Changeset 2268 for trunk/profile.php

Timestamp:

Mar 8, 2008, 1:38:09 PM (16 years ago)

Author:

rvelices

Message:

• security fix (profile)
• les langues a la hache
• fix some copy/paste errors

File:

• trunk/profile.php (modified) (8 diffs)

trunk/profile.php

@@ -3 +3 @@
 // | PhpWebGallery - a PHP based picture gallery                           |
 // | Copyright (C) 2002-2003 Pierrick LE GALL - pierrick@phpwebgallery.net |
-// | Copyright (C) 2003-2007 PhpWebGallery Team - http://phpwebgallery.net |
+// | Copyright (C) 2003-2008 PhpWebGallery Team - http://phpwebgallery.net |
 // +-----------------------------------------------------------------------+
 // | file          : $Id$
@@ -55 +55 @@
     $userdata );
 
-  $template->assign('U_HOME', make_index_url());
-
   // +-----------------------------------------------------------------------+
   // |                             errors display                            |
@@ -71 +69 @@
 
 //------------------------------------------------------ update & customization
-function save_profile_from_post(&$userdata, &$errors)
+function save_profile_from_post($userdata, &$errors)
 {
   global $conf;
   $errors = array();
-  
+
   if (!isset($_POST['validate']))
   {
     return false;
+  }
+
+  $special_user = in_array($userdata['id'], array($conf['guest_id'], $conf['default_user_id']));
+  if ($special_user)
+  {
+    unset($_POST['mail_address'],
+          $_POST['password'],
+          $_POST['use_new_pwd'],
+          $_POST['passwordConf']
+          );
   }
 
@@ -159 +167 @@
 
       $data = array();
-      $data{$conf['user_fields']['id']} = $_POST['userid'];
+      $data{$conf['user_fields']['id']} = $userdata['id'];
       $data{$conf['user_fields']['email']} = $_POST['mail_address'];
 
@@ -183 +191 @@
 
     $data = array();
-    $data['user_id'] = $_POST['userid'];
+    $data['user_id'] = $userdata['id'];
 
     foreach ($fields as $field)
@@ -196 +204 @@
                  array($data));
 
-    trigger_action( 'loc_user_profile_updated', $_POST['userid'] );
+    trigger_action( 'save_profile_from_post', $userdata['id'] );
     
     if (!empty($_POST['redirect']))
@@ -215 +223 @@
   $template->assign('radio_options',
     array(
-      'true' => l10n('yes'),
-      'false' => l10n('no')));
+      'true' => l10n('Yes'),
+      'false' => l10n('No')));
 
   $template->assign(
     array(
       'USERNAME'=>$userdata['username'],
-      'USERID'=>$userdata['id'],
       'EMAIL'=>get_email_address_as_display_text(@$userdata['email']),
       'NB_IMAGE_LINE'=>$userdata['nb_image_line'],
@@ -256 +263 @@
   $template->assign('language_options', $language_options);
 
-  if (!(in_array($userdata['id'], array($conf['guest_id'], $conf['default_user_id']))))
-  {
-    $template->assign('not_special_user', true);
-    $template->assign('in_admin', defined('IN_ADMIN'));
-  }
-
+  $special_user = in_array($userdata['id'], array($conf['guest_id'], $conf['default_user_id']));
+  $template->assign('SPECIAL_USER', $special_user);
+  $template->assign('IN_ADMIN', defined('IN_ADMIN'));
+
+  // allow plugins to add their own form data to content
+  trigger_action( 'load_profile_in_template', $userdata );
+  
   $template->assign_var_from_handle('PROFILE_CONTENT', 'profile_content');
 }