+//    along with this program; if not, write to the Free Software
+//    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+
+include("../inc/inc.Settings.php");
+include("../inc/inc.Utils.php");
+include("../inc/inc.DBInit.php");
+include("../inc/inc.Language.php");
+include("../inc/inc.ClassUI.php");
+include("../inc/inc.Authentication.php");
+
+if (!isset($_GET["documentid"]) || !is_numeric($_GET["documentid"]) || intval($_GET["documentid"])<1) {
+	UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
+}
+$documentid = $_GET["documentid"];
+$document = $dms->getDocument($documentid);
+
+if (!is_object($document)) {
+	UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
+}
+
+$folder = $document->getFolder();
+$docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
+
+$versionid = $_GET["version"];
+$version = $document->getContentByVersion($versionid);
+
+if (!is_object($version)) {
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
+}
+
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
+UI::globalNavigation($folder);
+UI::pageNavigation($docPathHTML, "view_document");
+
+UI::contentHeading(getMLText("edit_attributes"));
+UI::contentContainerStart();
+?>
+<form action="../op/op.EditAttributes.php" name="form1" method="POST">
+	<?php echo createHiddenFieldWithKey('editattributes'); ?>
+	<input type="Hidden" name="documentid" value="<?php print $documentid;?>">
+	<input type="Hidden" name="version" value="<?php print $versionid;?>">
+	<table cellpadding="3">
+<?php
+	$attrdefs = $dms->getAllAttributeDefinitions(array(LetoDMS_Core_AttributeDefinition::objtype_documentcontent, LetoDMS_Core_AttributeDefinition::objtype_all));
+	if($attrdefs) {
+		foreach($attrdefs as $attrdef) {
+?>
+<tr>
+	<td><?php echo htmlspecialchars($attrdef->getName()); ?></td>
+	<td><?php UI::printAttributeEditField($attrdef, $version->getAttributeValue($attrdef)) ?></td>
+</tr>
+<?php
+		}
+	}
+?>
+		<tr>
+			<td colspan="2"><br><input type="Submit" value="<?php printMLText("save") ?>"></td>
+		</tr>
+	</table>
+</form>
+<?php
+UI::contentContainerEnd();
+UI::htmlEndPage();
+?>

out/out.EditComment.php

@@ -42,10 +42,10 @@ $versionid = $_GET["version"];
 $version = $document->getContentByVersion($versionid);
 
 if (!is_object($version)) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 
@@ -76,6 +76,7 @@ UI::contentHeading(getMLText("edit_comment"));
 UI::contentContainerStart();
 ?>
 <form action="../op/op.EditComment.php" name="form1" onsubmit="return checkForm();" method="POST">
+	<?php echo createHiddenFieldWithKey('editcomment'); ?>
 	<input type="Hidden" name="documentid" value="<?php print $documentid;?>">
 	<input type="Hidden" name="version" value="<?php print $versionid;?>">
 	<table cellpadding="3">

out/out.EditDocument.php

@@ -38,10 +38,10 @@ $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if ($document->getAccessMode($user) < M_READWRITE) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 
@@ -112,6 +112,19 @@ UI::contentContainerStart();
 				print "</td></tr>";
 			}
 		?>
+		<?php
+			$attrdefs = $dms->getAllAttributeDefinitions(array(LetoDMS_Core_AttributeDefinition::objtype_document, LetoDMS_Core_AttributeDefinition::objtype_all));
+			if($attrdefs) {
+				foreach($attrdefs as $attrdef) {
+?>
+		<tr>
+			<td><?php echo htmlspecialchars($attrdef->getName()); ?></td>
+			<td><?php UI::printAttributeEditField($attrdef, $document->getAttributeValue($attrdef)) ?></td>
+		</tr>
+<?php
+				}
+			}
+?>
 		<tr>
 			<td colspan="2"><br><input type="Submit" value="<?php printMLText("save") ?>"></td>
 		</tr>

out/out.EditFolder.php

@@ -38,10 +38,10 @@ if (!is_object($folder)) {
 $folderPathHTML = getFolderPathHTML($folder, true);
 
 if ($folder->getAccessMode($user) < M_READWRITE) {
-	UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))),getMLText("access_denied"));
 }
 
-UI::htmlStartPage(getMLText("folder_title", array("foldername" => $folder->getName())));
+UI::htmlStartPage(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($folderPathHTML, "view_folder", $folder);
 
@@ -95,6 +95,19 @@ if ($parent && $parent->getAccessMode($user) > M_READ) {
 	print "</td></tr>\n";
 }
 ?>
+<?php
+	$attrdefs = $dms->getAllAttributeDefinitions(array(LetoDMS_Core_AttributeDefinition::objtype_folder, LetoDMS_Core_AttributeDefinition::objtype_all));
+	if($attrdefs) {
+		foreach($attrdefs as $attrdef) {
+?>
+<tr>
+	<td><?php echo htmlspecialchars($attrdef->getName()); ?></td>
+	<td><?php UI::printAttributeEditField($attrdef, $folder->getAttributeValue($attrdef)) ?></td>
+</tr>
+<?php
+		}
+	}
+?>
 <tr>
 <td colspan="2"><input type="Submit" value="<?php printMLText("save"); ?>"></td>
 </tr>

out/out.EditUserData.php

@@ -68,7 +68,7 @@ UI::contentContainerStart();
 		<td><input id="currentpwd" type="Password" name="currentpwd" size="30"></td>
 	</tr>
 	<tr>
-		<td><?php printMLText("password");?>:</td>
+		<td><?php printMLText("new_password");?>:</td>
 		<td><input id="pwd" type="Password" name="pwd" size="30"> <div id="outerstrength" style="min-width: 100px; height: 14px; display: inline-block; border: 1px solid black; padding: 1px;"><div id="innerstrength" style="width: 0px; height: 14px; display: inline-block; border: 0px; padding: 0px; background-color: red;">&nbsp;</div> <div id="strength" style="display: inline-block;"></div></div></td>
 	</tr>
 	<tr>

out/out.FolderAccess.php

@@ -47,10 +47,10 @@ if (!is_object($folder)) {
 $folderPathHTML = getFolderPathHTML($folder, true);
 
 if ($folder->getAccessMode($user) < M_ALL) {
-	UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))),getMLText("access_denied"));
 }
 
-UI::htmlStartPage(getMLText("folder_title", array("foldername" => $folder->getName())));
+UI::htmlStartPage(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($folderPathHTML, "view_folder", $folder);
 
@@ -84,6 +84,7 @@ if ($user->isAdmin()) {
 	UI::contentSubHeading(getMLText("set_owner"));
 ?>
 	<form action="../op/op.FolderAccess.php">
+	<?php echo createHiddenFieldWithKey('folderaccess'); ?>
 	<input type="Hidden" name="action" value="setowner">
 	<input type="Hidden" name="folderid" value="<?php print $folderid;?>">
 	<?php printMLText("owner");?> : <select name="ownerid">
@@ -95,7 +96,7 @@ if ($user->isAdmin()) {
 		print "<option value=\"".$currUser->getID()."\"";
 		if ($currUser->getID() == $owner->getID())
 			print " selected";
-		print ">" . htmlspecialchars($currUser->getFullname()) . "</option>\n";
+		print ">" . htmlspecialchars($currUser->getLogin() . " - " . $currUser->getFullname()) . "</option>\n";
 	}
 	?>
 	</select>
@@ -109,14 +110,37 @@ if ($folderid != $settings->_rootFolderID && $folder->getParent()){
 	UI::contentSubHeading(getMLText("access_inheritance"));
 	
 	if ($folder->inheritsAccess()) {
-		printMLText("inherits_access_msg", array(
+		printMLText("inherits_access_msg");
-			"copyurl" => "../op/op.FolderAccess.php?folderid=".$folderid."&action=notinherit&mode=copy", 
+?>
-			"emptyurl" => "../op/op.FolderAccess.php?folderid=".$folderid."&action=notinherit&mode=empty"));
+  <p>
+	<form action="../op/op.FolderAccess.php" style="display: inline-block;">
+  <?php echo createHiddenFieldWithKey('folderaccess'); ?>
+	<input type="hidden" name="folderid" value="<?php print $folderid;?>">
+	<input type="hidden" name="action" value="notinherit">
+	<input type="hidden" name="mode" value="copy">
+	<input type="submit" value="<?php printMLText("inherits_access_copy_msg")?>">
+	</form>
+	<form action="../op/op.FolderAccess.php" style="display: inline-block;">
+  <?php echo createHiddenFieldWithKey('folderaccess'); ?>
+	<input type="hidden" name="folderid" value="<?php print $folderid;?>">
+	<input type="hidden" name="action" value="notinherit">
+	<input type="hidden" name="mode" value="empty">
+	<input type="submit" value="<?php printMLText("inherits_access_empty_msg")?>">
+	</form>
+	</p>
+<?php
 		UI::contentContainerEnd();
 		UI::htmlEndPage();
 		exit();
 	}
-	printMLText("does_not_inherit_access_msg", array("inheriturl" => "../op/op.FolderAccess.php?folderid=".$folderid."&action=inherit"));
+?>
+	<form action="../op/op.FolderAccess.php">
+  <?php echo createHiddenFieldWithKey('folderaccess'); ?>
+	<input type="hidden" name="folderid" value="<?php print $folderid;?>">
+	<input type="hidden" name="action" value="inherit">
+	<input type="submit" value="<?php printMLText("does_not_inherit_access_msg")?>">
+	</form>
+<?php
 }
 
