profile.php 31 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * This file displays the user's profile,
  5. * optionally it allows users to modify their profile as well.
  6. *
  7. * See inc/conf/profile.conf.php to modify settings
  8. *
  9. * @package chamilo.auth
  10. */
  11. $cidReset = true;
  12. require_once '../inc/global.inc.php';
  13. if (api_get_setting('allow_social_tool') == 'true') {
  14. $this_section = SECTION_SOCIAL;
  15. } else {
  16. $this_section = SECTION_MYPROFILE;
  17. }
  18. $htmlHeadXtra[] = api_get_password_checker_js('#username', '#password1');
  19. $_SESSION['this_section'] = $this_section;
  20. if (!(isset($_user['user_id']) && $_user['user_id']) || api_is_anonymous($_user['user_id'], true)) {
  21. api_not_allowed(true);
  22. }
  23. $htmlHeadXtra[] = '<script src="../inc/lib/javascript/tag/jquery.fcbkcomplete.js" type="text/javascript" language="javascript"></script>';
  24. $htmlHeadXtra[] = '<link href="'.api_get_path(WEB_LIBRARY_PATH).'javascript/tag/style.css" rel="stylesheet" type="text/css" />';
  25. $htmlHeadXtra[] = '<script>
  26. function confirmation(name) {
  27. if (confirm("'.get_lang('AreYouSureToDelete', '').' " + name + " ?")) {
  28. document.forms["profile"].submit();
  29. } else {
  30. return false;
  31. }
  32. }
  33. function show_image(image,width,height) {
  34. width = parseInt(width) + 20;
  35. height = parseInt(height) + 20;
  36. window_x = window.open(image,\'windowX\',\'width=\'+ width + \', height=\'+ height + \'\');
  37. }
  38. function generate_open_id_form() {
  39. $.ajax({
  40. contentType: "application/x-www-form-urlencoded",
  41. beforeSend: function(objeto) {
  42. /*$("#div_api_key").html("Loading...");*/ },
  43. type: "POST",
  44. url: "'.api_get_path(WEB_AJAX_PATH).'user_manager.ajax.php?a=generate_api_key",
  45. data: "num_key_id="+"",
  46. success: function(datos) {
  47. $("#div_api_key").html(datos);
  48. }
  49. });
  50. }
  51. function hide_icon_edit(element_html) {
  52. ident="#edit_image";
  53. $(ident).hide();
  54. }
  55. function show_icon_edit(element_html) {
  56. ident="#edit_image";
  57. $(ident).show();
  58. }
  59. </script>';
  60. //$interbreadcrumb[] = array('url' => '../auth/profile.php', 'name' => get_lang('ModifyProfile'));
  61. if (!empty ($_GET['coursePath'])) {
  62. $course_url = api_get_path(WEB_COURSE_PATH).htmlentities(strip_tags($_GET['coursePath'])).'/index.php';
  63. $interbreadcrumb[] = array('url' => $course_url, 'name' => Security::remove_XSS($_GET['courseCode']));
  64. }
  65. $warning_msg = '';
  66. if (!empty($_GET['fe'])) {
  67. $warning_msg .= get_lang('UplUnableToSaveFileFilteredExtension');
  68. $_GET['fe'] = null;
  69. }
  70. $jquery_ready_content = '';
  71. if (api_get_setting('allow_message_tool') == 'true') {
  72. $jquery_ready_content = <<<EOF
  73. $(".message-content .message-delete").click(function(){
  74. $(this).parents(".message-content").animate({ opacity: "hide" }, "slow");
  75. $(".message-view").animate({ opacity: "show" }, "slow");
  76. });
  77. EOF;
  78. }
  79. $tool_name = is_profile_editable() ? get_lang('ModifProfile') : get_lang('ViewProfile');
  80. $table_user = Database :: get_main_table(TABLE_MAIN_USER);
  81. /*
  82. * Get initial values for all fields.
  83. */
  84. $user_data = UserManager::get_user_info_by_id(api_get_user_id());
  85. $array_list_key = UserManager::get_api_keys(api_get_user_id());
  86. $id_temp_key = UserManager::get_api_key_id(api_get_user_id(), 'dokeos');
  87. $value_array = $array_list_key[$id_temp_key];
  88. $user_data['api_key_generate'] = $value_array;
  89. if ($user_data !== false) {
  90. if (api_get_setting('login_is_email') == 'true') {
  91. $user_data['username'] = $user_data['email'];
  92. }
  93. if (is_null($user_data['language'])) {
  94. $user_data['language'] = api_get_setting('platformLanguage');
  95. }
  96. }
  97. /*
  98. * Initialize the form.
