potential for privacy leakage, plus photo not showing occasionally

[friendica.git] / mod / profiles.php

diff --git a/mod/profiles.php b/mod/profiles.php
index c9dc4c80c7d0e6d6a901a2bf9c378141477f4fdc..d510e4398a5949fc482e33515c7864c9033ef148 100644 (file)
--- a/mod/profiles.php
+++ b/mod/profiles.php
@@ -10,10 +10,10 @@ function profiles_post(&$a) {
 
        $namechanged = false;
 
-       if(($a->argc > 1) && ($a->argv[1] != "new") && intval($a->argv[1])) {
+       if(($a->argc > 1) && ($a->argv[1] !== "new") && intval($a->argv[1])) {
                $orig = q("SELECT * FROM `profile` WHERE `id` = %d AND `uid` = %d LIMIT 1",
                        intval($a->argv[1]),
-                       intval($_SESSION['uid'])
+                       intval(local_user())
                );
                if(! count($orig)) {
                        notice( t('Profile not found.') . EOL);
@@ -138,7 +138,7 @@ function profiles_post(&$a) {
                if($namechanged && $is_default) {
                        $r = q("UPDATE `contact` SET `name-date` = '%s' WHERE `self` = 1 AND `uid` = %d LIMIT 1",
                                dbesc(datetime_convert()),
-                               intval($_SESSION['uid'])
+                               intval(local_user())
                        );
                }
 
@@ -157,16 +157,18 @@ function profiles_post(&$a) {
 
 
 function profiles_content(&$a) {
+       $o = '';
        $o .= '<script> $(document).ready(function() { $(\'#nav-profiles-link\').addClass(\'nav-selected\'); });</script>';
+
        if(! local_user()) {
                notice( t('Permission denied.') . EOL);
                return;
        }
 
-       if(($a->argc > 2) && ($a->argv[1] == "drop") && intval($a->argv[2])) {
+       if(($a->argc > 2) && ($a->argv[1] === "drop") && intval($a->argv[2])) {
                $r = q("SELECT * FROM `profile` WHERE `id` = %d AND `uid` = %d AND `is-default` = 0 AND `self` = 0 LIMIT 1",
                        intval($a->argv[2]),
-                       intval($_SESSION['uid'])
+                       intval(local_user())
                );
                if(! count($r)) {
                        notice( t('Profile not found.') . EOL);
@@ -177,9 +179,9 @@ function profiles_content(&$a) {
                // move every contact using this profile as their default to the user default
 
                $r = q("UPDATE `contact` SET `profile-id` = (SELECT `profile`.`id` AS `profile-id` FROM `profile` WHERE `profile`.`is-default` = 1 AND `profile`.`uid` = %d LIMIT 1) WHERE `profile-id` = %d AND `uid` = %d ",
-                       intval($_SESSION['uid']),
+                       intval(local_user()),
                        intval($a->argv[2]),
-                       intval($_SESSION['uid'])
+                       intval(local_user())
                );
                $r = q("DELETE FROM `profile` WHERE `id` = %d LIMIT 1",
                        intval($a->argv[2])
@@ -195,20 +197,20 @@ function profiles_content(&$a) {
 
 
 
-       if(($a->argc > 1) && ($a->argv[1] == 'new')) {
+       if(($a->argc > 1) && ($a->argv[1] === 'new')) {
 
                $r0 = q("SELECT `id` FROM `profile` WHERE `uid` = %d",
-                       intval($_SESSION['uid']));
+                       intval(local_user()));
                $num_profiles = count($r0);
 
                $name = t('Profile-') . ($num_profiles + 1);
 
                $r1 = q("SELECT `name`, `photo`, `thumb` FROM `profile` WHERE `uid` = %d AND `is-default` = 1 LIMIT 1",
-                       intval($_SESSION['uid']));
+                       intval(local_user()));
                
                $r2 = q("INSERT INTO `profile` (`uid` , `profile-name` , `name`, `photo`, `thumb`)
                        VALUES ( %d, '%s', '%s', '%s', '%s' )",
-                       intval($_SESSION['uid']),
+                       intval(local_user()),
                        dbesc($name),
                        dbesc($r1[0]['name']),
                        dbesc($r1[0]['photo']),
@@ -216,7 +218,7 @@ function profiles_content(&$a) {
                );
 
