Project

General

Profile

« Previous | Next » 

Revision 1777

Added by Dietmar over 11 years ago

+ add methode StripCodeFromText in class.wb to clean injection
! rebranding the admin/settings and security fixes
! a few new styling in backend wb_theme
! beginning aa lot of account changes like correction of $_SESSION indexe, security fixes
+ add head.load.min.js and head.min.js to /include/jquery/ to style HTML5 templates

View differences:

preferences_form.php
1 1
<?php
2 2
/**
3
 *
4
 * @category        frontend
5
 * @package         account
6
 * @author          WebsiteBaker Project
7
 * @copyright       2009-2012, WebsiteBaker Org. e.V.
8
 * @link			http://www.websitebaker2.org/
9
 * @license         http://www.gnu.org/licenses/gpl.html
10
 * @platform        WebsiteBaker 2.8.x
11
 * @requirements    PHP 5.2.2 and higher
12
 * @version         $Id$
13
 * @filesource		$HeadURL$
14
 * @lastmodified    $Date$
15
 *
16
 */
3
*
4
* @category        frontend
5
* @package         account
6
* @author          WebsiteBaker Project
7
* @copyright       2009-2012, WebsiteBaker Org. e.V.
8
* @link			http://www.websitebaker2.org/
9
* @license         http://www.gnu.org/licenses/gpl.html
10
* @platform        WebsiteBaker 2.8.x
11
* @requirements    PHP 5.2.2 and higher
12
* @version         $Id$
13
* @filesource		$HeadURL$
14
* @lastmodified    $Date$
15
*
16
*/
17 17

  
18 18
/* -------------------------------------------------------- */
19 19
// Must include code to stop this file being accessed directly
20
if(defined('WB_PATH') == false)
21
{
22
	// Stop this file being access directly
23
		die('<h2 style="color:red;margin:3em auto;text-align:center;">Cannot access this file directly</h2>');
20
if(!defined('WB_PATH')) {
21
require_once(dirname(dirname(__FILE__)).'/framework/globalExceptionHandler.php');
22
throw new IllegalFileException();
24 23
}
25 24
/* -------------------------------------------------------- */
26 25

  
27
	if($wb->is_authenticated() === false) {
26
if($wb->is_authenticated() === false) {
28 27
// User needs to login first
29
		header("Location: ".WB_URL."/account/login.php?redirect=".$wb->link);
30
		exit(0);
31
	}
28
header("Location: ".WB_URL."/account/login.php?redirect=".$wb->link);
29
exit(0);
30
}
32 31

  
33 32
// load module default language file (EN)
34
	require_once(WB_PATH .'/account/languages/EN.php');
33
require_once(WB_PATH .'/account/languages/EN.php');
35 34
// check for user defined language file, load it and override EN-Settings with
36
	if(file_exists(WB_PATH .'/account/languages/' .LANGUAGE .'.php')) {
37
		require_once(WB_PATH .'/account/languages/' .LANGUAGE .'.php');
38
	}
39
	require_once(WB_PATH.'/framework/functions-utf8.php');
35
if(file_exists(WB_PATH .'/account/languages/' .LANGUAGE .'.php')) {
36
require_once(WB_PATH .'/account/languages/' .LANGUAGE .'.php');
37
}
38
require_once(WB_PATH.'/framework/functions-utf8.php');
40 39

  
41 40
//	echo '<style type="text/css">';
42 41
//	include(WB_PATH .'/account/frontend.css');
43 42
//	echo "\n</style>\n";
44 43

  
45
	$user_time = true;
46
	require(ADMIN_PATH.'/interface/timezones.php');
47
	require(ADMIN_PATH.'/interface/date_formats.php');
48
	require(ADMIN_PATH.'/interface/time_formats.php');
49
	$error = array();
50
	$success = array();
51
	$template = new Template(WB_PATH .'/account/htt','keep');
44
$user_time = true;
45
require(ADMIN_PATH.'/interface/timezones.php');
46
require(ADMIN_PATH.'/interface/date_formats.php');
47
require(ADMIN_PATH.'/interface/time_formats.php');
48
$error = array();
49
$success = array();
50
$template = new Template(WB_PATH .'/account/htt','keep');
52 51

