X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=mod%2Fprofiles.php;h=6a32fbee5a75e916d0143b4b880ce35552d41b97;hb=be6031aa1b859cefc75b84f25baba7c213204cc2;hp=a4a49ec785ad1b4e5dfda67a1430bff5adfec849;hpb=dc35d2f2f352b1f378a00dae37c6be3044c9a0a0;p=friendica.git diff --git a/mod/profiles.php b/mod/profiles.php index a4a49ec785..6a32fbee5a 100644 --- a/mod/profiles.php +++ b/mod/profiles.php @@ -12,6 +12,7 @@ use Friendica\Core\Addon; use Friendica\Core\Config; use Friendica\Core\L10n; use Friendica\Core\PConfig; +use Friendica\Core\Renderer; use Friendica\Core\System; use Friendica\Core\Worker; use Friendica\Database\DBA; @@ -21,6 +22,7 @@ use Friendica\Model\Profile; use Friendica\Module\Login; use Friendica\Network\Probe; use Friendica\Util\DateTimeFormat; +use Friendica\Util\Strings; use Friendica\Util\Temporal; function profiles_init(App $a) { @@ -200,13 +202,13 @@ function profiles_post(App $a) { $is_default = (($orig[0]['is-default']) ? 1 : 0); - $profile_name = notags(trim($_POST['profile_name'])); + $profile_name = Strings::escapeTags(trim($_POST['profile_name'])); if (! strlen($profile_name)) { notice(L10n::t('Profile Name is required.') . EOL); return; } - $dob = $_POST['dob'] ? escape_tags(trim($_POST['dob'])) : '0000-00-00'; + $dob = $_POST['dob'] ? Strings::escapeHtml(trim($_POST['dob'])) : '0000-00-00'; $y = substr($dob, 0, 4); if ((! ctype_digit($y)) || ($y < 1900)) { @@ -214,7 +216,7 @@ function profiles_post(App $a) { } else { $ignore_year = false; } - if (!in_array($dob, ['0000-00-00', '0001-01-01'])) { + if (!in_array($dob, ['0000-00-00', DBA::NULL_DATE])) { if (strpos($dob, '0000-') === 0 || strpos($dob, '0001-') === 0) { $ignore_year = true; $dob = substr($dob, 5); @@ -227,7 +229,7 @@ function profiles_post(App $a) { } } - $name = notags(trim($_POST['name'])); + $name = Strings::escapeTags(trim($_POST['name'])); if (! strlen($name)) { $name = '[No Name]'; @@ -237,19 +239,19 @@ function profiles_post(App $a) { $namechanged = true; } - $pdesc = notags(trim($_POST['pdesc'])); - $gender = notags(trim($_POST['gender'])); - $address = notags(trim($_POST['address'])); - $locality = notags(trim($_POST['locality'])); - $region = notags(trim($_POST['region'])); - $postal_code = notags(trim($_POST['postal_code'])); - $country_name = notags(trim($_POST['country_name'])); - $pub_keywords = profile_clean_keywords(notags(trim($_POST['pub_keywords']))); - $prv_keywords = profile_clean_keywords(notags(trim($_POST['prv_keywords']))); - $marital = notags(trim($_POST['marital'])); - $howlong = notags(trim($_POST['howlong'])); + $pdesc = Strings::escapeTags(trim($_POST['pdesc'])); + $gender = Strings::escapeTags(trim($_POST['gender'])); + $address = Strings::escapeTags(trim($_POST['address'])); + $locality = Strings::escapeTags(trim($_POST['locality'])); + $region = Strings::escapeTags(trim($_POST['region'])); + $postal_code = Strings::escapeTags(trim($_POST['postal_code'])); + $country_name = Strings::escapeTags(trim($_POST['country_name'])); + $pub_keywords = profile_clean_keywords(Strings::escapeTags(trim($_POST['pub_keywords']))); + $prv_keywords = profile_clean_keywords(Strings::escapeTags(trim($_POST['prv_keywords']))); + $marital = Strings::escapeTags(trim($_POST['marital'])); + $howlong = Strings::escapeTags(trim($_POST['howlong'])); - $with = ((x($_POST,'with')) ? notags(trim($_POST['with'])) : ''); + $with = (!empty($_POST['with']) ? Strings::escapeTags(trim($_POST['with'])) : ''); if (! strlen($howlong)) { $howlong = DBA::NULL_DATETIME; @@ -310,30 +312,30 @@ function profiles_post(App $a) { } /// @TODO Not flexible enough for later expansion, let's have more OOP here - $sexual = notags(trim($_POST['sexual'])); - $xmpp = notags(trim($_POST['xmpp'])); - $homepage = notags(trim($_POST['homepage'])); + $sexual = Strings::escapeTags(trim($_POST['sexual'])); + $xmpp = Strings::escapeTags(trim($_POST['xmpp'])); + $homepage = Strings::escapeTags(trim($_POST['homepage'])); if ((strpos($homepage, 'http') !