 $accessList = $folder->getAccessList();
@@ -124,6 +148,7 @@ $accessList = $folder->getAccessList();
 UI::contentSubHeading(getMLText("default_access"));
 ?>
 <form action="../op/op.FolderAccess.php">
+  <?php echo createHiddenFieldWithKey('folderaccess'); ?>
 	<input type="Hidden" name="folderid" value="<?php print $folderid;?>">
 	<input type="Hidden" name="action" value="setdefault">
 	<?php printAccessModeSelection($folder->getDefaultAccess()); ?>
@@ -140,47 +165,68 @@ if ((count($accessList["users"]) != 0) || (count($accessList["groups"]) != 0)) {
 
 	foreach ($accessList["users"] as $userAccess) {
 		$userObj = $userAccess->getUser();
+		print "<tr>\n";
+		print "<td><img src=\"images/usericon.gif\" class=\"mimeicon\"></td>\n";
+		print "<td>". htmlspecialchars($userObj->getFullName()) . "</td>\n";
 		print "<form action=\"../op/op.FolderAccess.php\">\n";
+  	echo createHiddenFieldWithKey('folderaccess')."\n";
 		print "<input type=\"Hidden\" name=\"folderid\" value=\"".$folderid."\">\n";
 		print "<input type=\"Hidden\" name=\"action\" value=\"editaccess\">\n";
 		print "<input type=\"Hidden\" name=\"userid\" value=\"".$userObj->getID()."\">\n";
-		print "<tr>\n";
-		print "<td><img src=\"images/usericon.gif\" class=\"mimeicon\"></td>\n";
-		print "<td>". htmlspecialchars($userObj->getFullName()) . "</td>\n";
 		print "<td>\n";
 		printAccessModeSelection($userAccess->getMode());
 		print "</td>\n";
 		print "<td><span class=\"actions\">\n";
 		print "<input type=\"Image\" class=\"mimeicon\" src=\"images/save.gif\">".getMLText("save")." ";
-		print "<a href=\"../op/op.FolderAccess.php?folderid=".$folderid."&action=delaccess&userid=".$userObj->getID()."\"><img src=\"images/del.gif\" class=\"mimeicon\"></a>".getMLText("delete");
+		print "</span></td>\n";
-		print "</span></td></tr>\n";
 		print "</form>\n";
+		print "<td><span class=\"actions\">\n";
+		print "<form action=\"../op/op.FolderAccess.php\">\n";
+  	echo createHiddenFieldWithKey('folderaccess')."\n";
+		print "<input type=\"Hidden\" name=\"folderid\" value=\"".$folderid."\">\n";
+		print "<input type=\"Hidden\" name=\"action\" value=\"delaccess\">\n";
+		print "<input type=\"Hidden\" name=\"userid\" value=\"".$userObj->getID()."\">\n";
+		print "<input type=\"Image\" class=\"mimeicon\" src=\"images/del.gif\">".getMLText("delete")." ";
+		print "</form>\n";
+		print "<span></td>\n";
+		print "</tr>\n";
 	}
 
 	foreach ($accessList["groups"] as $groupAccess) {
 		$groupObj = $groupAccess->getGroup();
 		$mode = $groupAccess->getMode();
+		print "<tr>";
+		print "<td><img src=\"images/groupicon.gif\" class=\"mimeicon\"></td>";
+		print "<td>". htmlspecialchars($groupObj->getName()) . "</td>";
 		print "<form action=\"../op/op.FolderAccess.php\">";
+  	echo createHiddenFieldWithKey('folderaccess')."\n";
 		print "<input type=\"Hidden\" name=\"folderid\" value=\"".$folderid."\">";
 		print "<input type=\"Hidden\" name=\"action\" value=\"editaccess\">";
 		print "<input type=\"Hidden\" name=\"groupid\" value=\"".$groupObj->getID()."\">";
-		print "<tr>";
-		print "<td><img src=\"images/groupicon.gif\" class=\"mimeicon\"></td>";
-		print "<td>". htmlspecialchars($groupObj->getName()) . "</td>";
 		print "<td>";
 		printAccessModeSelection($groupAccess->getMode());
 		print "</td>\n";
 		print "<td><span class=\"actions\">\n";
 		print "<input type=\"Image\" class=\"mimeicon\" src=\"images/save.gif\">".getMLText("save")." ";
-		print "<a href=\"../op/op.FolderAccess.php?folderid=".$folderid."&action=delaccess&groupid=".$groupObj->getID()."\"><img src=\"images/del.gif\" class=\"mimeicon\"></a>".getMLText("delete");
+		print "</span></td>\n";
-		print "</span></td></tr>\n";
 		print "</form>";
+		print "<td><span class=\"actions\">\n";
+		print "<form action=\"../op/op.FolderAccess.php\">\n";
+  	echo createHiddenFieldWithKey('folderaccess')."\n";
+		print "<input type=\"Hidden\" name=\"folderid\" value=\"".$folderid."\">\n";
+		print "<input type=\"Hidden\" name=\"action\" value=\"delaccess\">\n";
+		print "<input type=\"Hidden\" name=\"groupid\" value=\"".$groupObj->getID()."\">\n";
+		print "<input type=\"Image\" class=\"mimeicon\" src=\"images/del.gif\">".getMLText("delete")." ";
+		print "</form>";
+		print "</span></td>\n";
+		print "</tr>\n";
 	}
 	
 	print "</table><br>";
 }
 ?>
 <form action="../op/op.FolderAccess.php" name="form1" onsubmit="return checkForm();">
+<?php echo createHiddenFieldWithKey('folderaccess'); ?>
 <input type="Hidden" name="folderid" value="<?php print $folderid?>">
 <input type="Hidden" name="action" value="addaccess">
 <table>
@@ -194,7 +240,7 @@ foreach ($allUsers as $userObj) {
 	if ($userObj->isGuest()) {
 		continue;
 	}
-	print "<option value=\"".$userObj->getID()."\">" . htmlspecialchars($userObj->getFullName()) . "\n";
+	print "<option value=\"".$userObj->getID()."\">" . htmlspecialchars($userObj->getLogin() . " - " . $userObj->getFullName()) . "</option>\n";
 }
 ?>
 </select>

out/out.FolderNotify.php

@@ -83,7 +83,15 @@ else {
 		print "<td><img src=\"images/usericon.gif\" class=\"mimeicon\"></td>";
 		print "<td>" . htmlspecialchars($userNotify->getFullName()) . "</td>";
 		if ($user->isAdmin() || $user->getID() == $userNotify->getID()) {
-			print "<td><a href=\"../op/op.FolderNotify.php?folderid=". $folderid . "&action=delnotify&userid=".$userNotify->getID()."\"><img src=\"images/del.gif\" class=\"mimeicon\"></a>".getMLText("delete")."</td>";
+			print "<td>";
+			print "<form action=\"../op/op.FolderNotify.php\" method=\"post\">\n";
+			echo createHiddenFieldWithKey('foldernotify')."\n";
+			print "<input type=\"Hidden\" name=\"folderid\" value=\"".$folderid."\">\n";
+			print "<input type=\"Hidden\" name=\"action\" value=\"delnotify\">\n";
+			print "<input type=\"Hidden\" name=\"userid\" value=\"".$userNotify->getID()."\">\n";
+			print "<input type=\"Image\" class=\"mimeicon\" src=\"images/del.gif\">".getMLText("delete")." ";
+			print "</form>\n";
+			print "</td>";
 		}else print "<td></td>";
 		print "</tr>";
 		$userNotifyIDs[] = $userNotify->getID();
@@ -94,7 +102,15 @@ else {
 		print "<td><img src=\"images/groupicon.gif\" class=\"mimeicon\"></td>";
 		print "<td>" . htmlspecialchars($groupNotify->getName()) . "</td>";
 		if ($user->isAdmin() || $groupNotify->isMember($user,true)) {
-			print "<td><a href=\"../op/op.FolderNotify.php?folderid=". $folderid . "&action=delnotify&groupid=".$groupNotify->getID()."\"><img src=\"images/del.gif\" class=\"mimeicon\"></a>".getMLText("delete")."</td>";
+			print "<td>";
+			print "<form action=\"../op/op.FolderNotify.php\" method=\"post\">\n";
+			echo createHiddenFieldWithKey('foldernotify')."\n";
+			print "<input type=\"Hidden\" name=\"folderid\" value=\"".$folderid."\">\n";
+			print "<input type=\"Hidden\" name=\"action\" value=\"delnotify\">\n";
+			print "<input type=\"Hidden\" name=\"groupid\" value=\"".$groupNotify->getID()."\">\n";
+			print "<input type=\"Image\" class=\"mimeicon\" src=\"images/del.gif\">".getMLText("delete")." ";
+			print "</form>\n";
+			print "</td>";
 		}else print "<td></td>";
 		print "</tr>";
 		$groupNotifyIDs[] = $groupNotify->getID();
@@ -104,7 +120,8 @@ print "</table>\n";
 
 ?>
 <br>
-<form action="../op/op.FolderNotify.php" name="form1" onsubmit="return checkForm();">
+<form action="../op/op.FolderNotify.php" method="post" name="form1" onsubmit="return checkForm();">
+<?php	echo createHiddenFieldWithKey('foldernotify'); ?>
 <input type="Hidden" name="folderid" value="<?php print $folderid?>">
 <input type="Hidden" name="action" value="addnotify">
 <table>

out/out.ForcePasswordChange.php

@@ -25,6 +25,10 @@ UI::contentContainerStart();
 ?>
 <form action="../op/op.EditUserData.php" method="post" name="form1" onsubmit="return checkForm();">
 <table>
+	<tr>
+		<td><?php printMLText("current_password");?>:</td>
+		<td><input id="currentpwd" type="Password" name="currentpwd" size="30"></td>
+	</tr>
 	<tr>
 		<td><?php printMLText("password");?>:</td>
 		<td><input id="pwd" type="Password" name="pwd" size="30"> <div id="outerstrength" style="min-width: 100px; height: 14px; display: inline-block; border: 1px solid black; padding: 1px;"><div id="innerstrength" style="width: 0px; height: 14px; display: inline-block; border: 0px; padding: 0px; background-color: red;">&nbsp;</div> <div id="strength" style="display: inline-block;"></div></div></td>

out/out.GroupView.php

@@ -75,7 +75,7 @@ foreach ($groups as $group){
 
 		echo "<li>".htmlspecialchars($member->getFullName());
 		if ($member->getEmail()!="")
-			echo " (<a href=\"mailto:".$member->getEmail()."\">".$member->getEmail()."</a>)";
+			echo " (<a href=\"mailto:".htmlspecialchars($member->getEmail())."\">".htmlspecialchars($member->getEmail())."</a>)";
 		foreach($managers as $manager)
 			if($manager->getId() == $member->getId())
 				echo ", ".getMLText("manager");

out/out.IndexInfo.php

@@ -42,7 +42,19 @@ if($settings->_enableFullSearch) {
 	else
 		require_once('LetoDMS/Lucene.php');
 
-	$index = Zend_Search_Lucene::open($settings->_luceneDir);
+	$index = LetoDMS_Lucene_Indexer::open($settings->_luceneDir);
+
+	$numDocs = $index->count();
+	echo "<pre>";
+	for ($id = 0; $id < $numDocs; $id++) {
+		if (!$index->isDeleted($id)) {
+			$hit = $index->getDocument($id);
+			echo $hit->document_id.": ".htmlspecialchars($hit->title)."\n";
+		}
+	}
+	echo "</pre>";
+
+
 
