Index: branches/unlabeled/unlabeled-1.49.2/admin/editor/cmseditor/editor/filemanager/browser/default/connectors/php/commands.php
===================================================================
diff -u -N -r7655 -r7755
--- branches/unlabeled/unlabeled-1.49.2/admin/editor/cmseditor/editor/filemanager/browser/default/connectors/php/commands.php	(.../commands.php)	(revision 7655)
+++ branches/unlabeled/unlabeled-1.49.2/admin/editor/cmseditor/editor/filemanager/browser/default/connectors/php/commands.php	(.../commands.php)	(revision 7755)
@@ -32,28 +32,25 @@
 			$aFolders[] = $sFile;
 			//echo '<Folder name="' . ConvertToXmlAttribute( $sFile ) . '" />' ;
 	}
-	
+
 	if (count($aFolders) > 0) {
 		natcasesort($aFolders);
 		foreach($aFolders AS $k=>$v) {
 			echo '<Folder name="' . ConvertToXmlAttribute($v) . '" />' ;
-		}	
+		}
 	}
-	
-	
+
+
 	closedir( $oCurrentFolder ) ;
 	// Close the "Folders" node.
 	echo "</Folders>" ;
 }
 
-function ValidateSID()
+function ValidateAdminSid()
 {
-	if (isset($Config['K4Mode']))
-		return true;
-	else {
 		$conn = GetADODbConnection();
 		$session_time = GetConfigValue('ses_timeout')+0;
-		$sid = $_COOKIE['admin_sid'];
+			$sid = ($_COOKIE['admin_sid'])?$_COOKIE['admin_sid']:$_COOKIE['sid'];
 		$sql = "SELECT count( sd.sid )
 						FROM session_data AS sd
 						LEFT JOIN sessions AS s ON s.sid = sd.sid
@@ -62,13 +59,36 @@
 						AND sd.sid = '".$sid."'
 						AND s.expire + '".$session_time."' > unix_timestamp()";
 		if ($conn->GetOne($sql) > 0) {
-			return true; 
-		} else {
-			echo "SESSION Validation FALSE";
+			return true;
+}
+function ValidateUserSid()
+{
+			$conn = GetADODbConnection();
+			$session_time = GetConfigValue('ses_timeout')+0;
+			$sid = $_COOKIE['sid'];
+			$sql = "SELECT count( sd.sid )
+							FROM sessions
+							sid = '".$sid."'
+							AND expire + '".$session_time."' > unix_timestamp()";
 		}
+		if ($conn->GetOne($sql) > 0)
+			return true;
+}
+function ValidateSID()
+{ global $Config;
+	if (isset($Config['K4Mode']))
+		return true;
+	else {
+		if ($Config['validate_type'] == 'user')
+			return ValidateUserSid();
+		elseif ($Config['validate_type'] == 'admin')
+			return ValidateAdminSid();
+		else
+			echo "SESSION Validation FALSE";
+
 	}
 	return false;
-}	
+}
 
 function GetCmsTree()
 {
@@ -92,14 +112,21 @@
 	if ($application->isModuleEnabled('Proj-CMS')) {
 		$lang = $application->GetVar('m_lang');
 
-		$query = 'SELECT CategoryId, NamedParentPath, l'.$lang.'_Title AS Title FROM '.TABLE_PREFIX.'Category ORDER By l'.$lang.'_Title';
-		$pages = $application->Conn->Query($query);
+		$st =& $application->recallObject('st.-dummy');
+		$st_options = $application->getUnitOption('st'.'.ParentId', 'Fields');
+		$pages = $st_options['options'];
+		$page_ids = array_keys($pages);
+		$tpls = $application->Conn->GetCol('SELECT NamedParentPath, CategoryId FROM '.TABLE_PREFIX.'Category WHERE CategoryId IN ('.join(',', $page_ids).')', 'CategoryId');
 
