Fixes #4138: Admin can edit any users' notifications

diff --git a/mod/notifications/actions/groupsave.php b/mod/notifications/actions/groupsave.php
index c304cb856a1a01c2a59f4de6c35b91d2975b12ae..7838f7e63bfa461d9dde5840dc224ee50718f863 100644 (file)
--- a/mod/notifications/actions/groupsave.php
+++ b/mod/notifications/actions/groupsave.php
@@ -6,27 +6,42 @@
  * @package ElggNotifications
  */
 
-// Load important global vars
-global $NOTIFICATION_HANDLERS;
+$current_user = elgg_get_logged_in_user_entity();
+
+$guid = (int) get_input('guid', 0);
+if (!$guid || !($user = get_entity($guid))) {
+       forward();
+}
+if (($user->guid != $current_user->guid) && !$current_user->isAdmin()) {
+       forward();
+}
 
 // Get group memberships and condense them down to an array of guids
 $groups = array();
-if ($groupmemberships = elgg_get_entities_from_relationship(array('relationship' => 'member', 'relationship_guid' => elgg_get_logged_in_user_guid(), 'types' => 'group', 'limit' => 9999))) {
+$options = array(
+       'relationship' => 'member',
+       'relationship_guid' => $user->guid,
+       'types' => 'group',
+       'limit' => 9999,
+);
+if ($groupmemberships = elgg_get_entities_from_relationship($options)) {
        foreach($groupmemberships as $groupmembership) {
                $groups[] = $groupmembership->guid;
        }
-}              
+}
 
+// Load important global vars
+global $NOTIFICATION_HANDLERS;
 foreach($NOTIFICATION_HANDLERS as $method => $foo) {
        $subscriptions[$method] = get_input($method.'subscriptions');
        $personal[$method] = get_input($method.'personal');
        $collections[$method] = get_input($method.'collections');
        if (!empty($groups)) {
                foreach($groups as $group) {
-                       if (in_array($group,$subscriptions[$method])) {
-                               add_entity_relationship(elgg_get_logged_in_user_guid(), 'notify'.$method, $group);
+                       if (in_array($group, $subscriptions[$method])) {
+                               add_entity_relationship($user->guid, 'notify'.$method, $group);
                        } else {
-                               remove_entity_relationship(elgg_get_logged_in_user_guid(), 'notify'.$method, $group);
+                               remove_entity_relationship($user->guid, 'notify'.$method, $group);
                        }
                }
        }

diff --git a/mod/notifications/actions/save.php b/mod/notifications/actions/save.php
index 163b656aa2ef4b6d77789569ed14c4d71922203b..3fe0001a329a7b0c04c0fb80a2ff15de8df054ca 100644 (file)
--- a/mod/notifications/actions/save.php
+++ b/mod/notifications/actions/save.php
@@ -6,9 +6,18 @@
  * @package ElggNotifications
  */
 
-$user = elgg_get_logged_in_user_entity();
+$current_user = elgg_get_logged_in_user_entity();
+
+$guid = (int) get_input('guid', 0);
+if (!$guid || !($user = get_entity($guid))) {
+       forward();
+}
+if (($user->guid != $current_user->guid) && !$current_user->isAdmin()) {
+       forward();
+}
 
 global $NOTIFICATION_HANDLERS;
+$subscriptions = array();
 foreach($NOTIFICATION_HANDLERS as $method => $foo) {
        $subscriptions[$method] = get_input($method.'subscriptions');
        $personal[$method] = get_input($method.'personal');

diff --git a/mod/notifications/groups.php b/mod/notifications/groups.php
index 45fb94e83bd3e2b18d1e6ae83104b95dd482131f..3e81e474a3b06ce94f3822f30482ad43aca016f6 100644 (file)
--- a/mod/notifications/groups.php
+++ b/mod/notifications/groups.php
@@ -3,16 +3,16 @@
  * Elgg notifications plugin group index
  *
  * @package ElggNotifications
+ *
+ * @uses $user ElggUser
  */
 
-// Load Elgg framework
-require_once(dirname(dirname(dirname(__FILE__))) . '/engine/start.php');
-
-// Ensure only logged-in users can see this page
-gatekeeper();
+if (!isset($user) || !($user instanceof ElggUser)) {
+       $url = 'notifications/group/' . elgg_get_logged_in_user_entity()->username;
+       forward($url);
+}
 
-elgg_set_page_owner_guid(elgg_get_logged_in_user_guid());
-$user = elgg_get_page_owner_entity();
+elgg_set_page_owner_guid($user);
 
 // Set the context to settings
 elgg_set_context('settings');
@@ -27,12 +27,15 @@ $people = array();
 
