From e40c05c1f842dc52bb2983ddfa00054c7dc69016 Mon Sep 17 00:00:00 2001
From: Dennis Brentjes <d.brentjes@gmail.com>
Date: Sat, 7 Jul 2018 12:21:12 +0000
Subject: [PATCH] Adds a Confirm Delete page and actually delete the assets.

---
 controllers/ConfirmDelete.php   | 43 +++++++++++++++++++++++++++
 models/Asset.php                |  8 +++++
 models/Dispatcher.php           |  1 +
 public/css/default.css          |  8 +++++
 templates/ConfirmDeletePage.php | 52 +++++++++++++++++++++++++++++++++
 templates/EditAssetForm.php     |  2 +-
 templates/PhotoPage.php         |  2 +-
 7 files changed, 114 insertions(+), 2 deletions(-)
 create mode 100644 controllers/ConfirmDelete.php
 create mode 100644 templates/ConfirmDeletePage.php

diff --git a/controllers/ConfirmDelete.php b/controllers/ConfirmDelete.php
new file mode 100644
index 00000000..7f204232
--- /dev/null
+++ b/controllers/ConfirmDelete.php
@@ -0,0 +1,43 @@
+<?php
+/*****************************************************************************
+ * ConfirmDelete.php
+ * Contains the ConfirmDelete controller
+ *
+ * Kabuki CMS (C) 2013-2016, Aaron van Geffen
+ *****************************************************************************/
+
+class ConfirmDelete extends HTMLController
+{
+	public function __construct()
+	{
+		// Ensure we're logged in at this point.
+		$user = Registry::get('user');
+		if (!$user->isLoggedIn())
+			throw new NotAllowedException();
+
+		$photo = Asset::fromSlug($_GET['slug']);
+		if (empty($photo))
+			throw new NotFoundException();
+
+		$author = $photo->getAuthor();
+		if (!($user->isAdmin() || $user->getUserId() === $author->getUserId()))
+			throw new NotAllowedException();
+
+		if (isset($_REQUEST['confirmed']))
+			$this->handleDelete($photo);
+
+		parent::__construct('Confirm deletion' . ' - ' . SITE_TITLE);
+		$page = new ConfirmDeletePage($photo->getImage());
+
+		$this->page->adopt($page);
+	}
+
+	private function handleDelete(Asset $photo) {
+		$album_url = $photo->getSubdir();
+
+		$photo->delete();
+
+		header('Location: ' . BASEURL . '/' . $album_url);
+		exit;
+	}
+}
diff --git a/models/Asset.php b/models/Asset.php
index 6d15a094..62ee0aa1 100644
--- a/models/Asset.php
+++ b/models/Asset.php
@@ -485,6 +485,14 @@ class Asset
 		if (!unlink(ASSETSDIR . '/' . $this->subdir . '/' . $this->filename))
 			return false;
 
+		$db->query('
+			UPDATE tags
+			SET id_asset_thumb = 0
+			WHERE id_asset_thumb = {int:id_asset} AND kind = "Album"',
+			[
+				'id_asset' => $this->id_asset,
+			]);
+
 		$db->query('
 			DELETE FROM assets_meta
 			WHERE id_asset = {int:id_asset}',
diff --git a/models/Dispatcher.php b/models/Dispatcher.php
index f9cc9307..7fb8bc69 100644
--- a/models/Dispatcher.php
+++ b/models/Dispatcher.php
@@ -28,6 +28,7 @@ class Dispatcher
 			'suggest' => 'ProvideAutoSuggest',
 			'timeline' => 'ViewTimeline',
 			'uploadmedia' => 'UploadMedia',
+			'confirmdelete' => 'ConfirmDelete',
 		];
 
 		// Work around PHP's FPM not always providing PATH_INFO.
diff --git a/public/css/default.css b/public/css/default.css
index 736b9747..a41421e0 100644
--- a/public/css/default.css
+++ b/public/css/default.css
@@ -629,6 +629,14 @@ a#previous_photo:hover, a#next_photo:hover {
 	width: 20%;
 }
 
+#confirm_box {
+	background: #fff;
+        box-shadow: 2px 2px 4px rgba(0, 0, 0, 0.3);
+        padding: 2%;
+        margin: 25px 0 25px 0;
+	text-align: center;
+}
+
 
 /* Responsive: smartphone in portrait
 ---------------------------------------*/
diff --git a/templates/ConfirmDeletePage.php b/templates/ConfirmDeletePage.php
new file mode 100644
index 00000000..2b003a69
--- /dev/null
+++ b/templates/ConfirmDeletePage.php
@@ -0,0 +1,52 @@
+<?php
+/*****************************************************************************
+ * ConfirmDeletePage.php
+ * Contains the confirm delete page template.
+ *
+ * Kabuki CMS (C) 2013-2016, Aaron van Geffen
+ *****************************************************************************/
+
+class ConfirmDeletePage extends SubTemplate
+{
+	private $photo;
+
+	public function __construct(Image $photo)
+	{
+		$this->photo = $photo;
+	}
+
+	protected function html_content()
+	{
+		$this->confirm();
+		$this->photo();
+	}
+
+	private function confirm()
+	{
+		echo '
+				<div id=confirm_box>
+					<h1>Confirm deletion</h1>
+					<p>You are about to permanently delete the following photo.</p>	
+					<a class="btn btn-red" href="', BASEURL, '/confirmdelete?slug=', $this->photo->getSlug(), '&confirmed">Delete</a>
+					<a class="btn" href="', $this->photo->getPageUrl(), '"> Cancel</a>
+				</div>';
+	}
+
+	private function photo()
+	{
+		echo '
+				<div id="photo_frame">
+					<a href="', $this->photo->getUrl(), '">';
+
+		if ($this->photo->isPortrait())
+			echo '
+						<img src="', $this->photo->getThumbnailUrl(null, 960), '" alt="">';
+		else
+			echo '
+						<img src="', $this->photo->getThumbnailUrl(1280, null), '" alt="">';
+
+		echo '
+					</a>
+				</div>';
+	}
+}
diff --git a/templates/EditAssetForm.php b/templates/EditAssetForm.php
index 14e29f8f..0fbf89a0 100644
--- a/templates/EditAssetForm.php
+++ b/templates/EditAssetForm.php
@@ -23,7 +23,7 @@ class EditAssetForm extends SubTemplate
 			<form id="asset_form" action="" method="post" enctype="multipart/form-data">
 				<div class="boxed_content" style="margin-bottom: 2%">
 					<div style="float: right">
-						<a class="btn btn-red" href="', BASEURL, '/editasset/?id=', $this->asset->getId(), '&delete">Delete asset</a>
+						<a class="btn btn-red" href="', BASEURL, '/confirmdelete?slug=', $this->asset->getSlug(), '>Delete asset</a>
 						<input type="submit" value="Save asset data">
 					</div>
 					<h2>Edit asset \'', $this->asset->getTitle(), '\' (', $this->asset->getFilename(), ')</h2>
diff --git a/templates/PhotoPage.php b/templates/PhotoPage.php
index ea3917cf..e7bc0edf 100644
--- a/templates/PhotoPage.php
+++ b/templates/PhotoPage.php
@@ -198,7 +198,7 @@ class PhotoPage extends SubTemplate
 		echo '
 				<div id=user_actions_box>
 					<h3>Actions</h3>
-					<a class="btn btn-red" href="', BASEURL, '/editasset/?id=', $this->photo->getId(), '&delete">Delete asset</a>
+					<a class="btn btn-red" href="', BASEURL, '/confirmdelete?slug=', $this->photo->getSlug(), '">Delete</a>
 				</div>';
 	}
 }