Merge branch 'craigk5n:master' into cmpsr

admin.php

@@ -107,7 +107,6 @@ function save_pref ( $prefs, $src ) {
   $select = translate ( 'Select' ) . '...';
 
   // Allow css_cache of webcal_config values.
-  @session_start();
   $_SESSION['webcal_tmp_login'] = 'blahblahblah';
 
   $editStr = '<button name="" type="button" '

adminhome.php

@@ -147,7 +147,6 @@
   }
 }
 
-@session_start();
 $_SESSION['webcal_tmp_login'] = 'SheIsA1Fine!';
 
 print_header( '',

css_cacher.php

@@ -14,6 +14,7 @@
 require_once 'includes/validate.php';
 
 load_global_settings();
+session_name(getSessionName());
 @session_start();
 $empTmp = ( ! empty( $_SESSION['webcal_tmp_login'] ) );
 

docker/docker-compose-php8-dev.yml

@@ -44,6 +44,22 @@ services:
       - 8080:80
     volumes:
       - ..:/var/www/html/
+    # You can use env vars instead of putting the details in includes/settings.php.  If WebCalendar
+    # sees WEBCALENDAR_USE_ENV is set to true, it will use these env vars and ignore settings.php.
+    # The install password below is "Webcalendar.1" (and you should change it).
+    # Use the following to generate your password hash (replace "Webcalendar.1" with your password):
+    # php -r "echo md5('Webcalendar.1');"
+    environment:
+      - WEBCALENDAR_USE_ENV=true
+      - WEBCALENDAR_INSTALL_PASSWORD=da1437a2c74ee0b35eed71e27d00c618
+      - WEBCALENDAR_DB_TYPE=mysqli
+      - WEBCALENDAR_DB_DATABASE=webcalendar_php8
+      - WEBCALENDAR_DB_LOGIN=webcalendar
+      - WEBCALENDAR_DB_PASSWORD=Webcalendar.1
+      - WEBCALENDAR_DB_HOST=db
+      - WEBCALENDAR_DB_PERSISTENT=true
+      - WEBCALENDAR_USER_INC=user.php
+      - WEBCALENDAR_MODE=dev
 
 volumes:
   mysql-data:

docker/docker-compose-php8.yml

@@ -40,6 +40,22 @@ services:
       - db
     ports:
       - 8080:80
+   # You can use env vars instead of putting the details in includes/settings.php.  If WebCalendar
+    # sees WEBCALENDAR_USE_ENV is set to true, it will use these env vars and ignore settings.php.
+    # The install password below is "Webcalendar.1" (and you should change it).
+    # Use the following to generate your password hash (replace "Webcalendar.1" with your password):
+    # php -r "echo md5('Webcalendar.1');"
+    #environment:
+    #  - WEBCALENDAR_USE_ENV=true
+    #  - WEBCALENDAR_INSTALL_PASSWORD=da1437a2c74ee0b35eed71e27d00c618
+    #  - WEBCALENDAR_DB_TYPE=mysqli
+    #  - WEBCALENDAR_DB_DATABASE=webcalendar_php8
+    #  - WEBCALENDAR_DB_LOGIN=webcalendar
+    #  - WEBCALENDAR_DB_PASSWORD=Webcalendar.1
+    #  - WEBCALENDAR_DB_HOST=db
+    #  - WEBCALENDAR_DB_PERSISTENT=true
+    #  - WEBCALENDAR_USER_INC=user.php
+    #  - WEBCALENDAR_MODE=dev
 
 volumes:
   mysql-data:

edit_entry.php

@@ -188,14 +188,14 @@ function time_selection($prefix, $time = '', $trigger = false)
       $cal_date = date('Ymd', $calTS);
       $cal_time = date('His', $calTS);
     }
-    $hour = floor($cal_time / 10000);
-    $minute = ($cal_time / 100) % 100;
+    $hour = intval(floor($cal_time / 10000));
+    $minute = intval(($cal_time / 100)) % 100;
 
     $dueTS = date_to_epoch($due_date . $due_time);
     $due_date = date('Ymd', $dueTS);
     $due_time = date('His', $dueTS);
-    $due_hour = floor($due_time / 10000);
-    $due_minute = ($due_time / 100) % 100;
+    $due_hour = intval(floor($due_time / 10000));
+    $due_minute = intval(($due_time / 100)) % 100;
 
     $priority = $row[6];
     $type = $row[7];

export.php

@@ -116,9 +116,9 @@
   function updateDateFields () {
     var displayAll = $('#exportall')[0].checked;
     if (displayAll) {
-      $('#dateArea').show();
-    } else {
       $('#dateArea').hide();
+    } else {
+      $('#dateArea').show();
     }
   }
 

export_handler.php

@@ -217,19 +217,19 @@ function transmit_header( $mime, $file ) {
   die_miserable_death ( 'Invalid format "' . htmlspecialchars($format) . '"' );
 $id = getValue ( 'id', '-?[0-9]+', true );
 
