Merge pull request #2094 from annando/1511-api

[friendica.git] / mod / group.php

diff --git a/mod/group.php b/mod/group.php
old mode 100755 (executable)
new mode 100644 (file)
index 13401ef..263586e
--- a/mod/group.php
+++ b/mod/group.php
@@ -21,6 +21,8 @@ function group_post(&$a) {
        }
 
        if(($a->argc == 2) && ($a->argv[1] === 'new')) {
+               check_form_security_token_redirectOnErr('/group/new', 'group_edit');
+
                $name = notags(trim($_POST['groupname']));
                $r = group_add(local_user(),$name);
                if($r) {
@@ -30,11 +32,13 @@ function group_post(&$a) {
                                goaway($a->get_baseurl() . '/group/' . $r);
                }
                else
-                       notice( t('Could not create group.') . EOL );   
+                       notice( t('Could not create group.') . EOL );
                goaway($a->get_baseurl() . '/group');
                return; // NOTREACHED
        }
        if(($a->argc == 2) && (intval($a->argv[1]))) {
+               check_form_security_token_redirectOnErr('/group', 'group_edit');
+
                $r = q("SELECT * FROM `group` WHERE `id` = %d AND `uid` = %d LIMIT 1",
                        intval($a->argv[1]),
                        intval(local_user())
@@ -47,7 +51,7 @@ function group_post(&$a) {
                $group = $r[0];
                $groupname = notags(trim($_POST['groupname']));
                if((strlen($groupname))  && ($groupname != $group['name'])) {
-                       $r = q("UPDATE `group` SET `name` = '%s' WHERE `uid` = %d AND `id` = %d LIMIT 1",
+                       $r = q("UPDATE `group` SET `name` = '%s' WHERE `uid` = %d AND `id` = %d",
                                dbesc($groupname),
                                intval(local_user()),
                                intval($group['id'])
@@ -58,10 +62,11 @@ function group_post(&$a) {
 
                $a->page['aside'] = group_side();
        }
-       return; 
+       return;
 }
 
 function group_content(&$a) {
+       $change = false;
 
        if(! local_user()) {
                notice( t('Permission denied') . EOL);
@@ -77,26 +82,32 @@ function group_content(&$a) {
                $switchtotext = 400;
 
        $tpl = get_markup_template('group_edit.tpl');
-       $context = array('$submit' => t('Submit'));
+
+       $context = array(
+                       '$submit' => t('Save Group'),
+       );
 
        if(($a->argc == 2) && ($a->argv[1] === 'new')) {
-               
+
                return replace_macros($tpl, $context + array(
                        '$title' => t('Create a group of contacts/friends.'),
-                       '$gname' => array('groupname',t('Group Name: '),$group['name'], ''),
+                       '$gname' => array('groupname',t('Group Name: '), '', ''),
                        '$gid' => 'new',
+                       '$form_security_token' => get_form_security_token("group_edit"),
                ));
 
 
        }
 
        if(($a->argc == 3) && ($a->argv[1] === 'drop')) {
+               check_form_security_token_redirectOnErr('/group', 'group_drop', 't');
+
                if(intval($a->argv[2])) {
                        $r = q("SELECT `name` FROM `group` WHERE `id` = %d AND `uid` = %d LIMIT 1",
                                intval($a->argv[2]),
                                intval(local_user())
                        );
-                       if(count($r)) 
+                       if(count($r))
                                $result = group_rmv(local_user(),$r[0]['name']);
                        if($result)
                                info( t('Group removed.') . EOL);
@@ -108,6 +119,8 @@ function group_content(&$a) {
        }
 
        if(($a->argc > 2) && intval($a->argv[1]) && intval($a->argv[2])) {
+               check_form_security_token_ForbiddenOnErr('group_member_change', 't');
+
                $r = q("SELECT `id` FROM `contact` WHERE `id` = %d AND `uid` = %d and `self` = 0 and `blocked` = 0 AND `pending` = 0 LIMIT 1",
                        intval($a->argv[2]),
                        intval(local_user())
@@ -155,17 +168,17 @@ function group_content(&$a) {
                $drop_tpl = get_markup_template('group_drop.tpl');
                $drop_txt = replace_macros($drop_tpl, array(
                        '$id' => $group['id'],
-                       '$delete' => t('Delete')
+                       '$delete' => t('Delete'),
+                       '$form_security_token' => get_form_security_token("group_drop"),
                ));
 
-               $celeb = ((($a->user['page-flags'] == PAGE_SOAPBOX) || ($a->user['page-flags'] == PAGE_COMMUNITY)) ? true : false);
 
-               
                $context = $context + array(
                        '$title' => t('Group Editor'),
                        '$gname' => array('groupname',t('Group Name: '),$group['name'], ''),
                        '$gid' => $group['id'],
                        '$drop' => $drop_txt,
+                       '$form_security_token' => get_form_security_token('group_edit'),
                );
 
        }
@@ -177,14 +190,14 @@ function group_content(&$a) {
                'label_members' => t('Members'),
                'members' => array(),
                'label_contacts' => t('All Contacts'),
-               'contacts' => arraY(),
+               'contacts' => array(),
        );
-               
 
+       $sec_token = addslashes(get_form_security_token('group_member_change'));
        $textmode = (($switchtotext && (count($members) > $switchtotext)) ? true : false);
        foreach($members as $member) {
                if($member['url']) {
-                       $member['click'] = 'groupChangeMember(' . $group['id'] . ',' . $member['id'] . '); return true;';
+                       $member['click'] = 'groupChangeMember(' . $group['id'] . ',' . $member['id'] . ',\'' . $sec_token . '\'); return true;';
                        $groupeditor['members'][] = micropro($member,true,'mpgroup', $textmode);
                }
                else
@@ -199,7 +212,7 @@ function group_content(&$a) {
                $textmode = (($switchtotext && (count($r) > $switchtotext)) ? true : false);
                foreach($r as $member) {
                        if(! in_array($member['id'],$preselected)) {
-                               $member['click'] = 'groupChangeMember(' . $group['id'] . ',' . $member['id'] . '); return true;';
+                               $member['click'] = 'groupChangeMember(' . $group['id'] . ',' . $member['id'] . ',\'' . $sec_token . '\'); return true;';
                                $groupeditor['contacts'][] = micropro($member,true,'mpall', $textmode);
                        }
                }
@@ -213,8 +226,7 @@ function group_content(&$a) {
                echo replace_macros($tpl, $context);
                killme();
        }
-       
+
        return replace_macros($tpl, $context);
 
 }
-