issue #552

* many more admin actions are logged into activity table
* use the activity.details as an associative array (serialized in database)

admin/batch_manager_global.php

@@ -277,6 +277,8 @@ DELETE
       array('primary' => array('id'), 'update' => array('author')),
       $datas
       );
+
+    pwg_activity('photo', $collection, 'edit', array('action'=>'author'));
   }
 
   // title
@@ -301,6 +303,8 @@ DELETE
       array('primary' => array('id'), 'update' => array('name')),
       $datas
       );
+
+    pwg_activity('photo', $collection, 'edit', array('action'=>'title'));
   }
 
   // date_creation
@@ -329,6 +333,8 @@ DELETE
       array('primary' => array('id'), 'update' => array('date_creation')),
       $datas
       );
+
+    pwg_activity('photo', $collection, 'edit', array('action'=>'date_creation'));
   }
 
   // privacy_level
@@ -349,6 +355,8 @@ DELETE
       $datas
       );
 
+    pwg_activity('photo', $collection, 'edit', array('action'=>'privacy_level'));
+
     if (isset($_SESSION['bulk_manager_filter']['level']))
     {
       if ($_POST['level'] < $_SESSION['bulk_manager_filter']['level'])

admin/cat_options.php

@@ -34,6 +34,14 @@ include_once(PHPWG_ROOT_PATH.'admin/include/tabsheet.class.php');
 // +-----------------------------------------------------------------------+
 check_status(ACCESS_ADMINISTRATOR);
 
+if (!empty($_POST))
+{
+  check_pwg_token();
+  check_input_parameter('cat_true', $_POST, true, PATTERN_ID);
+  check_input_parameter('cat_false', $_POST, true, PATTERN_ID);
+  check_input_parameter('section', $_GET, false, '/^[a-z0-9_-]+$/i');
+}
+
 // +-----------------------------------------------------------------------+
 // |                       modification registration                       |
 // +-----------------------------------------------------------------------+
@@ -43,8 +51,6 @@ if (isset($_POST['falsify'])
     and isset($_POST['cat_true'])
     and count($_POST['cat_true']) > 0)
 {
-  check_pwg_token();
-  check_input_parameter('cat_true', $_POST, true, PATTERN_ID);
   switch ($_GET['section'])
   {
     case 'comments' :
@@ -78,13 +84,13 @@ UPDATE '.CATEGORIES_TABLE.'
       break;
     }
   }
+
+  pwg_activity('album', $_POST['cat_true'], 'edit', array('section'=>$_GET['section'], 'action'=>'falsify'));
 }
 else if (isset($_POST['trueify'])
          and isset($_POST['cat_false'])
          and count($_POST['cat_false']) > 0)
 {
-  check_pwg_token();
-  check_input_parameter('cat_false', $_POST, true, PATTERN_ID);
   switch ($_GET['section'])
   {
     case 'comments' :
@@ -115,6 +121,8 @@ UPDATE '.CATEGORIES_TABLE.'
       break;
     }
   }
+
+  pwg_activity('album', $_POST['cat_false'], 'edit', array('section'=>$_GET['section'], 'action'=>'trueify'));
 }
 
 // +-----------------------------------------------------------------------+

admin/group_list.php

@@ -86,6 +86,9 @@ INSERT INTO '.GROUPS_TABLE.'
     pwg_query($query);
 
     $page['infos'][] = l10n('group "%s" added', $_POST['groupname']);
+
+    $inserted_id = pwg_db_insert_id(GROUPS_TABLE);
+    pwg_activity('group', $inserted_id, 'add');
   }
 }
 
@@ -130,6 +133,7 @@ SELECT name
         WHERE id = '.$group.'
       ;';
         pwg_query($query);
+        pwg_activity('group', $group, 'edit', array('action'=>$action));
       }
     }
   }
@@ -177,6 +181,7 @@ SELECT name
       pwg_query($query);
 
       trigger_notify('delete_group', $groupids);
+      pwg_activity('group', $groupids, 'delete');
 
