profile.php 25 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765
  1. <?php // $Id: profile.php 17471 2008-12-29 09:54:41Z yannoo $
  2. /*
  3. ==============================================================================
  4. Dokeos - elearning and course management software
  5. Copyright (c) 2004-2008 Dokeos SPRL
  6. Copyright (c) 2003 Ghent University (UGent)
  7. Copyright (c) 2001 Universite catholique de Louvain (UCL)
  8. Copyright (c) Roan Embrechts (Vrije Universiteit Brussel)
  9. For a full list of contributors, see "credits.txt".
  10. The full license can be read in "license.txt".
  11. This program is free software; you can redistribute it and/or
  12. modify it under the terms of the GNU General Public License
  13. as published by the Free Software Foundation; either version 2
  14. of the License, or (at your option) any later version.
  15. See the GNU General Public License for more details.
  16. Contact address: Dokeos, rue du Corbeau, 108, B-1030 Brussels, Belgium
  17. Mail: info@dokeos.com
  18. ==============================================================================
  19. */
  20. /**
  21. ==============================================================================
  22. * This file displays the user's profile,
  23. * optionally it allows users to modify their profile as well.
  24. *
  25. * See inc/conf/profile.conf.php to modify settings
  26. *
  27. * @package dokeos.auth
  28. ==============================================================================
  29. */
  30. /*
  31. ==============================================================================
  32. INIT SECTION
  33. ==============================================================================
  34. */
  35. // name of the language file that needs to be included
  36. $language_file = 'registration';
  37. $cidReset = true;
  38. require ('../inc/global.inc.php');
  39. require_once (api_get_path(LIBRARY_PATH).'formvalidator/FormValidator.class.php');
  40. $this_section = SECTION_MYPROFILE;
  41. api_block_anonymous_users();
  42. $htmlHeadXtra[] = '<script type="text/javascript">
  43. function confirmation(name)
  44. {
  45. if (confirm("'.get_lang('AreYouSureToDelete').' " + name + " ?"))
  46. {return true;}
  47. else
  48. {return false;}
  49. }
  50. function show_image(image,width,height) {
  51. width = parseInt(width) + 20;
  52. height = parseInt(height) + 20;
  53. window_x = window.open(\'\',\'windowX\',\'width=\'+ width + \', height=\'+ height + \'\');
  54. window_x.document.write("<img src=\'"+image+"?rand='.time().'\'/>");
  55. }
  56. </script>';
  57. if (!empty ($_GET['coursePath']))
  58. {
  59. $course_url = api_get_path(WEB_COURSE_PATH).htmlentities(strip_tags($_GET['coursePath'])).'/index.php';
  60. $interbreadcrumb[] = array ('url' => $course_url, 'name' => Security::remove_XSS($_GET['courseCode']));
  61. }
  62. $warning_msg = '';
  63. if(!empty($_GET['fe']))
  64. {
  65. $warning_msg .= get_lang('UplUnableToSaveFileFilteredExtension');
  66. $_GET['fe'] = null;
  67. }
  68. /*
  69. -----------------------------------------------------------
  70. Configuration file
  71. -----------------------------------------------------------
  72. */
  73. require_once (api_get_path(CONFIGURATION_PATH).'profile.conf.php');
  74. /*
  75. -----------------------------------------------------------
  76. Libraries
  77. -----------------------------------------------------------
  78. */
  79. include_once (api_get_path(LIBRARY_PATH).'fileManage.lib.php');
  80. include_once (api_get_path(LIBRARY_PATH).'fileUpload.lib.php');
  81. include_once (api_get_path(LIBRARY_PATH).'image.lib.php');
  82. require_once (api_get_path(LIBRARY_PATH).'usermanager.lib.php');
  83. if (is_profile_editable())
  84. $tool_name = get_lang('ModifProfile');
  85. else
  86. $tool_name = get_lang('ViewProfile');
  87. $table_user = Database :: get_main_table(TABLE_MAIN_USER);
  88. /*
  89. -----------------------------------------------------------
  90. Form
  91. -----------------------------------------------------------
  92. */
  93. /*
  94. * Get initial values for all fields.