 	$terms = $index->terms();
 	echo "<p>".count($terms)." Terms</p>";

out/out.Indexer.php

@@ -38,17 +38,26 @@ function tree($folder, $indent='') { /* {{{ */
 		echo $indent."  ".$document->getId().":".htmlspecialchars($document->getName())." ";
 		/* If the document wasn't indexed before then just add it */
 		if(!($hits = $index->find('document_id:'.$document->getId()))) {
-			$index->addDocument(new LetoDMS_Lucene_IndexedDocument($dms, $document));
+			$index->addDocument(new LetoDMS_Lucene_IndexedDocument($dms, $document, $settings->_convcmd ? $settings->_convcmd : null));
 			echo "(document added)";
 		} else {
 			$hit = $hits[0];
-			$created = (int) $hit->getDocument()->getFieldValue('created');
+			/* Check if the attribute created is set or has a value older
+			 * than the lasted content. Documents without such an attribute
+			 * where added when a new document was added to the dms. In such
+			 * a case the document content  wasn't indexed.
+			 */
+			try {
+				$created = (int) $hit->getDocument()->getFieldValue('created');
+			} catch (Zend_Search_Lucene_Exception $e) {
+				$created = 0;
+			}
 			$content = $document->getLatestContent();
 			if($created >= $content->getDate()) {
 				echo $indent."(document unchanged)";
 			} else {
 				if($index->delete($hit->id)) {
-					$index->addDocument(new LetoDMS_Lucene_IndexedDocument($dms, $document));
+					$index->addDocument(new LetoDMS_Lucene_IndexedDocument($dms, $document, $settings->_convcmd ? $settings->_convcmd : null));
 				}
 				echo $indent."(document updated)";
 			}
@@ -76,7 +85,9 @@ if($settings->_enableFullSearch) {
 	if(isset($_GET['create']) && $_GET['create'] == 1) {
 		if(isset($_GET['confirm']) && $_GET['confirm'] == 1) {
 			echo "<p>Recreating index</p>";
-			$index = Zend_Search_Lucene::create($settings->_luceneDir);
+			$index = LetoDMS_Lucene_Indexer::create($settings->_luceneDir);
+			LetoDMS_Lucene_Indexer::init($settings->_stopWordsFile);
+//			$index = Zend_Search_Lucene::create($settings->_luceneDir);
 		} else {
 			echo '<p>'.getMLText('create_fulltext_index_warning').'</p>';
 			echo '<a href="out.Indexer.php?create=1&confirm=1">'.getMLText('confirm_create_fulltext_index').'</a>';
@@ -86,18 +97,22 @@ if($settings->_enableFullSearch) {
 		}
 	} else {
 		echo "<p>Updating index</p>";
-		$index = Zend_Search_Lucene::open($settings->_luceneDir);
+		$index = LetoDMS_Lucene_Indexer::open($settings->_luceneDir);
+		LetoDMS_Lucene_Indexer::init($settings->_stopWordsFile);
+//		$index = Zend_Search_Lucene::open($settings->_luceneDir);
 	}
 
+/*
+
+	$analyzer = new Zend_Search_Lucene_Analysis_Analyzer_Common_Utf8_CaseInsensitive();
 	if($settings->_stopWordsFile && file_exists($settings->_stopWordsFile)) {
 		$stopWordsFilter = new Zend_Search_Lucene_Analysis_TokenFilter_StopWords();
 		$stopWordsFilter->loadFromFile($settings->_stopWordsFile);
-	 
-		$analyzer = new Zend_Search_Lucene_Analysis_Analyzer_Common_TextNum_CaseInsensitive();
 		$analyzer->addFilter($stopWordsFilter);
-	 
-		Zend_Search_Lucene_Analysis_Analyzer::setDefault($analyzer);
 	}
+	 
+	Zend_Search_Lucene_Analysis_Analyzer::setDefault($analyzer);
+*/
 
 	$folder = $dms->getFolder($settings->_rootFolderID);
 	echo "<pre>";

out/out.MoveDocument.php

@@ -39,10 +39,10 @@ $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if ($document->getAccessMode($user) < M_READWRITE) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 UI::contentHeading(getMLText("move_document"));

out/out.MoveFolder.php

@@ -39,14 +39,14 @@ if (!is_object($folder)) {
 $folderPathHTML = getFolderPathHTML($folder, true);
 
 if ($folderid == $settings->_rootFolderID || !$folder->getParent()) {
-	UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("cannot_move_root"));
+	UI::exitError(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))),getMLText("cannot_move_root"));
 }
 
 if ($folder->getAccessMode($user) < M_READWRITE) {
-	UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))),getMLText("access_denied"));
 }
 
-UI::htmlStartPage(getMLText("folder_title", array("foldername" => $folder->getName())));
+UI::htmlStartPage(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($folderPathHTML, "view_folder", $folder);
 UI::contentHeading(getMLText("move_folder"));

out/out.MyDocuments.php

@@ -136,9 +136,11 @@ if ($showInProcess){
 		UI::contentContainerStart();
 		$printheader=true;
 		$iRev = array();
+		$dList = array();
 		foreach ($reviewStatus["indstatus"] as $st) {
 		
-			if ( $st["status"]==0 && isset($docIdx[$st["documentID"]][$st["version"]]) ) {
+			if ( $st["status"]==0 && isset($docIdx[$st["documentID"]][$st["version"]]) && !in_array($st["documentID"], $dList) ) {
+				$dList[] = $st["documentID"];
 			
 				if ($printheader){
 					print "<table class=\"folderView\">";
@@ -163,7 +165,8 @@ if ($showInProcess){
 		}
 		foreach ($reviewStatus["grpstatus"] as $st) {
 		
-			if (!in_array($st["documentID"], $iRev) && $st["status"]==0 && isset($docIdx[$st["documentID"]][$st["version"]])) {
+			if (!in_array($st["documentID"], $iRev) && $st["status"]==0 && isset($docIdx[$st["documentID"]][$st["version"]]) && !in_array($st["documentID"], $dList) && $docIdx[$st["documentID"]][$st["version"]]['owner'] != $user->getId()) {
+				$dList[] = $st["documentID"];
 
 				if ($printheader){
 					print "<table class=\"folderView\">";
@@ -224,7 +227,7 @@ if ($showInProcess){
 		}
 		foreach ($approvalStatus["grpstatus"] as $st) {
 		
-			if (!in_array($st["documentID"], $iRev) && $st["status"]==0 && isset($docIdx[$st["documentID"]][$st["version"]])) {
+			if (!in_array($st["documentID"], $iRev) && $st["status"]==0 && isset($docIdx[$st["documentID"]][$st["version"]]) && $docIdx[$st["documentID"]][$st["version"]]['owner'] != $user->getId()) {
 				if ($printheader){
 					print "<table class=\"folderView\">";
 					print "<thead>\n<tr>\n";

out/out.ObjectCheck.php

@@ -34,6 +34,7 @@ function tree($folder, $repair, $path=':', $indent='') { /* {{{ */
 		$folderList = $folder->getFolderList();
 		/* Check the folder */
 		if($folderList != $path) {
+			print "<tr>\n";
 			$needsrepair = true;
 			print "<td><a class=\"standardText\" href=\"../out/out.ViewFolder.php?folderid=".$folder->getID()."\"><img src=\"../out/images/folder_closed.gif\" width=18 height=18 border=0></a></td>";
 			print "<td><a class=\"standardText\" href=\"../out/out.ViewFolder.php?folderid=".$folder->getID()."\">";
@@ -64,9 +65,10 @@ function tree($folder, $repair, $path=':', $indent='') { /* {{{ */
 	$path .= $folder->getId().':';
 	$documents = $folder->getDocuments();
 	foreach($documents as $document) {
-		/* Check the document */
+		/* Check the folder list of the document */
 		$folderList = $document->getFolderList();
 		if($folderList != $path) {
+			print "<tr>\n";
 			$needsrepair = true;
 			$lc = $document->getLatestContent();
 			print "<td><a class=\"standardText\" href=\"../out/out.ViewDocument.php?documentid=".$document->getID()."\"><img class=\"mimeicon\" src=\"../out/images/icons/".UI::getMimeIcon($lc->getFileType())."\" title=\"".$lc->getMimeType()."\"></a></td>";
@@ -76,7 +78,7 @@ function tree($folder, $repair, $path=':', $indent='') { /* {{{ */
 			for ($i = 1; $i  < count($tmppath); $i++) {
 				print htmlspecialchars($tmppath[$i]->getName())."/";
 			}
-			print $document->getName();
+			print htmlspecialchars($document->getName());
 			print "</a></td>";
 			$owner = $document->getOwner();
 			print "<td>".htmlspecialchars($owner->getFullName())."</td>";
@@ -89,6 +91,33 @@ function tree($folder, $repair, $path=':', $indent='') { /* {{{ */
 			}
 			print "</tr>\n";
 		}
+
+		/* Check if the content is available */
+		$versions = $document->getContent();
+		foreach($versions as $version) {
+			$filepath = $dms->contentDir . $version->getPath();
+			if(!file_exists($filepath)) {
+			print "<tr>\n";
+			print "<td><a class=\"standardText\" href=\"../out/out.ViewDocument.php?documentid=".$document->getID()."\"><img class=\"mimeicon\" src=\"../out/images/icons/".UI::getMimeIcon($version->getFileType())."\" title=\"".$version->getMimeType()."\"></a></td>";
+			print "<td><a class=\"standardText\" href=\"../out/out.ViewDocument.php?documentid=".$document->getID()."\">/";
+			$folder = $document->getFolder();
+			$tmppath = $folder->getPath();
+			for ($i = 1; $i  < count($tmppath); $i++) {
+				print htmlspecialchars($tmppath[$i]->getName())."/";
+			}
+			print htmlspecialchars($document->getName());
+			print "</a></td>";
+			$owner = $document->getOwner();
+			print "<td>".htmlspecialchars($owner->getFullName())."</td>";
+			print "<td>Document content of version ".$version->getVersion()." is missing ('".$path."')</td>";
+			if($repair) {
+				print "<td><span class=\"warning\">Cannot repaired</span></td>\n";
+			} else {
+				print "<td></td>\n";
+			}
+			print "</tr>\n";
+			}
+		}
 	}
 } /* }}} */
 

out/out.OverrideContentStatus.php

@@ -40,31 +40,31 @@ $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if ($document->getAccessMode($user) < M_ALL) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
 if (!isset($_GET["version"]) || !is_numeric($_GET["version"]) || intval($_GET["version"])<1) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 
 $version = $_GET["version"];
 $content = $document->getContentByVersion($version);
 
 if (!is_object($content)) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 
 $overallStatus = $content->getStatus();
 
