Prevents group animator to edit data from a user who does not belong to this group.

[platal.git] / modules / platal.php

diff --git a/modules/platal.php b/modules/platal.php
index b480a83..1bc0a94 100644 (file)
--- a/modules/platal.php
+++ b/modules/platal.php
@@ -1,6 +1,6 @@
 <?php
 /***************************************************************************
- *  Copyright (C) 2003-2009 Polytechnique.org                              *
+ *  Copyright (C) 2003-2010 Polytechnique.org                              *
  *  http://opensource.polytechnique.org/                                   *
  *                                                                         *
  *  This program is free software; you can redistribute it and/or modify   *
@@ -75,14 +75,8 @@ class PlatalModule extends PLModule
 
     function handler_cacert(&$page)
     {
-        $data = file_get_contents("/etc/ssl/xorgCA/cacert.pem","r");
-        header("Pragma:");
-        header("Set-Cookie:");
-        header("Cache-Control:");
-        header("Expires:");
-        header("Content-Type: application/x-x509-ca-cert");
-        header("Content-Length: ".strlen($data));
-        echo $data;
+        pl_cached_content_headers("application/x-x509-ca-cert");
+        readfile("/etc/ssl/xorgCA/cacert.pem");
         exit;
     }
 
@@ -119,10 +113,10 @@ class PlatalModule extends PLModule
     function __set_rss_state($state)
     {
         if ($state) {
-            S::set('token', rand_url_id(16));
+            S::user()->token = rand_url_id(16);
             XDB::execute('UPDATE  accounts
                              SET  token = {?}
-                           WHERE  uid = {?}', S::s('token'), S::i('uid'));
+                           WHERE  uid = {?}', S::user()->token, S::i('uid'));
         } else {
             S::kill('token');
             XDB::execute('UPDATE  accounts
@@ -138,11 +132,7 @@ class PlatalModule extends PLModule
 
         if (Post::has('email_format')) {
             $fmt = Post::s('email_format');
-            XDB::execute("UPDATE accounts
-                             SET email_format = {?}
-                           WHERE uid = {?}",
-                         $fmt, S::v('uid'));
-            S::set('email_format', $fmt);
+            S::user()->setEmailFormat($fmt);
         }
 
         if (Post::has('rss')) {
@@ -153,7 +143,7 @@ class PlatalModule extends PLModule
         # carva will extend to users not in the main domain.
         $res = XDB::query("SELECT  alias
                              FROM  aliases
-                            WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
+                            WHERE  uid = {?} AND FIND_IN_SET('bestalias', flags)",
                           S::user()->id());
         $page->assign('bestalias', $res->fetchOneCell());
     }
@@ -191,7 +181,7 @@ class PlatalModule extends PLModule
         # carva will extend to users not in the main domain.
         $res = XDB::query("SELECT  alias
                              FROM  aliases
-                            WHERE  id = {?} AND FIND_IN_SET('bestalias', flags)",
+                            WHERE  uid = {?} AND FIND_IN_SET('bestalias', flags)",
                           S::user()->id());
         $page->assign('bestalias', $res->fetchOneCell());
     }
@@ -212,10 +202,10 @@ class PlatalModule extends PLModule
     {
         global $globals;
 
-        if (Post::has('response2'))  {
+        if (Post::has('pwhash') && Post::t('pwhash'))  {
             S::assert_xsrf_token();
 
-            S::set('password', $password = Post::v('response2'));
+            S::set('password', $password = Post::t('pwhash'));
             XDB::execute('UPDATE  accounts
                              SET  password = {?}
                            WHERE  uid={?}', $password,
@@ -234,12 +224,12 @@ class PlatalModule extends PLModule
             S::logger()->log('passwd');
             Platal::session()->setAccessCookie(true);
 
-            $page->changeTpl('platal/motdepasse.success.tpl');
+            $page->changeTpl('platal/password.success.tpl');
             $page->run();
         }
 
-        $page->changeTpl('platal/motdepasse.tpl');
-        $page->addJsLink('motdepasse.js');
+        $page->changeTpl('platal/password.tpl');
+        $page->addJsLink('password.js');
         $page->setTitle('Mon mot de passe');
     }
 
@@ -324,7 +314,7 @@ class PlatalModule extends PLModule
         $page->assign('ok', true);
 
         $url   = rand_url_id();
-        XDB::execute('INSERT INTO  perte_pass (certificat,uid,created)
+        XDB::execute('INSERT INTO  account_lost_passwords (certificat,uid,created)
                            VALUES  ({?},{?},NOW())', $url, $user->id());
         $res   = XDB::query('SELECT  email
                                FROM  emails
@@ -363,11 +353,11 @@ Adresse de secours : " . Post::v('email') : ""));
     {
         global $globals;
         // XXX: recovery requires data from the profile
-        XDB::execute('DELETE FROM  perte_pass
+        XDB::execute('DELETE FROM  account_lost_passwords
                             WHERE  DATE_SUB(NOW(), INTERVAL 380 MINUTE) > created');
 
         $res = XDB::query('SELECT  uid
-                             FROM  perte_pass WHERE certificat={?}', $certif);
+                             FROM  account_lost_passwords WHERE certificat={?}', $certif);
         $ligne = $res->fetchOneAssoc();
         if (!$ligne) {
             $page->changeTpl('platal/index.tpl');
@@ -375,13 +365,13 @@ Adresse de secours : " . Post::v('email') : ""));
         }
 
         $uid = $ligne["uid"];
-        if (Post::has('response2')) {
-            $password = Post::v('response2');
+        if (Post::has('pwhash') && Post::t('pwhash')) {
+            $password = Post::t('pwhash');
             XDB::query('UPDATE  accounts
                            SET  password={?}
                          WHERE  uid = {?} AND state = \'active\'',
                        $password, $uid);
-            XDB::query('DELETE FROM  perte_pass
+            XDB::query('DELETE FROM  account_lost_passwords
                               WHERE  certificat={?}', $certif);
 
             // If GoogleApps is enabled, and the user did choose to use synchronized passwords,
@@ -397,8 +387,8 @@ Adresse de secours : " . Post::v('email') : ""));
             S::logger($uid)->log("passwd", "");
             $page->changeTpl('platal/tmpPWD.success.tpl');
         } else {
-            $page->changeTpl('platal/motdepasse.tpl');
-            $page->addJsLink('motdepasse.js');
+            $page->changeTpl('platal/password.tpl');
+            $page->addJsLink('password.js');
         }
     }