]> git.mxchange.org Git - friendica.git/blobdiff - mod/profiles.php
potential for privacy leakage, plus photo not showing occasionally
[friendica.git] / mod / profiles.php
index 4bbfbb44cbc7f047854086b670b31065da4edc39..d510e4398a5949fc482e33515c7864c9033ef148 100644 (file)
@@ -4,23 +4,26 @@
 function profiles_post(&$a) {
 
        if(! local_user()) {
-               $_SESSION['sysmsg'] .= "Unauthorised." . EOL;
+               notice( t('Permission denied.') . EOL);
                return;
        }
-       if(($a->argc > 1) && ($a->argv[1] != "new") && intval($a->argv[1])) {
-               $r = q("SELECT * FROM `profile` WHERE `id` = %d AND `uid` = %d LIMIT 1",
+
+       $namechanged = false;
+
+       if(($a->argc > 1) && ($a->argv[1] !== "new") && intval($a->argv[1])) {
+               $orig = q("SELECT * FROM `profile` WHERE `id` = %d AND `uid` = %d LIMIT 1",
                        intval($a->argv[1]),
-                       intval($_SESSION['uid'])
+                       intval(local_user())
                );
-               if(! count($r)) {
-                       $_SESSION['sysmsg'] .= "Profile not found." . EOL;
+               if(! count($orig)) {
+                       notice( t('Profile not found.') . EOL);
                        return;
                }
-               $is_default = (($r[0]['is-default']) ? 1 : 0);
+               $is_default = (($orig[0]['is-default']) ? 1 : 0);
 
                $profile_name = notags(trim($_POST['profile_name']));
                if(! strlen($profile_name)) {
-                       $a->$_SESSION['sysmsg'] .= "Profile Name is required." . EOL;
+                       notify( t('Profile Name is required.') . EOL);
                        return;
                }
        
@@ -39,13 +42,21 @@ function profiles_post(&$a) {
 
                        
                $name = notags(trim($_POST['name']));
+
+               if($orig[0]['name'] != $name)
+                       $namechanged = true;
+
                $gender = notags(trim($_POST['gender']));
                $address = notags(trim($_POST['address']));
                $locality = notags(trim($_POST['locality']));
                $region = notags(trim($_POST['region']));
                $postal_code = notags(trim($_POST['postal_code']));
                $country_name = notags(trim($_POST['country_name']));
-               $marital = notags(trim(implode(', ',$_POST['marital'])));
+
+               $marital = notags(trim($_POST['marital']));
+               if($marital != $orig[0]['marital'])
+                       $maritalchanged = true;
+
                $sexual = notags(trim($_POST['sexual']));
                $homepage = notags(trim($_POST['homepage']));
                $politic = notags(trim($_POST['politic']));
@@ -61,10 +72,8 @@ function profiles_post(&$a) {
                $romance = escape_tags(trim($_POST['romance']));
                $work = escape_tags(trim($_POST['work']));
                $education = escape_tags(trim($_POST['education']));
-               if(x($_POST,'profile_in_directory'))
-                       $publish = (($_POST['profile_in_directory'] == 1) ? 1: 0);
-               if(! in_array($gender,array('','Male','Female','Other')))
-                       $gender = '';
+               $hide_friends = (($_POST['hide-friends'] == 1) ? 1: 0);
+
 
                $r = q("UPDATE `profile` 
                        SET `profile-name` = '%s',
@@ -90,7 +99,8 @@ function profiles_post(&$a) {
                        `film` = '%s',
                        `romance` = '%s',
                        `work` = '%s',
-                       `education` = '%s'
+                       `education` = '%s',
+                       `hide-friends` = %d
                        WHERE `id` = %d AND `uid` = %d LIMIT 1",
                        dbesc($profile_name),
                        dbesc($name),
@@ -116,48 +126,52 @@ function profiles_post(&$a) {
                        dbesc($romance),
                        dbesc($work),
                        dbesc($education),
+                       intval($hide_friends),
                        intval($a->argv[1]),
                        intval($_SESSION['uid'])
                );
 
                if($r)
-                       $_SESSION['sysmsg'] .= "Profile updated." . EOL;
-
+                       notice( t('Profile updated.') . EOL);
 