       $page['infos'][] = l10n('group "%s" deleted', $groupname);
     }
@@ -215,6 +220,7 @@ SELECT COUNT(*)
         WHERE name = \''.pwg_db_real_escape_string($_POST['merge']).'\'
       ;';
       list($groupid) = pwg_db_fetch_row(pwg_query($query));
+      pwg_activity('group', $groupid, 'add', array('action'=>$action, 'groups'=>implode(',', $groups)));
     }
     $grp_access = array();
     $usr_grp = array();
@@ -301,6 +307,7 @@ SELECT COUNT(*)
       ;';
       
       list($groupid) = pwg_db_fetch_row(pwg_query($query));
+      pwg_activity('group', $groupid, 'add', array('action'=>$action, 'group'=>$group));
       $query = '
     SELECT *
       FROM '.GROUP_ACCESS_TABLE.'
@@ -360,7 +367,9 @@ SELECT COUNT(*)
       WHERE id = '.$group.'
     ;';
       pwg_query($query);
-    
+
+      pwg_activity('group', $group, 'edit', array('action'=>$action));
+
       $page['infos'][] = l10n('group "%s" updated', $groupname);
     }
   }

admin/include/functions.php

@@ -163,7 +163,7 @@ DELETE FROM '.USER_CACHE_CATEGORIES_TABLE.'
   pwg_query($query);
 
   trigger_notify('delete_categories', $ids);
-  pwg_activity('album', $ids, 'delete', 'photo_deletion_mode='.$photo_deletion_mode);
+  pwg_activity('album', $ids, 'delete', array('photo_deletion_mode'=>$photo_deletion_mode));
 }
 
 /**
@@ -361,6 +361,7 @@ SELECT
   }
 
   trigger_notify('delete_elements', $ids);
+  pwg_activity('photo', $ids, 'delete');
   return count($ids);
 }
 
@@ -416,6 +417,7 @@ DELETE FROM '.USERS_TABLE.'
   pwg_query($query);
 
   trigger_notify('delete_user', $user_id);
+  pwg_activity('user', $user_id, 'delete');
 }
 
 /**
@@ -1423,6 +1425,8 @@ SELECT status
     '%d album moved', '%d albums moved',
     count($categories)
     );
+
+  pwg_activity('album', $category_ids, 'move', array('parent'=>$new_parent));
 }
 
 /**
@@ -1700,6 +1704,7 @@ DELETE
   pwg_query($query);
 
   trigger_notify("delete_tags", $tag_ids);
+  pwg_activity('tag', $tag_ids, 'delete');
 
   update_images_lastmodified($image_ids);
   invalidate_user_cache_nb_tags();
@@ -2226,6 +2231,7 @@ SELECT id
       );
 
     $inserted_id = pwg_db_insert_id(TAGS_TABLE);
+    pwg_activity('tag', $inserted_id, 'add');
 
     return array(
       'info' => l10n('Tag "%s" was added', stripslashes($tag_name)),

admin/include/functions_upload.inc.php

@@ -372,6 +372,7 @@ SELECT
     single_insert(IMAGES_TABLE, $insert);
 
     $image_id = pwg_db_insert_id(IMAGES_TABLE);
+    pwg_activity('photo', $image_id, 'add');
   }
 
   if (isset($categories) and count($categories) > 0)

admin/picture_modify.php

@@ -197,6 +197,7 @@ UPDATE '.CATEGORIES_TABLE.'
   $represented_albums = $_POST['represent'];
 
   $page['infos'][] = l10n('Photo informations updated');
+  pwg_activity('photo', $_GET['image_id'], 'edit');
 }
 
 // tags

admin/site_update.php

@@ -320,6 +320,9 @@ SELECT id_uppercat, MAX(rank)+1 AS next_rank
           $category_up[] = $category['id_uppercat'];
         }
       }
+
+      pwg_activity('album', $category_ids, 'add', array('sync'=>true));
+
       $category_up=implode(',',array_unique($category_up));
       if ($conf['inheritance_by_default'])
       {
@@ -676,6 +679,8 @@ SELECT *
         $insert_links
         );
 
