profile.php 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * This file displays the user's profile,
  5. * optionally it allows users to modify their profile as well.
  6. *
  7. * See inc/conf/profile.conf.php to modify settings
  8. *
  9. * @package chamilo.auth
  10. */
  11. use Chamilo\UserBundle\Entity\User;
  12. use ChamiloSession as Session;
  13. $cidReset = true;
  14. require_once '../inc/global.inc.php';
  15. if (api_get_setting('allow_social_tool') == 'true') {
  16. $this_section = SECTION_SOCIAL;
  17. } else {
  18. $this_section = SECTION_MYPROFILE;
  19. }
  20. //$htmlHeadXtra[] = api_get_password_checker_js('#username', '#password1');
  21. $_SESSION['this_section'] = $this_section;
  22. if (!(isset($_user['user_id']) && $_user['user_id']) || api_is_anonymous($_user['user_id'], true)) {
  23. api_not_allowed(true);
  24. }
  25. $htmlHeadXtra[] = api_get_password_checker_js('#username', '#password1');
  26. $htmlHeadXtra[] = '<link href="'. api_get_path(WEB_PATH) .'web/assets/cropper/dist/cropper.min.css" rel="stylesheet">';
  27. $htmlHeadXtra[] = '<script src="'. api_get_path(WEB_PATH) .'web/assets/cropper/dist/cropper.min.js"></script>';
  28. $htmlHeadXtra[] = '<script>
  29. $(document).ready(function() {
  30. var $image = $("#previewImage");
  31. var $input = $("[name=\'cropResult\']");
  32. var $cropButton = $("#cropButton");
  33. var canvas = "";
  34. var imageWidth = "";
  35. var imageHeight = "";
  36. $("input:file").change(function() {
  37. var oFReader = new FileReader();
  38. oFReader.readAsDataURL(document.getElementById("picture_form").files[0]);
  39. oFReader.onload = function (oFREvent) {
  40. $image.attr("src", this.result);
  41. $("#labelCropImage").html("'.get_lang('Preview').'");
  42. $("#cropImage").addClass("thumbnail");
  43. $cropButton.removeClass("hidden");
  44. // Destroy cropper
  45. $image.cropper("destroy");
  46. $image.cropper({
  47. aspectRatio: 1 / 1,
  48. responsive : true,
  49. center : false,
  50. guides : false,
  51. movable: false,
  52. zoomable: false,
  53. rotatable: false,
  54. scalable: false,
  55. crop: function(e) {
  56. // Output the result data for cropping image.
  57. $input.val(e.x+","+e.y+","+e.width+","+e.height);
  58. }
  59. });
  60. };
  61. });
  62. $("#cropButton").on("click", function() {
  63. var canvas = $image.cropper("getCroppedCanvas");
  64. var dataUrl = canvas.toDataURL();
  65. $image.attr("src", dataUrl);
  66. $image.cropper("destroy");
  67. $cropButton.addClass("hidden");
  68. return false;
  69. });
  70. });
  71. function confirmation(name) {
  72. if (confirm("'.get_lang('AreYouSureToDeleteJS', '').' " + name + " ?")) {
  73. document.forms["profile"].submit();
  74. } else {
  75. return false;
  76. }
  77. }
  78. function show_image(image,width,height) {
  79. width = parseInt(width) + 20;
  80. height = parseInt(height) + 20;
  81. window_x = window.open(image,\'windowX\',\'width=\'+ width + \', height=\'+ height + \'\');
  82. }
  83. function generate_open_id_form() {
  84. $.ajax({
  85. contentType: "application/x-www-form-urlencoded",
  86. beforeSend: function(objeto) {
  87. /*$("#div_api_key").html("Loading...");*/ },
  88. type: "POST",
  89. url: "'.api_get_path(WEB_AJAX_PATH).'user_manager.ajax.php?a=generate_api_key",
  90. data: "num_key_id="+"",
  91. success: function(datos) {
  92. $("#div_api_key").html(datos);
  93. }
  94. });
  95. }
  96. function hide_icon_edit(element_html) {
  97. ident="#edit_image";
  98. $(ident).hide();
  99. }
  100. function show_icon_edit(element_html) {
  101. ident="#edit_image";
  102. $(ident).show();
  103. }
  104. </script>';
  105. $warning_msg = '';
  106. if (!empty($_GET['fe'])) {
  107. $warning_msg .= get_lang('UplUnableToSaveFileFilteredExtension');
  108. $_GET['fe'] = null;
  109. }
  110. $jquery_ready_content = '';
  111. if (api_get_setting('allow_message_tool') == 'true') {
  112. $jquery_ready_content = <<<EOF
  113. $(".message-content .message-delete").click(function(){
  114. $(this).parents(".message-content").animate({ opacity: "hide" }, "slow");
  115. $(".message-view").animate({ opacity: "show" }, "slow");
  116. });
  117. EOF;
  118. }
  119. $tool_name = is_profile_editable() ? get_lang('ModifProfile') : get_lang('ViewProfile');
  120. $table_user = Database :: get_main_table(TABLE_MAIN_USER);
  121. /*
  122. * Get initial values for all fields.
