}
$mr = $r->fetchOneAssoc();
- if (!is_numeric($login)) { //user has a forlife
+ // Checks the user has a forlife, as non-registered user can't have redirections.
+ if ($mr['forlife']) {
$redirect = new Redirect($mr['user_id']);
}
// Check if there was a submission
foreach($_POST as $key => $val) {
+ S::assert_xsrf_token();
+
switch ($key) {
case "add_fwd":
$email = trim(Env::v('email'));
case "u_edit":
require_once('secure_hash.inc.php');
$pass_encrypted = Env::v('newpass_clair') != "********" ? hash_encrypt(Env::v('newpass_clair')) : Env::v('passw');
- $naiss = Env::v('naissanceN');
- $deces = Env::v('decesN');
- $perms = Env::v('permsN');
- $prenm = Env::v('prenomN');
- $nom = Env::v('nomN');
- $promo = Env::i('promoN');
- $sexe = Env::v('sexeN');
- $comm = trim(Env::v('commentN'));
- $watch = Env::v('watchN');
- $flags = '';
+ $naiss = Env::v('naissanceN');
+ $deces = Env::v('decesN');
+ $perms = Env::v('permsN');
+ $prenm = Env::v('prenomN');
+ $nom = Env::v('nomN');
+ $nomusage = Env::v('nomusageN');
+ $promo = Env::i('promoN');
+ $sexe = Env::v('sexeN');
+ $comm = trim(Env::v('commentN'));
+ $watch = Env::v('watchN');
+ $flags = '';
if ($sexe) {
$flags = 'femme';
}
break;
}
- $watch = 'SELECT naissance, deces, password, perms,
+ $watch = 'SELECT naissance, deces, password, perms, nom_usage,
prenom, nom, flags, promo, comment
FROM auth_user_md5
WHERE user_id = ' . $mr['user_id'];
perms = '$perms',
prenom = '".addslashes($prenm)."',
nom = '".addslashes($nom)."',
+ nom_usage = '".addslashes($nomusage)."',
flags = '$flags',
promo = $promo,
comment = '".addslashes($comm)."'
$new_fields = $res->fetchOneAssoc();
$mailer = new PlMailer("admin/useredit.mail.tpl");
- $mailer->assign("user", S::v('forlife'));
+ $mailer->assign("admin", S::v('forlife'));
+ $mailer->assign("user", $mr['forlife']);
$mailer->assign('old', $old_fields);
$mailer->assign('new', $new_fields);
$mailer->send();
update_NbIns();
$page->trig("'{$mr['user_id']}' a été désinscrit !");
$mailer = new PlMailer("admin/useredit.mail.tpl");
- $mailer->assign("user", S::v('forlife'));
+ $mailer->assign("admin", S::v('forlife'));
+ $mailer->assign("user", $mr['forlife']);
$mailer->assign("deletion", true);
$mailer->send();
break;
}
}
- $page->assign('op',$op);
- $page->assign('target',$target);
+ $page->assign('op', $op);
+ $page->assign('target', $target);
// on a un $target valide, on prepare les mails
if ($target) {
-
// on examine l'op a effectuer
switch ($op) {
case 'mail':
- send_warning_homonyme($prenom, $nom, $forlife, $loginbis);
- switch_bestalias($target, $loginbis);
+ S::assert_xsrf_token();
+
+ send_warning_homonyme($prenom, $nom, $forlife, $loginbis);
+ switch_bestalias($target, $loginbis);
$op = 'list';
break;
+
case 'correct':
- switch_bestalias($target, $loginbis);
+ S::assert_xsrf_token();
+
+ switch_bestalias($target, $loginbis);
XDB::execute("UPDATE aliases SET type='homonyme',expire=NOW() WHERE alias={?}", $loginbis);
XDB::execute("REPLACE INTO homonymes (homonyme_id,user_id) VALUES({?},{?})", $target, $target);
- send_robot_homonyme($prenom, $nom, $forlife, $loginbis);
+ send_robot_homonyme($prenom, $nom, $forlife, $loginbis);
$op = 'list';
break;
}
$page->assign('promo',$promo);
if ($validate) {
+ S::assert_xsrf_token();
+
$new_deces = array();
