root/releases/0.672/profile/profile.class.php

<?php 
/*
Penny note: none of the queries in this file 
that are get_something_sql or
get_something_select can be converted to use 
prepared statements because they all have $where
that has come from some function somewhere...
*/

Class ElggProfile {

    function ElggProfile ($profile_id) {

        global $data;
        global $page_owner;
        global $PAGE;

        // ELGG profile system initialisation
        // ID of profile to view / edit
        
        if (!empty($profile_id)) {
            $this->id = $profile_id;
        } else {
            $this->id = -1;
        }

        $page_owner = $profile_id;

        // Profile initialisation
        // very strange init sequence from the old main() call follows
        $this->editfield_defaults();
        // $this->actions();     // not from here -- 
        // $this->upload_foaf();

    }

    function edit_link () {


        global $page_owner;
        global $data;
        global $CFG;

        $run_result = '';

        if (run("permissions:check", "profile")) {
        
            $editMsg = __gettext("Click here to edit this profile.");

            $run_result .= <<<END
                
                <p>
                <a href="{$CFG->wwwroot}profile/edit.php?profile_id=$page_owner">$editMsg</a>
                </p>
END;

            $run_result .= run("profile:edit:link");
            
        }
        return $run_result;
    }

    function display_name () {

        global $name_cache;
        global $data;
    
        if (!isset($name_cache[$this->id]) || (time() - $name_cache[$this->id]->created > 60)) {
        
            $name_cache[$this->id]->created = time();
            $name_cache[$this->id]->data = htmlspecialchars(user_info('name',$this->id), ENT_COMPAT, 'utf-8');
        
        }
        $run_result = $name_cache[$this->id]->data;
        return $run_result;
    }

    function display_form () {

        global $page_owner;
        global $data;
        global $CFG;

        $run_result = '';

        $body = "<p>\n" . __gettext("    This screen allows you to edit your profile. Blank fields will not show up on your profile screen in any view; you can change the access level for each piece of information in order to prevent it from falling into the wrong hands. For example, we strongly recommend you keep your address to yourself or a few trusted parties.") . "</p>\n";

        if (run("permissions:check", "profile")) {
    
            $profile_username = user_info('username', $page_owner);
        


            $body .= "<form action=\"".url . "profile/edit.php?profile_id=".$page_owner."\" method=\"post\" enctype=\"multipart/form-data\">";
            $body .= "<p>" . __gettext("You can import some profile data by uploading a FOAF file here:") . "</p>";
            $body .=templates_draw(array(
                                                 'context' => 'databox',
                                                 'name' => __gettext("Upload a FOAF file:"),
                                                 'column1' => "<input name=\"foaf_file\" id=\"foaf_file\" type=\"file\" />",
                                                 'column2' => "<input type=\"submit\" value=\"".__gettext("Upload") . "\" />"
                                                 )
                         );
            $body .= <<<END
        
                <input type="hidden" name="action" value="profile:foaf:upload" />
                <input type="hidden" name="profile_id" value="$page_owner" />
                </form>
        
END;
            $body .= "<p>" .__gettext("Or you can fill in your profile directly below:") . "</p>";
            $body .= "<form action=\"".url . "profile/edit.php?profile_id=".$page_owner."\" method=\"post\">";
    
            // Cycle through all defined profile detail fields and display them
    
            if (!empty($data['profile:details']) && sizeof($data['profile:details']) > 0) {
        
                foreach($data['profile:details'] as $field) {
                    $body .= $this->editfield_display($field);
                }
    
            }
    
            $submitMsg = __gettext("Submit details:");
            $saveProfile = __gettext("Save your profile");
            $body .= <<< END
    
                <p align="center">
                <label>
                $submitMsg
                <input type="submit" name="submit" value="$saveProfile" />
                </label>
                <input type="hidden" name="action" value="profile:edit" />
                <input type="hidden" name="profile_id" value="$page_owner" />
                </p>

                </form>
END;

            $run_result .= $body;
    
        }
        return $run_result;
    }

    function editfield_defaults () {

        global $CFG;
        include($CFG->profilelocation . "profile.config.php");
        return $run_result;
    }

    // the field parameter seems to be an array of unknown structure... 
    function editfield_display ($field) {

        global $page_owner;
        static $usertype;
        
        if (!isset($usertype)) {
            $usertype = user_type($page_owner);
        }
        
        // copy array element with default to ''
        $flabel = !empty($field[0]) ? $field[0] : '';
        $fname  = !empty($field[1]) ? $field[1] : '';
        $ftype  = !empty($field[2]) ? $field[2] : '';
        $fblurb = !empty($field[3]) ? $field[3] : '';
        $fusertype = !empty($field[4]) ? $field[4] : '';
        
        if (!empty($fusertype) && $fusertype != $usertype) {
            return '';
        }

        global $page_owner;
        global $data;
        global $CFG;

