Changeset 2073 in ExiteCMS

Timestamp:

11/26/08 22:20:46 (3 years ago)

Author:

root

Message:

implemented a new file upload module for the wiki, with upload notification via PM for additional security

Location:

modules/common/wiki/php-files/modules/wiki

Files:

• actions/footer.php (modified) (1 diff)
• handlers/page/upload.php (modified) (1 diff)
• module_installer.php (modified) (8 diffs)
• templates/modules.wiki.wiki_admin.tpl (modified) (3 diffs)
• wiki_admin.php (modified) (2 diffs)

modules/common/wiki/php-files/modules/wiki/actions/footer.php

@@ -8 +8 @@
 <?php 
     echo $this->HasAccess("write") ? "<a href=\"".$this->href("edit")."\" title=\"Click to edit this page\">Edit page</a> |\n" : "";
-    echo $this->HasAccess("write") ? "<a href=\"".$this->href("upload")."\" title=\"Click to upload new images\">Upload Image</a> |\n" : "";
+    echo $this->HasAccess("write") ? "<a href=\"".$this->href("upload")."\" title=\"Click to upload new files\">Upload File</a> |\n" : "";
     echo "<a href=\"".$this->href("history")."\" title=\"Click to view recent edits to this page\">Page History</a> |\n";
     echo $this->GetPageTime() ? "<a href=\"".$this->href("revisions")."\" title=\"Click to view recent revisions list for this page\">Revisions</a> |\n" : "";

