'special' => true);
}
- $exclude = is_null($exclude) ? '' : ' AND id != ' . $exclude . ' ';
+ $exclude = is_null($exclude) ? '' : ' AND id != ' . intval($exclude) . ' ';
$priority = rand(0, 510);
do {
$priority = (int)($priority/2);
// cache les evenements lus et raffiche les evenements a relire
if ($action == 'read' && $eid) {
- XDB::execute('DELETE evenements_vus.*
+ XDB::execute('DELETE ev.*
FROM evenements_vus AS ev
INNER JOIN evenements AS e ON e.id = ev.evt_id
WHERE peremption < NOW()');
exit;
}
} else {
- $upload = new PlUpload(S::v('forlife'), 'event');
+ $upload = new PlUpload(S::user()->login(), 'event');
if ($upload->exists() && $upload->isType('image')) {
header('Content-Type: ' . $upload->contentType());
echo $upload->getContents();
function handler_rss(&$page, $user = null, $hash = null)
{
- require_once 'rss.inc.php';
-
- $uid = init_rss('events/rss.tpl', $user, $hash);
-
- $rss = XDB::iterator(
- 'SELECT e.id, e.titre, e.texte, e.creation_date, e.post_id, p.attachmime IS NOT NULL AS photo,
- IF(u2.nom_usage = "", u2.nom, u2.nom_usage) AS nom, u2.prenom, u2.promo,
- FIND_IN_SET(\'wiki\', e.flags) AS wiki
- FROM auth_user_md5 AS u
- INNER JOIN evenements AS e ON ( (e.promo_min = 0 || e.promo_min <= u.promo)
- AND (e.promo_max = 0 || e.promo_max >= u.promo) )
- LEFT JOIN evenements_photo AS p ON (p.eid = e.id)
- INNER JOIN auth_user_md5 AS u2 ON (u2.user_id = e.user_id)
- WHERE u.user_id = {?} AND FIND_IN_SET("valide", e.flags)
- AND peremption >= NOW()', $uid);
- $page->assign('rss', $rss);
+ $this->load('feed.inc.php');
+ $feed = new EventFeed();
+ return $feed->run($page, $user, $hash);
}
function handler_preview(&$page)
$page->changeTpl('events/submit.tpl');
$page->addJsLink('ajax.js');
- require_once('wiki.inc.php');
- wiki_require_page('Xorg.Annonce');
+ $wp = new PlWikiPage('Xorg.Annonce');
+ $wp->buildCache();
$titre = Post::v('titre');
$texte = Post::v('texte');
$peremption = Post::i('peremption');
$valid_mesg = Post::v('valid_mesg');
$action = Post::v('action');
- $upload = new PlUpload(S::v('forlife'), 'event');
+ $upload = new PlUpload(S::user()->login(), 'event');
$this->upload_image($page, $upload);
if (($promo_min > $promo_max && $promo_max != 0)||
} elseif ($action && (!trim($texte) || !trim($titre))) {
$page->trigError("L'article doit avoir un titre et un contenu");
} elseif ($action) {
+ S::assert_xsrf_token();
+
require_once 'validations.inc.php';
$evtreq = new EvtReq($titre, $texte, $promo_min, $promo_max,
- $peremption, $valid_mesg, S::v('uid'), $upload);
+ $peremption, $valid_mesg, S::user(), $upload);
$evtreq->submit();
$page->assign('ok', true);
} elseif (!Env::v('preview')) {
function handler_admin_tips(&$page, $action = 'list', $id = null)
{
- $page->setTitle('Polytechnique.org - Administration - Astuces');
+ $page->setTitle('Administration - Astuces');
$page->assign('title', 'Gestion des Astuces');
$table_editor = new PLTableEditor('admin/tips', 'tips', 'id');
$table_editor->describe('peremption', 'date de péremption', true);
{
$page->changeTpl('events/admin.tpl');
$page->addJsLink('ajax.js');
- $page->setTitle('Polytechnique.org - Administration - Evenements');
+ $page->setTitle('Administration - Evenements');
$page->register_modifier('hde', 'html_entity_decode');
$arch = $action == 'archives';
$page->assign('action', $action);
- $upload = new PlUpload(S::v('forlife'), 'event');
+ $upload = new PlUpload(S::user()->login(), 'event');
if ((Env::has('preview') || Post::v('action') == "Proposer") && $eid) {
$action = 'edit';
$this->upload_image($page, $upload);
}
if (Post::v('action') == 'Pas d\'image' && $eid) {
+ S::assert_xsrf_token();
$upload->rm();
XDB::execute("DELETE FROM evenements_photo WHERE eid = {?}", $eid);
$action = 'edit';
} elseif (Post::v('action') == 'Supprimer l\'image' && $eid) {
+ S::assert_xsrf_token();
$upload->rm();
$action = 'edit';
} elseif (Post::v('action') == "Proposer" && $eid) {
+ S::assert_xsrf_token();
$promo_min = Post::i('promo_min');
$promo_max = Post::i('promo_max');
if (($promo_min != 0 && ($promo_min <= 1900 || $promo_min >= 2020)) ||
} else {
switch ($action) {
case 'delete':
+ S::assert_xsrf_token();
XDB::execute('DELETE from evenements
WHERE id = {?}', $eid);
break;
case "archive":
+ S::assert_xsrf_token();
XDB::execute('UPDATE evenements
SET creation_date = creation_date, flags = CONCAT(flags,",archive")
WHERE id = {?}', $eid);
break;
case "unarchive":
+ S::assert_xsrf_token();
XDB::execute('UPDATE evenements
SET creation_date = creation_date, flags = REPLACE(flags,"archive","")
WHERE id = {?}', $eid);
break;
case "valid":
+ S::assert_xsrf_token();
XDB::execute('UPDATE evenements
SET creation_date = creation_date, flags = CONCAT(flags,",valide")
WHERE id = {?}', $eid);
break;
case "unvalid":
+ S::assert_xsrf_token();
XDB::execute('UPDATE evenements
SET creation_date = creation_date, flags = REPLACE(flags,"valide", "")
WHERE id = {?}', $eid);