17 files changed, 235 insertions, 128 deletions

diff --git a/LibertyAttachable.php b/LibertyAttachable.php
index cf8daa2..8bcb8b7 100644
--- a/LibertyAttachable.php
+++ b/LibertyAttachable.php
@@ -3,7 +3,7 @@
  * Management of Liberty Content
  *
  * @package  liberty
- * @version  $Header: /cvsroot/bitweaver/_bit_liberty/LibertyAttachable.php,v 1.9 2005/12/18 22:30:20 squareing Exp $
+ * @version  $Header: /cvsroot/bitweaver/_bit_liberty/LibertyAttachable.php,v 1.10 2005/12/26 12:25:03 squareing Exp $
  * @author   spider <spider@steelsun.com>
  */
 // +----------------------------------------------------------------------+
@@ -144,14 +144,14 @@ class LibertyAttachable extends LibertyContent {
 
 	function verify( &$pParamHash ) {
 		global $gBitSystem, $gBitUser;
-		if( !empty( $pParamHash['attachment_id'] ) && !is_numeric( $pParamHash['attachment_id'] ) ) {
+		if( @$this->verifyId( $pParamHash['attachment_id'] ) ) {
 			$this->mErrors['file'] = 'System Error: Non-numeric storage_id.';
 		}
 
 		if( empty( $pParamHash['user_id'] ) ) {
 			// storage is always owned by the user that uploaded it!
 			// er... or at least admin if somehow we have a NULL mUserId - anon uploads maybe?
-			$pParamHash['user_id'] = is_numeric( $gBitUser->mUserId ) ? $gBitUser->mUserId : ROOT_USER_ID;
+			$pParamHash['user_id'] = @$this->verifyId( $gBitUser->mUserId ) ? $gBitUser->mUserId : ROOT_USER_ID;
 		}
 		if( empty( $pParamHash['process_storage'] ) ) {
 			$pParamHash['process_storage'] = NULL;
@@ -265,13 +265,13 @@ Disable for now - instead fend off new uploads once quota is exceeded. Need a ni
 		}
 		$this->mDb->CompleteTrans();
 
-		if( !empty( $pParamHash['existing_attachment_id'] ) ) {
-			foreach($pParamHash['existing_attachment_id'] as $existingAttachmentId) {
+		if( @$this->verifyId( $pParamHash['existing_attachment_id'] ) ) {
+			foreach( $pParamHash['existing_attachment_id'] as $existingAttachmentId ) {
 				// allow for multiple values seperated by any non numeric character
 				$ids = preg_split( '/\D/', $existingAttachmentId );
 				foreach( $ids as $id ) {
 					$id = ( int )$id;
-					if( !empty( $id ) ) {
+					if( @$this->verifyId( $id ) ) {
 						$this->cloneAttachment( $id, $pParamHash['content_id'] );
 					}
 				}
@@ -289,7 +289,7 @@ Disable for now - instead fend off new uploads once quota is exceeded. Need a ni
 		$rs = $this->mDb->query($sql, array( $pAttachmentId ));
 		$tmpAttachment = $rs->fields;
 
-		if ( !empty($tmpAttachment['attachment_id']) ) {
+		if ( @$this->verifyId($tmpAttachment['attachment_id']) ) {
 			$newAttachmentId = $this->mDb->GenID( 'tiki_attachments_id_seq' );
 			$sql = "INSERT INTO `".BIT_DB_PREFIX."tiki_attachments` ( `attachment_id`, `attachment_plugin_guid`, `content_id`, `foreign_id`, `user_id` ) VALUES ( ?, ?, ?, ?, ? )";
 			$rs = $this->mDb->query( $sql, array( $newAttachmentId, $tmpAttachment['attachment_plugin_guid'], $pNewContentId, $tmpAttachment['foreign_id'], $gBitUser->mUserId ) );
@@ -311,7 +311,7 @@ Disable for now - instead fend off new uploads once quota is exceeded. Need a ni
 		global $gBitUser;
 		$ret = NULL;
 
-		if( is_numeric( $pAttachmentId ) ) {
+		if( @$this->verifyId( $pAttachmentId ) ) {
 			$sql = "SELECT `attachment_plugin_guid`, `user_id` FROM `".BIT_DB_PREFIX."tiki_attachments` WHERE `attachment_id`=?";
 			$rs = $this->mDb->query( $sql, array( $pAttachmentId ) );
 			$guid = $rs->fields['attachment_plugin_guid'];
@@ -341,9 +341,9 @@ Disable for now - instead fend off new uploads once quota is exceeded. Need a ni
 	}
 
 	function detachAttachment( $pAttachmentId ) {
-		if (is_numeric($pAttachmentId)) {
+		if( @$this->verifyId( $pAttachmentId ) ) {
 			$attachmentInfo = $this->getAttachment($pAttachmentId);
-			if (!empty($attachmentInfo['user_id'])) {
+			if (@$this->verifyId($attachmentInfo['user_id'] ) ) {
 				$attachmentOwner = new BitUser($attachmentInfo['user_id']);
 				$attachmentOwner->load();
 				if ($attachmentOwner->mContentId) {
@@ -363,9 +363,9 @@ Disable for now - instead fend off new uploads once quota is exceeded. Need a ni
 	function load( $pContentId=NULL ) {
 		// assume a derived class has joined on the tiki_content table, and loaded it's columns already.
 		global $gLibertySystem;
-		$conId = ( isset( $pContentId ) && is_numeric( $pContentId ) ? $pContentId : $this->mContentId );
+		$conId = ( @$this->verifyId( $pContentId ) ? $pContentId : $this->mContentId );
 
-		if( !empty( $conId ) ) {
+		if( @$this->verifyId( $conId ) ) {
 			LibertyContent::load($pContentId);
 			$query = "SELECT * FROM `".BIT_DB_PREFIX."tiki_attachments` ta
 					  WHERE ta.`content_id`=?";
@@ -391,7 +391,7 @@ Disable for now - instead fend off new uploads once quota is exceeded. Need a ni
 		global $gLibertySystem;
 		$ret = NULL;
 
