Changeset 1392

Timestamp:

12/06/07 15:33:46 (1 year ago)

Author:

rho

Message:

Path #173 and integrated request confirmation instead javascript confirmation

Signed-off: Rolando Espinoza La fuente <rho@prosoftpeople.com>

Files:

• devel/lib/elgglib.php (modified) (1 diff)
• devel/mod/blog/lib/weblogs_actions.php (modified) (2 diffs)
• devel/mod/blog/lib/weblogs_posts_view.php (modified) (2 diffs)
• devel/mod/community/lib/communities_actions.php (modified) (2 diffs)
• devel/mod/community/lib/communities_moderator_of.php (modified) (1 diff)
• devel/mod/community/lib/user_info_menu.php (modified) (1 diff)
• devel/mod/file/file_include_wizard.php (modified) (3 diffs)
• devel/mod/file/lib.php (modified) (4 diffs)
• devel/mod/file/lib/files_actions.php (modified) (3 diffs)
• devel/mod/friend/lib/user_info_menu_text.php (modified) (1 diff)
• devel/mod/generic_comments/comments_actions.php (modified) (1 diff)
• devel/mod/generic_comments/lib.php (modified) (1 diff)
• devel/mod/users/lib/userdetails_actions.php (modified) (1 diff)
• devel/mod/users/lib/userdetails_edit.php (modified) (1 diff)

devel/lib/elgglib.php

@@ -3534 +3534 @@
-}
-
+/**
+ * Request confirmation to perform some action
+ *
+ * @param string $message Message to show on request
+ * @param mixed $vars array of parameters to re-send needed to continue action
+ * @return bool true if sucessful confirmed
+ */
+function require_confirm($message, $vars=null) {
+    global $CFG;
+
+    $form_key = optional_param('form_key');
+
+    // check if pass key verification
+    if (elggform_key_check($form_key, 'confirm')) {
+        // pass form key verification
+        return true;
+    }
+    else {
+        // build form key and show form
+        $form_key = elggform_key_get('confirm');
+        $title = __gettext('Please confirm your action');
+
+        $sContinue = __gettext('Continue');
+        $sBack = __gettext('Back');
+
+        // add form key
+        $vars['form_key'] = $form_key;
+
+        // add parameters
+        $inputs = '';
+        foreach ($vars as $name => $value) {
+            $value = htmlspecialchars($value, ENT_COMPAT, 'utf-8'); // prevent messing code
+            $inputs .= "<input type=\"hidden\" id=\"{$name}\" name=\"{$name}\" value=\"{$value}\" />\n";
+        }
+
+        // add buttons
+        //$inputs .= "<input type=\"button\" value=\"{$sBack}\" onclick=\"history.back()\" />\n";
+        $inputs .= "<a href=\"#\" onclick=\"history.back(); return false;\">{$sBack}</a> or ";
+        $inputs .= "<input type=\"submit\" name=\"submit\" value=\"{$sContinue}\" />\n";
+
+        $body = "<div id=\"confirm-form\">\n";
+        $body .= "<form name=\"confirm-form\" action=\"\" method=\"post\">\n";
+        $body .= templates_draw(array(
+            'context' => 'databox',
+            'name' => $message,
+            'column1' => $inputs,
+            ));
+
+        $body .= "</form>\n";
+        $body .= "</div>\n";
+
+        // show form
+        templates_page_output($title, $body);
+    }
+
+    return false;
+}
+
+/**
+ * Generate a secret key to use in forms
+ *
+ * @param string $form_name form name identificator
+ * @return string generated key
+ */
+function elggform_key_get($form_name) {
+    //build secret key
+    $form_key = md5($_SESSION['userid'] . time());
+    //store secret in session
+    $_SESSION['form'][$form_name] = array('key' => $form_key, 'timestamp' => time());
+    // return key
+    return $form_key;
+}
+
+/**
+ * Check form secret key
+ *
+ * @param string $form_key key to check
+ * @param string $form_name form name identificator
+ * @return bool true if key matchs
+ */
+function elggform_key_check($form_key, $form_name) {
+    // clear old keys based on timestamp, delta 1 day
+    if (isset($_SESSION['form'][$form_name]['timestamp'])
+        && $_SESSION['form'][$form_name]['timestamp'] < time() - 86400) {
+        unset($_SESSION['form'][$form_name]);
+    }
+
+    // check if pass key verification
+    if (!empty($form_key)
+        && !empty($_SESSION['form'][$form_name]['key'])
+        && $form_key == $_SESSION['form'][$form_name]['key']) {
+        // pass form key verification
+        $result = true;
+    } else {
+        $result = false;        
+    }
+
+    // clear anyway
+    unset($_SESSION['form'][$form_name]);
+    return $result;
+}
+
-function get_string($s) {
-    return __gettext($s);

