Khaganat-NeL/khanat-opennel-code
2
0
Fork 0
Code Issues 21 Pull requests Projects Releases 1 Packages Wiki Activity

Added functionality to update country + gender + added some xss security

Browse source
This commit is contained in:
Quitta 2013-07-05 00:37:48 +02:00
parent f3a1410562
commit aae614dd45
4 changed files with 65 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
code/ryzom/tools/server/ryzom_ams/www/html/func/change_info.php
View file

@ -3,7 +3,7 @@
function change_info(){
try{
//if logged in
//if logged in
if(WebUsers::isLoggedIn()){
if(isset($_POST['target_id'])){
@ -19,17 +19,24 @@ function change_info(){
$webUser = new WebUsers();
//use current info to check for changes
$current_info = $webUser->getInfo($_POST['target_id']);
//TODO: XSS filtering
//make the query that will update the data.
//TODO: XSS filtering
$current_info['FirstName'] = filter_var($current_info['FirstName'], FILTER_SANITIZE_STRING);
$current_info['LastName'] = filter_var($current_info['LastName'], FILTER_SANITIZE_STRING);
$current_info['Country'] = filter_var($current_info['Country'], FILTER_SANITIZE_STRING);
$current_info['Gender'] = filter_var($current_info['Gender'], FILTER_SANITIZE_NUMBER_INT);
$updated = false;
$values = Array();
$values['user'] = $target_username;
//make the query that will update the data.
$query = "UPDATE ams_user SET ";
if(($_POST['FirstName'] != "") && ($_POST['FirstName'] != $current_info['FirstName'])){
$query = $query . "FirstName = :fName ";
$updated = true;
$values['fName'] = $_POST['FirstName'];
$values['fName'] = filter_var($_POST['FirstName'], FILTER_SANITIZE_STRING);
}
if(($_POST['LastName'] != "") && ($_POST['LastName'] != $current_info['LastName'])){
if($updated){
@ -38,9 +45,27 @@ function change_info(){
$query = $query . "LastName = :lName ";
}
$updated = true;
$values['lName'] = $_POST['LastName'];
$values['lName'] = filter_var($_POST['LastName'], FILTER_SANITIZE_STRING);
}
//TODO: add the other fields too
if(($_POST['Country'] != "AA") && ($_POST['Country'] != $current_info['Country'])){
if($updated){
$query = $query . ", Country = :country ";
}else{
$query = $query . "Country = :country ";
}
$updated = true;
$values['country'] = filter_var($_POST['Country'], FILTER_SANITIZE_STRING);
}
if($_POST['Gender'] != $current_info['Gender']){
if($updated){
$query = $query . ", Gender = :gender ";
}else{
$query = $query . "Gender = :gender ";
}
$updated = true;
$values['gender'] = filter_var($_POST['Gender'], FILTER_SANITIZE_NUMBER_INT);
}
//finish the query!
$query = $query . "WHERE Login = :user";
//if some field is update then:
@ -61,24 +86,25 @@ function change_info(){
$result['username'] = $_SESSION['user'];
$result['no_visible_elements'] = 'FALSE';
$result['target_id'] = $_POST['target_id'];
if(isset($_GET['id'])){
if(WebUsers::isAdmin() && ($_POST['target_id'] != $_SESSION['id'])){
$result['isAdmin'] = "TRUE";
}
}
helpers :: loadtemplate( 'settings', $result);
exit;
}else{
//ERROR: permission denied!
$_SESSION['error_code'] = "403";
header("Location: index.php?page=error");
exit;
}
}else{
//ERROR: The form was not filled in correclty
header("Location: index.php?page=settings");
exit;
}
}else{
//ERROR: user is not logged in
exit;
header("Location: index.php");
exit;
}
}catch (PDOException $e) {

12
code/ryzom/tools/server/ryzom_ams/www/html/func/change_mail.php
View file

@ -28,10 +28,10 @@ function change_mail(){
}else{
$result['EMAIL_ERROR'] = 'FALSE';
}
$result['prevNewEmail'] = $_POST["NewEmail"];
$result['prevNewEmail'] = filter_var($_POST["NewEmail"], FILTER_SANITIZE_EMAIL);
if ($reply== "success"){
$status = WebUsers::setEmail($target_username, $_POST["NewEmail"] );
$status = WebUsers::setEmail($target_username, filter_var($_POST["NewEmail"], FILTER_SANITIZE_EMAIL) );
if($status == 'ok'){
$result['SUCCESS_MAIL'] = "OK";
}else if($status == 'shardoffline'){
@ -66,14 +66,20 @@ function change_mail(){
}else{
//ERROR: permission denied!
$_SESSION['error_code'] = "403";
header("Location: index.php?page=error");
exit;
}
}else{
//ERROR: The form was not filled in correclty
header("Location: index.php?page=settings");
exit;
}
}else{
//ERROR: user is not logged in
exit;
header("Location: index.php");
exit;
}
}catch (PDOException $e) {

16
code/ryzom/tools/server/ryzom_ams/www/html/func/change_password.php
View file

@ -42,12 +42,12 @@ function change_password(){
exit;
}else{
$result['prevCurrentPass'] = $_POST["CurrentPass"];
$result['prevNewPass'] = $_POST["NewPass"];
$result['prevConfirmNewPass'] = $_POST["ConfirmNewPass"];
$result['prevCurrentPass'] = filter_var($_POST["CurrentPass"], FILTER_SANITIZE_STRING);
$result['prevNewPass'] = filter_var($_POST["NewPass"], FILTER_SANITIZE_STRING);
$result['prevConfirmNewPass'] = filter_var($_POST["ConfirmNewPass"], FILTER_SANITIZE_STRING);
$result['permission'] = $_SESSION['permission'];
$result['no_visible_elements'] = 'FALSE';
$return['username'] = $_SESSION['user'];
$result['username'] = $_SESSION['user'];
$result['target_id'] = $_POST['target_id'];
global $SITEBASE;
@ -61,14 +61,20 @@ function change_password(){
}else{
//ERROR: permission denied!
$_SESSION['error_code'] = "403";
header("Location: index.php?page=error");
exit;
}
}else{
//ERROR: The form was not filled in correclty
header("Location: index.php?page=settings");
exit;
}
}else{
//ERROR: user is not logged in
exit;
header("Location: index.php");
exit;
}
}catch (PDOException $e) {

8
code/ryzom/tools/server/ryzom_ams/www/html/inc/settings.php
View file

@ -21,6 +21,14 @@ function settings(){
$result = WebUsers::getInfo($_SESSION['id']);
$result['target_id'] = $_SESSION['id'];
$result['current_mail'] = WebUsers::getEmail($_SESSION['id']);
//Sanitize Data
$result['current_mail'] = filter_var($result['current_mail'], FILTER_SANITIZE_EMAIL);
$result['Login'] = filter_var($result['Login'], FILTER_SANITIZE_STRING);
$result['FirstName'] = filter_var($result['FirstName'], FILTER_SANITIZE_STRING);
$result['LastName'] = filter_var($result['LastName'], FILTER_SANITIZE_STRING);
$result['Country'] = filter_var($result['Country'], FILTER_SANITIZE_STRING);
$result['Gender'] = filter_var($result['Gender'], FILTER_SANITIZE_NUMBER_INT);
}
$result['country_array'] = getCountryArray();
return $result;