Skip to content

Commit 54d499e

Browse files
PryxPryx
committed
Fixed some todos & added email validation
1 parent f310aac commit 54d499e

File tree

7 files changed

+38
-21
lines changed

7 files changed

+38
-21
lines changed

‎admin/index.php‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,6 @@
99
User::restore_session();
1010
}
1111

12-
//TODO: CHeck if user deactivated
13-
1412
if (!isset($_SESSION['user']))
1513
{
1614
if (isset($_GET['do']) && $_GET['do']=="lost-password")

‎admin/lost-password.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
$user->change_password($_POST['token']);
1414
if (isset($message)){?>
1515
<p class="alert alert-danger"><?php echo $message?></p>
16-
<a href="<?php echo WEB_URL;?>/admin/?do=lost-password<?php echo "&id=".$_POST['id']."&token=".$_POST['token'];?>"><?php echo _("Go back");?> </a>
16+
<a href="<?php echo WEB_URL;?>/admin/?do=lost-password<?php echo "&amp;id=".$_POST['id']."&amp;token=".$_POST['token'];?>"><?php echo _("Go back");?> </a>
1717
<?php
1818
}
1919
else{?>

‎admin/new-user.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
<h2>Add new user</h2>
1010
</div>
1111

12-
<form action="<?php echo WEB_URL;?>/admin/?do=new-user&new=user" method="POST" class="form-horizontal">
12+
<form action="<?php echo WEB_URL;?>/admin/?do=new-user&amp;new=user" method="POST" class="form-horizontal">
1313
<?php if (isset($message))
1414
{?>
1515
<p class="alert alert-danger"><?php echo $message?></p>

‎admin/settings.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
<section>
2323
<h3 class="pull-left"><?php echo _("Services");?></h3>
2424
<?php if ($user->get_rank() <= 1){?>
25-
<form action="?do=settings&new=service" method="post">
25+
<form action="?do=settings&amp;new=service" method="post">
2626
<div class="input-group pull-right new-service">
2727
<input class="form-control" name="service" placeholder="Name" type="text" value="<?php echo ((isset($_POST['service']))?htmlspecialchars($_POST['service']):''); ?>" maxlength="50" required>
2828
<span class="input-group-btn">
@@ -52,7 +52,7 @@
5252
echo "<td>".$result['name']."</td>";
5353
if ($user->get_rank()<=1)
5454
{
55-
echo '<td><a href="'.WEB_URL.'/admin/?do=settings&delete='.$result['id'].'" class="pull-right delete-service"><i class="fa fa-trash"></i></a></td>';
55+
echo '<td><a href="'.WEB_URL.'/admin/?do=settings&amp;delete='.$result['id'].'" class="pull-right delete-service"><i class="fa fa-trash"></i></a></td>';
5656
}
5757
echo "</tr>";
5858
}?>
@@ -74,7 +74,7 @@
7474
{
7575
echo "<tr>";
7676
echo "<td>".$result['id']."</td>";
77-
echo "<td><a href='".WEB_URL."/admin/?do=user&id=".$result['id']."'>".$result['username']."</a></td>";
77+
echo "<td><a href='".WEB_URL."/admin/?do=user&amp;id=".$result['id']."'>".$result['username']."</a></td>";
7878
echo "<td>".$result['name']."</td>";
7979
echo "<td>".$result['surname']."</td>";
8080
echo "<td><a href=\"mailto:".$result['email']."\">".$result['email']."</a></td>";

‎classes/constellation.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ public function render_incidents($future=false, $offset=0, $limit = 5, $admin =
3939
{
4040
if ($offset)
4141
{
42-
echo '<noscript><div class="centered"><a href="'.WEB_URL.'/?offset='.($offset-$limit+1).'&timestamp='.$timestamp.'" class="btn btn-default">'._("Back").'</a></div></noscript>';
42+
echo '<noscript><div class="centered"><a href="'.WEB_URL.'/?offset='.($offset-$limit+1).'&amp;timestamp='.$timestamp.'" class="btn btn-default">'._("Back").'</a></div></noscript>';
4343
}
4444
echo "<h3>"._("Past incidents")."</h3>";
4545
}
@@ -59,7 +59,7 @@ public function render_incidents($future=false, $offset=0, $limit = 5, $admin =
5959
}
6060
if ($show)
6161
{
62-
echo '<div class="centered"><a href="'.WEB_URL.'/?offset='.($offset).'&timestamp='.$timestamp.'" id="loadmore" class="btn btn-default">'._("Load more").'</a></div>';
62+
echo '<div class="centered"><a href="'.WEB_URL.'/?offset='.($offset).'&amp;timestamp='.$timestamp.'" id="loadmore" class="btn btn-default">'._("Load more").'</a></div>';
6363
}
6464
}
6565
}