modules/common/wiki/php-files/modules/wiki/handlers/page/upload.php

@@ -10 +10 @@
 | the included gpl.txt file or visit http://gnu.org  |
 +----------------------------------------------------*/
-global $db_prefix, $locale, $userdata, $imagetypes;
-
-if ($this->HasAccess("read")) {
-
-    // error handling
-    if (isset($_GET['status'])) {
-        $status = $_GET['status'];
-        switch ($status) {
-            case "upy":
-                $error = stripinput($GET['image'])." succesfully uploaded";
-                break;
-            case "upe":
-                $error = stripinput($GET['image'])." succesfully replaced";
-                break;
-            case "upn":
-                $error = "The file uploaded is not recognized as a valid image";
-                break;
-        }
-        if (isset($error)) {
-            print("<table align='center' cellpadding='0' cellspacing='0' width='100%'>
-            <tr>
-                <td class='tbl' align='center'>
-                    <br />
-                    <b>".$error."</b>
-                    <br /><br />
-                </td>
-            </tr>
-            </table>\n");
-        }
-    }
-
-    // parameter processing
-    $userid = isset($_GET['userid']) ? stripinput($_GET['userid']) : -1;
-    if (isset($_POST['uploadimage'])) {
-        $imgext = strrchr($_FILES['myfile']['name'], ".");
-        $imgname = $_FILES['myfile']['name'];
-        $imgsize = $_FILES['myfile']['size'];
-        $imgtemp = $_FILES['myfile']['tmp_name'];
-        // valid extension ?
+
+// globals used in PM function storemessage()
+global $db_prefix, $locale, $userdata, $imagetypes, $settings, $action, $attachments, $global_options, $totals, $random_id;
+
+// no upload allowed if no write access to the page!
+if (!$this->HasAccess("write")) {
+    redirect($this->Href());
+}
+
+// load the locale
+locale_load('modules.wiki');
+
+// error handling
+if (isset($_GET['status'])) {
+    $status = stripinput($_GET['status']);
+    $file = isset($_GET['file']) ? stripinput($_GET['file']) : "";
+    switch ($status) {
+        case "upy":
+            $error = $file." succesfully uploaded";
+            break;
+        case "upe":
+            $error = $file." succesfully replaced";
+            break;
+        case "upi":
+            $error = "The file uploaded has an illegal file type";
+            break;
+        case "upn":
+            $error = "The file uploaded is not recognized as a valid image";
+            break;
+        case "upx":
+            $error = "The file is not really uploaded. Hacking attempt logged!";
+            break;
+        default:
+            break;
+    }
+    if (isset($error)) {
+
+        // no we need to report this to the wiki admins?
+        if (!empty($settings['wiki_report_uploads'])) {
+        
+            // include the pm functions
+            include_once PATH_INCLUDES."pm_functions_include.php";
+
+            // create the PM message
+            $message = array();
+            $message['pm_subject'] = $locale['430'];
+            $message['pm_message'] = sprintf($locale['431'], $userdata['user_name'], $error);
+            $message['pm_size'] = strlen($message['pm_message']);
+            $message['pm_datestamp'] = time();
+            $message['pm_smileys'] = 1;
+            $message['recipients'] = array(-1 * $settings['wiki_report_uploads']);
+            $message['user_ids'] = array();
+
+            $group_id = $settings['wiki_report_uploads'];
+            if ($group_id == "101" || $group_id == "102" || $group_id == "103") {
+                // message to a user_level based group
+                $result = dbquery(
+                    "SELECT u.user_id, u.user_name, u.user_email, mo.pmconfig_email_notify FROM ".$db_prefix."users u
+                    LEFT JOIN ".$db_prefix."pm_config mo USING(user_id)
+                    WHERE user_status = '0' AND user_level >= '".$group_id."'"
+                );
+            } else {
+                // message to a user_groups based group
+                $groups = array();
+                // gather the group and it's sub-groups into an array
+                getgroupmembers($group_id);
+                $sql = "SELECT u.user_id, u.user_name, u.user_email, mo.pmconfig_email_notify FROM ".$db_prefix."users u 
+                        LEFT JOIN ".$db_prefix."pm_config mo USING(user_id)
+                        WHERE ";
+                $c = 0;
+                foreach ($groups as $group) {
+                    $sql .= ($c++==0?"":"OR ")."user_groups REGEXP('^\\\.{$group}$|\\\.{$group}\\\.|\\\.{$group}$') ";
+                }
+                $result = dbquery($sql);
+            }
+        }
+
+        // process the user information retrieved
+        while ($data = dbarray($result)) {
+            // make sure we don't already have this user (due to group membership)
+            if (!in_array($data['user_id'], $message['user_ids'])) {