-		if( is_numeric( $pAttachmentId ) ) {
+		if( @$this->verifyId( $pAttachmentId ) ) {
 			$query = "SELECT * FROM `".BIT_DB_PREFIX."tiki_attachments` ta
 					  WHERE ta.`attachment_id`=?";
 			if( $result = $this->mDb->query($query,array((int) $pAttachmentId)) ) {
@@ -413,9 +413,9 @@ Disable for now - instead fend off new uploads once quota is exceeded. Need a ni
 
 		$attachmentInfo = $this->getAttachment( $pAttachmentId );
 
-		if (!empty($attachmentInfo['attachment_id']) && !empty($attachmentInfo['foreign_id']) && !empty($attachmentInfo['attachment_plugin_guid']) ) {
+		if( @$this->verifyId( $attachmentInfo['attachment_id'] ) && @$this->verifyId( $attachmentInfo['foreign_id'] ) && @$this->verifyId( $attachmentInfo['attachment_plugin_guid'] ) ) {
 			$query = "SELECT  * FROM `".BIT_DB_PREFIX."tiki_attachments` WHERE `foreign_id` = ? AND `attachment_plugin_guid` = ? AND `attachment_id` <> ?";
-			$result = $this->mDb->query($query, array($attachmentInfo['foreign_id'], $attachmentInfo['attachment_plugin_guid'], $attachment['attachment_id']));
+			$result = $this->mDb->query( $query, array ($attachmentInfo['foreign_id'], $attachmentInfo['attachment_plugin_guid'], $attachment['attachment_id'] ) );
 			$ret = $result->getRows();
 		}
 
@@ -619,7 +619,7 @@ function liberty_gd_resize_image( &$pFileHash, $pFormat = NULL ) {
 	list($iwidth, $iheight, $itype, $iattr) = @getimagesize( $pFileHash['source_file'] );
 	list($type, $ext) = split( '/', strtolower( $pFileHash['type'] ) );
 	$destUrl = $pFileHash['dest_path'].$pFileHash['dest_base_name'];
-	if( (empty( $pFileHash['max_width'] ) || empty( $pFileHash['max_height'] )) || ($iwidth <= $pFileHash['max_width'] && $iheight <= $pFileHash['max_height'] && ( $ext == 'gif' || $ext == 'png'  || $ext == 'jpg'   || $ext == 'jpeg' ) ) ) {
+	if( ( empty( $pFileHash['max_width'] ) || empty( $pFileHash['max_height'] ) ) || ( $iwidth <= $pFileHash['max_width'] && $iheight <= $pFileHash['max_height'] && ( $ext == 'gif' || $ext == 'png'  || $ext == 'jpg'   || $ext == 'jpeg' ) ) ) {
 		// Keep the same dimensions as input file
 		$pFileHash['max_width'] = $iwidth;
 		$pFileHash['max_height'] = $iheight;
diff --git a/LibertyComment.php b/LibertyComment.php
index 4ddd151..71eb08a 100644
--- a/LibertyComment.php
+++ b/LibertyComment.php
@@ -3,7 +3,7 @@
  * Management of Liberty Content
  *
  * @package  liberty
- * @version  $Header: /cvsroot/bitweaver/_bit_liberty/LibertyComment.php,v 1.6 2005/11/22 07:27:18 squareing Exp $
+ * @version  $Header: /cvsroot/bitweaver/_bit_liberty/LibertyComment.php,v 1.7 2005/12/26 12:25:03 squareing Exp $
  * @author   spider <spider@steelsun.com>
  */
 
@@ -147,7 +147,7 @@ class LibertyComment extends LibertyContent {
 			$pMixed = &$this->mInfo;
 		}
 		$ret = NULL;
-		if( !empty( $pMixed['parent_id'] ) && $viewContent = LibertyBase::getLibertyObject( $pMixed['parent_id'] ) ) {
+		if( @$this->verifyId( $pMixed['parent_id'] ) && $viewContent = LibertyBase::getLibertyObject( $pMixed['parent_id'] ) ) {
 			$ret = $viewContent->getDisplayUrl();
 		}
 		return( $ret );
@@ -171,7 +171,7 @@ class LibertyComment extends LibertyContent {
 			$mid .= " AND tc.`content_type_guid`=? ";
 			$bindVars[] = $pParamHash['content_type_guid'];
 		}
-		if ( !empty( $pParamHash['user_id'] ) ) {
+		if ( @$this->verifyId( $pParamHash['user_id'] ) ) {
 			$mid .= " AND tc.`user_id`=? ";
 			$bindVars[] = $pParamHash['user_id'];
 		}
@@ -202,7 +202,7 @@ class LibertyComment extends LibertyContent {
 			$rows = $this->mDb->getAssoc($sql, array($contentId));
 			$commentCount += count($rows);
 			foreach ($rows as $row) {
-				if( !empty( $row['child_content_id'] ) ) {
+				if( @$this->verifyId( $row['child_content_id'] ) ) {
 					$commentCount += $this->getNumComments( $row['child_content_id'] );
 				}
 			}
diff --git a/LibertyContent.php b/LibertyContent.php
index 6bc4a8e..1a8f267 100644
--- a/LibertyContent.php
+++ b/LibertyContent.php
@@ -3,7 +3,7 @@
 * Management of Liberty content
 *
 * @package  liberty
-* @version  $Header: /cvsroot/bitweaver/_bit_liberty/LibertyContent.php,v 1.12 2005/12/18 22:30:21 squareing Exp $
+* @version  $Header: /cvsroot/bitweaver/_bit_liberty/LibertyContent.php,v 1.13 2005/12/26 12:25:03 squareing Exp $
 * @author   spider <spider@steelsun.com>
 */
 
@@ -138,8 +138,8 @@ class LibertyContent extends LibertyBase {
 			$pParamHash['user_id'] = $gBitUser->getUserId();
 		}
 
-		if( empty( $pParamHash['content_id'] ) ) {
-			if( empty( $this->mContentId ) ) {
+		if( !@$this->verifyId( $pParamHash['content_id'] ) ) {
+			if( !@$this->verifyId( $this->mContentId ) ) {
 				// These should never be updated, only inserted
 				$pParamHash['content_store']['created'] = !empty( $pParamHash['created'] ) ? $pParamHash['created'] : $gBitSystem->getUTCTime();
 				$pParamHash['content_store']['user_id'] = $pParamHash['user_id'];
@@ -180,7 +180,7 @@ class LibertyContent extends LibertyBase {
 		}
 		$pParamHash['content_store']['ip'] = $pParamHash['ip'];
 
