X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=modules%2Fxnetgrp.php;h=6fb4e7c9267a47dfcd4d38f4a23179c2e329b6ec;hb=efccf7ed77120bf8b15ac54d4d447e842f032884;hp=3a6ea7e8c6e3bac35b24c0dd51e82531eb8cf808;hpb=1c82f959c6e69a5a979e46e530872685106f9103;p=platal.git diff --git a/modules/xnetgrp.php b/modules/xnetgrp.php index 3a6ea7e..6fb4e7c 100644 --- a/modules/xnetgrp.php +++ b/modules/xnetgrp.php @@ -86,6 +86,7 @@ class XnetGrpModule extends PLModule '%grp/trombi' => $this->make_hook('trombi', AUTH_MDP, 'groupannu'), '%grp/geoloc' => $this->make_hook('geoloc', AUTH_MDP, 'groupannu'), '%grp/subscribe' => $this->make_hook('subscribe', AUTH_MDP), + '%grp/subscribe/valid' => $this->make_hook('subscribe_valid', AUTH_MDP, 'groupadmin'), '%grp/unsubscribe' => $this->make_hook('unsubscribe', AUTH_MDP, 'groupmember'), '%grp/change_rights' => $this->make_hook('change_rights', AUTH_MDP), @@ -165,6 +166,13 @@ class XnetGrpModule extends PLModule AND FIND_IN_SET('public', u.flags)", $globals->asso('id')); } + if (may_update()) { + $subs_valid = XDB::query("SELECT uid + FROM groupex.membres_sub_requests + WHERE asso_id = {?}", + $globals->asso('id')); + $page->assign('requests', $subs_valid->numRows()); + } if (!S::has('core_rss_hash')) { $page->setRssLink("Polytechnique.net :: {$globals->asso("nom")} :: News publiques", @@ -304,6 +312,7 @@ class XnetGrpModule extends PLModule $page->addJsLink('ajax.js'); if (Post::has('send')) { + S::assert_xsrf_token(); $from = Post::v('from'); $sujet = Post::v('sujet'); $body = Post::v('body'); @@ -502,6 +511,38 @@ class XnetGrpModule extends PLModule $page->assign('ann', $ann); } + private function removeSubscriptionRequest($uid) + { + global $globals; + XDB::execute("DELETE FROM groupex.membres_sub_requests + WHERE asso_id = {?} AND uid = {?}", + $globals->asso('id'), $uid); + } + + private function validSubscription($nom, $prenom, $sexe, $uid, $forlife) + { + global $globals; + $this->removeSubscriptionRequest($uid); + XDB::execute("INSERT INTO groupex.membres (asso_id, uid) + VALUES ({?}, {?})", + $globals->asso('id'), $uid); + $mailer = new PlMailer(); + $mailer->addTo("$forlife@polytechnique.org"); + $mailer->setFrom('"' . S::v('prenom') . ' ' . S::v('nom') + . '" <' . S::v('forlife') . '@polytechnique.org>'); + $mailer->setSubject('[' . $globals->asso('nom') . '] Demande d\'inscription'); + $message = ($sexe ? 'Chère' : 'Cher') . " Camarade,\n" + . "\n" + . " Suite à ta demande d'adhésion à " . $globals->asso('nom') . ",\n" + . "j'ai le plaisir de t'annoncer que ton inscription a été validée !\n" + . "\n" + . "Bien cordialement,\n" + . "-- \n" + . S::s('prenom') . ' ' . S::s('nom') . '.'; + $mailer->setTxtBody($message); + $mailer->send(); + } + function handler_subscribe(&$page, $u = null) { global $globals; @@ -514,12 +555,13 @@ class XnetGrpModule extends PLModule if (!is_null($u) && may_update()) { $page->assign('u', $u); - $res = XDB::query("SELECT u.nom, u.prenom, u.promo, u.user_id, FIND_IN_SET('femme', u.flags) + $res = XDB::query("SELECT u.nom, u.prenom, u.promo, u.user_id, FIND_IN_SET('femme', u.flags), s.reason FROM auth_user_md5 AS u INNER JOIN aliases AS al ON (al.id = u.user_id AND al.type != 'liste') - WHERE al.alias = {?