Better error messages for bank returns.

[platal.git] / modules / lists.php

diff --git a/modules/lists.php b/modules/lists.php
index 8c52f23..baed14f 100644 (file)
--- a/modules/lists.php
+++ b/modules/lists.php
@@ -26,25 +26,25 @@ class ListsModule extends PLModule
     function handlers()
     {
         return array(
-            'lists'              => $this->make_hook('lists',     AUTH_MDP),
-            'lists/ajax'         => $this->make_hook('ajax',      AUTH_MDP,    'user', NO_AUTH),
-            'lists/create'       => $this->make_hook('create',    AUTH_MDP,    'lists'),
-
-            'lists/members'      => $this->make_hook('members',   AUTH_COOKIE),
-            'lists/csv'          => $this->make_hook('csv',       AUTH_COOKIE),
-            'lists/annu'         => $this->make_hook('annu',      AUTH_COOKIE),
-            'lists/archives'     => $this->make_hook('archives',  AUTH_COOKIE),
+            'lists'              => $this->make_hook('lists',     AUTH_PASSWD, 'user'),
+            'lists/ajax'         => $this->make_hook('ajax',      AUTH_PASSWD, 'user', NO_AUTH),
+            'lists/create'       => $this->make_hook('create',    AUTH_PASSWD, 'lists'),
+
+            'lists/members'      => $this->make_hook('members',   AUTH_COOKIE, 'user'),
+            'lists/csv'          => $this->make_hook('csv',       AUTH_COOKIE, 'user'),
+            'lists/annu'         => $this->make_hook('annu',      AUTH_COOKIE, 'user'),
+            'lists/archives'     => $this->make_hook('archives',  AUTH_COOKIE, 'user'),
             'lists/archives/rss' => $this->make_hook('rss',       AUTH_PUBLIC, 'user', NO_HTTPS),
 
-            'lists/moderate'     => $this->make_hook('moderate',  AUTH_MDP),
-            'lists/admin'        => $this->make_hook('admin',     AUTH_MDP),
-            'lists/options'      => $this->make_hook('options',   AUTH_MDP),
-            'lists/delete'       => $this->make_hook('delete',    AUTH_MDP),
+            'lists/moderate'     => $this->make_hook('moderate',  AUTH_PASSWD, 'user'),
+            'lists/admin'        => $this->make_hook('admin',     AUTH_PASSWD, 'user'),
+            'lists/options'      => $this->make_hook('options',   AUTH_PASSWD, 'user'),
+            'lists/delete'       => $this->make_hook('delete',    AUTH_PASSWD, 'user'),
 
-            'lists/soptions'     => $this->make_hook('soptions',  AUTH_MDP),
-            'lists/check'        => $this->make_hook('check',     AUTH_MDP),
-            'admin/lists'        => $this->make_hook('admin_all', AUTH_MDP,    'admin'),
-            'admin/aliases'      => $this->make_hook('aaliases',  AUTH_MDP,    'admin')
+            'lists/soptions'     => $this->make_hook('soptions',  AUTH_PASSWD, 'user'),
+            'lists/check'        => $this->make_hook('check',     AUTH_PASSWD, 'user'),
+            'admin/lists'        => $this->make_hook('admin_all', AUTH_PASSWD, 'admin'),
+            'admin/aliases'      => $this->make_hook('aaliases',  AUTH_PASSWD, 'admin')
         );
     }
 
@@ -61,6 +61,19 @@ class ListsModule extends PLModule
         return $globals->mail->domain;
     }
 
+    function verify_list_owner($page, $liste)
+    {
+        if (list(, , $owners) = $this->client->get_members($liste)) {
+            if (!(in_array(S::user()->forlifeEmail(), $owners) || S::admin())) {
+                $page->kill("La liste n'existe pas ou tu n'as pas le droit de l'administrer.");
+            }
+        } else {
+            $page->kill("La liste n'existe pas ou tu n'as pas le droit de l'administrer.<br />"
+                      . " Si tu penses qu'il s'agit d'une erreur, "
+                      . "<a href='mailto:support@polytechnique.org'>contact le support</a>.");
+        }
+    }
+
     function get_pending_ops($domain, $list)
     {
         list($subs,$mails) = $this->client->get_pending_ops($list);
@@ -346,11 +359,11 @@ class ListsModule extends PLModule
         $this->prepare_client($page);
         $members = $this->client->get_members($liste);
         $list = list_fetch_basic_info(list_extract_members($members[1]));
-        pl_cached_content_headers('text/x-csv', 1);
+        pl_cached_content_headers('text/x-csv', 'iso-8859-1', 1);
 