+      pwg_activity('photo', $caddiables, 'add', array('sync'=>true));
+
       // add new photos to caddie
       if (isset($_POST['add_to_caddie']) and $_POST['add_to_caddie'] == 1)
       {

admin/tags.php

@@ -107,6 +107,8 @@ SELECT id, name
       ),
     $updates
     );
+
+  pwg_activity('tag', explode(',', $_POST['edit_list']), 'edit');
 }
 // +-----------------------------------------------------------------------+
 // |                            dulicate tags                              |
@@ -154,14 +156,9 @@ SELECT id, name
             'url_name' => trigger_change('render_tag_url', $tag_name),
             )
           );
+        $destination_tag_id = pwg_db_insert_id(TAGS_TABLE);
 
-        $query = '
-        SELECT id
-          FROM '.TAGS_TABLE.'
-          WHERE name = \''.$tag_name.'\'
-        ;';
-        $destination_tag = array_from_query($query, 'id');
-        $destination_tag_id = $destination_tag[0];
+        pwg_activity('tag', $destination_tag_id, 'add', array('action'=>'duplicate', 'source_tag'=>$tag_id));
 
         $query = '
         SELECT

include/functions.inc.php

@@ -511,7 +511,7 @@ INSERT INTO '.HISTORY_TABLE.'
   return true;
 }
 
-function pwg_activity($object, $object_id, $action, $details=null)
+function pwg_activity($object, $object_id, $action, $details=array())
 {
   global $user;
 
@@ -521,19 +521,64 @@ function pwg_activity($object, $object_id, $action, $details=null)
     $object_ids = array($object_id);
   }
 
+  if (isset($_REQUEST['method']))
+  {
+    $details['method'] = $_REQUEST['method'];
+  }
+  else
+  {
+    $details['script'] = script_basename();
+
+    if ('admin' == $details['script'] and isset($_GET['page']))
+    {
+      $details['script'].= '/'.$_GET['page'];
+    }
+  }
+
+  if ('user' == $object and 'login' == $action)
+  {
+    $details['agent'] = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : 'unknown';
+  }
+
+  if ('photo' == $object and 'add' == $action and !isset($details['sync']))
+  {
+    $details['added_with'] = 'app';
+    if (isset($_SERVER['HTTP_REFERER']) and preg_match('/page=photos_add/', $_SERVER['HTTP_REFERER']))
+    {
+      $details['added_with'] = 'browser';
+    }
+    $details['agent'] = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : 'unknown';
+  }
+
+  if (in_array($object, array('album', 'photo')) and 'delete' == $action and isset($_GET['page']) and 'site_update' == $_GET['page'])
+  {
+    $details['sync'] = true;
+  }
+
+  if ('tag' == $object and 'delete' == $action and isset($_POST['destination_tag']))
+  {
+    $details['action'] = 'merge';
+    $details['destination_tag'] = $_POST['destination_tag'];
+  }
+
+  $inserts = array();
+  $details_insert = pwg_db_real_escape_string(serialize($details));
+  $ip_address = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : null;
+
   foreach ($object_ids as $loop_object_id)
   {
-    single_insert(
-      ACTIVITY_TABLE,
-      array(
-        'object' => $object,
-        'object_id' => $loop_object_id,
-        'action' => $action,
-        'performed_by' => $user['id'],
-        'details' => pwg_db_real_escape_string($details),
-      )
+    $inserts[] = array(
+      'object' => $object,
+      'object_id' => $loop_object_id,
+      'action' => $action,
+      'performed_by' => $user['id'],
+      'session_idx' => session_id(),
+      'ip_address' => $ip_address,
+      'details' => $details_insert,
     );
   }
+
+  mass_inserts(ACTIVITY_TABLE, array_keys($inserts[0]), $inserts);
 }
 
 /**

include/functions_user.inc.php

@@ -282,6 +282,8 @@ SELECT id
         )
       );
 
+    pwg_activity('user', $user_id, 'add');
+
     return $user_id;
   }
   else
@@ -961,6 +963,7 @@ function log_user($user_id, $remember_me)
 
   $user['id'] = $_SESSION['pwg_uid'];
   trigger_notify('user_login', $user['id']);
+  pwg_activity('user', $user['id'], 'login');
 }
 
