]> git.mxchange.org Git - quix0rs-gnu-social.git/blob - actions/profilesettings.php
add csrf protection to profile settings
[quix0rs-gnu-social.git] / actions / profilesettings.php
1 <?php
2 /*
3  * Laconica - a distributed open-source microblogging tool
4  * Copyright (C) 2008, Controlez-Vous, Inc.
5  *
6  * This program is free software: you can redistribute it and/or modify
7  * it under the terms of the GNU Affero General Public License as published by
8  * the Free Software Foundation, either version 3 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU Affero General Public License for more details.
15  *
16  * You should have received a copy of the GNU Affero General Public License
17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
18  */
19
20 if (!defined('LACONICA')) { exit(1); }
21
22 require_once(INSTALLDIR.'/lib/settingsaction.php');
23
24 class ProfilesettingsAction extends SettingsAction {
25
26         function get_instructions() {
27                 return _('You can update your personal profile info here '.
28                                   'so people know more about you.');
29         }
30
31         function show_form($msg=NULL, $success=false) {
32                 $user = common_current_user();
33                 $profile = $user->getProfile();
34                 $this->form_header(_('Profile settings'), $msg, $success);
35
36                 common_element_start('form', array('method' => 'post',
37                                                                                    'id' => 'profilesettings',
38                                                                                    'action' =>
39                                                                                    common_local_url('profilesettings')));
40                 common_hidden('token', common_session_token());
41                 # too much common patterns here... abstractable?
42                 common_input('nickname', _('Nickname'),
43                                          ($this->arg('nickname')) ? $this->arg('nickname') : $profile->nickname,
44                                          _('1-64 lowercase letters or numbers, no punctuation or spaces'));
45                 common_input('fullname', _('Full name'),
46                                          ($this->arg('fullname')) ? $this->arg('fullname') : $profile->fullname);
47                 common_input('homepage', _('Homepage'),
48                                          ($this->arg('homepage')) ? $this->arg('homepage') : $profile->homepage,
49                                          _('URL of your homepage, blog, or profile on another site'));
50                 common_textarea('bio', _('Bio'),
51                                                 ($this->arg('bio')) ? $this->arg('bio') : $profile->bio,
52                                                 _('Describe yourself and your interests in 140 chars'));
53                 common_input('location', _('Location'),
54                                          ($this->arg('location')) ? $this->arg('location') : $profile->location,
55                                          _('Where you are, like "City, State (or Region), Country"'));
56
57                 $language = common_language();
58                 common_dropdown('language', _('Language'), get_nice_language_list(), _('Preferred language'), TRUE, $language);
59                 $timezone = common_timezone();
60                 $timezones = array();
61                 foreach(DateTimeZone::listIdentifiers() as $k => $v) {
62                         $timezones[$v] = $v;
63                 }
64                 common_dropdown('timezone', _('Timezone'), $timezones, _('What timezone are you normally in?'), TRUE, $timezone);
65
66                 common_checkbox('autosubscribe', _('Automatically subscribe to whoever subscribes to me (best for non-humans)'),
67                                                 ($this->arg('autosubscribe')) ? $this->boolean('autosubscribe') : $user->autosubscribe);
68                 common_submit('submit', _('Save'));
69                 common_element_end('form');
70                 common_show_footer();
71         }
72
73         function handle_post() {
74
75                 $nickname = $this->trimmed('nickname');
76                 $fullname = $this->trimmed('fullname');
77                 $homepage = $this->trimmed('homepage');
78                 $bio = $this->trimmed('bio');
79                 $location = $this->trimmed('location');
80                 $autosubscribe = $this->boolean('autosubscribe');
81                 $language = $this->trimmed('language');
82                 $timezone = $this->trimmed('timezone');
83
84                 # CSRF protection
85
86                 $token = $this->trimmed('token');
87                 if (!$token || $token != common_session_token()) {
88                         $this->show_form(_('There was a problem with your session token. Try again, please.'));
89                         return;
90                 }
91
92                 # Some validation
93
94                 if (!Validate::string($nickname, array('min_length' => 1,
95                                                                                            'max_length' => 64,
96                                                                                            'format' => VALIDATE_NUM . VALIDATE_ALPHA_LOWER))) {
97                         $this->show_form(_('Nickname must have only lowercase letters and numbers and no spaces.'));
