Version 4.1.19

applications/cms/modules/front/pages/builder.php

@@ -2,9 +2,10 @@
 /**
  * @brief		[Front] Page Controller
  * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
- * @copyright	(c) 2001 - SVN_YYYY Invision Power Services, Inc.
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
  * @license		http://www.invisionpower.com/legal/standards/
- * @package		IPS Social Suite
+ * @package		IPS Community Suite
+ * @subpackage	Content
  * @since		25 Feb 2014
  * @version		SVN_VERSION_NUMBER
  */
@@ -41,13 +42,24 @@ class _builder extends \IPS\core\modules\front\system\widgets
 			$block->plugin_plugin = \IPS\Request::i()->block_plugin_plugin;
 			$block->key		   = md5( uniqid() );
 			
-			$params = array();
+			$params		= array();
 			$block->content = NULL;
-			
+
 			if ( isset( \IPS\Request::i()->_sending ) )
 			{
 				foreach( explode( ",", \IPS\Request::i()->_sending ) as $field )
 				{
+					/* Multi-Selects will pass their parameters through as an array, so we need to make sure we check those properly to include all options. */
+					if ( mb_strstr( $field, '[]' ) !== FALSE )
+					{
+						$field		= str_replace( '[]', '', $field );
+						$isArray	= TRUE;
+					}
+					else
+					{
+						$isArray	= FALSE;
+					}
+					
 					if ( $field and isset( \IPS\Request::i()->$field ) )
 					{
 						if ( $field == 'block_content' )
@@ -67,7 +79,24 @@ class _builder extends \IPS\core\modules\front\system\widgets
 							$params[ 'widget_feed_container'] = \IPS\Request::i()->$field == 'on' ? 0 : \IPS\Request::i()->$field;
 							continue;
 						}
+
+						/* We need to handle tags special */
+						if( $field == 'widget_feed_tags' )
+						{
+							$params[ $field ] = explode( ',', \IPS\Request::i()->$field );
+							continue;
+						}
 						
+						/* Is it an array? */
+						if ( $isArray )
+						{
+							foreach( \IPS\Request::i()->$field AS $multi )
+							{
+								$params[ $field ][] = $multi;
+							}
+							continue;
+						}
+
 						$params[ $field ] = \IPS\Request::i()->$field;
 					}
 				}
@@ -234,6 +263,8 @@ class _builder extends \IPS\core\modules\front\system\widgets
 		$newOrder = array();
 		$seen     = array();
 
+		\IPS\Session::i()->csrfCheck();
+		
 		try
 		{
 			$currentConfig = \IPS\Db::i()->select( '*', 'cms_page_widget_areas', array( 'area_page_id=? AND area_area=?', \IPS\Request::i()->pageID, \IPS\Request::i()->area ) )->first();
@@ -243,7 +274,7 @@ class _builder extends \IPS\core\modules\front\system\widgets
 		{
 			$widgets = array();
 		}
-		
+
 		/* Loop over the new order and merge in current blocks so we don't lose config */
 		if ( isset ( \IPS\Request::i()->order ) )
 		{
@@ -301,7 +332,14 @@ class _builder extends \IPS\core\modules\front\system\widgets
 				}
 			}
 		}
-
+		
+		/* Check core_widget_areas to ensure that the block wasn't added there */
+		if ( isset( \IPS\Request::i()->exclude ) and ! empty( \IPS\Request::i()->exclude ) )
+		{
+			$bits = explode( "_", \IPS\Request::i()->exclude );
+			$this->_checkAndDeleteFromCoreWidgets( $bits[3], $seen );
+		}
+		
 		/* Expire Caches so up to date information displays */
 		\IPS\Widget::deleteCaches();
 
@@ -311,4 +349,53 @@ class _builder extends \IPS\core\modules\front\system\widgets
 		
 		\IPS\cms\Pages\Page::load( \IPS\Request::i()->pageID )->postWidgetOrderSave();
 	}
+	
+	/**
+	 * Sometimes the widgets end up in the core table. We haven't really found out why this happens. It happens very rarely.
+	 * It may be that the CMS JS mixin doesn't load so the core ajax URLs are used (system/widgets.php) and not the cms widget (page/builder.php).
+	 * This method ensures that any widgets in the core table are removed
+	 *
+	 * @param	string	$uniqueId	The unique key of the widget (eg: wzsj1233)
+	 * @param	array	$widgets	Current widgets (eg from core_widget_areas.widgets (json decoded))
+	 * @return	boolen				True if something removed, false if not
+	 */
+	protected function _checkAndDeleteFromCoreWidgets( $uniqueId, $widgets )
+	{
+		if ( ! in_array( $uniqueId, $widgets ) )
+		{
+			/* This widget hasn't been seen, so it isn't in the cms table */
+			try
+			{
+				$cmsWidget = \IPS\Db::i()->select( '*', 'core_widget_areas', array( 'app=? and module=? and controller=? and area=?', 'cms', 'pages', 'page', \IPS\Request::i()->area ) )->first();
+				$cmsWidgets = json_decode( $cmsWidget['widgets'], TRUE );
+				$newWidgets = array();
+				
+				foreach( $cmsWidgets as $item )
+				{
+					if ( $item['unique'] !== $uniqueId )
+					{
+						$newWidgets[] = $item;
+					}
+				}
+				
+				/* Anything to save? */
+				if ( count( $newWidgets ) )
+				{
+					\IPS\Db::i()->replace( 'core_widget_areas', array( 'app' => 'cms', 'module' => 'pages', 'controller' => 'page', 'widgets' => json_encode( $newWidgets ), 'area' => \IPS\Request::i()->area ) );
+				}
+				else
+				{
+					/* Just remove the entire row */
+					\IPS\Db::i()->delete( 'core_widget_areas', array( 'app=? and module=? and controller=? and area=?', 'cms', 'pages', 'page', \IPS\Request::i()->area ) );
+				}
+				
+				return TRUE;
+			}
+			catch( \UnderFlowException $ex )
+			{
+				/* Well, it isn't there either... */
+				return FALSE;
+			}
+		}
+	}
 }