+//		$query = 'SELECT CategoryId, NamedParentPath, l'.$lang.'_Name AS Title FROM '.TABLE_PREFIX.'Category ORDER By l'.$lang.'_Title';
+//		$pages = $application->Conn->Query($query);
+
 		$res = '';
-		foreach ($pages as $page) {
-			$page_path = preg_replace('/^content\//', '', strtolower($page['NamedParentPath']).'.html');
-			$title = $page['Title'].' ('.$page_path.')';
-			$res .= '<CmsPage path="'.$page_path.'" title="'.$prefix.htmlspecialchars($title,ENT_QUOTES).'" st_id="'.$page['CategoryId'].'" serverpath="'.BASE_PATH.'/" />';
+		foreach ($pages as $id => $title) {
+			$page_path = preg_replace('/^content\//', '', strtolower($tpls[$id]).'.html');
+			$title = $title.' ('.$page_path.')';
+			$real_url = $application->HREF($tpls[$id], '', null, 'index.php');
+			$res .= '<CmsPage real_url="'.$real_url.'" path="@@'.$id.'@@" title="'.$prefix.htmlspecialchars($title,ENT_QUOTES).'" st_id="'.$id.'" serverpath="" />';
 		}
 	}
 	else {
@@ -127,7 +154,6 @@
 	if ($rs && !$rs->EOF)
 	{
 		$default_lang_prefix = $rs->fields['value'];
-		$lang_prefix = GetLangFromSid();
 	}
 	$query = "SELECT value FROM config WHERE name = 'cms_direct_mode'";
 	$rs = $conn->Execute($query);
@@ -160,11 +186,12 @@
 	if (!$system_tpl_ids)
 	    $system_tpl_ids = '0';
 	if ( $cms_mode == 1 ) {
+		//$lang_prefix = $this->Application->GetVar('lang_prefix');
 		$query = "
 			SELECT st.*,
-				IF(lb.".$lang_prefix."_content='' OR lb.".$lang_prefix."_content IS NULL,
+				IF(lb.".$default_lang_prefix."_content='' OR lb.".$default_lang_prefix."_content IS NULL,
 				st.st_path,
-				lb.".$lang_prefix."_content
+				lb.".$default_lang_prefix."_content
 				) AS page_title
 			FROM
 				structure_templates AS st
@@ -191,8 +218,7 @@
 				working_blocks AS wb
 			ON
 				(st.st_id = wb.template_id) AND (wb.block_type = 3)
-			WHERE
-					st.st_parent_id = ".$st_id."
+			WHERE		st.st_parent_id = ".$st_id."
 				AND st_id != ".$email_templates_folder_id."
 				AND st.st_id NOT IN ($system_tpl_ids)
 				AND st_path != '/cms%' " . $filter . "
@@ -211,7 +237,7 @@
 				$prefix .= '--';
 			if ($level > 0)
 				$prefix=$prefix.'- ';
-/*				
+/*
 			$page = ereg_replace("&","&amp;",$rs->fields['page_title']);
 			$page = ereg_replace("\"","&quot;",$page);
 			$page = ereg_replace("'","&#039;",$page);
@@ -252,12 +278,13 @@
 
 function GetFoldersAndFiles( $resourceType, $currentFolder, $aParams = array('name','asc'))
 {
+	global $Config ;
 	// Map the virtual path to the local server path.
 	if (isset($Config['K4Mode']))
 		$date_format = "m/d/Y h:i A";
-	else 
+	else
 		$date_format = GetConfigValue('date_format').' '.GetConfigValue('time_format');
-	
+
 	$sServerDir = ServerMapFolder( $resourceType, $currentFolder ) ;
 	// Initialize the output buffers for "Folders" and "Files".
 	$aFolders = array();
@@ -280,7 +307,7 @@
 				{
 					$size = round( $iFileSize / 1024 );
 					$aFileSizes[] = ($size < 1)? 1:$size;//  round( $iFileSize / 1024 ) ;
-				} else 
+				} else
 					$aFileSizes[] = $iFileSize;
 					$aFiles[] = $sFile;
 					$aFileDate[] = filectime($sServerDir.$sFile);
@@ -298,11 +325,11 @@
 		}
 		foreach($aFolders AS $k=>$v) {
 			$sFolders .= '<Folder name="' . ConvertToXmlAttribute($v) . '" />' ;
-		}	
+		}
 	}
 	if (count($aFiles) > 0) {
-		if ($aParams[0] == 'name') 
-		{	
+		if ($aParams[0] == 'name')
+		{
 			natcasesort($aFiles);
 			if ($aParams[1] == 'desc')
 			{
@@ -330,7 +357,7 @@
 				$sFiles	.= '<File name="' . ConvertToXmlAttribute( $aFiles[$fk] ) . '" size="' . $aFileSizes[$fk] . '" date="' . date($date_format,$fv) . '" />' ;
 			}
 		}
-	}		
+	}
 /*	while ( $sFile = readdir( $oCurrentFolder ) )
 	{
 		if ( $sFile != '.' && $sFile != '..'  && $sFile != 'CVS')
@@ -348,8 +375,8 @@
 				$sFiles	.= '<File name="' . ConvertToXmlAttribute( $sFile ) . '" size="' . $iFileSize . '" />' ;
 			}
 		}
-*/		
-		
+*/
+
 	if ($aParams[1] == "desc")
 	{
 		echo $sFiles ;
@@ -418,7 +445,7 @@
 		$sql = "UPDATE live_blocks SET ".$lang_prefix."_content = replace(".$lang_prefix."_content,'".$original_str."','".$new_str."')";
 		$conn->Execute($sql);
 	}
-	
+
 }
 