  95. */
  96. $user_data = UserManager::get_user_info_by_id(api_get_user_id());
  97. if ($user_data !== false)
  98. {
  99. if (is_null($user_data['language']))
  100. $user_data['language'] = api_get_setting('platformLanguage');
  101. }
  102. $user_image = UserManager::get_user_picture_path_by_id(api_get_user_id(),'none');
  103. $fck_attribute['Height'] = "150";
  104. $fck_attribute['Width'] = "100%";
  105. $fck_attribute['ToolbarSet'] = "Profil";
  106. /*
  107. * Initialize the form.
  108. */
  109. $form = new FormValidator('profile', 'post', api_get_self()."?".str_replace('&fe=1','',$_SERVER['QUERY_STRING']), null, array('style' => 'width: 75%; float: '.($text_dir=='rtl'?'right;':'left;')));
  110. /* Make sure this is the first submit on the form, even though it is hidden!
  111. * Otherwise, if a user has productions and presses ENTER to submit, he will
  112. * attempt to delete the first production in the list. */
  113. if (is_profile_editable())
  114. $form->addElement('submit', null, get_lang('Ok'), array('style' => 'visibility:hidden;'));
  115. // SUBMIT (visible)
  116. if (is_profile_editable())
  117. {
  118. $form->addElement('submit', 'apply_change', get_lang('Ok'));
  119. }
  120. else
  121. {
  122. $form->freeze();
  123. }
  124. //THEME
  125. if (is_profile_editable() && api_get_setting('user_selected_theme') == 'true')
  126. {
  127. $form->addElement('select_theme', 'theme', get_lang('Theme'));
  128. if (api_get_setting('profile', 'theme') !== 'true')
  129. $form->freeze('theme');
  130. $form->applyFilter('theme', 'trim');
  131. //if (api_get_setting('registration', 'openid') == 'true')
  132. // $form->addRule('openid', get_lang('ThisFieldIsRequired'), 'required');
  133. }
  134. // LAST NAME and FIRST NAME
  135. $form->addElement('text', 'lastname', get_lang('LastName'), array('size' => 40));
  136. $form->addElement('text', 'firstname', get_lang('FirstName'), array('size' => 40));
  137. if (api_get_setting('profile', 'name') !== 'true')
  138. $form->freeze(array('lastname', 'firstname'));
  139. $form->applyFilter(array('lastname', 'firstname'), 'stripslashes');
  140. $form->applyFilter(array('lastname', 'firstname'), 'trim');
  141. $form->addRule('lastname' , get_lang('ThisFieldIsRequired'), 'required');
  142. $form->addRule('firstname', get_lang('ThisFieldIsRequired'), 'required');
  143. // USERNAME
  144. $form->addElement('text', 'username', get_lang('UserName'), array('size' => 40));
  145. if (api_get_setting('profile', 'login') !== 'true')
  146. $form->freeze('username');
  147. $form->applyFilter('username', 'stripslashes');
  148. $form->applyFilter('username', 'trim');
  149. $form->addRule('username', get_lang('ThisFieldIsRequired'), 'required');
  150. $form->addRule('username', get_lang('UsernameWrong'), 'username');
  151. $form->addRule('username', get_lang('UserTaken'), 'username_available', $user_data['username']);
  152. // OFFICIAL CODE
  153. if (CONFVAL_ASK_FOR_OFFICIAL_CODE)
  154. {
  155. $form->addElement('text', 'official_code', get_lang('OfficialCode'), array('size' => 40));
  156. if (api_get_setting('profile', 'officialcode') !== 'true')
  157. $form->freeze('official_code');
  158. $form->applyFilter('official_code', 'stripslashes');
  159. $form->applyFilter('official_code', 'trim');
  160. if (api_get_setting('registration', 'officialcode') == 'true' && api_get_setting('profile', 'officialcode') == 'true')