  99. */
  100. $form = new FormValidator(
  101. 'profile',
  102. 'post',
  103. api_get_self()."?".str_replace('&fe=1', '', Security::remove_XSS($_SERVER['QUERY_STRING'])),
  104. null,
  105. array('style' => 'width: 70%; float: '.($text_dir == 'rtl' ? 'right;' : 'left;'))
  106. );
  107. if (api_is_western_name_order()) {
  108. // FIRST NAME and LAST NAME
  109. $form->addElement('text', 'firstname', get_lang('FirstName'), array('size' => 40));
  110. $form->addElement('text', 'lastname', get_lang('LastName'), array('size' => 40));
  111. } else {
  112. // LAST NAME and FIRST NAME
  113. $form->addElement('text', 'lastname', get_lang('LastName'), array('size' => 40));
  114. $form->addElement('text', 'firstname', get_lang('FirstName'), array('size' => 40));
  115. }
  116. if (api_get_setting('profile', 'name') !== 'true') {
  117. $form->freeze(array('lastname', 'firstname'));
  118. }
  119. $form->applyFilter(array('lastname', 'firstname'), 'stripslashes');
  120. $form->applyFilter(array('lastname', 'firstname'), 'trim');
  121. $form->applyFilter(array('lastname', 'firstname'), 'html_filter');
  122. $form->addRule('lastname' , get_lang('ThisFieldIsRequired'), 'required');
  123. $form->addRule('firstname', get_lang('ThisFieldIsRequired'), 'required');
  124. // USERNAME
  125. $form->addElement('text', 'username', get_lang('UserName'), array('id' => 'username', 'maxlength' => USERNAME_MAX_LENGTH, 'size' => USERNAME_MAX_LENGTH));
  126. if (api_get_setting('profile', 'login') !== 'true' || api_get_setting('login_is_email') == 'true') {
  127. $form->freeze('username');
  128. }
  129. $form->applyFilter('username', 'stripslashes');
  130. $form->applyFilter('username', 'trim');
  131. $form->addRule('username', get_lang('ThisFieldIsRequired'), 'required');
  132. $form->addRule('username', get_lang('UsernameWrong'), 'username');
  133. $form->addRule('username', get_lang('UserTaken'), 'username_available', $user_data['username']);
  134. // OFFICIAL CODE
  135. if (CONFVAL_ASK_FOR_OFFICIAL_CODE) {
  136. $form->addElement('text', 'official_code', get_lang('OfficialCode'), array('size' => 40));
  137. if (api_get_setting('profile', 'officialcode') !== 'true') {
  138. $form->freeze('official_code');
  139. }
  140. $form->applyFilter('official_code', 'stripslashes');
  141. $form->applyFilter('official_code', 'trim');
  142. $form->applyFilter('official_code', 'html_filter');
  143. if (api_get_setting('registration', 'officialcode') == 'true' && api_get_setting('profile', 'officialcode') == 'true') {
  144. $form->addRule('official_code', get_lang('ThisFieldIsRequired'), 'required');
  145. }
  146. }
  147. // EMAIL
  148. $form->addElement('email', 'email', get_lang('Email'), array('size' => 40));
  149. if (api_get_setting('profile', 'email') !== 'true') {
  150. $form->freeze('email');
  151. }
  152. if (api_get_setting('registration', 'email') == 'true' && api_get_setting('profile', 'email') == 'true') {
  153. $form->applyFilter('email', 'stripslashes');
  154. $form->applyFilter('email', 'trim');
  155. $form->addRule('email', get_lang('ThisFieldIsRequired'), 'required');
  156. $form->addRule('email', get_lang('EmailWrong'), 'email');
  157. }
  158. // OPENID URL
  159. if (is_profile_editable() && api_get_setting('openid_authentication') == 'true') {
  160. $form->addElement('text', 'openid', get_lang('OpenIDURL'), array('size' => 40));
  161. if (api_get_setting('profile', 'openid') !== 'true') {
  162. $form->freeze('openid');
  163. }
  164. $form->applyFilter('openid', 'trim');
  165. //if (api_get_setting('registration', 'openid') == 'true') {
  166. // $form->addRule('openid', get_lang('ThisFieldIsRequired'), 'required');
  167. //}
  168. }
  169. // PHONE
  170. $form->addElement('text', 'phone', get_lang('Phone'), array('size' => 20));
  171. if (api_get_setting('profile', 'phone') !== 'true') {
  172. $form->freeze('phone');
  173. }
  174. $form->applyFilter('phone', 'stripslashes');
  175. $form->applyFilter('phone', 'trim');
  176. $form->applyFilter('phone', 'html_filter');
  177. /*if (api_get_setting('registration', 'phone') == 'true') {
  178. $form->addRule('phone', get_lang('ThisFieldIsRequired'), 'required');
  179. }
  180. $form->addRule('phone', get_lang('EmailWrong'), 'email');*/
  181. // PICTURE
  182. if (is_profile_editable() && api_get_setting('profile', 'picture') == 'true') {
