Merge branch 'master' into develop

Conflicts:
	common/js/common.js
	common/js/xe.js
	common/js/xe.min.js
	modules/editor/skins/xpresseditor/js/xpresseditor.min.js

modules/document/conf/module.xml

@@ -15,6 +15,9 @@
         <permission action="procDocumentDeleteCategory" target="member" />
         <permission action="procDocumentMakeXmlFile" target="member" />
         <permission action="procDocumentAdminMoveToTrash" target="member" />
+
+        <permission action="procDocumentAdminInsertExtraVar" target="manager" />
+        <permission action="procDocumentAdminDeleteExtraVar" target="manager" />
     </permissions>
     <actions>
         <action name="dispDocumentPrint" type="view" />

modules/editor/tpl/js/uploader.js

@@ -115,6 +115,7 @@ var uploadAutosaveChecker = false;
 		}
 
 		if(is_def(window.xeVid)) settings.post_params.vid = xeVid;
+		settings.sessionName = cfg.sessionName;
 		settings.post_params[cfg.sessionName] = getCookie(cfg.sessionName);
 
 		uploaderSettings[seq] = settings;
@@ -166,6 +167,7 @@ var uploadAutosaveChecker = false;
 		},
 		onFileDialogComplete : function(numFilesSelected, numFilesQueued) {
 			try {
+				this.addPostParam(this.settings.sessionName, getCookie(this.settings.sessionName));
 				this.startUpload();
 			} catch (e)  {
 				this.debug(e);
@@ -173,6 +175,7 @@ var uploadAutosaveChecker = false;
 		},
 		onUploadStart : _true,
 		onUploadProgress : function(file, bytesLoaded, bytesTotal) {
+			this.addPostParam(this.settings.sessionName, getCookie(this.settings.sessionName));
 			try {
 				var $list, $lastopt, percent, filename;
 

modules/file/conf/module.xml

@@ -1,7 +1,9 @@
 <?xml version="1.0" encoding="utf-8"?>
 <module>
     <grants />
-    <permissions />
+    <permissions>
+        <permission action="procFileAdminInsertModuleConfig" target="manager" />
+    </permissions>
     <actions>
         <action name="dispFileAdminList" type="view" admin_index="true" menu_name="file" menu_index="true" />
         <action name="dispFileAdminConfig" type="view" menu_name="fileUpload" menu_index="true" />

modules/member/member.controller.php

@@ -1810,6 +1810,8 @@ class memberController extends member
 			}
 		}
 
+		$_SESSION['session_checkup'] = null;
+		$this->regenerateSession();
 		$this->setSessionInfo();
 
 		return $output;
@@ -1869,6 +1871,31 @@ class memberController extends member
 		$this->addMemberMenu( 'dispMemberOwnDocument', 'cmd_view_own_document');
 	}
 
+	function validateSession()
+	{
+		$destory_session = false;
+
+		if($_SESSION['ipaddress'] != $_SERVER['REMOTE_ADDR']) $destory_session =  true;
+
+		if($destory_session)
+		{
+			$this->destroySessionInfo();
+			return false;
+		}
+
+		return true;
+	}
+
+	function regenerateSession()
+	{
+		if(!$_SESSION['session_checkup'] || time() - $_SESSION['session_checkup'] > 30)
+		{
+			session_regenerate_id(true);
+			$_SESSION['session_checkup'] = time();
+		}
+	}
+
+
 	/**
 	 * Logged method for providing a personalized menu
 	 * Login information is used in the output widget, or personalized page

modules/member/member.model.php

@@ -234,6 +234,12 @@ class memberModel extends member
 			}
 			Context::set('logged_info', $logged_info);
 