        $run_result = '';

        if (empty($flabel) && empty($fname)) {
            return '';
        }
            
        if (!isset($data['profile:preload'][$flabel])) {
            if (!$value = get_record('profile_data','name',$fname,'owner',$page_owner)) {
                $value = "";
                $value->value = "";
                $value->access = $CFG->default_access;
            }
        } else {
            $value = "";
            $value->value = $data['profile:preload'][$fname];
            $value->access = $CFG->default_access;
            
        }
        
        $name = "<label for=\"$fname\"><b>{$flabel}</b>";
        if (!empty($fblurb)) {
            $name .= "<br /><i>" . $fblurb . "</i>";
        }
        $name .= '</label>';
        
        if (empty($ftype)) {
            $ftype = "text";
        }

        $column1 = display_input_field(array("profiledetails[" . $fname . "]",$value->value,$ftype,$fname,@$value->ident,$page_owner));
        $column2 = "<label>". __gettext("Access Restriction:") ."<br />";
        $column2 .= run("display:access_level_select",array("profileaccess[".$fname . "]",$value->access)) . "</label>";
        
        $run_result .=templates_draw(array(
                                           'context' => 'databox',
                                           'name'    => $name,
                                           'column1' => $column1,
                                           'column2' => $column2
                                           )
                                     );
        
        return $run_result;

    }

    function field_display ($field, $allvalues) {

        global $data;

        $run_result = '';

        if (sizeof($field) >= 2) {
    
            // $value = get_record('profile_data','name',$field[1],'owner',$this->id);
        
            foreach($allvalues as $curvalue) {
                if ($curvalue->name == stripslashes($field[1])) {
                    $value = $curvalue;
                    break; // found it, done!
                }
            }

            if (!isset($value)) {
                return '';
            }

            if ((($value->value != "" && $value->value != "blank")) 
                && run("users:access_level_check", $value->access)) {
                $name = $field[0];
                $column1 = display_output_field(array($value->value,$field[2],$field[1],$field[0],$value->ident));
                $run_result .=templates_draw(array(
                                                           'context' => 'databox1',
                                                           'name' => $name,
                                                           'column1' => $column1
                                                           )
                                   );
            }
        }
        return $run_result;
    }

    function search ($tagtype, $tagvalue) {

        global $data, $CFG, $db;
    
        $handle = 0;
        $run_result = '';

        foreach($data['profile:details'] as $profiletype) {
            if ($profiletype[1] == $tagtype && $profiletype[2] == "keywords") {
                $handle = 1;
            }
        }
    
        if ($handle) {
            
            $searchline = "tagtype = " . $db->qstr($tagtype) . " AND tag = " . $db->qstr($tagvalue) . "";
            $searchline = "(" . run("users:access_level_sql_where",$_SESSION['userid']) . ") AND " . $searchline;
            $searchline = str_replace("owner","t.owner",$searchline);
            $tagvalue = stripslashes($tagvalue);
            if ($result = get_record_sql('SELECT DISTINCT u.* FROM '.$CFG->prefix.'tags t 
                                          LEFT JOIN '.$CFG->prefix.'users u ON u.ident = t.owner
                                          WHERE '.$searchline)) {
                $profilesMsg = __gettext("Profiles where");
                $body = <<< END
            
                    <h2>
                    $profilesMsg
END;
                $body .= "'".__gettext($tagtype)."' = '".$tagvalue."':";
                $body .= <<< END
                    </h2>
END;
                $body .= <<< END
                    <table class="userlist">
                    <tr>
END;
                $i = 1;
                foreach($result as $key => $info) {
                    $width = 50;
                    if (sizeof($tagvalue) > 4) {
                        $width = 25;
                    }
                    $friends_username = $info->username;
                    $friends_name = htmlspecialchars(stripslashes($info->name), ENT_COMPAT, 'utf-8');
                    $friends_menu = run("users:infobox:menu",array($info->ident));
                    $body .= <<< END
                        <td align="center">
                        <p>
                        <a href="{$CFG->wwwroot}{$friends_username}/">
                        <img src="{$CFG->wwwroot}_icon/user/{$info->icon}/w/{$width}" alt="{$friends_name}" border="0" /></a><br />
                        <span class="userdetails">
                        {$friends_name}
                    {$friends_menu}
                    </span>
                          </p>
                          </td>
END;
                    if ($i % 5 == 0) {
                        $body .= "</tr><tr>";
                    }
                    $i++;
                }
                $body .= <<< END
                    </tr>
                    </table>
END;
                $run_result .= $body;
            }
        }
        return $run_result;
    }

    function search_all_tagtypes () {

        global $data;

        foreach($data['profile:details'] as $profiletype) {
            if ($profiletype[2] == "keywords") {
                $data['search:tagtypes'][] = $profiletype[1];
            }
        }
        return true;
    }

    function search_all_tagtypes_rss () {

        global $data;

        foreach($data['profile:details'] as $profiletype) {
            if ($profiletype[2] == "keywords") {
                $data['search:tagtypes:rss'][] = $profiletype[1];
            }
        }
        return true;
    }

    function search_ecl ($tagtype, $tagvalue) {

        global $data, $CFG, $db;
    