  183. $form->addElement('file', 'picture', ($user_data['picture_uri'] != '' ? get_lang('UpdateImage') : get_lang('AddImage')), array('class' => 'picture-form'));
  184. $form->add_progress_bar();
  185. if (!empty($user_data['picture_uri'])) {
  186. $form->addElement('checkbox', 'remove_picture', null, get_lang('DelImage'));
  187. }
  188. $allowed_picture_types = array ('jpg', 'jpeg', 'png', 'gif');
  189. $form->addRule('picture', get_lang('OnlyImagesAllowed').' ('.implode(',', $allowed_picture_types).')', 'filetype', $allowed_picture_types);
  190. }
  191. // LANGUAGE
  192. $form->addElement('select_language', 'language', get_lang('Language'));
  193. if (api_get_setting('profile', 'language') !== 'true') {
  194. $form->freeze('language');
  195. }
  196. //THEME
  197. if (is_profile_editable() && api_get_setting('user_selected_theme') == 'true') {
  198. $form->addElement('SelectTheme', 'theme', get_lang('Theme'));
  199. if (api_get_setting('profile', 'theme') !== 'true') {
  200. $form->freeze('theme');
  201. }
  202. $form->applyFilter('theme', 'trim');
  203. }
  204. // EXTENDED PROFILE this make the page very slow!
  205. if (api_get_setting('extended_profile') == 'true') {
  206. $width_extended_profile = 500;
  207. //$form->addElement('html', '<a href="javascript: void(0);" onclick="javascript: show_extend();"> show_extend_profile</a>');
  208. //$form->addElement('static', null, '<em>'.get_lang('OptionalTextFields').'</em>');
  209. // MY COMPETENCES
  210. $form->addHtmlEditor('competences', get_lang('MyCompetences'), false, false, array('ToolbarSet' => 'Profile', 'Width' => $width_extended_profile, 'Height' => '130'));
  211. // MY DIPLOMAS
  212. $form->addHtmlEditor('diplomas', get_lang('MyDiplomas'), false, false, array('ToolbarSet' => 'Profile', 'Width' => $width_extended_profile, 'Height' => '130'));
  213. // WHAT I AM ABLE TO TEACH
  214. $form->addHtmlEditor('teach', get_lang('MyTeach'), false, false, array('ToolbarSet' => 'Profile', 'Width' => $width_extended_profile, 'Height' => '130'));
  215. // MY PRODUCTIONS
  216. $form->addElement('file', 'production', get_lang('MyProductions'));
  217. if ($production_list = UserManager::build_production_list(api_get_user_id(), '', true)) {
  218. $form->addElement('static', 'productions_list', null, $production_list);
  219. }
  220. // MY PERSONAL OPEN AREA
  221. $form->addHtmlEditor('openarea', get_lang('MyPersonalOpenArea'), false, false, array('ToolbarSet' => 'Profile', 'Width' => $width_extended_profile, 'Height' => '350'));
  222. $form->applyFilter(array('competences', 'diplomas', 'teach', 'openarea'), 'stripslashes');
  223. $form->applyFilter(array('competences', 'diplomas', 'teach'), 'trim'); // openarea is untrimmed for maximum openness
  224. }
  225. // PASSWORD, if auth_source is platform
  226. if (is_platform_authentication() && is_profile_editable() && api_get_setting('profile', 'password') == 'true') {
  227. $form->addElement('password', 'password0', array(get_lang('Pass'), get_lang('Enter2passToChange')), array('size' => 40));
  228. $form->addElement('password', 'password1', get_lang('NewPass'), array('id'=> 'password1', 'size' => 40));
  229. if (isset($_configuration['allow_strength_pass_checker']) && $_configuration['allow_strength_pass_checker']) {
  230. $form->addElement('label', null, '<div id="password_progress"></div>');
  231. }
  232. $form->addElement('password', 'password2', get_lang('Confirmation'), array('size' => 40));
  233. // user must enter identical password twice so we can prevent some user errors
  234. $form->addRule(array('password1', 'password2'), get_lang('PassTwo'), 'compare');
  235. if (CHECK_PASS_EASY_TO_FIND) {
  236. $form->addRule('password1', get_lang('CurrentPasswordEmptyOrIncorrect'), 'callback', 'api_check_password');
  237. }
  238. }
  239. // EXTRA FIELDS
  240. $extra_data = UserManager::get_extra_user_data(api_get_user_id(), true);
  241. $return_params = UserManager::set_extra_fields_in_form($form, $extra_data, 'profile', false, api_get_user_id());
  242. $jquery_ready_content = $return_params['jquery_ready_content'];
  243. // the $jquery_ready_content variable collects all functions that will be load in the $(document).ready javascript function
  244. $htmlHeadXtra[] ='<script>
  245. $(document).ready(function(){
  246. '.$jquery_ready_content.'