-		if( empty( $pParamHash['modifier_user_id'] ) ) {
+		if( !@$this->verifyId( $pParamHash['modifier_user_id'] ) ) {
 			global $gBitUser;
 			$pParamHash['modifier_user_id'] = $gBitUser->getUserId();
 		}
@@ -223,7 +223,7 @@ class LibertyContent extends LibertyBase {
 		if( LibertyContent::verify( $pParamHash ) ) {
 			$this->mDb->StartTrans();
 			$table = BIT_DB_PREFIX."tiki_content";
-			if( empty( $pParamHash['content_id'] ) ) {
+			if( !@$this->verifyId( $pParamHash['content_id'] ) ) {
 				$pParamHash['content_store']['content_id'] = $this->mDb->GenID( 'tiki_content_id_seq' );
 				$pParamHash['content_id'] = $pParamHash['content_store']['content_id'];
 				// make sure some variables are stuff in case services need getObjectType, mContentId, etc...
@@ -321,7 +321,7 @@ class LibertyContent extends LibertyBase {
 	 * Check mContentId to establish if the object has been loaded with a valid record
 	 */
 	function isValid() {
-		return( !empty( $this->mContentId ) && is_numeric( $this->mContentId ) && $this->mContentId );
+		return( $this->verifyId( $this->mContentId ) );
 	}
 
 	/**
@@ -329,7 +329,7 @@ class LibertyContent extends LibertyBase {
 	 */
 	function isOwner() {
 		global $gBitUser;
-		return( $this->isValid() && !empty( $this->mInfo['user_id'] ) && $this->mInfo['user_id'] == $gBitUser->mUserId );
+		return( $this->isValid() && @$this->verifyId( $this->mInfo['user_id'] ) && $this->mInfo['user_id'] == $gBitUser->mUserId );
 	}
 
 
@@ -467,7 +467,7 @@ class LibertyContent extends LibertyBase {
 	 * @return bool true ( will not currently report a failure )
 	 */
 	function storePermission( $pGroupId, $perm_name, $object_id=NULL ) {
-		if( empty( $object_id ) ) {
+		if( !@$this->verifyId( $object_id ) ) {
 			$object_id = $this->mContentId;
 		}
 		//$object_id = md5($object_type . $object_id);
@@ -815,7 +815,7 @@ class LibertyContent extends LibertyBase {
 			$bindVars[] = $pListHash['stop'];
 		}
 
-		if( !empty( $pListHash['user_id'] ) ) {
+		if( @$this->verifyId( $pListHash['user_id'] ) ) {
 			$mid .= " AND tc.`user_id` = ? ";
 			$bindVars[] = $pListHash['user_id'];
 		}
diff --git a/LibertyStructure.php b/LibertyStructure.php
index ea850f5..496635f 100755
--- a/LibertyStructure.php
+++ b/LibertyStructure.php
@@ -3,7 +3,7 @@
  * Management of Liberty Content
  *
  * @package  liberty
- * @version  $Header: /cvsroot/bitweaver/_bit_liberty/LibertyStructure.php,v 1.10 2005/12/18 22:30:21 squareing Exp $
+ * @version  $Header: /cvsroot/bitweaver/_bit_liberty/LibertyStructure.php,v 1.11 2005/12/26 12:25:03 squareing Exp $
  * @author   spider <spider@steelsun.com>
  */
 
@@ -48,10 +48,10 @@ class LibertyStructure extends LibertyBase {
 				  INNER JOIN `'.BIT_DB_PREFIX.'tiki_content` tc ON (ts.`content_id`=tc.`content_id`)
 				  LEFT JOIN `'.BIT_DB_PREFIX.'users_users` uu ON ( uu.`user_id` = tc.`user_id` )';
 
-		if( is_numeric( $pStructureId ) ) {
+		if( @$this->verifyId( $pStructureId ) ) {
 			$query .= ' WHERE ts.`structure_id`=?';
 			$bindVars = array( $pStructureId );
-		} elseif( is_numeric( $pContentId ) ) {
+		} elseif( @$this->verifyId( $pContentId ) ) {
 			$query .= ' WHERE ts.`content_id`=?';
 			$bindVars = array( $pContentId );
 		}
@@ -76,7 +76,7 @@ class LibertyStructure extends LibertyBase {
 
 	function isRootNode() {
 		$ret = FALSE;
-		if( !empty( $this->mInfo['structure_id'] ) ) {
+		if( @$this->verifyId( $this->mInfo['structure_id'] ) ) {
 			$ret = $this->mInfo['root_structure_id'] == $this->mInfo['structure_id'];
 		}
 		return $ret;
@@ -102,7 +102,7 @@ class LibertyStructure extends LibertyBase {
 
 
 	function isValid() {
-		return( !empty( $this->mStructureId ) && is_numeric( $this->mStructureId ) );
+		return( $this->verifyId( $this->mStructureId ) );
 	}
 
 	function loadNavigation() {
@@ -148,7 +148,7 @@ class LibertyStructure extends LibertyBase {
 
 	function getSubTree( $pStructureId, $level = 0, $parent_pos = '' ) {
 		global $gLibertySystem, $gBitSystem;
-		if( !empty( $pStructureId ) ) {
+		if( @$this->verifyId( $pStructureId ) ) {
 			$ret = array();
 			$pos = 1;
 			//The structure page is used as a title
@@ -232,7 +232,7 @@ class LibertyStructure extends LibertyBase {
 			$bindVars=array();
 		}
 
-		if( !empty( $pListHash['user_id'] ) ) {
+		if( @$this->verifyId( $pListHash['user_id'] ) ) {
 			$mid .= " AND tc.`user_id` = ? ";
 			array_push( $bindVars, $pListHash['user_id'] );
 		}
@@ -268,10 +268,10 @@ class LibertyStructure extends LibertyBase {
 	}
 
 	function verifyNode( &$pParamHash ) {
-		if( empty( $pParamHash['content_id'] ) || !is_numeric( $pParamHash['content_id'] ) ) {
+		if( !@$this->verifyId( $pParamHash['content_id'] ) ) {
 			$this->mErrors['content'] = 'Could not store structure. Invalid content id. '.$pParamHash['content_id'];
 		} else {
-			if( empty( $pParamHash['parent_id'] ) || !is_numeric( $pParamHash['parent_id'] ) ) {
+			if( !@$this->verifyId( $pParamHash['parent_id'] ) ) {
 				$pParamHash['parent_id'] = 0;
 			}
 			if( empty( $pParamHash['alias'] ) ) {
@@ -312,7 +312,7 @@ class LibertyStructure extends LibertyBase {
 