+            // add it to the processed user_ids list
+                $message['user_ids'][] = $data;
+            }
+        }
+
+        // send the PM message
+        storemessage($message, false, true);
+        
+        print("<table align='center' cellpadding='0' cellspacing='0' width='100%'>
+        <tr>
+            <td class='tbl' align='center'>
+                <br />
+                <b>".$error."</b>
+                <br /><br />
+            </td>
+        </tr>
+        </table>\n");
+    }
+}
+// parameter processing
+$userid = isset($_GET['userid']) ? stripinput($_GET['userid']) : -1;
+if (isset($_POST['uploadfile']) && !empty($_FILES['myfile']['name'])) {
+    $imgext = strrchr($_FILES['myfile']['name'], ".");
+    $imgname = $_FILES['myfile']['name'];
+    $imgsize = $_FILES['myfile']['size'];
+    $imgtemp = $_FILES['myfile']['tmp_name'];
+
+    // check if this file has really been uploaded
+    if (is_uploaded_file($imgtemp)) {
+
+        // check if this file has a forbidden extension
+        if (in_array($imgext, explode(",", $settings['attachtypes']))) {
+            redirect($this->Href('upload')."&file=".stripinput($imgname)."&status=upi");
+        }
+
+        // check if the file is an image file
         if (in_array($imgext, $imagetypes)) {
-            // really an uploaded file?
-            if (is_uploaded_file($imgtemp)){
-                // really an image?
-                if (verify_image($imgtemp)){
-                    $imgname = PATH_IMAGES."wiki/".substr("000000".$userdata['user_id'], -6)."_".$imgname;
-                    $newfile = !file_exists($imgname);
-                    move_uploaded_file($imgtemp, $imgname);
-                    chmod($afolder.$imgname,0644);
-                    if ($newfile) {
-                        redirect($this->Href('upload')."&status=upy&image=".$_FILES['myfile']['name']);
-                    } else {
-                        redirect($this->Href('upload')."&status=upe");
-                    }
+            if (verify_image($imgtemp)){
+                $imgname = PATH_IMAGES."wiki/".substr("000000".$userdata['user_id'], -6)."_".$imgname;
+                $newfile = !file_exists($imgname);
+                move_uploaded_file($imgtemp, $imgname);
+                chmod($afolder.$imgname,0644);
+                if ($newfile) {
+                    redirect($this->Href('upload')."&file=".stripinput($imgname)."&status=upy");
                 } else {
-                    redirect($this->Href('upload')."&status=upn");
+                    redirect($this->Href('upload')."&file=".stripinput($imgname)."&status=upe");
                 }
-            }
-        } else {
-            redirect($this->Href('upload')."&status=upn");
-        }
-    }
-
-    if (isset($_GET['delete']) && $this->IsAdmin() && file_exists(PATH_IMAGES."wiki/".stripinput($_GET['delete']))) {
-        unlink (PATH_IMAGES."wiki/".stripinput($_GET['delete']));
-    }
-
-    // open the page body
-    print("<div class='page'>");
-
-    // get the list of uploaded images
-    $filelist = makefilelist(PATH_IMAGES.'wiki', ".|..");
-
-    // create a page
-    $upload_list = array();
-    $uploads = count($filelist);
-    $user = "";
+            } else {
+                redirect($this->Href('upload')."&file=".stripinput($imgname)."&status=upn");
+            }
+
+        } else {
+
+            $imgname = PATH_ROOT."files/wiki/".substr("000000".$userdata['user_id'], -6)."_".$imgname;
+            $newfile = !file_exists($imgname);
+            move_uploaded_file($imgtemp, $imgname);
+            chmod($afolder.$imgname,0644);
+            if ($newfile) {
+                redirect($this->Href('upload')."&file=".stripinput($imgname)."&status=upy");
+            } else {
+                redirect($this->Href('upload')."&file=".stripinput($imgname)."&status=upe");
+            }
+
+        }
+
+    } else {
+        redirect($this->Href('upload')."&file=".stripinput($imgname)."&status=upx");
+    }
+        
+}
+
+if (isset($_GET['delete']) && isset($_GET['type']) && $this->IsAdmin()) {
+    switch (stripinput($_GET['type'])) {
+        case "F":
+            unlink (PATH_ROOT."files/wiki/".stripinput($_GET['delete']));
+            break;
+        case "I":
+            unlink (PATH_IMAGES."wiki/".stripinput($_GET['delete']));
+            break;
+        default:
+    }
+}
+
+// get the list of uploaded images and files
+$filelist = array_flip(makefilelist(PATH_IMAGES.'wiki', ".|.."));
+foreach($filelist as $key => $value) {
+    $filelist[$key] = "I";
+}
+$filelist = array_merge($filelist, array_flip(makefilelist(PATH_ROOT.'files/wiki', ".|..")));
+foreach($filelist as $key => $value) {
+    if (isNum($value)) $filelist[$key] = "F";
+}
+ksort($filelist);
+        
+// create a page
+$upload_list = array();
+$uploads = count($imagelist) + count($filelist);
+$user = "";
     