‎classes/incident.php‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,20 @@ function __construct($data)
3737
* @param int ID
3838
*/
3939
public static function delete($id){
40-
//TODO: This should check whether it's admin or their own post...
41-
global $mysqli, $message;
40+
global $mysqli, $message, $user;
41+
42+
if ($user->get_rank() > 1)
43+
{
44+
$stmt = $mysqli->prepare("SELECT count(*) as count FROM status WHERE id= ? AND user_id = ?");
45+
$stmt->bind_param("ii", $id, $_SESSION['user']);
46+
$stmt->execute();
47+
$query = $stmt->get_result();
48+
if (!$query->fetch_assoc()['count'])
49+
{
50+
$message = _("You don't have permission to do that!");
51+
return;
52+
}
53+
}
4254

4355
$stmt = $mysqli->prepare("DELETE FROM services_status WHERE status_id = ?");
4456
$stmt->bind_param("i", $id);
@@ -164,7 +176,7 @@ public function render($admin=0){
164176
<div class="panel-footer clearfix">
165177
<small><?php echo _("Posted by");?>: <?php echo $this->username;
166178
if (isset($this->end_date)){?>
167-
<span class="pull-right"><?php echo strtotime($this->end_date)>time()?_("Ending"):_("Ended");?>:&nbsp;<time class="pull-right timeago" datetime="<?php echo $this->end_date; ?>"><?php echo $this->end_date; ?></time></span>
179+
<span class="pull-right"><?php echo strtotime($this->end_date)>time()?_("Ending"):_("Ended");?>: <time class="pull-right timeago" datetime="<?php echo $this->end_date; ?>"><?php echo $this->end_date; ?></time></span>
168180
<?php } ?>
169181
</small>
170182
</div>

‎classes/user.php‎

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ public function toggle()
9797
$stmt->bind_param("i", $this->id);
9898
$stmt->execute();
9999
$stmt->close();
100-
header("Location: ".WEB_URL."/admin/?do=user&id=".$id);
100+
header("Location: ".WEB_URL."/admin/?do=user&amp;id=".$id);
101101
}else{
102102
$message = _("You don't have the permission to do that!");
103103
}
@@ -138,6 +138,12 @@ public static function add()
138138
$username = $_POST['username'];
139139
$email = $_POST['email'];
140140
$pass = $_POST['password'];
141+
142+
if (!filter_var($email, FILTER_VALIDATE_EMAIL))
143+
{
144+
$message = "Invalid email!";
145+
return;
146+
}
141147

142148
$variables = array();
143149
if (strlen($name)>50){
@@ -153,6 +159,7 @@ public static function add()
153159
$variables[] = 'email: 60';
154160
}
155161

162+
156163
if (!empty($variables))
157164
{
158165
$message = _("Please mind the following character limits: ");
@@ -308,16 +315,16 @@ public function render_user_settings()
308315
</div>
309316
<div class="row">
310317
<div class="col-md-2 col-md-offset-2"><strong><?php echo _("Username");?></strong></div>
311-
<div class="col-md-6"><?php echo $this->username."&nbsp;"; if ($this->id!=$_SESSION['user'] && $user->get_rank()<=1 && ($user->get_rank()<$this->rank))
318+
<div class="col-md-6"><?php echo $this->username." "; if ($this->id!=$_SESSION['user'] && $user->get_rank()<=1 && ($user->get_rank()<$this->rank))
312319
{
313-
echo "<a href='".WEB_URL."/admin/?do=user&id=".$this->id."&what=toggle'>";
320+
echo "<a href='".WEB_URL."/admin/?do=user&amp;id=".$this->id."&amp;what=toggle'>";
314321
echo "<i class='fa fa-".($this->active?"check success":"times danger")."'></i></a>";
315322
}else{
316323
echo "<i class='fa fa-".($this->active?"check success":"times danger")."'></i>";
317324
}?></div>
318325
</div>
319326

