Merge branch 'release' of https://github.com/PrestaShop/PrestaShop in…

…to release

CONTRIBUTORS.md

@@ -1,3 +1,4 @@
+- 123monsite-regis
 - adonis karavokyros
 - Adonis Karavokyros
 - Adrien
@@ -9,6 +10,7 @@
 - Alexander Otchenashev
 - alexey-svistunov
 - Alexey Svistunov
+- Alfonso Jiménez
 - anat
 - Andrew
 - aNiassy
@@ -17,9 +19,11 @@
 - Arnaud Lemercier
 - Axome
 - Balestrino
+- bellini13
 - Benjamin PONGY
 - BigZ
 - bLeveque
+- BluTiGeS
 - bMancone
 - Bruno Leveque
 - bumbu
@@ -30,6 +34,7 @@
 - Captain-FLAM
 - ccauw
 - cedricfontaine
+- cedricgeffroy
 - Cédric Mouleyre
 - Chen.Zhidong
 - Chris
@@ -49,13 +54,15 @@
 - Danoosh Mir
 - David Gasperoni
 - Davy Rolink
+- DevNet
 - Dh42
 - Dimitrios Karvounaris
 - Dinis Lage
 - djfm
 - dlage
 - dMetzger
 - (d)oekia
+- doekia
 - DOEO
 - Dragan Skrbic
 - dreammeup
@@ -77,6 +84,7 @@
 - fchellypresta
 - Felipe Uribe
 - fetis
+- Florian Kwakkenbos
 - fram
 - Francois Gaillard
 - François Gaillard
@@ -103,8 +111,10 @@
 - hiousi
 - indesign47
 - inem0o
+- ITBpro.com
 - ivancasasempere
 - Jáchym Toušek
+- janisVincent
 - Javsmile
 - jBreux
 - J. Danse
@@ -116,9 +126,13 @@
 - Jérôme Nadaud
 - jessylenne
 - jmCollin
+- Joan Juvanteny
 - jObregon
+- Joep Hendrix
+- Jonadabe
 - Jonathan Danse
 - Jonathan SAHM
+- Jorge Vargas
 - joseantgv
 - Julien
 - julienbourdeau
@@ -157,23 +171,28 @@
 - Mikael Blotin
 - Mikko Hellsing
 - Milow
+- Mingsong Hu
 - minic studio
 - misthero
 - mMarinetti
+- M-Mommsen
 - montes
 - MustangZhong
 - natrim
 - neemzy
 - nezenmoins
 - Nicolas Sorosac
 - Niklas Ekman
+- Niko Wicaksono
 - Nils-Helge Garli Hegvik
 - Nino Uzelac
 - nPellicari
 - nturato
 - oleacorner
 - Otto Nascarella
 - Patanock
+- Per Lejontand
+- peterept
 - Peter Schaeffer
 - PhpMadman
 - Pierre
@@ -201,6 +220,7 @@
 - romainberger
 - root
 - runningz
+- sadlyblue
 - sagaradonis
 - Samy Rabih
 - Sarah Lorenzini
@@ -209,6 +229,7 @@
 - Sébastien
 - Sébastien Bocahu
 - Seynaeve
+- shaffe-fr
 - Shagshag
 - Shipow
 - sjousse
@@ -226,8 +247,10 @@
 - tDidierjean
 - Thibaud Chauviere
 - thoma202
+- Thomas
 - Thomas Blanc
 - Thomas Nabord
+- Threef
 - timsit
 - TMMeilleur
 - Tomasz Slominski
@@ -247,6 +270,7 @@
 - Xavier
 - Xavier Borderie
 - Xavier POITAU
+- xKnut
 - yanngarras
 - Yoozio
 - zimmi1

admin-dev/ajax_products_list.php

@@ -65,24 +65,28 @@
 		($exclude_packs ? 'AND (p.cache_is_pack IS NULL OR p.cache_is_pack = 0)' : '').
 		' GROUP BY p.id_product';
 
-$result = Db::getInstance()->executeS($sql);
+$items = Db::getInstance()->executeS($sql);
 
