Extension:Coppermine

WARNING: The code or configuration described here poses a major security risk.

Site administrators: You are advised against using it until this security issue is resolved.

Problem: Vulnerable to Cross-site scripting attacks, because it passes user input directly to the browser. This may lead to user accounts being hijacked, among other things.
Solution: strictly validate user input and/or apply escaping to all characters that have a special meaning in HTML

WARNING: The code or configuration described here poses a major security risk.

Site administrators: You are advised against using it until this security issue is resolved.

Problem: Vulnerable to SQL injection attacks, because it passes user input directly into SQL commands. This may lead to user accounts being hijacked, wiki content being compromised, private data being leaked, malware being injected, and the entire wiki content being erased, among other things.
Solution: make proper use of MediaWiki's database class instead of concatenating raw sql

MediaWiki extensions manual - list

Coppermine

Release status: beta

Implementation

Tag

Description

This extension allows you to insert coppermine gallery pictures into a mediawiki page

Author(s)

Jeremy Laurenson (JeremyLaurenson^talk)

Last version

0.2(c)

License

No license specified

Download

No link

Parameters
Inside code listing

Check usage and version matrix

This extension allows you to display pictures from your Coppermine photo gallery inside of a MediaWiki page.

This extension assumes your Coppermine tables are in the same database as MediaWiki, since it uses MediaWiki's database functions to access the Coppermine tables.

It can display most recent, top viewed, top rated, random and last viewed pictures from the entire site or a specific album.

Pictures are displayed as thumbnails, and can be formated in a simple table or simply output inside the doc.

Usage [edit]

Example MediaWiki code:

<coppermine>view random | count 9 | cols 3 | table 1 | border 0 | colheight 105| colwidth 105 | alink yes | showcaption size,movietitle</coppermine>

Parameters

url

optional

Url to link to when the user clicks an image.

view

Required

Which type of view - this particular view was set to see the top viewed images

May be:

lastcom	Show the items that were last commented on
lastup	Show the latest uploaded items
topn	Show the top viewed items
toprated	Show the top rated items as decided by user votes
lasthits	Show the most recently viewed items
random	Show a random selection

count

Required

Number of thumbnails to display

album

optional

Album number to display thumbnails from

table

optional

Set this parameter to 1 to have the thumbnails displayed in a table

cols

optional

Number of columns in the table

border

optional

Define a border for the table - this parameter is a number, same as border= in html

colheight

optional

Height of each table cell

colwidth

optional

Width of each table cell

bgcolor

optional

Background color for each table cell

ilink

optional

Instead of linking to the single URL no matter what thumb is clicked, set this to yes to instead link to the picture page within coppermine

alink

optional

Instead of linking to the single URL no matter what thumb is clicked, set this to yes to instead link to the album page within coppermine

showcaption

optional

Displays a caption below the thumbnail - the value of this parameter determines what is displayed, and to display multiple pieces of info, separate them with commas (,) for example: size,movietitle

Caption parameter values:

size	Show file size
title	Show item title or filename
moviesize	Show file sizes only for movies
movietitle	Show titles only for movies

tooltip

optional

Displays a tooltip when hovering over a thumbnail - the value of this parameter determines what is displayed, and to display multiple pieces of info, separate them with commas (,) for example: size,movietitle a value of * includes all tips

Caption parameter values:

size	Show file size
title	Show item title or filename
moviesize	Show file sizes only for movies
movietitle	Show titles only for movies
dimensions	Show image dimensions
votes	Show number of votes
time	Show image upload time/date

Code [edit]

First, you have to make file called Coppermine.php and upload it into the extensions folder.