-    // display the uploaded files in a foldable list
-    print("<table align='center' cellpadding='0' cellspacing='0' width='100%'>
-    <tr>
-        <td class='tbl2' style='white-space:nowrap;'>
-            Uploaded by
+// open the page body
+print("<div class='page'>");
+
+// display the uploaded files in a foldable list
+print("<table align='center' cellpadding='0' cellspacing='0' width='100%'>
+<tr>
+    <td class='tbl2' style='white-space:nowrap;'>
+        Uploaded by
+    </td>
+    <td align='right' class='tbl2'>
+        Options
+    </td>
+</tr>
+<tr>
+    <td colspan='2' height='1'>
+    </td>
+</tr>\n");
+
+$first = true;
+foreach ($filelist as $file => $filetype) {
+    $s = explode("_", $file);
+    $usr = count($s) > 1 ? (int) $s[0] : 0;
+    if ($usr != $user) {
+        $user = $usr;
+        if ($usr == 0) {
+            $username = $locale['user2'];;
+        } else {
+            $result = dbquery("SELECT user_name FROM ".$db_prefix."users WHERE user_id = '$usr'");
+            if ($data = dbarray($result)) {
+                $username = $data['user_name'];
+            }
+        }
+        // close the previous block?
+        if (!$first) {
+            print ("</table>
+                </div>
+            </td>
+        </tr>\n");
+        } else {
+            $first = false;
+        }
+        // new user
+        print ("<tr>
+        <td class='tbl2'>
+            <img src='".THEME."images/bullet.gif' alt='' />&nbsp;
+            <a href='".BASEDIR."profile.php?lookup=$usr'>$username</a>
         </td>
-        <td align='right' class='tbl2'>
-            Options
+        <td class='tbl2' align='right'>
+            <img onclick=\"javascript:flipBox('dl_$usr')\" src='".THEME."images/panel_".($userid == $usr ? "off" : "on").".gif' name='b_dl_$usr' alt='' />
         </td>
     </tr>
     <tr>
-        <td colspan='2' height='1'>
-        </td>
-    </tr>\n");
-
-    $first = true;
-    foreach ($filelist as $file) {
-        $s = explode("_", $file);
-        $usr = count($s) > 1 ? (int) $s[0] : 0;
-        if ($usr != $user) {
-            $user = $usr;
-            if ($usr == 0) {
-                $username = $locale['user2'];;
-            } else {
-                $result = dbquery("SELECT user_name FROM ".$db_prefix."users WHERE user_id = '$usr'");
-                if ($data = dbarray($result)) {
-                    $username = $data['user_name'];
-                }
-            }
-            // close the previous block?
-            if (!$first) {
-                print ("</table>
-                    </div>
+        <td colspan='2'>
+            <div id='box_dl_$usr' style='".($userid == $usr ? "" : "display:none")."'>
+                <table cellpadding='0' cellspacing='0' width='100%'>\n");
+    }
+    if ($filetype == "I") {
+        $imagesize = @getimagesize(PATH_IMAGES."wiki/".$file);
+        $filetime = date("Y-m-d H:i", filemtime(PATH_IMAGES."wiki/".$file));
+    } else {
+        $imagesize = "";
+        $filetime = date("Y-m-d H:i", filemtime(PATH_ROOT."files/wiki/".$file));
+    }
+    print ("<tr>
+                <td class='tbl'>
+                    $file
                 </td>
+                <td class='tbl' width='1%' style='white-space:nowrap'>
+                    ".$filetime."
+                </td>
+                <td class='tbl' width='1%' style='white-space:nowrap'>
+                    ".(is_array($imagesize) ? ($imagesize[0]."x".$imagesize[1]) : "")."
+                </td>
+                <td align='right' width='1%' class='tbl' style='white-space:nowrap'>");
+    print ("
+                    <a href='".$this->Href('upload')."&amp;userid=$usr&amp;view=$file&amp;type=$filetype'><img src='".THEME."images/image_view.gif' alt='View' title='View' /></a>&nbsp;");
+    if ($this->IsAdmin()) {
+        if ($filetype == "I") {
+            print ("<a href='".$this->Href('upload')."&amp;userid=$usr&amp;delete=$file&amp;type=I' onclick='return DeleteItem()'><img src='".THEME."images/picture_delete.gif' alt='Delete' title='Delete Image' /></a>");
+        } else {
+            print ("<a href='".$this->Href('upload')."&amp;userid=$usr&amp;delete=$file&amp;type=F' onclick='return DeleteItem()'><img src='".THEME."images/page_delete.gif' alt='Delete' title='Delete File' /></a>");
+        }
+        print ("</td>
             </tr>\n");
-            } else {
-                $first = false;
-            }
-            // new user
+    }
+    if (isset($_GET['view']) && stripinput($_GET['view']) == $file) {
+        if (stripinput($_GET['type']) == "I") {
             print ("<tr>
-            <td class='tbl2'>
-                <img src='".THEME."images/bullet.gif' alt='' />&nbsp;
-                <a href='".BASEDIR."profile.php?lookup=$usr'>$username</a>
-            </td>
-            <td class='tbl2' align='right'>
-                <img onclick=\"javascript:flipBox('dl_$usr')\" src='".THEME."images/panel_".($userid == $usr ? "off" : "on").".gif' name='b_dl_$usr' alt='' />
-            </td>
-        </tr>
-        <tr>
-            <td colspan='2'>