             //Create a new structure entry
 			$pParamHash['structure_id'] = $this->mDb->GenID( 'tiki_structures_id_seq' );
-			if( empty( $pParamHash['root_structure_id'] ) || !is_numeric( $pParamHash['root_structure_id'] ) ) {
+			if( !@$this->verifyId( $pParamHash['root_structure_id'] ) ) {
 				$pParamHash['root_structure_id'] = $pParamHash['structure_id'];
 			}
 			$query = "INSERT INTO `".BIT_DB_PREFIX."tiki_structures`( `structure_id`, `parent_id`,`content_id`, `root_structure_id`, `page_alias`, `pos` ) values(?,?,?,?,?,?)";
@@ -329,9 +329,9 @@ class LibertyStructure extends LibertyBase {
 		if( $this->isValid() ) {
 			//If there is a parent and the parent isnt the structure root node.
 			$this->mDb->StartTrans();
-			if( !empty( $this->mInfo["parent_id"] ) ) {
+			if( @$this->verifyId( $this->mInfo["parent_id"] ) ) {
 				$parentNode = $this->getNode( $this->mInfo["parent_id"] );
-				if( !empty( $parentNode['parent_id'] ) ) {
+				if( @$this->verifyId( $parentNode['parent_id'] ) ) {
 					//Make a space for the node after its parent
 					$query = "update `".BIT_DB_PREFIX."tiki_structures` set `pos`=`pos`+1 where `pos`>? and `parent_id`=?";
 					$this->mDb->query( $query, array( $parentNode['pos'], $parentNode['parent_id'] ) );
@@ -470,7 +470,7 @@ class LibertyStructure extends LibertyBase {
 
 	function s_remove_page( $structure_id, $delete ) {
 		// Now recursively remove
-		if( is_numeric( $structure_id ) ) {
+		if( @$this->verifyId( $structure_id ) ) {
 			$query = "SELECT `structure_id`, ts.`content_id`
 					  FROM `".BIT_DB_PREFIX."tiki_structures` ts
 					  WHERE `parent_id`=?";
@@ -621,7 +621,7 @@ class LibertyStructure extends LibertyBase {
 	}
 
 	function get_toc($pStructureId=NULL,$order='asc',$showdesc=false,$numbering=true,$numberPrefix='') {
-		if( empty( $pStructureId ) ) {
+		if( !@$this->verifyId( $pStructureId ) ) {
 			$pStructureId = $this->mStructureId;
 		}
 		$structure_tree = $this->build_subtree_toc($pStructureId,false,$order,$numberPrefix);
diff --git a/attachment_browser.php b/attachment_browser.php
index 0857189..daab591 100644
--- a/attachment_browser.php
+++ b/attachment_browser.php
@@ -3,7 +3,7 @@
  * attachment_browser
  *
  * @author   spider <spider@steelsun.com>
- * @version  $Revision: 1.6 $
+ * @version  $Revision: 1.7 $
  * @package  liberty
  * @subpackage functions
  */
@@ -16,14 +16,14 @@ require_once("../bit_setup_inc.php");
 global $gBitSmarty, $gContent, $gBitUser, $gBitSystem, $gLibertySystem;
 $listHash = $_REQUEST;
 $listHash = array(
-	'page' => !empty( $_REQUEST['pgnPage'] ) ? $_REQUEST['pgnPage'] : NULL
+	'page' => @BitBase::verifyId( $_REQUEST['pgnPage'] ) ? $_REQUEST['pgnPage'] : NULL
 );
 $userAttachments = $gBitUser->getUserAttachments( $listHash );
 $gBitSmarty->assign( 'userAttachments', $userAttachments );
 
 // pagination
-$offset = !empty( $_REQUEST['offset'] ) ? $_REQUEST['offset'] : 0;
-$gBitSmarty->assign( 'curPage', $pgnPage = !empty( $_REQUEST['pgnPage'] ) ? $_REQUEST['pgnPage'] : 1 );
+$offset = @BitBase::verifyId( $_REQUEST['offset'] ) ? $_REQUEST['offset'] : 0;
+$gBitSmarty->assign( 'curPage', $pgnPage = @BitBase::verifyId( $_REQUEST['pgnPage'] ) ? $_REQUEST['pgnPage'] : 1 );
 $offset = ( $pgnPage - 1 ) * $gBitSystem->mPrefs['maxRecords'];
 
 // calculate page number
diff --git a/comments_inc.php b/comments_inc.php
index 42d94dd..1336fd7 100644
--- a/comments_inc.php
+++ b/comments_inc.php
@@ -3,12 +3,12 @@
  * comment_inc
  *
  * @author   spider <spider@steelsun.com>
- * @version  $Revision: 1.6 $
+ * @version  $Revision: 1.7 $
  * @package  liberty
  * @subpackage functions
  */
 
-// $Header: /cvsroot/bitweaver/_bit_liberty/comments_inc.php,v 1.6 2005/11/22 07:27:18 squareing Exp $
+// $Header: /cvsroot/bitweaver/_bit_liberty/comments_inc.php,v 1.7 2005/12/26 12:25:03 squareing Exp $
 
 // Copyright (c) 2002-2003, Luis Argerich, Garland Foster, Eduardo Polidor, et. al.
 // All Rights Reserved. See copyright.txt for details and a complete list of authors.
@@ -36,14 +36,14 @@ $postComment = array();
 $formfeedback = array();
 $gBitSmarty->assign_by_ref('formfeedback', $formfeedback);
 
-if (!empty($_REQUEST['delete_comment_id']) && $gBitUser->hasPermission( 'bit_p_post_comments' )) {
+if( @BitBase::verifyId($_REQUEST['delete_comment_id']) && $gBitUser->hasPermission( 'bit_p_post_comments' )) {
 	$deleteComment = new LibertyComment($_REQUEST['delete_comment_id']);
-	if (!empty ($deleteComment->mInfo['content_id'])) {
+	if( @BitBase::verifyId($deleteComment->mInfo['content_id'] ) ) {
 		$deleteComment->deleteComment();
 	}
 }
 
