Version 5.0.14

applications/core/modules/front/discover/streams.php

@@ -461,7 +461,7 @@ class streams extends Controller
 			}
 			if ( !empty( $extra ) )
 			{
-				$results = $results->addExtraItems( $extra, NULL, ( Request::i()->isAjax() and isset( Request::i()->after ) ) ? DateTime::ts( Request::i()->after ) : NULL, ( Request::i()->isAjax() and isset( Request::i()->before ) ) ? DateTime::ts( Request::i()->before ) : NULL );
+				$results = $results->addExtraItems( $extra, NULL, ( Request::i()->isAjax() and isset( Request::i()->after ) ) ? DateTime::ts( (int) Request::i()->after ) : NULL, ( Request::i()->isAjax() and isset( Request::i()->before ) ) ? DateTime::ts( (int) Request::i()->before ) : NULL );
 			}
 		}
 
@@ -682,7 +682,7 @@ class streams extends Controller
 			}
 		}
 
-		foreach( Content\Search\SearchContent::searchableClasses() as $class )
+		foreach( Content\Search\SearchContent::searchableClasses( Member::loggedIn() ) as $class )
 		{
 			$classes[ $class ] = $class::$title . '_pl';
 			if ( isset( $class::$containerNodeClass ) and $class == Request::i()->className )
@@ -699,7 +699,7 @@ class streams extends Controller
 				), NULL, NULL, NULL, 'stream_containers_' . $class::$title );
 				$field->label = Member::loggedIn()->language()->addToStack( 'stream_narrow_by_container_label', FALSE, array( 'sprintf' => array( Member::loggedIn()->language()->addToStack( $containerClass::$nodeTitle ) ) ) );
 
-				return Output::i()->json( array( 'node' => Theme::i()->getTemplate('streams')->filterFormContentTypeContent( $field, $class, Request::i()->key ) ) );
+				Output::i()->json( array( 'node' => Theme::i()->getTemplate('streams')->filterFormContentTypeContent( $field, $class, Request::i()->key ) ) );
 			}
 		}
 

applications/core/modules/front/messaging/messenger.php

@@ -32,7 +32,6 @@ use IPS\Notification;
 use IPS\Output;
 use IPS\Request;
 use IPS\Session;
-use IPS\Settings;
 use IPS\Theme;
 use LogicException;
 use OutOfRangeException;
@@ -60,11 +59,6 @@ class messenger extends Controller
 	 */
 	protected static string $contentModel = 'IPS\core\Messenger\Conversation';
 	
-	/**
-	 * [Content\Controller]	FURL Base
-	 */
-	protected static string $furlBase = 'messenger';
-	
 	/**
 	 * Execute
 	 *
@@ -586,9 +580,9 @@ class messenger extends Controller
 				try
 				{
 					$conversation = Conversation::loadAndCheckPerms( $id );
-					$conversation->moveConversation( Request::i()->move_message_to );
+					$conversation->moveConversation( $values['move_message_to'] );
 				}
-				catch ( OutOfRangeException $e )
+				catch ( OutOfRangeException )
 				{
 					continue;
 				}
@@ -762,7 +756,7 @@ class messenger extends Controller
 		try
 		{
 			$conversation = Conversation::loadAndCheckPerms( Request::i()->id );
-			if ( $conversation->starter_id != Member::loggedIn()->member_id )
+			if ( $conversation->starter_id != Member::loggedIn()->member_id or Request::i()->member == $conversation->starter_id )
 			{
 				throw new BadMethodCallException;
 			}
@@ -787,7 +781,7 @@ class messenger extends Controller
 				Output::i()->redirect( $conversation->url() );
 			}
 		}
-		catch ( LogicException $e )
+		catch ( LogicException )
 		{
 			Output::i()->error( 'no_module_permission', '2C137/4', 403, '' );
 		}
@@ -1071,6 +1065,8 @@ class messenger extends Controller
 	 */
 	protected function removeAlertFilter() : void
 	{
+		Session::i()->csrfCheck();
+
 		Alert::clearMessengerFilters();
 