  123. */
  124. $user_data = api_get_user_info(api_get_user_id());
  125. $array_list_key = UserManager::get_api_keys(api_get_user_id());
  126. $id_temp_key = UserManager::get_api_key_id(api_get_user_id(), 'dokeos');
  127. $value_array = $array_list_key[$id_temp_key];
  128. $user_data['api_key_generate'] = $value_array;
  129. if ($user_data !== false) {
  130. if (api_get_setting('login_is_email') == 'true') {
  131. $user_data['username'] = $user_data['email'];
  132. }
  133. if (is_null($user_data['language'])) {
  134. $user_data['language'] = api_get_setting('platformLanguage');
  135. }
  136. }
  137. /*
  138. * Initialize the form.
  139. */
  140. $form = new FormValidator(
  141. 'profile',
  142. 'post',
  143. api_get_self()."?".str_replace('&fe=1', '', Security::remove_XSS($_SERVER['QUERY_STRING'])),
  144. null
  145. );
  146. if (api_is_western_name_order()) {
  147. // FIRST NAME and LAST NAME
  148. $form->addElement('text', 'firstname', get_lang('FirstName'), array('size' => 40));
  149. $form->addElement('text', 'lastname', get_lang('LastName'), array('size' => 40));
  150. } else {
  151. // LAST NAME and FIRST NAME
  152. $form->addElement('text', 'lastname', get_lang('LastName'), array('size' => 40));
  153. $form->addElement('text', 'firstname', get_lang('FirstName'), array('size' => 40));
  154. }
  155. if (api_get_setting('profile', 'name') !== 'true') {
  156. $form->freeze(array('lastname', 'firstname'));
  157. }
  158. $form->applyFilter(array('lastname', 'firstname'), 'stripslashes');
  159. $form->applyFilter(array('lastname', 'firstname'), 'trim');
  160. $form->applyFilter(array('lastname', 'firstname'), 'html_filter');
  161. $form->addRule('lastname' , get_lang('ThisFieldIsRequired'), 'required');
  162. $form->addRule('firstname', get_lang('ThisFieldIsRequired'), 'required');
  163. // USERNAME
  164. $form->addElement(
  165. 'text',
  166. 'username',
  167. get_lang('UserName'),
  168. array(
  169. 'id' => 'username',
  170. 'maxlength' => USERNAME_MAX_LENGTH,
  171. 'size' => USERNAME_MAX_LENGTH,
  172. )
  173. );
  174. if (api_get_setting('profile', 'login') !== 'true' || api_get_setting('login_is_email') == 'true') {
  175. $form->freeze('username');
  176. }
  177. $form->applyFilter('username', 'stripslashes');
  178. $form->applyFilter('username', 'trim');
  179. $form->addRule('username', get_lang('ThisFieldIsRequired'), 'required');
  180. $form->addRule('username', get_lang('UsernameWrong'), 'username');
  181. $form->addRule('username', get_lang('UserTaken'), 'username_available', $user_data['username']);
  182. // OFFICIAL CODE
  183. if (CONFVAL_ASK_FOR_OFFICIAL_CODE) {
  184. $form->addElement('text', 'official_code', get_lang('OfficialCode'), array('size' => 40));
  185. if (api_get_setting('profile', 'officialcode') !== 'true') {
  186. $form->freeze('official_code');
  187. }
  188. $form->applyFilter('official_code', 'stripslashes');
  189. $form->applyFilter('official_code', 'trim');
  190. $form->applyFilter('official_code', 'html_filter');
  191. if (api_get_setting('registration', 'officialcode') == 'true' && api_get_setting('profile', 'officialcode') == 'true') {
  192. $form->addRule('official_code', get_lang('ThisFieldIsRequired'), 'required');
