diff --git a/README.md b/README.md index fdd20df7..30c52039 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ Please visit https://engelsystem.de for a feature list. ## Installation ### Requirements: - * PHP >= 5.6.4, PHP >= 7.0.0 recommended + * PHP >= 7.0.0 * MySQL-Server >= 5.5.x * Webserver, i.e. lighttpd, nginx, or Apache diff --git a/composer.json b/composer.json index d2e0108b..45dce626 100644 --- a/composer.json +++ b/composer.json @@ -14,12 +14,13 @@ } ], "require": { - "php": ">=5.6.4", + "php": ">=7.0.0", "erusev/parsedown": "1.6.*", - "twbs/bootstrap": "^3.3" + "twbs/bootstrap": "^3.3", + "symfony/http-foundation": "^3.3" }, "require-dev": { - "phpunit/phpunit": "^6.2" + "phpunit/phpunit": "^6.3" }, "autoload": { "psr-4": { diff --git a/config/config.default.php b/config/config.default.php index ffa030db..419b02d1 100644 --- a/config/config.default.php +++ b/config/config.default.php @@ -4,7 +4,7 @@ return [ // MySQL-Connection Settings - 'database' => [ + 'database' => [ 'host' => 'localhost', 'user' => 'root', 'pw' => '', @@ -12,28 +12,28 @@ return [ ], // For accessing stats - 'api_key' => '', + 'api_key' => '', // Enable maintenance mode (show a static page) - 'maintenance' => false, + 'maintenance' => false, // Set to development to enable debugging messages - 'environment' => 'production', + 'environment' => 'production', // URL to the angel faq and job description - 'faq_url' => 'https://events.ccc.de/congress/2013/wiki/Static:Volunteers', + 'faq_url' => 'https://events.ccc.de/congress/2013/wiki/Static:Volunteers', // Contact email address, linked on every page - 'contact_email' => 'mailto:ticket@c3heaven.de', + 'contact_email' => 'mailto:ticket@c3heaven.de', // From address of all emails - 'no_reply_email' => 'noreply@engelsystem.de', + 'no_reply_email' => 'noreply@engelsystem.de', // Default theme, 1=style1.css - 'theme' => 1, + 'theme' => 1, // Available themes - 'available_themes' => [ + 'available_themes' => [ '4' => 'Engelsystem 33c3 (2016)', '3' => 'Engelsystem 32c3 (2015)', '2' => 'Engelsystem cccamp15', @@ -42,10 +42,13 @@ return [ ], // Number of News shown on one site - 'display_news' => 6, + 'display_news' => 6, + + // Only arrived angels can sign up for shifts + 'signup_requires_arrival' => false, // Anzahl Stunden bis zum Austragen eigener Schichten - 'last_unsubscribe' => 3, + 'last_unsubscribe' => 3, // Setzt den zu verwendenden Crypto-Algorithmus (entsprechend der Dokumentation von crypt()). // Falls ein Benutzerpasswort in einem anderen Format gespeichert ist, @@ -55,7 +58,7 @@ return [ // Blowfish '$2y$13' // SHA-256 '$5$rounds=5000' // SHA-512 '$6$rounds=5000' - 'crypt_alg' => '$6$rounds=5000', // SHA-512 + 'crypt_alg' => '$6$rounds=5000', 'min_password_length' => 8, diff --git a/db/update.sql b/db/update.sql index dd203a86..5d93e230 100644 --- a/db/update.sql +++ b/db/update.sql @@ -8,19 +8,23 @@ ALTER TABLE `User` ADD COLUMN `email_by_human_allowed` BOOLEAN NOT NULL; -- No Self Sign Up for some Angel Types ALTER TABLE AngelTypes ADD no_self_signup TINYINT(1) NOT NULL; -ALTER TABLE `AngelTypes` - ADD `contact_user_id` INT NULL, - ADD `contact_name` VARCHAR(250) NULL, - ADD `contact_dect` VARCHAR(5) NULL, - ADD `contact_email` VARCHAR(250) NULL, +ALTER TABLE `AngelTypes` + ADD `contact_user_id` INT NULL, + ADD `contact_name` VARCHAR(250) NULL, + ADD `contact_dect` VARCHAR(5) NULL, + ADD `contact_email` VARCHAR(250) NULL, ADD INDEX (`contact_user_id`); -ALTER TABLE `AngelTypes` +ALTER TABLE `AngelTypes` ADD FOREIGN KEY (`contact_user_id`) REFERENCES `User`(`UID`) ON DELETE SET NULL ON UPDATE CASCADE; - INSERT INTO `Privileges` (`id`, `name`, `desc`) VALUES (NULL, 'shiftentry_edit_angeltype_supporter', 'If user with this privilege is angeltype supporter, he can put users in shifts for their angeltype'); - -- DB Performance ALTER TABLE `Shifts` ADD INDEX(`start`); -ALTER TABLE `NeededAngelTypes` ADD INDEX(`count`); \ No newline at end of file +ALTER TABLE `NeededAngelTypes` ADD INDEX(`count`); + +-- Security +UPDATE `Groups` SET UID = UID * 10; +INSERT INTO `Groups` (Name, UID) VALUES ('News Admin', -65); +INSERT INTO `Privileges` (id, name, `desc`) VALUES (42, 'admin_news_html', 'Use HTML in news'); +INSERT INTO `GroupPrivileges` (group_id, privilege_id) VALUES (-65, 14), (-65, 42); diff --git a/includes/autoload.php b/includes/autoload.php new file mode 100644 index 00000000..f51f89e4 --- /dev/null +++ b/includes/autoload.php @@ -0,0 +1,9 @@ + 'view', 'angeltype_id' => $angeltype_id]); } /** @@ -127,7 +127,7 @@ function angeltype_edit_controller() if (!$supporter_mode) { if ($request->has('name')) { - $result = AngelType_validate_name($request->input('name'), $angeltype); + $result = AngelType_validate_name($request->postData('name'), $angeltype); $angeltype['name'] = $result->getValue(); if (!$result->isValid()) { $valid = false; @@ -211,17 +211,21 @@ function angeltypes_list_controller() foreach ($angeltypes as &$angeltype) { $actions = [ - button(page_link_to('angeltypes') . '&action=view&angeltype_id=' . $angeltype['id'], _('view'), 'btn-xs') + button( + page_link_to('angeltypes', ['action' => 'view', 'angeltype_id' => $angeltype['id']]), + _('view'), + 'btn-xs' + ) ]; if (in_array('admin_angel_types', $privileges)) { $actions[] = button( - page_link_to('angeltypes') . '&action=edit&angeltype_id=' . $angeltype['id'], + page_link_to('angeltypes', ['action' => 'edit', 'angeltype_id' => $angeltype['id']]), _('edit'), 'btn-xs' ); $actions[] = button( - page_link_to('angeltypes') . '&action=delete&angeltype_id=' . $angeltype['id'], + page_link_to('angeltypes', ['action' => 'delete', 'angeltype_id' => $angeltype['id']]), _('delete'), 'btn-xs' ); @@ -230,13 +234,15 @@ function angeltypes_list_controller() $angeltype['membership'] = AngelType_render_membership($angeltype); if ($angeltype['user_angeltype_id'] != null) { $actions[] = button( - page_link_to('user_angeltypes') . '&action=delete&user_angeltype_id=' . $angeltype['user_angeltype_id'], + page_link_to('user_angeltypes', + ['action' => 'delete', 'user_angeltype_id' => $angeltype['user_angeltype_id']] + ), _('leave'), 'btn-xs' ); } else { $actions[] = button( - page_link_to('user_angeltypes') . '&action=add&angeltype_id=' . $angeltype['id'], + page_link_to('user_angeltypes', ['action' => 'add', 'angeltype_id' => $angeltype['id']]), _('join'), 'btn-xs' ); @@ -245,7 +251,11 @@ function angeltypes_list_controller() $angeltype['restricted'] = $angeltype['restricted'] ? glyph('lock') : ''; $angeltype['no_self_signup'] = $angeltype['no_self_signup'] ? '' : glyph('share'); - $angeltype['name'] = '' . $angeltype['name'] . ''; + $angeltype['name'] = '' + . $angeltype['name'] + . ''; $angeltype['actions'] = table_buttons($actions); } diff --git a/includes/controller/rooms_controller.php b/includes/controller/rooms_controller.php index 6d0864ae..d6da9709 100644 --- a/includes/controller/rooms_controller.php +++ b/includes/controller/rooms_controller.php @@ -1,4 +1,5 @@ 'view', 'room_id' => $room['RID']]); } /** @@ -97,7 +98,7 @@ function room_link($room) */ function room_edit_link($room) { - return page_link_to('admin_rooms') . '&show=edit&id=' . $room['RID']; + return page_link_to('admin_rooms', ['show' => 'edit', 'id' => $room['RID']]); } /** diff --git a/includes/controller/shift_entries_controller.php