 // status change control
 if ($overallStatus["status"] == S_REJECTED || $overallStatus["status"] == S_EXPIRED || $overallStatus["status"] == S_DRAFT_REV || $overallStatus["status"] == S_DRAFT_APP ) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("cannot_change_final_states"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("cannot_change_final_states"));
 }
 
 $reviewStatus = $content->getReviewStatus();
 $approvalStatus = $content->getApprovalStatus();
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 

out/out.RemoveDocument.php

@@ -39,10 +39,10 @@ $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if ($document->getAccessMode($user) < M_ALL) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 UI::contentHeading(getMLText("rm_document"));

out/out.RemoveDocumentFile.php

@@ -38,22 +38,22 @@ $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if (!isset($_GET["fileid"]) || !is_numeric($_GET["fileid"]) || intval($_GET["fileid"])<1) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_file_id"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_file_id"));
 }
 
 $fileid = $_GET["fileid"];
 $file = $document->getDocumentFile($fileid);
 
 if (!is_object($file)) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_file_id"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_file_id"));
 }
 
 if (($document->getAccessMode($user) < M_ALL)&&($user->getID()!=$file->getUserID())) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 UI::contentHeading(getMLText("rm_file"));
@@ -64,7 +64,7 @@ UI::contentContainerStart();
   <?php echo createHiddenFieldWithKey('removedocumentfile'); ?>
 	<input type="Hidden" name="documentid" value="<?php echo $documentid?>">
 	<input type="Hidden" name="fileid" value="<?php echo $fileid?>">
-	<p><?php printMLText("confirm_rm_file", array ("documentname" => $document->getName(), "name" => htmlspecialchars($file->getName())));?></p>
+	<p><?php printMLText("confirm_rm_file", array ("documentname" => htmlspecialchars($document->getName()), "name" => htmlspecialchars($file->getName())));?></p>
 	<input type="Submit" value="<?php printMLText("rm_file");?>">
 </form>
 <?php

out/out.RemoveFolder.php

@@ -38,14 +38,14 @@ if (!is_object($folder)) {
 $folderPathHTML = getFolderPathHTML($folder, true);
 
 if ($folderid == $settings->_rootFolderID || !$folder->getParent()) {
-	UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("cannot_rm_root"));
+	UI::exitError(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))),getMLText("cannot_rm_root"));
 }
 
 if ($folder->getAccessMode($user) < M_ALL) {
-	UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))),getMLText("access_denied"));
 }
 
-UI::htmlStartPage(getMLText("folder_title", array("foldername" => $folder->getName())));
+UI::htmlStartPage(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($folderPathHTML, "view_folder", $folder);
 UI::contentHeading(getMLText("rm_folder"));

out/out.RemoveVersion.php

@@ -39,22 +39,26 @@ if (!is_object($document)) {
 $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
+if (!$settings->_enableVersionDeletion && !$user->isAdmin()) {
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
+}
+
 if ($document->getAccessMode($user) < M_ALL) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
 if (!isset($_GET["version"]) || !is_numeric($_GET["version"]) || intval($_GET["version"])<1) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 
 $version = $_GET["version"];
 $version = $document->getContentByVersion($version);
 
 if (!is_object($version)) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 UI::contentHeading(getMLText("rm_version"));
@@ -62,6 +66,7 @@ UI::contentContainerStart();
 
 ?>
 <form action="../op/op.RemoveVersion.php" name="form1" method="POST">
+	<?php echo createHiddenFieldWithKey('removeversion'); ?>
 	<input type="Hidden" name="documentid" value="<?php echo $documentid?>">
 	<input type="Hidden" name="version" value="<?php echo $version->getVersion()?>">
 	<p><?php printMLText("confirm_rm_version", array ("documentname" => htmlspecialchars($document->getName()), "version" => $version->getVersion()));?></p>

out/out.ReviewDocument.php

@@ -40,31 +40,31 @@ $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if ($document->getAccessMode($user) < M_READ) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
 if (!isset($_GET["version"]) || !is_numeric($_GET["version"]) || intval($_GET["version"])<1) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 $version = $_GET["version"];
 $content = $document->getContentByVersion($version);
 if (!is_object($content)) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 
 // operation is admitted only for last deocument version
 $latestContent = $document->getLatestContent();
 if ($latestContent->getVersion()!=$version) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 // verify if document has expired
 if ($document->hasExpired()){
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
 $reviews = $latestContent->getReviewStatus();
 if(!$reviews) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("no_action"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("no_action"));
 }
 
 foreach($reviews as $review) {
@@ -74,7 +74,7 @@ foreach($reviews as $review) {
 	}
 }
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 UI::contentHeading(getMLText("submit_review"));
@@ -132,7 +132,8 @@ if ($reviewStatus['type'] == 0) {
 		print "</tr></tbody></table><br>";
 	}
 ?>
-	<form method="POST" action="../op/op.ReviewDocument.php" name="form1" onsubmit="return checkIndForm();">
+	<form method="post" action="../op/op.ReviewDocument.php" name="form1" onsubmit="return checkIndForm();">
+	<?php echo createHiddenFieldWithKey('reviewdocument'); ?>
 	<table>
 	<tr><td class='infos' valign='top'><?php printMLText("comment")?>:</td>
 	<td class='infos' valign='top'><textarea name="comment" cols="80" rows="4"></textarea>

out/out.ReviewSummary.php

@@ -128,7 +128,7 @@ foreach ($reviewStatus["indstatus"] as $st) {
 		print "<td>".htmlspecialchars($docIdx[$st["documentID"]][$st["version"]]["ownerName"])."</td>";
 		print "<td>".getOverallStatusText($docIdx[$st["documentID"]][$st["version"]]["status"])."</td>";
 		print "<td>".$st["version"]."</td>";
-		print "<td>".$st["date"]." ". $docIdx[$st["documentID"]][$st["version"]]["statusName"] ."</td>";
+		print "<td>".$st["date"]." ". htmlspecialchars($docIdx[$st["documentID"]][$st["version"]]["statusName"]) ."</td>";
 		print "<td>".(!$docIdx[$st["documentID"]][$st["version"]]["expires"] ? "-":getReadableDate($docIdx[$st["documentID"]][$st["version"]]["expires"]))."</td>";				
 		print "</tr>\n";
 	}
@@ -168,7 +168,7 @@ foreach ($reviewStatus["grpstatus"] as $st) {
 		print "<td>".htmlspecialchars($docIdx[$st["documentID"]][$st["version"]]["ownerName"])."</td>";
 		print "<td>".getOverallStatusText($docIdx[$st["documentID"]][$st["version"]]["status"])."</td>";
 		print "<td>".$st["version"]."</td>";
-		print "<td>".$st["date"]." ". $docIdx[$st["documentID"]][$st["version"]]["statusName"] ."</td>";
+		print "<td>".$st["date"]." ". htmlspecialchars($docIdx[$st["documentID"]][$st["version"]]["statusName"]) ."</td>";
 		print "<td>".(!$docIdx[$st["documentID"]][$st["version"]]["expires"] ? "-":getReadableDate($docIdx[$st["documentID"]][$st["version"]]["expires"]))."</td>";				
 		print "</tr>\n";
 	}

out/out.SearchForm.php

@@ -100,14 +100,28 @@ function chooseKeywords(target) {
 <tr>
 <td><?php printMLText("search_in");?>:</td>
 <td><ul class="actions">
-<li class="first"><input type="Checkbox" id="keywords" name="searchin[]" value="1"><label for="keywords"><?php printMLText("keywords");?></label></li>
+<li class="first"><input type="Checkbox" id="keywords" name="searchin[]" value="1"><label for="keywords"><?php printMLText("keywords");?></label> (<?php printMLText('documents_only'); ?>)</li>
 <li><input type="Checkbox" name="searchin[]" id="searchName" value="2"><label for="searchName"><?php printMLText("name");?></label></li>
 <li><input type="Checkbox" name="searchin[]" id="comment" value="3"><label for="comment"><?php printMLText("comment");?></label></li>
+<li><input type="Checkbox" name="searchin[]" id="attributes" value="4"><label for="attributes"><?php printMLText("attributes");?></label></li>
 </ul>
 </td>
 </tr>
+<?php
+	$attrdefs = $dms->getAllAttributeDefinitions(array(LetoDMS_Core_AttributeDefinition::objtype_document, LetoDMS_Core_AttributeDefinition::objtype_documentcontent/*, LetoDMS_Core_AttributeDefinition::objtype_all*/));
+	if($attrdefs) {
+		foreach($attrdefs as $attrdef) {
+?>
 <tr>
-<td><?php printMLText("category");?>:</td>
+	<td><?php echo htmlspecialchars($attrdef->getName()); ?></td>
+	<td><?php UI::printAttributeEditField($attrdef, '') ?></td>
+</tr>
+<?php
+		}
+	}
+?>
+<tr>
+<td><?php printMLText("category");?>:<br />(<?php printMLText('documents_only'); ?>)</td>
 <td>
 <select name="categoryids[]" multiple>
 <option value="-1"><?php printMLText("all_categories");?>
@@ -121,7 +135,7 @@ foreach ($allCats as $catObj) {
 </td>
 </tr>
 <tr>
-<td><?php printMLText("status");?>:</td>
+<td><?php printMLText("status");?>:<br />(<?php printMLText('documents_only'); ?>)</td>
 <td>
 <ul class="actions">
 <li class="first"><input type="checkbox" id="pendingReview" name="pendingReview" value="1"><label for='pendingReview'><?php printOverallStatusText(S_DRAFT_REV);?></label></li>

out/out.SetExpires.php

@@ -39,10 +39,10 @@ $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if ($document->getAccessMode($user) < M_READWRITE) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 UI::contentHeading(getMLText("set_expiry"));

out/out.SetReviewersApprovers.php

@@ -39,11 +39,11 @@ $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if ($document->getAccessMode($user) < M_ALL) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
 if (!isset($_GET["version"]) || !is_numeric($_GET["version"]) || intval($_GET["version"]<1)) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 
 $version = $_GET["version"];
@@ -51,15 +51,15 @@ $content = $document->getContentByVersion($version);
 $overallStatus = $content->getStatus();
 
 if (!is_object($content)) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 
 // control for document state
 if ($overallStatus["status"]==S_REJECTED || $overallStatus["status"]==S_OBSOLETE ) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("cannot_assign_invalid_state"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("cannot_assign_invalid_state"));
 }
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 UI::contentHeading(getMLText("change_assignments"));
@@ -115,25 +115,25 @@ foreach ($docAccess["users"] as $usr) {
 	
 	if ($mandatory){
 
-		print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>". htmlspecialchars($usr->getFullName())." &lt;".$usr->getEmail()."&gt;";
+		print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>". htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName())." &lt;".$usr->getEmail()."&gt;";
 		print "<input id='revInd".$usr->getID()."' type='hidden' name='indReviewers[]' value='". $usr->getID() ."'>";
 
