X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=modules%2Fcarnet.php;h=78b0b6943036ad93df5bbd2cbeeea31ce1d36315;hb=ab694eb5b8b8f0b3e528b7775abae6263cbb824b;hp=c970213162da5b5687f95acda865c13c7f0b52f4;hpb=8c4a0c30c699f190cb7906746e22f67014df3368;p=platal.git diff --git a/modules/carnet.php b/modules/carnet.php index c970213..78b0b69 100644 --- a/modules/carnet.php +++ b/modules/carnet.php @@ -1,6 +1,6 @@ $this->make_hook('notifs', AUTH_COOKIE), 'carnet/contacts' => $this->make_hook('contacts', AUTH_COOKIE), - 'carnet/contacts/pdf' => $this->make_hook('pdf', AUTH_COOKIE), - 'carnet/contacts/ical' => $this->make_hook('ical', AUTH_PUBLIC), - 'carnet/contacts/vcard' => $this->make_hook('vcard', AUTH_COOKIE), + 'carnet/contacts/pdf' => $this->make_hook('pdf', AUTH_COOKIE, 'user', NO_HTTPS), + 'carnet/contacts/ical' => $this->make_hook('ical', AUTH_PUBLIC, 'user', NO_HTTPS), + 'carnet/contacts/vcard' => $this->make_hook('vcard', AUTH_COOKIE, 'user', NO_HTTPS), - 'carnet/rss' => $this->make_hook('rss', AUTH_PUBLIC), + 'carnet/rss' => $this->make_hook('rss', AUTH_PUBLIC, 'user', NO_HTTPS), ); } @@ -66,6 +66,7 @@ class CarnetModule extends PLModule if (Get::has('read')) { $_SESSION['watch_last'] = Get::v('read'); + update_NbNotifs(); pl_redirect('carnet/panel'); } @@ -84,7 +85,7 @@ class CarnetModule extends PLModule if(preg_match('!^ *(\d{4}) *$!', $arg, $matches)) { $p = intval($matches[1]); if($p<1900 || $p>2100) { - $page->trig("la promo entrée est invalide"); + $page->trigError("la promo entrée est invalide"); } else { if ($action == 'add_promo') { $watch->_promos->add($p); @@ -96,9 +97,9 @@ class CarnetModule extends PLModule $p1 = intval($matches[1]); $p2 = intval($matches[2]); if($p1<1900 || $p1>2100) { - $page->trig('la première promo de la plage entrée est invalide'); + $page->trigError('la première promo de la plage entrée est invalide'); } elseif($p2<1900 || $p2>2100) { - $page->trig('la seconde promo de la plage entrée est invalide'); + $page->trigError('la seconde promo de la plage entrée est invalide'); } else { if ($action == 'add_promo') { $watch->_promos->addRange($p1, $p2); @@ -107,7 +108,7 @@ class CarnetModule extends PLModule } } } else { - $page->trig("La promo (ou la plage de promo) entrée est dans un format incorrect."); + $page->trigError("La promo (ou la plage de promo) entrée est dans un format incorrect."); } } @@ -126,6 +127,9 @@ class CarnetModule extends PLModule $promo_sortie = $res->fetchOneCell(); $page->assign('promo_sortie', $promo_sortie); + if ($action) { + S::assert_xsrf_token(); + } switch ($action) { case 'add_promo': case 'del_promo': @@ -141,13 +145,20 @@ class CarnetModule extends PLModule break; } - if (Env::has('subs')) $watch->_subs->update('sub'); + if (Env::has('subs')) { + S::assert_xsrf_token(); + $watch->_subs->update('sub'); + } + if (Env::has('flags_contacts')) { + S::assert_xsrf_token(); $watch->watch_contacts = Env::b('contacts'); $watch->saveFlags(); } + if (Env::has('flags_mail')) { - $watch->watch_mail = Env::b('mail'); + S::assert_xsrf_token(); + $watch->watch_mail = Env::b('mail'); $watch->saveFlags(); } @@ -183,7 +194,13 @@ class CarnetModule extends PLModule return Array($total, $list); } - function handler_contacts(&$page, $action = null, $subaction = null) + function searchErrorHandler($explain) { + global $page; + $page->trigError($explain); + $this->handler_contacts($page); + } + + function handler_contacts(&$page, $action = null, $subaction = null, $ssaction = null) { $page->assign('xorg_title','Polytechnique.org - Mes contacts'); $this->_add_rss_link($page); @@ -191,6 +208,11 @@ class CarnetModule extends PLModule $uid = S::v('uid'); $user = Env::v('user'); + // For XSRF protection, checks both the normal xsrf token, and the special RSS token. + // It allows direct linking to contact adding in the RSS feed. + if (Env::v('action') && Env::v('token') !