b/includes/controller/shift_entries_controller.php index 72189869..150db2e9 100644 --- a/includes/controller/shift_entries_controller.php +++ b/includes/controller/shift_entries_controller.php @@ -13,7 +13,7 @@ function shift_entry_add_controller() $request = request(); $shift_id = 0; - if ($request->has('shift_id') && preg_match('/^\d*$/', $request->input('shift_id'))) { + if ($request->has('shift_id') && preg_match('/^\d+$/', $request->input('shift_id'))) { $shift_id = $request->input('shift_id'); } else { redirect(page_link_to('user_shifts')); @@ -27,13 +27,13 @@ function shift_entry_add_controller() } $shift = Shift($shift_id); - $shift['Name'] = $room_array[$shift['RID']]; if ($shift == null) { redirect(page_link_to('user_shifts')); } + $shift['Name'] = $room_array[$shift['RID']]; $type_id = 0; - if ($request->has('type_id') && preg_match('/^\d*$/', $request->input('type_id'))) { + if ($request->has('type_id') && preg_match('/^\d+$/', $request->input('type_id'))) { $type_id = $request->input('type_id'); } else { redirect(page_link_to('user_shifts')); @@ -64,7 +64,7 @@ function shift_entry_add_controller() if ( $request->has('user_id') - && preg_match('/^\d*$/', $request->input('user_id')) + && preg_match('/^\d+$/', $request->input('user_id')) && ( in_array('user_shifts_admin', $privileges) || in_array('shiftentry_edit_angeltype_supporter', $privileges) diff --git a/includes/controller/shifts_controller.php b/includes/controller/shifts_controller.php index 96f12baa..70011821 100644 --- a/includes/controller/shifts_controller.php +++ b/includes/controller/shifts_controller.php @@ -1,4 +1,5 @@ 'view']; if (isset($shift['SID'])) { - $link .= '&shift_id=' . $shift['SID']; + $parameters['shift_id'] = $shift['SID']; } + + $link = page_link_to('shifts', $parameters); + return $link; } @@ -20,7 +24,7 @@ function shift_link($shift) */ function shift_delete_link($shift) { - return page_link_to('user_shifts') . '&delete_shift=' . $shift['SID']; + return page_link_to('user_shifts', ['delete_shift' => $shift['SID']]); } /** @@ -29,7 +33,7 @@ function shift_delete_link($shift) */ function shift_edit_link($shift) { - return page_link_to('user_shifts') . '&edit_shift=' . $shift['SID']; + return page_link_to('user_shifts', ['edit_shift' => $shift['SID']]); } /** @@ -61,7 +65,7 @@ function shift_edit_controller() $angeltypes = select_array(AngelTypes(), 'id', 'name'); $shifttypes = select_array(ShiftTypes(), 'id', 'name'); - $needed_angel_types = select_array(NeededAngelTypes_by_shift($shift_id), 'id', 'count'); + $needed_angel_types = select_array(NeededAngelTypes_by_shift($shift_id), 'angel_type_id', 'count'); foreach (array_keys($angeltypes) as $angeltype_id) { if (!isset($needed_angel_types[$angeltype_id])) { $needed_angel_types[$angeltype_id] = 0; @@ -116,15 +120,20 @@ function shift_edit_controller() $msg .= error(_('The ending time has to be after the starting time.'), true); } - foreach ($needed_angel_types as $needed_angeltype_id => $needed_angeltype_name) { - if ($request->has('type_' . $needed_angeltype_id) && test_request_int('type_' . $needed_angeltype_id)) { - $needed_angel_types[$needed_angeltype_id] = trim($request->input('type_' . $needed_angeltype_id)); - } else { - $valid = false; - $msg .= error(sprintf( - _('Please check your input for needed angels of type %s.'), - $needed_angeltype_name - ), true); + foreach ($needed_angel_types as $needed_angeltype_id => $count) { + $needed_angel_types[$needed_angeltype_id] = 0; + + $queryKey = 'type_' . $needed_angeltype_id; + if ($request->has($queryKey)) { + if (test_request_int($queryKey)) { + $needed_angel_types[$needed_angeltype_id] = trim($request->input($queryKey)); + } else { + $valid = false; + $msg .= error(sprintf( + _('Please check your input for needed angels of type %s.'), + $angeltypes[$needed_angeltype_id] + ), true); + } } } @@ -195,7 +204,7 @@ function shift_delete_controller() } // Schicht komplett löschen (nur für admins/user mit user_shifts_admin privileg) - if (!$request->has('delete_shift') || !preg_match('/^\d*$/', $request->input('delete_shift'))) { + if (!$request->has('delete_shift') || !preg_match('/^\d+$/', $request->input('delete_shift'))) { redirect(page_link_to('user_shifts')); } $shift_id = $request->input('delete_shift'); @@ -225,7 +234,9 @@ function shift_delete_controller() date('Y-m-d H:i', $shift['start']), date('H:i', $shift['end']) ), true), - '' . _('delete') . '' + '' . _('delete') . '' ]); } @@ -308,8 +319,6 @@ function shifts_controller() /** * Redirects the user to his next shift. - * - * @return false */ function shift_next_controller() { diff --git a/includes/controller/shifttypes_controller.php b/includes/controller/shifttypes_controller.php index 9cf292ee..4e7cd92c 100644 --- a/includes/controller/shifttypes_controller.php +++ b/includes/controller/shifttypes_controller.php @@ -6,7 +6,7 @@ */ function shifttype_link($shifttype) { - return page_link_to('shifttypes') . '&action=view&shifttype_id=' . $shifttype['id']; + return page_link_to('shifttypes', ['action' => 'view', 'shifttype_id' => $shifttype['id']]); } /** @@ -100,7 +100,7 @@ function shifttype_edit_controller() engelsystem_log('Created shifttype ' . $name); success(_('Created shifttype.')); } - redirect(page_link_to('shifttypes') . '&action=view&shifttype_id=' . $shifttype_id); + redirect(page_link_to('shifttypes', ['action' => 'view', 'shifttype_id' => $shifttype_id])); } } diff --git a/includes/controller/user_angeltypes_controller.php b/includes/controller/user_angeltypes_controller.php index f212716d..fa4f5777 100644 --- a/includes/controller/user_angeltypes_controller.php +++ b/includes/controller/user_angeltypes_controller.php @@ -17,8 +17,7 @@ function user_angeltypes_unconfirmed_hint() $unconfirmed_links = []; foreach ($unconfirmed_user_angeltypes as $user_angeltype) { $unconfirmed_links[] = '' . $user_angeltype['name'] . ' (+' . $user_angeltype['count'] . ')' . ''; @@ -61,7 +60,7 @@ function user_angeltypes_delete_all_controller() engelsystem_log(sprintf('Denied all users for angeltype %s', AngelType_name_render($angeltype))); success(sprintf(_('Denied all users for angeltype %s.'), AngelType_name_render($angeltype))); - redirect(page_link_to('angeltypes') . '&action=view&angeltype_id=' . $angeltype['id']); + redirect(page_link_to('angeltypes', ['action' => 'view', 'angeltype_id' => $angeltype['id']])); } return [ @@ -107,7 +106,7 @@ function user_angeltypes_confirm_all_controller() engelsystem_log(sprintf('Confirmed all users for angeltype %s', AngelType_name_render($angeltype))); success(sprintf(_('Confirmed all users for angeltype %s.'), AngelType_name_render($angeltype))); - redirect(page_link_to('angeltypes') . '&action=view&angeltype_id=' . $angeltype['id']); + redirect(page_link_to('angeltypes', ['action' => 'view', 'angeltype_id' => $angeltype['id']])); } return [ @@ -167,7 +166,7 @@ function user_angeltype_confirm_controller() User_Nick_render($user_source), AngelType_name_render($angeltype) )); - redirect(page_link_to('angeltypes') . '&action=view&angeltype_id=' . $angeltype['id']); + redirect(page_link_to('angeltypes', ['action' => 'view', 'angeltype_id' => $angeltype['id']])); } return [ @@ -221,7 +220,7 @@ function