'%grp/trombi' => $this->make_hook('trombi', AUTH_MDP, 'groupannu'),
'%grp/geoloc' => $this->make_hook('geoloc', AUTH_MDP, 'groupannu'),
'%grp/subscribe' => $this->make_hook('subscribe', AUTH_MDP),
+ '%grp/subscribe/valid' => $this->make_hook('subscribe_valid', AUTH_MDP, 'groupadmin'),
'%grp/unsubscribe' => $this->make_hook('unsubscribe', AUTH_MDP, 'groupmember'),
'%grp/change_rights' => $this->make_hook('change_rights', AUTH_MDP),
AND FIND_IN_SET('public', u.flags)",
$globals->asso('id'));
}
+ if (may_update()) {
+ $subs_valid = XDB::query("SELECT uid
+ FROM groupex.membres_sub_requests
+ WHERE asso_id = {?}",
+ $globals->asso('id'));
+ $page->assign('requests', $subs_valid->numRows());
+ }
if (!S::has('core_rss_hash')) {
$page->setRssLink("Polytechnique.net :: {$globals->asso("nom")} :: News publiques",
$page->addJsLink('ajax.js');
if (Post::has('send')) {
+ S::assert_xsrf_token();
$from = Post::v('from');
$sujet = Post::v('sujet');
$body = Post::v('body');
$page->assign('ann', $ann);
}
+ private function removeSubscriptionRequest($uid)
+ {
+ global $globals;
+ XDB::execute("DELETE FROM groupex.membres_sub_requests
+ WHERE asso_id = {?} AND uid = {?}",
+ $globals->asso('id'), $uid);
+ }
+
+ private function validSubscription($nom, $prenom, $sexe, $uid, $forlife)
+ {
+ global $globals;
+ $this->removeSubscriptionRequest($uid);
+ XDB::execute("INSERT INTO groupex.membres (asso_id, uid)
+ VALUES ({?}, {?})",
+ $globals->asso('id'), $uid);
+ $mailer = new PlMailer();
+ $mailer->addTo("$forlife@polytechnique.org");
+ $mailer->setFrom('"' . S::v('prenom') . ' ' . S::v('nom')
+ . '" <' . S::v('forlife') . '@polytechnique.org>');
+ $mailer->setSubject('[' . $globals->asso('nom') . '] Demande d\'inscription');
+ $message = ($sexe ? 'Chère' : 'Cher') . " Camarade,\n"
+ . "\n"
+ . " Suite à ta demande d'adhésion à " . $globals->asso('nom') . ",\n"
+ . "j'ai le plaisir de t'annoncer que ton inscription a été validée !\n"
+ . "\n"
+ . "Bien cordialement,\n"
+ . "-- \n"
+ . S::s('prenom') . ' ' . S::s('nom') . '.';
+ $mailer->setTxtBody($message);
+ $mailer->send();
+ }
+
function handler_subscribe(&$page, $u = null)
{
global $globals;
if (!is_null($u) && may_update()) {
$page->assign('u', $u);
- $res = XDB::query("SELECT u.nom, u.prenom, u.promo, u.user_id, FIND_IN_SET('femme', u.flags)
+ $res = XDB::query("SELECT u.nom, u.prenom, u.promo, u.user_id, FIND_IN_SET('femme', u.flags), s.reason
FROM auth_user_md5 AS u
INNER JOIN aliases AS al ON (al.id = u.user_id AND al.type != 'liste')
- WHERE al.alias = {?}", $u);
+ LEFT JOIN groupex.membres_sub_requests AS s ON (u.user_id = s.uid AND s.asso_id = {?})
+ WHERE al.alias = {?}", $globals->asso('id'), $u);
- if (list($nom, $prenom, $promo, $uid, $sexe) = $res->fetchOneRow()) {
+ if (list($nom, $prenom, $promo, $uid, $sexe, $reason) = $res->fetchOneRow()) {
$res = XDB::query("SELECT COUNT(*)
FROM groupex.membres AS m
INNER JOIN aliases AS a ON (m.uid = a.id AND a.type != 'homonyme')
$u, $globals->asso('id'));
$n = $res->fetchOneCell();
if ($n) {
+ $this->removeSubscriptionRequest($uid);
$page->kill("$prenom $nom est déjà membre du groupe !");
return;
- }
- elseif (Env::has('accept'))
- {
- XDB::execute("INSERT INTO groupex.membres (asso_id, uid)
- VALUES ({?}, {?})",
- $globals->asso('id'), $uid);
- $mailer = new PlMailer();
- $mailer->addTo("$u@polytechnique.org");
- $mailer->setFrom('"'.S::v('prenom').' '.S::v('nom')
- .'" <'.S::v('forlife').'@polytechnique.org>');
- $mailer->setSubject('['.$globals->asso('nom').'] Demande d\'inscription');
- $message = ($sexe ? 'Chère' : 'Cher') . " Camarade,\n"
- . "\n"
- . " Suite à ta demande d'adhésion à ".$globals->asso('nom').",\n"
- . "j'ai le plaisir de t'annoncer que ton inscription a été validée !\n"
- . "\n"
- . "Bien cordialement,\n"
- . "-- \n"
- . "{$_SESSION["prenom"]} {$_SESSION["nom"]}.";
- $mailer->setTxtBody($message);
- $mailer->send();
+ } elseif (Env::has('accept')) {
+ S::assert_xsrf_token();
+
+ $this->validSubscription($nom, $prenom, $sexe, $uid, $u);
pl_redirect("member/$u");
- }
