|
@@ -1,4 +1,5 @@
|
|
|
<?php
|
|
|
+define(USERUNKNOW,0);
|
|
|
define(SOCIALUNKNOW,1);
|
|
|
define(SOCIALPARENT,2);
|
|
|
define(SOCIALFRIEND,3);
|
|
@@ -21,18 +22,18 @@ class UserFriend extends UserManager {
|
|
|
*/
|
|
|
public function register_friend ($friend_id,$my_user_id,$relation_type) {
|
|
|
$tbl_my_friend = Database :: get_main_table(TABLE_MAIN_USER_FRIEND);
|
|
|
- $sql = 'SELECT COUNT(*) as count FROM ' . $tbl_my_friend . ' WHERE friend_user_id=' . $friend_id.' AND user_id='.$my_user_id;
|
|
|
+ $sql = 'SELECT COUNT(*) as count FROM ' . $tbl_my_friend . ' WHERE friend_user_id=' . Database::escape_string($friend_id).' AND user_id='.Database::escape_string($my_user_id);
|
|
|
$result = api_sql_query($sql, __FILE__, __LINE__);
|
|
|
$row = Database :: fetch_array($result, 'ASSOC');
|
|
|
if ($row['count'] == 0) {
|
|
|
- $sql_i = 'INSERT INTO ' . $tbl_my_friend . '(friend_user_id,user_id,relation_type)values(' . $friend_id . ','.$my_user_id.','.$relation_type.');';
|
|
|
+ $sql_i = 'INSERT INTO ' . $tbl_my_friend . '(friend_user_id,user_id,relation_type)values(' . Database::escape_string($friend_id) . ','.Database::escape_string($my_user_id).','.Database::escape_string($relation_type).');';
|
|
|
api_sql_query($sql_i, __FILE__, __LINE__);
|
|
|
} else {
|
|
|
- $sql = 'SELECT COUNT(*) as count FROM ' . $tbl_my_friend . ' WHERE friend_user_id=' . $friend_id . ' AND user_id='.$my_user_id;
|
|
|
+ $sql = 'SELECT COUNT(*) as count FROM ' . $tbl_my_friend . ' WHERE friend_user_id=' . Database::escape_string($friend_id) . ' AND user_id='.Database::escape_string($my_user_id);
|
|
|
$result = api_sql_query($sql, __FILE__, __LINE__);
|
|
|
$row = Database :: fetch_array($result, 'ASSOC');
|
|
|
if ($row['count'] == 1) {
|
|
|
- $sql_i = 'UPDATE ' . $tbl_my_friend . ' SET relation_type='.$relation_type.' WHERE friend_user_id=' . $friend_id.' AND user_id='.$my_user_id;
|
|
|
+ $sql_i = 'UPDATE ' . $tbl_my_friend . ' SET relation_type='.$relation_type.' WHERE friend_user_id=' . Database::escape_string($friend_id).' AND user_id='.Database::escape_string($my_user_id);
|
|
|
api_sql_query($sql_i, __FILE__, __LINE__);
|
|
|
}
|
|
|
}
|
|
@@ -48,12 +49,12 @@ class UserFriend extends UserManager {
|
|
|
$tbl_my_friend = Database :: get_main_table(TABLE_MAIN_USER_FRIEND);
|
|
|
$tbl_my_message = Database :: get_main_table(TABLE_MAIN_MESSAGE);
|
|
|
$user_id=api_get_user_id();
|
|
|
- $sql = 'SELECT COUNT(*) as count FROM ' . $tbl_my_friend . ' WHERE user_id=' . $user_id . ' AND relation_type<>6 AND friend_user_id='.$friend_id;
|
|
|
+ $sql = 'SELECT COUNT(*) as count FROM ' . $tbl_my_friend . ' WHERE user_id=' . Database::escape_string($user_id) . ' AND relation_type<>6 AND friend_user_id='.Database::escape_string($friend_id);
|
|
|
$result = api_sql_query($sql, __FILE__, __LINE__);
|
|
|
$row = Database :: fetch_array($result, 'ASSOC');
|
|
|
if ($row['count'] == 1) {
|
|
|
- $sql_i = 'UPDATE ' . $tbl_my_friend . ' SET relation_type=6 WHERE user_id=' . $user_id.' AND friend_user_id='.$friend_id;
|
|
|
- $sql_j = 'UPDATE ' . $tbl_my_message . ' SET msg_status=7 WHERE user_receiver_id=' . $user_id.' AND user_sender_id='.$friend_id;
|
|
|
+ $sql_i = 'UPDATE ' . $tbl_my_friend . ' SET relation_type=6 WHERE user_id=' . Database::escape_string($user_id).' AND friend_user_id='.Database::escape_string($friend_id);
|
|
|
+ $sql_j = 'UPDATE ' . $tbl_my_message . ' SET msg_status=7 WHERE user_receiver_id=' . Database::escape_string($user_id).' AND user_sender_id='.Database::escape_string($friend_id);
|
|
|
api_sql_query($sql_i, __FILE__, __LINE__);
|
|
|
api_sql_query($sql_j, __FILE__, __LINE__);
|
|
|
}
|
|
@@ -105,14 +106,14 @@ class UserFriend extends UserManager {
|
|
|
public function get_relation_between_contacts ($user_id,$user_friend) {
|
|
|
$tbl_my_friend_relation_type = Database :: get_main_table(TABLE_MAIN_USER_FRIEND_RELATION_TYPE);
|
|
|
$tbl_my_friend = Database :: get_main_table(TABLE_MAIN_USER_FRIEND);
|
|
|
- $sql= 'SELECT rt.id FROM '.$tbl_my_friend_relation_type.' rt ' .