== 0) && (strlen($homepage))) { // neither http nor https in URL, add them $homepage = 'http://'.$homepage; } - $hometown = notags(trim($_POST['hometown'])); - $politic = notags(trim($_POST['politic'])); - $religion = notags(trim($_POST['religion'])); - - $likes = escape_tags(trim($_POST['likes'])); - $dislikes = escape_tags(trim($_POST['dislikes'])); - - $about = escape_tags(trim($_POST['about'])); - $interest = escape_tags(trim($_POST['interest'])); - $contact = escape_tags(trim($_POST['contact'])); - $music = escape_tags(trim($_POST['music'])); - $book = escape_tags(trim($_POST['book'])); - $tv = escape_tags(trim($_POST['tv'])); - $film = escape_tags(trim($_POST['film'])); - $romance = escape_tags(trim($_POST['romance'])); - $work = escape_tags(trim($_POST['work'])); - $education = escape_tags(trim($_POST['education'])); + $hometown = Strings::escapeTags(trim($_POST['hometown'])); + $politic = Strings::escapeTags(trim($_POST['politic'])); + $religion = Strings::escapeTags(trim($_POST['religion'])); + + $likes = Strings::escapeHtml(trim($_POST['likes'])); + $dislikes = Strings::escapeHtml(trim($_POST['dislikes'])); + + $about = Strings::escapeHtml(trim($_POST['about'])); + $interest = Strings::escapeHtml(trim($_POST['interest'])); + $contact = Strings::escapeHtml(trim($_POST['contact'])); + $music = Strings::escapeHtml(trim($_POST['music'])); + $book = Strings::escapeHtml(trim($_POST['book'])); + $tv = Strings::escapeHtml(trim($_POST['tv'])); + $film = Strings::escapeHtml(trim($_POST['film'])); + $romance = Strings::escapeHtml(trim($_POST['romance'])); + $work = Strings::escapeHtml(trim($_POST['work'])); + $education = Strings::escapeHtml(trim($_POST['education'])); $hide_friends = (($_POST['hide-friends'] == 1) ? 1: 0); @@ -526,12 +528,12 @@ function profiles_content(App $a) { return; } - $a->page['htmlhead'] .= replace_macros(get_markup_template('profed_head.tpl'), [ + $a->page['htmlhead'] .= Renderer::replaceMacros(Renderer::getMarkupTemplate('profed_head.tpl'), [ '$baseurl' => System::baseUrl(true), ]); - $opt_tpl = get_markup_template("profile-hide-friends.tpl"); - $hide_friends = replace_macros($opt_tpl,[ + $opt_tpl = Renderer::getMarkupTemplate("profile-hide-friends.tpl"); + $hide_friends = Renderer::replaceMacros($opt_tpl,[ '$yesno' => [ 'hide-friends', //Name L10n::t('Hide contacts and friends:'), //Label @@ -552,8 +554,8 @@ function profiles_content(App $a) { $detailled_profile = (PConfig::get(local_user(), 'system', 'detailled_profile') AND $personal_account); $is_default = (($r[0]['is-default']) ? 1 : 0); - $tpl = get_markup_template("profile_edit.tpl"); - $o .= replace_macros($tpl, [ + $tpl = Renderer::getMarkupTemplate("profile_edit.tpl"); + $o .= Renderer::replaceMacros($tpl, [ '$personal_account' => $personal_account, '$detailled_profile' => $detailled_profile, @@ -663,11 +665,11 @@ function profiles_content(App $a) { if (DBA::isResult($r)) { - $tpl = get_markup_template('profile_entry.tpl'); + $tpl = Renderer::getMarkupTemplate('profile_entry.tpl'); $profiles = ''; foreach ($r as $rr) { - $profiles .= replace_macros($tpl, [ + $profiles .= Renderer::replaceMacros($tpl, [ '$photo' => $a->removeBaseURL($rr['thumb']), '$id' => $rr['id'], '$alt' => L10n::t('Profile Image'), @@ -677,8 +679,8 @@ function profiles_content(App $a) { ]); } - $tpl_header = get_markup_template('profile_listing_header.tpl'); - $o .= replace_macros($tpl_header,[ + $tpl_header = Renderer::getMarkupTemplate('profile_listing_header.tpl'); + $o .= Renderer::replaceMacros($tpl_header,[ '$header' => L10n::t('Edit/Manage Profiles'), '$chg_photo' => L10n::t('Change profile photo'), '$cr_new' => L10n::t('Create New Profile'),