  193. }
  194. }
  195. // EMAIL
  196. $form->addElement('email', 'email', get_lang('Email'), array('size' => 40));
  197. if (api_get_setting('profile', 'email') !== 'true') {
  198. $form->freeze('email');
  199. }
  200. if (api_get_setting('registration', 'email') == 'true' && api_get_setting('profile', 'email') == 'true') {
  201. $form->applyFilter('email', 'stripslashes');
  202. $form->applyFilter('email', 'trim');
  203. $form->addRule('email', get_lang('ThisFieldIsRequired'), 'required');
  204. $form->addRule('email', get_lang('EmailWrong'), 'email');
  205. }
  206. // OPENID URL
  207. if (is_profile_editable() && api_get_setting('openid_authentication') == 'true') {
  208. $form->addElement('text', 'openid', get_lang('OpenIDURL'), array('size' => 40));
  209. if (api_get_setting('profile', 'openid') !== 'true') {
  210. $form->freeze('openid');
  211. }
  212. $form->applyFilter('openid', 'trim');
  213. }
  214. // PHONE
  215. $form->addElement('text', 'phone', get_lang('Phone'), array('size' => 20));
  216. if (api_get_setting('profile', 'phone') !== 'true') {
  217. $form->freeze('phone');
  218. }
  219. $form->applyFilter('phone', 'stripslashes');
  220. $form->applyFilter('phone', 'trim');
  221. $form->applyFilter('phone', 'html_filter');
  222. // PICTURE
  223. if (is_profile_editable() && api_get_setting('profile', 'picture') == 'true') {
  224. $form->addElement(
  225. 'file',
  226. 'picture',
  227. ($user_data['picture_uri'] != '' ? get_lang('UpdateImage') : get_lang(
  228. 'AddImage'
  229. )),
  230. array('id' => 'picture_form', 'class' => 'picture-form')
  231. );
  232. $form->addHtml(''
  233. . '<div class="form-group">'
  234. . '<label for="cropImage" id="labelCropImage" class="col-sm-2 control-label"></label>'
  235. . '<div class="col-sm-8">'
  236. . '<div id="cropImage" class="cropCanvas">'
  237. . '<img id="previewImage" >'
  238. . '</div>'
  239. . '<div>'
  240. . '<button class="btn btn-primary hidden" name="cropButton" id="cropButton"><em class="fa fa-crop"></em> '.get_lang('CropYourPicture').'</button>'
  241. . '</div>'
  242. . '</div>'
  243. . '</div>'
  244. . '');
  245. $form->addHidden('cropResult', '');
  246. $form->add_progress_bar();
  247. if (!empty($user_data['picture_uri'])) {
  248. $form->addElement('checkbox', 'remove_picture', null, get_lang('DelImage'));
  249. }
  250. $allowed_picture_types = api_get_supported_image_extensions();
  251. $form->addRule(
  252. 'picture',
  253. get_lang('OnlyImagesAllowed').' ('.implode(', ', $allowed_picture_types).')',
  254. 'filetype',
  255. $allowed_picture_types
  256. );
  257. }
  258. // LANGUAGE
  259. $form->addElement('select_language', 'language', get_lang('Language'));
  260. if (api_get_setting('profile', 'language') !== 'true') {
  261. $form->freeze('language');
  262. }
  263. //THEME
  264. if (is_profile_editable() && api_get_setting('user_selected_theme') == 'true') {
  265. $form->addElement('SelectTheme', 'theme', get_lang('Theme'));
  266. if (api_get_setting('profile', 'theme') !== 'true') {
  267. $form->freeze('theme');
  268. }
  269. $form->applyFilter('theme', 'trim');
  270. }
  271. // EXTENDED PROFILE this make the page very slow!