-               if($is_default) {
-                       $r = q("UPDATE `profile` 
-                       SET `publish` = %d
-                       WHERE `id` = %d AND `uid` = %d LIMIT 1",
-                       intval($publish),
-                       intval($a->argv[1]),
-                       intval($_SESSION['uid'])
 
+               if($namechanged && $is_default) {
+                       $r = q("UPDATE `contact` SET `name-date` = '%s' WHERE `self` = 1 AND `uid` = %d LIMIT 1",
+                               dbesc(datetime_convert()),
+                               intval(local_user())
                        );
                }
 
-
+               if($is_default) {
+                       // Update global directory in background
+                       $php_path = ((strlen($a->config['php_path'])) ? $a->config['php_path'] : 'php');
+                       $url = $_SESSION['my_url'];
+                       if($url && strlen(get_config('system','directory_submit_url')))
+                               proc_close(proc_open("\"$php_path\" \"include/directory.php\" \"$url\" &",
+                                       array(),$foo));
+               }
        }
-
-
-
 }
 
 
 
 
 function profiles_content(&$a) {
+       $o = '';
+       $o .= '<script> $(document).ready(function() { $(\'#nav-profiles-link\').addClass(\'nav-selected\'); });</script>';
+
        if(! local_user()) {
-               $_SESSION['sysmsg'] .= "Unauthorised." . EOL;
+               notice( t('Permission denied.') . EOL);
                return;
        }
 
-       if(($a->argc > 2) && ($a->argv[1] == "drop") && intval($a->argv[2])) {
-               $r = q("SELECT * FROM `profile` WHERE `id` = %d AND `uid` = %d AND `is-default` = 0 LIMIT 1",
+       if(($a->argc > 2) && ($a->argv[1] === "drop") && intval($a->argv[2])) {
+               $r = q("SELECT * FROM `profile` WHERE `id` = %d AND `uid` = %d AND `is-default` = 0 AND `self` = 0 LIMIT 1",
                        intval($a->argv[2]),
-                       intval($_SESSION['uid'])
+                       intval(local_user())
                );
                if(! count($r)) {
-                       $_SESSION['sysmsg'] .= "Profile not found." . EOL;
+                       notice( t('Profile not found.') . EOL);
                        goaway($a->get_baseurl() . '/profiles');
                        return; // NOTREACHED
                }
@@ -165,15 +179,15 @@ function profiles_content(&$a) {
                // move every contact using this profile as their default to the user default
 
                $r = q("UPDATE `contact` SET `profile-id` = (SELECT `profile`.`id` AS `profile-id` FROM `profile` WHERE `profile`.`is-default` = 1 AND `profile`.`uid` = %d LIMIT 1) WHERE `profile-id` = %d AND `uid` = %d ",
-                       intval($_SESSION['uid']),
+                       intval(local_user()),
                        intval($a->argv[2]),
-                       intval($_SESSION['uid'])
+                       intval(local_user())
                );
                $r = q("DELETE FROM `profile` WHERE `id` = %d LIMIT 1",
                        intval($a->argv[2])
                );
                if($r)
-                       notice("Profile deleted." . EOL);
+                       notice( t('Profile deleted.') . EOL);
 
                goaway($a->get_baseurl() . '/profiles');
                return; // NOTREACHED
@@ -183,20 +197,20 @@ function profiles_content(&$a) {
 
 
 
-       if(($a->argc > 1) && ($a->argv[1] == 'new')) {
+       if(($a->argc > 1) && ($a->argv[1] === 'new')) {
 
                $r0 = q("SELECT `id` FROM `profile` WHERE `uid` = %d",
-                       intval($_SESSION['uid']));
+                       intval(local_user()));
                $num_profiles = count($r0);
 
-               $name = "Profile-" . ($num_profiles + 1);
+               $name = t('Profile-') . ($num_profiles + 1);
 
                $r1 = q("SELECT `name`, `photo`, `thumb` FROM `profile` WHERE `uid` = %d AND `is-default` = 1 LIMIT 1",
-                       intval($_SESSION['uid']));
+                       intval(local_user()));
                