user_angeltype_delete_controller() engelsystem_log($success_message); success($success_message); - redirect(page_link_to('angeltypes') . '&action=view&angeltype_id=' . $angeltype['id']); + redirect(page_link_to('angeltypes', ['action' => 'view', 'angeltype_id' => $angeltype['id']])); } return [ @@ -287,7 +286,7 @@ function user_angeltype_update_controller() engelsystem_log($success_message); success($success_message); - redirect(page_link_to('angeltypes') . '&action=view&angeltype_id=' . $angeltype['id']); + redirect(page_link_to('angeltypes', ['action' => 'view', 'angeltype_id' => $angeltype['id']])); } return [ @@ -341,7 +340,7 @@ function user_angeltype_add_controller() AngelType_name_render($angeltype) )); - redirect(page_link_to('angeltypes') . '&action=view&angeltype_id=' . $angeltype['id']); + redirect(page_link_to('angeltypes', ['action' => 'view', 'angeltype_id' => $angeltype['id']])); } } @@ -383,7 +382,7 @@ function user_angeltype_join_controller($angeltype) )); } - redirect(page_link_to('angeltypes') . '&action=view&angeltype_id=' . $angeltype['id']); + redirect(page_link_to('angeltypes', ['action' => 'view', 'angeltype_id' => $angeltype['id']])); } return [ diff --git a/includes/controller/user_driver_licenses_controller.php b/includes/controller/user_driver_licenses_controller.php index fef278dd..3db31eff 100644 --- a/includes/controller/user_driver_licenses_controller.php +++ b/includes/controller/user_driver_licenses_controller.php @@ -63,7 +63,7 @@ function user_driver_license_edit_link($user = null) if ($user == null) { return page_link_to('user_driver_licenses'); } - return page_link_to('user_driver_licenses') . '&user_id=' . $user['UID']; + return page_link_to('user_driver_licenses', ['user_id' => $user['UID']]); } /** diff --git a/includes/controller/users_controller.php b/includes/controller/users_controller.php index 832d93f0..e8cb1b27 100644 --- a/includes/controller/users_controller.php +++ b/includes/controller/users_controller.php @@ -47,7 +47,7 @@ function user_delete_controller() $request = request(); if ($request->has('user_id')) { - $user_source = User($request->get('user_id')); + $user_source = User($request->query->get('user_id')); } else { $user_source = $user; } @@ -68,7 +68,7 @@ function user_delete_controller() if ( !( $request->has('password') - && verify_password($request->post('password'), $user['Passwort'], $user['UID']) + && verify_password($request->postData('password'), $user['Passwort'], $user['UID']) ) ) { $valid = false; @@ -106,7 +106,7 @@ function users_link() */ function user_edit_link($user) { - return page_link_to('admin_user') . '&user_id=' . $user['UID']; + return page_link_to('admin_user', ['user_id' => $user['UID']]); } /** @@ -115,7 +115,7 @@ function user_edit_link($user) */ function user_delete_link($user) { - return page_link_to('users') . '&action=delete&user_id=' . $user['UID']; + return page_link_to('users', ['action' => 'delete', 'user_id' => $user['UID']]); } /** @@ -124,7 +124,7 @@ function user_delete_link($user) */ function user_link($user) { - return page_link_to('users') . '&action=view&user_id=' . $user['UID']; + return page_link_to('users', ['action' => 'view', 'user_id' => $user['UID']]); } /** @@ -297,9 +297,9 @@ function user_password_recovery_set_new_controller() if ( $request->has('password') - && strlen($request->post('password')) >= config('min_password_length') + && strlen($request->postData('password')) >= config('min_password_length') ) { - if ($request->post('password') != $request->post('password2')) { + if ($request->postData('password') != $request->postData('password2')) { $valid = false; error(_('Your passwords don\'t match.')); } @@ -309,7 +309,7 @@ function user_password_recovery_set_new_controller() } if ($valid) { - set_password($user_source['UID'], $request->post('password')); + set_password($user_source['UID'], $request->postData('password')); success(_('Password saved.')); redirect(page_link_to('login')); } @@ -353,7 +353,7 @@ function user_password_recovery_start_controller() _('Password recovery'), sprintf( _('Please visit %s to recover your password.'), - page_link_to_absolute('user_password_recovery') . '&token=' . $token + page_link_to('user_password_recovery', ['token' => $token]) ) ); success(_('We sent an email containing your password recovery link.')); diff --git a/includes/engelsystem_provider.php b/includes/engelsystem_provider.php index ff682871..aed331d4 100644 --- a/includes/engelsystem_provider.php +++ b/includes/engelsystem_provider.php @@ -6,16 +6,13 @@ use Engelsystem\Exceptions\Handler as ExceptionHandler; use Engelsystem\Http\Request; use Engelsystem\Renderer\HtmlEngine; use Engelsystem\Renderer\Renderer; +use Symfony\Component\HttpFoundation\Session\Session; /** * This file includes all needed functions, connects to the db etc. */ -if (!is_readable(__DIR__ . '/../vendor/autoload.php')) { - die('Please run composer.phar install'); -} -require __DIR__ . '/../vendor/autoload.php'; - +require_once __DIR__ . '/autoload.php'; /** * Load configuration @@ -36,9 +33,10 @@ date_default_timezone_set($config->get('timezone')); /** * Initialize Request + * + * @var Request $request */ -$request = new Request(); -$request->create(); +$request = Request::createFromGlobals(); $request::setInstance($request); /** @@ -86,88 +84,95 @@ Db::getPdo()->setAttribute(PDO::ATTR_EMULATE_PREPARES, false); /** * Include legacy code */ -require_once realpath(__DIR__ . '/../includes/sys_auth.php'); -require_once realpath(__DIR__ . '/../includes/sys_form.php'); -require_once realpath(__DIR__ . '/../includes/sys_log.php'); -require_once realpath(__DIR__ . '/../includes/sys_menu.php'); -require_once realpath(__DIR__ . '/../includes/sys_page.php'); -require_once realpath(__DIR__ . '/../includes/sys_template.php'); +$includeFiles = [ + __DIR__ . '/../includes/sys_auth.php', + __DIR__ . '/../includes/sys_form.php', + __DIR__ . '/../includes/sys_log.php', + __DIR__ . '/../includes/sys_menu.php', + __DIR__ . '/../includes/sys_page.php', + __DIR__ . '/../includes/sys_template.php', -require_once realpath(__DIR__ . '/../includes/model/AngelType_model.php'); -require_once realpath(__DIR__ . '/../includes/model/EventConfig_model.php'); -require_once realpath(__DIR__ . '/../includes/model/LogEntries_model.php'); -require_once realpath(__DIR__ . '/../includes/model/Message_model.php'); -require_once realpath(__DIR__ . '/../includes/model/NeededAngelTypes_model.php'); -require_once realpath(__DIR__ . '/../includes/model/Room_model.php'); -require_once realpath(__DIR__ . '/../includes/model/ShiftEntry_model.php'); -require_once realpath(__DIR__ . '/../includes/model/Shifts_model.php'); -require_once realpath(__DIR__ . '/../includes/model/ShiftsFilter.php'); -require_once realpath(__DIR__ . '/../includes/model/ShiftSignupState.php'); -require_once realpath(__DIR__ . '/../includes/model/ShiftTypes_model.php'); -require_once realpath(__DIR__ . '/../includes/model/UserAngelTypes_model.php'); -require_once realpath(__DIR__ . '/../includes/model/UserDriverLicenses_model.php'); -require_once realpath(__DIR__ . '/../includes/model/UserGroups_model.php'); -require_once realpath(__DIR__ . '/../includes/model/User_model.php'); -require_once realpath(__DIR__ . '/../includes/model/ValidationResult.php'); + __DIR__ . '/../includes/model/AngelType_model.php', + __DIR__ . '/../includes/model/EventConfig_model.php', + __DIR__ . '/../includes/model/LogEntries_model.php', + __DIR__ . '/../includes/model/Message_model.php', + __DIR__ . '/../includes/model/NeededAngelTypes_model.php', + __DIR__ . '/../includes/model/Room_model.php', + __DIR__ . '/../includes/model/ShiftEntry_model.php', + __DIR__ . '/../includes/model/Shifts_model.php', + __DIR__ . '/../includes/model/ShiftsFilter.php', + __DIR__ . '/../includes/model/ShiftSignupState.php', + __DIR__ . '/../includes/model/ShiftTypes_model.php', + __DIR__ . '/../includes/model/UserAngelTypes_model.php', + __DIR__ . '/../includes/model/UserDriverLicenses_model.php', + __DIR__ . '/../includes/model/UserGroups_model.php', + __DIR__ . '/../includes/model/User_model.php', + __DIR__ . '/../includes/model/ValidationResult.php', -require_once realpath(__DIR__ . '/../includes/view/AngelTypes_view.php'); -require_once realpath(__DIR__ . '/../includes/view/EventConfig_view.php'); -require_once realpath(__DIR__ . '/../includes/view/Questions_view.php'); -require_once realpath(__DIR__ . '/../includes/view/Rooms_view.php'); -require_once realpath(__DIR__ . '/../includes/view/ShiftCalendarLane.php'); -require_once realpath(__DIR__ . '/../includes/view/ShiftCalendarRenderer.php'); -require_once realpath(__DIR__ . '/../includes/view/ShiftCalendarShiftRenderer.php'); -require_once realpath(__DIR__ . '/../includes/view/ShiftsFilterRenderer.php'); -require_once realpath(__DIR__ . '/../includes/view/Shifts_view.php'); -require_once realpath(__DIR__ . '/../includes/view/ShiftEntry_view.php'); -require_once realpath(__DIR__ . '/../includes/view/ShiftTypes_view.php'); -require_once realpath(__DIR__ . '/../includes/view/UserAngelTypes_view.php'); -require_once realpath(__DIR__ . '/../includes/view/UserDriverLicenses_view.php'); -require_once realpath(__DIR__ . '/../includes/view/UserHintsRenderer.php'); -require_once realpath(__DIR__ . '/../includes/view/User_view.php'); + __DIR__ . '/../includes/view/AngelTypes_view.php', + __DIR__ . '/../includes/view/EventConfig_view.php', + __DIR__ . '/../includes/view/Questions_view.php', + __DIR__ . '/../includes/view/Rooms_view.php', + __DIR__ . '/../includes/view/ShiftCalendarLane.php', + __DIR__ . '/../includes/view/ShiftCalendarRenderer.php', + __DIR__ . '/../includes/view/ShiftCalendarShiftRenderer.php', + __DIR__ . '/../includes/view/ShiftsFilterRenderer.php', + __DIR__ . '/../includes/view/Shifts_view.php', + __DIR__ . '/../includes/view/ShiftEntry_view.php', + __DIR__ . '/../includes/view/ShiftTypes_view.php', + __DIR__ . '/../includes/view/UserAngelTypes_view.php', + __DIR__ . '/../includes/view/UserDriverLicenses_view.php', + __DIR__ . '/../includes/view/UserHintsRenderer.php', + __DIR__ . '/../includes/view/User_view.php', -require_once realpath(__DIR__ . '/../includes/controller/angeltypes_controller.php'); -require_once realpath(__DIR__ . '/../includes/controller/event_config_controller.php'); -require_once realpath(__DIR__ . '/../includes/controller/rooms_controller.php'); -require_once realpath(__DIR__ . '/../includes/controller/shift_entries_controller.php'); -require_once realpath(__DIR__ . '/../includes/controller/shifts_controller.php'); -require_once realpath(__DIR__ . '/../includes/controller/shifttypes_controller.php'); -require_once realpath(__DIR__ . '/../includes/controller/users_controller.php'); -require_once realpath(__DIR__ . '/../includes/controller/user_angeltypes_controller.php'); -require_once realpath(__DIR__ . '/../includes/controller/user_driver_licenses_controller.php'); + __DIR__ . '/../includes/controller/angeltypes_controller.php', + __DIR__ . '/../includes/controller/event_config_controller.php', + __DIR__ . '/../includes/controller/rooms_controller.php', + __DIR__ . '/../includes/controller/shift_entries_controller.php', + __DIR__ . '/../includes/controller/shifts_controller.php', + __DIR__ . '/../includes/controller/shifttypes_controller.php', + __DIR__ . '/../includes/controller/users_controller.php', + __DIR__ . '/../includes/controller/user_angeltypes_controller.php', + __DIR__ . '/../includes/controller/user_driver_licenses_controller.php', -require_once realpath(__DIR__ . '/../includes/helper/graph_helper.php'); -require_once realpath(__DIR__ . '/../includes/helper/internationalization_helper.php'); -require_once realpath(__DIR__ . '/../includes/helper/message_helper.php'); -require_once realpath(__DIR__ . '/../includes/helper/error_helper.php'); -require_once realpath(__DIR__ . '/../includes/helper/email_helper.php'); + __DIR__ . '/../includes/helper/graph_helper.php', + __DIR__ . '/../includes/helper/internationalization_helper.php', + __DIR__ . '/../includes/helper/message_helper.php', + __DIR__ . '/../includes/helper/error_helper.php', + __DIR__ . '/../includes/helper/email_helper.php', -require_once realpath(__DIR__ . '/../includes/mailer/shifts_mailer.php'); -require_once realpath(__DIR__ . '/../includes/mailer/users_mailer.php'); + __DIR__ . '/../includes/mailer/shifts_mailer.php', + __DIR__ . '/../includes/mailer/users_mailer.php', -require_once realpath(__DIR__ . '/../includes/pages/admin_active.php'); -require_once realpath(__DIR__ . '/../includes/pages/admin_arrive.php'); -require_once realpath(__DIR__ . '/../includes/pages/admin_free.php'); -require_once realpath(__DIR__ . '/../includes/pages/admin_groups.php'); -require_once realpath(__DIR__ . '/../includes/pages/admin_import.php'); -require_once realpath(__DIR__ . '/../includes/pages/admin_log.php'); -require_once realpath(__DIR__ . '/../includes/pages/admin_questions.php'); -require_once realpath(__DIR__ . '/../includes/pages/admin_rooms.php'); -require_once realpath(__DIR__ . '/../includes/pages/admin_shifts.php'); -require_once realpath(__DIR__ . '/../includes/pages/admin_user.php'); -require_once realpath(__DIR__ . '/../includes/pages/guest_login.php'); -require_once realpath(__DIR__ . '/../includes/pages/user_messages.php'); -require_once realpath(__DIR__ . '/../includes/pages/user_myshifts.php'); -require_once realpath(__DIR__ . '/../includes/pages/user_news.php'); -require_once realpath(__DIR__ . '/../includes/pages/user_questions.php'); -require_once realpath(__DIR__ . '/../includes/pages/user_settings.php'); -require_once realpath(__DIR__ . '/../includes/pages/user_shifts.php'); + __DIR__ . '/../includes/pages/admin_active.php', + __DIR__ . '/../includes/pages/admin_arrive.php', + __DIR__ . '/../includes/pages/admin_free.php', + __DIR__ . '/../includes/pages/admin_groups.php', + __DIR__ . '/../includes/pages/admin_import.php', + __DIR__ . '/../includes/pages/admin_log.php', + __DIR__ . '/../includes/pages/admin_questions.php', + __DIR__ . '/../includes/pages/admin_rooms.php', + __DIR__ . '/../includes/pages/admin_shifts.php', + __DIR__ . '/../includes/pages/admin_user.php', + __DIR__ . '/../includes/pages/guest_login.php', + __DIR__ . '/../includes/pages/user_messages.php', + __DIR__ . '/../includes/pages/user_myshifts.php', + __DIR__ . '/../includes/pages/user_news.php', + __DIR__ . '/../includes/pages/user_questions.php', + __DIR__ . '/../includes/pages/user_settings.php', + __DIR__ . '/../includes/pages/user_shifts.php', +]; +foreach ($includeFiles as $file) { + require_once realpath($file); +} /** * Init application */ -session_start(); +$session = new Session(); +$session->start(); +$request->setSession($session); gettext_init(); diff --git a/includes/helper/internationalization_helper.php b/includes/helper/internationalization_helper.php index d2dbcdbd..131941e9 100644 --- a/includes/helper/internationalization_helper.php +++ b/includes/helper/internationalization_helper.php @@ -1,5 +1,7 @@ get('locale'); } /** @@ -27,11 +29,12 @@ function gettext_init() { $locales = config('locales'); $request = request(); + $session = session(); if ($request->has('set_locale') && isset($locales[$request->input('set_locale')])) { - $_SESSION['locale'] = $request->input('set_locale'); - } elseif (!isset($_SESSION['locale'])) { - $_SESSION['locale'] = config('default_locale'); + $session->set('locale', $request->input('set_locale')); + } elseif (!