  247. });
  248. </script>';
  249. if (api_get_setting('profile', 'apikeys') == 'true') {
  250. $form->addElement('html', '<div id="div_api_key">');
  251. $form->addElement('text', 'api_key_generate', get_lang('MyApiKey'), array('size' => 40, 'id' => 'id_api_key_generate'));
  252. $form->addElement('html', '</div>');
  253. $form->addElement('button', 'generate_api_key', get_lang('GenerateApiKey'), array('id' => 'id_generate_api_key', 'onclick' => 'generate_open_id_form(); return false;')); //generate_open_id_form()
  254. }
  255. // SUBMIT
  256. if (is_profile_editable()) {
  257. $form->addButtonUpdate(get_lang('SaveSettings'), 'apply_change');
  258. } else {
  259. $form->freeze();
  260. }
  261. $user_data = array_merge($user_data, $extra_data);
  262. $form->setDefaults($user_data);
  263. /**
  264. * Is user auth_source is platform ?
  265. *
  266. * @return boolean if auth_source is platform
  267. */
  268. function is_platform_authentication() {
  269. $tab_user_info = api_get_user_info();
  270. return $tab_user_info['auth_source'] == PLATFORM_AUTH_SOURCE;
  271. }
  272. /**
  273. * Can a user edit his/her profile?
  274. *
  275. * @return boolean Editability of the profile
  276. */
  277. function is_profile_editable() {
  278. return $GLOBALS['profileIsEditable'];
  279. }
  280. /*
  281. PRODUCTIONS FUNCTIONS
  282. */
  283. /**
  284. * Upload a submitted user production.
  285. *
  286. * @param $user_id User id
  287. * @return The filename of the new production or FALSE if the upload has failed
  288. */
  289. function upload_user_production($user_id) {
  290. $image_path = UserManager::get_user_picture_path_by_id($user_id, 'system');
  291. $production_repository = $image_path['dir'];
  292. if (!file_exists($production_repository)) {
  293. @mkdir($production_repository, api_get_permissions_for_new_directories(), true);
  294. }
  295. $filename = replace_dangerous_char($_FILES['production']['name']);
  296. $filename = disable_dangerous_file($filename);
  297. if (filter_extension($filename)) {
  298. if (@move_uploaded_file($_FILES['production']['tmp_name'], $production_repository.$filename)) {
  299. return $filename;
  300. }
  301. }
  302. return false; // this should be returned if anything went wrong with the upload
  303. }
  304. /**
  305. * Check current user's current password
  306. * @param char password
  307. * @return bool true o false
  308. * @uses Gets user ID from global variable
  309. */
  310. function check_user_password($password) {
  311. $user_id = api_get_user_id();
  312. if ($user_id != strval(intval($user_id)) || empty($password)) { return false; }
  313. $table_user = Database :: get_main_table(TABLE_MAIN_USER);
  314. $password = api_get_encrypted_password($password);
  315. $password = Database::escape_string($password);
  316. $sql_password = "SELECT * FROM $table_user WHERE user_id='".$user_id."' AND password='".$password."'";
  317. $result = Database::query($sql_password);
  318. return Database::num_rows($result) != 0;
  319. }
  320. /**
  321. * Check current user's current password
  322. * @param char email
  323. * @return bool true o false
  324. * @uses Gets user ID from global variable
  325. */
  326. function check_user_email($email) {
  327. $user_id = api_get_user_id();
  328. if ($user_id != strval(intval($user_id)) || empty($email)) { return false; }
  329. $table_user = Database :: get_main_table(TABLE_MAIN_USER);
  330. $email = Database::escape_string($email);
  331. $sql_password = "SELECT * FROM $table_user WHERE user_id='".$user_id."' AND email='".$email."'";