 		Output::i()->redirect( Url::internal('app=core&module=messaging&controller=messenger&overview=1') );

applications/core/modules/front/search/search.php

@@ -279,7 +279,7 @@ class search extends Controller
 								break;
 								
 							default:
-								$$l = DateTime::ts( Request::i()->$key );
+								$$l = DateTime::ts( (int) Request::i()->$key );
 								break;
 						}
 					}
@@ -646,8 +646,8 @@ class search extends Controller
 			if ( isset( Request::i()->$beforeKey ) and Request::i()->$beforeKey != 'any' and isset( Request::i()->$afterKey ) and Request::i()->$afterKey != 'any' )
 			{
 				/* Javascript takes a date and turns it into a timestamp but does not apply any timezone offsetting, so we don't want to do so here or else the date we create may not be the same one the user chose. */
-				$after	= DateTime::ts( Request::i()->$afterKey, TRUE );
-				$before	= DateTime::ts( Request::i()->$beforeKey, TRUE );
+				$after	= DateTime::ts( (int) Request::i()->$afterKey, TRUE );
+				$before	= DateTime::ts( (int) Request::i()->$beforeKey, TRUE );
 				$titleConditions[] = Member::loggedIn()->language()->addToStack( "search_blurb_date_$k", FALSE, array( 'sprintf' => array( Member::loggedIn()->language()->addToStack( "search_blurb_date_between", FALSE, array( 'sprintf' => array( $after->localeDate(), $before->localeDate() ) ) ) ) ) );
 
 				$query->$method( $after, $before );
@@ -693,7 +693,7 @@ class search extends Controller
 								break;
 								
 							default:
-								$$l = DateTime::ts( Request::i()->$$key );
+								$$l = DateTime::ts( (int) Request::i()->$$key );
 								$dateCondition = Member::loggedIn()->language()->addToStack( "search_blurb_date_{$l}", FALSE, array( 'sprintf' => array( $$l->localeDate() ) ) );
 								break;
 						}
@@ -1043,12 +1043,12 @@ class search extends Controller
 		
 		/* Dates */
 		$form->add( new Select( 'startDate', ( isset( Request::i()->start_before ) or ( isset( Request::i()->start_after ) and is_numeric( Request::i()->start_after ) ) ) ? 'custom' : Request::i()->start_after, FALSE, array( 'options' => $dateOptions, 'toggles' => array( 'custom' => array( 'elCustomDate_startDate' ) ) ), NULL, NULL, NULL, 'startDate' ), NULL, 'search_tab_content' );
-		$form->add( new DateRange( 'startDateCustom', array( 'start' => ( isset( Request::i()->start_after ) and is_numeric(  Request::i()->start_after ) ) ? DateTime::ts( Request::i()->start_after, TRUE ) : NULL, 'end' => isset( Request::i()->start_before ) ? DateTime::ts( Request::i()->start_before, TRUE ) : NULL ), false, array(
+		$form->add( new DateRange( 'startDateCustom', array( 'start' => ( isset( Request::i()->start_after ) and is_numeric(  Request::i()->start_after ) ) ? DateTime::ts( (int) Request::i()->start_after, TRUE ) : NULL, 'end' => isset( Request::i()->start_before ) ? DateTime::ts( (int) Request::i()->start_before, TRUE ) : NULL ), false, array(
 			'start' => array( 'timezone' => new DateTimeZone( 'UTC' ), 'time' => FALSE ),
 			'end' => array( 'timezone' => new DateTimeZone( 'UTC' ), 'time' => FALSE )
 		) ), NULL, 'search_tab_content' );
 		$form->add( new Select( 'updatedDate', ( isset( Request::i()->updated_before ) or ( isset( Request::i()->updated_after ) and is_numeric( Request::i()->updated_after ) ) ) ? 'custom' : Request::i()->updated_after, FALSE, array( 'options' => $dateOptions, 'toggles' => array( 'custom' => array( 'elCustomDate_updatedDate' ) ) ), NULL, NULL, NULL, 'updatedDate' ), NULL, 'search_tab_content' );
-		$form->add( new DateRange( 'updatedDateCustom', array( 'start' => ( isset( Request::i()->updated_after ) and is_numeric( Request::i()->updated_after ) ) ? DateTime::ts( Request::i()->updated_after, TRUE ) : NULL, 'end' => isset( Request::i()->updated_before ) ? DateTime::ts( Request::i()->updated_before, TRUE ) : NULL ), false, array(
+		$form->add( new DateRange( 'updatedDateCustom', array( 'start' => ( isset( Request::i()->updated_after ) and is_numeric( Request::i()->updated_after ) ) ? DateTime::ts( (int) Request::i()->updated_after, TRUE ) : NULL, 'end' => isset( Request::i()->updated_before ) ? DateTime::ts( (int) Request::i()->updated_before, TRUE ) : NULL ), false, array(
 			'start' => array( 'timezone' => new DateTimeZone( 'UTC' ), 'time' => FALSE ),
 			'end' => array( 'timezone' => new DateTimeZone( 'UTC' ), 'time' => FALSE )
 		) ), NULL, 'search_tab_content' );
@@ -1366,7 +1366,7 @@ class search extends Controller
 	public static function contentTypes( Member|bool $member = TRUE ) : array
 	{
 		$types = array();
-		foreach( Content\Search\SearchContent::searchableClasses() as $class )
+		foreach( Content\Search\SearchContent::searchableClasses( $member instanceof Member ? $member : Member::loggedIn() ) as $class )
 		{
 			if( in_array( 'IPS\Content\Item', class_parents( $class ) ) )
 			{
@@ -1374,6 +1374,7 @@ class search extends Controller
 				$types[ $key ] = $class;
 			}
 		}
+
 		return $types;
 	}
 	