 	}else if (isset($reviewIndex["i"][$usr->getID()])) {
 
 		switch ($reviewIndex["i"][$usr->getID()]["status"]) {
 			case 0:
-				print "<li class=\"cbSelectItem\"><input id='revInd".$usr->getID()."' type='checkbox' name='indReviewers[]' value='". $usr->getID() ."' checked='checked'>".htmlspecialchars($usr->getFullName());
+				print "<li class=\"cbSelectItem\"><input id='revInd".$usr->getID()."' type='checkbox' name='indReviewers[]' value='". $usr->getID() ."' checked='checked'>".htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName());
 				break;
 			case -2:
-				print "<li class=\"cbSelectItem\"><input id='revInd".$usr->getID()."' type='checkbox' name='indReviewers[]' value='". $usr->getID() ."'>".htmlspecialchars($usr->getFullName());
+				print "<li class=\"cbSelectItem\"><input id='revInd".$usr->getID()."' type='checkbox' name='indReviewers[]' value='". $usr->getID() ."'>".htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName());
 				break;
 			default:
-				print "<li class=\"cbSelectItem\"><input id='revInd".$usr->getID()."' type='checkbox' name='indReviewers[]' value='". $usr->getID() ."' disabled='disabled'>".htmlspecialchars($usr->getFullName());
+				print "<li class=\"cbSelectItem\"><input id='revInd".$usr->getID()."' type='checkbox' name='indReviewers[]' value='". $usr->getID() ."' disabled='disabled'>".htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName());
 				break;
 		}
 	}
 	else {
-		print "<li class=\"cbSelectItem\"><input id='revInd".$usr->getID()."' type='checkbox' name='indReviewers[]' value='". $usr->getID() ."'>". htmlspecialchars($usr->getFullName());
+		print "<li class=\"cbSelectItem\"><input id='revInd".$usr->getID()."' type='checkbox' name='indReviewers[]' value='". $usr->getID() ."'>". htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName());
 	}
 }
 ?>
@@ -191,25 +191,25 @@ foreach ($docAccess["users"] as $usr) {
 
 	if ($mandatory){
 	
-		print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>". htmlspecialchars($usr->getFullName())." &lt;".$usr->getEmail()."&gt;";
+		print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>". htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName())." &lt;".$usr->getEmail()."&gt;";
 		print "<input id='appInd".$usr->getID()."' type='hidden' name='indApprovers[]' value='". $usr->getID() ."'>";
 
 	}else if (isset($approvalIndex["i"][$usr->getID()])) {
 	
 		switch ($approvalIndex["i"][$usr->getID()]["status"]) {
 			case 0:
-				print "<li class=\"cbSelectItem\"><input id='appInd".$usr->getID()."' type='checkbox' name='indApprovers[]' value='". $usr->getID() ."' checked='checked'>".htmlspecialchars($usr->getFullName());
+				print "<li class=\"cbSelectItem\"><input id='appInd".$usr->getID()."' type='checkbox' name='indApprovers[]' value='". $usr->getID() ."' checked='checked'>".htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName());
 				break;
 			case -2:
-				print "<li class=\"cbSelectItem\"><input id='appInd".$usr->getID()."' type='checkbox' name='indApprovers[]' value='". $usr->getID() ."'>".htmlspecialchars($usr->getFullName());
+				print "<li class=\"cbSelectItem\"><input id='appInd".$usr->getID()."' type='checkbox' name='indApprovers[]' value='". $usr->getID() ."'>".htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName());
 				break;
 			default:
-				print "<li class=\"cbSelectItem\"><input id='appInd".$usr->getID()."' type='checkbox' name='indApprovers[]' value='". $usr->getID() ."' disabled='disabled'>".htmlspecialchars($usr->getFullName());
+				print "<li class=\"cbSelectItem\"><input id='appInd".$usr->getID()."' type='checkbox' name='indApprovers[]' value='". $usr->getID() ."' disabled='disabled'>".htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName());
 				break;
 		}
 	}
 	else {
-		print "<li class=\"cbSelectItem\"><input id='appInd".$usr->getID()."' type='checkbox' name='indApprovers[]' value='". $usr->getID() ."'>". htmlspecialchars($usr->getFullName());
+		print "<li class=\"cbSelectItem\"><input id='appInd".$usr->getID()."' type='checkbox' name='indApprovers[]' value='". $usr->getID() ."'>". htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName());
 	}
 }
 ?>

out/out.Settings.php

@@ -412,6 +412,27 @@ if(!is_writeable($settings->_configFilePath)) {
         <td><?php printMLText("settings_enableAdminRevApp");?>:</td>
         <td><input name="enableAdminRevApp" type="checkbox" <?php if ($settings->_enableAdminRevApp) echo "checked" ?> /></td>
       </tr>
+      <tr title="<?php printMLText("settings_enableVersionDeletion_desc");?>">
+        <td><?php printMLText("settings_enableVersionDeletion");?>:</td>
+        <td><input name="enableVersionDeletion" type="checkbox" <?php if ($settings->_enableVersionDeletion) echo "checked" ?> /></td>
+      </tr>
+      <tr title="<?php printMLText("settings_enableVersionModification_desc");?>">
+        <td><?php printMLText("settings_enableVersionModification");?>:</td>
+        <td><input name="enableVersionModification" type="checkbox" <?php if ($settings->_enableVersionModification) echo "checked" ?> /></td>
+      </tr>
+
+      <!--
+        -- SETTINGS - ADVANCED - NOTIFICATION
+      -->
+      <tr ><td><b> <?php printMLText("settings_Notification");?></b></td> </tr>
+      <tr title="<?php printMLText("settings_enableOwnerNotification_desc");?>">
+        <td><?php printMLText("settings_enableOwnerNotification");?>:</td>
+        <td><input name="enableOwnerNotification" type="checkbox" <?php if ($settings->_enableOwnerNotification) echo "checked" ?> /></td>
+      </tr>
+      <tr title="<?php printMLText("settings_enableNotificationAppRev_desc");?>">
+        <td><?php printMLText("settings_enableNotificationAppRev");?>:</td>
+        <td><input name="enableNotificationAppRev" type="checkbox" <?php if ($settings->_enableNotificationAppRev) echo "checked" ?> /></td>
+      </tr>
 
       <!--
         -- SETTINGS - ADVANCED - SERVER

out/out.UpdateDocument.php

@@ -39,10 +39,10 @@ $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if ($document->getAccessMode($user) < M_READWRITE) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 
@@ -140,6 +140,19 @@ $docAccess = $document->getApproversList();
 				<input type="radio" name="expires" value="true"<?php if ($document->expires()) print " checked";?>><?php UI::printDateChooser(-1, "exp");?>
 			</td>
 		</tr>
+<?php
+	$attrdefs = $dms->getAllAttributeDefinitions(array(LetoDMS_Core_AttributeDefinition::objtype_documentcontent, LetoDMS_Core_AttributeDefinition::objtype_all));
+	if($attrdefs) {
+		foreach($attrdefs as $attrdef) {
+?>
+<tr>
+	<td><?php echo htmlspecialchars($attrdef->getName()); ?></td>
+	<td><?php UI::printAttributeEditField($attrdef, '') ?></td>
+</tr>
+<?php
+		}
+	}
+?>
 		<tr>
 			<td colspan=2>
 			
@@ -158,8 +171,8 @@ $docAccess = $document->getApproversList();
 					$mandatory=false;
 					foreach ($res as $r) if ($r['reviewerUserID']==$usr->getID()) $mandatory=true;
 
-					if ($mandatory) print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>". htmlspecialchars($usr->getFullName());
+					if ($mandatory) print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>". htmlspecialchars($usr->getFullName())."</li>";
-					else print "<li class=\"cbSelectItem\"><input id='revInd".$usr->getID()."' type='checkbox' name='indReviewers[]' value='". $usr->getID() ."'>". htmlspecialchars($usr->getFullName());
+					else print "<li class=\"cbSelectItem\"><input id='revInd".$usr->getID()."' type='checkbox' name='indReviewers[]' value='". $usr->getID() ."'>". htmlspecialchars($usr->getFullName())."</li>";
 				}
 ?>
 				</ul>
@@ -173,8 +186,8 @@ $docAccess = $document->getApproversList();
 					$mandatory=false;
 					foreach ($res as $r) if ($r['reviewerGroupID']==$grp->getID()) $mandatory=true;	
 
-					if ($mandatory) print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>".htmlspecialchars($grp->getName());
+					if ($mandatory) print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>".htmlspecialchars($grp->getName())."</li>";
-					else print "<li class=\"cbSelectItem\"><input id='revGrp".$grp->getID()."' type='checkbox' name='grpReviewers[]' value='". $grp->getID() ."'>".htmlspecialchars($grp->getName());
+					else print "<li class=\"cbSelectItem\"><input id='revGrp".$grp->getID()."' type='checkbox' name='grpReviewers[]' value='". $grp->getID() ."'>".htmlspecialchars($grp->getName())."</li>";
 				}
 ?>
 				</ul>
@@ -195,8 +208,8 @@ $docAccess = $document->getApproversList();
 					$mandatory=false;
 					foreach ($res as $r) if ($r['approverUserID']==$usr->getID()) $mandatory=true;
 					
