Version 5.0.6

applications/core/modules/front/system/alerts.php

@@ -58,7 +58,7 @@ class alerts extends Controller
 		{
 			$alert = Alert::load( Request::i()->id );
 
-			if( $alert->reply == Alert::REPLY_REQUIRED and Member::loggedIn()->member_id and Member::loggedIn()->canUseMessenger() )
+			if( $alert->reply == Alert::REPLY_REQUIRED and Member::loggedIn()->member_id and Member::loggedIn()->canUseMessenger() and Member::load( $alert->member_id )->member_id )
 			{
 				Output::i()->error( 'alert_cant_dismiss', '3C428/1', 403, '' );
 			}

applications/core/modules/front/system/attachments.php

@@ -23,6 +23,7 @@ use IPS\Output;
 use IPS\Request;
 use IPS\Session;
 use IPS\Theme;
+use LogicException;
 use OutOfRangeException;
 use UnderflowException;
 use function defined;
@@ -110,13 +111,13 @@ class attachments extends Controller
 				$attachmentItem = $extensions[ $exploded[1] ]->attachmentLookup( $attachment[ 'id1' ], $attachment[ 'id2' ], $attachment[ 'id3' ] );
 			}
 		}
-		catch ( OutOfRangeException $e )
+		catch ( OutOfRangeException | LogicException $e )
 		{
 			Output::i()->json( array( 'error' => 'no_permission' ) );
 		}
 
 		/* If we have permission to edit the post, we're going to save the rotation angle */
-		if( $attachmentItem->author()->member_id == Member::loggedIn()->member_id OR $attachmentItem->canEdit() )
+		if( $attachmentItem instanceof \IPS\Content and ( $attachmentItem->author()->member_id == Member::loggedIn()->member_id OR $attachmentItem->canEdit() ) )
 		{
 			$baseRotation = $attachment['attach_img_rotate'];
 			$temp = false;

applications/core/modules/front/system/editor.php

@@ -387,7 +387,7 @@ class editor extends Controller
 			}
 		}
 		/* Work out what tab we're on */
-		if ( !Request::i()->tab )
+		if ( !Request::i()->tab or !in_array( Request::i()->tab, $mediaSources ) )
 		{
 			if( !count( $mediaSources ) )
 			{
@@ -400,7 +400,8 @@ class editor extends Controller
 		}
 
 		$exploded = explode( '_', Request::i()->tab );
-		$classname = "IPS\\{$exploded[0]}\\extensions\\core\\EditorMedia\\{$exploded[1]}";
+		$classname = Application::getExtensionClass( $exploded[0], 'EditorMedia', $exploded[1] );
+
 		$extension = new $classname;
 		$url = Url::internal( "app=core&module=system&controller=editor&do=myMedia&tab=" . Request::i()->tab . "&key=" . Request::i()->key . "&postKey=" . Request::i()->postKey . "&existing=1" );
 		

applications/core/modules/front/system/metatags.php

@@ -212,7 +212,11 @@ class metatags extends Controller
 
 			foreach( $manifest as $k => $v )
 			{
-				if( $v )
+				if ( $k == 'start_url' AND empty( $v ) )
+				{
+					$output[ $k ] = '/';
+				}
+				else if ( $v )
 				{
 					$output[ $k ] = $v;
 				}

applications/core/modules/front/system/register.php

@@ -258,17 +258,24 @@ class register extends Controller
 						$steps[ $key ] = $form;
 					}
 				}
+
+				/* This happens when the user has already completed the step.
+				We need to use a dummy function, or the wizard gets thrown out of whack. */
+				if( !array_key_exists( $step->key, $steps ) )
+				{
+					$steps[ $step->key ] = function( $data )
+					{
+						return $data;
+					};
+				}
 			}
 		}
 
-		/* If we have more than one step, add a redirect step at the end */
-		if( count( $steps ) > 1 )
+		/* The redirect is always the last step */
+		$steps['profile_done'] = function( $data ) use( $postBeforeRegister )
 		{
-			$steps['profile_done'] = function( $data ) use( $postBeforeRegister )
-			{
-				$this->_performRedirect( $postBeforeRegister );
-			};
-		}
+			$this->_performRedirect( $postBeforeRegister );
+		};
 		
 		/* Output */
 		Output::i()->title	= Member::loggedIn()->language()->addToStack('registration');

applications/core/modules/front/system/settings.php

@@ -191,7 +191,8 @@ class settings extends Controller
 		{
 			$tabs['email'] = [
 				'icon' => 'envelope',
-				'title' => 'email_address'
+				'title' => 'email_address',
+				'url' => Url::internal( "app=core&module=system&controller=settings&area=email", "front", "settings_email" )
 			];
 			if( Member::loggedIn()->members_bitoptions['email_messages_bounce'] )
 			{
@@ -215,7 +216,10 @@ class settings extends Controller
 
 		if( $canChangePassword )
 		{
-			$tabs['password'] = [ 'icon' => 'key' ];
+			$tabs['password'] = [
+				'icon' => 'key',
+				'url' => Url::internal( "app=core&module=system&controller=settings&area=password", "front", "settings_password" )
+			];
 		}
 
