if (!may_update()) {
return PL_FORBIDDEN;
}
+ S::assert_xsrf_token();
$res = XDB::query("SELECT asso_id, short_name FROM groupex.evenements
WHERE eid = {?} AND asso_id = {?}",
function handler_sub(&$page, $eid = null)
{
- require_once dirname(__FILE__).'/xnetevents/xnetevents.inc.php';
+ $this->load('xnetevents.inc.php');
$page->changeTpl('xnetevents/subscribe.tpl');
$evt = get_event_detail($eid);
- if (!$evt) {
+ if (is_null($evt)) {
return PL_NOT_FOUND;
}
+ if ($evt === false) {
+ global $globals, $platal;
+ $url = $globals->asso('sub_url');
+ if (empty($url)) {
+ $url = $platal->ns . 'subscribe';
+ }
+ $page->kill('Cet événement est reservé aux membres du groupe ' . $globals->asso('nom') .
+ '. Pour devenir membre, rends-toi sur la page de <a href="' . $url . '">demande d\'inscripton</a>.');
+ }
if (!$evt['inscr_open']) {
$page->kill('Les inscriptions pour cet événement sont closes');
if (!Post::has('submit')) {
return;
+ } else {
+ S::assert_xsrf_token();
}
$moments = Post::v('moment', array());
function handler_csv(&$page, $eid = null, $item_id = null)
{
- require_once dirname(__FILE__).'/xnetevents/xnetevents.inc.php';
+ $this->load('xnetevents.inc.php');
if (!is_numeric($item_id)) {
$item_id = null;
{
global $globals;
- require_once dirname(__FILE__).'/xnetevents/xnetevents.inc.php';
+ $this->load('xnetevents.inc.php');
$evt = get_event_detail($eid);
if (!$evt) {
return PL_FORBIDDEN;
$page->assign('moments', $moments);
if (Post::v('intitule')) {
- require_once dirname(__FILE__).'/xnetevents/xnetevents.inc.php';
+ S::assert_xsrf_token();
+
+ $this->load('xnetevents.inc.php');
$short_name = event_change_shortname($page, $eid,
$infos['short_name'],
Env::v('short_name', ''));
// request for a new payment
if (Post::v('paiement_id') == -1 && $money_defaut >= 0) {
require_once 'validations.inc.php';
- $p = new PayReq(S::v('uid'),
+ $p = new PayReq(S::user(),
Post::v('intitule')." - ".$globals->asso('nom'),
Post::v('site'), $money_defaut,
Post::v('confirmation'), 0, 999,
{
global $globals;
- require_once dirname(__FILE__).'/xnetevents/xnetevents.inc.php';
+ $this->load('xnetevents.inc.php');
$evt = get_event_detail($eid, $item_id);
if (!$evt) {
}
if (may_update() && Post::v('adm')) {
+ S::assert_xsrf_token();
+
$member = get_infos(Post::v('mail'));
if (!$member) {
$page->trigError("Membre introuvable");