* Closes #1104: Edit profile and edit icon links on pulldown menu for editable users.

* Closes #545: Admins are now able to edit profiles and icons of other users.
* CSRF protection added to icon upload and edit code.
* Version bump.

git-svn-id: https://code.elgg.org/elgg/trunk@3387 36083f99-b078-4883-b0ff-0f9b5a30f544

diff --git a/mod/profile/actions/cropicon.php b/mod/profile/actions/cropicon.php
index 5acf8a915b4adb59473c56ca93dad8099a99cef9..58f12a5126da3e553692b1df748e016ce5489331 100644 (file)
--- a/mod/profile/actions/cropicon.php
+++ b/mod/profile/actions/cropicon.php
@@ -9,6 +9,9 @@
         * @copyright Curverider Ltd 2008-2009\r
         * @link http://elgg.com/\r
         */\r
+
+       gatekeeper();
+       action_gatekeeper();
 \r
                $x1 = (int) get_input('x_1',0);\r
                $y1 = (int) get_input('y_1',0);\r

diff --git a/mod/profile/actions/edit.php b/mod/profile/actions/edit.php
index 95a669a69283b3e997599d7df8fdf12b24291d97..5092dbd8b36c22988b5925a36854abba48e07de6 100644 (file)
--- a/mod/profile/actions/edit.php
+++ b/mod/profile/actions/edit.php
@@ -11,7 +11,10 @@
         */\r
                \r
        // Load configuration\r
-               global $CONFIG;\r
+               global $CONFIG;
+               
+               gatekeeper();
+               action_gatekeeper();\r
 \r
        // Get profile fields\r
                $input = array();\r

diff --git a/mod/profile/actions/iconupload.php b/mod/profile/actions/iconupload.php
index aec433bbd2e8cda72cb15527c3b3a4e58bc4af34..3bfbe5ceb2f3b6ce4b50d90c85ea3442abbd068b 100644 (file)
--- a/mod/profile/actions/iconupload.php
+++ b/mod/profile/actions/iconupload.php
@@ -9,11 +9,21 @@
         * @copyright Curverider Ltd 2008-2009\r
         * @link http://elgg.com/\r
         */\r
-\r
+
+       gatekeeper();
+       action_gatekeeper();
+       
+       $user = page_owner_entity();
+       if (!$user)
+               $user = $_SESSION['user'];
+               \r
        // If we were given a correct icon\r
                if (\r
-                               isloggedin()\r
+                               (isloggedin()) &&
+                               ($user) &&
+                               ($user->canEdit())\r
                        ) {\r
+                               
                                \r
                                $topbar = get_resized_image_from_uploaded_file('profileicon',16,16, true);\r
                                $tiny = get_resized_image_from_uploaded_file('profileicon',25,25, true);\r
@@ -28,40 +38,40 @@
                                        && $tiny !== false) {\r
                                \r
                                        $filehandler = new ElggFile();\r
-                                       $filehandler->owner_guid = $_SESSION['user']->getGUID();\r
-                                       $filehandler->setFilename("profile/" . $_SESSION['user']->username . "large.jpg");\r
+                                       $filehandler->owner_guid = $user->getGUID();\r
+                                       $filehandler->setFilename("profile/" . $user->username . "large.jpg");\r
                                        $filehandler->open("write");\r
                                        $filehandler->write($large);\r
                                        $filehandler->close();\r
-                                       $filehandler->setFilename("profile/" . $_SESSION['user']->username . "medium.jpg");\r
+                                       $filehandler->setFilename("profile/" . $user->username . "medium.jpg");\r
                                        $filehandler->open("write");\r
                                        $filehandler->write($medium);\r
                                        $filehandler->close();\r
-                                       $filehandler->setFilename("profile/" . $_SESSION['user']->username . "small.jpg");\r
+                                       $filehandler->setFilename("profile/" . $user->username . "small.jpg");\r
                                        $filehandler->open("write");\r
                                        $filehandler->write($small);\r
                                        $filehandler->close();\r
-                                       $filehandler->setFilename("profile/" . $_SESSION['user']->username . "tiny.jpg");\r
+                                       $filehandler->setFilename("profile/" . $user->username . "tiny.jpg");\r
                                        $filehandler->open("write");\r
                                        $filehandler->write($tiny);\r
                                        $filehandler->close();\r
-                                       $filehandler->setFilename("profile/" . $_SESSION['user']->username . "topbar.jpg");\r
+                                       $filehandler->setFilename("profile/" . $user->username . "topbar.jpg");\r
                                        $filehandler->open("write");\r
                                        $filehandler->write($topbar);\r
                                        $filehandler->close();\r
-                                       $filehandler->setFilename("profile/" . $_SESSION['user']->username . "master.jpg");\r
+                                       $filehandler->setFilename("profile/" . $user->username . "master.jpg");\r
                                        $filehandler->open("write");\r
                     $filehandler->write($master);\r
                                        $filehandler->close();\r
                                        \r
-                                       $_SESSION['user']->icontime = time();\r
+                                       $user->icontime = time();\r
                                        \r
                                        system_message(elgg_echo("profile:icon:uploaded"));\r
                                        \r
-                                       trigger_elgg_event('profileiconupdate',$_SESSION['user']->type,$_SESSION['user']);\r
+                                       trigger_elgg_event('profileiconupdate',$user->type,$user);\r
                                        \r
                                        //add to river\r
-                                       add_to_river('river/user/default/profileiconupdate','update',$_SESSION['user']->guid,$_SESSION['user']->guid);\r
+                                       add_to_river('river/user/default/profileiconupdate','update',$user->guid,$user->guid);\r
                                \r
                                } else {\r
                                        system_message(elgg_echo("profile:icon:notfound"));                                     \r
@@ -75,7 +85,7 @@
                        \r
            //forward the user back to the upload page to crop\r
            \r
-           $url = "mod/profile/editicon.php";\r
+           $url = "pg/profile/{$user->username}/editicon/";\r
                        \r
                if (isloggedin()) forward($url);\r
 \r