-if (!empty($_REQUEST['post_comment_id']) && $gBitUser->hasPermission( 'bit_p_post_comments' )) {
+if( @BitBase::verifyId($_REQUEST['post_comment_id']) && $gBitUser->hasPermission( 'bit_p_post_comments' )) {
 	$post_comment_id = $_REQUEST['post_comment_id'];
 	$editComment = new LibertyComment($post_comment_id);
 	if ($editComment->mInfo['content_id']) {
@@ -68,12 +68,12 @@ $gBitSmarty->assign('post_comment_id', $post_comment_id);
 
 // Store comment posts
 if (!empty($_REQUEST['post_comment_submit']) && $gBitUser->hasPermission( 'bit_p_post_comments' )) {
-	$storeComment = new LibertyComment(!empty($editComment->mCommentId) ? $editComment->mCommentId : NULL);
+	$storeComment = new LibertyComment(@BitBase::verifyId($editComment->mCommentId) ? $editComment->mCommentId : NULL);
 	$storeRow = array();
 	$storeRow['title'] = $_REQUEST['comment_title'];
 	$storeRow['edit'] = $_REQUEST['comment_data'];
-	$storeRow['parent_id'] = (!empty($storeComment->mInfo['parent_id']) ? $storeComment->mInfo['parent_id'] : (empty($_REQUEST['post_comment_reply_id']) ? $commentsParentId : $_REQUEST['post_comment_reply_id']));
-	$storeRow['content_id'] = (!empty($storeComment->mContentId) ? $storeComment->mContentId : NULL);
+	$storeRow['parent_id'] = (@BitBase::verifyId($storeComment->mInfo['parent_id']) ? $storeComment->mInfo['parent_id'] : (!@BitBase::verifyId($_REQUEST['post_comment_reply_id']) ? $commentsParentId : $_REQUEST['post_comment_reply_id']));
+	$storeRow['content_id'] = (@BitBase::verifyId($storeComment->mContentId) ? $storeComment->mContentId : NULL);
 	$storeComment->storeComment($storeRow);
 }
 
@@ -94,7 +94,7 @@ if( !empty( $_REQUEST['post_comment_preview'] ) ) {
 }
 
 // $post_comment_reply_id is the content_id which a post is replying to
-if (!empty($_REQUEST['post_comment_reply_id'])) {
+if (@BitBase::verifyId($_REQUEST['post_comment_reply_id'])) {
 	$post_comment_reply_id = $_REQUEST['post_comment_reply_id'];
 	$tmpComment = new LibertyComment(NULL, $post_comment_reply_id);
 	//$postComment['data'] = $commentsLib->quoteComment($tmpComment->mInfo['data']);  // This is super-ugly, better to just not quote at all, the indented comment indicates what comment it is replying to
@@ -135,7 +135,7 @@ $commentOffset = !empty( $_REQUEST['comment_page'] ) ? ($_REQUEST['comment_page'
 
 $gComment = new LibertyComment( NULL, $gContent->mContentId );
 // $commentsParentId is the content_id which the comment tree is attached to
-if( empty( $commentsParentId ) ) {
+if( !@BitBase::verifyId( $commentsParentId ) ) {
 	$comments = NULL;
 	$numComments = 0;
 } else {
diff --git a/edit_structure_inc.php b/edit_structure_inc.php
index eeeb059..0111436 100644
--- a/edit_structure_inc.php
+++ b/edit_structure_inc.php
@@ -3,7 +3,7 @@
  * edit_structure_inc
  *
  * @author   Christian Fowler>
- * @version  $Revision: 1.8 $
+ * @version  $Revision: 1.9 $
  * @package  liberty
  * @subpackage functions
  */
@@ -18,7 +18,7 @@
 require_once( '../bit_setup_inc.php' );
 include_once( LIBERTY_PKG_PATH.'LibertyStructure.php');
 
-if( empty( $_REQUEST["structure_id"] ) ) {
+if( !@BitBase::verifyId( $_REQUEST["structure_id"] ) ) {
 	$gBitSystem->fatalError( "No structure indicated" );
 } else {
 	global $gStructure;
@@ -125,7 +125,6 @@ if( empty( $_REQUEST["structure_id"] ) ) {
 		}
 	}
 
-	$gBitSmarty->assign( (!empty( $_REQUEST['tab'] ) ? $_REQUEST['tab'] : 'body').'TabSelect', 'tdefault' );
 	$gBitSmarty->assign('subtree', $rootTree = $rootStructure->getSubTree( $rootStructure->mStructureId ));
 }
 
diff --git a/get_content_list_inc.php b/get_content_list_inc.php
index a96c4db..dcca43f 100644
--- a/get_content_list_inc.php
+++ b/get_content_list_inc.php
@@ -3,7 +3,7 @@
  * get_content_list
  *
  * @author   Christian Fowler>
- * @version  $Revision: 1.5 $
+ * @version  $Revision: 1.6 $
  * @package  liberty
  * @subpackage functions
  */
@@ -27,7 +27,7 @@ if( empty( $contentListHash ) ) {
 		'max_records' =>         !empty( $max_content ) ? $max_content : 500,
 		'sort_mode' =>           !empty( $content_sort_mode ) ? $content_sort_mode : 'title_asc',
 		'find' =>                !empty( $_REQUEST["find_objects"] ) ? $_REQUEST["find_objects"] : NULL,
-		'user_id' =>             !empty( $_REQUEST['user_id'] ) ? $_REQUEST['user_id'] : NULL,
+		'user_id' =>             @BitBase::verifyId( $_REQUEST['user_id'] ) ? $_REQUEST['user_id'] : NULL,
 	);
 }
 $contentList = $gContent->getContentList( $contentListHash );
diff --git a/list_content.php b/list_content.php
index 6992bd8..da9868b 100644
--- a/list_content.php
+++ b/list_content.php
@@ -3,7 +3,7 @@
  * list_content
  *
  * @author   spider <spider@steelsun.com>
- * @version  $Revision: 1.6 $
+ * @version  $Revision: 1.7 $
  * @package  liberty
  * @subpackage functions
  */
@@ -20,9 +20,9 @@ if( !empty( $_REQUEST['sort_mode'] ) ) {
 }
 