  272. if (api_get_setting('extended_profile') == 'true') {
  273. $width_extended_profile = 500;
  274. // MY COMPETENCES
  275. $form->addHtmlEditor(
  276. 'competences',
  277. get_lang('MyCompetences'),
  278. false,
  279. false,
  280. array(
  281. 'ToolbarSet' => 'Profile',
  282. 'Width' => $width_extended_profile,
  283. 'Height' => '130',
  284. )
  285. );
  286. // MY DIPLOMAS
  287. $form->addHtmlEditor(
  288. 'diplomas',
  289. get_lang('MyDiplomas'),
  290. false,
  291. false,
  292. array(
  293. 'ToolbarSet' => 'Profile',
  294. 'Width' => $width_extended_profile,
  295. 'Height' => '130',
  296. )
  297. );
  298. // WHAT I AM ABLE TO TEACH
  299. $form->addHtmlEditor(
  300. 'teach',
  301. get_lang('MyTeach'),
  302. false,
  303. false,
  304. array(
  305. 'ToolbarSet' => 'Profile',
  306. 'Width' => $width_extended_profile,
  307. 'Height' => '130',
  308. )
  309. );
  310. // MY PRODUCTIONS
  311. $form->addElement('file', 'production', get_lang('MyProductions'));
  312. if ($production_list = UserManager::build_production_list(api_get_user_id(), '', true)) {
  313. $form->addElement('static', 'productions_list', null, $production_list);
  314. }
  315. // MY PERSONAL OPEN AREA
  316. $form->addHtmlEditor(
  317. 'openarea',
  318. get_lang('MyPersonalOpenArea'),
  319. false,
  320. false,
  321. array(
  322. 'ToolbarSet' => 'Profile',
  323. 'Width' => $width_extended_profile,
  324. 'Height' => '350',
  325. )
  326. );
  327. // openarea is untrimmed for maximum openness
  328. $form->applyFilter(array('competences', 'diplomas', 'teach', 'openarea'), 'stripslashes');
  329. $form->applyFilter(array('competences', 'diplomas', 'teach'), 'trim');
  330. }
  331. // PASSWORD, if auth_source is platform
  332. if (is_platform_authentication() &&
  333. is_profile_editable() &&
  334. api_get_setting('profile', 'password') == 'true'
  335. ) {
  336. $form->addElement('password', 'password0', array(get_lang('Pass'), get_lang('Enter2passToChange')), array('size' => 40));
  337. $form->addElement('password', 'password1', get_lang('NewPass'), array('id'=> 'password1', 'size' => 40));
  338. $checkPass = api_get_setting('allow_strength_pass_checker');
  339. if ($checkPass == 'true') {
  340. $form->addElement('label', null, '<div id="password_progress"></div>');
  341. }
  342. $form->addElement('password', 'password2', get_lang('Confirmation'), array('size' => 40));
  343. // user must enter identical password twice so we can prevent some user errors
  344. $form->addRule(array('password1', 'password2'), get_lang('PassTwo'), 'compare');
  345. if (CHECK_PASS_EASY_TO_FIND) {
  346. $form->addRule('password1', get_lang('CurrentPasswordEmptyOrIncorrect'), 'callback', 'api_check_password');
  347. }
  348. }
  349. $extraField = new ExtraField('user');
  350. $return = $extraField->addElements($form, api_get_user_id());
  351. $jquery_ready_content = $return['jquery_ready_content'];
  352. // the $jquery_ready_content variable collects all functions that
  353. // will be load in the $(document).ready javascript function
  354. $htmlHeadXtra[] ='<script>
  355. $(document).ready(function(){
  356. '.$jquery_ready_content.'