diff --git a/mod/profile/editicon.php b/mod/profile/editicon.php
index 2471eb00eb63ca170b47557c3a0975344aef96ae..b9e2b2e1387ebdd47e369ba80a2524b92ca02446 100644 (file)
--- a/mod/profile/editicon.php
+++ b/mod/profile/editicon.php
@@ -24,7 +24,7 @@
 \r
        // set title\r
                $area2 = elgg_view_title(elgg_echo('profile:createicon:header'));\r
-               $area2 .= elgg_view("profile/editicon");\r
+               $area2 .= elgg_view("profile/editicon", array('user' => $page_owner));\r
                \r
        // Get the form and correct canvas area\r
                $body = elgg_view_layout("two_column_left_sidebar", '', $area2);\r

diff --git a/mod/profile/manifest.xml b/mod/profile/manifest.xml
index 3ddbb1c07dcb5321abb0b179501d7259a73079ca..d67b15fd02ba4bab32abb32b925c6f3f007f7505 100644 (file)
--- a/mod/profile/manifest.xml
+++ b/mod/profile/manifest.xml
@@ -1,10 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <plugin_manifest>
         <field key="author" value="Curverider ltd" />
-        <field key="version" value="1.5" />
+        <field key="version" value="1.6" />
         <field key="description" value="Elgg profile plugin." />
         <field key="website" value="http://www.elgg.org/" />
         <field key="copyright" value="(C) Curverider 2008-2009" />
                <field key="licence" value="GNU Public License version 2" />
-               <field key="elgg_version" value="2009030702" />
+               <field key="elgg_version" value="2009070601" />
 </plugin_manifest>