<?php
#
# Tag :
# <coppermine>commands</coppermine>
#
# This plugin is for my site. It assumes that your coppermine data is in the same SQL database
# as your MediaWiki data. If not, bummer :-(
#
# Version 0.1c
$wgExtensionFunctions[] = 'wfCoppermine';
$wgExtensionCredits['parserhook'][] = array(
'name' => 'Coppermine',
'description' => 'Display recent, top photos from Coppermine gallery',
'author' => 'Jeremy Laurenson',
'url' => 'http://www.mediawiki.org/wiki/Extension:Coppermine'
);
function wfCoppermine() {
global $wgParser;
$wgParser->setHook('coppermine', 'rendercoppermine');
}
function connect() {
// Check if the phpBB tables are in a different database then the Wiki.
if ($GLOBALS['wgPHPBB_UseExtDatabase'] == true) {
// Connect to database. I supress the error here.
$fresMySQLConnection = @mysql_connect($GLOBALS['wgPHPBB_MySQL_Host'], //<-
$GLOBALS['wgPHPBB_MySQL_Username'], //<-
$GLOBALS['wgPHPBB_MySQL_Password'], true);
// Check if we are connected to the database.
if (!$fresMySQLConnection) {
$this->mySQLError('There was a problem when connecting to the phpBB database. ' . //<-
'Check your Host, Username, and Password settings. ');
}
// Select Database
$db_selected = mysql_select_db($GLOBALS['wgPHPBB_MySQL_Database'], $fresMySQLConnection);
// Check if we were able to select the database.
if (!$db_selected) {
$this->mySQLError('There was a problem when connecting to the phpBB database. ' .
'The database ' . $GLOBALS['wgPHPBB_MySQL_Database'] . ' was not found. ');
}
} else {
// Connect to database.
$fresMySQLConnection = mysql_connect($GLOBALS['wgDBserver'], $GLOBALS['wgDBuser'], $GLOBALS['wgDBpassword'], true);
// Check if we are connected to the database.
if (!$fresMySQLConnection) {
$this->mySQLError('There was a problem when connecting to the phpBB database. ' . //<-
'Check your Host, Username, and Password settings. ');
}
// Select Database: This assumes the wiki and phpbb are in the same database.
$db_selected = mysql_select_db($GLOBALS['wgDBname']);
// Check if we were able to select the database.
if (!$db_selected) {
$this->mySQLError('There was a problem when connecting to the phpBB database. ' .
'The database ' . $GLOBALS['wgDBname'] . ' was not found. ');
}
}
$GLOBALS['gstrMySQLVersion'] = substr(mysql_get_server_info(), 0, 3); // Get the mysql version.
return $fresMySQLConnection;
}
function mySQLError( $message ) {
echo $message . ' ';
echo 'MySQL Error Number: ' . mysql_errno() . ' ';
echo 'MySQL Error Message: ' . mysql_error() . ' ';
exit;
}
function strict() {
return true;
}
function updateExternalDB( $user ) {
return true;
}
function rendercoppermine($input) {
#*****************************************************************************************************
#*****************************************************************************************************
#***** Your information needs to be entered below... This info is from your coppermine install ******
#*****************************************************************************************************
#*****************************************************************************************************
$cpg_prefix = 'cpg_';
# Database prefix used for your coppermine tables
$cpg_root = "http://www.yoursite.com/gallery/";
# Root of your coppermine install, so we can link to
#*****************************************************************************************************