 /**
@@ -1137,6 +1140,7 @@ function logout_user()
   global $conf;
 
   trigger_notify('user_logout', @$_SESSION['pwg_uid']);
+  pwg_activity('user', @$_SESSION['pwg_uid'], 'logout');
 
   $_SESSION = array();
   session_unset();

include/ws_functions/pwg.categories.php

@@ -731,7 +731,7 @@ SELECT *
       );
   }
 
-  pwg_activity('album', $params['category_id'], 'edit', 'method='.$_REQUEST['method'].' fields='.implode(',', array_keys($update)));
+  pwg_activity('album', $params['category_id'], 'edit', array('fields' => implode(',', array_keys($update))));
 }
 
 /**
@@ -782,7 +782,7 @@ UPDATE '. USER_CACHE_CATEGORIES_TABLE .'
 ;';
   pwg_query($query);
 
-  pwg_activity('album', $params['category_id'], 'edit', 'method='.$_REQUEST['method'].' image_id='.$params['image_id']);
+  pwg_activity('album', $params['category_id'], 'edit', array('image_id'=>$params['image_id']));
 }
 
 /**
@@ -829,7 +829,7 @@ UPDATE '.CATEGORIES_TABLE.'
 ;';
   pwg_query($query);
 
-  pwg_activity('album', $params['category_id'], 'edit', 'method='.$_REQUEST['method']);
+  pwg_activity('album', $params['category_id'], 'edit');
 }
 
 /**
@@ -875,7 +875,7 @@ SELECT
   
   set_random_representant(array($params['category_id']));
 
-  pwg_activity('album', $params['category_id'], 'edit', 'method='.$_REQUEST['method']);
+  pwg_activity('album', $params['category_id'], 'edit');
 
   // return url of the new representative
   $query = '

include/ws_functions/pwg.groups.php

@@ -98,8 +98,11 @@ SELECT COUNT(*)
       'is_default' => boolean_to_string($params['is_default']),
       )
     );
+  $inserted_id = pwg_db_insert_id();
 
-  return $service->invoke('pwg.groups.getList', array('group_id' => pwg_db_insert_id()));
+  pwg_activity('group', $inserted_id, 'add');
+
+  return $service->invoke('pwg.groups.getList', array('group_id' => $inserted_id));
 }
 
 /**
@@ -153,6 +156,7 @@ DELETE
   pwg_query($query);
 
   trigger_notify('delete_group', $groupids);
+  pwg_activity('group', $groupids, 'delete');
 
   include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
   invalidate_user_cache();
@@ -219,6 +223,8 @@ SELECT COUNT(*)
     array('id' => $params['group_id'])
     );
 
+  pwg_activity('group', $params['group_id'], 'edit');
+
   return $service->invoke('pwg.groups.getList', array('group_id' => $params['group_id']));
 }
 
@@ -267,6 +273,9 @@ SELECT COUNT(*)
   include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
   invalidate_user_cache();
 
+  pwg_activity('group', $params['group_id'], 'edit');
+  pwg_activity('user', $params['user_id'], 'edit');
+
   return $service->invoke('pwg.groups.getList', array('group_id' => $params['group_id']));
 }
 
@@ -307,6 +316,9 @@ DELETE FROM '. USER_GROUP_TABLE .'
   include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
   invalidate_user_cache();
 
+  pwg_activity('group', $params['group_id'], 'edit');
+  pwg_activity('user', $params['user_id'], 'edit');
+
   return $service->invoke('pwg.groups.getList', array('group_id' => $params['group_id']));
 }
 

include/ws_functions/pwg.images.php

@@ -722,6 +722,8 @@ UPDATE '. IMAGES_TABLE .'
 ;';
   $result = pwg_query($query);
 
+  pwg_activity('photo', $params['image_id'], 'edit');
+
   $affected_rows = pwg_db_changes($result);
   if ($affected_rows)
   {
@@ -1694,6 +1696,8 @@ SELECT *
       $update,
       array('id' => $update['id'])
       );
+
+    pwg_activity('photo', $update['id'], 'edit');
   }
 
   if (isset($params['categories']))

include/ws_functions/pwg.users.php

@@ -639,6 +639,8 @@ SELECT
 
   invalidate_user_cache();
 