-					if ($mandatory) print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>". htmlspecialchars($usr->getFullName());
+					if ($mandatory) print "<li class=\"cbSelectItem\"><input type='checkbox' checked='checked' disabled='disabled'>". htmlspecialchars($usr->getFullName())."</li>";
-					else print "<li class=\"cbSelectItem\"><input id='appInd".$usr->getID()."' type='checkbox' name='indApprovers[]' value='". $usr->getID() ."'>". htmlspecialchars($usr->getFullName());
+					else print "<li class=\"cbSelectItem\"><input id='appInd".$usr->getID()."' type='checkbox' name='indApprovers[]' value='". $usr->getID() ."'>". htmlspecialchars($usr->getFullName())."</li>";
 				}
 ?>
 				</ul>

out/out.UpdateDocument2.php

@@ -44,14 +44,14 @@ $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / <a href=\"../out/out.ViewDocument.php?documentid=".$documentid."\">".htmlspecialchars($document->getName())."</a>";
 
 if ($document->getAccessMode($user) < M_READWRITE) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 
-UI::contentHeading(getMLText("update_document") . ": " . $document->getName());
+UI::contentHeading(getMLText("update_document") . ": " . htmlspecialchars($document->getName()));
 UI::contentContainerStart();
 
 if ($document->isLocked()) {

out/out.UsrMgr.php

@@ -187,7 +187,7 @@ UI::contentContainerStart();
 
 					if ($usr->isGuest()) continue;
 
-					print "<li class=\"cbSelectItem\"><input id='revUsr".$usr->getID()."' type='checkbox' name='usrReviewers[]' value='". $usr->getID() ."'>".$usr->getLogin();
+					print "<li class=\"cbSelectItem\"><input id='revUsr".$usr->getID()."' type='checkbox' name='usrReviewers[]' value='". $usr->getID() ."'>".htmlspecialchars($usr->getLogin());
 				}
 ?>
 				</ul>
@@ -217,7 +217,7 @@ UI::contentContainerStart();
 
 					if ($usr->isGuest()) continue;
 
-					print "<li class=\"cbSelectItem\"><input id='appUsr".$usr->getID()."' type='checkbox' name='usrApprovers[]' value='". $usr->getID() ."'>".$usr->getLogin();
+					print "<li class=\"cbSelectItem\"><input id='appUsr".$usr->getID()."' type='checkbox' name='usrApprovers[]' value='". $usr->getID() ."'>".htmlspecialchars($usr->getLogin());
 				}
 ?>
 				</ul>
@@ -249,7 +249,7 @@ UI::contentContainerStart();
 
 		print "<td id=\"keywords".$currUser->getID()."\" style=\"display : none;\">";
 
-		UI::contentSubHeading(getMLText("user")." : ".$currUser->getLogin());
+		UI::contentSubHeading(getMLText("user")." : ".htmlspecialchars($currUser->getLogin()));
 	?>
 
 	<a class="standardText" href="../out/out.RemoveUser.php?userid=<?php print $currUser->getID();?>"><img src="images/del.gif" width="15" height="15" border="0" align="absmiddle" alt=""> <?php printMLText("rm_user");?></a>
@@ -263,7 +263,7 @@ UI::contentContainerStart();
 	<table>
 		<tr>
 			<td><?php printMLText("user_login");?>:</td>
-			<td><input name="login" value="<?php print $currUser->getLogin();?>"></td>
+			<td><input name="login" value="<?php print htmlspecialchars($currUser->getLogin());?>"></td>
 		</tr>
 		<tr>
 			<td><?php printMLText("password");?>:</td>
@@ -347,7 +347,7 @@ UI::contentContainerStart();
 					$checked=false;
 					foreach ($res as $r) if ($r['reviewerUserID']==$usr->getID()) $checked=true;
 
-					print "<li class=\"cbSelectItem\"><input id='revUsr".$usr->getID()."' type='checkbox' ".($checked?"checked='checked' ":"")."name='usrReviewers[]' value='". $usr->getID() ."'>".$usr->getLogin()."</li>\n";
+					print "<li class=\"cbSelectItem\"><input id='revUsr".$usr->getID()."' type='checkbox' ".($checked?"checked='checked' ":"")."name='usrReviewers[]' value='". $usr->getID() ."'>".htmlspecialchars($usr->getLogin())."</li>\n";
 				}
 				?>
 				</ul>
@@ -387,7 +387,7 @@ UI::contentContainerStart();
 					$checked=false;
 					foreach ($res as $r) if ($r['approverUserID']==$usr->getID()) $checked=true;
 
-					print "<li class=\"cbSelectItem\"><input id='appUsr".$usr->getID()."' type='checkbox' ".($checked?"checked='checked' ":"")."name='usrApprovers[]' value='". $usr->getID() ."'>".$usr->getLogin()."</li>\n";
+					print "<li class=\"cbSelectItem\"><input id='appUsr".$usr->getID()."' type='checkbox' ".($checked?"checked='checked' ":"")."name='usrApprovers[]' value='". $usr->getID() ."'>".htmlspecialchars($usr->getLogin())."</li>\n";
 				}
 				?>
 				</ul>

out/out.ViewDocument.php

@@ -3,7 +3,7 @@
 //    Copyright (C) 2002-2005  Markus Westphal
 //    Copyright (C) 2006-2008 Malcolm Cowe
 //    Copyright (C) 2010 Matteo Lucarelli
-//    Copyright (C) 2011 Uwe Steinmann
+//    Copyright (C) 2010-2012 Uwe Steinmann
 //
 //    This program is free software; you can redistribute it and/or modify
 //    it under the terms of the GNU General Public License as published by
@@ -24,6 +24,7 @@ include("../inc/inc.Utils.php");
 include("../inc/inc.DBInit.php");
 include("../inc/inc.Language.php");
 include("../inc/inc.ClassUI.php");
+include("../inc/inc.ClassAccessOperation.php");
 include("../inc/inc.Authentication.php");
 
 function filterDocumentLinks($user, $links) { /* {{{ */
@@ -51,7 +52,7 @@ $folder = $document->getFolder();
 $docPathHTML = getFolderPathHTML($folder, true). " / ".htmlspecialchars($document->getName());
 
 if ($document->getAccessMode($user) < M_READ) {
-	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
 }
 
 if ($document->verifyLastestContentExpriry()){
@@ -64,10 +65,13 @@ $status = $latestContent->getStatus();
 $reviewStatus = $latestContent->getReviewStatus();
 $approvalStatus = $latestContent->getApprovalStatus();
 
+/* Create object for checking access to certain operations */
+$accessop = new LetoDMS_AccessOperation($document, $user, $settings);
+
 // verify if file exists
 $file_exists=file_exists($dms->contentDir . $latestContent->getPath());
 
-UI::htmlStartPage(getMLText("document_title", array("documentname" => $document->getName())));
+UI::htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 UI::globalNavigation($folder);
 UI::pageNavigation($docPathHTML, "view_document");
 UI::contentHeading(getMLText("document_infos"));
@@ -118,6 +122,20 @@ print "<a class=\"infos\" href=\"mailto:".$owner->getEmail()."\">".htmlspecialch
 ?>
 </td>
 </tr>
+<?php
+$attributes = $document->getAttributes();
+if($attributes) {
+	foreach($attributes as $attribute) {
+		$attrdef = $attribute->getAttributeDefinition();
+?>
+		<tr>
+			<td><?php echo htmlspecialchars($attrdef->getName()); ?>:</td>
+			<td><?php echo htmlspecialchars($attribute->getValue()); ?></td>
+		</tr>
+<?php
+	}
+}
+?>
 </table>
 <?php
 UI::contentContainerEnd();
@@ -157,6 +175,16 @@ print "<li>".getMLText("uploaded_by")." <a href=\"mailto:".$updatingUser->getEma
 print "<li>".getLongReadableDate($latestContent->getDate())."</li>";
 
 print "</ul>\n";
+print "<ul class=\"documentDetail\">\n";
+$attributes = $latestContent->getAttributes();
+if($attributes) {
+	foreach($attributes as $attribute) {
+		$attrdef = $attribute->getAttributeDefinition();
+		print "<li>".htmlspecialchars($attrdef->getName()).": ".htmlspecialchars($attribute->getValue())."</li>\n";
+	}
+}
+print "</ul>\n";
+
 print "<td>".htmlspecialchars($latestContent->getComment())."</td>";
 
 print "<td width='10%'>".getOverallStatusText($status["status"]);
@@ -168,23 +196,28 @@ print "</td>";
 print "<td>";
 
 print "<ul class=\"actions\">";
-if (($document->getAccessMode($user) >= M_READWRITE) && (count($versions) > 1)) {
+/* Only admin has the right to remove version in any case or a regular
+ * user if enableVersionDeletion is on
+ */
+if($accessop->mayRemoveVersion()) {
 	print "<li><a href=\"out.RemoveVersion.php?documentid=".$documentid."&version=".$latestContent->getVersion()."\">".getMLText("rm_version")."</a></li>";
 }
-if ($document->getAccessMode($user) == M_ALL) {
+if($accessop->mayOverwriteStatus()) {
-	if ( $status["status"]==S_RELEASED || $status["status"]==S_OBSOLETE ){
+	print "<li><a href='../out/out.OverrideContentStatus.php?documentid=".$documentid."&version=".$latestContent->getVersion()."'>".getMLText("change_status")."</a></li>";
-		print "<li><a href='../out/out.OverrideContentStatus.php?documentid=".$documentid."&version=".$latestContent->getVersion()."'>".getMLText("change_status")."</a></li>";
-	}
-	if ( $status["status"]==S_RELEASED || $status["status"]==S_DRAFT_REV || $status["status"]==S_DRAFT_APP ){
-		print "<li><a href='../out/out.SetReviewersApprovers.php?documentid=".$documentid."&version=".$latestContent->getVersion()."'>".getMLText("change_assignments")."</a></li>";
-	}
-	if ( $status["status"]==S_DRAFT_REV || $status["status"]==S_DRAFT_APP || $status["status"]==S_EXPIRED ){
-		print "<li><a href='../out/out.SetExpires.php?documentid=".$documentid."'>".getMLText("set_expiry")."</a></li>";
-	}
 }
-if ($document->getAccessMode($user) >= M_READWRITE) {
+// Allow changing reviewers/approvals only if not reviewed
+if($accessop->maySetReviewersApprovers()) {
+	print "<li><a href='../out/out.SetReviewersApprovers.php?documentid=".$documentid."&version=".$latestContent->getVersion()."'>".getMLText("change_assignments")."</a></li>";
+}
+if($accessop->maySetExpires()) {
+	print "<li><a href='../out/out.SetExpires.php?documentid=".$documentid."'>".getMLText("set_expiry")."</a></li>";
+}
+if($accessop->mayEditComment()) {
 	print "<li><a href=\"out.EditComment.php?documentid=".$documentid."&version=".$latestContent->getVersion()."\">".getMLText("edit_comment")."</a></li>";
 }
+if($accessop->mayEditAttributes()) {
+	print "<li><a href=\"out.EditAttributes.php?documentid=".$documentid."&version=".$latestContent->getVersion()."\">".getMLText("edit_attributes")."</a></li>";
+}
 
 print "<li><a href=\"../op/op.Download.php?documentid=".$documentid."&vfile=1\">".getMLText("versioning_info")."</a></li>";	
 