                $r2 = q("INSERT INTO `profile` (`uid` , `profile-name` , `name`, `photo`, `thumb`)
                        VALUES ( %d, '%s', '%s', '%s', '%s' )",
-                       intval($_SESSION['uid']),
+                       intval(local_user()),
                        dbesc($name),
                        dbesc($r1[0]['name']),
                        dbesc($r1[0]['photo']),
@@ -204,48 +218,49 @@ function profiles_content(&$a) {
                );
 
                $r3 = q("SELECT `id` FROM `profile` WHERE `uid` = %d AND `profile-name` = '%s' LIMIT 1",
-                       intval($_SESSION['uid']),
+                       intval(local_user()),
                        dbesc($name)
                );
-               $_SESSION['sysmsg'] .= "New profile created." . EOL;
+               notice( t('New profile created.') . EOL);
                if(count($r3) == 1)
                        goaway($a->get_baseurl() . '/profiles/' . $r3[0]['id']);
                goaway($a->get_baseurl() . '/profiles');
        }                
 
-       if(($a->argc > 2) && ($a->argv[1] == 'clone')) {
+       if(($a->argc > 2) && ($a->argv[1] === 'clone')) {
 
                $r0 = q("SELECT `id` FROM `profile` WHERE `uid` = %d",
-                       intval($_SESSION['uid']));
+                       intval(local_user()));
                $num_profiles = count($r0);
 
-               $name = "Profile-" . ($num_profiles + 1);
+               $name = t('Profile-') . ($num_profiles + 1);
                $r1 = q("SELECT * FROM `profile` WHERE `uid` = %d AND `id` = %d LIMIT 1",
-                       intval($_SESSION['uid']),
+                       intval(local_user()),
                        intval($a->argv[2])
                );
                if(! count($r1)) {
-                       notice("Profile unavailable to clone." . EOL);
+                       notice( t('Profile unavailable to clone.') . EOL);
                        return;
                }
                unset($r1[0]['id']);
                $r1[0]['is-default'] = 0;
                $r1[0]['publish'] = 0;  
+               $r1[0]['net-publish'] = 0;      
                $r1[0]['profile-name'] = dbesc($name);
 
                dbesc_array($r1[0]);
 
-               $r2 = q("INSERT INTO `profile` (`" 
+               $r2 = dbq("INSERT INTO `profile` (`" 
                        . implode("`, `", array_keys($r1[0])) 
                        . "`) VALUES ('" 
                        . implode("', '", array_values($r1[0])) 
                        . "')" );
 
                $r3 = q("SELECT `id` FROM `profile` WHERE `uid` = %d AND `profile-name` = '%s' LIMIT 1",
-                       intval($_SESSION['uid']),
+                       intval(local_user()),
                        dbesc($name)
                );
-               $_SESSION['sysmsg'] .= "New profile created." . EOL;
+               notice( t('New profile created.') . EOL);
                if(count($r3) == 1)
                        goaway($a->get_baseurl() . '/profiles/' . $r3[0]['id']);
        goaway($a->get_baseurl() . '/profiles');
@@ -253,32 +268,24 @@ function profiles_content(&$a) {
        }                
 
 
-
-
-
-       if(intval($a->argv[1])) {
+       if(($a->argc > 1) && (intval($a->argv[1]))) {
                $r = q("SELECT * FROM `profile` WHERE `id` = %d AND `uid` = %d LIMIT 1",
                        intval($a->argv[1]),
-                       intval($_SESSION['uid'])
+                       intval(local_user())
                );
                if(! count($r)) {
-                       $_SESSION['sysmsg'] .= "Profile not found." . EOL;
+                       notice( t('Profile not found.') . EOL);
                        return;
                }
 
                require_once('mod/profile.php');
-               profile_load($a,$_SESSION['uid'],$r[0]['id']);
+               profile_load($a,$a->user['nickname'],$r[0]['id']);
 
-               require_once('view/profile_selectors.php');
+               require_once('include/profile_selectors.php');
 