 $max_content = $gBitSystem->mPrefs['maxRecords'];
-$offset_content = !empty( $_REQUEST['offset'] ) ? $_REQUEST['offset'] : 0;
-$gBitSmarty->assign( 'user_id', !empty( $_REQUEST['user_id'] ) ? $_REQUEST['user_id'] : NULL );
-$gBitSmarty->assign( 'curPage', $page = !empty( $_REQUEST['page'] ) ? $_REQUEST['page'] : 1 );
+$offset_content = @BitBase::verifyId( $_REQUEST['offset'] ) ? $_REQUEST['offset'] : 0;
+$gBitSmarty->assign( 'user_id', @BitBase::verifyId( $_REQUEST['user_id'] ) ? $_REQUEST['user_id'] : NULL );
+$gBitSmarty->assign( 'curPage', $page = @BitBase::verifyId( $_REQUEST['page'] ) ? $_REQUEST['page'] : 1 );
 $offset_content = ( $page - 1 ) * $gBitSystem->mPrefs['maxRecords'];
 
 // now that we have all the offsets, we can get the content list
diff --git a/lookup_content_inc.php b/lookup_content_inc.php
index 9d6049d..cd910c7 100644
--- a/lookup_content_inc.php
+++ b/lookup_content_inc.php
@@ -3,13 +3,13 @@
  * lookup_content_inc
  *
  * @author   spider <spider@steelsun.com>
- * @version  $Revision: 1.5 $
+ * @version  $Revision: 1.6 $
  * @package  liberty
  * @subpackage functions
  */
 	global $gContent;
 
-	if( !empty( $_REQUEST['structure_id'] ) ) {
+	if( @BitBase::verifyId( $_REQUEST['structure_id'] ) ) {
 		/**
 		 * required setup
 		 */
@@ -28,7 +28,7 @@
 				$gBitSmarty->assign_by_ref( 'gContent', $gContent );
 			}
 		}
-	} elseif( !empty( $_REQUEST['content_id'] ) ) {
+	} elseif( @BitBase::verifyId( $_REQUEST['content_id'] ) ) {
 		require_once( LIBERTY_PKG_PATH.'LibertyBase.php');
 		if( $gContent = LibertyBase::getLibertyObject( $_REQUEST['content_id'] ) ) {
 			$gBitSmarty->assign_by_ref( 'gContent', $gContent );
diff --git a/modules/mod_structure_toc.php b/modules/mod_structure_toc.php
new file mode 100644
index 0000000..a8471ac
--- /dev/null
+++ b/modules/mod_structure_toc.php
@@ -0,0 +1,16 @@
+<?php
+global $gStructure, $gContent;
+$struct = NULL;
+if( is_object( $gContent ) && ( empty( $gStructure ) || !$gStructure->isValid() ) ) {
+	$structures = $gContent->getStructures();
+	// We take the first structure. not good, but works for now - spiderr
+	if( !empty( $structures[0] ) ) {
+		$struct = new LibertyStructure( $structures[0]['structure_id'] );
+	}
+} else {
+	$struct = &$gStructure;
+}
+if( is_object( $struct ) && count( $struct->isValid() ) ) {
+	$gBitSmarty->assign( 'modStructureTOC', $struct->get_toc( $struct->mInfo['root_structure_id'] ) );
+}
+?>
diff --git a/modules/mod_structure_toc.tpl b/modules/mod_structure_toc.tpl
new file mode 100644
index 0000000..b299218
--- /dev/null
+++ b/modules/mod_structure_toc.tpl
@@ -0,0 +1,5 @@
+{if $modStructureTOC}
+	{bitmodule title="$moduleTitle" name="structure_navigation"}
+		{$modStructureTOC}
+	{/bitmodule}
+{/if}
diff --git a/plugins/data.div.php b/plugins/data.div.php
new file mode 100644
index 0000000..0851980
--- /dev/null
+++ b/plugins/data.div.php
@@ -0,0 +1,77 @@
+<?php
+// $id: data.example.php,v 1.4.2.9 2005/07/14 09:03:36 starrider Exp $
+/**
+ * assigned_modules
+ *
+ * @author     xing
+ * @version    $Revision: 1.2 $
+ * @package    liberty
+ * @subpackage plugins_data
+ * @copyright  Copyright (c) 2004, bitweaver.org
+ */
+
+define( 'PLUGIN_GUID_DATADIV', 'datadiv' );
+global $gLibertySystem;
+$pluginParams = array ( 
+	'tag' => 'DIV',
+	'auto_activate' => TRUE,
+	'requires_pair' => TRUE,
+	'load_function' => 'data_div',
+	'title' => 'Div (DIV)',
+	'help_page' => 'DataPluginDiv',
+	'description' => tra( "This plugin allows you to easily create a div with a number of optional CSS parameters." ),
+	'help_function' => 'data_div_help',
+	'syntax' => "{div border='3px solid blue'}",
+	'plugin_type' => DATA_PLUGIN
+);
+$gLibertySystem->registerPlugin( PLUGIN_GUID_DATADIV, $pluginParams );
+$gLibertySystem->registerDataTag( $pluginParams['tag'], PLUGIN_GUID_DATADIV );
+
+function data_div_help() {
+	$help =
+		'<table class="data help">'
+			.'<tr>'
+				.'<th>' . tra( "Key" ) . '</th>'
+				.'<th>' . tra( "Type" ) . '</th>'
+				.'<th>' . tra( "Comments" ) . '</th>'
+			.'</tr>'
+			.'<tr class="odd">'
+				.'<td>' . tra( "CSS rules" ) . '</td>'
+				.'<td>' . tra( "string") . '<br />' . tra( "(optional)" ) . '</td>'
+				.'<td>' . tra( "This can be any CSS style rule. e.g.: ") . "border='3px solid blue'" .'</td>'
+			.'</tr>'
+			.'<tr class="even">'
+				.'<td>preset</td>'
+				.'<td>' . tra( "string") . '<br />' . tra( "(optional)" ) . '</td>'
+				.'<td>' . tra( "There are a few presets, which you can use to style with. Presets include: dark, orange, red, blue, centered.") .'</td>'
+			.'</tr>'
+ 		.'</table>'
+		. tra( "Example: " ) . "{div preset=centered border='3px solid blue'}";
+	return $help;
+}
+
+function data_div( $data, $params ) {
+	$style = '';
+	foreach( $params as $key => $value ) {
+		switch( $key ) {
+			case 'preset':
+				if( $value == 'dark' ) {
+					$style .= 'background:#333;color:#ccc;border:2px solid #000;padding:0.5em 1em;margin:0.5em;';
+				} elseif( $value == "orange" ) {
+					$style .= 'background:#f60;color:#fff;border:2px solid #900;padding:0.5em 1em;margin:0.5em;';
+				} elseif( $value == "red" ) {
+					$style .= 'background:#eee;color:#900;border:2px solid #900;padding:0.5em 1em;margin:0.5em;';
+				} elseif( $value == "blue" ) {
+					$style .= 'background:#def;color:#009;border:2px solid #acf;padding:0.5em 1em;margin:0.5em;';
+				} elseif( $value == "centered" ) {
+					$style .= 'background:#eee;color:#333;border:2px solid #ddd;padding:0.5em 1em;margin:0.5em auto;width:50%;text-align:center;';
+				}
+				break;
+			default:
+				$style .= $key.':'.$value.';';
+				break;
+		}
+	}
+	return( '<div style="'.$style.'">'.$data.'</div>' );
+}
+?>
diff --git a/plugins/data.include.php b/plugins/data.include.php
index ae416cb..be91942 100644
--- a/plugins/data.include.php
+++ b/plugins/data.include.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * @version  $Revision: 1.6 $
+ * @version  $Revision: 1.7 $
  * @package  liberty
  * @subpackage plugins_data
  */
@@ -17,7 +17,7 @@
 // | Reworked for Bitweaver (& Undoubtedly Screwed-Up) 
 // | by: StarRider <starrrider@users.sourceforge.net>
 // +----------------------------------------------------------------------+
-// $Id: data.include.php,v 1.6 2005/08/24 20:55:17 squareing Exp $
+// $Id: data.include.php,v 1.7 2005/12/26 12:25:03 squareing Exp $
 