@@ -231,7 +264,7 @@ if (is_array($reviewStatus) && count($reviewStatus)>0) {
 				else {
 					$reqName = "<i>".htmlspecialchars($required->getName())."</i>";
 				}
-				if($required->isMember($user))
+				if($required->isMember($user) && ($user->getId() != $owner->getId()))
 					$is_reviewer = true;
 				break;
 		}
@@ -243,8 +276,8 @@ if (is_array($reviewStatus) && count($reviewStatus)>0) {
 		print "<td>".htmlspecialchars($r["comment"])."</td>\n";
 		print "<td>".getReviewStatusText($r["status"])."</td>\n";
 		print "<td><ul class=\"actions\">";
-		
+
-		if ($is_reviewer && $status["status"]==S_DRAFT_REV) {
+		if ($is_reviewer && $r["status"]==0) {
 			print "<li><a href=\"../out/out.ReviewDocument.php?documentid=".$documentid."&version=".$latestContent->getVersion()."&reviewid=".$r['reviewID']."\">".getMLText("submit_review")."</a></li>";
 		}else if (($updateUser==$user)&&(($r["status"]==1)||($r["status"]==-1))&&(!$document->hasExpired())){
 			print "<li><a href=\"../out/out.ReviewDocument.php?documentid=".$documentid."&version=".$latestContent->getVersion()."&reviewid=".$r['reviewID']."\">".getMLText("edit")."</a></li>";
@@ -292,7 +325,7 @@ if (is_array($approvalStatus) && count($approvalStatus)>0) {
 				else {
 					$reqName = "<i>".htmlspecialchars($required->getName())."</i>";
 				}
-				if($required->isMember($user))
+				if($required->isMember($user) && ($user->getId() != $owner->getId()))
 					$is_approver = true;
 				break;
 		}
@@ -360,11 +393,23 @@ if (count($versions)>1) {
 		print "<li>".getMLText("uploaded_by")." <a href=\"mailto:".$updatingUser->getEmail()."\">".htmlspecialchars($updatingUser->getFullName())."</a></li>";
 		print "<li>".getLongReadableDate($version->getDate())."</li>";
 		print "</ul>\n";
+		print "<ul class=\"documentDetail\">\n";
+		$attributes = $version->getAttributes();
+		if($attributes) {
+			foreach($attributes as $attribute) {
+				$attrdef = $attribute->getAttributeDefinition();
+				print "<li>".htmlspecialchars($attrdef->getName()).": ".htmlspecialchars($attribute->getValue())."</li>\n";
+			}
+		}
+		print "</ul>\n";
 		print "<td>".htmlspecialchars($version->getComment())."</td>";
 		print "<td>".getOverallStatusText($vstat["status"])."</td>";
 		print "<td>";
 		print "<ul class=\"actions\">";
-		if (($document->getAccessMode($user) == M_ALL) && (count($versions) > 1)) {
+		/* Only admin has the right to remove version in any case or a regular
+		 * user if enableVersionDeletion is on
+		 */
+		if($accessop->mayRemoveVersion()) {
 			print "<li><a href=\"out.RemoveVersion.php?documentid=".$documentid."&version=".$version->getVersion()."\">".getMLText("rm_version")."</a></li>";
 		}
 		print "<li><a href='../out/out.DocumentVersionDetail.php?documentid=".$documentid."&version=".$version->getVersion()."'>".getMLText("details")."</a></li>";

out/out.ViewFolder.php

@@ -46,10 +46,10 @@ if (isset($_GET["orderby"]) && strlen($_GET["orderby"])==1 ) {
 $folderPathHTML = getFolderPathHTML($folder);
 
 if ($folder->getAccessMode($user) < M_READ) {
-	UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("access_denied"));
+	UI::exitError(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))),getMLText("access_denied"));
 }
 
-UI::htmlStartPage(getMLText("folder_title", array("foldername" => $folder->getName())));
+UI::htmlStartPage(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))));
 
 UI::globalNavigation($folder);
 UI::pageNavigation($folderPathHTML, "view_folder", $folder);
@@ -59,12 +59,27 @@ if ($settings->_enableFolderTree) UI::printTreeNavigation($folderid,$showtree);
 UI::contentHeading(getMLText("folder_infos"));
 
 $owner = $folder->getOwner();
-UI::contentContainer("<table>\n<tr>\n".
+UI::contentContainerStart();
+print "<table>\n<tr>\n".
 			"<td>".getMLText("owner").":</td>\n".
 			"<td><a class=\"infos\" href=\"mailto:".htmlspecialchars($owner->getEmail())."\">".htmlspecialchars($owner->getFullName())."</a>".
 			"</td>\n</tr>\n<tr>\n".
 			"<td>".getMLText("comment").":</td>\n".
-			"<td>".htmlspecialchars($folder->getComment())."</td>\n</tr>\n</table>\n");
+			"<td>".htmlspecialchars($folder->getComment())."</td>\n</tr>\n";
+$attributes = $folder->getAttributes();
+if($attributes) {
+	foreach($attributes as $attribute) {
+		$attrdef = $attribute->getAttributeDefinition();
+?>
+		<tr>
+			<td><?php echo htmlspecialchars($attrdef->getName()); ?>:</td>
+			<td><?php echo htmlspecialchars($attribute->getValue()); ?></td>
+		</tr>
+<?php
+	}
+}
+print "</table>\n";
+UI::contentContainerEnd();
 
 UI::contentHeading(getMLText("folder_contents"));
 UI::contentContainerStart();