== S::v('core_rss_hash')) { + S::assert_xsrf_token(); + } switch (Env::v('action')) { case 'retirer': if (is_numeric($user)) { @@ -198,7 +220,7 @@ class CarnetModule extends PLModule WHERE uid = {?} AND contact = {?}', $uid, $user)) { - $page->trig("Contact retiré !"); + $page->trigSuccess("Contact retiré !"); } } else { if (XDB::execute( @@ -207,7 +229,7 @@ class CarnetModule extends PLModule INNER JOIN aliases AS a ON (c.contact=a.id and a.type!="homonyme") WHERE c.uid = {?} AND a.alias={?}', $uid, $user)) { - $page->trig("Contact retiré !"); + $page->trigSuccess("Contact retiré !"); } } break; @@ -216,24 +238,40 @@ class CarnetModule extends PLModule require_once('user.func.inc.php'); if (($login = get_user_login($user)) !== false) { if (XDB::execute( - 'INSERT INTO contacts (uid, contact) - SELECT {?}, id - FROM aliases - WHERE alias = {?}', $uid, $login)) + 'REPLACE INTO contacts (uid, contact) + SELECT {?}, id + FROM aliases + WHERE alias = {?}', $uid, $login)) { - $page->trig('Contact ajouté !'); + $page->trigSuccess('Contact ajouté !'); } else { - $page->trig('Contact déjà dans la liste !'); + $page->trigWarning('Contact déjà dans la liste !'); } } } - $view = new UserSet("INNER JOIN contacts AS c2 ON (u.user_id = c2.contact)", " c2.uid = $uid "); + $search = false; + if ($action == 'search') { + $action = $subaction; + $subaction = $ssaction; + $search = true; + } + if ($search && trim(Env::v('quick'))) { + require_once 'userset.inc.php'; + $base = 'carnet/contacts/search'; + + require_once(dirname(__FILE__) . '/search/classes.inc.php'); + ThrowError::$throwHook = array($this, 'searchErrorHandler'); + $view = new SearchSet(true, false, "INNER JOIN contacts AS c2 ON (u.user_id = c2.contact)", "c2.uid = $uid"); + } else { + $base = 'carnet/contacts'; + $view = new UserSet("INNER JOIN contacts AS c2 ON (u.user_id = c2.contact)", " c2.uid = $uid "); + } $view->addMod('minifiche', 'Mini-Fiches', true); $view->addMod('trombi', 'Trombinoscope', false, array('with_admin' => false, 'with_promo' => true)); - $view->addMod('geoloc', 'Planisphère'); - $view->apply('carnet/contacts', $page, $action, $subaction); - if ($action != 'geoloc' || !$subaction) { + $view->addMod('geoloc', 'Planisphère', false, array('with_annu' => 'carnet/contacts/search')); + $view->apply($base, $page, $action, $subaction); + if ($action != 'geoloc' || ($search && !$ssaction) || (!$search && !$subaction)) { $page->changeTpl('carnet/mescontacts.tpl'); } } @@ -243,7 +281,7 @@ class CarnetModule extends PLModule require_once dirname(__FILE__).'/carnet/contacts.pdf.inc.php'; require_once 'user.func.inc.php'; - session_write_close(); + Platal::session()->close(); $sql = "SELECT a.alias FROM aliases AS a @@ -261,6 +299,11 @@ class CarnetModule extends PLModule while (list($alias) = $citer->next()) { $user = get_user_details($alias); + foreach ($user as &$value) { + if (is_utf8($value)) { + $value = utf8_decode($value); + } + } $pdf = ContactsPDF::addContact($pdf, $user, $arg0 == 'photos' || $arg1 == 'photos'); } $pdf->Output();