  161. $form->addRule('official_code', get_lang('ThisFieldIsRequired'), 'required');
  162. }
  163. // EMAIL
  164. $form->addElement('text', 'email', get_lang('Email'), array('size' => 40));
  165. if (api_get_setting('profile', 'email') !== 'true')
  166. $form->freeze('email');
  167. $form->applyFilter('email', 'stripslashes');
  168. $form->applyFilter('email', 'trim');
  169. if (api_get_setting('registration', 'email') == 'true')
  170. $form->addRule('email', get_lang('ThisFieldIsRequired'), 'required');
  171. $form->addRule('email', get_lang('EmailWrong'), 'email');
  172. // OPENID URL
  173. if(is_profile_editable() && api_get_setting('openid_authentication')=='true')
  174. {
  175. $form->addElement('text', 'openid', get_lang('OpenIDURL'), array('size' => 40));
  176. if (api_get_setting('profile', 'openid') !== 'true')
  177. $form->freeze('openid');
  178. $form->applyFilter('openid', 'trim');
  179. //if (api_get_setting('registration', 'openid') == 'true')
  180. // $form->addRule('openid', get_lang('ThisFieldIsRequired'), 'required');
  181. }
  182. // PHONE
  183. $form->addElement('text', 'phone', get_lang('phone'), array('size' => 20));
  184. if (api_get_setting('profile', 'phone') !== 'true')
  185. $form->freeze('phone');
  186. $form->applyFilter('phone', 'stripslashes');
  187. $form->applyFilter('phone', 'trim');
  188. /*if (api_get_setting('registration', 'phone') == 'true')
  189. $form->addRule('phone', get_lang('ThisFieldIsRequired'), 'required');
  190. $form->addRule('phone', get_lang('EmailWrong'), 'email');*/
  191. // PICTURE
  192. if (is_profile_editable() && api_get_setting('profile', 'picture') == 'true')
  193. {
  194. $form->addElement('file', 'picture', ($user_image != '' ? get_lang('UpdateImage') : get_lang('AddImage')));
  195. $form->add_progress_bar();
  196. if( strlen($user_data['picture_uri']) > 0)
  197. {
  198. $form->addElement('checkbox', 'remove_picture', null, get_lang('DelImage'));
  199. }
  200. $form->addRule('picture', get_lang('OnlyImagesAllowed'), 'mimetype', array('image/gif', 'image/jpeg', 'image/png','image/pjpeg'));
  201. }
  202. // LANGUAGE
  203. $form->addElement('select_language', 'language', get_lang('Language'));
  204. if (api_get_setting('profile', 'language') !== 'true')
  205. $form->freeze('language');
  206. // EXTENDED PROFILE
  207. if (api_get_setting('extended_profile') == 'true')
  208. {
  209. $form->addElement('static', null, '<em>'.get_lang('OptionalTextFields').'</em>');
  210. // MY COMPETENCES
  211. $form->add_html_editor('competences', get_lang('MyCompetences'), false);
  212. // MY DIPLOMAS
  213. $form->add_html_editor('diplomas', get_lang('MyDiplomas'), false);
  214. // WHAT I AM ABLE TO TEACH
  215. $form->add_html_editor('teach', get_lang('MyTeach'), false);
  216. // MY PRODUCTIONS
  217. $form->addElement('file', 'production', get_lang('MyProductions'));
  218. if ($production_list = UserManager::build_production_list($_user['user_id'],'',true))
  219. {
  220. $form->addElement('static', 'productions_list', null, $production_list);
  221. }
  222. // MY PERSONAL OPEN AREA
  223. $form->add_html_editor('openarea', get_lang('MyPersonalOpenArea'), false);
  224. $form->applyFilter(array('competences', 'diplomas', 'teach', 'openarea'), 'stripslashes');
  225. $form->applyFilter(array('competences', 'diplomas', 'teach'), 'trim'); // openarea is untrimmed for maximum openness
