X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=modules%2Faxletter.php;h=68577c56b6ee2bdfc6f677c28599a68d2f445cc0;hb=a5878ac19cc6ea75a753470cf68b7d2180d6cd51;hp=5f6eb9aa06c07661d0fde3b5aae468cb0097c0f0;hpb=c6f2cafe99f848cd04f077284751a40e322b081a;p=platal.git

diff --git a/modules/axletter.php b/modules/axletter.php
index 5f6eb9a..68577c5 100644
--- a/modules/axletter.php
+++ b/modules/axletter.php
@@ -80,18 +80,19 @@ class AXLetterModule extends PLModule
 
         $page->changeTpl('axletter/edit.tpl');
 
-        $saved     = Post::i('saved');
-        $new       = false;
-        $id        = Post::i('id');
-        $shortname = trim(Post::v('shortname'));
-        $subject   = trim(Post::v('subject'));
-        $title     = trim(Post::v('title'));
-        $body      = rtrim(Post::v('body'));
-        $signature = trim(Post::v('signature'));
-        $promo_min = Post::i('promo_min');
-        $promo_max = Post::i('promo_max');
-        $echeance  = Post::has('echeance_date') ? Post::v('echeance_date') . ' ' . Post::v('echeance_time')
-                                                : Post::v('echeance');
+        $saved      = Post::i('saved');
+        $new        = false;
+        $id         = Post::i('id');
+        $short_name = trim(Post::v('short_name'));
+        $subject    = trim(Post::v('subject'));
+        $title      = trim(Post::v('title'));
+        $body       = rtrim(Post::v('body'));
+        $signature  = trim(Post::v('signature'));
+        $promo_min  = Post::i('promo_min');
+        $promo_max  = Post::i('promo_max');
+        $echeance   = Post::has('echeance_date') ?
+              preg_replace('/^(\d\d\d\d)(\d\d)(\d\d)$/', '\1-\2-\3', Post::v('echeance_date')) . ' ' . Post::v('echeance_time')
+            : Post::v('echeance');
         $echeance_date = Post::v('echeance_date');
         $echeance_time = Post::v('echeance_time');
 
@@ -109,6 +110,8 @@ class AXLetterModule extends PLModule
                 $new   = true;
             }
         } elseif (Post::has('valid')) {
+            S::assert_xsrf_token();
+
             if (!$subject && $title) {
                 $subject = $title;
             }
@@ -126,19 +129,19 @@ class AXLetterModule extends PLModule
                 $page->trig("L'intervalle de promotions n'est pas valide");
                 Post::kill('valid');
             }
-            if (empty($shortname)) {
+            if (empty($short_name)) {
                 $page->trig("L'annonce doit avoir un nom raccourci pour simplifier la navigation dans les archives");
                 Post::kill('valid');
-            } elseif (!preg_match('/^[a-z][-a-z0-9]*[a-z0-9]$/', $shortname)) {
+            } elseif (!preg_match('/^[a-z][-a-z0-9]*[a-z0-9]$/', $short_name)) {
                 $page->trig("Le nom raccourci n'est pas valide, il doit comporter au moins 2 caractères et n'être composé "
                           . "que de chiffres, lettres et tirets");
                 Post::kill('valid');
-            } elseif ($shortname != Post::v('old_shortname')) {
-                $res = XDB::query("SELECT id FROM axletter WHERE short_name = {?}", $shortname);
+            } elseif ($short_name != Post::v('old_short_name')) {
+                $res = XDB::query("SELECT id FROM axletter WHERE short_name = {?}", $short_name);
                 if ($res->numRows() && $res->fetchOneCell() != $id) {
-                    $page->trig("Le nom $shortname est déjà utilisé, merci d'en choisir un autre");
-                    $shortname = Post::v('old_shortname');
-                    if (empty($shortname)) {
+                    $page->trig("Le nom $short_name est déjà utilisé, merci d'en choisir un autre");
+                    $short_name = Post::v('old_short_name');
+                    if (empty($short_name)) {
                         Post::kill('valid');
                     }
                 }
@@ -147,7 +150,7 @@ class AXLetterModule extends PLModule
             switch (@Post::v('valid')) {
               case 'Aperçu':
                 require_once dirname(__FILE__) . '/axletter/axletter.inc.php';
-                $al = new AXLetter(array($id, $shortname, $subject, $title, $body, $signature,
+                $al = new AXLetter(array($id, $short_name, $subject, $title, $body, $signature,
                                          $promo_min, $promo_max, $echeance, 0, 'new'));
                 $al->toHtml($page, S::v('prenom'), S::v('nom'), S::v('femme'));
                 break;
@@ -156,7 +159,7 @@ class AXLetterModule extends PLModule
                 XDB::execute("REPLACE INTO  axletter
                                        SET  id = {?}, short_name = {?}, subject = {?}, title = {?}, body = {?},
                                             signature = {?}, promo_min = {?}, promo_max = {?}, echeance = {?}",
-                             $id, $shortname, $subject, $title, $body, $signature, $promo_min, $promo_max, $echeance);
+                             $id, $short_name, $subject, $title, $body, $signature, $promo_min, $promo_max, $echeance);
                 if (!$saved) {
                     global $globals;
                     $mailer = new PlMailer();
@@ -191,7 +194,7 @@ class AXLetterModule extends PLModule
             }
         }
         $page->assign('id', $id);
-        $page->assign('shortname', $shortname);
+        $page->assign('short_name', $short_name);
         $page->assign('subject', $subject);
         $page->assign('title', $title);
         $page->assign('body', $body);
@@ -223,17 +226,12 @@ class AXLetterModule extends PLModule
     function handler_cancel(&$page, $force = null)
     {
         require_once dirname(__FILE__) . '/axletter/axletter.inc.php';
-        if (!AXLetter::hasPerms()) {
-            return PL_FORBIDDEN;
-        }
-
-        $url = parse_url($_SERVER['HTTP_REFERER']);
-        if ($force != 'force' && trim($url['path'], '/') != 'ax/edit') {
+        if (!AXLetter::hasPerms() || !S::has_xsrf_token()) {
             return PL_FORBIDDEN;
         }
 
         $al = AXLetter::awaiting();
-        if (!$alg) {
+        if (!$al) {
             $page->kill("Aucune lettre en attente");
             return;
         }
@@ -248,12 +246,7 @@ class AXLetterModule extends PLModule
     function handler_valid(&$page, $force = null)
     {
         require_once dirname(__FILE__) . '/axletter/axletter.inc.php';
-        if (!AXLetter::hasPerms()) {
-            return PL_FORBIDDEN;
-        }
-
-        $url = parse_url($_SERVER['HTTP_REFERER']);
-        if ($force != 'force' && trim($url['path'], '/') != 'ax/edit') {
+        if (!AXLetter::hasPerms() || !S::has_xsrf_token()) {
             return PL_FORBIDDEN;
         }
 
@@ -296,6 +289,8 @@ class AXLetterModule extends PLModule
             $uid    = Post::v('uid');
         }
         if ($uid) {
+            S::assert_xsrf_token();
+
             $uids   = preg_split('/ *[,;\: ] */', $uid);
             foreach ($uids as $uid) {
                 switch ($action) {
@@ -307,7 +302,7 @@ class AXLetterModule extends PLModule
                     break;
                 }
                 if (!$res) {
-                    $page->trig("Personne ne oorrespond à l'identifiant '$uid'");
+                    $page->trig("Personne ne correspond à l'identifiant '$uid'");
                 }
             }
         }