3 files changed, 93 insertions, 73 deletions

diff --git a/mod/blog/actions/blog/auto_save_revision.php b/mod/blog/actions/blog/auto_save_revision.php
index a67939e9f..e33edfaab 100644
--- a/mod/blog/actions/blog/auto_save_revision.php
+++ b/mod/blog/actions/blog/auto_save_revision.php
@@ -3,15 +3,11 @@
  * Action called by AJAX periodic auto saving when editing.
  *
  * @package Blog
- * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
- * @author Curverider Ltd
- * @copyright Curverider Ltd 2008-2010
- * @link http://elgg.org/
  */
 
 $guid = get_input('guid');
-$user = get_loggedin_user();
-$title = get_input('title');
+$user = elgg_get_logged_in_user_entity();
+$title = htmlspecialchars(get_input('title', '', false), ENT_QUOTES, 'UTF-8');
 $description = get_input('description');
 $excerpt = get_input('excerpt');
 
@@ -41,9 +37,12 @@ if ($title && $description) {
 		$blog->access_id = ACCESS_PRIVATE;
 		$blog->title = $title;
 		$blog->description = $description;
-		$blog->excerpt = blog_make_excerpt($excerpt);
-		// must be present or doesn't show up when metadata sorting.
-		$blog->publish_date = time();
+		$blog->excerpt = elgg_get_excerpt($excerpt);
+
+		// mark this as a brand new post so we can work out the
+		// river / revision logic in the real save action.
+		$blog->new_post = TRUE;
+
 		if (!$blog->save()) {
 			$error = elgg_echo('blog:error:cannot_save');
 		}
@@ -64,7 +63,7 @@ if ($title && $description) {
 		if (!$auto_save) {
 			$annotation_id = $blog->annotate('blog_auto_save', $description);
 		} elseif ($auto_save instanceof ElggAnnotation && $auto_save->value != $description) {
-			$blog->clearAnnotations('blog_auto_save');
+			$blog->deleteAnnotations('blog_auto_save');
 			$annotation_id = $blog->annotate('blog_auto_save', $description);
 		} elseif ($auto_save instanceof ElggAnnotation && $auto_save->value == $description) {
 			// this isn't an error because we have an up to date annotation.
@@ -86,4 +85,5 @@ if ($error) {
 	$msg = elgg_echo('blog:message:saved');
 	$json = array('success' => TRUE, 'message' => $msg, 'guid' => $blog->getGUID());
 	echo json_encode($json);
-}
\ No newline at end of file
+}
+exit;
diff --git a/mod/blog/actions/blog/delete.php b/mod/blog/actions/blog/delete.php
index 8fa1ff889..ca4eb8a7f 100644
--- a/mod/blog/actions/blog/delete.php
+++ b/mod/blog/actions/blog/delete.php
@@ -3,18 +3,20 @@
  * Delete blog entity
  *
  * @package Blog
- * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
- * @author Curverider Ltd
- * @copyright Curverider Ltd 2008-2010
- * @link http://elgg.org/
  */
 
 $blog_guid = get_input('guid');
 $blog = get_entity($blog_guid);
 
 if (elgg_instanceof($blog, 'object', 'blog') && $blog->canEdit()) {
+	$container = get_entity($blog->container_guid);
 	if ($blog->delete()) {
 		system_message(elgg_echo('blog:message:deleted_post'));
+		if (elgg_instanceof($container, 'group')) {
+			forward("blog/group/$container->guid/all");
+		} else {
+			forward("blog/owner/$container->username");
+		}
 	} else {
 		register_error(elgg_echo('blog:error:cannot_delete_post'));
 	}
@@ -22,4 +24,4 @@ if (elgg_instanceof($blog, 'object', 'blog') && $blog->canEdit()) {
 	register_error(elgg_echo('blog:error:post_not_found'));
 }
 
-forward($_SERVER['HTTP_REFERER']);
\ No newline at end of file
+forward(REFERER);
\ No newline at end of file
diff --git a/mod/blog/actions/blog/save.php b/mod/blog/actions/blog/save.php
index eca711f60..82a9e6c51 100644
--- a/mod/blog/actions/blog/save.php
+++ b/mod/blog/actions/blog/save.php
@@ -2,20 +2,25 @@
 /**
  * Save blog entity
  *
+ * Can be called by clicking save button or preview button. If preview button,
+ * we automatically save as draft. The preview button is only available for
+ * non-published drafts.
+ *
+ * Drafts are saved with the access set to private.
+ *
  * @package Blog
- * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
- * @author Curverider Ltd
- * @copyright Curverider Ltd 2008-2010
- * @link http://elgg.org/
  */
 
 // start a new sticky form session in case of failure
-//elgg_make_sticky_form();
+elgg_make_sticky_form('blog');
+
+// save or preview
+$save = (bool)get_input('save');
 
 // store errors to pass along
 $error = FALSE;
-$error_forward_url = $_SERVER['HTTP_REFERER'];
-$user = get_loggedin_user();
+$error_forward_url = REFERER;
+$user = elgg_get_logged_in_user_entity();
 
 // edit or create a new entity
 $guid = get_input('guid');
@@ -26,31 +31,31 @@ if ($guid) {
 		$blog = $entity;
 	} else {
 		register_error(elgg_echo('blog:error:post_not_found'));
-		forward(get_input('forward', $_SERVER['HTTP_REFERER']));
+		forward(get_input('forward', REFERER));
 	}
-	$success_forward_url = get_input('forward', $blog->getURL());
 