 		/* MFA */
@@ -233,7 +237,8 @@ class settings extends Controller
 		{
 			$tabs['mfa'] = [
 				'icon' => 'lock',
-				'title' => 'ucp_mfa'
+				'title' => 'ucp_mfa',
+				'url' => Url::internal( "app=core&module=system&controller=settings&area=mfa", "front", "settings_mfa" )
 			];
 		}
 
@@ -242,20 +247,25 @@ class settings extends Controller
 		{
 			$tabs['devices'] = [
 				'icon' => 'laptop',
-				'title' => 'ucp_devices'
+				'title' => 'ucp_devices',
+				'url' => Url::internal( "app=core&module=system&controller=settings&area=devices", "front", "settings_devices" )
 			];
 		}
 
 		/* Can change username? */
 		if( Member::loggedIn()->group['g_dname_changes'] )
 		{
-			$tabs['username'] = [ 'icon' => 'user' ];
+			$tabs['username'] = [
+				'icon' => 'user',
+				'url' => Url::internal( "app=core&module=system&controller=settings&area=username", "front", "settings_username" )
+			];
 		}
 
 		/* Content Preferences */
 		$tabs['links'] = [
 			'icon' => 'file-pen',
-			'title' => 'profile_settings_cvb'
+			'title' => 'profile_settings_cvb',
+			'url' => Url::internal( "app=core&module=system&controller=settings&area=links", "front", "settings_links" )
 		];
 
 		/* Signature */
@@ -292,7 +302,8 @@ class settings extends Controller
 		{
 			$tabs['apps'] = [
 				'icon' => 'cubes',
-				'title' => 'oauth_apps'
+				'title' => 'oauth_apps',
+				'url' => Url::internal( "app=core&module=system&controller=settings&area=apps", "front", "settings_apps" )
 			];
 		}
 

applications/core/modules/front/system/themeeditor.php

@@ -56,6 +56,13 @@ class themeeditor extends Controller
 	 */
 	public function manage(): void
 	{
+		/* If we are coming from a login, redirect to the homepage. At this point, the
+		editor cookie will already be enabled, so the theme editor will open automatically. */
+		if( isset( Request::i()->_fromLogin ) and Request::i()->_fromLogin )
+		{
+			Output::i()->redirect( Url::internal( "" ) );
+		}
+
 		if( !Member::loggedIn()->modPermission( 'can_use_theme_editor' ) )
 		{
 			Output::i()->error( 'no_permission', '2S164/1', 403, '' );
@@ -364,14 +371,7 @@ class themeeditor extends Controller
 	 */
 	protected function customCss() : void
 	{
-		$functionName = "css_" . uniqid();
-		Theme::makeProcessFunction( Theme::fixResourceTags( (string) Request::i()->content, 'front' ), $functionName, '', FALSE, TRUE );
-
-		$fqFunc		= 'IPS\\Theme\\'. $functionName;
-		$content	= Theme::minifyCss( $fqFunc() );
-
-		/* Replace any <fileStore.xxx> tags in the CSS */
-		Output::i()->parseFileObjectUrls( $content );
+		$content = Theme::compileCustomCss( Request::i()->content );
 		Output::i()->json( [ 'content' => $content ] );
 	}
 }

applications/core/modules/front/system/widgets.php

@@ -78,6 +78,7 @@ class widgets extends Controller
 			$this->pageApp = 'global';
 			$this->pageModule = 'global';
 			$this->pageController = 'global';
+			$this->widgetClass = Widget::class;
 		}
 		
 		parent::execute();
@@ -90,10 +91,16 @@ class widgets extends Controller
 	 */
 	protected function getBlockList() : void
 	{
-		/* Initialize with Pages as the first in the list */
-		$availableBlocks = array(
-			'cms' => []
-		);
+		if( Application::appIsEnabled( 'cms' ) )
+		{
+			/* Initialize with Pages as the first in the list */
+			$availableBlocks = [
+				'cms' => []
+			];
+		}else
+		{
+			$availableBlocks = [];
+		}
 
 		$favoriteIds = json_decode( Settings::i()->favorite_blocks, true );
 		$favorites = [];
@@ -228,6 +235,10 @@ class widgets extends Controller
 
 		$output = (string) $widget;
 		Output::i()->output = ( $output ) ?:  Theme::i()->getTemplate( 'widgets', 'core', 'front' )->blankWidget( $widget );
+		if( Request::i()->isAjax() )
+		{
+			Output::i()->sendOutput( Output::i()->output );
+		}
 	}
 	
 	/**