 $groupmemberships = elgg_get_entities_from_relationship(array(
        'relationship' => 'member',
-       'relationship_guid' => elgg_get_logged_in_user_guid(),
+       'relationship_guid' => $user->guid,
        'types' => 'group',
        'limit' => 9999,
 ));
 
-$body = elgg_view_form('notificationsettings/groupsave', array(), array('groups' => $groupmemberships));
+$body = elgg_view_form('notificationsettings/groupsave', array(), array(
+       'groups' => $groupmemberships,
+       'user' => $user,
+));
 
 $params = array(
        'content' => $body,

diff --git a/mod/notifications/index.php b/mod/notifications/index.php
index 882389fde093e8f923ee1f1b5851e8a81d4bf991..f4143f57b36dbfa7cc2f31c1c670b919357cc995 100644 (file)
--- a/mod/notifications/index.php
+++ b/mod/notifications/index.php
@@ -3,16 +3,16 @@
  * Elgg notifications plugin index
  *
  * @package ElggNotifications
+ *
+ * @uses $user ElggUser
  */
 
-// Load Elgg framework
-require_once(dirname(dirname(dirname(__FILE__))) . '/engine/start.php');
-
-// Ensure only logged-in users can see this page
-gatekeeper();
+if (!isset($user) || !($user instanceof ElggUser)) {
+       $url = 'notifications/personal/' . elgg_get_logged_in_user_entity()->username;
+       forward($url);
+}
 
-elgg_set_page_owner_guid(elgg_get_logged_in_user_guid());
-$user = elgg_get_page_owner_entity();
+elgg_set_page_owner_guid($user);
 
 // Set the context to settings
 elgg_set_context('settings');
@@ -26,7 +26,7 @@ elgg_push_breadcrumb($title);
 $people = array();
 if ($people_ents = elgg_get_entities_from_relationship(array(
                'relationship' => 'notify',
-               'relationship_guid' => elgg_get_logged_in_user_guid(),
+               'relationship_guid' => $user->guid,
                'types' => 'user',
                'limit' => 99999,
        ))) {
@@ -36,7 +36,10 @@ if ($people_ents = elgg_get_entities_from_relationship(array(
        }
 }
 
-$body = elgg_view('notifications/subscriptions/form', array('people' => $people));
+$body = elgg_view('notifications/subscriptions/form', array(
+       'people' => $people,
+       'user' => $user,
+));
 
 $params = array(
        'content' => $body,

diff --git a/mod/notifications/start.php b/mod/notifications/start.php
index 761f17e400b8156a093e0858778e7d8dfba6dcca..d5d418f0f34ede7eba3a8682761e4ca1673f3cf6 100644 (file)
--- a/mod/notifications/start.php
+++ b/mod/notifications/start.php
@@ -40,13 +40,25 @@ function notifications_plugin_init() {
  */
 function notifications_page_handler($page) {
 
+       gatekeeper();
+       $current_user = elgg_get_logged_in_user_entity();
+
        // default to personal notifications
        if (!isset($page[0])) {
                $page[0] = 'personal';
        }
+       if (!isset($page[1])) {
+               forward("notifications/{$page[0]}/{$current_user->username}");
+       }
+
+       $user = get_user_by_username($page[1]);
+       if (($user->guid != $current_user->guid) && !$current_user->isAdmin()) {
+               forward();
+       }
 
        $base = elgg_get_plugins_path() . 'notifications';
 
+       // note: $user passed in
        switch ($page[0]) {
                case 'group':
                        require "$base/groups.php";
@@ -66,12 +78,16 @@ function notifications_page_handler($page) {
  */
 function notifications_plugin_pagesetup() {
        if (elgg_get_context() == "settings" && elgg_get_logged_in_user_guid()) {
-               $user = elgg_get_logged_in_user_entity();
+
+               $user = elgg_get_page_owner_entity();
+               if (!$user) {
+                       $user = elgg_get_logged_in_user_entity();
+               }
 
                $params = array(
                        'name' => '2_a_user_notify',
                        'text' => elgg_echo('notifications:subscriptions:changesettings'),
-                       'href' => "notifications/personal",
+                       'href' => "notifications/personal/{$user->username}",
                );
                elgg_register_menu_item('page', $params);
                
