source: branches/2.2/profile.php @ 11371

Last change on this file since 11371 was 11157, checked in by plg, 10 years ago

bug 2280 fixed: check language and theme values before updating database. The
posted value must match an expected value, this is not a free texfield.

  • Property svn:eol-style set to LF
File size: 10.4 KB
Line 
1<?php
2// +-----------------------------------------------------------------------+
3// | Piwigo - a PHP based photo gallery                                    |
4// +-----------------------------------------------------------------------+
5// | Copyright(C) 2008-2011 Piwigo Team                  http://piwigo.org |
6// | Copyright(C) 2003-2008 PhpWebGallery Team    http://phpwebgallery.net |
7// | Copyright(C) 2002-2003 Pierrick LE GALL   http://le-gall.net/pierrick |
8// +-----------------------------------------------------------------------+
9// | This program is free software; you can redistribute it and/or modify  |
10// | it under the terms of the GNU General Public License as published by  |
11// | the Free Software Foundation                                          |
12// |                                                                       |
13// | This program is distributed in the hope that it will be useful, but   |
14// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
15// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
16// | General Public License for more details.                              |
17// |                                                                       |
18// | You should have received a copy of the GNU General Public License     |
19// | along with this program; if not, write to the Free Software           |
20// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
21// | USA.                                                                  |
22// +-----------------------------------------------------------------------+
23
24// customize appearance of the site for a user
25// +-----------------------------------------------------------------------+
26// |                           initialization                              |
27// +-----------------------------------------------------------------------+
28
29if (!defined('PHPWG_ROOT_PATH'))
30{//direct script access
31  define('PHPWG_ROOT_PATH','./');
32  include_once(PHPWG_ROOT_PATH.'include/common.inc.php');
33
34  // +-----------------------------------------------------------------------+
35  // | Check Access and exit when user status is not ok                      |
36  // +-----------------------------------------------------------------------+
37  check_status(ACCESS_CLASSIC);
38
39  if (!empty($_POST))
40  {
41    check_pwg_token();
42  }
43
44  $userdata = $user;
45
46  trigger_action('loc_begin_profile');
47
48// Reset to default (Guest) custom settings
49  if (isset($_POST['reset_to_default']))
50  {
51    $fields = array(
52      'nb_image_line', 'nb_line_page', 'maxwidth', 'maxheight', 'expand',
53      'show_nb_comments', 'show_nb_hits', 'recent_period', 'show_nb_hits'
54      );
55
56    // Get the Guest custom settings
57    $query = '
58SELECT '.implode(',', $fields).'
59  FROM '.USER_INFOS_TABLE.'
60  WHERE user_id = '.$conf['default_user_id'].'
61;';
62    $result = pwg_query($query);
63    $default_user = pwg_db_fetch_assoc($result);
64    $userdata = array_merge($userdata, $default_user);
65  }
66
67  save_profile_from_post($userdata, $errors);
68
69  $title= l10n('Your Gallery Customization');
70  $page['body_id'] = 'theProfilePage';
71  include(PHPWG_ROOT_PATH.'include/page_header.php');
72
73  load_profile_in_template(
74    get_root_url().'profile.php', // action
75    make_index_url(), // for redirect
76    $userdata );
77
78  // +-----------------------------------------------------------------------+
79  // |                             errors display                            |
80  // +-----------------------------------------------------------------------+
81  if (count($errors) != 0)
82  {
83    $template->assign('errors', $errors);
84  }
85  $template->set_filename('profile', 'profile.tpl');
86  trigger_action('loc_end_profile');
87  $template->pparse('profile');
88  include(PHPWG_ROOT_PATH.'include/page_tail.php');
89}
90
91//------------------------------------------------------ update & customization
92function save_profile_from_post($userdata, &$errors)
93{
94  global $conf;
95  $errors = array();
96
97  if (!isset($_POST['validate']))
98  {
99    return false;
100  }
101
102  $special_user = in_array($userdata['id'], array($conf['guest_id'], $conf['default_user_id']));
103  if ($special_user)
104  {
105    unset(
106      $_POST['mail_address'],
107      $_POST['password'],
108      $_POST['use_new_pwd'],
109      $_POST['passwordConf'],
110      $_POST['theme'],
111      $_POST['language']
112      );
113    $_POST['theme'] = get_default_theme();
114    $_POST['language'] = get_default_language();
115  }
116
117  if ($conf['allow_user_customization'] or defined('IN_ADMIN'))
118  {
119    $int_pattern = '/^\d+$/';
120    if (empty($_POST['nb_image_line'])
121        or (!preg_match($int_pattern, $_POST['nb_image_line'])))
122    {
123      $errors[] = l10n('The number of photos per row must be a not null scalar');
124    }
125
126    if (empty($_POST['nb_line_page'])
127        or (!preg_match($int_pattern, $_POST['nb_line_page'])))
128    {
129      $errors[] = l10n('The number of rows per page must be a not null scalar');
130    }
131
132    if ($_POST['maxwidth'] != ''
133        and (!preg_match($int_pattern, $_POST['maxwidth'])
134             or $_POST['maxwidth'] < 50))
135    {
136      $errors[] = l10n('Maximum width must be a number superior to 50');
137    }
138    if ($_POST['maxheight']
139         and (!preg_match($int_pattern, $_POST['maxheight'])
140               or $_POST['maxheight'] < 50))
141    {