-if ($result)
+$acc = (bool)Tools::isSubmit('excludeIds');
+
+if ($items && $acc)
+	foreach ($items AS $item)
+		echo trim($item['name']).(!empty($item['reference']) ? ' (ref: '.$item['reference'].')' : '').'|'.(int)($item['id_product'])."\n";
+elseif ($items)
 {
-	$items = array();
-	foreach ($result AS $item)
+	// packs
+	$results = array();
+	foreach ($items AS $item)
 	{
 		$product = array(
 			'id' => (int)($item['id_product']),
 			'name' => $item['name'],
 			'ref' => (!empty($item['reference']) ? $item['reference'] : ''),
-			'image' => Context::getContext()->link->getImageLink($item['link_rewrite'], $item['id_image'], 'home_default' ),
+			'image' => str_replace('http://', Tools::getShopProtocol(), Context::getContext()->link->getImageLink($item['link_rewrite'], $item['id_image'], 'home_default')),
 		);
-		array_push($items, $product);
+		array_push($results, $product);
 	}
-	echo Tools::jsonEncode($items);
+	echo Tools::jsonEncode($results);
 }
 else
-{
-	json_encode (new stdClass);
-}
+	json_encode(new stdClass);

admin-dev/backup.php

@@ -40,7 +40,7 @@
 $backupdir = realpath(PrestaShopBackup::getBackupPath());
 
 if ($backupdir === false)
-	die (Tools::displayError('There is no backup directory.'));
+	die (Tools::displayError('There is no "/backup" directory.'));
 
 if (!$backupfile = Tools::getValue('filename'))
 	die (Tools::displayError('No file has been specified.'));

admin-dev/filemanager/dialog.php

@@ -10,11 +10,13 @@
 
 	include('include/utils.php');
 
+
+
 	if (isset($_GET['fldr'])
 		&& !empty($_GET['fldr'])
 		&& preg_match('/\.{1,2}[\/|\\\]/', urldecode($_GET['fldr'])) === 0
 	)
-		$subdir = urldecode(trim($_GET['fldr'], '/').'/');
+		$subdir = urldecode(trim(str_replace("\0", '', $_GET['fldr']), '/').'/');
 	else
 		$subdir = '';
 

admin-dev/filemanager/force_download.php

@@ -6,7 +6,7 @@
 if (preg_match('/\.{1,2}[\/|\\\]/', $_POST['path']) !== 0)
 	die('wrong path');
 
-if (strpos($_POST['name'], DIRECTORY_SEPARATOR) !== false)
+if (strpos($_POST['name'], '/') !== false || strpos($_POST['name'], '\\') !== false)
 	die('wrong path');
 
 $path = $current_path.$_POST['path'];

admin-dev/filemanager/upload.php

@@ -3,8 +3,8 @@
 if ($_SESSION['verify'] != 'RESPONSIVEfilemanager') die('forbiden');
 include('include/utils.php');
 
-$_POST['path'] = $current_path.$_POST['path'];
-$_POST['path_thumb'] = $thumbs_base_path.$_POST['path_thumb'];
+$_POST['path'] = $current_path.str_replace('\0', '', $_POST['path']);
+$_POST['path_thumb'] = $thumbs_base_path.str_replace("\0", '', $_POST['path_thumb']);
 
 $storeFolder = $_POST['path'];
 $storeFolderThumb = $_POST['path_thumb'];