-               $tpl = file_get_contents('view/profed_head.tpl');
-               $opt_tpl = file_get_contents("view/profile-in-directory.tpl");
-               $profile_in_dir = replace_macros($opt_tpl,array(
-                       '$yes_selected' => (($r[0]['publish']) ? " checked=\"checked\" " : ""),
-                       '$no_selected' => (($r[0]['publish'] == 0) ? " checked=\"checked\" " : "")
-               ));
+               $tpl = load_view_file('view/profed_head.tpl');
 
-               $opt_tpl = file_get_contents("view/profile-hide-friends.tpl");
+               $opt_tpl = load_view_file("view/profile-hide-friends.tpl");
                $hide_friends = replace_macros($opt_tpl,array(
                        '$yes_selected' => (($r[0]['hide-friends']) ? " checked=\"checked\" " : ""),
                        '$no_selected' => (($r[0]['hide-friends'] == 0) ? " checked=\"checked\" " : "")
@@ -293,12 +300,13 @@ function profiles_content(&$a) {
        
 
                $is_default = (($r[0]['is-default']) ? 1 : 0);
-               $tpl = file_get_contents("view/profile_edit.tpl");
+               $tpl = load_view_file("view/profile_edit.tpl");
                $o .= replace_macros($tpl,array(
+                       '$disabled' => (($is_default) ? 'onclick="return false;" style="color: #BBBBFF;"' : ''),
                        '$baseurl' => $a->get_baseurl(),
                        '$profile_id' => $r[0]['id'],
                        '$profile_name' => $r[0]['profile-name'],
-                       '$default' => (($is_default) ? "<p id=\"profile-edit-default-desc\">This is your <strong>public</strong> profile.<br />It <strong>may</strong> be visible to anybody using the internet.</p>" : ""),
+                       '$default' => (($is_default) ? '<p id="profile-edit-default-desc">' . t('This is your <strong>public</strong> profile.<br />It <strong>may</strong> be visible to anybody using the internet.') . '</p>' : ""),
                        '$name' => $r[0]['name'],
                        '$dob' => dob($r[0]['dob']),
                        '$hide_friends' => $hide_friends,
@@ -307,7 +315,7 @@ function profiles_content(&$a) {
                        '$region' => $r[0]['region'],
                        '$postal_code' => $r[0]['postal-code'],
                        '$country_name' => $r[0]['country-name'],
-                       '$age' => ((intval($r[0]['dob'])) ? '(Age: '. age($r[0]['dob'],$a->user['timezone'],$a->user['timezone']) . ')' : ''),
+                       '$age' => ((intval($r[0]['dob'])) ? '(' . t('Age: ') . age($r[0]['dob'],$a->user['timezone'],$a->user['timezone']) . ')' : ''),
                        '$gender' => gender_selector($r[0]['gender']),
                        '$marital' => marital_selector($r[0]['marital']),
                        '$sexual' => sexpref_selector($r[0]['sexual']),
@@ -323,8 +331,7 @@ function profiles_content(&$a) {
                        '$romance' => $r[0]['romance'],
                        '$work' => $r[0]['work'],
                        '$education' => $r[0]['education'],
-                       '$contact' => $r[0]['contact'],
-                       '$profile_in_dir' => (($is_default) ? $profile_in_dir : '')
+                       '$contact' => $r[0]['contact']
                ));
 
                return $o;
@@ -334,12 +341,12 @@ function profiles_content(&$a) {
        else {
 
                $r = q("SELECT * FROM `profile` WHERE `uid` = %d",
-                       $_SESSION['uid']);
+                       local_user());
                if(count($r)) {
 
-                       $o .= file_get_contents('view/profile_listing_header.tpl');
-                       $tpl_default = file_get_contents('view/profile_entry_default.tpl');
-                       $tpl = file_get_contents('view/profile_entry.tpl');
+                       $o .= load_view_file('view/profile_listing_header.tpl');
+                       $tpl_default = load_view_file('view/profile_entry_default.tpl');
+                       $tpl = load_view_file('view/profile_entry.tpl');
 
                        foreach($r as $rr) {
                                $template = (($rr['is-default']) ? $tpl_default : $tpl);