        $handle = 0;
        $run_result = '';

        foreach($data['profile:details'] as $profiletype) {
            if ($profiletype[1] == $tagtype && $profiletype[2] == "keywords") {
                $handle = 1;
            }
        }
    
        if ($handle) {
            
            $sub_result = "";
            
            $searchline = "tagtype = " . $db->qstr($tagtype) . " AND tag = " . $db->qstr($tagvalue) . "";
            $searchline = "(" . run("users:access_level_sql_where",$_SESSION['userid']) . ") AND " . $searchline;
            $searchline = str_replace("owner", "t.owner", $searchline);
            $tagvalue = stripslashes($tagvalue);
            if ($result = get_record_sql('SELECT DISTINCT u.* FROM '.$CFG->prefix.'tags t
                                          LEFT JOIN '.$CFG->prefix.'users u ON u.ident = t.owner 
                                          WHERE '.$searchline)) {
                foreach($result as $key => $info) {
                    $icon = url . '_icon/user/'.$post->icon;
                    $sub_result .= "\t\t\t<item>\n";
                    $sub_result .= "\t\t\t\t<name><![CDATA[" . htmlspecialchars(stripslashes($info->name), ENT_COMPAT, 'utf-8') . "]]></name>\n";
                    $sub_result .= "\t\t\t\t<link>" . url . htmlspecialchars($info->username, ENT_COMPAT, 'utf-8') . "</link>\n";
                    $sub_result .= "\t\t\t\t<link>$icon</link>\n";
                    $sub_result .= "\t\t\t</item>\n";
                }
            }
            
            if ($sub_result != "") {
                
                $run_result .= "\t\t<profiles tagtype=\"".addslashes(htmlspecialchars($tagtype, ENT_COMPAT, 'utf-8'))."\">\n" . $sub_result . "\t\t</profiles>\n";
                
            }
            
        }
        return $run_result;
    }

    function search_rss ($tagtype, $tagvalue) {

        global $data, $CFG, $db;
    
        $handle = 0;
        $run_result = '';

        foreach($data['profile:details'] as $profiletype) {
            if ($profiletype[1] == $tagtype && $profiletype[2] == "keywords") {
                $handle = 1;
            }
        }
    
        if ($handle) {
            
            $searchline = "tagtype = " . $db->qstr($tagtype) . " AND tag = " . $db->qstr($tagvalue) . "";
            $searchline = "(" . run("users:access_level_sql_where",$_SESSION['userid']) . ") AND " . $searchline;
            $searchline = str_replace("owner", "t.owner", $searchline);
            $tagvalue = stripslashes($tagvalue);
            if ($result = get_records_sql('SELECT DISTINCT u.* FROM '.$CFG->prefix.'tags t
                                          LEFT JOIN '.$CFG->prefix.'users u ON u.ident = t.owner 
                                          WHERE '.$searchline)) {
                foreach($result as $key => $info) {
                    $run_result .= "\t<item>\n";
                    $run_result .= "\t\t<title><![CDATA['" . htmlspecialchars($tagtype, ENT_COMPAT, 'utf-8') . "' = " . htmlspecialchars($tagvalue, ENT_COMPAT, 'utf-8') . " :: " . htmlspecialchars(stripslashes($info->name), ENT_COMPAT, 'utf-8') . "]]></title>\n";
                    $run_result .= "\t\t<link>" . url . htmlspecialchars($info->username, ENT_COMPAT, 'utf-8') . "</link>\n";
                    $run_result .= "\t</item>\n";
                }
            }
        }
        return $run_result;
    }

    function upload_foaf () {

        global $data,$CFG;
        
        $action = optional_param('action');
        if (!empty($action) && $action == "profile:foaf:upload" && logged_on && run("permissions:check", "profile")) {
            require_once($CFG->dirroot.'lib/uploadlib.php');
            $um = new upload_manager('foaf_file',false,true,0,true);
            $dir = $CFG->dataroot . 'tmp/foaf/';
            if (!$um->process_file_uploads($dir)) {
                $messages[] = __gettext("There was an error uploading the file. Possibly the file was too large, or the upload was interrupted.");
                $messages[] = $um->get_errors();
                return false;
            }
            $file = $um->get_new_filepath();
            $foaf = @GetXMLTreeProfile($file);
            
            $data['profile:preload'] = array();
            
            if (isset($foaf['RDF:RDF'][0]['PERSON'][0]) && !isset($foaf['RDF:RDF'][0]['FOAF:PERSON'][0])) {
                $foaf['RDF:RDF'][0]['FOAF:PERSON'][0] = $foaf['RDF:RDF'][0]['PERSON'][0];
            }
            
            if (isset($foaf['RDF:RDF'][0]['FOAF:PERSON'][0])) {
                
                $foaf = $foaf['RDF:RDF'][0]['FOAF:PERSON'][0];
                
                if (!empty($data['foaf:profile']) && sizeof