7 files changed, 382 insertions, 15 deletions

diff --git a/check_setup.php b/check_setup.php
new file mode 100644
index 00000000..96dd0f7d
--- /dev/null
+++ b/check_setup.php
@@ -0,0 +1,40 @@
+<?php
+
+// PHP 5.3 minimum
+if (version_compare(PHP_VERSION, '5.3.3', '<')) {
+    die('This software require PHP 5.3.3 minimum');
+}
+
+// Short tags must be enabled for PHP < 5.4
+if (version_compare(PHP_VERSION, '5.4.0', '<')) {
+
+    if (! ini_get('short_open_tag')) {
+        die('This software require to have short tags enabled, check your php.ini => "short_open_tag = On"');
+    }
+}
+
+// Check PDO Sqlite
+if (! extension_loaded('pdo_sqlite')) {
+    die('PHP extension required: pdo_sqlite');
+}
+
+// Check ZIP
+if (! extension_loaded('zip')) {
+    die('PHP extension required: zip');
+}
+
+// Check if /cache is writeable
+if (! is_writable('cache')) {
+    die('The directory "cache" must be writeable by your web server user');
+}
+
+// Check if /db is writeable
+if (! is_writable('db')) {
+    die('The directory "db" must be writeable by your web server user');
+}
+
+// install folder still present, need to install wallabag
+if (is_dir('install')) {
+    require('install/index.php');
+    exit;
+}
\ No newline at end of file
diff --git a/inc/poche/Database.class.php b/inc/poche/Database.class.php
index 58583bf5..3332b5a3 100644
--- a/inc/poche/Database.class.php
+++ b/inc/poche/Database.class.php
@@ -344,30 +344,36 @@ class Database {
         return $this->getHandle()->lastInsertId($column);
     }
 
-    public function retrieveAllTags() {
-        $sql = "SELECT * FROM tags";
-        $query = $this->executeQuery($sql, array());
+    public function retrieveAllTags($user_id) {
+        $sql = "SELECT tags.* FROM tags
+          LEFT JOIN tags_entries ON tags_entries.tag_id=tags.id
+          LEFT JOIN entries ON tags_entries.entry_id=entries.id
+          WHERE entries.user_id=?";
+        $query = $this->executeQuery($sql, array($user_id));
         $tags = $query->fetchAll();
 
         return $tags;
     }
 
-    public function retrieveTag($id) {
+    public function retrieveTag($id, $user_id) {
         $tag  = NULL;
-        $sql    = "SELECT * FROM tags WHERE id=?";
-        $params = array(intval($id));
+        $sql    = "SELECT tags.* FROM tags
+          LEFT JOIN tags_entries ON tags_entries.tag_id=tags.id
+          LEFT JOIN entries ON tags_entries.entry_id=entries.id
+          WHERE tags.id=? AND entries.user_id=?";
+        $params = array(intval($id), $user_id);
         $query  = $this->executeQuery($sql, $params);
         $tag  = $query->fetchAll();
 
         return isset($tag[0]) ? $tag[0] : null;
     }
 
-    public function retrieveEntriesByTag($tag_id) {
+    public function retrieveEntriesByTag($tag_id, $user_id) {
         $sql = 
             "SELECT entries.* FROM entries
             LEFT JOIN tags_entries ON tags_entries.entry_id=entries.id
-            WHERE tags_entries.tag_id = ?";
-        $query = $this->executeQuery($sql, array($tag_id));
+            WHERE tags_entries.tag_id = ? AND entries.user_id=?";
+        $query = $this->executeQuery($sql, array($tag_id, $user_id));
         $entries = $query->fetchAll();
 