$session->has('locale')) { + $session->set('locale', config('default_locale')); } gettext_locale(); @@ -48,7 +51,7 @@ function gettext_init() function gettext_locale($locale = null) { if ($locale == null) { - $locale = $_SESSION['locale']; + $locale = session()->get('locale'); } putenv('LC_ALL=' . $locale); @@ -62,14 +65,20 @@ function gettext_locale($locale = null) */ function make_langselect() { - $url = $_SERVER['REQUEST_URI'] . (strpos($_SERVER['REQUEST_URI'], '?') > 0 ? '&' : '?') . 'set_locale='; + $request = Request::getInstance(); $items = []; foreach (config('locales') as $locale => $name) { + $url = url($request->getPathInfo(), ['set_locale' => $locale]); + $items[] = toolbar_item_link( - htmlspecialchars($url) . $locale, + htmlspecialchars($url), '', - '' . $name . ' ' . $name + sprintf( + '%s %2$s', + url('pic/flag/' . $locale . '.png'), + $name + ) ); } return $items; diff --git a/includes/helper/message_helper.php b/includes/helper/message_helper.php index 1f429c27..4fa0efe3 100644 --- a/includes/helper/message_helper.php +++ b/includes/helper/message_helper.php @@ -7,12 +7,12 @@ */ function msg() { - if (!isset($_SESSION['msg'])) { - return ''; - } - $msg = $_SESSION['msg']; - $_SESSION['msg'] = ''; - return $msg; + $session = session(); + + $message = $session->get('msg', ''); + $session->set('msg', ''); + + return $message; } /** @@ -57,21 +57,23 @@ function success($msg, $immediately = false) * @param string $class * @param string $msg * @param bool $immediately - * @return string|null + * @return string */ function alert($class, $msg, $immediately = false) { + $session = session(); + + if (empty($msg)) { + return ''; + } + if ($immediately) { - if ($msg == '') { - return ''; - } return '
' . $msg . '
'; } - if (!isset($_SESSION['msg'])) { - $_SESSION['msg'] = ''; - } - $_SESSION['msg'] .= alert($class, $msg, true); + $message = $session->get('msg', ''); + $message .= alert($class, $msg, true); + $session->set('msg', $message); - return null; + return ''; } diff --git a/includes/model/Shifts_model.php b/includes/model/Shifts_model.php index 88b28998..03f8341f 100644 --- a/includes/model/Shifts_model.php +++ b/includes/model/Shifts_model.php @@ -45,7 +45,7 @@ function Shifts_by_ShiftsFilter(ShiftsFilter $shiftsFilter) AND NOT `Shifts`.`PSID` IS NULL) AS tmp_shifts ORDER BY `start`'; - + return DB::select( $sql, [ @@ -245,6 +245,10 @@ function Shift_signup_allowed_angel( ) { $free_entries = Shift_free_entries($needed_angeltype, $shift_entries); + if (config('signup_requires_arrival') && !$user['Gekommen']) { + return new ShiftSignupState(ShiftSignupState::SHIFT_ENDED, $free_entries); + } + if ($user_shifts == null) { $user_shifts = Shifts_by_user($user); } @@ -444,6 +448,7 @@ function Shift_update($shift) * * @param array $shift * @return bool|null + * @throws Exception */ function Shift_update_by_psid($shift) { diff --git a/includes/model/User_model.php b/includes/model/User_model.php index 4757ed3c..0ed602e0 100644 --- a/includes/model/User_model.php +++ b/includes/model/User_model.php @@ -241,7 +241,7 @@ function Users_by_angeltype($angeltype) `UserAngelTypes`.`id` AS `user_angeltype_id`, `UserAngelTypes`.`confirm_user_id`, `UserAngelTypes`.`supporter`, - (`UserDriverLicenses`.`user_id` IS NOT NULL) as `wants_to_drive`, + (`UserDriverLicenses`.`user_id` IS NOT NULL) AS `wants_to_drive`, `UserDriverLicenses`.* FROM `User` JOIN `UserAngelTypes` ON `User`.`UID`=`UserAngelTypes`.`user_id` diff --git a/includes/pages/admin_active.php b/includes/pages/admin_active.php index be1217ff..d67af681 100644 --- a/includes/pages/admin_active.php +++ b/includes/pages/admin_active.php @@ -82,9 +82,13 @@ function admin_active() $limit = ''; $msg = success(_('Marked angels.'), true); } else { - $set_active = '« ' - . _('back') . ' | ' + $set_active = '« ' + . _('back') + . ' | ' . _('apply') . ''; } @@ -176,28 +180,46 @@ function admin_active() $actions = []; if ($usr['Aktiv'] == 0) { - $actions[] = '' + $parameters = [ + 'active' => $usr['UID'], + 'search' => $search, + ]; + if ($show_all_shifts) { + $parameters['show_all_shifts'] = 1; + } + $actions[] = '' . _('set active') . ''; } if ($usr['Aktiv'] == 1 && $usr['Tshirt'] == 0) { - $actions[] = '' + $parametersRemove = [ + 'not_active' => $usr['UID'], + 'search' => $search, + ]; + $parametersShirt = [ + 'tshirt' => $usr['UID'], + 'search' => $search, + ]; + if ($show_all_shifts) { + $parametersRemove['show_all_shifts'] = 1; + $parametersShirt['show_all_shifts'] = 1; + } + $actions[] = '' . _('remove active') . ''; - $actions[] = '' + $actions[] = '' . _('got t-shirt') . ''; } if ($usr['Tshirt'] == 1) { - $actions[] = '' + $parameters = [ + 'not_tshirt' => $usr['UID'], + 'search' => $search, + ]; + if ($show_all_shifts) { + $parameters['show_all_shifts'] = 1; + } + $actions[] = '' . _('remove t-shirt') . ''; } diff --git a/includes/pages/admin_arrive.php b/includes/pages/admin_arrive.php index ebeccb8c..48e2c91f 100644 --- a/includes/pages/admin_arrive.php +++ b/includes/pages/admin_arrive.php @@ -23,7 +23,7 @@ function admin_arrive() $search = strip_request_item('search'); } - if ($request->has('reset') && preg_match('/^\d*$/', $request->input('reset'))) { + if ($request->has('reset') && preg_match('/^\d+$/', $request->input('reset'))) { $user_id = $request->input('reset'); $user_source = User($user_id); if ($user_source != null) { @@ -39,7 +39,7 @@ function admin_arrive() } else { $msg = error(_('Angel not found.'), true); } - } elseif ($request->has('arrived') && preg_match('/^\d*$/', $request->input('arrived'))) { + } elseif ($request->has('arrived') && preg_match('/^\d+$/', $request->input('arrived'))) { $user_id = $request->input('arrived'); $user_source = User($user_id); if ($user_source != null) { @@ -92,8 +92,14 @@ function admin_arrive() $usr['rendered_arrival_date'] = $usr['arrival_date'] > 0 ? date('Y-m-d', $usr['arrival_date']) : '-'; $usr['arrived'] = $usr['Gekommen'] == 1 ? _('yes') : ''; $usr['actions'] = $usr['Gekommen'] == 1 - ? '' . _('reset') . '' - : '' . _('arrived') . ''; + ? '' . _('reset') . '' + : '' . _('arrived') . ''; if ($usr['arrival_date'] > 0) { $day = date('Y-m-d', $usr['arrival_date']); diff --git a/includes/pages/admin_free.php b/includes/pages/admin_free.php index ebf227a4..a3c0d17f 100644 --- a/includes/pages/admin_free.php +++ b/includes/pages/admin_free.php @@ -94,7 +94,7 @@ function admin_free() 'email' => $usr['email_by_human_allowed'] ? $usr['email'] : glyph('eye-close'), 'actions' => in_array('admin_user', $privileges) - ? button(page_link_to('admin_user') . '&id=' . $usr['UID'], _('edit'), 'btn-xs') + ? button(page_link_to('admin_user', ['id' => $usr['UID']]), _('edit'), 'btn-xs') : '' ]; } diff --git a/includes/pages/admin_groups.php b/includes/pages/admin_groups.php index ea0d4dbc..e0260320 100644 --- a/includes/pages/admin_groups.php +++ b/includes/pages/admin_groups.php @@ -38,7 +38,8 @@ function admin_groups() 'name' => $group['Name'], 'privileges' => join(', ', $privileges_html), 'actions' => button( - page_link_to('admin_groups') . '&action=edit&id=' . $group['UID'], + page_link_to('admin_groups', + ['action' => 'edit', 'id' => $group['UID']]), _('edit'), 'btn-xs' ) @@ -80,7 +81,8 @@ function admin_groups() 'privileges[]', $privilege['desc'] . ' (' . $privilege['name'] . ')', $privilege['group_id'] != '', - $privilege['id'] + $privilege['id'], + 'privilege-' . $privilege['name'] ); $privileges_html .