  
53
	switch($wb->get_post('action')):
54
		case 'details':
55
			require_once(WB_PATH .'/account/details.php');
56
			break;
57
		case 'email':
58
			require_once(WB_PATH .'/account/email.php');
52
switch($wb->get_post('action')):
53
case 'details':
54
require_once(WB_PATH .'/account/details.php');
55
break;
56
case 'email':
57
require_once(WB_PATH .'/account/email.php');
59 58

  
60
			break;
61
		case 'password':
62
			require_once(WB_PATH .'/account/password.php');
63
			break;
64
		default:
65
			// do nothing
66
	endswitch; // switch
59
break;
60
case 'password':
61
require_once(WB_PATH .'/account/password.php');
62
break;
63
default:
64
// do nothing
65
endswitch; // switch
67 66

  
68 67
// show template
69
	$template->set_file('page', 'preferences.htt');
70
	$template->set_block('page', 'main_block', 'main');
68
$template->set_file('page', 'preferences.htt');
69
$template->set_block('page', 'main_block', 'main');
71 70
// get existing values from database
72
	$sql = "SELECT `display_name`,`email` FROM ".TABLE_PREFIX."users WHERE `user_id` = '".$wb->get_user_id()."'";
73
	$rowset = $database->query($sql);
74
	if($database->is_error()) $error[] = $database->get_error();
75
	$row = $rowset->fetchRow();
71
$sql = "SELECT `display_name`,`email` FROM ".TABLE_PREFIX."users WHERE `user_id` = '".$wb->get_user_id()."'";
72
$rowset = $database->query($sql);
73
if($database->is_error()) $error[] = $database->get_error();
74
$row = $rowset->fetchRow();
76 75
// insert values into form
77
	$template->set_var('DISPLAY_NAME', $row['display_name']);
78
	$template->set_var('EMAIL', $row['email']);
76
$template->set_var('DISPLAY_NAME', $row['display_name']);
77
$template->set_var('EMAIL', $row['email']);
78
$template->set_var('ACTION_URL', WB_URL.'/account/preferences.php');
79 79

  
80 80
// read available languages from table addons and assign it to the template
81
	$sql  = 'SELECT * FROM `'.TABLE_PREFIX.'addons` ';
82
	$sql .= 'WHERE `type` = \'language\' ORDER BY `directory`';
83
	if( $res_lang = $database->query($sql) )
84
	{
85
		$template->set_block('main_block', 'language_list_block', 'language_list');
86
		while( $rec_lang = $res_lang->fetchRow() )
87
		{
88
	        $langIcons = (empty($rec_lang['directory'])) ? 'none' : strtolower($rec_lang['directory']);
89
			$template->set_var('CODE',        $rec_lang['directory']);
90
			$template->set_var('NAME',        $rec_lang['name']);
91
			$template->set_var('FLAG',        THEME_URL.'/images/flags/'.$langIcons);
92
			$template->set_var('SELECTED',    (LANGUAGE == $rec_lang['directory'] ? ' selected="selected"' : '') );
93
			$template->parse('language_list', 'language_list_block', true);
94
		}
95
	}
81
$sql  = 'SELECT * FROM `'.TABLE_PREFIX.'addons` ';
82
$sql .= 'WHERE `type` = \'language\' ORDER BY `directory`';
83
if( $res_lang = $database->query($sql) )
84
{
85
    $template->set_block('main_block', 'language_list_block', 'language_list');
86
    while( $rec_lang = $res_lang->fetchRow() )
87
    {
88
        $langIcons = (empty($rec_lang['directory'])) ? 'none' : strtolower($rec_lang['directory']);
89
        $template->set_var('CODE',        $rec_lang['directory']);
90
        $template->set_var('NAME',        $rec_lang['name']);
91
        $template->set_var('FLAG',        THEME_URL.'/images/flags/'.$langIcons);
92
        $template->set_var('SELECTED',    ($wb->get_session('LANGUAGE') == $rec_lang['directory'] ? ' selected="selected"' : '') );
93
        $template->parse('language_list', 'language_list_block', true);
94
    }
95
}
96 96
// Insert default timezone values
97
	$template->set_block('main_block', 'timezone_list_block', 'timezone_list');
98
	foreach($TIMEZONES AS $hour_offset => $title) {
99
		$template->set_var('VALUE', $hour_offset);
100
		$template->set_var('NAME', $title);
101
		if($wb->get_timezone() == $hour_offset*3600) {
102
			$template->set_var('SELECTED', 'selected="selected"');
103
		} else {
104
			$template->set_var('SELECTED', '');
105
		}
106
		$template->parse('timezone_list', 'timezone_list_block', true);
107
	}
97
$template->set_block('main_block', 'timezone_list_block', 'timezone_list');
98
foreach($TIMEZONES AS $hour_offset => $title) {
99
    $template->set_var('VALUE', $hour_offset);
100
    $template->set_var('NAME', $title);
101
    if($wb->get_timezone() == $hour_offset*3600) {
102
        $template->set_var('SELECTED', 'selected="selected"');
103
    } else {
104
        $template->set_var('SELECTED', '');
105
    }
106
    $template->parse('timezone_list', 'timezone_list_block', true);
107
}
108 108