 	// save some data for revisions once we save the new edit
-	$revision_value = $blog->description;
-	$new_post = FALSE;
+	$revision_text = $blog->description;
+	$new_post = $blog->new_post;
 } else {
 	$blog = new ElggBlog();
 	$blog->subtype = 'blog';
-	$success_forward_url = get_input('forward');
 	$new_post = TRUE;
 }
 
+// set the previous status for the hooks to update the time_created and river entries
+$old_status = $blog->status;
+
 // set defaults and required values.
 $values = array(
 	'title' => '',
 	'description' => '',
 	'status' => 'draft',
-	'publish_date' => time(),
 	'access_id' => ACCESS_DEFAULT,
 	'comments_on' => 'On',
 	'excerpt' => '',
 	'tags' => '',
-	'container_guid' => ''
+	'container_guid' => (int)get_input('container_guid'),
 );
 
 // fail if a required entity isn't set
@@ -58,7 +63,11 @@ $required = array('title', 'description');
 
 // load from POST and do sanity and access checking
 foreach ($values as $name => $default) {
-	$value = get_input($name, $default);
+	if ($name === 'title') {
+		$value = htmlspecialchars(get_input('title', $default, false), ENT_QUOTES, 'UTF-8');
+	} else {
+		$value = get_input($name, $default);
+	}
 
 	if (in_array($name, $required) && empty($value)) {
 		$error = elgg_echo("blog:error:missing:$name");
@@ -70,20 +79,13 @@ foreach ($values as $name => $default) {
 
 	switch ($name) {
 		case 'tags':
-			if ($value) {
-				$values[$name] = string_to_tag_array($value);
-			} else {
-				unset ($values[$name]);
-			}
+			$values[$name] = string_to_tag_array($value);
 			break;
 
 		case 'excerpt':
 			if ($value) {
-				$value = blog_make_excerpt($value);
-			} else {
-				$value = blog_make_excerpt($values['description']);
+				$values[$name] = elgg_get_excerpt($value);
 			}
-			$values[$name] = $value;
 			break;
 
 		case 'container_guid':
@@ -99,32 +101,27 @@ foreach ($values as $name => $default) {
 			}
 			break;
 
-		case 'publish_date':
-			if (!$value = strtotime($value)) {
-				$value = time();
-			}
-
-			$values[$name] = $value;
-			break;
-
-		// don't try to set the guid
-		case 'guid':
-			unset($values['guid']);
-			break;
-
 		default:
 			$values[$name] = $value;
 			break;
 	}
 }
 
+// if preview, force status to be draft
+if ($save == false) {
+	$values['status'] = 'draft';
+}
+
+// if draft, set access to private and cache the future access
+if ($values['status'] == 'draft') {
+	$values['future_access'] = $values['access_id'];
+	$values['access_id'] = ACCESS_PRIVATE;
+}
+
 // assign values to the entity, stopping on error.
 if (!$error) {
 	foreach ($values as $name => $value) {
-		if (FALSE === ($blog->$name = $value)) {
-			$error = elgg_echo('blog:error:cannot_save' . "$name=$value");
-			break;
-		}
+		$blog->$name = $value;
 	}
 }
 
@@ -132,19 +129,49 @@ if (!$error) {
 if (!$error) {
 	if ($blog->save()) {
 		// remove sticky form entries
-		elgg_clear_sticky_form();
+		elgg_clear_sticky_form('blog');
 
 		// remove autosave draft if exists
-		$blog->clearAnnotations('blog_auto_save');
+		$blog->deleteAnnotations('blog_auto_save');
 
-		// if this was an edit, create a revision
-		if (!$new_post && $revision_value) {
-			// create a revision annotation
-			$blog->annotate('blog_revision', $revision_value);
+		// no longer a brand new post.
+		$blog->deleteMetadata('new_post');
+
+		// if this was an edit, create a revision annotation
+		if (!$new_post && $revision_text) {
+			$blog->annotate('blog_revision', $revision_text);
 		}
 
 		system_message(elgg_echo('blog:message:saved'));
-		forward($success_forward_url);
+
+		$status = $blog->status;
+
+		// add to river if changing status or published, regardless of new post
+		// because we remove it for drafts.
+		if (($new_post || $old_status == 'draft') && $status == 'published') {
+			add_to_river('river/object/blog/create', 'create', $blog->owner_guid, $blog->getGUID());
+
+			// we only want notifications sent when post published
+			register_notification_object('object', 'blog', elgg_echo('blog:newpost'));
+			elgg_trigger_event('publish', 'object', $blog);
+
+			// reset the creation time for posts that move from draft to published
+			if ($guid) {
+				$blog->time_created = time();
+				$blog->save();
+			}
+		} elseif ($old_status == 'published' && $status == 'draft') {
+			elgg_delete_river(array(
+				'object_guid' => $blog->guid,
+				'action_type' => 'create',
+			));
+		}
+
+		if ($blog->status == 'published' || $save == false) {
+			forward($blog->getURL());
+		} else {
+			forward("blog/edit/$blog->guid");
+		}
 	} else {
 		register_error(elgg_echo('blog:error:cannot_save'));
 		forward($error_forward_url);
@@ -153,12 +180,3 @@ if (!$error) {
 	register_error($error);
 	forward($error_forward_url);
 }
-
-// forward with success or failure
-if ($error) {
-	register_error($error);
-	forward($error_forward_url);
-} else {
-	system_message(elgg_echo('blog:message:saved'));
-	forward($success_forward_url);
-}
\ No newline at end of file