$uid = S::v('uid');
if ($action == 'best' && $email) {
+ if (!S::has_xsrf_token()) {
+ return PL_FORBIDDEN;
+ }
+
// bestalias is the first bit : 1
// there will be maximum 8 bits in flags : 255
XDB::execute("UPDATE aliases SET flags=flags & (255 - 1) WHERE id={?}", $uid);
$page->assign('demande', AliasReq::get_request($uid));
if ($action == 'delete' && $value) {
+ S::assert_xsrf_token();
+
//Suppression d'un alias
XDB::execute(
'DELETE virtual, virtual_redirect
list($alias, $visibility) = $res->fetchOneRow();
$page->assign('actuel', $alias);
- if ($action == 'ask' && Env::has('alias') and Env::has('raison')) {
- //Si l'utilisateur vient de faire une damande
+ if ($action == 'ask' && Env::has('alias') && Env::has('raison')) {
+ S::assert_xsrf_token();
+ //Si l'utilisateur vient de faire une damande
$alias = Env::v('alias');
$raison = Env::v('raison');
$public = (Env::v('public', 'off') == 'on')?"public":"private";
$page->assign('success',$alias);
return;
}
- }
- elseif ($action == 'set'
- && ($value == 'public' || $value == 'private'))
- {
+ } elseif ($action == 'set' && ($value == 'public' || $value == 'private')) {
+ if (!S::has_xsrf_token()) {
+ return PL_FORBIDDEN;
+ }
+
if ($value == 'public') {
XDB::execute("UPDATE auth_user_quick SET emails_alias_pub = 'public'
WHERE user_id = {?}", S::v('uid'));
}
if (Env::has('emailop')) {
+ S::assert_xsrf_token();
+
$actifs = Env::v('emails_actifs', Array());
print_r(Env::v('emails_rewrite'));
if (Env::v('emailop') == "ajouter" && Env::has('email')) {
$page->changeTpl('emails/submit_spam.tpl');
if (Post::has('send_email')) {
+ S::assert_xsrf_token();
+
$upload = PlUpload::get($_FILES['mail'], S::v('forlife'), 'spam.submit', true);
if (!$upload) {
$page->trig('Une erreur a été rencontrée lors du transfert du fichier');
// action si on recoit un formulaire
if (Post::has('save')) {
+ if (!S::has_xsrf_token()) {
+ return PL_FORBIDDEN;
+ }
+
unset($_POST['save']);
if (trim(preg_replace('/-- .*/', '', Post::v('contenu'))) != "") {
$_POST['to_contacts'] = explode(';', @$_POST['to_contacts']);
}
exit;
} else if (Env::v('submit') == 'Envoyer') {
+ S::assert_xsrf_token();
+
function getEmails($aliases)
{
if (!is_array($aliases)) {
global $globals;
require_once 'emails.inc.php';
+ if (!S::has_xsrf_token()) {
+ return PL_FORBIDDEN;
+ }
if (!S::has_perms() || !$forlife) {
$forlife = S::v('bestalias');
}
$page->changeTpl('emails/broken.tpl');
if ($warn == 'warn' && $email) {
+ S::assert_xsrf_token();
+
$email = valide_email($email);
// vérifications d'usage
$sel = XDB::query(
"SELECT e.uid, a.alias
FROM emails AS e
- INNER JOIN auth_user_md5 AS u ON e.uid = u.user_id
INNER JOIN aliases AS a ON (e.uid = a.id AND type!='homonyme'
AND FIND_IN_SET('bestalias',a.flags))
WHERE e.email={?}", $email);
à jour sur le site <{$globals->baseurl}/emails> tes adresses
de redirection...
-Pour plus de rensignements sur le service de patte cassée, n'hésites pas à
+Pour plus de renseignements sur le service de patte cassée, n'hésite pas à
consulter la page <{$globals->baseurl}/emails/broken>.
-A bientôt sur Polytechnique.org !
+À bientôt sur Polytechnique.org !
L'équipe d'administration <support@" . $globals->mail->domain . '>';
$mail = new PlMailer();
$page->trig("Mail envoyé ! :o)");
}
} elseif (Post::has('email')) {
+ S::assert_xsrf_token();
+
$email = valide_email(Post::v('email'));
list(,$fqdn) = explode('@', $email);
$fqdn = strtolower($fqdn);
- if ($fqdn == 'polytechnique.org' || $fqdn == 'melix.org'
- || $fqdn == 'm4x.org' || $fqdn == 'melix.net')
- {
+ if ($fqdn == 'polytechnique.org' || $fqdn == 'melix.org' || $fqdn == 'm4x.org' || $fqdn == 'melix.net') {
$page->assign('neuneu', true);
} else {
$page->assign('email',$email);
$sel = XDB::query(
- "SELECT e1.uid, e1.panne != 0 AS panne, count(e2.uid) AS nb_mails,
+ "SELECT e1.uid, e1.panne != 0 AS panne,
+ (count(e2.uid) + IF(FIND_IN_SET('googleapps', u.mail_storage), 1, 0)) AS nb_mails,
u.nom, u.prenom, u.promo, a.alias AS forlife
FROM emails as e1
LEFT JOIN emails as e2 ON(e1.uid = e2.uid
'dangerous' => 'Usurpations par cette adresse');
$page->assign('states', $states);
+ if (Post::has('action')) {
+ S::assert_xsrf_token();
+ }
switch (Post::v('action')) {
- case 'create':
+ case 'create':
if (trim(Post::v('emailN')) != '') {
Xdb::execute('INSERT IGNORE INTO emails_watch (email, state, detection, last, uid, description)
VALUES ({?}, {?}, CURDATE(), NOW(), {?}, {?})',
};
break;
- case 'edit':
+ case 'edit':
Xdb::execute('UPDATE emails_watch
SET state = {?}, last = NOW(), uid = {?}, description = {?}
WHERE email = {?}', Post::v('stateN'), S::i('uid'), Post::v('descriptionN'), Post::v('emailN'));
break;
- default:
+ default:
if ($action == 'delete' && !is_null($email)) {
Xdb::execute('DELETE FROM emails_watch WHERE email = {?}', $email);
}