}", $u); + LEFT JOIN groupex.membres_sub_requests AS s ON (u.user_id = s.uid AND s.asso_id = {?}) + WHERE al.alias = {?}", $globals->asso('id'), $u); - if (list($nom, $prenom, $promo, $uid, $sexe) = $res->fetchOneRow()) { + if (list($nom, $prenom, $promo, $uid, $sexe, $reason) = $res->fetchOneRow()) { $res = XDB::query("SELECT COUNT(*) FROM groupex.membres AS m INNER JOIN aliases AS a ON (m.uid = a.id AND a.type != 'homonyme') @@ -527,33 +569,18 @@ class XnetGrpModule extends PLModule $u, $globals->asso('id')); $n = $res->fetchOneCell(); if ($n) { + $this->removeSubscriptionRequest($uid); $page->kill("$prenom $nom est déjà membre du groupe !"); return; - } - elseif (Env::has('accept')) - { - XDB::execute("INSERT INTO groupex.membres (asso_id, uid) - VALUES ({?}, {?})", - $globals->asso('id'), $uid); - $mailer = new PlMailer(); - $mailer->addTo("$u@polytechnique.org"); - $mailer->setFrom('"'.S::v('prenom').' '.S::v('nom') - .'" <'.S::v('forlife').'@polytechnique.org>'); - $mailer->setSubject('['.$globals->asso('nom').'] Demande d\'inscription'); - $message = ($sexe ? 'Chère' : 'Cher') . " Camarade,\n" - . "\n" - . " Suite à ta demande d'adhésion à ".$globals->asso('nom').",\n" - . "j'ai le plaisir de t'annoncer que ton inscription a été validée !\n" - . "\n" - . "Bien cordialement,\n" - . "-- \n" - . "{$_SESSION["prenom"]} {$_SESSION["nom"]}."; - $mailer->setTxtBody($message); - $mailer->send(); + } elseif (Env::has('accept')) { + S::assert_xsrf_token(); + + $this->validSubscription($nom, $prenom, $sexe, $uid, $u); pl_redirect("member/$u"); - } - elseif (Env::has('refuse')) - { + } elseif (Env::has('refuse')) { + S::assert_xsrf_token(); + + $this->removeSubscriptionRequest($uid); $mailer = new PlMailer(); $mailer->addTo("$u@polytechnique.org"); $mailer->setFrom('"'.S::v('prenom').' '.S::v('nom') @@ -568,6 +595,7 @@ class XnetGrpModule extends PLModule $page->assign('nom', $nom); $page->assign('promo', $promo); $page->assign('uid', $uid); + $page->assign('reason', $reason); } return; } @@ -579,15 +607,29 @@ class XnetGrpModule extends PLModule return; } + $res = XDB::query("SELECT uid + FROM groupex.membres_sub_requests + WHERE uid = {?} AND asso_id = {?}", + S::i('uid'), $globals->asso('id')); + if ($res->numRows() != 0) { + $page->kill("Tu as déjà demandé ton inscription à ce groupe. Cette demande est actuellement en attente de validation."); + return; + } + if (Post::has('inscrire')) { + S::assert_xsrf_token(); + + XDB::execute("INSERT INTO groupex.membres_sub_requests (asso_id, uid, ts, reason) + VALUES ({?}, {?}, NOW(), {?})", + $globals->asso('id'), S::i('uid'), Post::v('message')); $res = XDB::query('SELECT IF(m.email IS NULL, - CONCAT(al.alias,"@polytechnique.org"), - m.email) - FROM groupex.membres AS m - INNER JOIN aliases AS al ON (al.type = "a_vie" - AND al.id = m.uid) - WHERE perms="admin" AND m.asso_id = {?}', - $globals->asso('id')); + CONCAT(al.alias,"@polytechnique.org"), + m.email) + FROM groupex.membres AS m + INNER JOIN aliases AS al ON (al.type = "a_vie" + AND al.id = m.uid) + WHERE perms="admin" AND m.asso_id = {?