  357. });
  358. </script>';
  359. if (api_get_setting('profile', 'apikeys') == 'true') {
  360. $form->addElement('html', '<div id="div_api_key">');
  361. $form->addElement(
  362. 'text',
  363. 'api_key_generate',
  364. get_lang('MyApiKey'),
  365. array('size' => 40, 'id' => 'id_api_key_generate')
  366. );
  367. $form->addElement('html', '</div>');
  368. $form->addElement(
  369. 'button',
  370. 'generate_api_key',
  371. get_lang('GenerateApiKey'),
  372. array(
  373. 'id' => 'id_generate_api_key',
  374. 'onclick' => 'generate_open_id_form(); return false;',
  375. )
  376. ); //generate_open_id_form()
  377. }
  378. // SUBMIT
  379. if (is_profile_editable()) {
  380. $form->addButtonUpdate(get_lang('SaveSettings'), 'apply_change');
  381. } else {
  382. $form->freeze();
  383. }
  384. $form->setDefaults($user_data);
  385. /**
  386. * Is user auth_source is platform ?
  387. *
  388. * @return boolean if auth_source is platform
  389. */
  390. function is_platform_authentication() {
  391. $tab_user_info = api_get_user_info();
  392. return $tab_user_info['auth_source'] == PLATFORM_AUTH_SOURCE;
  393. }
  394. /**
  395. * Can a user edit his/her profile?
  396. *
  397. * @return boolean Editability of the profile
  398. */
  399. function is_profile_editable() {
  400. return $GLOBALS['profileIsEditable'];
  401. }
  402. /*
  403. PRODUCTIONS FUNCTIONS
  404. */
  405. /**
  406. * Upload a submitted user production.
  407. *
  408. * @param $user_id User id
  409. * @return The filename of the new production or FALSE if the upload has failed
  410. */
  411. function upload_user_production($user_id)
  412. {
  413. $production_repository = UserManager::getUserPathById($user_id, 'system');
  414. if (!file_exists($production_repository)) {
  415. @mkdir($production_repository, api_get_permissions_for_new_directories(), true);
  416. }
  417. $filename = api_replace_dangerous_char($_FILES['production']['name']);
  418. $filename = disable_dangerous_file($filename);
  419. if (filter_extension($filename)) {
  420. if (@move_uploaded_file($_FILES['production']['tmp_name'], $production_repository.$filename)) {
  421. return $filename;
  422. }
  423. }
  424. return false; // this should be returned if anything went wrong with the upload
  425. }
  426. /**
  427. * Check current user's current password
  428. * @param char email
  429. * @return bool true o false
  430. * @uses Gets user ID from global variable
  431. */
  432. function check_user_email($email) {
  433. $user_id = api_get_user_id();
  434. if ($user_id != strval(intval($user_id)) || empty($email)) {
  435. return false;
  436. }
  437. $table_user = Database :: get_main_table(TABLE_MAIN_USER);
  438. $email = Database::escape_string($email);
  439. $sql = "SELECT * FROM $table_user
  440. WHERE user_id='".$user_id."' AND email='".$email."'";
  441. $result = Database::query($sql);
  442. return Database::num_rows($result) != 0;
  443. }
  444. $filtered_extension = false;
  445. if ($form->validate()) {
  446. $wrong_current_password = false;
  447. $user_data = $form->getSubmitValues(1);
  448. $user = UserManager::getRepository()->find(api_get_user_id());
  449. // set password if a new one was provided
  450. $validPassword = false;
  451. $passwordWasChecked = false;
  452. if ($user &&
  453. (!empty($user_data['password0']) &&
  454. !empty($user_data['password1'])) ||
  455. (!empty($user_data['password0']) &&
  456. api_get_setting('profile', 'email') == 'true')
  457. ) {
  458. $passwordWasChecked = true;
  459. $validPassword = UserManager::isPasswordValid(
  460. $user_data['password0'],
  461. $user
  462. );