|
|
|
- 'WHERE rt.id=(SELECT uf.relation_type FROM '.$tbl_my_friend.' uf WHERE user_id='.$user_id.' AND friend_user_id='.$user_friend.')';
|
|
|
+ $sql= 'SELECT rt.id as id FROM '.$tbl_my_friend_relation_type.' rt ' .
|
|
|
+ 'WHERE rt.id=(SELECT uf.relation_type FROM '.$tbl_my_friend.' uf WHERE user_id='.Database::escape_string($user_id).' AND friend_user_id='.Database::escape_string($user_friend).')';
|
|
|
$res=api_sql_query($sql,__FILE__,__LINE__);
|
|
|
$row=Database::fetch_array($res,'ASSOC');
|
|
|
if (Database::num_rows($res)>0) {
|
|
|
return $row['id'];
|
|
|
} else {
|
|
|
- return SOCIALUNKNOW;
|
|
|
+ return USERUNKNOW;
|
|
|
}
|
|
|
}
|
|
|
/**
|
|
@@ -127,12 +128,12 @@ class UserFriend extends UserManager {
|
|
|
$list_ids_friends=array();
|
|
|
$tbl_my_friend = Database :: get_main_table(TABLE_MAIN_USER_FRIEND);
|
|
|
$tbl_my_user = Database :: get_main_table(TABLE_MAIN_USER);
|
|
|
- $sql='SELECT friend_user_id FROM '.$tbl_my_friend.' WHERE relation_type<>6 AND friend_user_id<>'.$user_id.' AND user_id='.$user_id;
|
|
|
+ $sql='SELECT friend_user_id FROM '.$tbl_my_friend.' WHERE relation_type<>6 AND friend_user_id<>'.Database::escape_string($user_id).' AND user_id='.Database::escape_string($user_id);
|
|
|
if (isset($id_group) && $id_group>0) {
|
|
|
$sql.=' AND relation_type='.$id_group;
|
|
|
}
|
|
|
if (isset($search_name) && is_string($search_name)===true) {
|
|
|
- $sql.=' AND friend_user_id IN (SELECT user_id FROM '.$tbl_my_user.' WHERE concat(firstName,lastName) like concat("%","'.$search_name.'","%"));';
|
|
|
+ $sql.=' AND friend_user_id IN (SELECT user_id FROM '.$tbl_my_user.' WHERE concat(firstName,lastName) like concat("%","'.Database::escape_string($search_name).'","%"));';
|
|
|
}
|
|
|
$res=api_sql_query($sql,__FILE__,__LINE__);
|
|
|
while ($row=Database::fetch_array($res,'ASSOC')) {
|
|
@@ -166,12 +167,12 @@ class UserFriend extends UserManager {
|
|
|
* get web path of user invitate
|
|
|
* @author isaac flores paz <florespaz@bidsoftperu.com>
|
|
|
* @param int user id
|
|
|
- * @param array
|
|
|
+ * @return array
|
|
|
*/
|
|
|
public function get_list_web_path_user_invitation_by_user_id ($user_id) {
|
|
|
$list_paths=array();
|
|
|
$list_path_friend=array();
|
|
|
- $list_ids = self::get_list_invitation_of_friends_by_user_id($user_id);
|
|
|
+ $list_ids = self::get_list_invitation_of_friends_by_user_id(Database::escape_string($user_id));
|
|
|
foreach ($list_ids as $values_ids) {
|
|
|
$list_path_image_friend[] = UserManager::get_user_picture_path_by_id($values_ids['user_sender_id'],'web',false,true);
|
|
|
}
|
|
@@ -190,19 +191,19 @@ class UserFriend extends UserManager {
|
|
|
$tbl_message=Database::get_main_table(TABLE_MAIN_MESSAGE);
|
|
|
$current_date=date('Y-m-d H:i:s',time());
|
|
|
$status_invitation=5;//status of pending invitation
|
|
|
- $sql_exist='SELECT COUNT(*) AS count FROM '.$tbl_message.' WHERE user_sender_id='.$user_id.' AND user_receiver_id='.$friend_id.' AND msg_status IN(5,6,7);';
|
|
|
+ $sql_exist='SELECT COUNT(*) AS count FROM '.$tbl_message.' WHERE user_sender_id='.Database::escape_string($user_id).' AND user_receiver_id='.Database::escape_string($friend_id).' AND msg_status IN(5,6,7);';
|
|
|
$res_exist=api_sql_query($sql_exist,__FILE__,__LINE__);
|
|
|
$row_exist=Database::fetch_array($res_exist,'ASSOC');
|
|
|
if ($row_exist['count']==0) {
|
|
|
