Adds missing anti-XSRF protections in Admin module.
[platal.git] / modules / carnet.php
CommitLineData
0337d704 1<?php
2/***************************************************************************
179afa7f 3 * Copyright (C) 2003-2008 Polytechnique.org *
0337d704 4 * http://opensource.polytechnique.org/ *
5 * *
6 * This program is free software; you can redistribute it and/or modify *
7 * it under the terms of the GNU General Public License as published by *
8 * the Free Software Foundation; either version 2 of the License, or *
9 * (at your option) any later version. *
10 * *
11 * This program is distributed in the hope that it will be useful, *
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
14 * GNU General Public License for more details. *
15 * *
16 * You should have received a copy of the GNU General Public License *
17 * along with this program; if not, write to the Free Software *
18 * Foundation, Inc., *
19 * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
20 ***************************************************************************/
21
c9f82d49 22class CarnetModule extends PLModule
23{
24 function handlers()
25 {
26 return array(
5e193297 27 'carnet' => $this->make_hook('index', AUTH_COOKIE),
28 'carnet/panel' => $this->make_hook('panel', AUTH_COOKIE),
29 'carnet/notifs' => $this->make_hook('notifs', AUTH_COOKIE),
fc12cbd1 30
5e193297 31 'carnet/contacts' => $this->make_hook('contacts', AUTH_COOKIE),
8fc4efa3 32 'carnet/contacts/pdf' => $this->make_hook('pdf', AUTH_COOKIE, 'user', NO_HTTPS),
33 'carnet/contacts/ical' => $this->make_hook('ical', AUTH_PUBLIC, 'user', NO_HTTPS),
34 'carnet/contacts/vcard' => $this->make_hook('vcard', AUTH_COOKIE, 'user', NO_HTTPS),
b48a0758 35
8fc4efa3 36 'carnet/rss' => $this->make_hook('rss', AUTH_PUBLIC, 'user', NO_HTTPS),
c9f82d49 37 );
38 }
0337d704 39
8d8f7607 40 function on_subscribe($forlife, $uid, $promo, $password)
41 {
42 require_once 'notifs.inc.php';
43 register_watch_op($uid, WATCH_INSCR);
44 inscription_notifs_base($uid);
45 }
46
fc12cbd1 47 function _add_rss_link(&$page)
48 {
cab08090 49 if (!S::has('core_rss_hash')) {
fc12cbd1 50 return;
fd8f77de 51 }
162370e7 52 $page->setRssLink('Polytechnique.org :: Carnet',
53 '/carnet/rss/'.S::v('forlife') .'/'.S::v('core_rss_hash').'/rss.xml');
fc12cbd1 54 }
55
b48a0758 56 function handler_index(&$page)
57 {
58 $page->changeTpl('carnet/index.tpl');
59 $page->assign('xorg_title','Polytechnique.org - Mon carnet');
60 $this->_add_rss_link($page);
b48a0758 61 }
62
fc12cbd1 63 function handler_panel(&$page)
64 {
65 $page->changeTpl('carnet/panel.tpl');
66
67 if (Get::has('read')) {
5e2307dc 68 $_SESSION['watch_last'] = Get::v('read');
c557ed51 69 update_NbNotifs();
8b00e0e0 70 pl_redirect('carnet/panel');
fc12cbd1 71 }
72
73 require_once 'notifs.inc.php';
74
75 $page->assign('now',date('YmdHis'));
cab08090 76 $notifs = new Notifs(S::v('uid'), true);
fc12cbd1 77
78 $page->assign('notifs', $notifs);
79 $page->assign('today', date('Y-m-d'));
80 $this->_add_rss_link($page);
fc12cbd1 81 }
82
b48a0758 83 function _handler_notifs_promos(&$page, &$watch, $action, $arg)