$res = XDB::iterRow("SELECT user_id,matricule,nom,prenom,deces FROM auth_user_md5 WHERE promo = {?}", $promo);
while (list($uid,$mat,$nom,$prenom,$deces) = $res->next()) {
$val = Env::v($mat);
- if($val == $deces || empty($val)) continue;
- XDB::execute('UPDATE auth_user_md5 SET deces={?} WHERE matricule = {?}', $val, $mat);
- $new_deces[] = array('name' => "$prenom $nom", 'date' => "$val");
- if($deces=='0000-00-00' or empty($deces)) {
- require_once('notifs.inc.php');
- register_watch_op($uid, WATCH_DEATH, $val);
- require_once('user.func.inc.php');
- user_clear_all_subs($uid, false); // by default, dead ppl do not loose their email
- }
+ if($val == $deces || empty($val)) {
+ continue;
+ }
+
+ XDB::execute('UPDATE auth_user_md5 SET deces={?} WHERE matricule = {?}', $val, $mat);
+ $new_deces[] = array('name' => "$prenom $nom", 'date' => "$val");
+ if($deces == '0000-00-00' || empty($deces)) {
+ require_once('notifs.inc.php');
+ register_watch_op($uid, WATCH_DEATH, $val);
+ require_once('user.func.inc.php');
+ user_clear_all_subs($uid, false); // by default, dead ppl do not loose their email
+ }
}
$page->assign('new_deces',$new_deces);
}
}
if(Env::has('uid') && Env::has('type') && Env::has('stamp')) {
+ S::assert_xsrf_token();
+
$req = Validate::get_typed_request(Env::v('uid'), Env::v('type'), Env::v('stamp'));
- if($req) { $req->handle_formu(); }
+ $req->handle_formu();
}
$r = XDB::iterator('SHOW COLUMNS FROM requests_answers');
}
$page->assign('hide_requests', $hidden);
+ // Update the count of item to validate here... useful in development configuration
+ // where several copies of the site use the same DB, but not the same "dynamic configuration"
+ update_NbValid();
$page->assign('vit', new ValidateIterator());
}
$page->setRssLink('Changement Récents',
'/Site/AllRecentChanges?action=rss&user=' . S::v('forlife') . '&hash=' . S::v('core_rss_hash'));
}
+
// update wiki perms
if ($action == 'update') {
+ S::assert_xsrf_token();
+
$perms_read = Post::v('read');
$perms_edot = Post::v('edit');
if ($perms_read || $perms_edit) {
}
if ($action == 'delete' && $wikipage != '') {
+ S::assert_xsrf_token();
+
if (wiki_delete_page($wikipage)) {
$page->trig("La page ".$wikipage." a été supprimée.");
} else {
}
if ($action == 'rename' && $wikipage != '' && $wikipage2 != '' && $wikipage != $wikipage2) {
+ S::assert_xsrf_token();
+
if ($changedLinks = wiki_rename_page($wikipage, $wikipage2)) {
$s = 'La page <em>'.$wikipage.'</em> a été déplacée en <em>'.$wikipage2.'</em>.';
if (is_numeric($changedLinks)) {
$page->assign('states', $states);
switch (Post::v('action')) {
- case 'create':
+ case 'create':
if (trim(Post::v('ipN')) != '') {
+ S::assert_xsrf_token();
Xdb::execute('INSERT IGNORE INTO ip_watch (ip, mask, state, detection, last, uid, description)
VALUES ({?}, {?}, {?}, CURDATE(), NOW(), {?}, {?})',
ip_to_uint(trim(Post::v('ipN'))), ip_to_uint(trim(Post::v('maskN'))),
};
break;
- case 'edit':
+ case 'edit':
+ S::assert_xsrf_token();
Xdb::execute('UPDATE ip_watch
SET state = {?}, last = NOW(), uid = {?}, description = {?}, mask = {?}
WHERE ip = {?}', Post::v('stateN'), S::i('uid'), Post::v('descriptionN'),
ip_to_uint(Post::v('maskN')), ip_to_uint(Post::v('ipN')));
break;
- default:
+ default:
if ($action == 'delete' && !is_null($ip)) {
+ S::assert_xsrf_token();
Xdb::execute('DELETE FROM ip_watch WHERE ip = {?}', ip_to_uint($ip));
}
}