320-
<form action="<?php echo WEB_URL;?>/admin/?do=user&id=<?php echo $this->id; ?>" method="POST">
327+
<form action="<?php echo WEB_URL;?>/admin/?do=user&amp;id=<?php echo $this->id; ?>" method="POST">
321328
<div class="row">
322329
<div class="col-md-2 col-md-offset-2"><strong><?php echo _("Role");?></strong></div>
323330
<div class="col-md-6"><?php if ($user->get_rank() == 0 && $this->id != $_SESSION['user']){?> <div class="input-group"><select class="form-control" name="permission"><?php foreach ($permissions as $key => $value) {
@@ -477,11 +484,11 @@ public static function password_link()
477484

478485
$token = Token::new($id, 'passwd', $time);
479486

480-
$link = WEB_URL."/admin/?do=lost-password&id=$id&token=$token";
487+
$link = WEB_URL."/admin/?do=lost-password&amp;id=$id&amp;token=$token";
481488
$to = $email;
482489
$user = new User($id);
483490
$subject = _('Reset password') . ' - '.NAME;
484-
$msg = sprintf(_( "Hi %s!<br>Below you will find link to change your password. The link is valid for 24hrs. If you didn't request this, feel free to ignore it. <br><br><a href=\"%s\">RESET PASSWORD</a><br><br>If the link doesn't work, copy & paste it into your browser: <br>%s"), $user->get_name(), $link, $link);
491+
$msg = sprintf(_( "Hi %s!<br>Below you will find link to change your password. The link is valid for 24hrs. If you didn't request this, feel free to ignore it. <br><br><a href=\"%s\">RESET PASSWORD</a><br><br>If the link doesn't work, copy &amp; paste it into your browser: <br>%s"), $user->get_name(), $link, $link);
485492
$headers = "Content-Type: text/html; charset=utf-8 ".PHP_EOL;
486493
$headers .= "MIME-Version: 1.0 ".PHP_EOL;
487494
$headers .= "From: ".MAILER_NAME.' <'.MAILER_ADDRESS.'>'.PHP_EOL;
@@ -503,10 +510,10 @@ public function email_link(){
503510
$token = Token::new($id, 'email;$email', $time);
504511

505512

506-
$link = WEB_URL."/admin/?do=change-email&id=$id&token=$token";
513+
$link = WEB_URL."/admin/?do=change-email&amp;id=$id&amp;token=$token";
507514
$to = $email;
508515
$subject = _('Email change').' - '.NAME;
509-
$msg = sprintf(_( "Hi %s!<br>Below you will find link to change your email. The link is valid for 24hrs. If you didn't request this, feel free to ignore it. <br><br><a href=\"%s\">CHANGE EMAIL</a><br><br>If the link doesn't work, copy & paste it into your browser: <br>%s"), $user->get_name(), $link, $link);
516+
$msg = sprintf(_( "Hi %s!<br>Below you will find link to change your email. The link is valid for 24hrs. If you didn't request this, feel free to ignore it. <br><br><a href=\"%s\">CHANGE EMAIL</a><br><br>If the link doesn't work, copy &amp; paste it into your browser: <br>%s"), $user->get_name(), $link, $link);
510517
$headers = "Content-Type: text/html; charset=utf-8 ".PHP_EOL;
511518
$headers .= "MIME-Version: 1.0 ".PHP_EOL;
512519
$headers .= "From: ".MAILER_NAME.' <'.MAILER_ADDRESS.'>'.PHP_EOL;
@@ -581,7 +588,7 @@ public function change_permission(){
581588
$stmt = $mysqli->prepare("UPDATE users SET permission=? WHERE id=?");
582589
$stmt->bind_param("si", $permission, $id);
583590
$stmt->execute();
584-
header("Location: ".WEB_URL."/admin/?do=user&id=".$id);
591+
header("Location: ".WEB_URL."/admin/?do=user&amp;id=".$id);
585592
}
586593
else{
587594
$message = _("You don't have permission to do that!");

0 commit comments

Comments
 (0)