X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=modules%2Fevents.php;h=24b0a4bd6ed549277fa4cb37e026647fe20c1192;hb=21c7c593d7100a887f984c49a82c03eb32169fc4;hp=1dda5dafcf595e57a17aec929825eeb1a4d33336;hpb=73279cf80bdac6acc811dff135f4218a38e9b8da;p=platal.git diff --git a/modules/events.php b/modules/events.php index 1dda5da..24b0a4b 100644 --- a/modules/events.php +++ b/modules/events.php @@ -81,7 +81,7 @@ class EventsModule extends PLModule return $res->fetchOneAssoc(); } - private function upload_image(PlatalPage &$page, PlUpload &$upload) + private function upload_image(PlPage &$page, PlUpload &$upload) { if (@!$_FILES['image']['tmp_name'] && !Env::v('image_url')) { return true; @@ -144,7 +144,7 @@ class EventsModule extends PLModule // cache les evenements lus et raffiche les evenements a relire if ($action == 'read' && $eid) { - XDB::execute('DELETE evenements_vus.* + XDB::execute('DELETE ev.* FROM evenements_vus AS ev INNER JOIN evenements AS e ON e.id = ev.evt_id WHERE peremption < NOW()'); @@ -218,7 +218,7 @@ class EventsModule extends PLModule exit; } } else { - $upload = new PlUpload(S::v('forlife'), 'event'); + $upload = new PlUpload(S::user()->login(), 'event'); if ($upload->exists() && $upload->isType('image')) { header('Content-Type: ' . $upload->contentType()); echo $upload->getContents(); @@ -233,22 +233,9 @@ class EventsModule extends PLModule function handler_rss(&$page, $user = null, $hash = null) { - require_once 'rss.inc.php'; - - $uid = init_rss('events/rss.tpl', $user, $hash); - - $rss = XDB::iterator( - 'SELECT e.id, e.titre, e.texte, e.creation_date, e.post_id, p.attachmime IS NOT NULL AS photo, - IF(u2.nom_usage = "", u2.nom, u2.nom_usage) AS nom, u2.prenom, u2.promo, - FIND_IN_SET(\'wiki\', e.flags) AS wiki - FROM auth_user_md5 AS u - INNER JOIN evenements AS e ON ( (e.promo_min = 0 || e.promo_min <= u.promo) - AND (e.promo_max = 0 || e.promo_max >= u.promo) ) - LEFT JOIN evenements_photo AS p ON (p.eid = e.id) - INNER JOIN auth_user_md5 AS u2 ON (u2.user_id = e.user_id) - WHERE u.user_id = {?} AND FIND_IN_SET("valide", e.flags) - AND peremption >= NOW()', $uid); - $page->assign('rss', $rss); + $this->load('feed.inc.php'); + $feed = new EventFeed(); + return $feed->run($page, $user, $hash); } function handler_preview(&$page) @@ -272,8 +259,8 @@ class EventsModule extends PLModule $page->changeTpl('events/submit.tpl'); $page->addJsLink('ajax.js'); - require_once('wiki.inc.php'); - wiki_require_page('Xorg.Annonce'); + $wp = new PlWikiPage('Xorg.Annonce'); + $wp->buildCache(); $titre = Post::v('titre'); $texte = Post::v('texte'); @@ -282,7 +269,7 @@ class EventsModule extends PLModule $peremption = Post::i('peremption'); $valid_mesg = Post::v('valid_mesg'); $action = Post::v('action'); - $upload = new PlUpload(S::v('forlife'), 'event'); + $upload = new PlUpload(S::user()->login(), 'event'); $this->upload_image($page, $upload); if (($promo_min > $promo_max && $promo_max != 0)|| @@ -308,9 +295,11 @@ class EventsModule extends PLModule } elseif ($action && (!trim($texte) || !trim($titre))) { $page->trigError("L'article doit avoir un titre et un contenu"); } elseif ($action) { + S::assert_xsrf_token(); + require_once 'validations.inc.php'; $evtreq = new EvtReq($titre, $texte, $promo_min, $promo_max, - $peremption, $valid_mesg, S::v('uid'), $upload); + $peremption, $valid_mesg, S::user(), $upload); $evtreq->submit(); $page->assign('ok', true); } elseif (!Env::v('preview')) { @@ -327,7 +316,7 @@ class EventsModule extends PLModule function handler_admin_tips(&$page, $action = 'list', $id = null) { - $page->assign('xorg_title', 'Polytechnique.org - Administration - Astuces'); + $page->setTitle('Administration - Astuces'); $page->assign('title', 'Gestion des Astuces'); $table_editor = new PLTableEditor('admin/tips', 'tips', 'id'); $table_editor->describe('peremption', 'date de péremption', true); @@ -348,26 +337,29 @@ class EventsModule extends PLModule { $page->changeTpl('events/admin.tpl'); $page->addJsLink('ajax.js'); - $page->assign('xorg_title','Polytechnique.org - Administration - Evenements'); + $page->setTitle('Administration - Evenements'); $page->register_modifier('hde', 'html_entity_decode'); $arch = $action == 'archives'; $page->assign('action', $action); - $upload = new PlUpload(S::v('forlife'), 'event'); + $upload = new PlUpload(S::user()->login(), 'event'); if ((Env::has('preview') || Post::v('action') == "Proposer") && $eid) { $action = 'edit'; $this->upload_image($page, $upload); } if (Post::v('action') == 'Pas d\'image' && $eid) { + S::assert_xsrf_token(); $upload->rm(); XDB::execute("DELETE FROM evenements_photo WHERE eid = {?}", $eid); $action = 'edit'; } elseif (Post::v('action') == 'Supprimer l\'image' && $eid) { + S::assert_xsrf_token(); $upload->rm(); $action = 'edit'; } elseif (Post::v('action') == "Proposer" && $eid) { + S::assert_xsrf_token(); $promo_min = Post::i('promo_min'); $promo_max = Post::i('promo_max'); if (($promo_min != 0 && ($promo_min <= 1900 || $promo_min >= 2020)) || @@ -377,7 +369,7 @@ class EventsModule extends PLModule $action = 'edit'; } else { $res = XDB::query('SELECT flags FROM evenements WHERE id = {?}', $eid); - $flags = new FlagSet($res->fetchOneCell()); + $flags = new PlFlagSet($res->fetchOneCell()); $flags->addFlag('wiki'); if (Post::v('important')) { $flags->addFlag('important'); @@ -434,17 +426,20 @@ class EventsModule extends PLModule } else { switch ($action) { case 'delete': + S::assert_xsrf_token(); XDB::execute('DELETE from evenements WHERE id = {?}', $eid); break; case "archive": + S::assert_xsrf_token(); XDB::execute('UPDATE evenements SET creation_date = creation_date, flags = CONCAT(flags,",archive") WHERE id = {?}', $eid); break; case "unarchive": + S::assert_xsrf_token(); XDB::execute('UPDATE evenements SET creation_date = creation_date, flags = REPLACE(flags,"archive","") WHERE id = {?}', $eid); @@ -453,12 +448,14 @@ class EventsModule extends PLModule break; case "valid": + S::assert_xsrf_token(); XDB::execute('UPDATE evenements SET creation_date = creation_date, flags = CONCAT(flags,",valide") WHERE id = {?}', $eid); break; case "unvalid": + S::assert_xsrf_token(); XDB::execute('UPDATE evenements SET creation_date = creation_date, flags = REPLACE(flags,"valide", "") WHERE id = {?}', $eid);