root/devel/profile/profile.class.php

<?php 
/*
Penny note: none of the queries in this file 
that are get_something_sql or
get_something_select can be converted to use 
prepared statements because they all have $where
that has come from some function somewhere...
*/

Class ElggProfile {

    function ElggProfile ($profile_id) {

        global $data;
        global $page_owner;
        global $PAGE;

        // ELGG profile system initialisation
        // ID of profile to view / edit
        
        if (!empty($profile_id)) {
            $this->id = $profile_id;
        } else {
            $this->id = -1;
        }

        $page_owner = $profile_id;

        // Profile initialisation
        // very strange init sequence from the old main() call follows
        $this->editfield_defaults();
        // $this->actions();     // not from here -- 
        // $this->upload_foaf();

    }

    function edit_link () {


        global $page_owner;
        global $data;
        global $CFG;

        $run_result = '';

        if (run("permissions:check", "profile")) {
        
            $editMsg = __gettext("Click here to edit this profile.");

            $run_result .= <<<END
                
                <p>
                <a href="{$CFG->wwwroot}profile/edit.php?profile_id=$page_owner">$editMsg</a>
                </p>
END;

            $run_result .= run("profile:edit:link");
            
        }
        return $run_result;
    }
    
    function display_name () {
        
        global $name_cache;
        global $data;
        
        if (!isset($name_cache[$this->id]) || (time() - $name_cache[$this->id]->created > 60)) {
        
            $name_cache[$this->id]->created = time();
            $name_cache[$this->id]->data = htmlspecialchars(user_info('name',$this->id), ENT_COMPAT, 'utf-8');
        
        }
        $run_result = $name_cache[$this->id]->data;
        return $run_result;
    }
    
    function display_form () {
        
        global $page_owner;
        global $data;
        global $CFG;
        
        $run_result = '';
        
        $body = "<p>\n" . __gettext("    This screen allows you to edit your profile. Blank fields will not show up on your profile screen in any view; you can change the access level for each piece of information in order to prevent it from falling into the wrong hands. For example, we strongly recommend you keep your address to yourself or a few trusted parties.") . "</p>\n";
        
        if (run("permissions:check", "profile")) {
            
            $profile_username = user_info('username', $page_owner);
            
            $body .= "<form action=\"".url . "profile/edit.php?profile_id=".$page_owner."\" method=\"post\" enctype=\"multipart/form-data\">";
            $body .= "<div class=\"tabber\">";
            
            // Cycle through all defined profile detail fields and display them
            
            $profilecat = array( );
            
            if (!empty($data['profile:details']) && sizeof($data['profile:details']) > 0) {
                
                foreach($data['profile:details'] as $field) {
                    
                    if (is_array($field)) {
                        $flabel = !empty($field[0]) ? $field[0] : '';
                        $fname  = !empty($field[1]) ? $field[1] : '';
                        $ftype  = !empty($field[2]) ? $field[2] : '';
                        $fblurb = !empty($field[3]) ? $field[3] : '';
                        $fusertype = !empty($field[4]) ? $field[4] : '';
                        $finvisible = false;
                        $frequired = false;
                        $fcat = __gettext("Main");
                    // Otherwise map things the new way!
                    } else {
                        $flabel = $field->name;
                        $fname = $field->internal_name;
                        $ftype = $field->field_type;
                        $fblurb = $field->description;
                        $fusertype = $field->user_type;
                        $finvisible = $field->invisible;
                        $frequired = $field->required;
                        if (!empty($field->category)) {
                            $fcat = $field->category;
                        } else {
                            $fcat = __gettext("Main");
                        }
                    }
                    
                    if (!isset($profilecat[$fcat])) {
                        $profilecat[$fcat] = '';
                    }
                    $profilecat[$fcat] .= $this->editfield_display($field);
                }
                if (sizeof($profilecat) > 0) {
                    foreach($profilecat as $cat => $html) {
                        
                        if ($html) {
                            $body .= "<div class=\"tabbertab\" title=\"$cat\">";
                            $body .= $html;
                            $body .= "</div>";
                        }
                    }
                }
            }
            
            $submitMsg = __gettext("Submit details:");
            $saveProfile = __gettext("Save your profile");
            $body .= <<< END
                
                </div>
                
                <p align="center">
                <label>
                $submitMsg
                <input type="submit" name="submit" value="$saveProfile" />
                </label>
                <input type="hidden" name="action" value="profile:edit" />
                <input type="hidden" name="profile_id" value="$page_owner" />
                </p>

                </form>
END;

