}
$mr = $r->fetchOneAssoc();
- if (!is_numeric($login)) { //user has a forlife
+ // Checks the user has a forlife, as non-registered user can't have redirections.
+ if ($mr['forlife']) {
$redirect = new Redirect($mr['user_id']);
}
// Check if there was a submission
foreach($_POST as $key => $val) {
+ if (!S::has_xsrf_token()) {
+ $page->kill("L'opération de modification de l'utilisateur a échouée, merci de réessayer.");
+ }
switch ($key) {
case "add_fwd":
$email = trim(Env::v('email'));
break;
case "clean_fwd":
if (!empty($val)) {
- $redirect->cleanErrors($val);
+ $redirect->clean_errors($val);
}
break;
case "add_alias":
promo = $promo,
comment = '".addslashes($comm)."'
WHERE user_id = '{$mr['user_id']}'";
+ if ($perms == 'disabled' && $old_fields['perms'] != 'disabled') {
+ // A user has been banned ==> ensure his php session has been killed
+ // This solution is ugly and overkill, but, it should be efficient.
+ kill_sessions();
+ }
if (XDB::execute($query)) {
user_reindex($mr['user_id']);
$mailer->assign('old', $old_fields);
$mailer->assign('new', $new_fields);
$mailer->send();
-
+
// update number of subscribers (perms or deceased may have changed)
update_NbIns();
if ($globals->mailstorage->googleapps_domain && Env::v('newpass_clair') != "********") {
require_once 'googleapps.inc.php';
$account = new GoogleAppsAccount($mr['user_id'], $mr['forlife']);
- if ($account->g_status == 'active' && $account->sync_password) {
+ if ($account->active() && $account->sync_password) {
$account->set_password($pass_encrypted);
}
}
$page->assign('promo',$promo);
- if ($validate) {
+ if ($validate && S::has_xsrf_token()) {
$new_deces = array();
$res = XDB::iterRow("SELECT user_id,matricule,nom,prenom,deces FROM auth_user_md5 WHERE promo = {?}", $promo);
while (list($uid,$mat,$nom,$prenom,$deces) = $res->next()) {
$val = Env::v($mat);
- if($val == $deces || empty($val)) continue;
- XDB::execute('UPDATE auth_user_md5 SET deces={?} WHERE matricule = {?}', $val, $mat);
- $new_deces[] = array('name' => "$prenom $nom", 'date' => "$val");
- if($deces=='0000-00-00' or empty($deces)) {
- require_once('notifs.inc.php');
- register_watch_op($uid, WATCH_DEATH, $val);
- require_once('user.func.inc.php');
- user_clear_all_subs($uid, false); // by default, dead ppl do not loose their email
- }
+ if($val == $deces || empty($val)) {
+ continue;
+ }
+
+ XDB::execute('UPDATE auth_user_md5 SET deces={?} WHERE matricule = {?}', $val, $mat);
+ $new_deces[] = array('name' => "$prenom $nom", 'date' => "$val");
+ if($deces == '0000-00-00' || empty($deces)) {
+ require_once('notifs.inc.php');
+ register_watch_op($uid, WATCH_DEATH, $val);
+ require_once('user.func.inc.php');
+ user_clear_all_subs($uid, false); // by default, dead ppl do not loose their email
+ }
}
$page->assign('new_deces',$new_deces);
+ } else if (!$validate) {
+ $page->trig("La mise à jour des dates de decès à échouée, merci de réessayer.");
}
$res = XDB::iterator('SELECT matricule, nom, prenom, deces FROM auth_user_md5 WHERE promo = {?} ORDER BY nom,prenom', $promo);
if(Env::has('uid') && Env::has('type') && Env::has('stamp')) {
$req = Validate::get_typed_request(Env::v('uid'), Env::v('type'), Env::v('stamp'));
- if($req) { $req->handle_formu(); }
+ if($req && S::has_xsrf_token()) {
+ $req->handle_formu();
+ } else if ($req) {
+ $page->trig("L'opération a échoué, merci de réessayer.");
+ }
}
$r = XDB::iterator('SHOW COLUMNS FROM requests_answers');