  
109 109
// Insert date format list
110
	$template->set_block('main_block', 'date_format_list_block', 'date_format_list');
111
	foreach($DATE_FORMATS AS $format => $title) {
112
		$format = str_replace('|', ' ', $format); // Add's white-spaces (not able to be stored in array key)
113
		if($format != 'system_default') {
114
			$template->set_var('VALUE', $format);
115
		} else {
116
			$template->set_var('VALUE', '');
117
		}
118
		$template->set_var('NAME', $title);
119
		if(DATE_FORMAT == $format AND !isset($_SESSION['USE_DEFAULT_DATE_FORMAT'])) {
120
			$template->set_var('SELECTED', 'selected="selected"');
121
		} elseif($format == 'system_default' AND isset($_SESSION['USE_DEFAULT_DATE_FORMAT'])) {
122
			$template->set_var('SELECTED', 'selected="selected"');
123
		} else {
124
			$template->set_var('SELECTED', '');
125
		}
126
		$template->parse('date_format_list', 'date_format_list_block', true);
127
	}
110
$template->set_block('main_block', 'date_format_list_block', 'date_format_list');
111
foreach($DATE_FORMATS AS $format => $title)
112
{
113
    $format = str_replace('|', ' ', $format); // Add's white-spaces (not able to be stored in array key)
114
    if($format != 'system_default') {
115
        $template->set_var('VALUE', $format);
116
    } else {
117
        $template->set_var('VALUE', '');
118
    }
119
    $template->set_var('NAME', $title);
120
    if($wb->get_session('DATE_FORMAT') == $format AND !isset($_SESSION['USE_DEFAULT_DATE_FORMAT'])) {
121
        $template->set_var('SELECTED', 'selected="selected"');
122
    } elseif($format == 'system_default' AND isset($_SESSION['USE_DEFAULT_DATE_FORMAT'])) {
123
        $template->set_var('SELECTED', 'selected="selected"');
124
    } else {
125
        $template->set_var('SELECTED', '');
126
    }
127
    $template->parse('date_format_list', 'date_format_list_block', true);
128
}
128 129