         return $entries;
diff --git a/inc/poche/Poche.class.php b/inc/poche/Poche.class.php
index 76169297..753bd7f0 100644
--- a/inc/poche/Poche.class.php
+++ b/inc/poche/Poche.class.php
@@ -463,6 +463,12 @@ class Poche
             case 'add_tag' :
                 $tags = explode(',', $_POST['value']);
                 $entry_id = $_POST['entry_id'];
+                $entry = $this->store->retrieveOneById($entry_id, $this->user->getId());
+                if (!$entry) {
+                    $this->messages->add('e', _('Article not found!'));
+                    Tools::logm('error : article not found');
+                    Tools::redirect();
+                }
                 foreach($tags as $key => $tag_value) {
                     $value = trim($tag_value);
                     $tag = $this->store->retrieveTagByValue($value);
@@ -487,6 +493,12 @@ class Poche
                 break;
             case 'remove_tag' :
                 $tag_id = $_GET['tag_id'];
+                $entry = $this->store->retrieveOneById($id, $this->user->getId());
+                if (!$entry) {
+                    $this->messages->add('e', _('Article not found!'));
+                    Tools::logm('error : article not found');
+                    Tools::redirect();
+                }
                 $this->store->removeTagForEntry($id, $tag_id);
                 Tools::redirect();
                 break;
@@ -525,6 +537,12 @@ class Poche
                 break;
             case 'edit-tags':
                 # tags
+                $entry = $this->store->retrieveOneById($id, $this->user->getId());
+                if (!$entry) {
+                    $this->messages->add('e', _('Article not found!'));
+                    Tools::logm('error : article not found');
+                    Tools::redirect();
+                }
                 $tags = $this->store->retrieveTagsByEntry($id);
                 $tpl_vars = array(
                     'entry_id' => $id,
@@ -532,8 +550,8 @@ class Poche
                 );
                 break;
             case 'tag':
-                $entries = $this->store->retrieveEntriesByTag($id);
-                $tag = $this->store->retrieveTag($id);
+                $entries = $this->store->retrieveEntriesByTag($id, $this->user->getId());
+                $tag = $this->store->retrieveTag($id, $this->user->getId());
                 $tpl_vars = array(
                     'tag' => $tag,
                     'entries' => $entries,
@@ -541,7 +559,7 @@ class Poche
                 break;
             case 'tags':
                 $token = $this->user->getConfigValue('token');
-                $tags = $this->store->retrieveAllTags();
+                $tags = $this->store->retrieveAllTags($this->user->getId());
                 $tpl_vars = array(
                     'token' => $token,
                     'user_id' => $this->user->getId(),
@@ -1056,7 +1074,7 @@ class Poche
         $feed->setChannelElement('author', 'wallabag');
 
         if ($type == 'tag') {
-            $entries = $this->store->retrieveEntriesByTag($tag_id);
+            $entries = $this->store->retrieveEntriesByTag($tag_id, $user_id);
         }
         else {
             $entries = $this->store->getEntriesByView($type, $user_id);
diff --git a/index.php b/index.php
index 1a595ece..2c81afd6 100644
--- a/index.php
+++ b/index.php
@@ -8,7 +8,8 @@
  * @license    http://www.wtfpl.net/ see COPYING file
  */
 
-define ('POCHE', '1.5.0');
+define ('POCHE', '1.5.1');
+require 'check_setup.php';
 require_once 'inc/poche/global.inc.php';
 session_start(); 
 
