merge -r4512 from branch 2.0 to trunk

web method images.setPrivacyLevel (ws_images_setPrivacyLevel) is POST only

git-svn-id: http://piwigo.org/svn/trunk@4513 68402e56-0260-453c-a942-63ccdbb3a9ee

include/calendar_weekly.class.php

@@ -54,11 +54,11 @@ class Calendar extends CalendarBase
           'labels' => null
         ),
       array(
-          'sql'=> pwg_db_get_week($this->date_field)+1,
+          'sql'=> pwg_db_get_week($this->date_field).'+1',
           'labels' => $week_no_labels,
         ),
       array(
-          'sql'=> pwg_db_get_dayofweek($this->date_field)-1,
+          'sql'=> pwg_db_get_dayofweek($this->date_field).'-1',
           'labels' => $lang['day']
         ),
      );

include/ws_functions.inc.php

@@ -855,6 +855,10 @@ function ws_images_setPrivacyLevel($params, &$service)
   {
     return new PwgError(401, 'Access denied');
   }
+  if (!$service->isPost())
+  {
+    return new PwgError(405, "This method requires HTTP POST");
+  }
   $params['image_id'] = array_map( 'intval',$params['image_id'] );
   if ( empty($params['image_id']) )
   {
@@ -865,6 +869,7 @@ function ws_images_setPrivacyLevel($params, &$service)
   {
     return new PwgError(WS_ERR_INVALID_PARAM, "Invalid level");
   }
+
   $query = '
 UPDATE '.IMAGES_TABLE.'
   SET level='.(int)$params['level'].'

template-common/scripts.js

@@ -111,8 +111,9 @@ PwgWS.prototype = {
 		}
 		this.transport.onreadystatechange = this.onStateChange.pwgBind(this);
 
-		var url = this.urlRoot;
+		var url = this.urlRoot+"ws.php?format=json";
-		url += "ws.php?format=json&method="+method;
+
+		var body = "method="+method;
 		if (parameters)
 		{
 			for (var property in parameters)
@@ -120,14 +121,25 @@ PwgWS.prototype = {
 				if ( typeof parameters[property] == 'object' && parameters[property])
 				{
 					for (var i=0; i<parameters[property].length; i++)
-						url += "&"+property+"[]="+encodeURIComponent(parameters[property][i]);
+						body += "&"+property+"[]="+encodeURIComponent(parameters[property][i]);
 				}
 				else
-					url += "&"+property+"="+encodeURIComponent(parameters[property]);
+					body += "&"+property+"="+encodeURIComponent(parameters[property]);
 			}
 		}
-		this.transport.open(this.options.method, url, this.options.async);
+
-		this.transport.send(null);
+		if (this.options.method == "POST" )
+		{
+			this.transport.open(this.options.method, url, this.options.async);
+			this.transport.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
+			this.transport.send(body);
+		}
+		else
+		{
+			url += "&"+body;
+			this.transport.open(this.options.method, url, this.options.async);
+			this.transport.send(null);
+		}
 	},
 
 	onStateChange: function() {

template/yoga/picture.tpl

@@ -214,6 +214,7 @@ var y = new PwgWS(rootUrl);
 y.callService(
 	"pwg.images.setPrivacyLevel", {image_id: id, level:level} ,
 	{
+		method: "POST",
 		onFailure: function(num, text) { selectElement.disabled = false; alert(num + " " + text); },
 		onSuccess: function(result) { selectElement.disabled = false; }
 	}

ws.php

@@ -136,7 +136,7 @@ function ws_addDefaultMethods( $arr )
       'image_id' => array('flags'=>WS_PARAM_FORCE_ARRAY),
       'level' => array('maxValue'=>$conf['available_permission_levels']),
       ),
-    'sets the privacy levels for the images'
+    'sets the privacy levels for the images (POST method only)'
     );
 
   $service->addMethod('pwg.session.getStatus', 'ws_session_getStatus', null, '' );