+  pwg_activity('user', $params['user_id'], 'edit');
+
   return $service->invoke('pwg.users.getList', array(
     'user_id' => $params['user_id'],
     'display' => 'basics,'.implode(',', array_keys($updates_infos)),

install/db/155-database.php

@@ -0,0 +1,36 @@
+<?php
+// +-----------------------------------------------------------------------+
+// | Piwigo - a PHP based photo gallery                                    |
+// +-----------------------------------------------------------------------+
+// | Copyright(C) 2008-2016 Piwigo Team                  http://piwigo.org |
+// | Copyright(C) 2003-2008 PhpWebGallery Team    http://phpwebgallery.net |
+// | Copyright(C) 2002-2003 Pierrick LE GALL   http://le-gall.net/pierrick |
+// +-----------------------------------------------------------------------+
+// | This program is free software; you can redistribute it and/or modify  |
+// | it under the terms of the GNU General Public License as published by  |
+// | the Free Software Foundation                                          |
+// |                                                                       |
+// | This program is distributed in the hope that it will be useful, but   |
+// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
+// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
+// | General Public License for more details.                              |
+// |                                                                       |
+// | You should have received a copy of the GNU General Public License     |
+// | along with this program; if not, write to the Free Software           |
+// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
+// | USA.                                                                  |
+// +-----------------------------------------------------------------------+
+
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+$upgrade_description = 'add columns session_idx+ip_address in activity table';
+
+pwg_query('alter table `'.PREFIX_TABLE.'activity` add column `session_idx` varchar(255) NOT NULL after `performed_by`;');
+pwg_query('alter table `'.PREFIX_TABLE.'activity` add column `ip_address` varchar(50) default null after session_idx;');
+
+echo "\n".$upgrade_description."\n";
+
+?>

install/piwigo_structure-mysql.sql

@@ -15,6 +15,8 @@ CREATE TABLE `piwigo_activity` (
   `object_id` int(11) unsigned NOT NULL,
   `action` varchar(255) NOT NULL,
   `performed_by` mediumint(8) unsigned NOT NULL,
+  `session_idx` varchar(255) NOT NULL,
+  `ip_address` varchar(50) DEFAULT NULL,
   `occured_on` datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `details` varchar(255) DEFAULT NULL,
   PRIMARY KEY (`activity_id`)

picture.php

@@ -316,7 +316,7 @@ UPDATE '.CATEGORIES_TABLE.'
   WHERE id = '.$page['category']['id'].'
 ;';
         pwg_query($query);
-        pwg_activity('album', $page['category']['id'], 'edit', 'script='.script_basename().' action='.$_GET['action'].' image_id='.$page['image_id']);
+        pwg_activity('album', $page['category']['id'], 'edit', array('action'=>$_GET['action'], 'image_id'=>$page['image_id']));
 
         include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
         invalidate_user_cache();

profile.php

@@ -192,6 +192,8 @@ function save_profile_from_post($userdata, &$errors)
     // mass_updates function
     include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
 
+    $activity_details_tables = array();
+
     if (isset($_POST['mail_address']))
     {
       // update common user informations
@@ -255,6 +257,8 @@ function save_profile_from_post($userdata, &$errors)
                     'update' => $fields
                     ),
                    array($data));
+
+      $activity_details_tables[] = 'users';
     }
 
     if ($conf['allow_user_customization'] or defined('IN_ADMIN'))
@@ -283,8 +287,11 @@ function save_profile_from_post($userdata, &$errors)
       mass_updates(USER_INFOS_TABLE,
                    array('primary' => array('user_id'), 'update' => $fields),
                    array($data));
+
+      $activity_details_tables[] = 'user_infos';
     }
     trigger_notify( 'save_profile_from_post', $userdata['id'] );
+    pwg_activity('user', $userdata['id'], 'edit', array('function'=>__FUNCTION__, 'tables'=>implode(',', $activity_details_tables)));
 
     if (!empty($_POST['redirect']))
     {