- elseif (Env::has('refuse'))
- {
+ } elseif (Env::has('refuse')) {
+ S::assert_xsrf_token();
+
+ $this->removeSubscriptionRequest($uid);
$mailer = new PlMailer();
$mailer->addTo("$u@polytechnique.org");
$mailer->setFrom('"'.S::v('prenom').' '.S::v('nom')
$page->assign('nom', $nom);
$page->assign('promo', $promo);
$page->assign('uid', $uid);
+ $page->assign('reason', $reason);
}
return;
}
return;
}
+ $res = XDB::query("SELECT uid
+ FROM groupex.membres_sub_requests
+ WHERE uid = {?} AND asso_id = {?}",
+ S::i('uid'), $globals->asso('id'));
+ if ($res->numRows() != 0) {
+ $page->kill("Tu as déjà demandé ton inscription à ce groupe. Cette demande est actuellement en attente de validation.");
+ return;
+ }
+
if (Post::has('inscrire')) {
+ S::assert_xsrf_token();
+
+ XDB::execute("INSERT INTO groupex.membres_sub_requests (asso_id, uid, ts, reason)
+ VALUES ({?}, {?}, NOW(), {?})",
+ $globals->asso('id'), S::i('uid'), Post::v('message'));
$res = XDB::query('SELECT IF(m.email IS NULL,
- CONCAT(al.alias,"@polytechnique.org"),
- m.email)
- FROM groupex.membres AS m
- INNER JOIN aliases AS al ON (al.type = "a_vie"
- AND al.id = m.uid)
- WHERE perms="admin" AND m.asso_id = {?}',
- $globals->asso('id'));
+ CONCAT(al.alias,"@polytechnique.org"),
+ m.email)
+ FROM groupex.membres AS m
+ INNER JOIN aliases AS al ON (al.type = "a_vie"
+ AND al.id = m.uid)
+ WHERE perms="admin" AND m.asso_id = {?}',
+ $globals->asso('id'));
$emails = $res->fetchColumn();
$to = implode(',', $emails);
}
}
+ function handler_subscribe_valid(&$page)
+ {
+ global $globals;
+
+ if (Post::has('valid')) {
+ S::assert_xsrf_token();
+ $subs = Post::v('subs');
+ if (is_array($subs)) {
+ $users = array();
+ foreach ($subs as $forlife => $val) {
+ if ($val == '1') {
+ $res = XDB::query("SELECT IF(u.nom_usage != '', u.nom_usage, u.nom) AS u,
+ u.prenom, FIND_IN_SET('femme', u.flags) AS sexe,
+ u.user_id
+ FROM auth_user_md5 AS u
+ INNER JOIN aliases AS a ON (a.id = u.user_id)
+ WHERE a.alias = {?}", $forlife);
+ if ($res->numRows() == 1) {
+ list($nom, $prenom, $sexe, $uid) = $res->fetchOneRow();
+ $this->validSubscription($nom, $prenom, $sexe, $uid, $forlife);
+ }
+ }
+ }
+ }
+ }
+
+ $it = XDB::iterator("SELECT IF(u.nom_usage != '', u.nom_usage, u.nom) AS nom,
+ u.prenom, u.promo, a.alias AS forlife, s.ts AS date
+ FROM groupex.membres_sub_requests AS s
+ INNER JOIN auth_user_md5 AS u ON (s.uid = u.user_id)
+ INNER JOIN aliases AS a ON (a.id = s.uid AND a.type = 'a_vie')
+ WHERE asso_id = {?}
+ ORDER BY nom, prenom",
+ $globals->asso('id'));
+
+ $page->changeTpl('xnetgrp/subscribe-valid.tpl');
+ $page->assign('valid', $it);
+ }
+
function handler_change_rights(&$page)
{
if (Env::has('right') && (may_update() || S::has('suid'))) {
if (is_null($email)) {
return;
+ } else {
+ S::assert_xsrf_token();
}
if (strpos($email, '@') === false) {
XDB::execute('INSERT INTO groupex.membres (uid, asso_id, origine, email)
VALUES ({?}, {?}, "X", {?})',
$uid, $globals->asso('id'), $email);
+ $this->removeSubscriptionRequest($uid);
pl_redirect("member/$email");
}
$page->trigError("Utilisateur invalide");
if (!Post::has('confirm')) {
return;
+ } else {
+ S::assert_xsrf_token();
}
if ($this->unsubscribe($user)) {
if (!Post::has('confirm')) {
return;
+ } else {
+ S::assert_xsrf_token();
}
if ($this->unsubscribe($user)) {
$globals->asso('mail_domain'));
if (Post::has('change')) {
+ S::assert_xsrf_token();
+
// Convert user status to X
if ($user['origine'] == 'ext' && trim(Post::v('login_X'))) {
$forlife = $this->changeLogin($page, $user, $mmlist, trim(Post::v('login_X')));
if (Post::v('valid') == 'Visualiser' || Post::v('valid') == 'Enregistrer'
|| Post::v('valid') == 'Supprimer l\'image' || Post::v('valid') == 'Pas d\'image') {
+ S::assert_xsrf_token();
+
if (!is_null($aid)) {
$art['id'] = $aid;
}
$page->changeTpl('xnetgrp/announce-admin.tpl');
if (Env::has('del')) {
+ S::assert_xsrf_token();
XDB::execute("DELETE FROM groupex.announces
WHERE id = {?} AND asso_id = {?}",
Env::i('del'), $globals->asso('id'));
projects / platal.git / blobdiff