= sprintf( ' %s %s', @@ -93,7 +95,10 @@ function admin_groups() $privileges_form[] = form_submit('submit', _('Save')); $html .= page_with_title(_('Edit group'), [ - form($privileges_form, page_link_to('admin_groups') . '&action=save&id=' . $group_id) + form( + $privileges_form, + page_link_to('admin_groups', ['action' => 'save', 'id' => $group_id]) + ) ]); } else { return error('No Group found.', true); @@ -108,7 +113,7 @@ function admin_groups() } $group = DB::selectOne('SELECT * FROM `Groups` WHERE `UID`=? LIMIT 1', [$group_id]); - $privileges = $request->get('privileges'); + $privileges = $request->postData('privileges'); if (!is_array($privileges)) { $privileges = []; } diff --git a/includes/pages/admin_import.php b/includes/pages/admin_import.php index bda5ba93..e97f95e1 100644 --- a/includes/pages/admin_import.php +++ b/includes/pages/admin_import.php @@ -98,10 +98,12 @@ function admin_import() if ($valid) { redirect( - page_link_to('admin_import') - . '&step=check&shifttype_id=' . $shifttype_id - . '&add_minutes_end=' . $add_minutes_end - . '&add_minutes_start=' . $add_minutes_start + page_link_to('admin_import', [ + 'step' => 'check', + 'shifttype_id' => $shifttype_id, + 'add_minutes_end' => $add_minutes_end, + 'add_minutes_start' => $add_minutes_start, + ]) ); } else { $html .= div('well well-sm text-center', [ @@ -207,10 +209,12 @@ function admin_import() ], shifts_printable($events_deleted, $shifttypes)), form_submit('submit', _('Import')) ], - page_link_to('admin_import') - . '&step=import&shifttype_id=' . $shifttype_id - . '&add_minutes_end=' . $add_minutes_end - . '&add_minutes_start=' . $add_minutes_start + page_link_to('admin_import', [ + 'step' => 'import', + 'shifttype_id' => $shifttype_id, + 'add_minutes_end' => $add_minutes_end, + 'add_minutes_start' => $add_minutes_start, + ]) ); break; @@ -248,7 +252,7 @@ function admin_import() list($rooms_new, $rooms_deleted) = prepare_rooms($import_file); foreach ($rooms_new as $room) { $result = Room_create($room, true, true); - + $rooms_import[trim($room)] = $result; } foreach ($rooms_deleted as $room) { diff --git a/includes/pages/admin_news.php b/includes/pages/admin_news.php index 4eafd3e2..eb3a250e 100644 --- a/includes/pages/admin_news.php +++ b/includes/pages/admin_news.php @@ -7,7 +7,7 @@ use Engelsystem\Database\DB; */ function admin_news() { - global $user; + global $user, $privileges; $request = request(); if (!$request->has('action')) { @@ -30,21 +30,31 @@ function admin_news() case 'edit': $user_source = User($news['UID']); - $html .= form([ - form_info(_('Date'), date('Y-m-d H:i', $news['Datum'])), - form_info(_('Author'), User_Nick_render($user_source)), - form_text('eBetreff', _('Subject'), $news['Betreff']), - form_textarea('eText', _('Message'), $news['Text']), - form_checkbox('eTreffen', _('Meeting'), $news['Treffen'] == 1, 1), - form_submit('submit', _('Save')) - ], page_link_to('admin_news&action=save&id=' . $news_id)); + $html .= form( + [ + form_info(_('Date'), date('Y-m-d H:i', $news['Datum'])), + form_info(_('Author'), User_Nick_render($user_source)), + form_text('eBetreff', _('Subject'), $news['Betreff']), + form_textarea('eText', _('Message'), $news['Text']), + form_checkbox('eTreffen', _('Meeting'), $news['Treffen'] == 1, 1), + form_submit('submit', _('Save')) + ], + page_link_to('admin_news', ['action' => 'save', 'id' => $news_id]) + ); - $html .= '' + $html .= '' . ' ' . _('Delete') . ''; break; case 'save': + $text = $request->postData('eText'); + if (!in_array('admin_news_html', $privileges)) { + $text = strip_tags($text); + } + DB::update(' UPDATE `News` SET `Datum`=?, @@ -56,14 +66,15 @@ function admin_news() ', [ time(), - $request->post('eBetreff'), - $request->post('eText'), + strip_tags($request->postData('eBetreff')), + $text, $user['UID'], $request->has('eTreffen') ? 1 : 0, $news_id ] ); - engelsystem_log('News updated: ' . $request->post('eBetreff')); + + engelsystem_log('News updated: ' . $request->postData('eBetreff')); success(_('News entry updated.')); redirect(page_link_to('news')); break; diff --git a/includes/pages/admin_questions.php b/includes/pages/admin_questions.php index 2b61b055..5f2e3a2b 100644 --- a/includes/pages/admin_questions.php +++ b/includes/pages/admin_questions.php @@ -52,9 +52,9 @@ function admin_questions() 'answer' => form([ form_textarea('answer', '', ''), form_submit('submit', _('Save')) - ], page_link_to('admin_questions') . '&action=answer&id=' . $question['QID']), + ], page_link_to('admin_questions', ['action' => 'answer', 'id' => $question['QID']])), 'actions' => button( - page_link_to('admin_questions') . '&action=delete&id=' . $question['QID'], + page_link_to('admin_questions', ['action' => 'delete', 'id' => $question['QID']]), _('delete'), 'btn-xs' ) @@ -72,7 +72,7 @@ function admin_questions() 'answered_by' => User_Nick_render($answer_user_source), 'answer' => str_replace("\n", '
', $question['Answer']), 'actions' => button( - page_link_to('admin_questions') . '&action=delete&id=' . $question['QID'], + page_link_to('admin_questions', ['action' => 'delete', 'id' => $question['QID']]), _('delete'), 'btn-xs' ) diff --git a/includes/pages/admin_rooms.php b/includes/pages/admin_rooms.php index 6f3584d5..9e153bf1 100644 --- a/includes/pages/admin_rooms.php +++ b/includes/pages/admin_rooms.php @@ -25,8 +25,8 @@ function admin_rooms() 'from_pentabarf' => glyph_bool($room['FromPentabarf'] == 'Y'), 'public' => glyph_bool($room['show'] == 'Y'), 'actions' => table_buttons([ - button(page_link_to('admin_rooms') . '&show=edit&id=' . $room['RID'], _('edit'), 'btn-xs'), - button(page_link_to('admin_rooms') . '&show=delete&id=' . $room['RID'], _('delete'), 'btn-xs') + button(page_link_to('admin_rooms', ['show' => 'edit', 'id' => $room['RID']]), _('edit'), 'btn-xs'), + button(page_link_to('admin_rooms', ['show' => 'delete', 'id' => $room['RID']]), _('delete'), 'btn-xs') ]) ]; } @@ -107,11 +107,14 @@ function admin_rooms() } foreach ($angeltypes as $angeltype_id => $angeltype) { - if ( - $request->has('angeltype_count_' . $angeltype_id) - && preg_match('/^\d{1,4}$/', $request->input('angeltype_count_' . $angeltype_id)) - ) { - $angeltypes_count[$angeltype_id] = $request->input('angeltype_count_' . $angeltype_id); + $angeltypes_count[$angeltype_id] = 0; + $queryKey = 'angeltype_count_' . $angeltype_id; + if (!