devel/mod/blog/lib/weblogs_actions.php

@@ -132 +132 @@
-    case "delete_weblog_post":
-        $id = optional_param('delete_post_id',0,PARAM_INT);
+        require_confirm(__gettext('Are you sure you want to permanently delete this weblog post?'));
+
-        if (logged_on && !empty($id)) {
-            if ($post_info = get_record('weblog_posts','ident',$id)) {
@@ -225 +227 @@
-    case "weblog_comment_delete":
-        $comment_id = optional_param('weblog_comment_delete',0,PARAM_INT);
+        require_confirm(__gettext('Are you sure you want to permanently delete this weblog comment?'));
+
-        if (logged_on && !empty($comment_id)) {
-            $commentinfo = get_record_sql('SELECT wc.*,wp.owner AS postowner,wp.ident AS postid

devel/mod/blog/lib/weblogs_posts_view.php

@@ -127 +127 @@
-    if (run("permissions:check",array("weblog:edit",$post->owner))) {
-        $Edit = __gettext("Edit");
-        $returnConfirm = __gettext("Are you sure you want to permanently delete this weblog post?");
-        $Delete = __gettext("Delete");
-        $links = <<< END
-                    | <a href="{$CFG->wwwroot}{$username}/$extensionContext/edit/{$post->ident}">$Edit</a> |
- onclick="return confirm('$returnConfirm')"
+
-END;
-    } else {
@@ -184 +183 @@
-                    $commentmenu = "";
-                    if (logged_on && ($comment->owner == $_SESSION['userid'] || run("permissions:check",array("weblog:edit",$post->owner)))) {
-                        $returnConfirm = __gettext("Are you sure you want to permanently delete this weblog comment?");
-                        $Delete = __gettext("Delete");
-                        $commentmenu = <<< END
- onclick="return confirm('$returnConfirm')"
+
-END;
-                    }

devel/mod/community/lib/communities_actions.php

@@ -67 +67 @@
-        case "community:delete":
-            $community_id = optional_param('community_id',0,PARAM_INT);
+            $community_name = htmlspecialchars(user_name($community_id), ENT_COMPAT, 'utf-8');
+            require_confirm(__gettext('Are you sure you want to delete this community?'));
+
-            if (run("permissions:check",array("userdetails:change", $community_id))) {
-                if (user_delete($community_id)) {
@@ -74 +77 @@
-                    $messages[] = __gettext("Error: the community could not be deleted.");
-                }
-
-
-
+
-            }
-        break;

devel/mod/community/lib/communities_moderator_of.php

@@ -19 +19 @@
-            $friends_menu = run("community:infobox:menu",array($info));
-            if (run("permissions:check",array("userdetails:change", $info->ident))) {
- onClick=\"return confirm('".__gettext('Are you sure you want to delete this community?')."');\"
+
-            }
-            $friends_icon = user_icon_html($info->ident,COMMUNITY_ICON_SIZE);

devel/mod/community/lib/user_info_menu.php

@@ -20 +20 @@
-  if ($info->owner == $_SESSION['userid'] && $info->owner == $profile_id) {
-    $functions[] = "<a href=\"" . $CFG->wwwroot . $info->username . "/profile\">" . __gettext("Administrate") . "</a>";
-
-
+
-    if ($profile_id != $_SESSION['userid']) {
-      $msg = "onclick=\"return confirm('" . addslashes(__gettext("Are you sure you want to separate this user from the community?")) . "')\"";

devel/mod/file/file_include_wizard.php

@@ -45 +45 @@
-     }
- }
+ $directories = '';
- $keys = array_keys($folders);
- for($i=0;$i<count($keys);$i++){
@@ -71 +72 @@
-
- if(!empty($user_files)){
-.
+
-   foreach($user_files as $file){
-     $file_name = (!empty($file->title))?$file->title:$file->originalname;
@@ -77 +78 @@
-     $type=(array_key_exists($extension,get_mimetype_array()))?" $extension":"";
-     if(ALLOW_WIZARD_FILE_DELETE){
+        //FIXME: set form key to pass require_confirm
+        $form_key = elggform_key_get('confirm');
+
-       $redirect_url = "{$CFG->wwwroot}mod/file/file_include_wizard.php?owner={$owner}&folder={$folder_id}";
-       $delete_msg = __gettext("Are you sure you want to permanently delete this file?");
-       $delete="&nbsp;&nbsp;";
-
+&amp;form_key=$form_key
-       $delete.="<img src=\"{$CFG->wwwroot}mod/file/fileicons/del.png\" border=\"0\"></a>";
-     }

