<?php
/***************************************************************************
- * Copyright (C) 2003-2007 Polytechnique.org *
+ * Copyright (C) 2003-2008 Polytechnique.org *
* http://opensource.polytechnique.org/ *
* *
* This program is free software; you can redistribute it and/or modify *
$page->changeTpl('axletter/edit.tpl');
- $saved = Post::i('saved');
- $new = false;
- $id = Post::i('id');
- $shortname = trim(Post::v('shortname'));
- $subject = trim(Post::v('subject'));
- $title = trim(Post::v('title'));
- $body = rtrim(Post::v('body'));
- $signature = trim(Post::v('signature'));
- $promo_min = Post::i('promo_min');
- $promo_max = Post::i('promo_max');
- $echeance = Post::has('echeance_date') ? Post::v('echeance_date') . ' ' . Post::v('echeance_time')
- : Post::v('echeance');
+ $saved = Post::i('saved');
+ $new = false;
+ $id = Post::i('id');
+ $short_name = trim(Post::v('short_name'));
+ $subject = trim(Post::v('subject'));
+ $title = trim(Post::v('title'));
+ $body = rtrim(Post::v('body'));
+ $signature = trim(Post::v('signature'));
+ $promo_min = Post::i('promo_min');
+ $promo_max = Post::i('promo_max');
+ $echeance = Post::has('echeance_date') ?
+ preg_replace('/^(\d\d\d\d)(\d\d)(\d\d)$/', '\1-\2-\3', Post::v('echeance_date')) . ' ' . Post::v('echeance_time')
+ : Post::v('echeance');
$echeance_date = Post::v('echeance_date');
$echeance_time = Post::v('echeance_time');
$new = true;
}
} elseif (Post::has('valid')) {
+ S::assert_xsrf_token();
+
if (!$subject && $title) {
$subject = $title;
}
$title = $subject;
}
if (!$subject || !$title || !$body) {
- $page->trig("L'article doit avoir un sujet et un contenu");
+ $page->trigError("L'article doit avoir un sujet et un contenu");
Post::kill('valid');
}
if (($promo_min > $promo_max && $promo_max != 0)||
($promo_min != 0 && ($promo_min <= 1900 || $promo_min >= 2020)) ||
($promo_max != 0 && ($promo_max <= 1900 || $promo_max >= 2020)))
{
- $page->trig("L'intervalle de promotions n'est pas valide");
+ $page->trigError("L'intervalle de promotions n'est pas valide");
Post::kill('valid');
}
- if (empty($shortname)) {
- $page->trig("L'annonce doit avoir un nom raccourci pour simplifier la navigation dans les archives");
+ if (empty($short_name)) {
+ $page->trigError("L'annonce doit avoir un nom raccourci pour simplifier la navigation dans les archives");
Post::kill('valid');
- } elseif (!preg_match('/^[a-z][-a-z0-9]*[a-z0-9]$/', $shortname)) {
- $page->trig("Le nom raccourci n'est pas valide, il doit comporter au moins 2 caractères et n'être composé "
+ } elseif (!preg_match('/^[a-z][-a-z0-9]*[a-z0-9]$/', $short_name)) {
+ $page->trigError("Le nom raccourci n'est pas valide, il doit comporter au moins 2 caractères et n'être composé "
. "que de chiffres, lettres et tirets");
Post::kill('valid');
- } elseif ($shortname != Post::v('old_shortname')) {
- $res = XDB::query("SELECT id FROM axletter WHERE shortname = {?}", $shortname);
+ } elseif ($short_name != Post::v('old_short_name')) {
+ $res = XDB::query("SELECT id FROM axletter WHERE short_name = {?}", $short_name);
if ($res->numRows() && $res->fetchOneCell() != $id) {
- $page->trig("Le nom $shortname est déjà utilisé, merci d'en choisir un autre");
- $shortname = Post::v('old_shortname');
- if (empty($shortname)) {
+ $page->trigError("Le nom $short_name est déjà utilisé, merci d'en choisir un autre");
+ $short_name = Post::v('old_short_name');
+ if (empty($short_name)) {
Post::kill('valid');