  332. $result = Database::query($sql_password);
  333. return Database::num_rows($result) != 0;
  334. }
  335. /* MAIN CODE */
  336. $filtered_extension = false;
  337. $update_success = false;
  338. $upload_picture_success = false;
  339. $upload_production_success = false;
  340. $msg_fail_changue_email = false;
  341. $msg_is_not_password = false;
  342. if (is_platform_authentication()) {
  343. if (!empty($_SESSION['change_email'])) {
  344. $msg_fail_changue_email= ($_SESSION['change_email'] == 'success');
  345. unset($_SESSION['change_email']);
  346. } elseif (!empty($_SESSION['is_not_password'])) {
  347. $msg_is_not_password = ($_SESSION['is_not_password'] == 'success');
  348. unset($_SESSION['is_not_password']);
  349. } elseif (!empty($_SESSION['profile_update'])) {
  350. $update_success = ($_SESSION['profile_update'] == 'success');
  351. unset($_SESSION['profile_update']);
  352. } elseif (!empty($_SESSION['image_uploaded'])) {
  353. $upload_picture_success = ($_SESSION['image_uploaded'] == 'success');
  354. unset($_SESSION['image_uploaded']);
  355. } elseif (!empty($_SESSION['production_uploaded'])) {
  356. $upload_production_success = ($_SESSION['production_uploaded'] == 'success');
  357. unset($_SESSION['production_uploaded']);
  358. }
  359. }
  360. if ($form->validate()) {
  361. $wrong_current_password = false;
  362. $user_data = $form->getSubmitValues(1);
  363. // set password if a new one was provided
  364. if (!empty($user_data['password0'])) {
  365. if (check_user_password($user_data['password0'])) {
  366. if (!empty($user_data['password1'])) {
  367. $password = $user_data['password1'];
  368. }
  369. } else {
  370. $wrong_current_password = true;
  371. $_SESSION['is_not_password'] = 'success';
  372. }
  373. }
  374. if (empty($user_data['password0']) && !empty($user_data['password1'])) {
  375. $wrong_current_password = true;
  376. $_SESSION['is_not_password'] = 'success';
  377. }
  378. $allow_users_to_change_email_with_no_password = true;
  379. if (is_platform_authentication() && api_get_setting('allow_users_to_change_email_with_no_password') == 'false') {
  380. $allow_users_to_change_email_with_no_password = false;
  381. }
  382. // If user sending the email to be changed (input available and not frozen )
  383. if (api_get_setting('profile', 'email') == 'true') {
  384. if ($allow_users_to_change_email_with_no_password) {
  385. if (!check_user_email($user_data['email'])) {
  386. $changeemail = $user_data['email'];
  387. //$_SESSION['change_email'] = 'success';
  388. }
  389. } else {
  390. //Normal behaviour
  391. if (!check_user_email($user_data['email']) && !empty($user_data['password0']) && !$wrong_current_password) {
  392. $changeemail = $user_data['email'];
  393. }
  394. if (!check_user_email($user_data['email']) && empty($user_data['password0'])){
  395. $_SESSION['change_email'] = 'success';
  396. }
  397. }
  398. }
  399. // Upload picture if a new one is provided
  400. if ($_FILES['picture']['size']) {
  401. $new_picture = UserManager::update_user_picture(
  402. api_get_user_id(),
  403. $_FILES['picture']['name'],
  404. $_FILES['picture']['tmp_name']
  405. );
  406. if ($new_picture) {
  407. $user_data['picture_uri'] = $new_picture;
  408. $_SESSION['image_uploaded'] = 'success';
  409. }
  410. } elseif (!empty($user_data['remove_picture'])) {
  411. // remove existing picture if asked
  412. UserManager::delete_user_picture(api_get_user_id());
  413. $user_data['picture_uri'] = '';
  414. }
  415. // Remove production.
