'. t('To create a new content type, enter the human-readable name, the machine-readable name, and all other relevant fields that are on this page. Once created, users of your site will be able to create posts that are instances of this content type.') .'
'; } - if (arg(0) == 'node' && is_numeric(arg(1)) && arg(2) == 'revisions') { + if (arg(0) == 'node' && is_numeric(arg(1)) && arg(2) == 'revisions' && arg(3) == NULL) { return ''. t('The revisions let you track differences between multiple versions of a post.') .'
'; } @@ -1195,11 +1195,26 @@ function node_menu($may_cache) { 'weight' => 1, 'type' => MENU_CALLBACK); $revisions_access = ((user_access('view revisions') || user_access('administer nodes')) && node_access('view', $node) && db_result(db_query('SELECT COUNT(vid) FROM {node_revisions} WHERE nid = %d', arg(1))) > 1); - $items[] = array('path' => 'node/'. arg(1) .'/revisions', 'title' => t('Revisions'), + $items[] = array( + 'path' => 'node/'. arg(1) .'/revisions', + 'title' => t('Revisions'), 'callback' => 'node_revisions', 'access' => $revisions_access, 'weight' => 2, - 'type' => MENU_LOCAL_TASK); + 'type' => MENU_LOCAL_TASK, + ); + if (!is_null(arg(3))) { + $items[] = array( + 'path' => 'node/'. arg(1) .'/revisions/'. arg(3) .'/delete', + 'callback' => 'node_revision_delete', + 'callback arguments' => array(arg(1), arg(3)), + ); + $items[] = array( + 'path' => 'node/'. arg(1) .'/revisions/'. arg(3) .'/revert', + 'callback' => 'node_revision_revert', + 'callback arguments' => array(arg(1), arg(3)), + ); + } } } @@ -1681,16 +1696,7 @@ function node_revision_revert($nid, $rev $node = node_load($nid, $revision); if ((user_access('revert revisions') || user_access('administer nodes')) && node_access('update', $node)) { if ($node->vid) { - $node->revision = 1; - $node->log = t('Copy of the revision from %date.', array('%date' => format_date($node->revision_timestamp))); - if (module_exists('taxonomy')) { - $node->taxonomy = array_keys($node->taxonomy); - } - - node_save($node); - - drupal_set_message(t('%title has been reverted back to the revision from %revision-date', array('%revision-date' => format_date($node->revision_timestamp), '%title' => $node->title))); - watchdog('content', t('@type: reverted %title revision %revision.', array('@type' => t($node->type), '%title' => $node->title, '%revision' => $revision))); + return drupal_get_form('node_revision_revert_confirm', $node); } else { drupal_set_message(t('You tried to revert to an invalid revision.'), 'error'); @@ -1701,6 +1707,31 @@ function node_revision_revert($nid, $rev } /** + * Ask for confirmation of the reversion to prevent against CSRF attacks. + */ +function node_revision_revert_confirm($node) { + $form['node'] = array('#type' => 'value', '#value' => $node); + return confirm_form($form, t('Are you sure you want to revert to the revision from %revision-date?', array('%revision-date' => format_date($node->revision_timestamp))), 'node/'. $node->nid .'/revisions', '', t('Revert'), t('Cancel')); +} + +function node_revision_revert_confirm_submit($form_id, $form_values) { + $node = $form_values['node']; + + $node->revision = 1; + $node->log = t('Copy of the revision from %date.', array('%date' => format_date($node->revision_timestamp))); + if (module_exists('taxonomy')) { + $node->taxonomy = array_keys($node->taxonomy); + } + + node_save($node); + + drupal_set_message(t('%title has been reverted back to the revision from %revision-date', array('%revision-date' => format_date($node->revision_timestamp), '%title' => $node->title))); + watchdog('content', t('@type: reverted %title revision %revision.', array('@type' => t($node->type), '%title' => $node->title, '%revision' => $revision))); + + return 'node/'. $node->nid .'/revisions'; +} + +/** * Delete the revision with specified revision number. A "delete revision" nodeapi event is invoked when a * revision is deleted. */ @@ -1710,22 +1741,22 @@ function node_revision_delete($nid, $rev if (node_access('delete', $node)) { // Don't delete the current revision if ($revision != $node->vid) { - $node = node_load($nid, $revision); - - db_query("DELETE FROM {node_revisions} WHERE nid = %d AND vid = %d", $nid, $revision); - node_invoke_nodeapi($node, 'delete revision'); - drupal_set_message(t('Deleted %title revision %revision.', array('%title' => $node->title, '%revision' => $revision))); - watchdog('content', t('@type: deleted %title revision %revision.', array('@type' => t($node->type), '%title' => $node->title, '%revision' => $revision))); + if ($node = node_load($nid, $revision)) { + return drupal_get_form('node_revision_delete_confirm', $node); + } + else { + drupal_set_message(t('Deletion failed. You tried to delete a non-existing revision.')); + } } - else { drupal_set_message(t('Deletion failed. You tried to delete the current revision.')); } + if (db_result(db_query('SELECT COUNT(vid) FROM {node_revisions} WHERE nid = %d', $nid)) > 1) { - drupal_goto("node/$nid/revisions"); + drupal_goto('node/'. $nid .'/revisions'); } else { - drupal_goto("node/$nid"); + drupal_goto('node/'. $nid); } } } @@ -1734,6 +1765,29 @@ function node_revision_delete($nid, $rev } /** + * Ask confirmation for revision deletion to prevent against CSRF attacks. + */ +function node_revision_delete_confirm($node) { + $form['node'] = array('#type' => 'value', '#value' => $node); + return confirm_form($form, t('Are you sure you want to delete the revision from %revision-date?', array('%revision-date' => format_date($node->revision_timestamp))), 'node/'. $node->nid .'/revisions', t('This action cannot be undone.'), t('Delete'), t('Cancel')); +} + +function node_revision_delete_confirm_submit($form_id, $form_values) { + $node = $form_values['node']; + db_query("DELETE FROM {node_revisions} WHERE nid = %d AND vid = %d", $node->nid, $node->vid); + node_invoke_nodeapi($node, 'delete revision'); + drupal_set_message(t('Deleted %title revision %revision.', array('%title' => $node->title, '%revision' => $node->vid))); + watchdog('content', t('@type: deleted %title revision %revision.', array('@type' => t($node->type), '%title' => $node->title, '%revision' => $node->vid))); + + if (db_result(db_query('SELECT COUNT(vid) FROM {node_revisions} WHERE nid = %d', $node->nid)) > 1) { + return 'node/'. $node->nid .'/revisions'; + } + else { + return 'node/'. $node->nid; + } +} + +/** * Return a list of all the existing revision numbers. */ function node_revision_list($node) { @@ -2355,12 +2409,6 @@ function node_revisions() { } } break; - case 'revert': - node_revision_revert(arg(1), arg(3)); - break; - case 'delete': - node_revision_delete(arg(1), arg(3)); - break; } } drupal_not_found();