@@ -79,7 +95,7 @@ function notifications_plugin_pagesetup() {
                        $params = array(
                                'name' => '2_group_notify',
                                'text' => elgg_echo('notifications:subscriptions:changesettings:groups'),
-                               'href' => "notifications/group",
+                               'href' => "notifications/group/{$user->username}",
                        );
                        elgg_register_menu_item('page', $params);
                }

diff --git a/mod/notifications/views/default/forms/notificationsettings/groupsave.php b/mod/notifications/views/default/forms/notificationsettings/groupsave.php
index 61b94ff8b950d407f07248be4806b78792146da4..168639ab2e5c0c1e64d85c370ca06491451ca497 100644 (file)
--- a/mod/notifications/views/default/forms/notificationsettings/groupsave.php
+++ b/mod/notifications/views/default/forms/notificationsettings/groupsave.php
@@ -3,13 +3,18 @@
  * Elgg notifications groups subscription form
  *
  * @package ElggNotifications
+ *
+ * @uses $vars['user'] ElggUser
  */
 
+/* @var ElggUser $user */
+$user = $vars['user'];
+
 global $NOTIFICATION_HANDLERS;
 foreach ($NOTIFICATION_HANDLERS as $method => $foo) {
        $subsbig[$method] = elgg_get_entities_from_relationship(array(
                'relationship' => 'notify' . $method,
-               'relationship_guid' => elgg_get_logged_in_user_guid(),
+               'relationship_guid' => $user->guid,
                'types' => 'group',
                'limit' => 99999,
        ));
@@ -97,6 +102,7 @@ END;
 <?php
 }
        echo '<div class="elgg-foot mtm">';
+       echo elgg_view('input/hidden', array('name' => 'guid', 'value' => $user->guid));
        echo elgg_view('input/submit', array('value' => elgg_echo('save')));
        echo '</div>';
        

diff --git a/mod/notifications/views/default/forms/notificationsettings/save.php b/mod/notifications/views/default/forms/notificationsettings/save.php
index ff32d85581470e93e27f69d19638eb45850308b6..9470256ca960a02c9298df85dec507dd147620c3 100644 (file)
--- a/mod/notifications/views/default/forms/notificationsettings/save.php
+++ b/mod/notifications/views/default/forms/notificationsettings/save.php
@@ -1,13 +1,21 @@
 <?php
 /**
  * Personal notifications form body
+ *
+ * @uses $vars['user'] ElggUser
  */
 
-echo elgg_view('notifications/subscriptions/personal');
-echo elgg_view('notifications/subscriptions/collections');
-echo elgg_view('notifications/subscriptions/forminternals');
+/* @var ElggUser $user */
+$user = $vars['user'];
+
+echo elgg_view('notifications/subscriptions/personal', $vars);
+echo elgg_view('notifications/subscriptions/collections', $vars);
+echo elgg_view('notifications/subscriptions/forminternals', $vars);
 
 ?>
 <div class="elgg-foot">
-<?php echo elgg_view('input/submit', array('value' => elgg_echo('save'))); ?>
+<?php
+echo elgg_view('input/hidden', array('name' => 'guid', 'value' => $user->guid));
+echo elgg_view('input/submit', array('value' => elgg_echo('save')));
+?>
 </div>

diff --git a/mod/notifications/views/default/notifications/subscriptions/collections.php b/mod/notifications/views/default/notifications/subscriptions/collections.php
index 28d9fb5b811ec1c7030b1c955ed7a27eba5f2836..b8787570d5862a5e263518f13c5070b18b979a51 100644 (file)
--- a/mod/notifications/views/default/notifications/subscriptions/collections.php
+++ b/mod/notifications/views/default/notifications/subscriptions/collections.php
@@ -1,4 +1,12 @@
-<?php //@todo JS 1.8: no ?>
+<?php
+/**
+ * @uses $vars['user'] ElggUser
+ */
+
+/* @var ElggUser $user */
+$user = $vars['user'];
+
+//@todo JS 1.8: no ?>
 <script type="text/javascript">
        
        function setCollection(members, method, id) {
@@ -42,7 +50,7 @@
        </tr>
 <?php
        $members = array();
-       if ($friends = get_user_friends(elgg_get_logged_in_user_guid(), '', 9999, 0)) {
+       if ($friends = get_user_friends($user->guid, '', 9999, 0)) {
                foreach($friends as $friend) {
                        $members[] = $friend->guid;
                }
@@ -63,7 +71,7 @@
        $i = 0;
        foreach($NOTIFICATION_HANDLERS as $method => $foo) {
                $metaname = 'collections_notifications_preferences_' . $method;
-               if ($collections_preferences = elgg_get_logged_in_user_entity()->$metaname) {
+               if ($collections_preferences = $user->$metaname) {
                        if (!empty($collections_preferences) && !is_array($collections_preferences)) {
                                $collections_preferences = array($collections_preferences);
                        }

diff --git a/mod/notifications/views/default/notifications/subscriptions/form.php b/mod/notifications/views/default/notifications/subscriptions/form.php
index f2f6238f902527a288da0c67811258ac30f8f4b5..8ae27f82922cc73ab0d3999f1762e00affa8ca88 100644 (file)
--- a/mod/notifications/views/default/notifications/subscriptions/form.php
+++ b/mod/notifications/views/default/notifications/subscriptions/form.php
@@ -1,11 +1,16 @@
 <?php
 /**
  * Elgg personal notifications
+ *
+ * @uses $vars['user'] ElggUser
  */
 