 /**
  * definitions
@@ -77,7 +77,7 @@ function data_include($data, $params) {
 		require_once( WIKI_PKG_PATH.'BitPage.php');
 		$wp = new BitPage( $params['page_id'] );
 		if( $wp->load() ) {
-			$ret = $wp->mInfo['data'];
+			$ret = $wp->parseData( $wp->mInfo['data'], $wp->mInfo['format_guid'] );
 		}
 	// load page by content_id
 	} elseif( isset( $params['content_id'] ) && is_numeric( $params['content_id'] ) ) {
diff --git a/plugins/data.module.php b/plugins/data.module.php
index 4428f9f..e28eca9 100644
--- a/plugins/data.module.php
+++ b/plugins/data.module.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * @version  $Revision: 1.6 $
+ * @version  $Revision: 1.7 $
  * @package  liberty
  * @subpackage plugins_data
  */
@@ -16,7 +16,7 @@
 // | Author (TikiWiki): Mose <mose@users.sourceforge.net>
 // | Reworked for Bitweaver  by: Christian Fowler <spiderr@users.sourceforge.net>
 // +----------------------------------------------------------------------+
-// $Id: data.module.php,v 1.6 2005/11/22 07:27:18 squareing Exp $
+// $Id: data.module.php,v 1.7 2005/12/26 12:25:03 squareing Exp $
 
 /**
  * definitions
@@ -65,7 +65,7 @@ function datamodule_help() {
 				.'<td colspan="3">' . tra( "Additional arguments and values depend on the selected module." )
 			.'</tr>'
 		.'</table>'
-		. tra( "Example: " ) . '{MODULE module=last_modified_pages package=wiki title="Recent Wiki Modifications"}';
+		. tra( "Example: " ) . '{MODULE module=last_changes package=liberty title="Recent Changes"}';
 	return $help;
 }
 
@@ -73,6 +73,7 @@ function data_datamodule( $data, $params ) {
 	global $modlib, $gBitSmarty;
 	require_once( KERNEL_PKG_PATH.'mod_lib.php' );
 	$out = '';
+	$ret = ' ';
 
 	extract( $params , EXTR_SKIP);
 
@@ -80,11 +81,15 @@ function data_datamodule( $data, $params ) {
 		// not sure if we can use the php file, since it sets everything to NULL when passed in - xing
 		global $module_rows;
 		$module_rows = !empty( $rows ) ? $rows : 10;
-		$php = constant( strtoupper( $package ).'_PKG_PATH' ).'modules/mod_'.$module.'.php';
+		//$php = constant( strtoupper( $package ).'_PKG_PATH' ).'modules/mod_'.$module.'.php';
 		// TODO: assigning variables to template doesn't work since they are replaced by module paramaters set in the php file - even when it's not in use! - xing
-		$tpl = 'bitpackage:'.$package.'/mod_'.$module.'.tpl';
+		if( is_file( constant( strtoupper( $package ).'_PKG_PATH' ).'modules/mod_'.$module.'.tpl' ) ) {
+			$tpl = 'bitpackage:'.$package.'/mod_'.$module.'.tpl';
+		} else {
+			return '<div class="error">'.tra( "The module / package combination you entered is not valid" ).'</div>';
+		}
 	} else {
-		$ret = '<div class="error">'.tra( "Both paramters 'module' and 'package' are required" );
+		return '<div class="error">'.tra( "Both paramters 'module' and 'package' are required" ).'</div>';
 	}
 
 	if( !$out = $gBitSmarty->fetch( $tpl ) ) {
@@ -96,7 +101,6 @@ function data_datamodule( $data, $params ) {
 		}
 	}
 	$out = eregi_replace( "\n", "", $out );
-	//vd($out);
 
 	// deal with custom styling
 	$style = '';
@@ -106,14 +110,13 @@ function data_datamodule( $data, $params ) {
 			$style .= $param.':'.$value.';';
 		}
 	}
+
 	if( !empty( $style ) ) {
 		$style = ' style="'.$style.'"';
 	}
 
 	if( $out ) {
 		$ret = '<div'.$style.'>'.$out.'</div>';
-	} else {
-		$ret = '<div class="error">'.tra( "Sorry no such module" ).'</div>'.$module;
 	}
 	return $ret;
 }
diff --git a/plugins/format.tikiwiki.php b/plugins/format.tikiwiki.php
index 43cd847..804e6a9 100644
--- a/plugins/format.tikiwiki.php
+++ b/plugins/format.tikiwiki.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * @version  $Revision: 1.13 $
+ * @version  $Revision: 1.14 $
  * @package  liberty
  */
 global $gLibertySystem;
@@ -320,6 +320,7 @@ class TikiWikiParser extends BitBase {
 		$data = preg_replace("/&(?!([a-z]{1,7};))/", "&amp;", $data);
 