98                         return;
99                 } else if (!User::allowed_nickname($nickname)) {
100                         $this->show_form(_('Not a valid nickname.'));
101                         return;
102                 } else if (!is_null($homepage) && (strlen($homepage) > 0) &&
103                                    !Validate::uri($homepage, array('allowed_schemes' => array('http', 'https')))) {
104                         $this->show_form(_('Homepage is not a valid URL.'));
105                         return;
106                 } else if (!is_null($fullname) && strlen($fullname) > 255) {
107                         $this->show_form(_('Full name is too long (max 255 chars).'));
108                         return;
109                 } else if (!is_null($bio) && strlen($bio) > 140) {
110                         $this->show_form(_('Bio is too long (max 140 chars).'));
111                         return;
112                 } else if (!is_null($location) && strlen($location) > 255) {
113                         $this->show_form(_('Location is too long (max 255 chars).'));
114                         return;
115                 }  else if (is_null($timezone) || !in_array($timezone, DateTimeZone::listIdentifiers())) {
116                         $this->show_form(_('Timezone not selected.'));
117                         return;
118                 } else if ($this->nickname_exists($nickname)) {
119                         $this->show_form(_('Nickname already in use. Try another one.'));
120                         return;
121                 } else if (!is_null($language) && strlen($language) > 50) {
122                         $this->show_form(_('Language is too long (max 50 chars).'));
123                 }
124
125                 $user = common_current_user();
126
127                 $user->query('BEGIN');
128
129                 if ($user->nickname != $nickname ||
130                         $user->language != $language ||
131                         $user->timezone != $timezone) {
132
133                         common_debug('Updating user nickname from ' . $user->nickname . ' to ' . $nickname,
134                                                  __FILE__);
135                         common_debug('Updating user language from ' . $user->language . ' to ' . $language,
136                                                  __FILE__);
137                         common_debug('Updating user timezone from ' . $user->timezone . ' to ' . $timezone,
138                                                  __FILE__);
139
140                         $original = clone($user);
141
142                         $user->nickname = $nickname;
143                         $user->language = $language;
144                         $user->timezone = $timezone;
145
146                         $result = $user->updateKeys($original);
147
148                         if ($result === FALSE) {
149                                 common_log_db_error($user, 'UPDATE', __FILE__);
150                                 common_server_error(_('Couldn\'t update user.'));
151                                 return;
152                         } else {
153                                 # Re-initialize language environment if it changed
154                                 common_init_language();
155                         }
156                 }
157
158                 # XXX: XOR
159
160                 if ($user->autosubscribe ^ $autosubscribe) {
161
162                         $original = clone($user);
163
164                         $user->autosubscribe = $autosubscribe;
165
166                         $result = $user->update($original);
167
168                         if ($result === FALSE) {
169                                 common_log_db_error($user, 'UPDATE', __FILE__);
170                                 common_server_error(_('Couldn\'t update user for autosubscribe.'));
171                                 return;
172                         }
173                 }
174
175                 $profile = $user->getProfile();
176
177                 $orig_profile = clone($profile);
178
179                 $profile->nickname = $user->nickname;
180                 $profile->fullname = $fullname;
181                 $profile->homepage = $homepage;
182                 $profile->bio = $bio;
183                 $profile->location = $location;
184                 $profile->profileurl = common_profile_url($nickname);
185
186                 common_debug('Old profile: ' . common_log_objstring($orig_profile), __FILE__);
187                 common_debug('New profile: ' . common_log_objstring($profile), __FILE__);
188
189                 $result = $profile->update($orig_profile);
190
191                 if (!$result) {
192                         common_log_db_error($profile, 'UPDATE', __FILE__);
193                         common_server_error(_('Couldn\'t save profile.'));
194                         return;
195                 }
196
197                 $user->query('COMMIT');
198
199                 common_broadcast_profile($profile);
200
201                 $this->show_form(_('Settings saved.'), TRUE);
202         }
203
204         function nickname_exists($nickname) {
205                 $user = common_current_user();
206                 $other = User::staticGet('nickname', $nickname);
207                 if (!$other) {
208                         return false;
209                 } else {
210                         return $other->id != $user->id;
211                 }
212         }
213 }