  463. if ($validPassword) {
  464. $password = $user_data['password1'];
  465. } else {
  466. Display::addFlash(
  467. Display:: return_message(
  468. get_lang('CurrentPasswordEmptyOrIncorrect'),
  469. 'warning',
  470. false
  471. )
  472. );
  473. }
  474. }
  475. $allow_users_to_change_email_with_no_password = true;
  476. if (is_platform_authentication() &&
  477. api_get_setting('allow_users_to_change_email_with_no_password') == 'false'
  478. ) {
  479. $allow_users_to_change_email_with_no_password = false;
  480. }
  481. // If user sending the email to be changed (input available and not frozen )
  482. if (api_get_setting('profile', 'email') == 'true') {
  483. if ($allow_users_to_change_email_with_no_password) {
  484. if (!check_user_email($user_data['email'])) {
  485. $changeemail = $user_data['email'];
  486. }
  487. } else {
  488. // Normal behaviour
  489. if (!check_user_email($user_data['email']) && $validPassword) {
  490. $changeemail = $user_data['email'];
  491. }
  492. if (!check_user_email($user_data['email']) &&
  493. empty($user_data['password0'])
  494. ){
  495. Display::addFlash(
  496. Display:: return_message(
  497. get_lang('ToChangeYourEmailMustTypeYourPassword'),
  498. 'error',
  499. false
  500. )
  501. );
  502. }
  503. }
  504. }
  505. // Upload picture if a new one is provided
  506. if ($_FILES['picture']['size']) {
  507. $new_picture = UserManager::update_user_picture(
  508. api_get_user_id(),
  509. $_FILES['picture']['name'],
  510. $_FILES['picture']['tmp_name'],
  511. $user_data['cropResult']
  512. );
  513. if ($new_picture) {
  514. $user_data['picture_uri'] = $new_picture;
  515. Display::addFlash(
  516. Display:: return_message(
  517. get_lang('PictureUploaded'),
  518. 'normal',
  519. false
  520. )
  521. );
  522. }
  523. } elseif (!empty($user_data['remove_picture'])) {
  524. // remove existing picture if asked
  525. UserManager::delete_user_picture(api_get_user_id());
  526. $user_data['picture_uri'] = '';
  527. }
  528. // Remove production.
  529. if (isset($user_data['remove_production']) &&
  530. is_array($user_data['remove_production'])
  531. ) {
  532. foreach (array_keys($user_data['remove_production']) as $production) {
  533. UserManager::remove_user_production(api_get_user_id(), urldecode($production));
  534. }
  535. if ($production_list = UserManager::build_production_list(api_get_user_id(), true, true)) {
  536. $form->insertElementBefore(
  537. $form->createElement('static', null, null, $production_list),
  538. 'productions_list'
  539. );
  540. }
  541. $form->removeElement('productions_list');
  542. Display::addFlash(
  543. Display:: return_message(get_lang('FileDeleted'), 'normal', false)
  544. );
  545. }
  546. // upload production if a new one is provided
  547. if (isset($_FILES['production']) && $_FILES['production']['size']) {
  548. $res = upload_user_production(api_get_user_id());
  549. if (!$res) {
  550. //it's a bit excessive to assume the extension is the reason why
  551. // upload_user_production() returned false, but it's true in most cases
  552. $filtered_extension = true;
  553. } else {
  554. Display::addFlash(
  555. Display:: return_message(
  556. get_lang('ProductionUploaded'),
  557. 'normal',
  558. false
  559. )
  560. );
  561. }
  562. }
  563. // remove values that shouldn't go in the database
  564. unset(
  565. $user_data['password0'],
  566. $user_data['password1'],
  567. $user_data['password2'],
  568. $user_data['MAX_FILE_SIZE'],
  569. $user_data['remove_picture'],
  570. $user_data['apply_change'],
  571. $user_data['email']
  572. );
  573. // Following RFC2396 (http://www.faqs.org/rfcs/rfc2396.html), a URI uses ':' as a reserved character