                $r3 = q("SELECT `id` FROM `profile` WHERE `uid` = %d AND `profile-name` = '%s' LIMIT 1",
-                       intval($_SESSION['uid']),
+                       intval(local_user()),
                        dbesc($name)
                );
                notice( t('New profile created.') . EOL);
@@ -225,15 +227,15 @@ function profiles_content(&$a) {
                goaway($a->get_baseurl() . '/profiles');
        }                
 
-       if(($a->argc > 2) && ($a->argv[1] == 'clone')) {
+       if(($a->argc > 2) && ($a->argv[1] === 'clone')) {
 
                $r0 = q("SELECT `id` FROM `profile` WHERE `uid` = %d",
-                       intval($_SESSION['uid']));
+                       intval(local_user()));
                $num_profiles = count($r0);
 
                $name = t('Profile-') . ($num_profiles + 1);
                $r1 = q("SELECT * FROM `profile` WHERE `uid` = %d AND `id` = %d LIMIT 1",
-                       intval($_SESSION['uid']),
+                       intval(local_user()),
                        intval($a->argv[2])
                );
                if(! count($r1)) {
@@ -248,14 +250,14 @@ function profiles_content(&$a) {
 
                dbesc_array($r1[0]);
 
-               $r2 = q("INSERT INTO `profile` (`" 
+               $r2 = dbq("INSERT INTO `profile` (`" 
                        . implode("`, `", array_keys($r1[0])) 
                        . "`) VALUES ('" 
                        . implode("', '", array_values($r1[0])) 
                        . "')" );
 
                $r3 = q("SELECT `id` FROM `profile` WHERE `uid` = %d AND `profile-name` = '%s' LIMIT 1",
-                       intval($_SESSION['uid']),
+                       intval(local_user()),
                        dbesc($name)
                );
                notice( t('New profile created.') . EOL);
@@ -266,10 +268,10 @@ function profiles_content(&$a) {
        }                
 
 
-       if(intval($a->argv[1])) {
+       if(($a->argc > 1) && (intval($a->argv[1]))) {
                $r = q("SELECT * FROM `profile` WHERE `id` = %d AND `uid` = %d LIMIT 1",
                        intval($a->argv[1]),
-                       intval($_SESSION['uid'])
+                       intval(local_user())
                );
                if(! count($r)) {
                        notice( t('Profile not found.') . EOL);
@@ -279,11 +281,11 @@ function profiles_content(&$a) {
                require_once('mod/profile.php');
                profile_load($a,$a->user['nickname'],$r[0]['id']);
 
-               require_once('view/profile_selectors.php');
+               require_once('include/profile_selectors.php');
 
-               $tpl = file_get_contents('view/profed_head.tpl');
+               $tpl = load_view_file('view/profed_head.tpl');
 
-               $opt_tpl = file_get_contents("view/profile-hide-friends.tpl");
+               $opt_tpl = load_view_file("view/profile-hide-friends.tpl");
                $hide_friends = replace_macros($opt_tpl,array(
                        '$yes_selected' => (($r[0]['hide-friends']) ? " checked=\"checked\" " : ""),
                        '$no_selected' => (($r[0]['hide-friends'] == 0) ? " checked=\"checked\" " : "")
@@ -298,7 +300,7 @@ function profiles_content(&$a) {
        
 
                $is_default = (($r[0]['is-default']) ? 1 : 0);
-               $tpl = file_get_contents("view/profile_edit.tpl");
+               $tpl = load_view_file("view/profile_edit.tpl");
                $o .= replace_macros($tpl,array(
                        '$disabled' => (($is_default) ? 'onclick="return false;" style="color: #BBBBFF;"' : ''),
                        '$baseurl' => $a->get_baseurl(),
@@ -339,12 +341,12 @@ function profiles_content(&$a) {
        else {
 
                $r = q("SELECT * FROM `profile` WHERE `uid` = %d",
-                       $_SESSION['uid']);
+                       local_user());
                if(count($r)) {
 
-                       $o .= file_get_contents('view/profile_listing_header.tpl');
-                       $tpl_default = file_get_contents('view/profile_entry_default.tpl');
-                       $tpl = file_get_contents('view/profile_entry.tpl');
+                       $o .= load_view_file('view/profile_listing_header.tpl');
+                       $tpl_default = load_view_file('view/profile_entry_default.tpl');
+                       $tpl = load_view_file('view/profile_entry.tpl');
 
                        foreach($r as $rr) {
                                $template = (($rr['is-default']) ? $tpl_default : $tpl);