142      $errors[] = l10n('Maximum height must be a number superior to 50');
143    }
144    // periods must be integer values, they represents number of days
145    if (!preg_match($int_pattern, $_POST['recent_period'])
146        or $_POST['recent_period'] <= 0)
147    {
148      $errors[] = l10n('Recent period must be a positive integer value') ;
149    }
150
151    if (!in_array($_POST['language'], array_keys(get_languages())))
152    {
153      die('Hacking attempt, incorrect language value');
154    }
155
156    if (!in_array($_POST['theme'], array_keys(get_pwg_themes())))
157    {
158      die('Hacking attempt, incorrect theme value');
159    }
160  }
161
162  if (isset($_POST['mail_address']))
163  {
164    // if $_POST and $userdata have are same email
165    // validate_mail_address allows, however, to check email
166    $mail_error = validate_mail_address($userdata['id'], $_POST['mail_address']);
167    if (!empty($mail_error))
168    {
169      $errors[] = $mail_error;
170    }
171  }
172
173  if (!empty($_POST['use_new_pwd']))
174  {
175    // password must be the same as its confirmation
176    if ($_POST['use_new_pwd'] != $_POST['passwordConf'])
177    {
178      $errors[] = l10n('New password confirmation does not correspond');
179    }
180
181    if ( !defined('IN_ADMIN') )
182    {// changing password requires old password
183      $query = '
184  SELECT '.$conf['user_fields']['password'].' AS password
185    FROM '.USERS_TABLE.'
186    WHERE '.$conf['user_fields']['id'].' = \''.$userdata['id'].'\'
187  ;';
188      list($current_password) = pwg_db_fetch_row(pwg_query($query));
189
190      if ($conf['pass_convert']($_POST['password']) != $current_password)
191      {
192        $errors[] = l10n('Current password is wrong');
193      }
194    }
195  }
196
197  if (count($errors) == 0)
198  {
199    // mass_updates function
200    include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
201
202    if (isset($_POST['mail_address']))
203    {
204      // update common user informations
205      $fields = array($conf['user_fields']['email']);
206
207      $data = array();
208      $data{$conf['user_fields']['id']} = $userdata['id'];
209      $data{$conf['user_fields']['email']} = $_POST['mail_address'];
210
211      // password is updated only if filled
212      if (!empty($_POST['use_new_pwd']))
213      {
214        array_push($fields, $conf['user_fields']['password']);
215        // password is encrpyted with function $conf['pass_convert']
216        $data{$conf['user_fields']['password']} =
217          $conf['pass_convert']($_POST['use_new_pwd']);
218      }
219      mass_updates(USERS_TABLE,
220                   array('primary' => array($conf['user_fields']['id']),
221                         'update' => $fields),
222                   array($data));
223    }
224
225    if ($conf['allow_user_customization'] or defined('IN_ADMIN'))
226    {
227      // update user "additional" informations (specific to Piwigo)
228      $fields = array(
229        'nb_image_line', 'nb_line_page', 'language', 'maxwidth', 'maxheight',
230        'expand', 'show_nb_comments', 'show_nb_hits', 'recent_period', 'theme'
231        );
232
233      $data = array();
234      $data['user_id'] = $userdata['id'];
235
236      foreach ($fields as $field)
237      {
238        if (isset($_POST[$field]))
239        {
240          $data[$field] = $_POST[$field];
241        }
242      }
243      mass_updates(USER_INFOS_TABLE,
244                   array('primary' => array('user_id'), 'update' => $fields),
245                   array($data));
246    }
247    trigger_action( 'save_profile_from_post', $userdata['id'] );
248
249    if (!empty($_POST['redirect']))
250    {
251      redirect($_POST['redirect']);
252    }
253  }
254  return true;
255}
256
257
258function load_profile_in_template($url_action, $url_redirect, $userdata)
259{
260  global $template, $conf;
261
262  $template->set_filename('profile_content', 'profile_content.tpl');
263
264  $template->assign('radio_options',
265    array(
266      'true' => l10n('Yes'),
267      'false' => l10n('No')));
268
269  $template->assign(
270    array(
271      'USERNAME'=>stripslashes($userdata['username']),
272      'EMAIL'=>get_email_address_as_display_text(@$userdata['email']),
273      'ALLOW_USER_CUSTOMIZATION'=>$conf['allow_user_customization'],
274      'NB_IMAGE_LINE'=>$userdata['nb_image_line'],
275      'NB_ROW_PAGE'=>$userdata['nb_line_page'],
276      'RECENT_PERIOD'=>$userdata['recent_period'],
277      'MAXWIDTH'=>@$userdata['maxwidth'],
278      'MAXHEIGHT'=>@$userdata['maxheight'],
279      'EXPAND' =>$userdata['expand'] ? 'true' : 'false',
280      'NB_COMMENTS'=>$userdata['show_nb_comments'] ? 'true' : 'false',
281      'NB_HITS'=>$userdata['show_nb_hits'] ? 'true' : 'false',
282      'REDIRECT' => $url_redirect,
283      'F_ACTION'=>$url_action,
284      ));
285
286  $template->assign('template_selection', $userdata['theme']);
287  $template->assign('template_options', get_pwg_themes());
288
289  foreach (get_languages() as $language_code => $language_name)
290  {
291    if (isset($_POST['submit']) or $userdata['language'] == $language_code)
292    {
293      $template->assign('language_selection', $language_code);
294    }
295    $language_options[$language_code] = $language_name;
296  }
297
298  $template->assign('language_options', $language_options);
299
300  $special_user = in_array($userdata['id'], array($conf['guest_id'], $conf['default_user_id']));
301  $template->assign('SPECIAL_USER', $special_user);
302  $template->assign('IN_ADMIN', defined('IN_ADMIN'));
303
304  // allow plugins to add their own form data to content
305  trigger_action( 'load_profile_in_template', $userdata );
306
307  $template->assign('PWG_TOKEN', get_pwg_token());
308  $template->assign_var_from_handle('PROFILE_CONTENT', 'profile_content');
309}
310?>
Note: See TracBrowser for help on using the repository browser.