84 {
85 if(preg_match('!^ *(\d{4}) *$!', $arg, $matches)) {
86 $p = intval($matches[1]);
87 if($p<1900 || $p>2100) {
a7de4ef7 88 $page->trig("la promo entrée est invalide");
b48a0758 89 } else {
90 if ($action == 'add_promo') {
91 $watch->_promos->add($p);
92 } else {
93 $watch->_promos->del($p);
94 }
95 }
96 } elseif (preg_match('!^ *(\d{4}) *- *(\d{4}) *$!', $arg, $matches)) {
97 $p1 = intval($matches[1]);
98 $p2 = intval($matches[2]);
99 if($p1<1900 || $p1>2100) {
a7de4ef7 100 $page->trig('la première promo de la plage entrée est invalide');
b48a0758 101 } elseif($p2<1900 || $p2>2100) {
a7de4ef7 102 $page->trig('la seconde promo de la plage entrée est invalide');
b48a0758 103 } else {
104 if ($action == 'add_promo') {
105 $watch->_promos->addRange($p1, $p2);
106 } else {
107 $watch->_promos->delRange($p1, $p2);
108 }
109 }
110 } else {
a7de4ef7 111 $page->trig("La promo (ou la plage de promo) entrée est dans un format incorrect.");
b48a0758 112 }
113 }
114
115 function handler_notifs(&$page, $action = null, $arg = null)
116 {
b48a0758 117 $page->changeTpl('carnet/notifs.tpl');
118
119 require_once 'notifs.inc.php';
120
cab08090 121 $watch = new Watch(S::v('uid'));
b48a0758 122
08cce2ff 123 $res = XDB::query("SELECT promo_sortie
b48a0758 124 FROM auth_user_md5
125 WHERE user_id = {?}",
cab08090 126 S::v('uid', -1));
b48a0758 127 $promo_sortie = $res->fetchOneCell();
128 $page->assign('promo_sortie', $promo_sortie);
129
130 switch ($action) {
131 case 'add_promo':
132 case 'del_promo':
133 $this->_handler_notifs_promos($page, $watch, $action, $arg);
134 break;
135
136 case 'del_nonins':
137 $watch->_nonins->del($arg);
138 break;
139
140 case 'add_nonins':
141 $watch->_nonins->add($arg);
142 break;
143 }
144
145 if (Env::has('subs')) $watch->_subs->update('sub');
146 if (Env::has('flags_contacts')) {
5e2307dc 147 $watch->watch_contacts = Env::b('contacts');
b48a0758 148 $watch->saveFlags();
149 }
150 if (Env::has('flags_mail')) {
5e2307dc 151 $watch->watch_mail = Env::b('mail');
b48a0758 152 $watch->saveFlags();
153 }
154
155 $page->assign_by_ref('watch', $watch);
b48a0758 156 }
157
158 function _get_list($offset, $limit) {
cab08090 159 $uid = S::v('uid');
08cce2ff 160 $res = XDB::query("SELECT COUNT(*) FROM contacts WHERE uid = {?}", $uid);
b48a0758 161 $total = $res->fetchOneCell();
162
5e2307dc 163 $order = Get::v('order');
b48a0758 164 $orders = Array(
165 'nom' => 'nom DESC, u.prenom, u.promo',
166 'promo' => 'promo DESC, nom, u.prenom',
167 'last' => 'u.date DESC, nom, u.prenom, promo');
168 if ($order != 'promo' && $order != 'last')
169 $order = 'nom';
170 $order = $orders[$order];
5e2307dc 171 if (Get::v('inv') == '')
b48a0758 172 $order = str_replace(" DESC,", ",", $order);
173
08cce2ff 174 $res = XDB::query("
b48a0758 175 SELECT u.prenom, IF(u.nom_usage='',u.nom,u.nom_usage) AS nom, a.alias AS forlife, u.promo
176 FROM contacts AS c
177 INNER JOIN auth_user_md5 AS u ON (u.user_id = c.contact)
178 INNER JOIN aliases AS a ON (u.user_id = a.id AND a.type='a_vie')
179 WHERE c.uid = {?}
180 ORDER BY $order