- $sql='INSERT INTO '.$tbl_message.'(user_sender_id,user_receiver_id,msg_status,send_date,title,content) VALUES('.$user_id.','.$friend_id.','.$status_invitation.',"'.$current_date.'","'.$message_title.'","'.$message_content.'")';
|
|
|
+ $sql='INSERT INTO '.$tbl_message.'(user_sender_id,user_receiver_id,msg_status,send_date,title,content) VALUES('.Database::escape_string($user_id).','.Database::escape_string($friend_id).','.Database::escape_string($status_invitation).',"'.$current_date.'","'.$message_title.'","'.$message_content.'")';
|
|
|
api_sql_query($sql,__FILE__,__LINE__);
|
|
|
return true;
|
|
|
} elseif($row_exist['count']==1) {
|
|
|
- $sql_if_exist='SELECT COUNT(*) AS count FROM '.$tbl_message.' WHERE user_sender_id='.$user_id.' AND user_receiver_id='.$friend_id.' AND msg_status=7';
|
|
|
+ $sql_if_exist='SELECT COUNT(*) AS count FROM '.$tbl_message.' WHERE user_sender_id='.Database::escape_string($user_id).' AND user_receiver_id='.Database::escape_string($friend_id).' AND msg_status=7';
|
|
|
$res_if_exist=api_sql_query($sql_if_exist,__FILE__,__LINE__);
|
|
|
$row_if_exist=Database::fetch_array($res_if_exist,'ASSOC');
|
|
|
if ($row_if_exist['count']==1) {
|
|
|
- $sql_if_exist_up='UPDATE '.$tbl_message.'SET msg_status=5 WHERE user_sender_id='.$user_id.' AND user_receiver_id='.$friend_id.';';
|
|
|
+ $sql_if_exist_up='UPDATE '.$tbl_message.'SET msg_status=5 WHERE user_sender_id='.Database::escape_string($user_id).' AND user_receiver_id='.Database::escape_string($friend_id).';';
|
|
|
api_sql_query($sql_if_exist_up,__FILE__,__LINE__);
|
|
|
return true;
|
|
|
} else {
|
|
@@ -223,7 +224,7 @@ class UserFriend extends UserManager {
|
|
|
public function get_message_number_invitation_by_user_id ($user_receiver_id) {
|
|
|
$status_invitation=5;//status of pending invitation
|
|
|
$tbl_message=Database::get_main_table(TABLE_MAIN_MESSAGE);
|
|
|
- $sql='SELECT COUNT(*) as count_message_in_box FROM '.$tbl_message.' WHERE user_receiver_id='.$user_receiver_id.' AND msg_status=5;';
|
|
|
+ $sql='SELECT COUNT(*) as count_message_in_box FROM '.$tbl_message.' WHERE user_receiver_id='.Database::escape_string($user_receiver_id).' AND msg_status=5;';
|
|
|
$res=api_sql_query($sql,__FILE__,__LINE__);
|
|
|
$row=Database::fetch_array($res,'ASSOC');
|
|
|
return $row['count_message_in_box'];
|
|
@@ -237,7 +238,7 @@ class UserFriend extends UserManager {
|
|
|
public function get_list_invitation_of_friends_by_user_id ($user_id) {
|
|
|
$list_friend_invitation=array();
|
|
|
$tbl_message=Database::get_main_table(TABLE_MAIN_MESSAGE);
|
|
|
- $sql='SELECT user_sender_id,send_date,title,content FROM '.$tbl_message.' WHERE user_receiver_id='.$user_id.' AND msg_status=5;';
|
|
|
+ $sql='SELECT user_sender_id,send_date,title,content FROM '.$tbl_message.' WHERE user_receiver_id='.Database::escape_string($user_id).' AND msg_status=5;';
|
|
|
$res=api_sql_query($sql,__FILE__,__LINE__);
|
|
|
while ($row=Database::fetch_array($res,'ASSOC')) {
|
|
|
$list_friend_invitation[]=$row;
|
|
@@ -254,7 +255,7 @@ class UserFriend extends UserManager {
|
|
|
public function invitation_accepted ($user_send_id,$user_receiver_id) {
|
|
|
$tbl_message=Database::get_main_table(TABLE_MAIN_MESSAGE);
|
|
|
$msg_status=6;// friend accepted
|
|
|
- $sql='UPDATE '.$tbl_message.' SET msg_status='.$msg_status.' WHERE user_sender_id='.$user_send_id.' AND user_receiver_id='.$user_receiver_id.';';