-$use_all_dates = getPostValue ( 'use_all_dates' );
+$use_all_dates = getPostValue ( 'use_all_dates', '' );
 if ( strtolower ( $use_all_dates ) != 'y' )
   $use_all_dates = '';
 
-$include_layers = getPostValue ( 'include_layers' );
+$include_layers = getPostValue ( 'include_layers', '' );
 if ( strtolower ( $include_layers ) != 'y' )
   $include_layers = '';
 
-$include_deleted = getPostValue ( 'include_deleted' );
+$include_deleted = getPostValue ( 'include_deleted', '' );
 if ( strtolower ( $include_deleted ) != 'y' )
   $include_deleted = '';
 
-$cat_filter = getPostValue ( 'cat_filter' );
+$cat_filter = getPostValue ( 'cat_filter', '' );
 if ( $cat_filter == 0 )
   $cat_filter = '';
 
@@ -247,11 +247,13 @@ function transmit_header( $mime, $file ) {
 $enddate = sprintf ( "%04d%02d%02d", $endyear, $endmonth, $endday );
 $moddate = sprintf ( "%04d%02d%02d", $modyear, $modmonth, $modday );
 
-mt_srand ( ( float ) microtime() * 1000000 );
+mt_srand(time());
 
 if ( empty ( $id ) )
   $id = 'all';
 
+load_global_settings(); // Need server URL
+
 $outputName = 'webcalendar-' . "$login-$id";
 if ( substr ( $format, 0, 4 ) == 'ical' ) {
   transmit_header ( 'text/calendar', $outputName . '.ics' );

includes/classes/WebCalendar.php

@@ -479,6 +479,10 @@ function _initValidate() {
     $SCRIPT, $session_not_found, $settings, $single_user, $single_user_login,
     $user_inc, $use_http_auth, $validate_redirect, $webcalendar_session;
 
+    // Give the PHP session a name unique to this install, allowing multiple WebCalendar installs
+    // on the same server.
+    $sessionName = 'WebCalendar-' . __DIR__;
+
     /* If WebCalendar is configured to use http authentication, then we can
      * use _initValidate(). If we are not using http auth, icalclient.php will
      * create its own http auth since an iCal client cannot login via a
@@ -553,6 +557,7 @@ function _initValidate() {
         if ( ! $login = user_logged_in() )
           $session_not_found = true;
       } else {
+        session_name(getSessionName());
         @session_start();
         if ( ! empty ( $_SESSION['webcal_login'] ) )
           $login = $_SESSION['webcal_login'];

includes/config.php

@@ -84,6 +84,15 @@ function die_miserable_death($error, $anchor = '')
   exit;
 }
 
+/**
+ * Give the PHP session a name unique to this install, allowing multiple WebCalendar installs
+ * on the same server.
+ */
+function getSessionName()
+{
+  return 'WebCalendar-' . __DIR__;
+}
+
 function db_error($doExit = false, $sql = '')
 {
   global $settings;

includes/functions.php

@@ -3951,6 +3951,37 @@ function isLeapYear(int $year = null): bool {
   return ($year % 4 == 0 && $year % 100 != 0) || $year % 400 == 0;
 }
 
+
+function getServerUrl($checkDatabase = true): string
+{
+  global $SERVER_URL, $HTTP_HOST, $REQUEST_URI;
+  $ret = null;
+
+  if (false&&$checkDatabase) {
+    $rows = dbi_get_cached_rows('SELECT cal_value FROM webcal_config WHERE cal_setting = ?', ['SERVER_URL']);
+    if (!empty($rows) && !empty($rows[0]) && !empty($rows[0][0])) {
+      $ret = $rows[0][0];
+    }
+  }
+  // Calculate it.
+  if (empty($ret))
+    $ret = determineServerUrl();
+  $ret = rtrim($ret, '/');
+  return $ret . '/';
+}
+
+function determineServerUrl(): string
+{
+  $protocol = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') ? 'https' : 'http';
+  $host = $_SERVER['HTTP_HOST'];
+  $port = $_SERVER['SERVER_PORT'];
+  $folder = dirname($_SERVER['SCRIPT_NAME']);
+  $url = $protocol . '://'. $host . '/';
+  if ($folder != '/')
+     $url .= $folder;
+  return $url;
+}
+
 /**
  * Loads default system settings (which can be updated via admin.php).
  *

includes/init.php

@@ -130,6 +130,13 @@ function send_http_headers () {
   // to restrict all content to one server, but it's blocking more than it should.
   //Header("Content-Security-Policy: default-src " . get_server_top_url() .
   //  "; img-src *; style-src *");
+
+  // Set charset to match what is defined in translation file's "charset" definition.
+  $charset = translate('charset');
+  if ($charset == '=') {
+    $charset = 'UTF-8'; // default
+  }
+  header('Content-Type: text/html; charset=' . $charset);
 }
 