  226. }
  227. // PASSWORD
  228. if (is_profile_editable() && api_get_setting('profile', 'password') == 'true')
  229. {
  230. $form->addElement('static', null, null, '<em>'.get_lang('Enter2passToChange').'</em>');
  231. $form->addElement('password', 'password1', get_lang('Pass'), array('size' => 40));
  232. $form->addElement('password', 'password2', get_lang('Confirmation'), array('size' => 40));
  233. // user must enter identical password twice so we can prevent some user errors
  234. $form->addRule(array('password1', 'password2'), get_lang('PassTwo'), 'compare');
  235. if (CHECK_PASS_EASY_TO_FIND)
  236. $form->addRule('password1', get_lang('PassTooEasy').': '.api_generate_password(), 'callback', 'api_check_password');
  237. }
  238. // EXTRA FIELDS
  239. $extra = UserManager::get_extra_fields(0,50,5,'ASC');
  240. $extra_data = UserManager::get_extra_user_data(api_get_user_id(),true);
  241. foreach($extra as $id => $field_details)
  242. {
  243. if($field_details[6] == 0)
  244. {
  245. continue;
  246. }
  247. switch($field_details[2])
  248. {
  249. case USER_FIELD_TYPE_TEXT:
  250. $form->addElement('text', 'extra_'.$field_details[1], $field_details[3], array('size' => 40));
  251. $form->applyFilter('extra_'.$field_details[1], 'stripslashes');
  252. $form->applyFilter('extra_'.$field_details[1], 'trim');
  253. if ($field_details[7] == 0) $form->freeze('extra_'.$field_details[1]);
  254. break;
  255. case USER_FIELD_TYPE_TEXTAREA:
  256. $form->add_html_editor('extra_'.$field_details[1], $field_details[3], false);
  257. //$form->addElement('textarea', 'extra_'.$field_details[1], $field_details[3], array('size' => 80));
  258. $form->applyFilter('extra_'.$field_details[1], 'stripslashes');
  259. $form->applyFilter('extra_'.$field_details[1], 'trim');
  260. if ($field_details[7] == 0) $form->freeze('extra_'.$field_details[1]);
  261. break;
  262. case USER_FIELD_TYPE_RADIO:
  263. $group = array();
  264. foreach($field_details[8] as $option_id => $option_details)
  265. {
  266. $options[$option_details[1]] = $option_details[2];
  267. $group[] =& HTML_QuickForm::createElement('radio', 'extra_'.$field_details[1], $option_details[1],$option_details[2].'<br />',$option_details[1]);
  268. }
  269. $form->addGroup($group, 'extra_'.$field_details[1], $field_details[3], '');
  270. if ($field_details[7] == 0) $form->freeze('extra_'.$field_details[1]);
  271. break;
  272. case USER_FIELD_TYPE_SELECT:
  273. $options = array();
  274. foreach($field_details[8] as $option_id => $option_details)
  275. {
  276. $options[$option_details[1]] = $option_details[2];
  277. }
  278. $form->addElement('select','extra_'.$field_details[1],$field_details[3],$options,'');
  279. if ($field_details[7] == 0) $form->freeze('extra_'.$field_details[1]);
  280. break;
  281. case USER_FIELD_TYPE_SELECT_MULTIPLE:
  282. $options = array();
  283. foreach($field_details[8] as $option_id => $option_details)
  284. {
  285. $options[$option_details[1]] = $option_details[2];
  286. }
  287. $form->addElement('select','extra_'.$field_details[1],$field_details[3],$options,array('multiple' => 'multiple'));
  288. if ($field_details[7] == 0) $form->freeze('extra_'.$field_details[1]);
  289. break;
  290. case USER_FIELD_TYPE_DATE:
  291. $form->addElement('datepickerdate', 'extra_'.$field_details[1], $field_details[3]);