admin-dev/functions.php

@@ -159,7 +159,7 @@ function getPath($urlBase, $id_category, $path = '', $highlight = '', $categoryT
 					WHERE c.nleft <= '.(int)$category['nleft'].'
 						AND c.nright >= '.(int)$category['nright'].'
 						AND cl.id_lang = '.(int)$context->language->id.
-						($home ? ' AND c.id_category='.$id_category : '').'
+						($home ? ' AND c.id_category='.(int)$id_category : '').'
 						AND c.id_category != '.(int)Category::getTopCategory()->id.'
 					GROUP BY c.id_category
 					ORDER BY c.level_depth ASC
@@ -171,9 +171,9 @@ function getPath($urlBase, $id_category, $path = '', $highlight = '', $categoryT
 			foreach ($categories AS $category)
 			{
 				$link = Context::getContext()->link->getAdminLink('AdminCategories');
-				$edit = '<a href="'.$link.'&id_category='.(int)$category['id_category'].'&'.(($category['id_category'] == 1 || $home) ? 'viewcategory' : 'updatecategory').'" title="'.($category['id_category'] == Category::getRootCategory()->id_category ? 'Home' : 'Modify').'"><i class="icon-'.(($category['id_category'] == Category::getRootCategory()->id_category  || $home) ? 'home' : 'pencil').'"></i></a> ';
+				$edit = '<a href="'.Tools::safeOutput($link.'&id_category='.(int)$category['id_category'].'&'.(($category['id_category'] == 1 || $home) ? 'viewcategory' : 'updatecategory')).'" title="'.($category['id_category'] == Category::getRootCategory()->id_category ? 'Home' : 'Modify').'"><i class="icon-'.(($category['id_category'] == Category::getRootCategory()->id_category  || $home) ? 'home' : 'pencil').'"></i></a> ';
 				$fullPath .= $edit.
-				($n < $nCategories ? '<a href="'.$urlBase.'&id_category='.(int)$category['id_category'].'&viewcategory&token='.Tools::getAdminToken('AdminCategories'.(int)(Tab::getIdFromClassName('AdminCategories')).(int)$context->employee->id).'" title="'.htmlentities($category['name'], ENT_NOQUOTES, 'UTF-8').'">' : '').
+				($n < $nCategories ? '<a href="'.Tools::safeOutput($urlBase.'&id_category='.(int)$category['id_category'].'&viewcategory&token='.Tools::getAdminToken('AdminCategories'.(int)(Tab::getIdFromClassName('AdminCategories')).(int)$context->employee->id)).'" title="'.htmlentities($category['name'], ENT_NOQUOTES, 'UTF-8').'">' : '').
 				(!empty($highlight) ? str_ireplace($highlight, '<span class="highlight">'.htmlentities($highlight, ENT_NOQUOTES, 'UTF-8').'</span>', $category['name']) : $category['name']).
 				($n < $nCategories ? '</a>' : '').
 				(($n++ != $nCategories || !empty($path)) ? ' > ' : '');
@@ -189,12 +189,12 @@ function getPath($urlBase, $id_category, $path = '', $highlight = '', $categoryT
 			return $path;
 
 		$name = ($highlight != null) ? str_ireplace($highlight, '<span class="highlight">'.$highlight.'</span>', CMSCategory::hideCMSCategoryPosition($category->name)) : CMSCategory::hideCMSCategoryPosition($category->name);
-		$edit = '<a href="'.$urlBase.'&id_cms_category='.$category->id.'&addcategory&token=' . Tools::getAdminToken('AdminCmsContent'.(int)(Tab::getIdFromClassName('AdminCmsContent')).(int)$context->employee->id).'">
+		$edit = '<a href="'.Tools::safeOutput($urlBase.'&id_cms_category='.$category->id.'&addcategory&token=' . Tools::getAdminToken('AdminCmsContent'.(int)(Tab::getIdFromClassName('AdminCmsContent')).(int)$context->employee->id)).'">
 				<i class="icon-pencil"></i></a> ';
 		if ($category->id == 1)
-			$edit = '<li><a href="'.$urlBase.'&id_cms_category='.$category->id.'&viewcategory&token=' . Tools::getAdminToken('AdminCmsContent'.(int)(Tab::getIdFromClassName('AdminCmsContent')).(int)$context->employee->id).'">
+			$edit = '<li><a href="'.Tools::safeOutput($urlBase.'&id_cms_category='.$category->id.'&viewcategory&token=' . Tools::getAdminToken('AdminCmsContent'.(int)(Tab::getIdFromClassName('AdminCmsContent')).(int)$context->employee->id)).'">
 					<i class="icon-home"></i></a></li> ';
-		$path = $edit.'<li><a href="'.$urlBase.'&id_cms_category='.$category->id.'&viewcategory&token=' . Tools::getAdminToken('AdminCmsContent'.(int)(Tab::getIdFromClassName('AdminCmsContent')).(int)$context->employee->id).'">
+		$path = $edit.'<li><a href="'.Tools::safeOutput($urlBase.'&id_cms_category='.$category->id.'&viewcategory&token=' . Tools::getAdminToken('AdminCmsContent'.(int)(Tab::getIdFromClassName('AdminCmsContent')).(int)$context->employee->id)).'">
 		'.$name.'</a></li> > '.$path;
 		if ($category->id == 1)
 			return substr($path, 0, strlen($path) - 3);

admin-dev/themes/default/bower.json

@@ -1,9 +1,9 @@
 {
   "name": "prestashop-admin",
-  "version": "1.6.0",
+  "version": "1.6.7",
   "dependencies": {
-    "font-awesome": "4.0.3",
-    "bootstrap-sass-official": "3.1.1",
+    "font-awesome": "4.1",
+    "bootstrap-sass-official": "3.1.1+2",
     "enquire": "2.1.0"
   },
   "devDependencies": {}