Twitter-integration - Twitter settings tab now saves Twitter credentials

[quix0rs-gnu-social.git] / actions / profilesettings.php

diff --git a/actions/profilesettings.php b/actions/profilesettings.php
index f2fe89826eae19749c83e8287778a892ea4a7f04..14c725ff91364ea4f87abcf9cc20301b431e6636 100644 (file)
--- a/actions/profilesettings.php
+++ b/actions/profilesettings.php
@@ -37,6 +37,7 @@ class ProfilesettingsAction extends SettingsAction {
                                                                                   'id' => 'profilesettings',
                                                                                   'action' =>
                                                                                   common_local_url('profilesettings')));
+               common_hidden('token', common_session_token());
                # too much common patterns here... abstractable?
                common_input('nickname', _('Nickname'),
                                         ($this->arg('nickname')) ? $this->arg('nickname') : $profile->nickname,
@@ -80,6 +81,14 @@ class ProfilesettingsAction extends SettingsAction {
                $language = $this->trimmed('language');
                $timezone = $this->trimmed('timezone');
 
+               # CSRF protection
+
+               $token = $this->trimmed('token');
+               if (!$token || $token != common_session_token()) {
+                       $this->show_form(_('There was a problem with your session token. Try again, please.'));
+                       return;
+               }
+
                # Some validation
 
                if (!Validate::string($nickname, array('min_length' => 1,
@@ -140,13 +149,16 @@ class ProfilesettingsAction extends SettingsAction {
                                common_log_db_error($user, 'UPDATE', __FILE__);
                                common_server_error(_('Couldn\'t update user.'));
                                return;
+                       } else {
+                               # Re-initialize language environment if it changed
+                               common_init_language();
                        }
                }
 
                # XXX: XOR
-               
+
                if ($user->autosubscribe ^ $autosubscribe) {
-                       
+
                        $original = clone($user);
 
                        $user->autosubscribe = $autosubscribe;
@@ -159,7 +171,7 @@ class ProfilesettingsAction extends SettingsAction {
                                return;
                        }
                }
-               
+
                $profile = $user->getProfile();
 
                $orig_profile = clone($profile);