X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=modules%2Fcarnet.php;h=277e2dcefc2df3dea09213c1c19b054a6203e628;hb=143ba7c95f06868f6a8dc7a4408d4ff04ded4ff0;hp=24bdaaa200691fda476fd81eb09e5e939fa8ab5b;hpb=ac73e29443d4a8d8558fdf82a92f9b4c2fa4adeb;p=platal.git diff --git a/modules/carnet.php b/modules/carnet.php index 24bdaaa..277e2dc 100644 --- a/modules/carnet.php +++ b/modules/carnet.php @@ -1,6 +1,6 @@ $this->make_hook('notifs', AUTH_COOKIE), 'carnet/contacts' => $this->make_hook('contacts', AUTH_COOKIE), - 'carnet/contacts/pdf' => $this->make_hook('pdf', AUTH_COOKIE), - 'carnet/contacts/ical' => $this->make_hook('ical', AUTH_PUBLIC), - 'carnet/contacts/vcard' => $this->make_hook('vcard', AUTH_COOKIE), + 'carnet/contacts/pdf' => $this->make_hook('pdf', AUTH_COOKIE, 'user', NO_HTTPS), + 'carnet/contacts/ical' => $this->make_hook('ical', AUTH_PUBLIC, 'user', NO_HTTPS), + 'carnet/contacts/vcard' => $this->make_hook('vcard', AUTH_COOKIE, 'user', NO_HTTPS), - 'carnet/rss' => $this->make_hook('rss', AUTH_PUBLIC), + 'carnet/rss' => $this->make_hook('rss', AUTH_PUBLIC, 'user', NO_HTTPS), ); } @@ -56,7 +56,7 @@ class CarnetModule extends PLModule function handler_index(&$page) { $page->changeTpl('carnet/index.tpl'); - $page->assign('xorg_title','Polytechnique.org - Mon carnet'); + $page->setTitle('Polytechnique.org - Mon carnet'); $this->_add_rss_link($page); } @@ -65,7 +65,8 @@ class CarnetModule extends PLModule $page->changeTpl('carnet/panel.tpl'); if (Get::has('read')) { - $_SESSION['watch_last'] = Get::v('read'); + S::set('watch_last', Get::v('read')); + Platal::session()->updateNbNotifs(); pl_redirect('carnet/panel'); } @@ -84,7 +85,7 @@ class CarnetModule extends PLModule if(preg_match('!^ *(\d{4}) *$!', $arg, $matches)) { $p = intval($matches[1]); if($p<1900 || $p>2100) { - $page->trig("la promo entrée est invalide"); + $page->trigError("la promo entrée est invalide"); } else { if ($action == 'add_promo') { $watch->_promos->add($p); @@ -96,9 +97,9 @@ class CarnetModule extends PLModule $p1 = intval($matches[1]); $p2 = intval($matches[2]); if($p1<1900 || $p1>2100) { - $page->trig('la première promo de la plage entrée est invalide'); + $page->trigError('la première promo de la plage entrée est invalide'); } elseif($p2<1900 || $p2>2100) { - $page->trig('la seconde promo de la plage entrée est invalide'); + $page->trigError('la seconde promo de la plage entrée est invalide'); } else { if ($action == 'add_promo') { $watch->_promos->addRange($p1, $p2); @@ -107,7 +108,7 @@ class CarnetModule extends PLModule } } } else { - $page->trig("La promo (ou la plage de promo) entrée est dans un format incorrect."); + $page->trigError("La promo (ou la plage de promo) entrée est dans un format incorrect."); } } @@ -126,6 +127,9 @@ class CarnetModule extends PLModule $promo_sortie = $res->fetchOneCell(); $page->assign('promo_sortie', $promo_sortie); + if ($action) { + S::assert_xsrf_token(); + } switch ($action) { case 'add_promo': case 'del_promo': @@ -141,13 +145,20 @@ class CarnetModule extends PLModule break; } - if (Env::has('subs')) $watch->_subs->update('sub'); + if (Env::has('subs')) { + S::assert_xsrf_token(); + $watch->_subs->update('sub'); + } + if (Env::has('flags_contacts')) { + S::assert_xsrf_token(); $watch->watch_contacts = Env::b('contacts'); $watch->saveFlags(); } + if (Env::has('flags_mail')) { - $watch->watch_mail = Env::b('mail'); + S::assert_xsrf_token(); + $watch->watch_mail = Env::b('mail'); $watch->saveFlags(); } @@ -183,14 +194,25 @@ class CarnetModule extends PLModule return Array($total, $list); } - function handler_contacts(&$page, $action = null, $subaction = null) + function searchErrorHandler($explain) { + $page =& Platal::page(); + $page->trigError($explain); + $this->handler_contacts($page); + } + + function handler_contacts(&$page, $action = null, $subaction = null, $ssaction = null) { - $page->assign('xorg_title','Polytechnique.org - Mes contacts'); + $page->setTitle('Polytechnique.org - Mes contacts'); $this->_add_rss_link($page); $uid = S::v('uid'); $user = Env::v('user'); + // For XSRF protection, checks both the normal xsrf token, and the special RSS token. + // It allows direct linking to contact adding in the RSS feed. + if (Env::v('action') && Env::v('token') !== S::v('core_rss_hash')) { + S::assert_xsrf_token(); + } switch (Env::v('action')) { case 'retirer': if (is_numeric($user)) { @@ -198,7 +220,7 @@ class CarnetModule extends PLModule WHERE uid = {?} AND contact = {?}', $uid, $user)) { - $page->trig("Contact retiré !"); + $page->trigSuccess("Contact retiré !"); } } else { if (XDB::execute( @@ -207,7 +229,7 @@ class CarnetModule extends PLModule INNER JOIN aliases AS a ON (c.contact=a.id and a.type!="homonyme") WHERE c.uid = {?} AND a.alias={?}', $uid, $user)) { - $page->trig("Contact retiré !"); + $page->trigSuccess("Contact retiré !"); } } break; @@ -221,19 +243,35 @@ class CarnetModule extends PLModule FROM aliases WHERE alias = {?}', $uid, $login)) { - $page->trig('Contact ajouté !'); + $page->trigSuccess('Contact ajouté !'); } else { - $page->trig('Contact déjà dans la liste !'); + $page->trigWarning('Contact déjà dans la liste !'); } } } - $view = new UserSet("INNER JOIN contacts AS c2 ON (u.user_id = c2.contact)", " c2.uid = $uid "); + $search = false; + if ($action == 'search') { + $action = $subaction; + $subaction = $ssaction; + $search = true; + } + if ($search && trim(Env::v('quick'))) { + require_once 'userset.inc.php'; + $base = 'carnet/contacts/search'; + + require_once(dirname(__FILE__) . '/search/classes.inc.php'); + ThrowError::$throwHook = array($this, 'searchErrorHandler'); + $view = new SearchSet(true, false, "INNER JOIN contacts AS c2 ON (u.user_id = c2.contact)", "c2.uid = $uid"); + } else { + $base = 'carnet/contacts'; + $view = new UserSet("INNER JOIN contacts AS c2 ON (u.user_id = c2.contact)", " c2.uid = $uid "); + } $view->addMod('minifiche', 'Mini-Fiches', true); $view->addMod('trombi', 'Trombinoscope', false, array('with_admin' => false, 'with_promo' => true)); - $view->addMod('geoloc', 'Planisphère'); - $view->apply('carnet/contacts', $page, $action, $subaction); - if ($action != 'geoloc' || !$subaction) { + $view->addMod('geoloc', 'Planisphère', false, array('with_annu' => 'carnet/contacts/search')); + $view->apply($base, $page, $action, $subaction); + if ($action != 'geoloc' || ($search && !$ssaction) || (!$search && !$subaction)) { $page->changeTpl('carnet/mescontacts.tpl'); } } @@ -243,7 +281,7 @@ class CarnetModule extends PLModule require_once dirname(__FILE__).'/carnet/contacts.pdf.inc.php'; require_once 'user.func.inc.php'; - session_write_close(); + Platal::session()->close(); $sql = "SELECT a.alias FROM aliases AS a @@ -291,7 +329,6 @@ class CarnetModule extends PLModule if (!$uid) { $uid = S::i('uid'); } else if ($uid != S::i('uid')) { - require_once 'xorg.misc.inc.php'; send_warning_email("Récupération d\'un autre utilisateur ($uid)"); } } else if (!$uid) {