X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=mod%2Fgroup.php;h=263586e2e903458f1cf7627a8849ffc4bdc64149;hb=b888382cc6cc2b2b123ef06abefe4ea10c2620d5;hp=f6f8e417330f20eadcc615543451f0bcbc3d5ba6;hpb=20817b4b8ea8b7d074d57a3fd752862931cf711c;p=friendica.git

diff --git a/mod/group.php b/mod/group.php
old mode 100755
new mode 100644
index f6f8e41733..263586e2e9
--- a/mod/group.php
+++ b/mod/group.php
@@ -21,6 +21,8 @@ function group_post(&$a) {
 	}
 
 	if(($a->argc == 2) && ($a->argv[1] === 'new')) {
+		check_form_security_token_redirectOnErr('/group/new', 'group_edit');
+
 		$name = notags(trim($_POST['groupname']));
 		$r = group_add(local_user(),$name);
 		if($r) {
@@ -30,11 +32,13 @@ function group_post(&$a) {
 				goaway($a->get_baseurl() . '/group/' . $r);
 		}
 		else
-			notice( t('Could not create group.') . EOL );	
+			notice( t('Could not create group.') . EOL );
 		goaway($a->get_baseurl() . '/group');
 		return; // NOTREACHED
 	}
 	if(($a->argc == 2) && (intval($a->argv[1]))) {
+		check_form_security_token_redirectOnErr('/group', 'group_edit');
+
 		$r = q("SELECT * FROM `group` WHERE `id` = %d AND `uid` = %d LIMIT 1",
 			intval($a->argv[1]),
 			intval(local_user())
@@ -47,7 +51,7 @@ function group_post(&$a) {
 		$group = $r[0];
 		$groupname = notags(trim($_POST['groupname']));
 		if((strlen($groupname))  && ($groupname != $group['name'])) {
-			$r = q("UPDATE `group` SET `name` = '%s' WHERE `uid` = %d AND `id` = %d LIMIT 1",
+			$r = q("UPDATE `group` SET `name` = '%s' WHERE `uid` = %d AND `id` = %d",
 				dbesc($groupname),
 				intval(local_user()),
 				intval($group['id'])
@@ -58,10 +62,11 @@ function group_post(&$a) {
 
 		$a->page['aside'] = group_side();
 	}
-	return;	
+	return;
 }
 
 function group_content(&$a) {
+	$change = false;
 
 	if(! local_user()) {
 		notice( t('Permission denied') . EOL);
@@ -77,25 +82,32 @@ function group_content(&$a) {
 		$switchtotext = 400;
 
 	$tpl = get_markup_template('group_edit.tpl');
-	$context = array('$submit' => t('Submit'));
+
+	$context = array(
+			'$submit' => t('Save Group'),
+	);
 
 	if(($a->argc == 2) && ($a->argv[1] === 'new')) {
-		
+
 		return replace_macros($tpl, $context + array(
 			'$title' => t('Create a group of contacts/friends.'),
-			'$gname' => array('groupname',t('Group Name: '),$group['name'], ''),
+			'$gname' => array('groupname',t('Group Name: '), '', ''),
+			'$gid' => 'new',
+			'$form_security_token' => get_form_security_token("group_edit"),
 		));
 
 
 	}
 
 	if(($a->argc == 3) && ($a->argv[1] === 'drop')) {
+		check_form_security_token_redirectOnErr('/group', 'group_drop', 't');
+
 		if(intval($a->argv[2])) {
 			$r = q("SELECT `name` FROM `group` WHERE `id` = %d AND `uid` = %d LIMIT 1",
 				intval($a->argv[2]),
 				intval(local_user())
 			);
-			if(count($r)) 
+			if(count($r))
 				$result = group_rmv(local_user(),$r[0]['name']);
 			if($result)
 				info( t('Group removed.') . EOL);
@@ -107,6 +119,8 @@ function group_content(&$a) {
 	}
 
 	if(($a->argc > 2) && intval($a->argv[1]) && intval($a->argv[2])) {
+		check_form_security_token_ForbiddenOnErr('group_member_change', 't');
+
 		$r = q("SELECT `id` FROM `contact` WHERE `id` = %d AND `uid` = %d and `self` = 0 and `blocked` = 0 AND `pending` = 0 LIMIT 1",
 			intval($a->argv[2]),
 			intval(local_user())
@@ -154,17 +168,17 @@ function group_content(&$a) {
 		$drop_tpl = get_markup_template('group_drop.tpl');
 		$drop_txt = replace_macros($drop_tpl, array(
 			'$id' => $group['id'],
-			'$delete' => t('Delete')
+			'$delete' => t('Delete'),
+			'$form_security_token' => get_form_security_token("group_drop"),
 		));
 
-		$celeb = ((($a->user['page-flags'] == PAGE_SOAPBOX) || ($a->user['page-flags'] == PAGE_COMMUNITY)) ? true : false);
 
-		
 		$context = $context + array(
 			'$title' => t('Group Editor'),
 			'$gname' => array('groupname',t('Group Name: '),$group['name'], ''),
 			'$gid' => $group['id'],
 			'$drop' => $drop_txt,
+			'$form_security_token' => get_form_security_token('group_edit'),
 		);
 
 	}
@@ -176,14 +190,14 @@ function group_content(&$a) {
 		'label_members' => t('Members'),
 		'members' => array(),
 		'label_contacts' => t('All Contacts'),
-		'contacts' => arraY(),
+		'contacts' => array(),
 	);
-		
 
+	$sec_token = addslashes(get_form_security_token('group_member_change'));
 	$textmode = (($switchtotext && (count($members) > $switchtotext)) ? true : false);
 	foreach($members as $member) {
 		if($member['url']) {
-			$member['click'] = 'groupChangeMember(' . $group['id'] . ',' . $member['id'] . '); return true;';
+			$member['click'] = 'groupChangeMember(' . $group['id'] . ',' . $member['id'] . ',\'' . $sec_token . '\'); return true;';
 			$groupeditor['members'][] = micropro($member,true,'mpgroup', $textmode);
 		}
 		else
@@ -198,7 +212,7 @@ function group_content(&$a) {
 		$textmode = (($switchtotext && (count($r) > $switchtotext)) ? true : false);
 		foreach($r as $member) {
 			if(! in_array($member['id'],$preselected)) {
-				$member['click'] = 'groupChangeMember(' . $group['id'] . ',' . $member['id'] . '); return true;';
+				$member['click'] = 'groupChangeMember(' . $group['id'] . ',' . $member['id'] . ',\'' . $sec_token . '\'); return true;';
 				$groupeditor['contacts'][] = micropro($member,true,'mpall', $textmode);
 			}
 		}
@@ -212,8 +226,7 @@ function group_content(&$a) {
 		echo replace_macros($tpl, $context);
 		killme();
 	}
-	
+
 	return replace_macros($tpl, $context);
 
 }
-