 		// oft-used characters (case insensitive)
+		$data = preg_replace("/~bull~/i", "&bull;", $data);
 		$data = preg_replace("/~bs~/i", "&#92;", $data);
 		$data = preg_replace("/~hs~/i", "&nbsp;", $data);
 		$data = preg_replace("/~amp~/i", "&amp;", $data);
@@ -912,58 +913,64 @@ class TikiWikiParser extends BitBase {
 		// Images
 		preg_match_all("/(\{img [^\}]+})/i", $data, $pages);
 
-		foreach (array_unique($pages[1])as $page_parse) {
-			$parts = explode(" ", $page_parse);
+		foreach( array_unique( $pages[1] ) as $page_parse ) {
+			// collect all parameters into $parts ( after we've removed whitespaces around '=' )
+			preg_match_all( "/(\w*)=([^=]*)(?=\s.*?|\s*\})/", preg_replace( "/\s+=\s+/", "=", $page_parse ), $parts );
 
 			$imgdata = array();
-			$imgdata["src"] = '';
-			$imgdata["height"] = '';
-			$imgdata["width"] = '';
-			$imgdata["link"] = '';
-			$imgdata["align"] = '';
-			$imgdata["float"] = '';
-			$imgdata["desc"] = '';
-
-			foreach ($parts as $part) {
-				$part = str_replace('}', '', $part);
-				$part = str_replace('{', '', $part);
-				$part = str_replace('\'', '', $part);
-				$part = str_replace('"', '', $part);
+			$imgdata['img_style'] = '';
+			$imgdata['div_style'] = '';
 
-				if (strstr($part, '=')) {
-				$subs = explode("=", $part, 2);
-
-				$imgdata[$subs[0]] = $subs[1];
+			foreach( $parts[1] as $i => $key ) {
+				$value = preg_replace( '/["\']/', "", $parts[2][$i] );
+				switch( $key ) {
+					case 'width':
+					case 'height':
+						$imgdata['img_style'] .= $key.':'.$value.';';
+						break;
+					case 'float':
+					case 'padding':
+					case 'margin':
+					case 'background':
+					case 'border':
+					case 'text-align':
+					case 'color':
+					case 'font':
+						$imgdata['div_style'] .= $key.':'.$value.';';
+						break;
+					case 'align':
+						$imgdata['div_style'] .= 'text-align:'.$value.';';
+						break;
+					default:
+						$imgdata[$key] = $value;
+						break;
 				}
 			}
 
-			//print("todo el tag es: ".$page_parse."<br/>");
-			//print_r($imgdata);
-			$repl = '<img alt="' . tra('Image') . '" src="'.$imgdata["src"].'" style="border:0;'.( !empty( $imgdata["float"] ) ? ' float:'.$imgdata["float"].';' : '' ).'"';
-
-
-
-			if ($imgdata["width"])
-				$repl .= ' width="' . $imgdata["width"] . '"';
-
-			if ($imgdata["height"])
-				$repl .= ' height="' . $imgdata["height"] . '"';
+			// check if we have a source to load an image from
+			if( !empty( $imgdata['src'] ) ) {
+				// set up image first
+				$repl = '<img'.
+						' alt="'.( !empty( $imgdata['desc'] ) ? $imgdata['desc'] : tra( 'Image' ) ).'"'.
+						' title="'.( !empty( $imgdata['desc'] ) ? $imgdata['desc'] : tra( 'Image' ) ).'"'.
+						' src="'.$imgdata['src'].'"'.
+						' style="'.$imgdata['img_style'].'"'.
+					' />';
 
-			if ($imgdata["align"])
-				$repl .= ' align="' . $imgdata["align"] . '"';
-
-			$repl .= ' />';
-
-			if ($imgdata["link"]) {
-				$repl = '<a href="' . $imgdata["link"] . '">' . $repl . '</a>';
-			}
+				// if this image is linking to something, wrap the image with the <a>
+				if( !empty( $imgdata['link'] ) ) {
+					$repl = '<a href="'.trim( $imgdata['link'] ).'">'.$repl.'</a>';
+				}
 
-			if ($imgdata["desc"]) {
-				$repl = '<table cellpadding="0" cellspacing="0"><tr><td>' . $repl . '</td></tr><tr><td><small>' . $imgdata["desc"] . '</small></td></tr></table>';
+				// finally, wrap the image with a div
+				if( !empty( $imgdata['div_style'] ) || !empty( $imgdata['desc'] ) ) {
+					$repl = '<div class="img-plugin" style="'.$imgdata['div_style'].'">'.$repl.'<br />'.( !empty( $imgdata['desc'] ) ? $imgdata['desc'] : '' ).'</div>';
+				}
+			} else {
+				$repl = '<span class="warning">'.tra( 'When using <strong>{img}</strong> the <strong>src</strong> parameter is required.' ).'</span>';
 			}
 
-
-			$data = str_replace($page_parse, $repl, $data);
+			$data = str_replace( $page_parse, $repl, $data );
 		}
 
 		$links = $this->get_links($data);
diff --git a/templates/storage_thumbs.tpl b/templates/storage_thumbs.tpl
index 181d35a..f0f5a05 100644
--- a/templates/storage_thumbs.tpl
+++ b/templates/storage_thumbs.tpl
@@ -1,9 +1,9 @@
 {strip}
-{if !$gBitSystem->isFeatureActive( 'feature_helppopup' )}
-	{popup_init src="`$smarty.const.THEMES_PKG_URL`js/overlib.js"}
-{/if}
-
 {if $gContent->mStorage}
+	{if !$gBitSystem->isFeatureActive( 'feature_helppopup' )}
+		{popup_init src="`$smarty.const.THEMES_PKG_URL`js/overlib.js"}
+	{/if}
+
 	<div class="storage">
 		{foreach from=$gContent->mStorage item=attachment }
 			{capture name="popup"}