  574. // we can thus ensure the URL doesn't contain any scheme name by searching for ':' in the string
  575. $my_user_openid = isset($user_data['openid']) ? $user_data['openid'] : '';
  576. if (!preg_match('/^[^:]*:\/\/.*$/', $my_user_openid)) {
  577. //ensure there is at least a http:// scheme in the URI provided
  578. $user_data['openid'] = 'http://'.$my_user_openid;
  579. }
  580. $extras = array();
  581. //Checking the user language
  582. $languages = api_get_languages();
  583. if (!in_array($user_data['language'], $languages['folder'])) {
  584. $user_data['language'] = api_get_setting('platformLanguage');
  585. }
  586. $_SESSION['_user']['language'] = $user_data['language'];
  587. //Only update values that are request by the "profile" setting
  588. $profile_list = api_get_setting('profile');
  589. //Adding missing variables
  590. $available_values_to_modify = array();
  591. foreach ($profile_list as $key => $status) {
  592. if ($status == 'true') {
  593. switch($key) {
  594. case 'login':
  595. $available_values_to_modify[] = 'username';
  596. break;
  597. case 'name':
  598. $available_values_to_modify[] = 'firstname';
  599. $available_values_to_modify[] = 'lastname';
  600. break;
  601. case 'picture':
  602. $available_values_to_modify[] = 'picture_uri';
  603. break;
  604. default:
  605. $available_values_to_modify[] = $key;
  606. break;
  607. }
  608. }
  609. }
  610. //Fixing missing variables
  611. $available_values_to_modify = array_merge(
  612. $available_values_to_modify,
  613. array('competences', 'diplomas', 'openarea', 'teach', 'openid')
  614. );
  615. // build SQL query
  616. $sql = "UPDATE $table_user SET";
  617. unset($user_data['api_key_generate']);
  618. foreach ($user_data as $key => $value) {
  619. if (substr($key, 0, 6) == 'extra_') { //an extra field
  620. continue;
  621. } elseif (strpos($key, 'remove_extra_') !== false) {
  622. } else {
  623. if (in_array($key, $available_values_to_modify)) {
  624. $sql .= " $key = '".Database::escape_string($value)."',";
  625. }
  626. }
  627. }
  628. $changePassword = false;
  629. // Change email
  630. if ($allow_users_to_change_email_with_no_password) {
  631. if (isset($changeemail) && in_array('email', $available_values_to_modify)) {
  632. $sql .= " email = '".Database::escape_string($changeemail)."' ";
  633. }
  634. if (isset($password) && in_array('password', $available_values_to_modify)) {
  635. $changePassword = true;
  636. /*$password = api_get_encrypted_password($password);
  637. $sql .= " password = '".Database::escape_string($password)."'";*/
  638. } else {
  639. // remove trailing , from the query we have so far
  640. //$sql = rtrim($sql, ',');
  641. }
  642. } else {
  643. if (isset($changeemail) && !isset($password) && in_array('email', $available_values_to_modify)) {
  644. $sql .= " email = '".Database::escape_string($changeemail)."'";
  645. } else {
  646. if (isset($password) && in_array('password', $available_values_to_modify)) {
  647. if (isset($changeemail) && in_array('email', $available_values_to_modify)) {
  648. $sql .= " email = '".Database::escape_string($changeemail)."' ";
  649. }
  650. $changePassword = true;
  651. /*$password = api_get_encrypted_password($password);
  652. $sql .= " password = '".Database::escape_string($password)."'";*/
  653. } else {
  654. // remove trailing , from the query we have so far
  655. //$sql = rtrim($sql, ',');
  656. }
  657. }
  658. }
  659. $sql = rtrim($sql, ',');
  660. if ($changePassword && !empty($password)) {
  661. UserManager::updatePassword(api_get_user_id(), $password);