#*****************************************************************************************************
$cpg_pictures= $cpg_prefix .'pictures';
$cpg_albums= $cpg_prefix .'albums';
$cpg_comments = $cpg_prefix .'comments';
$output='';
$cpg_params=explode('|', $input);
$cpg_view=0;
foreach($cpg_params as $x){
$cpg_param=explode(' ', trim($x));
switch(strtolower($cpg_param[0])){
case 'view';
$cpg_view=strtolower($cpg_param[1]);
break;
case 'count';
$cpg_count=strtolower($cpg_param[1]);
break;
case 'url';
$cpg_url=strtolower($cpg_param[1]);
break;
case 'album';
$cpg_album=strtolower($cpg_param[1]);
break;
case 'cols';
$cpg_cols=strtolower($cpg_param[1]);
break;
case 'table';
$cpg_table=strtolower($cpg_param[1]);
break;
case 'border';
$cpg_border=strtolower($cpg_param[1]);
break;
case 'colheight';
$cpg_colheight=strtolower($cpg_param[1]);
break;
case 'colwidth';
$cpg_colwidth=strtolower($cpg_param[1]);
break;
case 'bgcolor';
$cpg_bgcolor=strtolower($cpg_param[1]);
break;
case 'ilink';
$cpg_individuallink=strtolower($cpg_param[1]);
break;
case 'alink';
$cpg_albumlink=strtolower($cpg_param[1]);
break;
case 'showcaption';
$cpg_showcaption=strtolower($cpg_param[1]);
break;
case 'tooltip';
$cpg_showtooltip=strtolower($cpg_param[1]);
break;
case 'captionsize';
$cpg_captionsize=strtolower($cpg_param[1]);
break;
case 'captioncolor';
$cpg_captioncolor=strtolower($cpg_param[1]);
break;
}
}
if(($cpg_view!='') and ($cpg_count!='')){
switch($cpg_view){
case 'lastcom': // Last comments
$cpg_sort=' pid desc ';
break;
case 'lastup': // Last uploaded
$cpg_sort=' pid desc ';
break;
case 'topn': // Top visited
$cpg_sort=' hits desc ';
break;
case 'toprated': // Top rated
$cpg_sort=' votes desc ';
break;
case 'lasthits': // Last viewed
$cpg_sort=' mtime desc ';
break;
case 'random': // Random
$cpg_sort=' RAND() desc ';
break;
}
if ($cpg_sort=='')return ' Style may be: lastcom, lastup, topn, toprated,lasthits or random';
$fresMySQLConnection = connect();
if($cpg_captionsize=='')$cpg_captionsize='2';
if($cpg_captioncolor=='')$cpg_captioncolor='BLACK';
$cpg_col=0;
$fstrMySQLQuery = 'SELECT * FROM `' .$cpg_pictures. '` WHERE `approved` = \'YES\' ';
if($cpg_album!='')$fstrMySQLQuery.=' and `aid`='.$cpg_album;
$fstrMySQLQuery.=' order by ';
$fstrMySQLQuery.=$cpg_sort;
$fstrMySQLQuery.=' limit '.$cpg_count;
$fresMySQLResult = mysql_query($fstrMySQLQuery, $fresMySQLConnection) or die(mySQLError('Unable to view external table'));
if(!$fresMySQLResult)$output=$output."No pictures found.";
if($cpg_table!='')$output=$output .'<TABLE ';
if(($cpg_table!='') and ($cpg_border!=''))$output=$output .'BORDER="'.$cpg_border.'" ';
if($cpg_table!='')$output=$output .'><TR>';
while($faryMySQLResult = mysql_fetch_array($fresMySQLResult)){
$cpg_x=$faryMySQLResult['pwidth'];
$cpg_y=$faryMySQLResult['pheight'];
$cpg_time=strftime('%b %e %G %I:%M%p',$faryMySQLResult['ctime']);
$cpg_votes=$faryMySQLResult['votes'];
$cpg_pid=$faryMySQLResult['pid'];
$cpg_aid=$faryMySQLResult['aid'];
$cpg_filesize=$faryMySQLResult['filesize'];
$cpg_filename=$faryMySQLResult['filename'];
$cpg_title=$faryMySQLResult['title'];
if($cpg_title=='')$cpg_title=$cpg_filename;
$cpg_displayfilesize=$cpg_filesize;
if($cpg_filesize<=(1024*1024))$cpg_displayfilesize=round($cpg_filesize/1024,1).'KB';