+			if($logged_info->is_admin == 'Y' || $logged_info->is_site_admin)
+			{
+				$oMemberController = getController('member');
+				$oMemberController->regenerateSession();
+			}
+
 			return $logged_info;
 		}
 		return NULL;

modules/module/conf/module.xml

@@ -4,6 +4,16 @@
     <permissions>
         <permission action="dispModuleSelectList" target="member" />
         <permission action="getModuleAdminGrant" target="manager" />
+		<permission action="getModuleAdminLangCode" target="manager" />
+		<permission action="getModuleAdminLangListByName" target="manager" />
+		<permission action="getModuleAdminLangListByValue" target="manager" />
+		<permission action="getLangListByLangcodeForAutoComplete" target="manager" />
+		<permission action="getLangByLangcode" target="manager" />
+		<permission action="getModuleAdminMultilingualHtml" target="manager" />
+		<permission action="getModuleAdminLangListHtml" target="manager" />
+		<permission action="procModuleAdminInsertLang" target="manager" />
+		<permission action="procModuleAdminInsertGrant" target="manager" />
+		<permission action="procModuleAdminUpdateSkinInfo" target="manager" />
     </permissions>
     <actions>
         <action name="dispModuleSelectList" type="view" />

modules/module/module.model.php

@@ -1995,14 +1995,19 @@ class moduleModel extends module
 		if(!$module_srl)
 		{
 			$grant->access = true;
-			if($this->isSiteAdmin($member_info, $module_info->site_srl)) $grant->access = $grant->is_admin = $grant->manager = $grant->is_site_admin = true;
-			else $grant->is_admin = $grant->manager = $member_info->is_admin=='Y'?true:false;
-			// If module_srl exists
+			if($this->isSiteAdmin($member_info, $module_info->site_srl))
+			{
+				$grant->access = $grant->manager = $grant->is_site_admin = true;
+			}
+
+			$grant->is_admin = $grant->manager = ($member_info->is_admin == 'Y') ? true : false;
 		}
 		else
 		{
+			// If module_srl exists
 			// Get a type of granted permission
-			$grant->access = $grant->is_admin = $grant->manager = $grant->is_site_admin = ($member_info->is_admin=='Y'||$this->isSiteAdmin($member_info, $module_info->site_srl))?true:false;
+			$grant->access = $grant->manager = $grant->is_site_admin = ($member_info->is_admin=='Y'||$this->isSiteAdmin($member_info, $module_info->site_srl))?true:false;
+			$grant->is_admin = ($member_info->is_admin == 'Y') ? true : false;
 			// If a just logged-in member is, check if the member is a module administrator
 			if(!$grant->manager && $member_info->member_srl)
 			{
@@ -2010,7 +2015,7 @@ class moduleModel extends module
 				$args->module_srl = $module_srl;
 				$args->member_srl = $member_info->member_srl;
 				$output = executeQuery('module.getModuleAdmin',$args);
-				if($output->data && $output->data->member_srl == $member_info->member_srl) $grant->manager = $grant->is_admin = true;
+				if($output->data && $output->data->member_srl == $member_info->member_srl) $grant->manager = true;
 			}
 			// If not an administrator, get information from the DB and grant manager privilege.
 			if(!$grant->manager)

modules/point/conf/module.xml

@@ -1,7 +1,9 @@
 <?xml version="1.0" encoding="utf-8"?>
 <module>
     <grants />
-    <permissions />
+    <permissions>
+        <permission action="procPointAdminInsertPointModuleConfig" target="manager" />
+    </permissions>
     <actions>
         <action name="dispPointAdminConfig" type="view" admin_index="true" menu_name="point" menu_index="true" />
         <action name="dispPointAdminModuleConfig" type="view" menu_name="point" />

modules/rss/conf/module.xml

@@ -1,7 +1,9 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <module>
     <grants />
-    <permissions />
+    <permissions>
+        <permission action="procRssAdminInsertModuleConfig" target="manager" />
+    </permissions>
     <actions>
         <action name="dispRssAdminIndex" type="view" index="true" admin_index="true" menu_name="rss" menu_index="true" />
         <action name="rss" type="view" />