  292. $form->_elements[$form->_elementIndex['extra_'.$field_details[1]]]->setLocalOption('minYear',1900);
  293. if ($field_details[7] == 0) $form->freeze('extra_'.$field_details[1]);
  294. $form->applyFilter('theme', 'trim');
  295. break;
  296. case USER_FIELD_TYPE_DATETIME:
  297. $form->addElement('datepicker', 'extra_'.$field_details[1], $field_details[3]);
  298. if ($field_details[7] == 0) $form->freeze('extra_'.$field_details[1]);
  299. $form->applyFilter('theme', 'trim');
  300. break;
  301. case USER_FIELD_TYPE_DOUBLE_SELECT:
  302. foreach ($field_details[8] as $key=>$element)
  303. {
  304. if ($element[2][0] == '*')
  305. {
  306. $values['*'][$element[0]] = str_replace('*','',$element[2]);
  307. }
  308. else
  309. {
  310. $values[0][$element[0]] = $element[2];
  311. }
  312. }
  313. $group='';
  314. $group[] =& HTML_QuickForm::createElement('select', 'extra_'.$field_details[1],'',$values[0],'');
  315. $group[] =& HTML_QuickForm::createElement('select', 'extra_'.$field_details[1].'*','',$values['*'],'');
  316. $form->addGroup($group, 'extra_'.$field_details[1], $field_details[3], '&nbsp;');
  317. if ($field_details[7] == 0) $form->freeze('extra_'.$field_details[1]);
  318. // recoding the selected values for double : if the user has selected certain values, we have to assign them to the correct select form
  319. if (key_exists('extra_'.$field_details[1], $extra_data))
  320. {
  321. // exploding all the selected values (of both select forms)
  322. $selected_values = explode(';',$extra_data['extra_'.$field_details[1]]);
  323. $extra_data['extra_'.$field_details[1]] =array();
  324. // looping through the selected values and assigning the selected values to either the first or second select form
  325. foreach ($selected_values as $key=>$selected_value)
  326. {
  327. if (key_exists($selected_value,$values[0]))
  328. {
  329. $extra_data['extra_'.$field_details[1]]['extra_'.$field_details[1]] = $selected_value;
  330. }
  331. else
  332. {
  333. $extra_data['extra_'.$field_details[1]]['extra_'.$field_details[1].'*'] = $selected_value;
  334. }
  335. }
  336. }
  337. break;
  338. case USER_FIELD_TYPE_DIVIDER:
  339. $form->addElement('static',$field_details[1], '<br /><strong>'.$field_details[3].'</strong>');
  340. break;
  341. }
  342. }
  343. // SUBMIT
  344. if (is_profile_editable())
  345. {
  346. $form->addElement('submit', 'apply_change', get_lang('Ok'));
  347. }
  348. else
  349. {
  350. $form->freeze();
  351. }
  352. $user_data = array_merge($user_data,$extra_data);
  353. $form->setDefaults($user_data);
  354. /*
  355. ==============================================================================
  356. FUNCTIONS
  357. ==============================================================================
  358. */
  359. /*
  360. -----------------------------------------------------------
  361. LOGIC FUNCTIONS
  362. -----------------------------------------------------------
  363. */
  364. /**
  365. * Can a user edit his/her profile?
  366. *
  367. * @return boolean Editability of the profile
  368. */
  369. function is_profile_editable()
  370. {
  371. return $GLOBALS['profileIsEditable'];
  372. }
  373. /*
  374. -----------------------------------------------------------
  375. USER IMAGE FUNCTIONS
  376. -----------------------------------------------------------
  377. */
  378. /**
  379. * Upload a submitted user image.
