Browse Source

[svn r20718] minor - logic changes - added remove_XSS - (partial FS#3909)

Isaac Flores 16 years ago
parent
commit
f837f3e603
1 changed files with 16 additions and 16 deletions
  1. 16 16
      main/social/register_friend.php

+ 16 - 16
main/social/register_friend.php

@@ -10,38 +10,38 @@ require_once api_get_path(LIBRARY_PATH).'image.lib.php';
 require_once api_get_path(LIBRARY_PATH).'usermanager.lib.php';
 require_once api_get_path(LIBRARY_PATH).'social.lib.php';
 $the_current_user_id	 = api_get_user_id();
-$my_current_friend		 = intval($_POST['friend_id']);
-$my_denied_current_friend= intval($_POST['denied_friend_id']);
-$my_delete_friend        = intval($_POST['delete_friend_id']);
-$friend_id_qualify       = intval($_POST['user_id_friend_q']);
+$my_current_friend		 = Security::remove_XSS($_POST['friend_id']);
+$my_denied_current_friend= Security::remove_XSS($_POST['denied_friend_id']);
+$my_delete_friend        = Security::remove_XSS($_POST['delete_friend_id']);
+$friend_id_qualify       = Security::remove_XSS($_POST['user_id_friend_q']);
 $type_friend_qualify     = Security::remove_XSS($_POST['type_friend_q']); //filtered?
 $is_my_friend            = Security::remove_XSS($_POST['is_my_friend']); //filtered?
-if (isset($is_my_friend)) {
+if (isset($_POST['is_my_friend'])) {
 	$relation_type='3';//my friend
 } else {
 	$relation_type='1';//Contact unknown	
 }
 
-if (isset($my_current_friend)) {
-	UserFriend::register_friend ($the_current_user_id,$my_current_friend,$relation_type);
-	UserFriend::register_friend ($my_current_friend,$the_current_user_id,$relation_type);	
-	UserFriend::invitation_accepted ($my_current_friend,$the_current_user_id);
-	if (isset($is_my_friend)) {
+if (isset($_POST['friend_id'])) {
+	UserFriend::register_friend ((int)$the_current_user_id,(int)$my_current_friend,(int)$relation_type);
+	UserFriend::register_friend ((int)$my_current_friend,(int)$the_current_user_id,(int)$relation_type);	
+	UserFriend::invitation_accepted ((int)$my_current_friend,(int)$the_current_user_id);
+	if (isset($_POST['is_my_friend'])) {
 		echo api_xml_http_response_encode(get_lang('AddedContactToList'));
 	} else {
 		Display::display_normal_message(api_xml_http_response_encode(get_lang('AddedContactToList')));
 	}
 
 }
-if (isset($my_denied_current_friend)) {
-	UserFriend::invitation_denied($my_denied_current_friend,$the_current_user_id);
+if (isset($_POST['denied_friend_id'])) {
+	UserFriend::invitation_denied((int)$my_denied_current_friend,(int)$the_current_user_id);
 	Display::display_confirmation_message(api_xml_http_response_encode(get_lang('InvitationDenied')));	
 }
-if (isset($my_delete_friend)) {
-	UserFriend::removed_friend($my_delete_friend);
+if (isset($_POST['delete_friend_id'])) {
+	UserFriend::removed_friend((int)$my_delete_friend);
 }
-if(isset($friend_id_qualify) && isset($type_friend_qualify)) {
-	UserFriend::qualify_friend($friend_id_qualify,$type_friend_qualify);
+if(isset($_POST['user_id_friend_q']) && isset($_POST['type_friend_q'])) {
+	UserFriend::qualify_friend((int)$friend_id_qualify,(int)$type_friend_qualify);
 	echo api_xml_http_response_encode(get_lang('AttachContactsToGroupSuccesfuly'));
 }
 ?>