-                <div id='box_dl_$usr' style='".($userid == $usr ? "" : "display:none")."'>
-                    <table cellpadding='0' cellspacing='0' width='100%'>\n");
-        }
-        $imagesize = @getimagesize(PATH_IMAGES."wiki/".$file);
-        print ("<tr>
-                    <td class='tbl'>
-                        $file
-                    </td>
-                    <td class='tbl' width='1%' style='white-space:nowrap'>
-                        ".date("Y-m-d H:i", filemtime(PATH_IMAGES."wiki/".$file))."
-                    </td>
-                    <td class='tbl' width='1%' style='white-space:nowrap'>
-                        ".(is_array($imagesize) ? ($imagesize[0]."x".$imagesize[1]) : "")."
-                    </td>
-                    <td align='right' width='1%' class='tbl' style='white-space:nowrap'>
-                        <a href='".$this->Href('upload')."&amp;userid=$usr&amp;view=$file'><img src='".THEME."images/image_view.gif' alt='View' title='View' /></a>&nbsp;");
-        if ($this->IsAdmin()) {
-            print ("<a href='".$this->Href('upload')."&amp;userid=$usr&amp;delete=$file' onclick='return DeleteItem()'><img src='".THEME."images/image_delete.gif' alt='Delete' title='Delete' /></a>
+                    <td class='tbl2' colspan='4' align='center'>
+                        <img src='".IMAGES."wiki/$file' alt='$file' />
                     </td>
                 </tr>\n");
-        }
-        if (isset($_GET['view']) && stripinput($_GET['view']) == $file) {
             print ("<tr>
-                        <td class='tbl2' colspan='4' align='center'>
-                            <img src='".IMAGES."wiki/$file' alt='$file' />
-                        </td>
-                    </tr>\n");
+                    <td class='tbl2' colspan='4' align='center'>
+                        <div style='vertical-align:middle;display:table-cell;padding:4px;'>
+                            <b>Copy to Wiki</b>:<br /> {{image class=\"center\" alt=\"$file\" title=\" description here \" url=\"$file\"}}
+                        </div>
+                    </td>
+                </tr>\n");
+        } else {
             print ("<tr>
-                        <td class='tbl2' colspan='4' align='center'>
-                            <div style='vertical-align:middle;display:table-cell;padding:4px;'>
-                                <b>Copy to Wiki</b>:<br /> {{image class=\"center\" alt=\"$file\" title=\" description here \" url=\"$file\"}}
-                            </div>
-                        </td>
-                    </tr>\n");
-        }
-
-    }
-    // need to close the last block?
-    if (!$first) {
-        print ("</table>
-            </div>
+                    <td class='tbl2' colspan='4' align='center'>
+                        <div style='vertical-align:middle;display:table-cell;padding:4px;'>
+                            <b>Copy to Wiki</b>:<br /> [[".$settings['siteurl']."files/wiki/$file ".substr($file,7)."]]
+                        </div>
+                    </td>
+                </tr>\n");
+        }
+    }
+}
+// need to close the last block?
+if (!$first) {
+    print ("</table>
+        </div>
+    </td>
+</tr>\n");
+}
+print ("</table>
+<script type='text/javascript'>
+function DeleteItem()
+{
+return confirm('Delete uploaded file?');
+}
+</script>");
+
+// file path notice
+print("<br /><div style='text-align:center;' class='small'>To prevent abuse, the wiki administrator(s) will be notified about every file uploaded</div>");
+
+// seperator
+print("<hr /><br />");
+
+// upload form
+print("<form name='uploadform' method='post' action='".$this->Href('upload')."' enctype='multipart/form-data'>
+<table align='center' cellpadding='0' cellspacing='0' width='100%'>
+    <tr>
+        <td align='center' class='tbl'>
+            New Wiki File: <input type='file' name='myfile' class='textbox' style='width:250px;' />
         </td>
-    </tr>\n");
-    }
-    print ("</table>
-    <script type='text/javascript'>
-    function DeleteItem()
-    {
-    return confirm('Delete uploaded image?');
-    }
-    </script>");
-
-    // seperator
-    print("<br /><hr /><br />");
-
-    // upload form
-    print("<form name='uploadform' method='post' action='".$this->Href('upload')."' enctype='multipart/form-data'>
-    <table align='center' cellpadding='0' cellspacing='0' width='100%'>
-        <tr>
-            <td align='center' class='tbl'>
-                New Wiki Image: <input type='file' name='myfile' class='textbox' style='width:250px;' />
-            </td>
-        </tr>
-        <tr>
-            <td align='center' class='tbl'>
-                <input type='submit' name='uploadimage' value='Upload' class='button' />
-            </td>
-        </tr>
-    </table>
-    </form>");
-
-    // close the page body
-    print("</div>");
-}
+    </tr>
+    <tr>
+        <td align='center' class='tbl'>
+            <input type='submit' name='uploadfile' value='Upload' class='button' />
+        </td>
+    </tr>
+</table>
+</form>");
+
+// close the page body
+print("</div>");
 ?>