  380. *
  381. * @param $user_id User id
  382. * @return The filename of the new picture or FALSE if the upload has failed
  383. */
  384. function upload_user_image($user_id)
  385. {
  386. /* Originally added by Miguel (miguel@cesga.es) - 2003-11-04
  387. * Code Refactoring by Hugues Peeters (hugues.peeters@claroline.net) - 2003-11-24
  388. * Moved inside a function and refactored by Thomas Corthals - 2005-11-04
  389. */
  390. $image_path = UserManager::get_user_picture_path_by_id($user_id,'system',true);
  391. $image_repository = $image_path['dir'];
  392. $existing_image = $image_path['file'];
  393. $file_extension = explode('.', $_FILES['picture']['name']);
  394. $file_extension = strtolower($file_extension[count($file_extension) - 1]);
  395. if (!file_exists($image_repository)) {
  396. mkpath($image_repository);
  397. }
  398. if ($existing_image != '') {
  399. if (KEEP_THE_NAME_WHEN_CHANGE_IMAGE) {
  400. $picture_filename = $existing_image;
  401. $old_picture_filename = 'saved_'.date('Y_m_d_H_i_s').'_'.uniqid('').'_'.$existing_image;
  402. } else {
  403. $old_picture_filename = $existing_image;
  404. $picture_filename = (PREFIX_IMAGE_FILENAME_WITH_UID ? 'u'.$user_id.'_' : '').uniqid('').'.'.$file_extension;
  405. }
  406. if (KEEP_THE_OLD_IMAGE_AFTER_CHANGE) {
  407. @rename($image_repository.$existing_image, $image_repository.$old_picture_filename);
  408. } else {
  409. @unlink($image_repository.$existing_image);
  410. }
  411. } else {
  412. $picture_filename = (PREFIX_IMAGE_FILENAME_WITH_UID ? $user_id.'_' : '').uniqid('').'.'.$file_extension;
  413. }
  414. // get the picture and resize it 200x200
  415. $temp = new image($_FILES['picture']['tmp_name']);
  416. $picture_infos=getimagesize($_FILES['picture']['tmp_name']);
  417. $thumbwidth = 200;
  418. if (empty($thumbwidth) or $thumbwidth==0) {
  419. $thumbwidth=200;
  420. }
  421. $new_height = round(($thumbwidth/$picture_infos[0])*$picture_infos[1]);
  422. $temp->resize($thumbwidth,$new_height,0);
  423. $type=$picture_infos[2];
  424. // original picture
  425. $big_temp = new image($_FILES['picture']['tmp_name']);
  426. switch (!empty($type)) {
  427. case 2 : $temp->send_image('JPG',$image_repository.$picture_filename);
  428. $big_temp->send_image('JPG',$image_repository.'big_'.$picture_filename);
  429. break;
  430. case 3 : $temp->send_image('PNG',$image_repository.$picture_filename);
  431. $big_temp->send_image('JPG',$image_repository.'big_'.$picture_filename);
  432. break;
  433. case 1 : $temp->send_image('GIF',$image_repository.$picture_filename);
  434. $big_temp->send_image('JPG',$image_repository.'big_'.$picture_filename);
  435. break;
  436. }
  437. return $picture_filename;
  438. }
  439. /**
  440. * Remove an existing user image.
  441. *
  442. * @param $user_id User id
  443. */
  444. function remove_user_image($user_id)
  445. {
  446. $image_path = UserManager::get_user_picture_path_by_id($user_id,'system');
  447. $image_repository = $image_path['dir'];
  448. $image = $image_path['file'];
  449. if ($image != '')
  450. {
  451. if (KEEP_THE_OLD_IMAGE_AFTER_CHANGE)
  452. {
  453. @rename($image_repository.$image, $image_repository.'deleted_'.date('Y_m_d_H_i_s').'_'.$image);
  454. }
  455. else
  456. {
  457. @unlink($image_repository.$image);
  458. }
  459. }
  460. }
  461. /*
  462. -----------------------------------------------------------
  463. PRODUCTIONS FUNCTIONS
  464. -----------------------------------------------------------
  465. */
  466. /**
  467. * Upload a submitted user production.