  
129 130
// Insert time format list
130
	$template->set_block('main_block', 'time_format_list_block', 'time_format_list');
131
	foreach($TIME_FORMATS AS $format => $title) {
132
		$format = str_replace('|', ' ', $format); // Add's white-spaces (not able to be stored in array key)
133
		if($format != 'system_default') {
134
			$template->set_var('VALUE', $format);
135
		} else {
136
			$template->set_var('VALUE', '');
137
		}
138
		$template->set_var('NAME', $title);
139
		if(TIME_FORMAT == $format AND !isset($_SESSION['USE_DEFAULT_TIME_FORMAT'])) {
140
			$template->set_var('SELECTED', 'selected="selected"');
141
		} elseif($format == 'system_default' AND isset($_SESSION['USE_DEFAULT_TIME_FORMAT'])) {
142
			$template->set_var('SELECTED', 'selected="selected"');
143
		} else {
144
			$template->set_var('SELECTED', '');
145
		}
146
		$template->parse('time_format_list', 'time_format_list_block', true);
147
	}
131
$template->set_block('main_block', 'time_format_list_block', 'time_format_list');
132
foreach($TIME_FORMATS AS $format => $title)
133
{
134
    $format = str_replace('|', ' ', $format); // Add's white-spaces (not able to be stored in array key)
135
    if($format != 'system_default') {
136
        $template->set_var('VALUE', $format);
137
    } else {
138
        $template->set_var('VALUE', '');
139
    }
140
    $template->set_var('NAME', $title);
141
    if($wb->get_session('TIME_FORMAT') == $format AND !isset($_SESSION['USE_DEFAULT_TIME_FORMAT'])) {
142
        $template->set_var('SELECTED', 'selected="selected"');
143
    } elseif($format == 'system_default' AND isset($_SESSION['USE_DEFAULT_TIME_FORMAT'])) {
144
        $template->set_var('SELECTED', 'selected="selected"');
145
    } else {
146
    $template->set_var('SELECTED', '');
147
    }
148
    $template->parse('time_format_list', 'time_format_list_block', true);
149
}
148 150
// Insert language headings
149
	$template->set_var(array(
150
			'HEADING_MY_SETTINGS' => $HEADING['MY_SETTINGS'],
151
			'HEADING_MY_EMAIL'    => $HEADING['MY_EMAIL'],
152
			'HEADING_MY_PASSWORD' => $HEADING['MY_PASSWORD']
153
			)
154
	);
151
$template->set_var(array(
152
'HEADING_MY_SETTINGS' => $HEADING['MY_SETTINGS'],
153
'HEADING_MY_EMAIL'    => $HEADING['MY_EMAIL'],
154
'HEADING_MY_PASSWORD' => $HEADING['MY_PASSWORD']
155
)
156
);
155 157
// Insert language text and messages
156
	$template->set_var(array(
157
			'HTTP_REFERER' => $_SESSION['HTTP_REFERER'],
158
			'TEXT_SAVE'	=> $TEXT['SAVE'],
159
			'TEXT_RESET' => $TEXT['RESET'],
160
			'TEXT_CANCEL' => $TEXT['CANCEL'],
161
			'TEXT_DISPLAY_NAME'	=> $TEXT['DISPLAY_NAME'],
162
			'TEXT_EMAIL' => $TEXT['EMAIL'],
163
			'TEXT_LANGUAGE' => $TEXT['LANGUAGE'],
164
			'TEXT_TIMEZONE' => $TEXT['TIMEZONE'],
165
			'TEXT_DATE_FORMAT' => $TEXT['DATE_FORMAT'],
166
			'TEXT_TIME_FORMAT' => $TEXT['TIME_FORMAT'],
167
			'TEXT_CURRENT_PASSWORD' => $TEXT['CURRENT_PASSWORD'],
168
			'TEXT_NEW_PASSWORD' => $TEXT['NEW_PASSWORD'],
169
			'TEXT_RETYPE_NEW_PASSWORD' => $TEXT['RETYPE_NEW_PASSWORD']
170
			)
171
	);
158
$template->set_var(array(
159
    'HTTP_REFERER' => $_SESSION['HTTP_REFERER'],
160
    'TEXT_SAVE'	=> $TEXT['SAVE'],
161
    'TEXT_RESET' => $TEXT['RESET'],
162
    'TEXT_CANCEL' => $TEXT['CANCEL'],
163
    'TEXT_DISPLAY_NAME'	=> $TEXT['DISPLAY_NAME'],
164
    'TEXT_EMAIL' => $TEXT['EMAIL'],
165
    'TEXT_LANGUAGE' => $TEXT['LANGUAGE'],
166
    'TEXT_TIMEZONE' => $TEXT['TIMEZONE'],
167
    'TEXT_DATE_FORMAT' => $TEXT['DATE_FORMAT'],
168
    'TEXT_TIME_FORMAT' => $TEXT['TIME_FORMAT'],
169
    'TEXT_CURRENT_PASSWORD' => $TEXT['CURRENT_PASSWORD'],
170
    'TEXT_NEW_PASSWORD' => $TEXT['NEW_PASSWORD'],
171
    'TEXT_RETYPE_NEW_PASSWORD' => $TEXT['RETYPE_NEW_PASSWORD']
172
    )
173
);
172 174