diff --git a/mod/profile/start.php b/mod/profile/start.php
index 3dd57c45011135a46f65dcf4d4047d923a029043..2b4d08c5d57a530289930a5de38a4d68e23c043c 100644 (file)
--- a/mod/profile/start.php
+++ b/mod/profile/start.php
@@ -67,11 +67,7 @@
                                if (get_context() == "profile")\r
                                    extend_view('canvas_header/submenu','profile/submenu');\r
 \r
-                       //add submenu options\r
-                               if (get_context() == "profile") {\r
-                                       add_submenu_item(elgg_echo('profile:editdetails'), $CONFIG->wwwroot . "mod/profile/edit.php");\r
-                                       add_submenu_item(elgg_echo('profile:editicon'), $CONFIG->wwwroot . "mod/profile/editicon.php");\r
-                               }\r
+                       \r
 \r
                        // Extend context menu with admin links\r
                        if (isadminloggedin())\r
@@ -146,7 +142,18 @@
                        // The username should be the file we're getting\r
                        if (isset($page[0])) {\r
                                set_input('username',$page[0]);\r
-                       }\r
+                       }
+                       // Any sub pages?
+                       if (isset($page[1])) {
+                               
+                               switch ($page[1])
+                               {
+                                       case 'edit' : include($CONFIG->pluginspath . "profile/edit.php"); break;
+                                       case 'editicon' : include($CONFIG->pluginspath . "profile/editicon.php"); break;
+                       
+                               }
+                       }
+                       \r
                        // Include the standard profile index\r
                        include($CONFIG->pluginspath . "profile/index.php");\r
                        \r
@@ -165,7 +172,6 @@
                        if (isset($page[0])) {
                                switch ($page[0])
                                {
-                                       case 'edit' :
                                        default: include($CONFIG->pluginspath . "profile/defaultprofile.php");
                                }
                        }
@@ -178,10 +184,19 @@
         */
                function profile_pagesetup()
                {
+                       global $CONFIG;
                        if (get_context() == 'admin' && isadminloggedin()) {
-                               global $CONFIG;
+                               
                                add_submenu_item(elgg_echo('profile:edit:default'), $CONFIG->wwwroot . 'pg/defaultprofile/edit/');
                        }
+               
+                       //add submenu options
+                       if (get_context() == "profile") {
+                               $page_owner = page_owner_entity();
+                               
+                               add_submenu_item(elgg_echo('profile:editdetails'), $CONFIG->wwwroot . "pg/profile/{$page_owner->username}/edit/");
+                               add_submenu_item(elgg_echo('profile:editicon'), $CONFIG->wwwroot . "pg/profile/{$page_owner->username}/editicon/");
+                       }
                }\r
                \r
        /**\r

diff --git a/mod/profile/views/default/profile/edit.php b/mod/profile/views/default/profile/edit.php
index e2eb8f5ce26295711e45defed126c6e474dc2eb8..b4d8162dd34bdcd98e8a4326b876a160eede73b3 100644 (file)
--- a/mod/profile/views/default/profile/edit.php
+++ b/mod/profile/views/default/profile/edit.php
@@ -16,7 +16,7 @@
 ?>\r
 <div class="contentWrapper">\r
 <form action="<?php echo $vars['url']; ?>action/profile/edit" method="post">\r
-\r
+<?php echo elgg_view('input/securitytoken') ?>\r
 <?php\r
 \r
        //var_export($vars['profile']);\r

diff --git a/mod/profile/views/default/profile/editicon.php b/mod/profile/views/default/profile/editicon.php
index 17154cee467828969132ea76d845332dd5d07bd6..b36da2c4fc3735df34ed2814da12ab30b224ca2b 100644 (file)
--- a/mod/profile/views/default/profile/editicon.php
+++ b/mod/profile/views/default/profile/editicon.php
@@ -12,7 +12,10 @@
         * @uses $vars['entity'] The user entity\r
         * @uses $vars['profile'] Profile items from $CONFIG->profile, defined in profile/start.php for now \r
         */\r
-\r
+
+       $currentuser = page_owner_entity();
+    if (!$currentuser)
+       $currentuser=$_SESSION['user'];\r
 ?>\r
 <!-- grab the required js for icon cropping -->\r
 <div class="contentWrapper">\r
@@ -25,7 +28,7 @@
        <label><?php echo elgg_echo('profile:currentavatar'); ?></label>\r
        <?php \r
                \r
-               $user_avatar = $_SESSION['user']->getIcon('medium');//$vars['url'] . "pg/icon/" . $_SESSION['user']->username . "/medium/" . $_SESSION['user']->icontime . ".jpg";\r
+               $user_avatar = $currentuser->getIcon('medium');\r
                echo "<img src=\"{$user_avatar}\" alt=\"avatar\" />";\r
 \r
        ?>\r
@@ -33,7 +36,9 @@
 </div>\r
 \r
 <div id="profile_picture_form">\r
-       <form action="<?php echo $vars['url']; ?>action/profile/iconupload" method="post" enctype="multipart/form-data">\r
+       <form action="<?php echo $vars['url']; ?>action/profile/iconupload" method="post" enctype="multipart/form-data">
+       <?php echo elgg_view('input/securitytoken'); ?>
+       <input type="hidden" name="username" value="<?php echo $vars['user']->username; ?>" />\r
        <p><label><?php echo elgg_echo("profile:editicon"); ?></label><br />\r
        \r
                <?php\r
@@ -51,9 +56,11 @@
 <p>    \r
 <?php\r
 \r
-    echo elgg_echo("profile:createicon:instructions");\r
-    //display the current user photo \r
-    $user_master_image = $vars['url'] . "pg/icon/" . $_SESSION['user']->username . "/master/" . $_SESSION['user']->icontime . ".jpg";\r
+    echo elgg_echo("profile:createicon:instructions");
+    \r
+    //display the current user photo
+     \r
+    $user_master_image = $currentuser->getIcon('master');//$vars['url'] . "pg/icon/" . $currentuser->username . "/master/" . $currentuser->icontime . ".jpg";\r
     \r
 ?>\r
 </p>\r
@@ -121,7 +128,8 @@
 \r
 <div class="clearfloat"></div>\r
 \r
-<form action="<?php echo $vars['url']; ?>action/profile/cropicon" method="post" />\r
+<form action="<?php echo $vars['url']; ?>action/profile/cropicon" method="post" />
+       <?php echo elgg_view('input/securitytoken'); ?>\r
        <input type="hidden" name="username" value="<?php echo $vars['user']->username; ?>" />\r
        <input type="hidden" name="x_1" value="<?php echo $vars['user']->x1; ?>" id="x_1" />\r
     <input type="hidden" name="x_2" value="<?php echo $vars['user']->x2; ?>" id="x_2" />\r