  468. *
  469. * @param $user_id User id
  470. * @return The filename of the new production or FALSE if the upload has failed
  471. */
  472. function upload_user_production($user_id)
  473. {
  474. $image_path = UserManager::get_user_picture_path_by_id($user_id,'system',true);
  475. $production_repository = $image_path['dir'].$user_id.'/';
  476. if (!file_exists($production_repository))
  477. {
  478. mkpath($production_repository);
  479. }
  480. $filename = replace_dangerous_char($_FILES['production']['name']);
  481. $filename = disable_dangerous_file($filename);
  482. if(filter_extension($filename))
  483. {
  484. if (@move_uploaded_file($_FILES['production']['tmp_name'], $production_repository.$filename))
  485. {
  486. return $filename;
  487. }
  488. }
  489. return false; // this should be returned if anything went wrong with the upload
  490. }
  491. /*
  492. ==============================================================================
  493. MAIN CODE
  494. ==============================================================================
  495. */
  496. $filtered_extension = false;
  497. $update_success = false;
  498. $upload_picture_success = false;
  499. $upload_production_success = false;
  500. if (!empty($_SESSION['profile_update']))
  501. {
  502. $update_success = ($_SESSION['profile_update'] == 'success');
  503. unset($_SESSION['profile_update']);
  504. }
  505. if (!empty($_SESSION['image_uploaded']))
  506. {
  507. $upload_picture_success = ($_SESSION['image_uploaded'] == 'success');
  508. unset($_SESSION['image_uploaded']);
  509. }
  510. if (!empty($_SESSION['production_uploaded']))
  511. {
  512. $upload_production_success = ($_SESSION['production_uploaded'] == 'success');
  513. unset($_SESSION['production_uploaded']);
  514. }
  515. elseif (isset($_POST['remove_production']))
  516. {
  517. foreach (array_keys($_POST['remove_production']) as $production)
  518. {
  519. UserManager::remove_user_production($_user['user_id'], urldecode($production));
  520. }
  521. if ($production_list = UserManager::build_production_list($_user['user_id'], true,true))
  522. $form->insertElementBefore($form->createElement('static', null, null, $production_list), 'productions_list');
  523. $form->removeElement('productions_list');
  524. $file_deleted = true;
  525. }
  526. elseif ($form->validate())
  527. {
  528. $user_data = $form->exportValues();
  529. // set password if a new one was provided
  530. if (!empty($user_data['password1']))
  531. $password = $user_data['password1'];
  532. // upload picture if a new one is provided
  533. if ($_FILES['picture']['size'])
  534. {
  535. if ($new_picture = upload_user_image($_user['user_id']))
  536. {
  537. $user_data['picture_uri'] = $new_picture;
  538. $_SESSION['image_uploaded'] = 'success';
  539. }
  540. }
  541. // remove existing picture if asked
  542. elseif (!empty($user_data['remove_picture']))
  543. {
  544. remove_user_image($_user['user_id']);
  545. $user_data['picture_uri'] = '';
  546. }
  547. // upload production if a new one is provided
  548. if ($_FILES['production']['size'])
  549. {
  550. $res = upload_user_production($_user['user_id']);
  551. if(!$res)
  552. {
  553. //it's a bit excessive to assume the extension is the reason why upload_user_production() returned false, but it's true in most cases
  554. $filtered_extension = true;
  555. }
  556. else
  557. {
  558. $_SESSION['production_uploaded'] = 'success';
  559. }
  560. }
  561. // remove values that shouldn't go in the database
  562. unset($user_data['password1'], $user_data['password2'], $user_data['MAX_FILE_SIZE'],
  563. $user_data['remove_picture'], $user_data['apply_change']);
  564. // Following RFC2396 (http://www.faqs.org/rfcs/rfc2396.html), a URI uses ':' as a reserved character
  565. // we can thus ensure the URL doesn't contain any scheme name by searching for ':' in the string