            $body .= "<p>&nbsp;</p><form action=\"".url . "profile/edit.php?profile_id=".$page_owner."\" method=\"post\" enctype=\"multipart/form-data\">";
            $body .= "<p>" . __gettext("You can import some profile data by uploading a FOAF file here:") . "</p>";
            $body .=templates_draw(array(
                                                 'context' => 'databox',
                                                 'name' => __gettext("Upload a FOAF file:"),
                                                 'column1' => "<input name=\"foaf_file\" id=\"foaf_file\" type=\"file\" />",
                                                 'column2' => "<input type=\"submit\" value=\"".__gettext("Upload") . "\" />"
                                                 )
                         );
            $body .= <<<END
        
                <input type="hidden" name="action" value="profile:foaf:upload" />
                <input type="hidden" name="profile_id" value="$page_owner" />
                </form>
        
END;

            $run_result .= $body;
    
        }
        return $run_result;
    }

    function editfield_defaults () {

        global $CFG;
        include($CFG->profilelocation . "profile.config.php");
        return $run_result;
    }

    // the field parameter seems to be an array of unknown structure... 
    function editfield_display ($field) {

        global $page_owner;
        static $usertype;
        
        if (!isset($usertype)) {
            $usertype = user_type($page_owner);
        }
        
        // copy array element with default to ''
        
        // If we're dealing with the old-style profile fields
        if (is_array($field)) {
            $flabel = !empty($field[0]) ? $field[0] : '';
            $fname  = !empty($field[1]) ? $field[1] : '';
            $ftype  = !empty($field[2]) ? $field[2] : '';
            $fblurb = !empty($field[3]) ? $field[3] : '';
            $fusertype = !empty($field[4]) ? $field[4] : '';
            $finvisible = false;
            $frequired = false;
        // Otherwise map things the new way!
        } else {
            $flabel = $field->name;
            $fname = $field->internal_name;
            $ftype = $field->field_type;
            $fblurb = $field->description;
            $fusertype = $field->user_type;
            $finvisible = $field->invisible;
            $frequired = $field->required;
        }
        
        if (!empty($fusertype) && $fusertype != $usertype) {
            return '';
        }

        global $page_owner;
        global $data;
        global $CFG;

        $run_result = '';

        if (empty($flabel) && empty($fname)) {
            return '';
        }
            
        if (!isset($data['profile:preload'][$fname])) {
            if (!$value = get_record('profile_data','name',$fname,'owner',$page_owner)) {
                $value = "";
                $value->value = "";
        if(isset($field->default_access)) { // default access can be set on a per profile field basis
          $value->access = $field->default_access;
        } else {
          $value->access = $CFG->default_access;
        }
        }
        } else {
            $value = "";
            $value->value = $data['profile:preload'][$fname];
            if (!isset($data['profile:preload:access'][$fname])) {
          if(isset($field->default_access)) {
        $value->access = $field->default_access;
          } else {
        $value->access = $CFG->default_access;
          }
            } else {
          $value->access = $data['profile:preload:access'][$fname];
            }
            
        }
        if ($finvisible) {
            $value->access = "PRIVATE";
        }
        
        $name = "<label for=\"$fname\"><b>{$flabel}</b>";
        if (!empty($fblurb)) {
            $name .= "<br /><i>" . $fblurb . "</i>";
        }
        $name .= '</label>';
        
        if (empty($ftype)) {
            $ftype = "text";
        }

        $column1 = display_input_field(array("profiledetails[" . $fname . "]",$value->value,$ftype,$fname,@$value->ident,$page_owner));
        if(!$finvisible) {
      $column2 = "<label>". __gettext("Access Restriction:") ."<br />";
      $column2 .= run("display:access_level_select",array("profileaccess[".$fname . "]",$value->access)) . "</label>";
        } else {
      $column2 = __gettext("Invisible field");
    }

        $run_result .=templates_draw(array(
                                           'context' => 'databox',
                                           'name'    => $name,
                                           'column1' => $column1,
                                           'column2' => $column2
                                           )
                                     );
        
        return $run_result;

    }

    function field_display ($field, $allvalues) {

        global $data;

        $run_result = '';
        
        // If we're dealing with the old-style profile fields
        if (is_array($field)) {
            $flabel = !empty($field[0]) ? $field[0] : '';
            $fname  = !empty($field[1]) ? $field[1] : '';
            $ftype  = !empty($field[2]) ? $field[2] : '';
            $fblurb = !empty($field[3]) ? $field[3] : '';
            $fusertype = !empty($field[4]) ? $field[4] : '';
        // Otherwise map things the new way!
        } else {
            $flabel = $field->name;
            $fname = $field->internal_name;
            $ftype = $field->field_type;
            $fblurb = $field->description;
            $fusertype = $field->user_type;
            $finvisible = $field->invisible;
            $frequired = $field->required;
        }