$request->has($queryKey)) { + continue; + } + + if (preg_match('/^\d{1,4}$/', $request->input($queryKey))) { + $angeltypes_count[$angeltype_id] = $request->input($queryKey); } else { $valid = false; $msg .= error(sprintf(_('Please enter needed angels for type %s.'), $angeltype), true); @@ -220,7 +223,7 @@ function admin_rooms() sprintf(_('Do you want to delete room %s?'), $name), buttons([ button( - page_link_to('admin_rooms') . '&show=delete&id=' . $room_id . '&ack', + page_link_to('admin_rooms', ['show' => 'delete', 'id' => $room_id, 'ack' => 1]), _('Delete'), 'delete btn-danger' ) @@ -231,7 +234,7 @@ function admin_rooms() return page_with_title(admin_rooms_title(), [ buttons([ - button(page_link_to('admin_rooms') . '&show=edit', _('add')) + button(page_link_to('admin_rooms', ['show' => 'edit']), _('add')) ]), msg(), table([ diff --git a/includes/pages/admin_shifts.php b/includes/pages/admin_shifts.php index b5079ed1..c77bd46d 100644 --- a/includes/pages/admin_shifts.php +++ b/includes/pages/admin_shifts.php @@ -19,6 +19,7 @@ function admin_shifts() { $valid = true; $request = request(); + $session = session(); $start = parse_date('Y-m-d H:i', date('Y-m-d') . ' 00:00'); $end = $start; $mode = 'single'; @@ -132,16 +133,14 @@ function admin_shifts() } elseif ($request->input('angelmode') == 'manually') { $angelmode = 'manually'; foreach ($types as $type) { - if ( - $request->has('type_' . $type['id']) - && preg_match('/^\d+$/', trim($request->input('type_' . $type['id']))) - ) { - $needed_angel_types[$type['id']] = trim($request->input('type_' . $type['id'])); + if (preg_match('/^\d+$/', trim($request->input('type_' . $type['id'], 0)))) { + $needed_angel_types[$type['id']] = trim($request->input('type_' . $type['id'], 0)); } else { $valid = false; error(sprintf(_('Please check the needed angels for team %s.'), $type['name'])); } } + if (array_sum($needed_angel_types) == 0) { $valid = false; error(_('There are 0 angels needed. Please enter the amounts of needed angels.')); @@ -272,8 +271,8 @@ function admin_shifts() } // Fürs Anlegen zwischenspeichern: - $_SESSION['admin_shifts_shifts'] = $shifts; - $_SESSION['admin_shifts_types'] = $needed_angel_types; + $session->set('admin_shifts_shifts', $shifts); + $session->set('admin_shifts_types', $needed_angel_types); $hidden_types = ''; foreach ($needed_angel_types as $type_id => $count) { @@ -303,16 +302,14 @@ function admin_shifts() } } elseif ($request->has('submit')) { if ( - !$request->has('admin_shifts_shifts') - || !isset($_SESSION['admin_shifts_types']) - || !is_array($_SESSION['admin_shifts_shifts']) - || !is_array($_SESSION['admin_shifts_types']) + !is_array($session->get('admin_shifts_shifts')) + || !is_array($session->get('admin_shifts_types')) ) { redirect(page_link_to('admin_shifts')); } $needed_angel_types_info = []; - foreach ($_SESSION['admin_shifts_shifts'] as $shift) { + foreach ($session->get('admin_shifts_shifts', []) as $shift) { $shift['URL'] = null; $shift['PSID'] = null; $shift_id = Shift_create($shift); @@ -324,7 +321,7 @@ function admin_shifts() . ' to ' . date('Y-m-d H:i', $shift['end']) ); - foreach ($_SESSION['admin_shifts_types'] as $type_id => $count) { + foreach ($session->get('admin_shifts_types', []) as $type_id => $count) { $angel_type_source = DB::selectOne(' SELECT * FROM `AngelTypes` @@ -350,8 +347,8 @@ function admin_shifts() success('Schichten angelegt.'); redirect(page_link_to('admin_shifts')); } else { - unset($_SESSION['admin_shifts_shifts']); - unset($_SESSION['admin_shifts_types']); + $session->remove('admin_shifts_shifts'); + $session->remove('admin_shifts_types'); } $rid = null; diff --git a/includes/pages/admin_user.php b/includes/pages/admin_user.php index 6bdc8d71..0620155b 100644 --- a/includes/pages/admin_user.php +++ b/includes/pages/admin_user.php @@ -46,25 +46,27 @@ function admin_user() . 'Wenn T-Shirt ein \'Ja\' enthält, bedeutet dies, dass der Engel ' . 'bereits sein T-Shirt erhalten hat.

' . "\n"; - $html .= '
' . "\n"; + $html .= '' . "\n"; $html .= '' . "\n"; $html .= '' . "\n"; $html .= ''; @@ -105,7 +107,8 @@ function admin_user() $html .= form_info('', _('Please visit the angeltypes page or the users profile to manage users angeltypes.')); $html .= 'Hier kannst Du das Passwort dieses Engels neu setzen:' . "\n"; + . page_link_to('admin_user', ['action' => 'change_pw', 'id' => $user_id]) + . '" method="post">' . "\n"; $html .= '
' . "\n"; $html .= '' . "\n"; - $html .= ' ' . "\n"; + $html .= ' ' . "\n"; $html .= ' ' . "\n"; - $html .= ' ' . "\n"; - $html .= ' ' . "\n"; - $html .= ' ' . "\n"; - $html .= ' ' . "\n"; - $html .= ' ' . "\n"; - $html .= ' ' . "\n"; + $html .= ' ' . "\n"; + $html .= ' ' . "\n"; + $html .= ' ' . "\n"; + $html .= ' ' . "\n"; + $html .= ' ' . "\n"; + $html .= ' ' . "\n"; if ($user_source['email_by_human_allowed']) { - $html .= " ' . "\n"; + $html .= " ' . "\n"; } - $html .= " ' . "\n"; + $html .= " ' . "\n"; $html .= ' ' . "\n"; @@ -91,7 +93,7 @@ function admin_user() $html .= ' ' . "\n"; - $html .= ' ' . "\n"; + $html .= ' ' . "\n"; $html .= '
Nick' . '
Nick' . '
Last login

' . date('Y-m-d H:i', $user_source['lastLogIn']) . '

Name' . '
Vorname' . '
Alter' . '
Telefon' . '
Handy' . '
DECT' . '
Name' . '
Vorname' . '
Alter' . '
Telefon' . '
Handy' . '
DECT' . '
email" . '
email" . '
jabber" . '
jabber" . '
Size' . html_select_key('size', 'eSize', $tshirt_sizes, $user_source['Size']) . '
T-Shirt' . "\n"; $html .= html_options('eTshirt', $options, $user_source['Tshirt']) . '
Hometown' . '
Hometown' . '
' . "\n" . '
' . "\n"; $html .= ' ' . "\n"; $html .= ' ' . "\n"; @@ -134,7 +137,8 @@ function admin_user() if ($user_id != $user['UID'] && $my_highest_group <= $his_highest_group) { $html .= 'Hier kannst Du die Benutzergruppen des Engels festlegen:' . "\n"; + . page_link_to('admin_user', ['action' => 'save_groups', 'id' => $user_id]) + . '" method="post">' . "\n"; $html .= '
Passwort' . '
Wiederholung' . '
'; $groups = DB::select(' @@ -175,11 +179,11 @@ function admin_user() switch ($request->input('action')) { case 'save_groups': if ($user_id != $user['UID']) { - $my_highest_group = DB::select( + $my_highest_group = DB::selectOne( 'SELECT * FROM `UserGroups` WHERE `uid`=? ORDER BY `group_id`', [$user['UID']] ); - $his_highest_group = DB::select( + $his_highest_group = DB::selectOne( 'SELECT * FROM `UserGroups` WHERE `uid`=? ORDER BY `group_id`', [$user_id] ); @@ -257,7 +261,7 @@ function admin_user() `Handy` = ?, `Alter` =?, `DECT` = ?, - ' . ($user_source['email_by_human_allowed'] ? '`email` = ' . DB::getPdo()->quote($request->post('eemail')) . ',' : '') . ' + ' . ($user_source['email_by_human_allowed'] ? '`email` = ' . DB::getPdo()->quote($request->postData('eemail')) . ',' : '') . ' `jabber` = ?, `Size` = ?, `Gekommen`= ?, @@ -268,34 +272,34 @@ function admin_user() WHERE `UID` = ? LIMIT 1'; DB::update($sql, [ - $request->post('eNick'), - $request->post('eName'), - $request->post('eVorname'), - $request->post('eTelefon'), - $request->post('eHandy'), - $request->post('eAlter'), - $request->post('eDECT'), - $request->post('ejabber'), - $request->post('eSize'), - $request->post('eGekommen'), - $request->post('eAktiv'), + User_validate_Nick($request->postData('eNick')), + $request->postData('eName'), + $request->postData('eVorname'), + $request->postData('eTelefon'), + $request->postData('eHandy'), + $request->postData('eAlter'), + $request->postData('eDECT'), + $request->postData('ejabber'), + $request->postData('eSize'), + $request->postData('eGekommen'), + $request->postData('eAktiv'), $force_active, - $request->post('eTshirt'), - $request->post('Hometown'), + $request->postData('eTshirt'), + $request->postData('Hometown'), $user_id, ]); engelsystem_log( - 'Updated user: ' . $request->post('eNick') . ', ' . $request->post('eSize') - . ', arrived: ' . $request->post('eVorname') - . ', active: ' . $request->post('eAktiv') - . ', tshirt: ' . $request->post('eTshirt') + 'Updated user: ' . $request->postData('eNick') . ', ' . $request->postData('eSize') + . ', arrived: ' . $request->postData('eVorname') + . ', active: ' . $request->postData('eAktiv') + . ', tshirt: ' . $request->postData('eTshirt') ); $html .