  566. $my_user_openid=isset($user_data['openid']) ? $user_data['openid'] : '';
  567. if(!preg_match('/^[^:]*:\/\/.*$/',$my_user_openid))
  568. { //ensure there is at least a http:// scheme in the URI provided
  569. $user_data['openid'] = 'http://'.$my_user_openid;
  570. }
  571. $extras = array();
  572. // build SQL query
  573. $sql = "UPDATE $table_user SET";
  574. foreach($user_data as $key => $value)
  575. {
  576. if(substr($key,0,6)=='extra_') //an extra field
  577. {
  578. $extras[substr($key,6)] = $value;
  579. }
  580. else
  581. {
  582. $sql .= " $key = '".Database::escape_string($value)."',";
  583. }
  584. }
  585. if (isset($password))
  586. {
  587. if ($userPasswordCrypted)
  588. {
  589. $sql .= " password = MD5('".Database::escape_string($password)."')";
  590. }
  591. else
  592. {
  593. $sql .= " password = '".Database::escape_string($password)."'";
  594. }
  595. }
  596. else // remove trailing , from the query we have so far
  597. {
  598. $sql = rtrim($sql, ',');
  599. }
  600. $sql .= " WHERE user_id = '".$_user['user_id']."'";
  601. api_sql_query($sql, __FILE__, __LINE__);
  602. //update the extra fields
  603. foreach($extras as $key=>$value)
  604. {
  605. $myres = UserManager::update_extra_field_value($_user['user_id'],$key,$value);
  606. }
  607. // re-init the system to take new settings into account
  608. $uidReset = true;
  609. include (api_get_path(INCLUDE_PATH).'local.inc.php');
  610. $_SESSION['profile_update'] = 'success';
  611. header("Location: ".api_get_self()."?{$_SERVER['QUERY_STRING']}".($filtered_extension && strstr($_SERVER['QUERY_STRING'],'&fe=1')===false?'&fe=1':''));
  612. exit;
  613. }
  614. /*
  615. ==============================================================================
  616. MAIN DISPLAY SECTION
  617. ==============================================================================
  618. */
  619. Display :: display_header(get_lang('ModifyProfile'));
  620. if (!empty($file_deleted))
  621. {
  622. Display :: display_confirmation_message(get_lang('FileDeleted'),false);
  623. }
  624. elseif (!empty($update_success))
  625. {
  626. $message=get_lang('ProfileReg');
  627. if ($upload_picture_success == true)
  628. {
  629. $message.='<br /> '.get_lang('PictureUploaded');
  630. }
  631. if ($upload_production_success == true)
  632. {
  633. $message.='<br />'.get_lang('ProductionUploaded');
  634. }
  635. Display :: display_confirmation_message($message,false);
  636. }
  637. if(!empty($warning_msg))
  638. {
  639. Display :: display_warning_message($warning_msg,false);
  640. }
  641. //User picture size is calculated from SYSTEM path
  642. $image_syspath = UserManager::get_user_picture_path_by_id($userid,'system',false,true);
  643. $image_size = getimagesize($image_syspath['dir'].$image_syspath['file']);
  644. //Web path
  645. $image_path = UserManager::get_user_picture_path_by_id($_user['user_id'],'web',false,true);
  646. $image_dir = $image_path['dir'];
  647. $image = $image_path['file'];
  648. $image_file = $image_dir.$image;
  649. $img_attributes = 'src="'.$image_file.'?rand='.time().'" '
  650. .'alt="'.$user_data['lastname'].' '.$user_data['firstname'].'" '
  651. .'style="float:'.($text_dir == 'rtl' ? 'left' : 'right').'; padding:5px;" ';
  652. if ($image_size[0] > 300) {
  653. //limit display width to 300px
  654. $img_attributes .= 'width="300" ';
  655. }
  656. // get the path,width and height from original picture
  657. $big_image = $image_dir.'big_'.$image;
  658. $big_image_size = @getimagesize($big_image);
  659. $big_image_width= $big_image_size[0];
  660. $big_image_height= $big_image_size[1];
  661. echo '<input type="image" '.$img_attributes.' onclick="return show_image(\''.$big_image.'\',\''.$big_image_width.'\',\''.$big_image_height.'\');"/>';
  662. $form->display();
  663. Display :: display_footer();
  664. ?>