  662. }
  663. if (api_get_setting('profile', 'officialcode') == 'true' &&
  664. isset($user_data['official_code'])
  665. ) {
  666. $sql .= ", official_code = '".Database::escape_string($user_data['official_code'])."'";
  667. }
  668. $sql .= " WHERE user_id = '".api_get_user_id()."'";
  669. Database::query($sql);
  670. if ($passwordWasChecked == false) {
  671. Display::addFlash(
  672. Display:: return_message(get_lang('ProfileReg'), 'normal', false)
  673. );
  674. } else {
  675. if ($validPassword) {
  676. Display::addFlash(
  677. Display:: return_message(get_lang('ProfileReg'), 'normal', false)
  678. );
  679. }
  680. }
  681. $extraField = new ExtraFieldValue('user');
  682. $extraField->saveFieldValues($user_data);
  683. $userInfo = api_get_user_info();
  684. Session::write('_user', $userInfo);
  685. // re-init the system to take new settings into account
  686. //$_SESSION['_user']['uidReset'] = true;
  687. //$_SESSION['noredirection'] = true;
  688. $url = api_get_self();
  689. header("Location: ".$url);
  690. exit;
  691. }
  692. // the header
  693. $actions = null;
  694. if (api_get_setting('allow_social_tool') != 'true') {
  695. if (api_get_setting('extended_profile') == 'true') {
  696. $actions .= '<div class="actions">';
  697. if (api_get_setting('allow_social_tool') == 'true' &&
  698. api_get_setting('allow_message_tool') == 'true'
  699. ) {
  700. $actions .= '<a href="'.api_get_path(WEB_PATH).'main/social/profile.php">'.
  701. Display::return_icon('shared_profile.png', get_lang('ViewSharedProfile')).'</a>';
  702. }
  703. if (api_get_setting('allow_message_tool') == 'true') {
  704. $actions .= '<a href="'.api_get_path(WEB_PATH).'main/messages/inbox.php">'.
  705. Display::return_icon('inbox.png', get_lang('Messages')).'</a>';
  706. }
  707. $show = isset($_GET['show']) ? '&amp;show='.Security::remove_XSS($_GET['show']) : '';
  708. if (isset($_GET['type']) && $_GET['type'] == 'extended') {
  709. $actions .= '<a href="profile.php?type=reduced'.$show.'">'.
  710. Display::return_icon('edit.png', get_lang('EditNormalProfile'),'',16).'</a>';
  711. } else {
  712. $actions .= '<a href="profile.php?type=extended'.$show.'">'.
  713. Display::return_icon('edit.png', get_lang('EditExtendProfile'),'',16).'</a>';
  714. }
  715. $actions .= '</div>';
  716. }
  717. }
  718. $show_delete_account_button = api_get_setting('platform_unsubscribe_allowed') == 'true' ? true : false;
  719. $tpl = new Template(get_lang('ModifyProfile'));
  720. $tpl->assign('actions', $actions);
  721. SocialManager::setSocialUserBlock($tpl, $user_id, 'messages');
  722. if (api_get_setting('allow_social_tool') == 'true') {
  723. SocialManager::setSocialUserBlock($tpl, api_get_user_id(), 'home');
  724. $menu = SocialManager::show_social_menu(
  725. 'home',
  726. null,
  727. api_get_user_id(),
  728. false,
  729. $show_delete_account_button
  730. );
  731. $tpl->assign('social_menu_block', $menu);
  732. $tpl->assign('social_right_content', $form->returnForm());
  733. $social_layout = $tpl->get_template('social/edit_profile.tpl');
  734. $tpl->display($social_layout);
  735. } else {
  736. $bigImage = UserManager::getUserPicture(api_get_user_id(), USER_IMAGE_SIZE_BIG);
  737. $normalImage = UserManager::getUserPicture(api_get_user_id(), USER_IMAGE_SIZE_ORIGINAL);
  738. $imageToShow = '<div id="image-message-container">';
  739. $imageToShow .= '<a class="expand-image" href="'.$bigImage.'" /><img src="'.$normalImage.'"></a>';
  740. $imageToShow .= '</div>';
  741. $content = $imageToShow.$form->returnForm();
  742. $tpl->assign('content', $content);
  743. $tpl->display_one_col_template();
  744. }