261       

   262       break;

   263     case 'addtag':

   264       $json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE);

   265       $resp = array(

   266           'success' => false,

   267           'error' => 'No error',

   268           'can_del' => ( $session->get_permissions('tag_delete_own') && $session->user_logged_in ),

   269           'in_acl' => false

   270         );

   271       

   272       // first of course, are we allowed to tag pages?

   273       if ( !$session->get_permissions('tag_create') )

   274       {

   275         $resp['error'] = 'You are not permitted to tag pages.';

   276         die($json->encode($resp));

   277       }

   278       

   279       // sanitize the tag name

   280       $tag = sanitize_tag($_POST['tag']);

   281       $tag = $db->escape($tag);

   282       

   283       if ( strlen($tag) < 2 )

   284       {

   285         $resp['error'] = 'Tags must consist of at least 2 alphanumeric characters.';

   286         die($json->encode($resp));

   287       }

   288       

   289       // check if tag is already on page

   290       $q = $db->sql_query('SELECT 1 FROM '.table_prefix.'tags WHERE page_id=\'' . $db->escape($paths->cpage['urlname_nons']) . '\' AND namespace=\'' . $db->escape($paths->namespace) . '\' AND tag_name=\'' . $tag . '\';');

   291       if ( !$q )

   292         $db->_die();

   293       if ( $db->numrows() > 0 )

   294       {

   295         $resp['error'] = 'This page already has this tag.';

   296         die($json->encode($resp));

   297       }

   298       $db->free_result();

   299       

   300       // tricky: make sure this tag isn't being used in some page group, and thus adding it could affect page access

   301       $can_edit_acl = ( $session->get_permissions('edit_acl') || $session->user_level >= USER_LEVEL_ADMIN );

   302       $q = $db->sql_query('SELECT 1 FROM '.table_prefix.'page_groups WHERE pg_type=' . PAGE_GRP_TAGGED . ' AND pg_target=\'' . $tag . '\';');

   303       if ( !$q )

   304         $db->_die();

   305       if ( $db->numrows() > 0 && !$can_edit_acl )

   306       {

   307         $resp['error'] = 'This tag is used in an ACL page group, and thus can\'t be added to a page by people without administrator privileges.';

   308         die($json->encode($resp));

   309       }

   310       $resp['in_acl'] = ( $db->numrows() > 0 );

   311       $db->free_result();

   312       

   313       // we're good

   314       $q = $db->sql_query('INSERT INTO '.table_prefix.'tags(tag_name,page_id,namespace,user) VALUES(\'' . $tag . '\', \'' . $db->escape($paths->cpage['urlname_nons']) . '\', \'' . $db->escape($paths->namespace) . '\', ' . $session->user_id . ');');

   315       if ( !$q )

   316         $db->_die();

   317       

   318       $resp['success'] = true;

   319       $resp['tag'] = $tag;

   320       $resp['tag_id'] = $db->insert_id();

   321       

   322       echo $json->encode($resp);

   323       break;

   324     case 'deltag':

   325       

   326       $tag_id = intval($_POST['tag_id']);

   327       if ( empty($tag_id) )

   328         die('Invalid tag ID');

   329       

   330       $q = $db->sql_query('SELECT t.tag_id, t.user, t.page_id, t.namespace, pg.pg_target IS NOT NULL AS used_in_acl FROM '.table_prefix.'tags AS t

   331   LEFT JOIN '.table_prefix.'page_groups AS pg

   332     ON ( pg.pg_id IS NULL OR ( pg.pg_target = t.tag_name AND pg.pg_type = ' . PAGE_GRP_TAGGED . ' ) )

   333   WHERE t.tag_id=' . $tag_id . ';');

   334       

   335       if ( !$q )

   336         $db->_die();

   337       

   338       if ( $db->numrows() < 1 )

   339         die('Could not find a tag with that ID');

   340       

   341       $row = $db->fetchrow();

   342       $db->free_result();

   343       

   344       if ( $row['page_id'] == $paths->cpage['urlname_nons'] && $row['namespace'] == $paths->namespace )

   345         $perms =& $session;

   346       else

   347         $perms = $session->fetch_page_acl($row['page_id'], $row['namespace']);

   348         

   349       $perm = ( $row['user'] != $session->user_id ) ?

   350                 'tag_delete_other' :

   351                 'tag_delete_own';

   352       

   353       if ( $row['user'] == 1 && !$session->user_logged_in )

   354         // anonymous user trying to delete tag (hardcode blacklisted)

   355         die('You are not authorized to delete this tag.');

   356         

   357       if ( !$perms->get_permissions($perm) )

   358         die('You are not authorized to delete this tag.');

   359       

   360       if ( $row['used_in_acl'] == 1 && !$perms->get_permissions('edit_acl') && $session->user_level < USER_LEVEL_ADMIN )

   361         die('You are not authorized to delete this tag.');

   362       

   363       // We're good

   364       $q = $db->sql_query('DELETE FROM '.table_prefix.'tags WHERE tag_id = ' . $tag_id . ';');

   365       if ( !$q )

   366         $db->_die();

   367       

   368       echo 'success';