diff --git a/mod/profile/views/default/profile/menu/links.php b/mod/profile/views/default/profile/menu/links.php
index ccbe5748f7f94b18a23eb16479b7bc9ce1d28a23..0dbe48264840fa8620f4eda37a4f602c6867d69e 100644 (file)
--- a/mod/profile/views/default/profile/menu/links.php
+++ b/mod/profile/views/default/profile/menu/links.php
@@ -16,7 +16,21 @@
 \r
        <p class="user_menu_profile">\r
                <a href="<?php echo $vars['entity']->getURL(); ?>"><?php echo elgg_echo("profile"); ?></a>\r
-       </p>\r
+       </p>
+       <?php
+               if ($vars['entity']->canEdit())
+               {
+       ?>
+               <p class="user_menu_profile">
+                       <a href="<?php echo $vars['url']?>pg/profile/<?php echo $vars['entity']->username; ?>/edit/"><?php echo elgg_echo("profile:edit"); ?></a>
+               </p>
+               <p class="user_menu_profile">
+                       <a href="<?php echo $vars['url']?>pg/profile/<?php echo $vars['entity']->username; ?>/editicon/"><?php echo elgg_echo("profile:editicon"); ?></a>
+               </p>
+       <?php
+               }
+       
+       ?>\r
        <p class="user_menu_friends">\r
                <a href="<?php echo $vars['url']; ?>pg/friends/<?php echo $vars['entity']->username; ?>/"><?php echo elgg_echo("friends"); ?></a>       \r
        </p>\r

diff --git a/mod/profile/views/default/profile/userdetails.php b/mod/profile/views/default/profile/userdetails.php
index c9eb5d77010962234dbe15d2208d37d654375689..91c3739105bb5ce89a301101c3df3d6645ed9170 100644 (file)
--- a/mod/profile/views/default/profile/userdetails.php
+++ b/mod/profile/views/default/profile/userdetails.php
@@ -63,7 +63,7 @@
 \r
        ?>\r
                <p class="profile_info_edit_buttons">\r
-                       <a href="<?php echo $vars['url']; ?>mod/profile/edit.php?username=<?php echo $vars['entity']->username; ?>"><?php echo elgg_echo("profile:edit"); ?></a>\r
+                       <a href="<?php echo $vars['url']; ?>pg/profile/<?php echo $vars['entity']->username; ?>/edit/"><?php echo elgg_echo("profile:edit"); ?></a>\r
                </p>\r
        <?php\r
 \r

diff --git a/version.php b/version.php
index e71b2b059b80f85aa1f3a10028b59e956d5082b6..d77a46967d090b689cb8aa016b5bdcd7b2ecaccd 100644 (file)
--- a/version.php
+++ b/version.php
@@ -13,7 +13,7 @@
         * @link http://elgg.org/\r
         */\r
 
-          $version = 2009070101;  // YYYYMMDD   = Elgg Date
+          $version = 2009070601;  // YYYYMMDD   = Elgg Date
                                   //         XX = Interim incrementer\r
        \r
           $release = '1.5';    // Human-friendly version name\r