181 LIMIT {?}, {?}", $uid, $offset*$limit, $limit);
182 $list = $res->fetchAllAssoc();
183
184 return Array($total, $list);
185 }
186
3b2f9d11 187 function searchErrorHandler($explain) {
188 global $page;
189 $page->trig($explain);
190 $this->handler_contacts($page);
191 }
192
a2aa8436 193 function handler_contacts(&$page, $action = null, $subaction = null, $ssaction = null)
b48a0758 194 {
b48a0758 195 $page->assign('xorg_title','Polytechnique.org - Mes contacts');
59a61432 196 $this->_add_rss_link($page);
b48a0758 197
cab08090 198 $uid = S::v('uid');
5e2307dc 199 $user = Env::v('user');
b48a0758 200
5e2307dc 201 switch (Env::v('action')) {
b48a0758 202 case 'retirer':
203 if (is_numeric($user)) {
08cce2ff 204 if (XDB::execute('DELETE FROM contacts
8c4a0c30 205 WHERE uid = {?} AND contact = {?}',
206 $uid, $user))
b48a0758 207 {
a7de4ef7 208 $page->trig("Contact retiré !");
b48a0758 209 }
210 } else {
08cce2ff 211 if (XDB::execute(
e2f609cd 212 'DELETE FROM c
b48a0758 213 USING contacts AS c
214 INNER JOIN aliases AS a ON (c.contact=a.id and a.type!="homonyme")
215 WHERE c.uid = {?} AND a.alias={?}', $uid, $user))
216 {
a7de4ef7 217 $page->trig("Contact retiré !");
b48a0758 218 }
219 }
220 break;
221
222 case 'ajouter':
223 require_once('user.func.inc.php');
224 if (($login = get_user_login($user)) !== false) {
08cce2ff 225 if (XDB::execute(
51e10229 226 'REPLACE INTO contacts (uid, contact)
227 SELECT {?}, id
228 FROM aliases
229 WHERE alias = {?}', $uid, $login))
b48a0758 230 {
a7de4ef7 231 $page->trig('Contact ajouté !');
b48a0758 232 } else {
a7de4ef7 233 $page->trig('Contact déjà dans la liste !');
b48a0758 234 }
235 }
236 }
237
a2aa8436 238 $search = false;
239 if ($action == 'search') {
240 $action = $subaction;
241 $subaction = $ssaction;
242 $search = true;
243 }
244 if ($search && trim(Env::v('quick'))) {
245 require_once 'userset.inc.php';
246 $base = 'carnet/contacts/search';
3b2f9d11 247
248 require_once(dirname(__FILE__) . '/search/classes.inc.php');
249 ThrowError::$throwHook = array($this, 'searchErrorHandler');
250 $view = new SearchSet(true, false, "INNER JOIN contacts AS c2 ON (u.user_id = c2.contact)", "c2.uid = $uid");
a2aa8436 251 } else {
252 $base = 'carnet/contacts';
253 $view = new UserSet("INNER JOIN contacts AS c2 ON (u.user_id = c2.contact)", " c2.uid = $uid ");
254 }
8c4a0c30 255 $view->addMod('minifiche', 'Mini-Fiches', true);
256 $view->addMod('trombi', 'Trombinoscope', false, array('with_admin' => false, 'with_promo' => true));
a2aa8436 257 $view->addMod('geoloc', 'Planisphère', false, array('with_annu' => 'carnet/contacts/search'));
258 $view->apply($base, $page, $action, $subaction);
259 if ($action != 'geoloc' || ($search && !$ssaction) || (!$search && !$subaction)) {
8c4a0c30 260 $page->changeTpl('carnet/mescontacts.tpl');
b48a0758 261 }
b48a0758 262 }
263
264 function handler_pdf(&$page, $arg0 = null, $arg1 = null)
265 {
ee5990c7 266 require_once dirname(__FILE__).'/carnet/contacts.pdf.inc.php';
b48a0758 267 require_once 'user.func.inc.php';
268
269 session_write_close();
270
271 $sql = "SELECT a.alias
272 FROM aliases AS a