diff --git a/install/index.php b/install/index.php
new file mode 100644
index 00000000..d31bad89
--- /dev/null
+++ b/install/index.php
@@ -0,0 +1,283 @@
+<?php
+$errors = array();
+$successes = array();
+if ($_POST['download']) {
+    if (!file_put_contents("cache/vendor.zip", fopen("http://static.wallabag.org/files/vendor.zip", 'r'))) {
+        $errors[] = 'Impossible to download vendor.zip. Please <a href="http://wllbg.org/vendor">download it manually<∕a> and unzip it in your wallabag folder.';
+    }
+    else {
+        if (extension_loaded('zip')) {
+            $zip = new ZipArchive();
+            if ($zip->open("cache/vendor.zip") !== TRUE){
+                $errors[] = 'Impossible to open cache/vendor.zip. Please unzip it manually in your wallabag folder.';
+            }
+            if ($zip->extractTo(realpath(''))) {
+                @unlink("cache/vendor.zip");
+                $successes[] = 'twig is now installed, you can install wallabag.';
+            }
+            else {
+                $errors[] = 'Impossible to extract cache/vendor.zip. Please unzip it manually in your wallabag folder.';
+            }
+            $zip->close();
+        }
+        else {
+            $errors[] = 'zip extension is not enabled in your PHP configuration. Please unzip cache/vendor.zip in your wallabag folder.';
+        }
+    }
+}
+else if ($_POST['install']) {
+    if (!is_dir('vendor')) {
+        $errors[] = 'You must install twig before.';
+    }
+    else {
+        $continue = true;
+        // Create config.inc.php
+        if (!copy('inc/poche/config.inc.php.new', 'inc/poche/config.inc.php')) {
+            $errors[] = 'Installation aborted, impossible to create inc/poche/config.inc.php file. Maybe you don\'t have write access to create it.';
+            $continue = false;
+        }
+        else {
+            function generate_salt() {
+                mt_srand(microtime(true)*100000 + memory_get_usage(true));
+                return md5(uniqid(mt_rand(), true));
+            }
+
+            $content = file_get_contents('inc/poche/config.inc.php');
+            $salt = generate_salt();
+            $content = str_replace("define ('SALT', '');", "define ('SALT', '".$salt."');", $content);
+            file_put_contents('inc/poche/config.inc.php', $content);
+        }
+
+        if ($continue) {
+
+            // User informations
+            $username = trim($_POST['username']);
+            $password = trim($_POST['password']);
+            $salted_password = sha1($password . $username . $salt);
+
+            // Database informations
+            if ($_POST['db_engine'] == 'sqlite') {
+                if (!copy('install/poche.sqlite', 'db/poche.sqlite')) {
+                    $errors[] = 'Impossible to create inc/poche/config.inc.php file.';
+                    $continue = false;
+                }
+                else {
+                    $db_path = 'sqlite:' . realpath('') . '/db/poche.sqlite';
+                    $handle = new PDO($db_path);
+                }
+            }
+            else {
+                $content = file_get_contents('inc/poche/config.inc.php');
+
+                if ($_POST['db_engine'] == 'mysql') {
+                    $db_path = 'mysql:host=' . $_POST['mysql_server'] . ';dbname=' . $_POST['mysql_database'];
+                    $content = str_replace("define ('STORAGE_SERVER', 'localhost');", "define ('STORAGE_SERVER', '".$_POST['mysql_server']."');", $content);
+                    $content = str_replace("define ('STORAGE_DB', 'poche');", "define ('STORAGE_DB', '".$_POST['mysql_database']."');", $content);
+                    $content = str_replace("define ('STORAGE_USER', 'poche');", "define ('STORAGE_USER', '".$_POST['mysql_user']."');", $content);
+                    $content = str_replace("define ('STORAGE_PASSWORD', 'poche');", "define ('STORAGE_PASSWORD', '".$_POST['mysql_password']."');", $content);
+                    $handle = new PDO($db_path, $_POST['mysql_user'], $_POST['mysql_password']); 
+
+                    $sql_structure = file_get_contents('install/mysql.sql');
+                }
+                else if ($_POST['db_engine'] == 'postgresql') {
+                    $db_path = 'pgsql:host=' . $_POST['pg_server'] . ';dbname=' . $_POST['pg_database'];
+                    $content = str_replace("define ('STORAGE_SERVER', 'localhost');", "define ('STORAGE_SERVER', '".$_POST['pg_server']."');", $content);
+                    $content = str_replace("define ('STORAGE_DB', 'poche');", "define ('STORAGE_DB', '".$_POST['pg_database']."');", $content);
+                    $content = str_replace("define ('STORAGE_USER', 'poche');", "define ('STORAGE_USER', '".$_POST['pg_user']."');", $content);
+                    $content = str_replace("define ('STORAGE_PASSWORD', 'poche');", "define ('STORAGE_PASSWORD', '".$_POST['pg_password']."');", $content);
+                    $handle = new PDO($db_path, $_POST['pg_user'], $_POST['pg_password']);
+
+                    $sql_structure = file_get_contents('install/postgres.sql');
+                }
+
+                $content = str_replace("define ('STORAGE', 'sqlite');", "define ('STORAGE', '".$_POST['db_engine']."');", $content);
+                file_put_contents('inc/poche/config.inc.php', $content);
+            }
+
+            if ($continue) {
+
+                function executeQuery($handle, $sql, $params) {
+                    try
+                    {
+                        $query = $handle->prepare($sql);
+                        $query->execute($params);
+                        return $query->fetchAll();
+                    }
+                    catch (Exception $e)