  416. if (isset($user_data['remove_production']) &&
  417. is_array($user_data['remove_production'])
  418. ) {
  419. foreach (array_keys($user_data['remove_production']) as $production) {
  420. UserManager::remove_user_production(api_get_user_id(), urldecode($production));
  421. }
  422. if ($production_list = UserManager::build_production_list(api_get_user_id(), true, true)) {
  423. $form->insertElementBefore($form->createElement('static', null, null, $production_list), 'productions_list');
  424. }
  425. $form->removeElement('productions_list');
  426. $file_deleted = true;
  427. }
  428. // upload production if a new one is provided
  429. if ($_FILES['production']['size']) {
  430. $res = upload_user_production(api_get_user_id());
  431. if (!$res) {
  432. //it's a bit excessive to assume the extension is the reason why
  433. // upload_user_production() returned false, but it's true in most cases
  434. $filtered_extension = true;
  435. } else {
  436. $_SESSION['production_uploaded'] = 'success';
  437. }
  438. }
  439. // remove values that shouldn't go in the database
  440. unset($user_data['password0'],$user_data['password1'], $user_data['password2'], $user_data['MAX_FILE_SIZE'],
  441. $user_data['remove_picture'], $user_data['apply_change'], $user_data['email'] );
  442. // Following RFC2396 (http://www.faqs.org/rfcs/rfc2396.html), a URI uses ':' as a reserved character
  443. // we can thus ensure the URL doesn't contain any scheme name by searching for ':' in the string
  444. $my_user_openid = isset($user_data['openid']) ? $user_data['openid'] : '';
  445. if (!preg_match('/^[^:]*:\/\/.*$/', $my_user_openid)) {
  446. //ensure there is at least a http:// scheme in the URI provided
  447. $user_data['openid'] = 'http://'.$my_user_openid;
  448. }
  449. $extras = array();
  450. //Checking the user language
  451. $languages = api_get_languages();
  452. if (!in_array($user_data['language'], $languages['folder'])) {
  453. $user_data['language'] = api_get_setting('platformLanguage');
  454. }
  455. //Only update values that are request by the "profile" setting
  456. $profile_list = api_get_setting('profile');
  457. //Adding missing variables
  458. $available_values_to_modify = array();
  459. foreach($profile_list as $key => $status) {
  460. if ($status == 'true') {
  461. switch($key) {
  462. case 'login':
  463. $available_values_to_modify[] = 'username';
  464. break;
  465. case 'name':
  466. $available_values_to_modify[] = 'firstname';
  467. $available_values_to_modify[] = 'lastname';
  468. break;
  469. case 'picture':
  470. $available_values_to_modify[] = 'picture_uri';
  471. break;
  472. default:
  473. $available_values_to_modify[] = $key;
  474. break;
  475. }
  476. }
  477. }
  478. //Fixing missing variables
  479. $available_values_to_modify = array_merge($available_values_to_modify, array('competences', 'diplomas', 'openarea', 'teach', 'openid'));
  480. // build SQL query
  481. $sql = "UPDATE $table_user SET";
  482. unset($user_data['api_key_generate']);
  483. foreach ($user_data as $key => $value) {
  484. if (substr($key, 0, 6) == 'extra_') { //an extra field
  485. $new_key = substr($key, 6);
  486. // format array date to 'Y-m-d' or date time to 'Y-m-d H:i:s'
  487. if (is_array($value) && isset($value['Y']) && isset($value['F']) && isset($value['d'])) {
  488. if (isset($value['H']) && isset($value['i'])) {
  489. // extra field date time
  490. $time = mktime($value['H'],$value['i'],0,$value['F'],$value['d'],$value['Y']);
  491. $extras[$new_key] = date('Y-m-d H:i:s',$time);
  492. } else {
  493. // extra field date
  494. $time = mktime(0,0,0,$value['F'],$value['d'],$value['Y']);
  495. $extras[$new_key] = date('Y-m-d',$time);
  496. }
  497. } else {
  498. $extras[$new_key] = $value;
  499. }
  500. } elseif (strpos($key, 'remove_extra_') !== false) {
  501. $extra_value = Security::filter_filename(urldecode(key($value)));
  502. // To remove from user_field_value and folder
  503. UserManager::update_extra_field_value($user_id, substr($key,13), $extra_value);
  504. } else {