 function RenameFile( $resourceType, $currentFolder , $aFilenames = array())
@@ -433,15 +460,15 @@
 		{
 			$sErrorNumber = '204' ;
 		} else {
-			if ( ( count($arAllowed) == 0 || in_array( $sExtension, $arAllowed ) ) && ( count($arDenied) == 0 || !in_array( $sExtension, $arDenied ) ) )
+			if ( ( count($arAllowed) == 0 || in_array( strtolower($sExtension), $arAllowed ) ) && ( count($arDenied) == 0 || !in_array( strtoupper($sExtension), $arDenied ) ) )
 			{
 				if (rename($sServerDir.$aFilenames[0],$sServerDir.$aFilenames[1])) {
 					if (isset($Config['K4Mode'])) {
 							// Update CMS Blocks
 					} else
 						UpdateCmsBlocksK3($resourceType,$currentFolder,$aFilenames[0],$aFilenames[1]);
 					$sErrorNumber = "0";
-				} else 
+				} else
 					$sErrorNumber = '205' ;
 			} else
 				$sErrorNumber = '203' ;
@@ -463,7 +490,7 @@
 		// Get the uploaded file name.
 		$sFileName = $oFile['name'] ;
 		$sOriginalFileName = $sFileName ;
-		$sExtension = substr( $sFileName, ( strrpos($sFileName, '.') + 1 ) ) ;
+		$sExtension = strtolower(substr( $sFileName, ( strrpos($sFileName, '.') + 1 ) ) );
 		global $Config ;
 		$arAllowed	= $Config['AllowedExtensions'][$resourceType] ;
 		$arDenied	= $Config['DeniedExtensions'][$resourceType] ;
@@ -522,19 +549,19 @@
 		return;
 	$conn = GetADODbConnection();
 	$aLangs = array();
-	$multilang = GetConfigValue('multilingual_mode'); 
+	$multilang = GetConfigValue('multilingual_mode');
 	$def_lang_prefix = GetConfigValue('default_lang_prefix');
-	if ($multilang) 
+	if ($multilang)
 	{
 		$query="SELECT lang_prefix FROM lang ORDER BY lang_id";
 		$rs = $conn->Execute($query);
 		while ($rs && !$rs->EOF) {
 			$aLangs[] = $rs->fields['lang_prefix'];
 			$rs->MoveNext();
-		} 
-	} else 
+		}
+	} else
 			$aLangs[] = $def_lang_prefix;
-	$sErrorNumber = 230;		
+	$sErrorNumber = 230;
 	if ($confirm == 1) {
 		DeleteConfirmedFiles($resourceType, $currentFolder, $aFiles);
 		echo '<Error number="100" originalDescription="" />' ;
@@ -546,9 +573,9 @@
 				continue;
 			$deleted_file = $Config['UserFilesPathNoBase'].$resourceType.$currentFolder.addslashes($v);
 			for($i=0; $i<count($aLangs); $i++)
-				$add_sql.= " lb1.".$aLangs[$i]."_content LIKE '%".$deleted_file."%' OR"; 
-	
-			if (strlen($add_sql) > 0) { 
+				$add_sql.= " lb1.".$aLangs[$i]."_content LIKE '%".$deleted_file."%' OR";
+
+			if (strlen($add_sql) > 0) {
 				$add_sql = rtrim($add_sql," OR");
 				$sql = "SELECT lb1.template_id, lb2.".$def_lang_prefix."_content FROM live_blocks AS lb1
 								LEFT JOIN live_blocks AS lb2 ON lb2.template_id = lb1.template_id AND lb2.block_num = 20
@@ -560,7 +587,7 @@
 						$page = @html_entity_decode($page,ENT_NOQUOTES,'UTF-8');
 						$page = @htmlspecialchars($page);
 						$ret_xml.= '<Error number="' . $sErrorNumber . '" originalDescription="' . ConvertToXmlAttribute("File '".$v."'; Template: '".$page."'") . '" />' ;
-						$rs->MoveNext();	
+						$rs->MoveNext();
 					}
 			}
 		}
@@ -571,15 +598,8 @@
 			echo '<Error number="100" originalDescription="" />' ;
 		}
 	}
-}
 
 
-function GetLangFromSid() {
-	$sid = $_COOKIE['admin_sid'];
-	$conn = GetADODbConnection();
-	$sql = "SELECT value FROM session_data WHERE name = 'old_translation_language' AND sid = $sid";
-	$translation_language = $conn->GetOne($sql);
-	return $translation_language; 
 }
 
 ?>