reset_db.sql

@@ -1,432 +0,0 @@
--- 
--- Table structure for table `tblACLs`
--- 
-
-DROP TABLE `tblACLs` ;
-CREATE TABLE `tblACLs` (
-  `id` int(11) NOT NULL auto_increment,
-  `target` int(11) NOT NULL default '0',
-  `targetType` tinyint(4) NOT NULL default '0',
-  `userID` int(11) NOT NULL default '-1',
-  `groupID` int(11) NOT NULL default '-1',
-  `mode` tinyint(4) NOT NULL default '0',
-  PRIMARY KEY  (`id`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblDocumentApproveLog`
--- 
-
-DROP TABLE `tblDocumentApproveLog` ;
-CREATE TABLE `tblDocumentApproveLog` (
-  `approveLogID` int(11) NOT NULL auto_increment,
-  `approveID` int(11) NOT NULL default '0',
-  `status` tinyint(4) NOT NULL default '0',
-  `comment` text NOT NULL,
-  `date` datetime NOT NULL default '0000-00-00 00:00:00',
-  `userID` int(11) NOT NULL default '0',
-  PRIMARY KEY  (`approveLogID`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblDocumentApprovers`
--- 
-
-DROP TABLE `tblDocumentApprovers` ;
-CREATE TABLE `tblDocumentApprovers` (
-  `approveID` int(11) NOT NULL auto_increment,
-  `documentID` int(11) NOT NULL default '0',
-  `version` smallint(5) unsigned NOT NULL default '0',
-  `type` tinyint(4) NOT NULL default '0',
-  `required` int(11) NOT NULL default '0',
-  PRIMARY KEY  (`approveID`),
-  UNIQUE KEY `documentID` (`documentID`,`version`,`type`,`required`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblDocumentContent`
--- 
-
-DROP TABLE `tblDocumentContent` ;
-CREATE TABLE `tblDocumentContent` (
-  `document` int(11) NOT NULL default '0',
-  `version` smallint(5) unsigned NOT NULL auto_increment,
-  `comment` text,
-  `date` int(12) default NULL,
-  `createdBy` int(11) default NULL,
-  `dir` varchar(255) NOT NULL default '',
-  `orgFileName` varchar(150) NOT NULL default '',
-  `fileType` varchar(10) NOT NULL default '',
-  `mimeType` varchar(70) NOT NULL default '',
-  PRIMARY KEY  (`document`,`version`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblDocumentLinks`
--- 
-
-DROP TABLE `tblDocumentLinks` ;
-CREATE TABLE `tblDocumentLinks` (
-  `id` int(11) NOT NULL auto_increment,
-  `document` int(11) NOT NULL default '0',
-  `target` int(11) NOT NULL default '0',
-  `userID` int(11) NOT NULL default '0',
-  `public` tinyint(1) NOT NULL default '0',
-  PRIMARY KEY  (`id`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblDocumentFiles`
--- 
-
-DROP TABLE `tblDocumentFiles` ;
-CREATE TABLE `tblDocumentFiles` (
-  `id` int(11) NOT NULL auto_increment,
-  `document` int(11) NOT NULL default '0',
-  `userID` int(11) NOT NULL default '0',
-  `comment` text,
-  `name` varchar(150) default NULL,
-  `date` int(12) default NULL,
-  `dir` varchar(255) NOT NULL default '',
-  `orgFileName` varchar(150) NOT NULL default '',
-  `fileType` varchar(10) NOT NULL default '',
-  `mimeType` varchar(70) NOT NULL default '',  
-  PRIMARY KEY  (`id`)
-) ;
-
-
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblDocumentLocks`
--- 
-
-DROP TABLE `tblDocumentLocks` ;
-CREATE TABLE `tblDocumentLocks` (
-  `document` int(11) NOT NULL default '0',
-  `userID` int(11) NOT NULL default '0',
-  PRIMARY KEY  (`document`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblDocumentReviewLog`
--- 
-
-DROP TABLE `tblDocumentReviewLog` ;
-CREATE TABLE `tblDocumentReviewLog` (
-  `reviewLogID` int(11) NOT NULL auto_increment,
-  `reviewID` int(11) NOT NULL default '0',
-  `status` tinyint(4) NOT NULL default '0',
-  `comment` text NOT NULL,
-  `date` datetime NOT NULL default '0000-00-00 00:00:00',
-  `userID` int(11) NOT NULL default '0',
-  PRIMARY KEY  (`reviewLogID`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblDocumentReviewers`
--- 
-
-DROP TABLE `tblDocumentReviewers` ;
-CREATE TABLE `tblDocumentReviewers` (
-  `reviewID` int(11) NOT NULL auto_increment,
-  `documentID` int(11) NOT NULL default '0',
-  `version` smallint(5) unsigned NOT NULL default '0',
-  `type` tinyint(4) NOT NULL default '0',
-  `required` int(11) NOT NULL default '0',
-  PRIMARY KEY  (`reviewID`),
-  UNIQUE KEY `documentID` (`documentID`,`version`,`type`,`required`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblDocumentStatus`
--- 
-
-DROP TABLE `tblDocumentStatus` ;
-CREATE TABLE `tblDocumentStatus` (
-  `statusID` int(11) NOT NULL auto_increment,
-  `documentID` int(11) NOT NULL default '0',
-  `version` smallint(5) unsigned NOT NULL default '0',
-  PRIMARY KEY  (`statusID`),
-  UNIQUE KEY `documentID` (`documentID`,`version`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblDocumentStatusLog`
--- 
-
-DROP TABLE `tblDocumentStatusLog` ;
-CREATE TABLE `tblDocumentStatusLog` (
-  `statusLogID` int(11) NOT NULL auto_increment,
-  `statusID` int(11) NOT NULL default '0',
-  `status` tinyint(4) NOT NULL default '0',
-  `comment` text NOT NULL,
-  `date` datetime NOT NULL default '0000-00-00 00:00:00',
-  `userID` int(11) NOT NULL default '0',
-  PRIMARY KEY  (`statusLogID`),
-  KEY `statusID` (`statusID`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblDocuments`
--- 
-
-DROP TABLE `tblDocuments` ;
-CREATE TABLE `tblDocuments` (
-  `id` int(11) NOT NULL auto_increment,
-  `name` varchar(150) default NULL,
-  `comment` text,
-  `date` int(12) default NULL,
-  `expires` int(12) default NULL,
-  `owner` int(11) default NULL,
-  `folder` int(11) default NULL,
-  `folderList` text NOT NULL,
-  `inheritAccess` tinyint(1) NOT NULL default '1',
-  `defaultAccess` tinyint(4) NOT NULL default '0',
-  `locked` int(11) NOT NULL default '-1',
-  `keywords` text NOT NULL,
-  `sequence` double NOT NULL default '0',
-  PRIMARY KEY  (`id`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblFolders`
--- 
-
-DROP TABLE `tblFolders` ;
-CREATE TABLE `tblFolders` (
-  `id` int(11) NOT NULL auto_increment,
-  `name` varchar(70) default NULL,
-  `parent` int(11) default NULL,
-  `comment` text,
-  `owner` int(11) default NULL,
-  `inheritAccess` tinyint(1) NOT NULL default '1',
-  `defaultAccess` tinyint(4) NOT NULL default '0',
-  `sequence` double NOT NULL default '0',
-  PRIMARY KEY  (`id`),
-  KEY `parent` (`parent`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblGroupMembers`
--- 
-
-DROP TABLE `tblGroupMembers` ;
-CREATE TABLE `tblGroupMembers` (
-  `groupID` int(11) NOT NULL default '0',
-  `userID` int(11) NOT NULL default '0',
-  `manager` smallint(1) NOT NULL default '0',
-  PRIMARY KEY  (`groupID`,`userID`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblGroups`
--- 
-
-DROP TABLE `tblGroups` ;
-CREATE TABLE `tblGroups` (
-  `id` int(11) NOT NULL auto_increment,
-  `name` varchar(50) default NULL,
-  `comment` text NOT NULL,
-  PRIMARY KEY  (`id`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblKeywordCategories`
--- 
-
-DROP TABLE `tblKeywordCategories` ;
-CREATE TABLE `tblKeywordCategories` (
-  `id` int(11) NOT NULL auto_increment,
-  `name` varchar(255) NOT NULL default '',
-  `owner` int(11) NOT NULL default '0',
-  PRIMARY KEY  (`id`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblKeywords`
--- 
-
-DROP TABLE `tblKeywords` ;
-CREATE TABLE `tblKeywords` (
-  `id` int(11) NOT NULL auto_increment,
-  `category` int(11) NOT NULL default '0',
-  `keywords` text NOT NULL,
-  PRIMARY KEY  (`id`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblNotify`
--- 
-
-DROP TABLE `tblNotify` ;
-CREATE TABLE `tblNotify` (
-  `target` int(11) NOT NULL default '0',
-  `targetType` int(11) NOT NULL default '0',
-  `userID` int(11) NOT NULL default '-1',
-  `groupID` int(11) NOT NULL default '-1',
-  PRIMARY KEY  (`target`,`targetType`,`userID`,`groupID`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblSessions`
--- 
-
-DROP TABLE `tblSessions` ;
-CREATE TABLE `tblSessions` (
-  `id` varchar(50) NOT NULL default '',
-  `userID` int(11) NOT NULL default '0',
-  `lastAccess` int(11) NOT NULL default '0',
-  `theme` varchar(30) NOT NULL default '',
-  `language` varchar(30) NOT NULL default '',
-  PRIMARY KEY  (`id`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblUserImages`
--- 
-
-DROP TABLE `tblUserImages` ;
-CREATE TABLE `tblUserImages` (
-  `id` int(11) NOT NULL auto_increment,
-  `userID` int(11) NOT NULL default '0',
-  `image` blob NOT NULL,
-  `mimeType` varchar(10) NOT NULL default '',
-  PRIMARY KEY  (`id`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for table `tblUsers`
--- 
-
-DROP TABLE `tblUsers` ;
-CREATE TABLE `tblUsers` (
-  `id` int(11) NOT NULL auto_increment,
-  `login` varchar(50) default NULL,
-  `pwd` varchar(50) default NULL,
-  `fullName` varchar(100) default NULL,
-  `email` varchar(70) default NULL,
-  `language` varchar(32) NOT NULL,
-  `theme` varchar(32) NOT NULL,
-  `comment` text NOT NULL,
-  `isAdmin` smallint(1) NOT NULL default '0',
-  `hidden` smallint(1) NOT NULL default '0',
-  PRIMARY KEY  (`id`)
-) ;
-
--- --------------------------------------------------------
-
---
--- dirID is the current target content subdirectory. The last file loaded
--- into MyDMS will be physically stored here. Is updated every time a new
--- file is uploaded.
---
--- dirPath is a essentially a foreign key from tblPathList, referencing the
--- parent directory path for dirID, relative to MyDMS's _contentDir.
---
-
-DROP TABLE `tblDirPath` ;
-CREATE TABLE `tblDirPath` (
-  `dirID` int(11) NOT NULL auto_increment,
-  `dirPath` varchar(255) NOT NULL,
-  PRIMARY KEY  (`dirPath`,`dirID`)
-) ;
-
--- --------------------------------------------------------
-
-DROP TABLE `tblPathList` ;
-CREATE TABLE `tblPathList` (
-  `id` int(11) NOT NULL auto_increment,
-  `parentPath` varchar(255) NOT NULL,
-  PRIMARY KEY  (`id`)
-) ;
-
--- --------------------------------------------------------
-
--- 
--- Table structure for mandatory reviewers
--- 
-
-DROP TABLE `tblMandatoryReviewers` ;
-CREATE TABLE `tblMandatoryReviewers` (
-  `userID` int(11) NOT NULL default '0',
-  `reviewerUserID` int(11) NOT NULL default '0',
-  `reviewerGroupID` int(11) NOT NULL default '0',
-  PRIMARY KEY  (`userID`,`reviewerUserID`,`reviewerGroupID`)
-) ;
-
--- 
--- Table structure for mandatory approvers
--- 
-
-DROP TABLE `tblMandatoryApprovers` ;
-CREATE TABLE `tblMandatoryApprovers` (
-  `userID` int(11) NOT NULL default '0',
-  `approverUserID` int(11) NOT NULL default '0',
-  `approverGroupID` int(11) NOT NULL default '0',
-  PRIMARY KEY  (`userID`,`approverUserID`,`approverGroupID`)
-) ;
-
--- 
--- Table structure for events (calendar)
--- 
-
-DROP TABLE `tblEvents` ;
-CREATE TABLE `tblEvents` (
-  `id` int(11) NOT NULL auto_increment,
-  `name` varchar(150) default NULL,
-  `comment` text,
-  `start` int(12) default NULL,
-  `stop` int(12) default NULL,
-  `date` int(12) default NULL,
-  `userID` int(11) NOT NULL default '0',
-  PRIMARY KEY  (`id`)
-) ;
-
-
---
--- Initial content for database
---
-
-INSERT INTO tblFolders VALUES (1, 'DMS', 0, 'DMS root', 1, 0, 2, 0);
-INSERT INTO tblUsers VALUES (1, 'admin', '21232f297a57a5a743894a0e4a801fc3', 'Administrator', 'address@server.com', '', '', '', 1, 0);
-INSERT INTO tblUsers VALUES (2, 'guest', NULL, 'Guest User', NULL, '', '', '', 0, 0);

styles/blue/style.css

@@ -333,15 +333,15 @@ ul.reviewer li {
 ul.reviewer li.first {
 	border-top: none;
 }
-ul.actions {
+ul.actions, ul.documentDetail {
 	padding: 0;
 	margin: 0;
 }
-ul.actions li {
+ul.actions li, ul.documentDetail li {
 	list-style: none;
 	padding: 0 0 0.1em 0;
 }
-ul.actions li.first {
+ul.actions li.first, ul.documentDetail li.first {
 	border-top: none;
 }
 dl.documentDetail {

webdav/letodms_webdav.php

@@ -409,16 +409,21 @@ class HTTP_WebDAV_Server_LetoDMS extends HTTP_WebDAV_Server
 		printf($format, "Size", "Last modified", "Filename");
 		echo "<hr>";
 
+		$parents = $folder->getPath();
+		$_fullpath = '/';
+		if(count($parents) > 1) {
+			$p = array_slice($parents, -2, 1);
+			$p = $p[0];
+			array_shift($parents);
+			$last = array_pop($parents);
+			foreach($parents as $parent)
+				$_fullpath .= $parent->getName().'/';
+			printf($format, 0, strftime("%Y-%m-%d %H:%M:%S", $p->getDate()), "<a href=\"".$_SERVER['SCRIPT_NAME'].htmlspecialchars($_fullpath)."\">..</a>");
+			$_fullpath .= $last->getName().'/';
+		}
 		foreach ($objs as $obj) {
 			$filename = $obj->getName();
-			$parents = $folder->getPath();
+			$fullpath = $_fullpath.$filename;
-			array_shift($parents);
-			$fullpath = '/';
-			if($parents) {
-				foreach($parents as $parent)
-					$fullpath .= $parent->getName().'/';
-			}
-			$fullpath .= $filename;
 			if(get_class($obj) == 'LetoDMS_Core_Folder') {
 				$fullpath .= '/';
 				$filename .= '/';