  
173 175
// Insert module releated language text and messages
174
	$template->set_var(array(
175
			'MOD_PREFERENCE_PLEASE_SELECT'  => $MOD_PREFERENCE['PLEASE_SELECT'],
176
			'MOD_PREFERENCE_SAVE_SETTINGS'  => $MOD_PREFERENCE['SAVE_SETTINGS'],
177
			'MOD_PREFERENCE_SAVE_EMAIL'     => $MOD_PREFERENCE['SAVE_EMAIL'],
178
			'MOD_PREFERENCE_SAVE_PASSWORD'  => $MOD_PREFERENCE['SAVE_PASSWORD'],
179
			)
180
	);
176
$template->set_var(array(
177
    'MOD_PREFERENCE_PLEASE_SELECT'  => $MOD_PREFERENCE['PLEASE_SELECT'],
178
    'MOD_PREFERENCE_SAVE_SETTINGS'  => $MOD_PREFERENCE['SAVE_SETTINGS'],
179
    'MOD_PREFERENCE_SAVE_EMAIL'     => $MOD_PREFERENCE['SAVE_EMAIL'],
180
    'MOD_PREFERENCE_SAVE_PASSWORD'  => $MOD_PREFERENCE['SAVE_PASSWORD'],
181
    )
182
);
181 183
// Insert error and/or success messages
182
	$template->set_block('main_block', 'error_block', 'error_list');
183
	$template->set_var('ERROR_VALUE', '');
184
	if(sizeof($error)>0){
185
		$template->set_var('ERROR_VALUE', $wb->format_message(implode('<br />',$error),'error'));
186
		$template->parse('error_list', 'error_block', true);
187
	} else {
188
		$template->parse('error_list', '');
189
	}
184
$template->set_block('main_block', 'error_block', 'error_list');
185
$template->set_var('ERROR_VALUE', '');
186
if(sizeof($error)>0){
187
    $template->set_var('ERROR_VALUE', $wb->format_message(implode('<br />',$error),'error'));
188
    $template->parse('error_list', 'error_block', true);
189
} else {
190
    $template->parse('error_list', '');
191
}
190 192

  
191
	$template->set_block('main_block', 'success_block', 'success_list');
192
	$template->set_var('SUCCESS_VALUE', '');
193
	if(sizeof($success)!=0){
194
			$template->set_var('SUCCESS_VALUE', $wb->format_message(implode('<br />',$success),'ok'));
195
			$template->parse('success_list', 'success_block', true);
196
	} else {
197
		$template->parse('success_list', '');
198
	}
193
$template->set_block('main_block', 'success_block', 'success_list');
194
$template->set_var('SUCCESS_VALUE', '');
195
if(sizeof($success)!=0){
196
    $template->set_var('SUCCESS_VALUE', $wb->format_message(implode('<br />',$success),'ok'));
197
    $template->parse('success_list', 'success_block', true);
198
} else {
199
    $template->parse('success_list', '');
200
}
199 201
// Parse template for preferences form
200
	$template->parse('main', 'main_block', false);
201
	$template->pparse('output', 'page');
202
$template->parse('main', 'main_block', false);
203
$template->pparse('output', 'page');

Also available in: Unified diff