|
|
|
+ $sql='UPDATE '.$tbl_message.' SET msg_status='.$msg_status.' WHERE user_sender_id='.Database::escape_string($user_send_id).' AND user_receiver_id='.Database::escape_string($user_receiver_id).';';
|
|
|
api_sql_query($sql,__FILE__,__LINE__);
|
|
|
}
|
|
|
/**
|
|
@@ -267,7 +268,7 @@ class UserFriend extends UserManager {
|
|
|
public function invitation_denied($user_send_id,$user_receiver_id) {
|
|
|
$tbl_message=Database::get_main_table(TABLE_MAIN_MESSAGE);
|
|
|
$msg_status=7;
|
|
|
- $sql='UPDATE '.$tbl_message.' SET msg_status='.$msg_status.' WHERE user_sender_id='.$user_send_id.' AND user_receiver_id='.$user_receiver_id.';';
|
|
|
+ $sql='UPDATE '.$tbl_message.' SET msg_status='.$msg_status.' WHERE user_sender_id='.Database::escape_string($user_send_id).' AND user_receiver_id='.Database::escape_string($user_receiver_id).';';
|
|
|
api_sql_query($sql,__FILE__,__LINE__);
|
|
|
}
|
|
|
/**
|
|
@@ -280,9 +281,43 @@ class UserFriend extends UserManager {
|
|
|
public function qualify_friend($id_friend_qualify,$type_qualify) {
|
|
|
$tbl_user_friend=Database::get_main_table(TABLE_MAIN_USER_FRIEND);
|
|
|
$user_id=api_get_user_id();
|
|
|
- $sql='UPDATE '.$tbl_user_friend.' SET relation_type='.$type_qualify.' WHERE user_id='.$user_id.' AND friend_user_id='.$id_friend_qualify.';';
|
|
|
+ $sql='UPDATE '.$tbl_user_friend.' SET relation_type='.$type_qualify.' WHERE user_id='.Database::escape_string($user_id).' AND friend_user_id='.Database::escape_string($id_friend_qualify).';';
|
|
|
api_sql_query($sql,__FILE__,__LINE__);
|
|
|
}
|
|
|
-
|
|
|
+ /**
|
|
|
+ * Send invitation a your friends
|
|
|
+ * @author Isaac Flores Paz <isaac.flores.paz@gmail.com>
|
|
|
+ * @param void
|
|
|
+ * @return string message invitation
|
|
|
+ */
|
|
|
+ function send_invitation_friend_user($userfriend_id,$subject_message='',$content_message='') {
|
|
|
+ //$id_user_friend=array();
|
|
|
+ $user_info=array();
|
|
|
+ $user_info=api_get_user_info($userfriend_id);
|
|
|
+ $succes=get_lang('MessageSentTo');
|
|
|
+ $succes.= ' : '.$user_info['firstName'].' '.$user_info['lastName'];
|
|
|
+ if (isset($subject_message) && isset($content_message) && isset($userfriend_id)) {
|
|
|
+ MessageManager::send_message(Database::escape_string($userfriend_id),Database::escape_string($subject_message), Database::escape_string($content_message));
|
|
|
+ Display::display_confirmation_message($succes,true);
|
|
|
+ exit;
|
|
|
+ } elseif(isset($userfriend_id) && !isset($subject_message)) {
|
|
|
+ $count_is_true=false;
|
|
|
+ $count_number_is_true=0;
|
|
|
+ if (isset($userfriend_id) && $userfriend_id>0) {
|
|
|
+ $user_info=array();
|
|
|
+ $user_id=api_get_user_id();
|
|
|
+ $user_info=api_get_user_info($user_id);
|
|
|
+ $message_title=get_lang('Invitation');
|
|
|
+ $message_content=$user_info['firstName'].' '.$user_info['lastName'].' :'.$content_message;
|
|
|
+ $count_is_true=self::send_invitation_friend(Database::escape_string($user_id),Database::escape_string($userfriend_id),Database::escape_string($message_title),Database::escape_string($message_content));
|
|
|
+ if ($count_is_true) {
|
|
|
+ echo Display::display_normal_message(get_lang('InvitationHasBeenSent'));
|
|
|
+ }else {
|
|
|
+ echo Display::display_error_message(get_lang('InvitationHasBeenNotSent'));
|
|
|
+ }
|
|
|
+
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
}
|
|
|
?>
|