-        echo "email,nom,promo\n";
-        echo implode("\n", $list);
-        exit;
+        echo utf8_decode("Nom;Prénom;Promotion\n");
+        echo utf8_decode(implode("\n", $list));
+        exit();
     }
 
     function handler_annu($page, $liste = null, $action = null, $subaction = null)
@@ -483,6 +496,7 @@ class ListsModule extends PLModule
         }
 
         $domain = $this->prepare_client($page);
+        $this->verify_list_owner($page, $liste);
 
         $page->changeTpl('lists/moderate.tpl');
 
@@ -602,6 +616,7 @@ class ListsModule extends PLModule
         }
 
         $domain = $this->prepare_client($page);
+        $this->verify_list_owner($page, $liste);
 
         $page->changeTpl('lists/admin.tpl');
 
@@ -618,8 +633,9 @@ class ListsModule extends PLModule
 
                   case 'marketu': case 'markets':
                     require_once 'emails.inc.php';
+                    $user = User::get($uids[$key]);
                     $mail = valide_email($mails[$key]);
-                    if (isvalid_email_redirection($mail)) {
+                    if (isvalid_email_redirection($mail, $user)) {
                         $from = ($action == 'marketu') ? 'user' : 'staff';
                         $market = Marketing::get($uids[$key], $mail);
                         if (!$market) {
@@ -643,6 +659,10 @@ class ListsModule extends PLModule
             $members = User::getBulkForlifeEmails(Env::v('add_member'),
                                                   true,
                                                   array('ListsModule', 'no_login_callback'));
+            // Make sure we send a list (array_values) of unique (array_unique)
+            // emails.
+            $members = array_values(array_unique($members));
+
             $arr = $this->client->mass_subscribe($liste, $members);
             if (is_array($arr)) {
                 foreach($arr as $addr) {
@@ -661,6 +681,10 @@ class ListsModule extends PLModule
                 $members = User::getBulkForlifeEmails($upload->getContents(),
                                                       true,
                                                       array('ListsModule', 'no_login_callback'));
+                // Make sure we send a list (array_values) of unique (array_unique)
+                // emails.
+                $members = array_values(array_unique($members));
+
                 $arr = $this->client->mass_subscribe($liste, $members);
                 if (is_array($arr)) {
                     foreach($arr as $addr) {
@@ -721,7 +745,6 @@ class ListsModule extends PLModule
             $page->assign_by_ref('members', $membres);
             $page->assign_by_ref('owners',  $moderos);
             $page->assign('np_m', count($mem));
-
         } else {
             $page->kill("La liste n'existe pas ou tu n'as pas le droit de l'administrer.<br />"
                       . " Si tu penses qu'il s'agit d'une erreur, "
@@ -736,6 +759,7 @@ class ListsModule extends PLModule
         }
 
         $this->prepare_client($page);
+        $this->verify_list_owner($page, $liste);
 
         $page->changeTpl('lists/options.tpl');
 
@@ -804,6 +828,7 @@ class ListsModule extends PLModule
         }
 
         $domain = $this->prepare_client($page);
+        $this->verify_list_owner($page, $liste);
         $page->changeTpl('lists/delete.tpl');
         if (Post::v('valid') == 'OUI') {
             S::assert_xsrf_token();
@@ -838,6 +863,7 @@ class ListsModule extends PLModule
         }
 
         $this->prepare_client($page);
+        $this->verify_list_owner($page, $liste);
 
         $page->changeTpl('lists/soptions.tpl');
 
@@ -867,6 +893,7 @@ class ListsModule extends PLModule
         }
 
         $this->prepare_client($page);
+        $this->verify_list_owner($page, $liste);
 
         $page->changeTpl('lists/check.tpl');