        
-echo elgg_view('subscriptions/form/additions',$vars);
+echo elgg_view('subscriptions/form/additions', $vars);
        
 // Display a description
 
-echo elgg_view_form('notificationsettings/save', array('class' => 'elgg-form-alt'));
+echo elgg_view_form('notificationsettings/save', array(
+       'class' => 'elgg-form-alt',
+       'user' => $vars['user']
+));

diff --git a/mod/notifications/views/default/notifications/subscriptions/forminternals.php b/mod/notifications/views/default/notifications/subscriptions/forminternals.php
index e89ce02bec255caf0673ac44c5cfffac2fde0eb7..11f26630359fd67e31281012ec0572a1fedb3d2c 100644 (file)
--- a/mod/notifications/views/default/notifications/subscriptions/forminternals.php
+++ b/mod/notifications/views/default/notifications/subscriptions/forminternals.php
@@ -1,8 +1,13 @@
 <?php
 /**
  * Hacked up friends picker that needs to be replaced
+ *
+ * @uses $vars['user'] ElggUser
  */
 
+/* @var ElggUser $user */
+$user = $vars['user'];
+
 elgg_load_js('elgg.friendspicker');
 elgg_load_js('jquery.easing');
 
@@ -19,11 +24,16 @@ elgg_load_js('jquery.easing');
 <?php
 
 // Get friends and subscriptions
-$friends = get_user_friends(elgg_get_logged_in_user_guid(),'',9999,0);
+$friends = get_user_friends($user->guid, '', 9999, 0);
                
 global $NOTIFICATION_HANDLERS;
 foreach($NOTIFICATION_HANDLERS as $method => $foo) {
-       $subsbig[$method] = elgg_get_entities_from_relationship(array('relationship' => 'notify' . $method, 'relationship_guid' => elgg_get_logged_in_user_guid(), 'types' => 'user', 'limit' => 99999));
+       $subsbig[$method] = elgg_get_entities_from_relationship(array(
+               'relationship' => 'notify' . $method,
+               'relationship_guid' => $user->guid,
+               'types' => 'user',
+               'limit' => 99999,
+       ));
 }
                
 $subs = array();
@@ -88,9 +98,9 @@ if (isset($vars['formtarget'])) {
                
 // Sort users by letter
 if (is_array($friends) && sizeof($friends)) {
-       foreach($friends as $user) {
+       foreach($friends as $friend) {
                                
-               $letter = elgg_substr($user->name,0,1);
+               $letter = elgg_substr($friend->name,0,1);
                $letter = elgg_strtoupper($letter);
                if (!elgg_substr_count($chararray,$letter)) {
                        $letter = "*";
@@ -98,7 +108,7 @@ if (is_array($friends) && sizeof($friends)) {
                if (!isset($users[$letter])) {
                        $users[$letter] = array();
                }
-               $users[$letter][$user->guid] = $user;
+               $users[$letter][$friend->guid] = $friend;
        }
 }
 

diff --git a/mod/notifications/views/default/notifications/subscriptions/personal.php b/mod/notifications/views/default/notifications/subscriptions/personal.php
index 7dac908fcbd44c8f07633702b2e4f5e5dbfd1a87..cf05426e272b54aea1b2b7c8ef6a536c9b9008a6 100644 (file)
--- a/mod/notifications/views/default/notifications/subscriptions/personal.php
+++ b/mod/notifications/views/default/notifications/subscriptions/personal.php
@@ -1,4 +1,10 @@
 <?php
+/**
+ * @uses $vars['user'] ElggUser
+ */
+
+/* @var ElggUser $user */
+$user = $vars['user'];
 
 global $NOTIFICATION_HANDLERS;
 
@@ -40,7 +46,7 @@ foreach($NOTIFICATION_HANDLERS as $method => $foo) {
 $fields = '';
 $i = 0;
 foreach($NOTIFICATION_HANDLERS as $method => $foo) {
-       if ($notification_settings = get_user_notification_settings(elgg_get_logged_in_user_guid())) {
+       if ($notification_settings = get_user_notification_settings($user->guid)) {
                if ($notification_settings->$method) {
                        $personalchecked[$method] = 'checked="checked"';
                } else {