modules/common/wiki/php-files/modules/wiki/module_installer.php

@@ -23 +23 @@
 +----------------------------------------------------*/
 $mod_title = "Wikka Wiki";                              // title or name of this module
-$mod_description = "ExiteCMS embedded implementation of Wikka Wakka Wiki v1.1.6.3"; // short description of it's purpose
-$mod_version = "1.1.6";                                 // module version number
+$mod_description = "ExiteCMS embedded implementation of Wikka Wakka Wiki v1.1.6.4"; // short description of it's purpose
+$mod_version = "1.1.9";                                 // module version number
 $mod_developer = "WanWizard";                           // author's name
 $mod_email = "wanwizard@exitecms.org";
@@ -110 +110 @@
 $localestrings['en']['426'] = "Page owner:";
 $localestrings['en']['427'] = "You don't have the rights to view this wiki page.";
+$localestrings['en']['428'] = "Send file upload notifications to:";
+$localestrings['en']['429'] = "No one";
+$localestrings['en']['430'] = "Wiki Upload notification";
+$localestrings['en']['431'] = "Wiki upload by: %s\n\nStatus message is: %s";
 
 $localestrings['nl'] = array();
@@ -139 +143 @@
 $localestrings['nl']['426'] = "Pagina eigenaar:";
 $localestrings['nl']['427'] = "U hebt geen rechten op deze wiki pagina te bekijken.";
+$localestrings['nl']['428'] = "Stuur een notificatie van bestandsuploads naar:";
+$localestrings['nl']['429'] = "Niemand";
+$localestrings['nl']['430'] = "Wiki upload notificatie";
+$localestrings['nl']['431'] = "Wiki upload door: %s\n\nStatus bericht is: %s";
 
 /*---------------------------------------------------+
@@ -309 +317 @@
 $mod_uninstall_cmds[] = array('type' => 'db', 'value' => "DELETE FROM ##PREFIX##configuration WHERE cfg_name = 'wiki_forum_links'");
 $mod_uninstall_cmds[] = array('type' => 'db', 'value' => "DELETE FROM ##PREFIX##configuration WHERE cfg_name = 'wiki_page_template'");
+$mod_uninstall_cmds[] = array('type' => 'db', 'value' => "DELETE FROM ##PREFIX##configuration WHERE cfg_name = 'wiki_report_uploads'");
 
 // delete the user groups
@@ -339 +348 @@
         if (!is_dir(PATH_IMAGES."wiki")) {
             @mkdir(PATH_IMAGES."wiki");
+        }
+        // create the wiki file directory
+        if (!is_dir(PATH_ROOT."files/wiki")) {
+            @mkdir(PATH_ROOT."files/wiki");
         }
     }
@@ -357 +370 @@
         $result = dbquery("INSERT INTO ".$db_prefix."configuration( cfg_name, cfg_value ) VALUES ('wiki_external_link_new_window', '1')");
         $result = dbquery("INSERT INTO ".$db_prefix."configuration( cfg_name, cfg_value ) VALUES ('wiki_default_read_acl', 'G0');");
+        $result = dbquery("INSERT INTO ".$db_prefix."configuration( cfg_name, cfg_value ) VALUES ('wiki_report_uploads', '103');");
         // get the group_id of the Wiki Editors group
         $result = dbquery("SELECT * FROM ".$db_prefix."user_groups WHERE group_ident = '".$mod_admin_rights."01'");
@@ -379 +393 @@
         $result = dbquery("INSERT INTO ".$db_prefix."configuration( cfg_name, cfg_value ) VALUES ('wiki_forum_links', '0')");
         $result = dbquery("INSERT INTO ".$db_prefix."configuration( cfg_name, cfg_value ) VALUES ('wiki_page_template', '')");
+        $result = dbquery("INSERT INTO ".$db_prefix."configuration( cfg_name, cfg_value ) VALUES ('wiki_report_uploads', '103');");
     }
 }
@@ -472 +487 @@
                 $result = dbquery("CREATE TABLE ".$db_prefix."wiki_aliases (from_tag varchar(75) NOT NULL default '', to_tag varchar(75) NOT NULL default '', UNIQUE KEY from_tag (from_tag,to_tag), KEY idx_from (from_tag), KEY idx_to (to_tag)) ENGINE=MyISAM;");
 