}
}
switch (@Post::v('valid')) {
case 'Aperçu':
require_once dirname(__FILE__) . '/axletter/axletter.inc.php';
- $al = new AXLetter(array($id, $shortname, $subject, $title, $body, $signature,
+ $al = new AXLetter(array($id, $short_name, $subject, $title, $body, $signature,
$promo_min, $promo_max, $echeance, 0, 'new'));
$al->toHtml($page, S::v('prenom'), S::v('nom'), S::v('femme'));
break;
case 'Confirmer':
XDB::execute("REPLACE INTO axletter
- SET id = {?}, shortname = {?}, subject = {?}, title = {?}, body = {?},
+ SET id = {?}, short_name = {?}, subject = {?}, title = {?}, body = {?},
signature = {?}, promo_min = {?}, promo_max = {?}, echeance = {?}",
- $id, $shortname, $subject, $title, $body, $signature, $promo_min, $promo_max, $echeance);
+ $id, $short_name, $subject, $title, $body, $signature, $promo_min, $promo_max, $echeance);
if (!$saved) {
+ global $globals;
$mailer = new PlMailer();
$mailer->setFrom("support@" . $globals->mail->domain);
$mailer->setSubject("Un nouveau projet de mail de l'AX vient d'être proposé");
INNER JOIN auth_user_md5 AS u USING(user_id)
INNER JOIN aliases AS a ON (u.user_id = a.id
AND FIND_IN_SET('bestalias', a.flags))");
- global $globals;
while (list($nom, $prenom, $alias) = $res->next()) {
$mailer->addTo("$nom $prenom <$alias@{$globals->mail->domain}>");
}
}
}
$page->assign('id', $id);
- $page->assign('shortname', $shortname);
+ $page->assign('short_name', $short_name);
$page->assign('subject', $subject);
$page->assign('title', $title);
$page->assign('body', $body);
$select .= "<option value=\"$stamp\"$sel>{$i}h</option>\n";
}
$page->assign('echeance_time', $select);
- }
+ }
}
function handler_cancel(&$page, $force = null)
{
require_once dirname(__FILE__) . '/axletter/axletter.inc.php';
- if (!AXLetter::hasPerms()) {
- return PL_FORBIDDEN;
- }
-
- $url = parse_url($_SERVER['HTTP_REFERER']);
- if ($force != 'force' && trim($url['path'], '/') != 'ax/edit') {
+ if (!AXLetter::hasPerms() || !S::has_xsrf_token()) {
return PL_FORBIDDEN;
}
$al = AXLetter::awaiting();
- if (!$alg) {
+ if (!$al) {
$page->kill("Aucune lettre en attente");
return;
}
function handler_valid(&$page, $force = null)
{
require_once dirname(__FILE__) . '/axletter/axletter.inc.php';
- if (!AXLetter::hasPerms()) {
- return PL_FORBIDDEN;
- }
-
- $url = parse_url($_SERVER['HTTP_REFERER']);
- if ($force != 'force' && trim($url['path'], '/') != 'ax/edit') {
+ if (!AXLetter::hasPerms() || !S::has_xsrf_token()) {
return PL_FORBIDDEN;
}
$uid = Post::v('uid');
}
if ($uid) {
+ S::assert_xsrf_token();
+
$uids = preg_split('/ *[,;\: ] */', $uid);
foreach ($uids as $uid) {
switch ($action) {
break;
}
if (!$res) {
- $page->trig("Personne ne oorrespond à l'identifiant '$uid'");
+ $page->trigError("Personne ne correspond à l'identifiant '$uid'");
}
}
}
INNER JOIN auth_user_md5 AS u USING(user_id)
INNER JOIN aliases AS a ON (u.user_id = a.id AND a.type = 'a_vie')");
$page->assign('admins', $res);
-
+
$importer = new CSVImporter('axletter_ins');
$importer->registerFunction('user_id', 'email vers Id X.org', array($this, 'idFromMail'));
$importer->forceValue('hash', array($this, 'createHash'));
$user = $email;
$domain = $globals->mail->domain2;
} else {
- list($user, $domain) = explode('@', $email);
+ list($user, $domain) = explode('@', $email);
}
if ($domain != $globals->mail->domain && $domain != $globals->mail->domain2
&& $domain != $globals->mail->alias_dom && $domain != $globals->mail->alias_dom2) {