applications/core/modules/front/system/announcement.php

@@ -93,6 +93,8 @@ class announcement extends Controller
 
 	/**
 	 * Check permissions for linked content item
+	 * 
+	 * called from js/front/controllers/modcp/ips.modcp.announcementForm.js
 	 *
 	 * @return	void
 	 */
@@ -128,6 +130,7 @@ class announcement extends Controller
 		}
 
 		$class = $furlDefinition[ $url->seoTemplate ]['verify'];
+		/** @var Item $item */
 		$item = $class::loadFromUrl( $url );
 
 		/* If the class does not have our method, return a not_verified status */

applications/core/modules/front/system/editor.php

@@ -136,6 +136,7 @@ class editor extends Controller
 			$externalEmbedAllowed,
 			$externalImageAllowed,
 			$internalEmbedAllowed,
+			Settings::i()->iframely_enabled ? Settings::i()->iframely_api_key : false, // we need to consider this when creating the cache key because it can change the results
 		]));
 
 		try

applications/core/modules/front/system/register.php

@@ -127,6 +127,12 @@ class register extends Controller
 			Output::i()->showOffline();
 		}
 
+		/* Are we already logged in? */
+		if( Member::loggedIn()->member_id )
+		{
+			Output::i()->redirect( Url::internal( "" ) );
+		}
+
 		if( Application::appIsEnabled( 'nexus' ) )
 		{
 			if ( Member::loggedIn()->canAccessModule( Module::get( 'nexus', 'store' ) ) and ( Settings::i()->nexus_reg_force or !isset( Request::i()->noPurchase ) ) and Package::haveRegistrationProducts() )
@@ -245,27 +251,30 @@ class register extends Controller
 		};
 
 		/* Do we have any profile completion steps marked for registration? */
-		foreach( ProfileStep::loadAll() as $step )
+		if( Login::registrationType() == 'full' )
 		{
-			if( $step->registration )
+			foreach( ProfileStep::loadAll() as $step )
 			{
-				$extension = $step->extension;
-				foreach( $extension::wizard() as $key => $form )
+				if( $step->registration )
 				{
-					if( $key == $step->key )
+					$extension = $step->extension;
+					foreach( $extension::wizard() as $key => $form )
 					{
-						$steps[ $key ] = $form;
+						if( $key == $step->key )
+						{
+							$steps[ $key ] = $form;
+						}
 					}
-				}
 
-				/* This happens when the user has already completed the step.
-				We need to use a dummy function, or the wizard gets thrown out of whack. */
-				if( !array_key_exists( $step->key, $steps ) )
-				{
-					$steps[ $step->key ] = function( $data )
+					/* This happens when the user has already completed the step.
+					We need to use a dummy function, or the wizard gets thrown out of whack. */
+					if( !array_key_exists( $step->key, $steps ) )
 					{
-						return $data;
-					};
+						$steps[ $step->key ] = function( $data )
+						{
+							return $data;
+						};
+					}
 				}
 			}
 		}
@@ -357,12 +366,16 @@ class register extends Controller
 				Session::i()->setMember( $member );
 				Device::loadOrCreate( $member, FALSE )->updateAfterAuthentication( TRUE );
 
-				/* If we have profile steps on registration, return instead of redirect */
-				foreach( ProfileStep::loadAll() as $step )
+				/* If we have profile steps on registration, return instead of redirect
+				but ONLY if we are using full registration */
+				if( Login::registrationType() == 'full' )
 				{
-					if( $step->registration )
+					foreach( ProfileStep::loadAll() as $step )
 					{
-						return [ 'member' => $member->member_id ];
+						if( $step->registration )
+						{
+							return [ 'member' => $member->member_id ];
+						}
 					}
 				}