        //if (sizeof($field) >= 2) {
    
            // $value = get_record('profile_data','name',$field[1],'owner',$this->id);
            if (is_array($allvalues) && !empty($allvalues)) {
                foreach($allvalues as $curvalue) {
                    if ($curvalue->name == stripslashes($fname)) {
                        $value = $curvalue;
                        break; // found it, done!
                    }
                }
            }

            if (!isset($value)) {
                return '';
            }

            if ((($value->value != "" && $value->value != "blank" && !$finvisible)) 
                && run("users:access_level_check", $value->access)) {
                $name = $flabel;
                $column1 = display_output_field(array($value->value,$ftype,$fname,$flabel,$value->ident));
                $run_result .=templates_draw(array(
                                                           'context' => 'databox1',
                                                           'name' => $name,
                                                           'column1' => $column1
                                                           )
                                   );
            }
        // }
        return $run_result;
    }

    function search ($tagtype, $tagvalue) {

        global $data, $CFG, $db;
    
        $handle = 0;
        $run_result = '';

        foreach($data['profile:details'] as $profiletype) {
            if ($profiletype[1] == $tagtype && $profiletype[2] == "keywords") {
                $handle = 1;
            }
        }
    
        if ($handle) {
            
            $searchline = "tagtype = " . $db->qstr($tagtype) . " AND tag = " . $db->qstr($tagvalue) . "";
            $searchline = "(" . run("users:access_level_sql_where",$_SESSION['userid']) . ") AND " . $searchline;
            $searchline = str_replace("owner","t.owner",$searchline);
            $tagvalue = stripslashes($tagvalue);
            if ($result = get_record_sql('SELECT DISTINCT u.* FROM '.$CFG->prefix.'tags t 
                                          LEFT JOIN '.$CFG->prefix.'users u ON u.ident = t.owner
                                          WHERE '.$searchline)) {
                $profilesMsg = __gettext("Profiles where");
                $body = <<< END
            
                    <h2>
                    $profilesMsg
END;
                $body .= "'".__gettext($tagtype)."' = '".$tagvalue."':";
                $body .= <<< END
                    </h2>
END;
                $body .= <<< END
                    <table class="userlist">
                    <tr>
END;
                $i = 1;
                foreach($result as $key => $info) {
                    $width = 50;
                    if (sizeof($tagvalue) > 4) {
                        $width = 25;
                    }
                    $friends_username = $info->username;
                    $friends_name = htmlspecialchars(stripslashes($info->name), ENT_COMPAT, 'utf-8');
                    $friends_menu = run("users:infobox:menu",array($info->ident));
                    $body .= <<< END
                        <td align="center">
                        <p>
                        <a href="{$CFG->wwwroot}{$friends_username}/">
                        <img src="{$CFG->wwwroot}_icon/user/{$info->icon}/w/{$width}" alt="{$friends_name}" border="0" /></a><br />
                        <span class="userdetails">
                        {$friends_name}
                    {$friends_menu}
                    </span>
                          </p>
                          </td>
END;
                    if ($i % 5 == 0) {
                        $body .= "</tr><tr>";
                    }
                    $i++;
                }
                $body .= <<< END
                    </tr>
                    </table>
END;
                $run_result .= $body;
            }
        }
        return $run_result;
    }

    function search_all_tagtypes () {

        global $data;

        foreach($data['profile:details'] as $profiletype) {
            if ($profiletype[2] == "keywords") {
                $data['search:tagtypes'][] = $profiletype[1];
            }
        }
        return true;
    }

    function search_all_tagtypes_rss () {

        global $data;

        foreach($data['profile:details'] as $profiletype) {
            if ($profiletype[2] == "keywords") {
                $data['search:tagtypes:rss'][] = $profiletype[1];
            }
        }
        return true;
    }

    function search_ecl ($tagtype, $tagvalue) {

        global $data, $CFG, $db;
    
        $handle = 0;
        $run_result = '';

        foreach($data['profile:details'] as $profiletype) {
            if ($profiletype[1] == $tagtype && $profiletype[2] == "keywords") {
                $handle = 1;
            }
        }
    
        if ($handle) {
            
            $sub_result = "";
            
            $searchline = "tagtype = " . $db->qstr($tagtype) . " AND tag = " . $db->qstr($tagvalue) . "";
            $searchline = "(" . run("users:access_level_sql_where",$_SESSION['userid']) . ") AND " . $searchline;
            $searchline = str_replace("owner", "t.owner", $searchline);
            $tagvalue = stri