273 INNER JOIN auth_user_md5 AS u ON ( a.id = u.user_id )
274 INNER JOIN contacts AS c ON ( a.id = c.contact )
275 WHERE c.uid = {?} AND a.type='a_vie'";
276 if ($arg0 == 'promo') {
277 $sql .= ' ORDER BY u.promo, u.nom, u.prenom';
278 } else {
279 $sql .= ' ORDER BY u.nom, u.prenom, u.promo';
280 }
281
cab08090 282 $citer = XDB::iterRow($sql, S::v('uid'));
b48a0758 283 $pdf = new ContactsPDF();
284
285 while (list($alias) = $citer->next()) {
286 $user = get_user_details($alias);
ac73e294 287 foreach ($user as &$value) {
288 if (is_utf8($value)) {
289 $value = utf8_decode($value);
290 }
291 }
93c099e1 292 $pdf = ContactsPDF::addContact($pdf, $user, $arg0 == 'photos' || $arg1 == 'photos');
b48a0758 293 }
294 $pdf->Output();
295
296 exit;
297 }
298
c9f82d49 299 function handler_rss(&$page, $user = null, $hash = null)
300 {
301 require_once 'rss.inc.php';
302 require_once 'notifs.inc.php';
0337d704 303
c9f82d49 304 $uid = init_rss('carnet/rss.tpl', $user, $hash);
305 $notifs = new Notifs($uid, false);
306 $page->assign('notifs', $notifs);
c9f82d49 307 }
fbfb06dc 308
963c0b2e 309 function handler_ical(&$page, $alias = null, $hash = null)
fbfb06dc 310 {
963c0b2e 311 require_once 'rss.inc.php';
312 $uid = init_rss(null, $alias, $hash, false);
313 if (S::logged()) {
314 if (!$uid) {
315 $uid = S::i('uid');
316 } else if ($uid != S::i('uid')) {
317 require_once 'xorg.misc.inc.php';
318 send_warning_email("Récupération d\'un autre utilisateur ($uid)");
319 }
320 } else if (!$uid) {
321 exit;
322 }
99544d53 323 require_once 'ical.inc.php';
801fcad8 324 $page->changeTpl('carnet/calendar.tpl', NO_SKIN);
3585b0c8 325 $page->register_function('display_ical', 'display_ical');
fbfb06dc 326
f3b3f363 327 $res = XDB::iterRow(
328 'SELECT u.prenom,
329 IF(u.nom_usage = \'\',u.nom,u.nom_usage) AS nom,
330 u.promo,
331 u.naissance,
332 DATE_ADD(u.naissance, INTERVAL 1 DAY) AS end,
333 u.date_ins,
334 a.alias AS forlife
335 FROM contacts AS c
336 INNER JOIN auth_user_md5 AS u ON (u.user_id = c.contact)
337 INNER JOIN aliases AS a ON (u.user_id = a.id AND a.type = \'a_vie\')
963c0b2e 338 WHERE c.uid = {?}', $uid);
f3b3f363 339
340 $annivs = Array();
341 while (list($prenom, $nom, $promo, $naissance, $end, $ts, $forlife) = $res->next()) {
342 $naissance = str_replace('-', '', $naissance);
343 $end = str_replace('-', '', $end);
344 $annivs[] = array(
345 'timestamp' => strtotime($ts),
346 'date' => $naissance,
347 'tomorrow' => $end,
348 'forlife' => $forlife,
349 'summary' => 'Anniversaire de '.$prenom
350 .' '.$nom.' - x '.$promo,
351 );
fbfb06dc 352 }
f3b3f363 353 $page->assign('events', $annivs);
fbfb06dc 354
355 header('Content-Type: text/calendar; charset=utf-8');
fbfb06dc 356 }
5e193297 357
917c4d11 358 function handler_vcard(&$page, $photos = null)
5e193297 359 {
360 $res = XDB::query('SELECT contact
361 FROM contacts
362 WHERE uid = {?}', S::v('uid'));
917c4d11 363 $vcard = new VCard($res->fetchColumn(), $photos == 'photos');
5e193297 364 $vcard->do_page(&$page);
365 }
4da0b8d7 366}
c9f82d49 367
a7de4ef7 368// vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
c9f82d49 369?>