  505. if (in_array($key, $available_values_to_modify)) {
  506. $sql .= " $key = '".Database::escape_string($value)."',";
  507. }
  508. }
  509. }
  510. //change email
  511. if ($allow_users_to_change_email_with_no_password) {
  512. if (isset($changeemail) && in_array('email', $available_values_to_modify)) {
  513. $sql .= " email = '".Database::escape_string($changeemail)."',";
  514. }
  515. if (isset($password) && in_array('password', $available_values_to_modify)) {
  516. $password = api_get_encrypted_password($password);
  517. $sql .= " password = '".Database::escape_string($password)."'";
  518. } else {
  519. // remove trailing , from the query we have so far
  520. $sql = rtrim($sql, ',');
  521. }
  522. } else {
  523. if (isset($changeemail) && !isset($password) && in_array('email', $available_values_to_modify)) {
  524. $sql .= " email = '".Database::escape_string($changeemail)."'";
  525. } else {
  526. if (isset($password) && in_array('password', $available_values_to_modify)) {
  527. if (isset($changeemail) && in_array('email', $available_values_to_modify)) {
  528. $sql .= " email = '".Database::escape_string($changeemail)."',";
  529. }
  530. $password = api_get_encrypted_password($password);
  531. $sql .= " password = '".Database::escape_string($password)."'";
  532. } else {
  533. // remove trailing , from the query we have so far
  534. $sql = rtrim($sql, ',');
  535. }
  536. }
  537. }
  538. if (api_get_setting('profile', 'officialcode') == 'true' && isset($user_data['official_code'])) {
  539. $sql .= ", official_code = '".Database::escape_string($user_data['official_code'])."'";
  540. }
  541. $sql .= " WHERE user_id = '".api_get_user_id()."'";
  542. Database::query($sql);
  543. // User tag process
  544. //1. Deleting all user tags
  545. $list_extra_field_type_tag = UserManager::get_all_extra_field_by_type(UserManager::USER_FIELD_TYPE_TAG);
  546. if (is_array($list_extra_field_type_tag) && count($list_extra_field_type_tag)>0) {
  547. foreach ($list_extra_field_type_tag as $id) {
  548. UserManager::delete_user_tags(api_get_user_id(), $id);
  549. }
  550. }
  551. //2. Update the extra fields and user tags if available
  552. if (is_array($extras) && count($extras)> 0) {
  553. foreach ($extras as $key => $value) {
  554. //3. Tags are process in the UserManager::update_extra_field_value by the UserManager::process_tags function
  555. // For array $value -> if exists key 'tmp_name' then must not be empty
  556. // This avoid delete from user field value table when doesn't upload a file
  557. if (is_array($value)) {
  558. if (array_key_exists('tmp_name', $value) && empty($value['tmp_name'])) {
  559. //Nothing to do
  560. } else {
  561. if (array_key_exists('tmp_name', $value)) {
  562. $value['tmp_name'] = Security::filter_filename($value['tmp_name']);
  563. }
  564. if (array_key_exists('name', $value)) {
  565. $value['name'] = Security::filter_filename($value['name']);
  566. }
  567. UserManager::update_extra_field_value($user_id, $key, $value);
  568. }
  569. } else {
  570. UserManager::update_extra_field_value($user_id, $key, $value);
  571. }
  572. }
  573. }
  574. // re-init the system to take new settings into account
  575. $_SESSION['_user']['uidReset'] = true;
  576. $_SESSION['noredirection'] = true;
  577. $_SESSION['profile_update'] = 'success';
  578. $url = api_get_self()."?{$_SERVER['QUERY_STRING']}".($filtered_extension && strpos($_SERVER['QUERY_STRING'], '&fe=1') === false ? '&fe=1' : '');
  579. header("Location: ".$url);
  580. exit;
  581. }
  582. // the header
  583. $actions = null;
  584. if (api_get_setting('allow_social_tool') != 'true') {
  585. if (api_get_setting('extended_profile') == 'true') {
  586. $actions .= '<div class="actions">';
  587. if (api_get_setting('allow_social_tool') == 'true' && api_get_setting('allow_message_tool') == 'true') {
  588. $actions .= '<a href="'.api_get_path(WEB_PATH).'main/social/profile.php">'.Display::return_icon('shared_profile.png', get_lang('ViewSharedProfile')).'</a>';
  589. }
  590. if (api_get_setting('allow_message_tool') == 'true') {