 /**

includes/user-app-joomla.php

@@ -349,8 +349,7 @@ function user_logged_in () {
 
 // Redirect the user to the login-app.php page
 function app_login_screen( $return ) {
-  global $SERVER_URL;
-  header ( "Location: {$SERVER_URL}login-app.php?return_path={$return}");
+  header ( "Location: " . getServerUrl() . "login-app.php?return_path={$return}");
   exit;
 }
 

includes/xcal.php

@@ -92,7 +92,7 @@ function wc_export_fold_lines ( $string, $encoding = 'none', $limit = 76 ) {
       if ( strcmp( $encoding, 'quotedprintable' ) == 0 )
         $enc = export_quoted_printable_encode( $string[$i] );
       else if ( strcmp( $encoding, 'utf8' ) == 0 )
-        $enc = utf8_encode ( $string[$i] );
+        $enc = mb_convert_encoding($string[$i], 'UTF-8', mb_detect_encoding($string[$i]));
     }
     if ( $string[$i] == ':' )
       $start_encode = 1;
@@ -219,12 +219,15 @@ function export_get_attendee( $id, $export ) {
         // Use "Full Name <email>" if we have it,
         // Just "login" if that's all we have.
         $attendee[$count] .= ';CN="'
-         . ( empty( $user['cal_firstname'] ) && empty( $user['cal_lastname'] )
-           ? $user['cal_login']
-           : utf8_encode( $user['cal_firstname'] ) . ' '
-             . utf8_encode( $user['cal_lastname'] ) ) . '"'
-         . ':MAILTO:' . ( empty( $user['cal_email'] )
-           ? $EMAIL_FALLBACK_FROM : $user['cal_email'] );
+        . (empty($user['cal_firstname']) && empty($user['cal_lastname'])
+          ? $user['cal_login']
+          : mb_convert_encoding($user['cal_firstname'], 'UTF-8', mb_detect_encoding($user['cal_firstname'])) . ' '
+          . mb_convert_encoding($user['cal_lastname'], 'UTF-8', mb_detect_encoding($user['cal_lastname']))) . '"';
+        if (!empty($user['cal_email'])) {
+          $attendee[$count] .= ':MAILTO:' . $user['cal_email'];
+        } else if (strpos('@', $EMAIL_FALLBACK_FROM) > 0) {
+          $attendee[$count] .= ':MAILTO:' . $EMAIL_FALLBACK_FROM;
+        }
       }
       $count++;
     } //end if ( count ( $user ) > 0 )
@@ -739,15 +742,18 @@ function export_get_event_entry( $id = 'all', $attachment = false ) {
   return $res;
 } //end function export_get_event_entry($id)
 function generate_uid ( $id = '' ) {
-  global $login, $SERVER_URL;
+  global $login;
 
-  $uid = $SERVER_URL;
+  $uid = getServerUrl();
   if ( empty ( $uid ) )
     $uid = 'UNCONFIGURED-WEBCALENDAR';
-  $uid = str_replace ( 'http://', ' ', $uid );
+  $uid = str_replace ( 'http://', '', $uid );
+  $uid = str_replace ( 'https://', '', $uid );
+  $uid = str_replace ( ':', '-', $uid );
   $uid .= sprintf ( "-%s-%010d", $login, $id );
-  $uid = preg_replace ( "/[\s\/\.-]+/", '-', $uid );
+  $uid = preg_replace ( "/[\/-]+/", '-', $uid );
   $uid = strtoupper ( $uid );
+
   return $uid;
 }
 // Add entries in the webcal_import and webcal_import_data tables.
@@ -944,8 +950,12 @@ function export_ical ( $id = 'all', $attachment = false ) {
   // Always output something, even if no records come back
   // This prevents errors on the iCal client
   $ret = "BEGIN:VCALENDAR\r\n";
-  $title = utf8_encode ( 'X-WR-CALNAME;VALUE=TEXT:' .
-  ( empty ( $publish_fullname ) ? $login : translate ( $publish_fullname ) ) );
+  $title = mb_convert_encoding(
+    'X-WR-CALNAME;VALUE=TEXT:' .
+    (empty($publish_fullname) ? $login : translate($publish_fullname)),
+    'UTF-8',
+    mb_detect_encoding(empty($publish_fullname) ? $login : $publish_fullname)
+  );
   $title = str_replace ( ',', "\\,", $title );
   $ret .= "$title\r\n";
   $ret .= generate_prodid ( 'ics' );