+                    {
+                        return FALSE;
+                    }
+                }
+
+                // create database structure
+                $query = executeQuery($handle, $sql_structure, array());
+
+                // Create user
+                $handle->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+
+                $sql = 'INSERT INTO users (username, password, name) VALUES (?, ?, ?)';
+                $params = array($username, $salted_password, $username);
+                $query = executeQuery($handle, $sql, $params);
+
+                $id_user = $handle->lastInsertId();
+
+                $sql = 'INSERT INTO users_config ( user_id, name, value ) VALUES (?, ?, ?)';
+                $params = array($id_user, 'pager', '10');
+                $query = executeQuery($handle, $sql, $params);
+
+                $sql = 'INSERT INTO users_config ( user_id, name, value ) VALUES (?, ?, ?)';
+                $params = array($id_user, 'language', 'en_EN.UTF8');
+                $query = executeQuery($handle, $sql, $params);
+
+                $successes[] = 'wallabag is now installed. Don\'t forget to delete install folder. Then, <a href="index.php">reload this page</a>.';
+            }
+        }
+    }
+}
+?>
+<!DOCTYPE html>
+<html>
+    <head>
+        <meta name="viewport" content="initial-scale=1.0">
+        <meta charset="utf-8">
+        <!--[if IE]>
+        <meta http-equiv="X-UA-Compatible" content="IE=10">
+        <![endif]-->
+        <title>wallabag — installation</title>
+        <link rel="shortcut icon" type="image/x-icon" href="themes/baggy/img/favicon.ico" />
+        <link rel="apple-touch-icon-precomposed" sizes="144x144" href="themes/baggy/img/apple-touch-icon-144x144-precomposed.png">
+        <link rel="apple-touch-icon-precomposed" sizes="72x72" href="themes/baggy/img/apple-touch-icon-72x72-precomposed.png">
+        <link rel="apple-touch-icon-precomposed" href="themes/baggy/img/apple-touch-icon-precomposed.png">
+        <link href='//fonts.googleapis.com/css?family=PT+Sans:700' rel='stylesheet' type='text/css'>
+        <link rel="stylesheet" href="themes/baggy/css/ratatouille.css" media="all">
+        <link rel="stylesheet" href="themes/baggy/css/font.css" media="all">
+        <link rel="stylesheet" href="themes/baggy/css/main.css" media="all">
+        <link rel="stylesheet" href="themes/baggy/css/messages.css" media="all">
+        <link rel="stylesheet" href="themes/baggy/css/print.css" media="print">
+        <script src="themes/baggy/js/jquery-2.0.3.min.js"></script>
+        <script src="themes/baggy/js/init.js"></script>
+    </head>
+    <body>
+        <header class="w600p center mbm">
+            <h1 class="logo">
+                <img width="100" height="100" src="themes/baggy/img/logo-w.png" alt="logo poche" />
+            </h1>
+        </header>
+        <div id="main">
+            <button id="menu" class="icon icon-menu desktopHide"><span>Menu</span></button>
+            <ul id="links" class="links">
+                <li><a href="http://www.wallabag.org/frequently-asked-questions/">FAQ</a></li>
+                <li><a href="http://doc.wallabag.org/">doc</a></li>
+                <li><a href="http://www.wallabag.org/help/">help</a></li>
+                <li><a href="http://www.wallabag.org/">wallabag.org</a></li>
+            </ul> 
+            <?php if (!empty($errors)) : ?>
+                <div class='messages error'>
+                    <p>Errors during installation:</p>
+                    <p>
+                        <ul>
+                        <?php foreach($errors as $error) :?>
+                            <li><?php echo $error; ?></li>
+                        <?php endforeach; ?>
+                        </ul>
+                    </p>
+                    <p><a href="index.php">Please reload</a> this page when you think you resolved these problems.</p>
+                </div>
+            <?php endif; ?>
+            <?php if (!empty($successes)) : ?>
+                <div class='messages success'>
+                    <p>
+                        <ul>
+                        <?php foreach($successes as $success) :?>
+                            <li><?php echo $success; ?></li>
+                        <?php endforeach; ?>
+                        </ul>
+                    </p>
+                </div>
+            <?php endif; ?>
+            <p>To install wallabag, you just have to fill the following fields. That's all.</p>
+            <p>Don't forget to check your server compatibility <a href="wallabag_compatibility_test.php">here</a>.</p>
+            <form method="post">
+                <fieldset>
+                    <legend><strong>Technical settings</strong></legend>
+                    <?php if (!is_dir('vendor')) : ?>
+                        <div class='messages notice'>wallabag needs twig, a template engine (<a href="http://twig.sensiolabs.org/">?</a>). Two ways to install it: 
+                        <ul>
+                            <li>automatically download and extract vendor.zip into your wallabag folder. 
+                            <p><input type="submit" name="download" value="Download vendor.zip" /></p>
+                            <?php if (!extension_loaded('zip')) : ?>
+                                <b>Be careful, zip extension is not enabled in your PHP configuration. You'll have to unzip vendor.zip manually.</b>
+                            <?php endif; ?>
+                                <em>This method is mainly recommended if you don't have a dedicated server.</em></li>
+                            <li>use <a href="http://getcomposer.org/">Composer</a> :<pre><code>curl -s http://getcomposer.org/installer | php
