Prevents potential wrong query.

[platal.git] / modules / search.php

diff --git a/modules/search.php b/modules/search.php
index 1dadf49..4386c99 100644 (file)
--- a/modules/search.php
+++ b/modules/search.php
@@ -47,18 +47,21 @@ class SearchModule extends PLModule
     {
         global $globals;
 
-        $res = XDB::query("SELECT  MIN(diminutif), MAX(diminutif)
-                             FROM  groups
-                            WHERE  cat = 'Promotions'");
-        list($min, $max) = $res->fetchOneRow();
-        $page->assign('promo_min', $min);
-        $page->assign('promo_max', $max);
-
         if (Env::has('quick') || $action == 'geoloc') {
-            $quick = trim(Env::v('quick'));
+            $quick = Env::t('quick');
             if (S::logged() && !Env::has('page')) {
                 S::logger()->log('search', 'quick=' . $quick);
             }
+
+            if ($quick == '') {
+                $page->trigWarning('Aucun critère de recherche n\'est spécifié.');
+                $page->changeTpl('search/index.tpl');
+                $page->setTitle('Annuaire');
+                $page->assign('formulaire', 1);
+                $page->addJsLink('ajax.js');
+                return;
+            }
+
             $list = 'profile|prf|fiche|fic|referent|ref|mentor';
             if (S::admin()) {
                 $list .= '|admin|adm|ax';
@@ -91,6 +94,17 @@ class SearchModule extends PLModule
                 $url .= 'action=search&q=' . urlencode(substr($quick, 4));
                 $url .= '&group=' . urlencode('-Equipe,-Main,-PmWiki,-Site,-Review');
                 pl_redirect($url);
+            } elseif (strpos($quick, 'trombi:') === 0) {
+                $promo = substr($quick, 7);
+                $res = XDB::query("SELECT  diminutif
+                                     FROM  groups
+                                    WHERE  cat = 'Promotions' AND diminutif = {?}",
+                                  $promo);
+                if ($res->numRows() == 0) {
+                    $page->trigWarning("La promotion demandée n'est pas valide: $promo");
+                } else {
+                    http_redirect('http://www.polytechnique.net/login/' . $promo . '/annuaire/trombi');
+                }
             }
 
             $page->assign('formulaire', 0);
@@ -193,7 +207,6 @@ class SearchModule extends PLModule
             die();
         }
 
-        require_once 'directory.enums.inc.php';
         $enums = array(
             'binetTxt'           => DirEnum::BINETS,
             'groupexTxt'         => DirEnum::GROUPESX,
@@ -207,7 +220,7 @@ class SearchModule extends PLModule
             'nationaliteTxt'     => DirEnum::NATIONALITIES,
             'schoolTxt'          => DirEnum::EDUSCHOOLS,
         );
-        if (!array_key_exists($enums, $type)) {
+        if (!array_key_exists($type, $enums)) {
             exit();
         }
 
@@ -240,9 +253,12 @@ class SearchModule extends PLModule
 
     function handler_list(&$page, $type = null, $idVal = null)
     {
+        $page->assign('name', $type);
+        $page->assign('with_text_value', true);
+        $page->assign('onchange', "document.forms.recherche.{$type}Txt.value = this.options[this.selectedIndex].text");
+
         // Give the list of all values possible of type and builds a select input for it
         $ids = null;
-        require_once 'directory.enums.inc.php';
 
         switch ($type) {
         case 'binet':
@@ -268,9 +284,9 @@ class SearchModule extends PLModule
           case 'nationalite':
             $ids = DirEnum::getOptionsIter(DirEnum::NATIONALITIES);
             break;
-        case 'region':
-            if ($isset($_REQUEST['country'])) {
-                $ids = DirEnum::getOptionsIter(DirEnum::ADMINAREAS, $_REQUEST['country']);
+          case 'region':
+            if (Env::has('country')) {
+                $ids = DirEnum::getOptionsIter(DirEnum::ADMINAREAS, Env::v('country'));
             } else {
                 $ids = DirEnum::getOptionsIter(DirEnum::ADMINAREAS);
             }
@@ -294,10 +310,7 @@ class SearchModule extends PLModule
         }
         pl_content_headers("text/xml");
         $page->changeTpl('include/field.select.tpl', NO_SKIN);
-        $page->assign('name', $type);
         $page->assign('list', $ids);
-        $page->assign('with_text_value', true);
-        $page->assign('onchange', "document.forms.recherche.{$type}Txt.value = this.options[this.selectedIndex].text");
     }
 }