}', + $globals->asso('id')); $emails = $res->fetchColumn(); $to = implode(',', $emails); @@ -622,6 +664,45 @@ class XnetGrpModule extends PLModule } } + function handler_subscribe_valid(&$page) + { + global $globals; + + if (Post::has('valid')) { + S::assert_xsrf_token(); + $subs = Post::v('subs'); + if (is_array($subs)) { + $users = array(); + foreach ($subs as $forlife => $val) { + if ($val == '1') { + $res = XDB::query("SELECT IF(u.nom_usage != '', u.nom_usage, u.nom) AS u, + u.prenom, FIND_IN_SET('femme', u.flags) AS sexe, + u.user_id + FROM auth_user_md5 AS u + INNER JOIN aliases AS a ON (a.id = u.user_id) + WHERE a.alias = {?}", $forlife); + if ($res->numRows() == 1) { + list($nom, $prenom, $sexe, $uid) = $res->fetchOneRow(); + $this->validSubscription($nom, $prenom, $sexe, $uid, $forlife); + } + } + } + } + } + + $it = XDB::iterator("SELECT IF(u.nom_usage != '', u.nom_usage, u.nom) AS nom, + u.prenom, u.promo, a.alias AS forlife, s.ts AS date + FROM groupex.membres_sub_requests AS s + INNER JOIN auth_user_md5 AS u ON (s.uid = u.user_id) + INNER JOIN aliases AS a ON (a.id = s.uid AND a.type = 'a_vie') + WHERE asso_id = {?} + ORDER BY nom, prenom", + $globals->asso('id')); + + $page->changeTpl('xnetgrp/subscribe-valid.tpl'); + $page->assign('valid', $it); + } + function handler_change_rights(&$page) { if (Env::has('right') && (may_update() || S::has('suid'))) { @@ -705,6 +786,8 @@ class XnetGrpModule extends PLModule if (is_null($email)) { return; + } else { + S::assert_xsrf_token(); } if (strpos($email, '@') === false) { @@ -747,6 +830,7 @@ class XnetGrpModule extends PLModule XDB::execute('INSERT INTO groupex.membres (uid, asso_id, origine, email) VALUES ({?}, {?}, "X", {?})', $uid, $globals->asso('id'), $email); + $this->removeSubscriptionRequest($uid); pl_redirect("member/$email"); } $page->trigError("Utilisateur invalide"); @@ -871,6 +955,8 @@ class XnetGrpModule extends PLModule if (!Post::has('confirm')) { return; + } else { + S::assert_xsrf_token(); } if ($this->unsubscribe($user)) { @@ -892,6 +978,8 @@ class XnetGrpModule extends PLModule if (!Post::has('confirm')) { return; + } else { + S::assert_xsrf_token(); } if ($this->unsubscribe($user)) { @@ -985,6 +1073,8 @@ class XnetGrpModule extends PLModule $globals->asso('mail_domain')); if (Post::has('change')) { + S::assert_xsrf_token(); + // Convert user status to X if ($user['origine'] == 'ext' && trim(Post::v('login_X'))) { $forlife = $this->changeLogin($page, $user, $mmlist, trim(Post::v('login_X'))); @@ -1169,6 +1259,8 @@ class XnetGrpModule extends PLModule if (Post::v('valid') == 'Visualiser' || Post::v('valid') == 'Enregistrer' || Post::v('valid') == 'Supprimer l\'image' || Post::v('valid') == 'Pas d\'image') { + S::assert_xsrf_token(); + if (!is_null($aid)) { $art['id'] = $aid; } @@ -1332,6 +1424,7 @@ class XnetGrpModule extends PLModule $page->changeTpl('xnetgrp/announce-admin.tpl'); if (Env::has('del')) { + S::assert_xsrf_token(); XDB::execute("DELETE FROM groupex.announces WHERE id = {?} AND asso_id = {?}", Env::i('del'), $globals->asso('id'));