-            case "1.1.5":
+            case "1.1.6":
+                // no specific changes between this version and the new one
+
+            case "1.1.7":
+                // new configuration item for the wiki file upload reports
+                $result = dbquery("INSERT INTO ".$db_prefix."configuration( cfg_name, cfg_value ) VALUES ('wiki_report_uploads', '103')");
+
+            case "1.1.8":
+                // added upload notifications
+
+            case "1.1.9":
                 // current version
 
             default:
+                // create the wiki image directory
+                if (!is_dir(PATH_IMAGES."wiki")) {
+                    @mkdir(PATH_IMAGES."wiki");
+                }
+                // create the wiki file directory
+                if (!is_dir(PATH_ROOT."files/wiki")) {
+                    @mkdir(PATH_ROOT."files/wiki");
+                }
                 // commands to execute for every upgrade
         }

modules/common/wiki/php-files/modules/wiki/templates/modules.wiki.wiki_admin.tpl

@@ -43 +43 @@
             <td class='tbl' width='50%'>
                 <select name='admin_group' class='textbox'>
-                {section name=id loop=$usergroups}
-                    <option value='{$usergroups[id].0}'{if $usergroups[id].0 == $settings2.wiki_admin_group} selected="selected"{/if}>{$usergroups[id].1}</option>
+                {section name=id loop=$wikigroups}
+                    <option value='{$wikigroups[id].0}'{if $wikigroups[id].0 == $settings2.wiki_admin_group} selected="selected"{/if}>{$wikigroups[id].1}</option>
                 {/section}
                 </select>
@@ -90 +90 @@
             <td class='tbl' width='50%'>
                 <select name='default_read_acl' class='textbox'>
-                {section name=id loop=$usergroups}
-                    <option value='{$usergroups[id].0}'{if $usergroups[id].0 == $settings2.wiki_default_read_acl} selected="selected"{/if}>{$usergroups[id].1}</option>
+                {section name=id loop=$wikigroups}
+                    <option value='{$wikigroups[id].0}'{if $wikigroups[id].0 == $settings2.wiki_default_read_acl} selected="selected"{/if}>{$wikigroups[id].1}</option>
                 {/section}
                 </select>
@@ -168 +168 @@
         </tr>
         <tr>
+            <td class='tbl' width='50%'>
+                {$locale.428}
+            </td>
+            <td class='tbl' width='50%'>
+                <select name='report_uploads' class='textbox'>
+                <option value=''{if "" == $settings2.wiki_report_uploads} selected="selected"{/if}>{$locale.429}</option>
+                {section name=id loop=$usergroups}
+                    {if $usergroups[id].0 != 0 && $usergroups[id].0 != 100 && $usergroups[id].0 != 101}
+                        <option value='{$usergroups[id].0}'{if $usergroups[id].0 == $settings2.wiki_report_uploads} selected="selected"{/if}>{$usergroups[id].1}</option>
+                    {/if}
+                {/section}
+                </select>
+            </td>
+        </tr>
+        <tr>
             <td align='center' colspan='2' class='tbl'>
                 <br />

modules/common/wiki/php-files/modules/wiki/wiki_admin.php

@@ -45 +45 @@
     $result = dbquery("UPDATE ".$db_prefix."configuration SET cfg_value = '".stripinput($_POST['forum_links'])."' WHERE cfg_name = 'wiki_forum_links'");
     $result = dbquery("UPDATE ".$db_prefix."configuration SET cfg_value = '".stripinput($_POST['page_template'])."' WHERE cfg_name = 'wiki_page_template'");
+    $result = dbquery("UPDATE ".$db_prefix."configuration SET cfg_value = '".stripinput($_POST['report_uploads'])."' WHERE cfg_name = 'wiki_report_uploads'");
     // if the name of the homepage has changed, update the wiki record
     if ($settings['wiki_root_page'] != stripinput($_POST['root_page'])) {
@@ -65 +66 @@
 $groups = getusergroups();
 $variables['usergroups'] = array();
+$variables['wikigroups'] = array();
 foreach ($groups as $group) {
-    $group[0] = "G".$group[0];
     $variables['usergroups'][] = $group;
+    $group[0] = "G" . $group[0];
+    $variables['wikigroups'][] = $group;
 }