devel/mod/file/lib.php

@@ -10 +10 @@
-    global $metatags;
-    
-    require_once (dirname(__FILE__)."/default_templates.php");
-    require_once (dirname(__FILE__)."/lib/file_config.php");
-    $page_owner = $profile_id;
@@ -65 +64 @@
-        $function['files:init'][] = $CFG->dirroot . "mod/file/lib/metadata_defaults.php";
-        $function['files:init'][] = $CFG->dirroot . "mod/file/lib/inline_mimetypes.php";
+        $function['init'][] = $CFG->dirroot . "mod/file/default_templates.php";
-    
-    // Mime-type init
@@ -494 +494 @@
-        $filemenu = "";
-        if (permissions_check("files:edit", $file->owner)  || permissions_check("files:edit", $file->files_owner)) {
-                        $areyouSure = __gettext("Are you sure you want to permanently delete this file?"); // gettext variable
-                        $delete = __gettext("Delete"); // gettext variable
-                        $edit = __gettext("Edit"); // gettext variable
-                        $filemenu .= <<< END
-            [<a href="{$CFG->wwwroot}mod/file/edit_file.php?edit_file_id={$file->ident}&amp;owner=$page_owner">$edit</a>]
- onclick="return confirm('$areyouSure')"
+
-END;
-        }
@@ -512 +511 @@
-                
-        if (permissions_check("files:edit", $folder->owner)  || permissions_check("files:edit", $folder->files_owner)) {
-            $areyouSure = __gettext("Are you sure you want to permanently delete this folder?"); // gettext variable
-            $delete = __gettext("Delete"); // gettext variable
-            $edit = __gettext("Edit"); // gettext variable
-            $foldermenu = <<< END
-            [<a href="{$CFG->wwwroot}mod/file/edit_folder.php?edit_folder_id={$folder->ident}&amp;owner=$page_owner&amp;return_type=parent">$edit</a>]
- onclick="return confirm('$areyouSure')"
+
-END;
-        }

devel/mod/file/lib/files_actions.php

@@ -175 +175 @@
-                            }
-                        }
-
-
-
+
-                    }
-                } else {
@@ -189 +187 @@
-    case "delete_folder":
-        $id = optional_param('delete_folder_id',0,PARAM_INT);
+        require_confirm(__gettext('Are you sure you want to permanently delete this folder?'));
+
-        if (!empty($id) && $id != -1) {
-            $folder = get_record('file_folders','ident',$id);
@@ -214 +214 @@
-    case "delete_file":
-        $id = optional_param('delete_file_id',0,PARAM_INT);
+        require_confirm(__gettext('Are you sure you want to permanently delete this file?'));
+
-        if (!empty($id) && $id != -1) {
-            $file = get_record('files','ident',$id);

devel/mod/friend/lib/user_info_menu_text.php

@@ -17 +17 @@
-            case 'no':
-            case 'yes':
- onclick=\"return confirm(
+
-                break;
-            case 'priv':

devel/mod/generic_comments/comments_actions.php

@@ -104 +104 @@
-            case "comment:delete":
-                $comment_id = optional_param('comment_delete',0,PARAM_INT);
+            require_confirm(__gettext('Are you sure you want to permanently delete this comment?'));
+
-                if (logged_on && !empty($comment_id)) {
-                    $comment = get_record('comments','ident',$comment_id);

devel/mod/generic_comments/lib.php

@@ -230 +230 @@
-                    $commentmenu = "";
-                    if (isloggedin() && ($comment->owner == $_SESSION['userid'] || run("permissions:check",array("comment:delete",$_SESSION['userid'],$comment->object_id,$comment->object_type)))) {
-                        $returnConfirm = __gettext("Are you sure you want to permanently delete this comment?");
-                        $Delete = __gettext("Delete");
-                        $commentmenu = <<< END
- onclick="return confirm('$returnConfirm')"
+
-END;
-                    }

devel/mod/users/lib/userdetails_actions.php

@@ -19 +19 @@
-    // Update user details
-    case "user:delete":
+            require_confirm(__gettext('Are you sure you want to delete this account?'), array('profile_id' => $page_owner, 'action' => 'user:delete'));
+
-            if (user_delete($page_owner)) {
-                if ($_SESSION['userid'] == $page_owner) {

devel/mod/users/lib/userdetails_edit.php

@@ -206 +206 @@
-        $blurb = __gettext("Deleting this account is permanent and absolutely cannot be undone. Only click this button if you're really sure!");
-        $deleteaccount = __gettext("Delete account");
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
-    }
-