if($cpg_filesize>(1024*1024))$cpg_displayfilesize=round($cpg_filesize/(1024*1024),1).'MB';
# Now we build the caption based on the tags we find in the caption keyword
$cpg_caption='';
if($cpg_showcaption!=''){
$cpg_captioninfo=explode(',', trim($cpg_showcaption));
foreach($cpg_captioninfo as $x){
switch($x){
case "title":
$cpg_caption.=$cpg_title.' ';
break;
case "size":
$cpg_caption.=$cpg_displayfilesize.' ';
break;
case "movietitle":
if($cpg_x==0)$cpg_caption.=$cpg_title.' ';
break;
case "moviesize":
if($cpg_x==0)$cpg_caption.=$cpg_displayfilesize.' ';
break;
}
}
}
if($cpg_showtooltip!=''){
if($cpg_showtooltip=='*')$cpg_showtooltip='title,dimensions,size,votes,time';
$cpg_tooltipinfo=explode(',', trim($cpg_showtooltip));
$cpg_tooltip='';
foreach($cpg_tooltipinfo as $x){
switch($x){
case "title":
$cpg_tooltip.=$cpg_title.' ';
break;
case "size":
$cpg_tooltip.=$cpg_displayfilesize.' ';
break;
case "movietitle":
if($cpg_x==0)$cpg_tooltip.=$cpg_title.' ';
break;
case "moviesize":
if($cpg_x==0)$cpg_tooltip.=$cpg_displayfilesize.' ';
break;
case "dimensions":
$cpg_tooltip.=$cpg_x.'x'.$cpg_y.' ';
break;
case "votes":
$cpg_tooltip.=$cpg_votes.' ';
break;
case "time":
$cpg_tooltip.=$cpg_time.' ';
break;
case "moviesize":
if($cpg_x==0)$cpg_tooltip.=$cpg_displayfilesize.' ';
break;
}
}
}
$cpg_col++;
if(($cpg_table!='') and ($cpg_col>$cpg_cols)){
$cpg_col=1;
$output.='</TR><TR>';
}
if($cpg_table!='')$output.='<TD VALIGN="MIDDLE" ALIGN="CENTER" ';
if(($cpg_table!='') and ($cpg_colheight!=''))$output.=' HEIGHT="'.$cpg_colheight.'" ';
if(($cpg_table!='') and ($cpg_colheight!=''))$output.=' WIDTH="'.$cpg_colwidth.'" ';
if(($cpg_table!='') and ($cpg_bgcolor!=''))$output.=' BGCOLOR="'.$cpg_bgcolor.'" ';
if($cpg_table!='')$output=$output .'>';
if(($cpg_individuallink=='') and ($cpg_albumlink==''))$output.='<a title="'.$cpg_tooltip.'" target="_parent" href="'.$cpg_url.'">';
if($cpg_individuallink!='')$output.='<a title="'.$cpg_tooltip.'" target="_parent" href="'.$cpg_root.'displayimage.php?album='.$cpg_aid.'&cat=0&pos=-'.$cpg_pid.'">';
if($cpg_albumlink!='')$output.='<a title="'.$cpg_tooltip.'" target="_parent" href="'.$cpg_root.'thumbnails.php?album='.$cpg_aid.'&cat=0">';
if($cpg_x!=0)$output.= "<img src=\"".$cpg_root."/albums/".$faryMySQLResult['filepath']."thumb_".$faryMySQLResult['filename']."\" border=\"0\">";
else $output.= "<img src=\"".$cpg_root."images/thumb_mpg.jpg\" border=\"0\">";
if($cpg_showcaption!='')$output.=' '.$cpg_caption.'';
$output.='</a>';
if($cpg_table!='')$output.='</TD>';
}
if($cpg_table!='')$output.='</TR></TABLE>';
}
return $output;
}

Installation [edit]

To install this extension, add the following to LocalSettings.php:

require_once("$IP/extensions/Coppermine.php");

Configuration parameters [edit]

Inside of the Coppermine.php file, you need to edit only two variables:

                $cpg_prefix =                           'cpg_';
                # Database prefix used for your coppermine tables
                $cpg_root  =                            'http://www.yoursitehere/gallery/';
                # Root of your coppermine install, so we can link to

Extension:Coppermine

Contents

Usage [edit]

Code [edit]

Installation [edit]

Configuration parameters [edit]

Navigation menu

Personal tools

Namespaces

Variants

Views

Actions

Search

Navigation

Support

MediaWiki.org

Development

Print/export

Toolbox