  591. $actions .= '<a href="'.api_get_path(WEB_PATH).'main/messages/inbox.php">'.Display::return_icon('inbox.png', get_lang('Messages')).'</a>';
  592. }
  593. $show = isset($_GET['show']) ? '&amp;show='.Security::remove_XSS($_GET['show']) : '';
  594. if (isset($_GET['type']) && $_GET['type'] == 'extended') {
  595. $actions .= '<a href="profile.php?type=reduced'.$show.'">'.Display::return_icon('edit.png', get_lang('EditNormalProfile'),'',16).'</a>';
  596. } else {
  597. $actions .= '<a href="profile.php?type=extended'.$show.'">'.Display::return_icon('edit.png', get_lang('EditExtendProfile'),'',16).'</a>';
  598. }
  599. $actions .= '</div>';
  600. }
  601. }
  602. if (!empty($file_deleted)) {
  603. Display::addFlash(Display :: return_message(get_lang('FileDeleted'), 'normal', false));
  604. } elseif (!empty($update_success)) {
  605. $message = get_lang('ProfileReg');
  606. if ($upload_picture_success) {
  607. $message .= '<br /> '.get_lang('PictureUploaded');
  608. }
  609. if ($upload_production_success) {
  610. $message.='<br />'.get_lang('ProductionUploaded');
  611. }
  612. Display::addFlash(Display :: return_message($message, 'normal', false));
  613. }
  614. if (!empty($msg_fail_changue_email)){
  615. $errormail=get_lang('ToChangeYourEmailMustTypeYourPassword');
  616. Display::addFlash(Display :: return_message($errormail, 'error', false));
  617. }
  618. if (!empty($msg_is_not_password)){
  619. $warning_msg = get_lang('CurrentPasswordEmptyOrIncorrect');
  620. Display::addFlash(Display :: return_message($warning_msg, 'warning', false));
  621. }
  622. // User picture size is calculated from SYSTEM path
  623. $image_syspath = UserManager::get_user_picture_path_by_id(api_get_user_id(), 'system', false, true);
  624. $image_syspath['dir'].$image_syspath['file'];
  625. //Web path
  626. $image_path = UserManager::get_user_picture_path_by_id(api_get_user_id(), 'web', false, true);
  627. $image_dir = $image_path['dir'];
  628. $image = $image_path['file'];
  629. $image_file = $image_dir.$image;
  630. $img_attributes = 'src="'.$image_file.'?rand='.time().'" '
  631. .'alt="'.api_get_person_name($user_data['firstname'], $user_data['lastname']).'" '
  632. .'style="float:'.($text_dir == 'rtl' ? 'left' : 'right').'; margin-top:0px;padding:5px;" ';
  633. // get the path,width and height from original picture
  634. $big_image = $image_dir.'big_'.$image;
  635. $big_image_size = api_getimagesize($big_image);
  636. $big_image_width = $big_image_size['width'];
  637. $big_image_height = $big_image_size['height'];
  638. $url_big_image = $big_image.'?rnd='.time();
  639. $show_delete_account_button = api_get_setting('platform_unsubscribe_allowed') == 'true' ? true : false;
  640. $tpl = new Template(get_lang('ModifyProfile'));
  641. $tpl->assign('actions', $actions);
  642. //$tpl->assign('message', Display::getFlashToString());
  643. SocialManager::setSocialUserBlock($tpl, $user_id, 'messages');
  644. if (api_get_setting('allow_social_tool') == 'true') {
  645. SocialManager::setSocialUserBlock($tpl, api_get_user_id(), 'home');
  646. $tpl->assign('social_menu_block', SocialManager::show_social_menu('home', null, api_get_user_id(), false, $show_delete_account_button));
  647. $tpl->assign('social_right_content', $form->returnForm());
  648. $social_layout = $tpl->get_template('social/inbox.tpl');
  649. $tpl->display($social_layout);
  650. } else {
  651. // Style position:absolute has been removed for Opera-compatibility.
  652. $imageToShow = '<div id="image-message-container" style="float:right;display:inline;padding:3px;width:230px;" >';
  653. if ($image == 'unknown.jpg') {
  654. $imageToShow .= '<img '.$img_attributes.' />';
  655. } else {
  656. $imageToShow .= '<input type="image" '.$img_attributes.' onclick="javascript: return show_image(\''.$url_big_image.'\',\''.$big_image_width.'\',\''.$big_image_height.'\');"/>';
  657. }
  658. $imageToShow .= '</div>';
  659. $content = $imageToShow.$form->returnForm();
  660. $tpl->assign('content', $form->returnForm());
  661. $tpl->display_one_col_template();
  662. }