+php composer.phar install</code></pre></li>
+                        </ul>
+                        </div>
+                    <?php endif; ?>
+                    <p>
+                        Database engine:
+                        <ul>
+                            <li><label for="sqlite">SQLite</label> <input name="db_engine" type="radio" checked="" id="sqlite" value="sqlite" /></li>
+                            <li>
+                                <label for="mysql">MySQL</label> <input name="db_engine" type="radio" id="mysql" value="mysql" />
+                                <ul id="mysql_infos">
+                                    <li><label for="mysql_server">Server</label> <input type="text" placeholder="localhost" id="mysql_server" name="mysql_server" /></li>
+                                    <li><label for="mysql_database">Database</label> <input type="text" placeholder="wallabag" id="mysql_database" name="mysql_database" /></li>
+                                    <li><label for="mysql_user">User</label> <input type="text" placeholder="user" id="mysql_user" name="mysql_user" /></li>
+                                    <li><label for="mysql_password">Password</label> <input type="text" placeholder="p4ssw0rd" id="mysql_password" name="mysql_password" /></li>
+                                </ul>
+                            </li>
+                            <li>
+                                <label for="postgresql">PostgreSQL</label> <input name="db_engine" type="radio" id="postgresql" value="postgresql" />
+                                <ul id="pg_infos">
+                                    <li><label for="pg_server">Server</label> <input type="text" placeholder="localhost" id="pg_server" name="pg_server" /></li>
+                                    <li><label for="pg_database">Database</label> <input type="text" placeholder="wallabag" id="pg_database" name="pg_database" /></li>
+                                    <li><label for="pg_user">User</label> <input type="text" placeholder="user" id="pg_user" name="pg_user" /></li>
+                                  id  <li><label for="pg_password">Password</label> <input type="text" placeholder="p4ssw0rd" id="pg_password" name="pg_password" /></li>
+                                </ul>
+                            </li>
+                        </ul>
+                    </p>
+                </fieldset>
+
+                <fieldset>
+                    <legend><strong>User settings</strong></legend>
+                    <p>
+                        <label for="username">Username</label>
+                        <input type="text" required id="username" name="username" value="wallabag" />
+                    </p>
+                    <p>
+                        <label for="password">Password</label>
+                        <input type="password" required id="password" name="password" value="wallabag" />
+                    </p>
+                    <p>
+                        <label for="show">Show password:</label> <input name="show" id="show" type="checkbox" onchange="document.getElementById('password').type = this.checked ? 'text' : 'password'">
+                    </p>
+                </fieldset>
+
+                <input type="submit" value="Install wallabag" name="install" />
+            </form>
+        </div>
+        <script>
+            $("#mysql_infos").hide();
+            $("#pg_infos").hide();
+            $("input[name=db_engine]").click(function() 
+                {
+                    if ( $("#mysql").prop('checked')) {
+                        $("#mysql_infos").show();
+                        $("#pg_infos").hide();
+                    }
+                    else {
+                        if ( $("#postgresql").prop('checked')) {
+                            $("#mysql_infos").hide();
+                            $("#pg_infos").show();
+                        }
+                        else {
+                            $("#mysql_infos").hide();
+                            $("#pg_infos").hide();
+                        }
+                    }
+                });
+        </script>
+    </body>
+</html>
\ No newline at end of file
diff --git a/themes/baggy/css/messages.css b/themes/baggy/css/messages.css
index e69de29b..0cd89a9e 100755
--- a/themes/baggy/css/messages.css
+++ b/themes/baggy/css/messages.css
@@ -0,0 +1,19 @@
+.messages.error {
+    border: 1px solid #c42608;
+    color: #c00 !important;
+    background: #fff0ef;
+    text-align: left;
+}
+
+.messages.notice {
+    border: 1px solid #ebcd41;
+    color: #000;
+    background: #fffcd3;
+    text-align: left;
+}
+
+.messages.success {
+    border: 1px solid #6dc70c;
+    background: #e0fbcc;
+    text-align: left;
+}
\ No newline at end of file
diff --git a/wallabag_compatibility_test.php b/wallabag_compatibility_test.php
index fd285042..26dce018 100644
--- a/wallabag_compatibility_test.php
+++ b/wallabag_compatibility_test.php
@@ -176,7 +176,7 @@ div.chunk {
                                 <tbody>
                                         <tr class="<?php echo ($php_ok) ? 'enabled' : 'disabled'; ?>">
                                                 <td>PHP</td>
-                                                <td>5.2.0 or higher</td>
+                                                <td>5.3.3 or higher</td>
                                                 <td><?php echo phpversion(); ?></td>
                                         </tr>
                                         <tr class="<?php echo ($xml_ok) ? 'enabled, and sane' : 'disabled, or broken'; ?>">