$page->setRssLink('Changement Récents',
'/Site/AllRecentChanges?action=rss&user=' . S::v('forlife') . '&hash=' . S::v('core_rss_hash'));
}
+
// update wiki perms
if ($action == 'update') {
$perms_read = Post::v('read');
$page->assign('states', $states);
switch (Post::v('action')) {
- case 'create':
+ case 'create':
if (trim(Post::v('ipN')) != '') {
- Xdb::execute('INSERT IGNORE INTO ip_watch (ip, state, detection, last, uid, description)
- VALUES ({?}, {?}, CURDATE(), NOW(), {?}, {?})',
- ip_to_uint(trim(Post::v('ipN'))), Post::v('stateN'), S::i('uid'), Post::v('descriptionN'));
+ if (!S::has_xsrf_token()) {
+ $page->trig("L'ajout d'une IP à surveiller a échoué, merci de réessayer.");
+ break;
+ }
+ Xdb::execute('INSERT IGNORE INTO ip_watch (ip, mask, state, detection, last, uid, description)
+ VALUES ({?}, {?}, {?}, CURDATE(), NOW(), {?}, {?})',
+ ip_to_uint(trim(Post::v('ipN'))), ip_to_uint(trim(Post::v('maskN'))),
+ Post::v('stateN'), S::i('uid'), Post::v('descriptionN'));
};
break;
- case 'edit':
+ case 'edit':
+ if (!S::has_xsrf_token()) {
+ $page->trig("L'édition de l'IP a échoué, merci de réessayer.");
+ break;
+ }
Xdb::execute('UPDATE ip_watch
- SET state = {?}, last = NOW(), uid = {?}, description = {?}
+ SET state = {?}, last = NOW(), uid = {?}, description = {?}, mask = {?}
WHERE ip = {?}', Post::v('stateN'), S::i('uid'), Post::v('descriptionN'),
- ip_to_uint(Post::v('ipN')));
+ ip_to_uint(Post::v('maskN')), ip_to_uint(Post::v('ipN')));
break;
- default:
+ default:
if ($action == 'delete' && !is_null($ip)) {
- Xdb::execute('DELETE FROM ip_watch WHERE ip = {?}', ip_to_uint($ip));
+ if (S::has_xsrf_token()) {
+ Xdb::execute('DELETE FROM ip_watch WHERE ip = {?}', ip_to_uint($ip));
+ } else {
+ $page->trig("La suppression de l'adresse IP a échouée, merci de réssayer.");
+ }
}
}
if ($action != 'create' && $action != 'edit') {
$sql = "SELECT w.ip, IF(s.ip IS NULL,
IF(w.ip = s2.ip, s2.host, s2.forward_host),
IF(w.ip = s.ip, s.host, s.forward_host)),
- w.detection, w.state, a.alias AS forlife
+ w.mask, w.detection, w.state, a.alias AS forlife
FROM ip_watch AS w
LEFT JOIN logger.sessions AS s ON (s.ip = w.ip)
LEFT JOIN logger.sessions AS s2 ON (s2.forward_ip = w.ip)
$table = array();
$props = array();
- while (list($ip, $host, $date, $state, $forlife) = $it->next()) {
+ while (list($ip, $host, $mask, $date, $state, $forlife) = $it->next()) {
$ip = uint_to_ip($ip);
+ $mask = uint_to_ip($mask);
if (count($props) == 0 || $props['ip'] != $ip) {
if (count($props) > 0) {
$table[] = $props;
}
$props = array('ip' => $ip,
+ 'mask' => $mask,
'host' => $host,
'detection' => $date,
'state' => $state,
}
$page->assign('table', $table);
} elseif ($action == 'edit') {
- $sql = "SELECT w.detection, w.state, w.last, w.description,
+ $sql = "SELECT w.detection, w.state, w.last, w.description, w.mask,
a1.alias AS edit, a2.alias AS forlife, s.host
FROM ip_watch AS w
LEFT JOIN aliases AS a1 ON (a1.id = w.uid AND a1.type = 'a_vie')
$it = Xdb::iterRow($sql, ip_to_uint($ip));
$props = array();
- while (list($detection, $state, $last, $description, $edit, $forlife, $host) = $it->next()) {
+ while (list($detection, $state, $last, $description, $mask, $edit, $forlife, $host) = $it->next()) {
if (count($props) == 0) {
$props = array('ip' => $ip,
+ 'mask' => uint_to_ip($mask),
'host' => $host,
'detection' => $detection,
'state' => $state,
projects / platal.git / blobdiff