Index: branches/5.2.x/core/units/forms/form_submissions/form_submissions_eh.php
===================================================================
diff -u -N -r14585 -r14614
--- branches/5.2.x/core/units/forms/form_submissions/form_submissions_eh.php	(.../form_submissions_eh.php)	(revision 14585)
+++ branches/5.2.x/core/units/forms/form_submissions/form_submissions_eh.php	(.../form_submissions_eh.php)	(revision 14614)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: form_submissions_eh.php 14585 2011-09-24 12:04:17Z alex $
+* @version	$Id: form_submissions_eh.php 14614 2011-10-03 16:04:13Z alex $
 * @package	In-Portal
 * @copyright	Copyright (C) 1997 - 2009 Intechnic. All rights reserved.
 * @license      GNU/GPL
@@ -16,7 +16,14 @@
 
 	class FormSubmissionsEventHandler extends kDBEventHandler {
 
-		function CheckPermission(&$event)
+		/**
+		 * Checks user permission to execute given $event
+		 *
+		 * @param kEvent $event
+		 * @return bool
+		 * @access public
+		 */
+		public function CheckPermission(&$event)
 		{
 			if (!$this->Application->isAdmin) {
 				if ($event->Name == 'OnCreate') {
@@ -65,6 +72,7 @@
 				'password' => 'grid_like_filter',
 				'textarea' => 'grid_like_filter',
 				'label' => 'grid_like_filter',
+				'upload' => 'grid_empty_filter',
 			);
 
 			return $mapping[$element_type];
@@ -116,6 +124,10 @@
 						'filter_block' => $this->_getFilterBlock($options['ElementType'])
 					);
 
+					if ($options['ElementType'] == 'upload') {
+						$conf_grids['Default']['Fields']['fld_' . $field_id]['data_block'] = 'grid_upload_td';
+					}
+
 					if ($options['Validation'] == 1) {
 						$conf_grids['Default']['Fields']['fld_' . $field_id]['data_block'] = 'grid_email_td';
 					}
@@ -138,18 +150,40 @@
 					$field_options['verify_field'] = 'fld_' . $field_id . '_verify';
 				}
 
+				if ($options['ElementType'] == 'upload') {
+					$field_options['formatter'] = 'kUploadFormatter';
+					$field_options['upload_dir'] = WRITEBALE_BASE . DIRECTORY_SEPARATOR . 'user_files' . DIRECTORY_SEPARATOR . 'form_submissions';
+
+					if ( $options['UploadMaxSize'] ) {
+						$field_options['max_size'] = $options['UploadMaxSize'] * 1024; // convert Kbytes to bytes
+					}
+
+					if ( $options['UploadExtensions'] ) {
+						$field_options['file_types'] = '*.' . implode(';*.', explode(',', $options['UploadExtensions']));
+					}
+				}
+
 				$conf_fields['fld_' . $field_id] = $field_options;
 			}
 
 			$this->Application->setUnitOption($event->Prefix, 'Fields', $conf_fields);
 			$this->Application->setUnitOption($event->Prefix, 'Grids', $conf_grids);
 		}
 
-		function SetCustomQuery(&$event)
+		/**
+		 * Apply any custom changes to list's sql query
+		 *
+		 * @param kEvent $event
+		 * @return void
+		 * @access protected
+		 * @see kDBEventHandler::OnListBuild()
+		 */
+		protected function SetCustomQuery(&$event)
 		{
 			$object =& $event->getObject();
-			$form_id = $this->Application->GetVar('form_id');
-			$object->addFilter('form_filter','%1$s.FormId = '.$form_id);
+			/* @var $object kDBList */
+
+			$object->addFilter('form_filter', '%1$s.FormId = ' . (int)$this->Application->GetVar('form_id'));
 		}
 
 		/**
@@ -193,7 +227,25 @@
 			// allows user to view only it's last submission
 			$this->Application->StoreVar('last_submission_id', $object->GetID());
 
-			$this->Application->EmailEventAdmin('FORM.SUBMITTED');
+			$form_submission_helper =& $this->Application->recallObject('FormSubmissionHelper');
+			/* @var $form_submission_helper FormSubmissionHelper */
+
+			$form =& $form_submission_helper->getForm($object);
+
+			$notify_email = $form->GetDBField('SubmitNotifyEmail');
+
+			if ($notify_email) {
+				$send_params = Array (
+					'to_name' => $notify_email,
+					'to_email' => $notify_email,
+				);
+
+				$this->Application->EmailEventAdmin('FORM.SUBMITTED', null, $send_params);
+			}
+			else {
+				$this->Application->EmailEventAdmin('FORM.SUBMITTED');
+			}
+
 //			$this->Application->EmailEventUser('FORM.SUBMITTED', null, 'to_email' => '');
 
 			$event->SetRedirectParam('opener', 's');
@@ -202,7 +254,7 @@
 			$theme =& $this->Application->recallObject('theme.current');
 			/* @var $theme kDBItem */
 
-			$template = $this->Application->GetVar('success_template');
+			$template = kUtil::unhtmlentities( $this->Application->GetVar('success_template') ); // kHTTPQuery do htmlspecialchars on everything
 			$alias_template = $theme->GetField('TemplateAliases', $template);
 
 			$event->redirect = $alias_template ? $alias_template : $template;
@@ -212,8 +264,10 @@
 		 * Processes Captcha code
 		 *
 		 * @param kEvent $event
+		 * @return void
+		 * @access protected
 		 */
-		function OnBeforeItemCreate(&$event)
+		protected function OnBeforeItemCreate(&$event)
 		{
 			parent::OnBeforeItemCreate($event);
 
@@ -225,7 +279,7 @@
 			if ( !$object->GetDBField('ReferrerURL') ) {
 				$referrer = $this->Application->GetVar('original_referrer');
 
-				if (!$referrer) {
+				if ( !$referrer ) {
 					$base_url = preg_quote($this->Application->BaseURL(), '/');
 					$referrer = preg_replace('/^' . $base_url . '/', '/', $_SERVER['HTTP_REFERER'], 1);
 				}
@@ -239,7 +293,7 @@
 			$form =& $form_submission_helper->getForm($object);
 
 			// validate captcha code
-			if ($form->GetDBField('UseSecurityImage') && !$this->Application->LoggedIn()) {
+			if ( $form->GetDBField('UseSecurityImage') && !$this->Application->LoggedIn() ) {
 				$captcha_helper =& $this->Application->recallObject('CaptchaHelper');
 				/* @var $captcha_helper kCaptchaHelper */
 
@@ -251,8 +305,10 @@
 		 * Checks, that target submission was selected for merging
 		 *
 		 * @param kEvent $event
+		 * @return void
+		 * @access protected
 		 */
-		function OnBeforeItemUpdate(&$event)
+		protected function OnBeforeItemUpdate(&$event)
 		{
 			parent::OnBeforeItemUpdate($event);
 
@@ -319,8 +375,10 @@
 		 * Fills merge-to dropdown
 		 *
 		 * @param kEvent $event
+		 * @return void
+		 * @access protected
 		 */
-		function OnAfterItemLoad(&$event)
+		protected function OnAfterItemLoad(&$event)
 		{
 			parent::OnAfterItemLoad($event);
 
@@ -382,9 +440,7 @@
 				$options[$submission_id] = $option_title;
 			}
 
-			$field_options = $object->GetFieldOptions('MergeToSubmission');
-			$field_options['options'] = $options;
-			$object->SetFieldOptions('MergeToSubmission', $field_options);
+			$object->SetFieldOption('MergeToSubmission', 'options', $options);
 		}
 
 		/**