= success('Änderung wurde gespeichert...' . "\n", true); break; case 'change_pw': - if ($request->post('new_pw') != '' && $request->post('new_pw') == $request->post('new_pw2')) { - set_password($user_id, $request->post('new_pw')); + if ($request->postData('new_pw') != '' && $request->postData('new_pw') == $request->postData('new_pw2')) { + set_password($user_id, $request->postData('new_pw')); $user_source = User($user_id); engelsystem_log('Set new password for ' . User_Nick_render($user_source)); $html .= success('Passwort neu gesetzt.', true); diff --git a/includes/pages/guest_login.php b/includes/pages/guest_login.php index f8c52767..9179c6c4 100644 --- a/includes/pages/guest_login.php +++ b/includes/pages/guest_login.php @@ -39,6 +39,7 @@ function guest_register() $min_password_length = config('min_password_length'); $event_config = EventConfig(); $request = request(); + $session = session(); $msg = ''; $nick = ''; @@ -127,8 +128,8 @@ function guest_register() } } - if ($request->has('password') && strlen($request->post('password')) >= $min_password_length) { - if ($request->post('password') != $request->post('password2')) { + if ($request->has('password') && strlen($request->postData('password')) >= $min_password_length) { + if ($request->postData('password') != $request->postData('password2')) { $valid = false; $msg .= error(_('Your passwords don\'t match.'), true); } @@ -226,15 +227,15 @@ function guest_register() $password_hash, $comment, $hometown, - $_SESSION['locale'], + $session->get('locale'), $planned_arrival_date, ] ); // Assign user-group and set password $user_id = DB::getPdo()->lastInsertId(); - DB::insert('INSERT INTO `UserGroups` (`uid`, `group_id`) VALUES (?, -2)', [$user_id]); - set_password($user_id, $request->post('password')); + DB::insert('INSERT INTO `UserGroups` (`uid`, `group_id`) VALUES (?, -20)', [$user_id]); + set_password($user_id, $request->postData('password')); // Assign angel-types $user_angel_types_info = []; @@ -328,7 +329,7 @@ function guest_register() 'angel_types', _('What do you want to do?') . sprintf( ' (%s)', - page_link_to('angeltypes') . '&action=about', + page_link_to('angeltypes', ['action' => 'about']), _('Description of job types') ), $angel_types, @@ -377,32 +378,43 @@ function guest_register() ]); } +/** + * @return string + */ function entry_required() { return ''; } +/** + * @return bool + */ function guest_logout() { - session_destroy(); + session()->invalidate(); redirect(page_link_to('start')); return true; } +/** + * @return string + */ function guest_login() { $nick = ''; $request = request(); - unset($_SESSION['uid']); + $session = session(); $valid = true; + $session->remove('uid'); + if ($request->has('submit')) { if ($request->has('nick') && strlen(User_validate_Nick($request->input('nick'))) > 0) { $nick = User_validate_Nick($request->input('nick')); $login_user = DB::selectOne('SELECT * FROM `User` WHERE `Nick`=?', [$nick]); if (!empty($login_user)) { if ($request->has('password')) { - if (!verify_password($request->post('password'), $login_user['Passwort'], $login_user['UID'])) { + if (!verify_password($request->postData('password'), $login_user['Passwort'], $login_user['UID'])) { $valid = false; error(_('Your password is incorrect. Please try it again.')); } @@ -420,8 +432,8 @@ function guest_login() } if ($valid && !empty($login_user)) { - $_SESSION['uid'] = $login_user['UID']; - $_SESSION['locale'] = $login_user['Sprache']; + $session->set('uid', $login_user['UID']); + $session->set('locale', $login_user['Sprache']); redirect(page_link_to('news')); } @@ -466,7 +478,10 @@ function guest_login() heading(_('What can I do?'), 2), '

' . _('Please read about the jobs you can do to help us.') . '

', buttons([ - button(page_link_to('angeltypes') . '&action=about', _('Teams/Job description') . ' »') + button( + page_link_to('angeltypes', ['action' => 'about']), + _('Teams/Job description') . ' »' + ) ]) ]) ]) @@ -474,6 +489,9 @@ function guest_login() ]); } +/** + * @return string + */ function get_register_hint() { global $privileges; diff --git a/includes/pages/user_atom.php b/includes/pages/user_atom.php index a1e2580a..2991bdbf 100644 --- a/includes/pages/user_atom.php +++ b/includes/pages/user_atom.php @@ -1,6 +1,7 @@ Engelsystem - ' . $_SERVER['HTTP_HOST'] + ' . $request->getHttpHost() . htmlspecialchars(preg_replace( '#[&?]key=[a-f\d]{32}#', '', - $_SERVER['REQUEST_URI'] + $request->getRequestUri() )) . ' ' . date('Y-m-d\TH:i:sP', $news_entries[0]['Datum']) . '' . "\n"; @@ -64,11 +66,12 @@ function make_atom_entries_from_news($news_entries) function make_atom_entry_from_news($news_entry) { - return ' + return ' + ' . htmlspecialchars($news_entry['Betreff']) . ' - - ' . preg_replace('#^https?://#', '', page_link_to_absolute('news')) . '-' . $news_entry['ID'] . ' - ' . date('Y-m-d\TH:i:sP', $news_entry['Datum']) . ' - ' . htmlspecialchars($news_entry['Text']) . ' - ' . "\n"; + + ' . preg_replace('#^https?://#', '', page_link_to('news_comments', ['nid' => $news_entry['ID']])) . ' + ' . date('Y-m-d\TH:i:sP', $news_entry['Datum']) . ' + ' . htmlspecialchars($news_entry['Text']) . ' + ' . "\n"; } diff --git a/includes/pages/user_messages.php b/includes/pages/user_messages.php index 2dea6207..06ae7e75 100644 --- a/includes/pages/user_messages.php +++ b/includes/pages/user_messages.php @@ -92,14 +92,14 @@ function user_messages() if ($message['RUID'] == $user['UID']) { if ($message['isRead'] == 'N') { $messages_table_entry['actions'] = button( - page_link_to('user_messages') . '&action=read&id=' . $message['id'], + page_link_to('user_messages', ['action' => 'read', 'id' => $message['id']]), _('mark as read'), 'btn-xs' ); } } else { $messages_table_entry['actions'] = button( - page_link_to('user_messages') . '&action=delete&id=' . $message['id'], + page_link_to('user_messages', ['action' => 'delete', 'id' => $message['id']]), _('delete message'), 'btn-xs' ); @@ -119,7 +119,7 @@ function user_messages() 'text' => _('Message'), 'actions' => '' ], $messages_table) - ], page_link_to('user_messages') . '&action=send') + ], page_link_to('user_messages', ['action' => 'send'])) ]); } else { switch ($request->input('action')) { diff --git a/includes/pages/user_myshifts.php b/includes/pages/user_myshifts.php index 81f8f505..836bd566 100644 --- a/includes/pages/user_myshifts.php +++ b/includes/pages/user_myshifts.php @@ -37,16 +37,16 @@ function user_myshifts() if ($request->input('reset') == 'ack') { User_reset_api_key($user); success(_('Key changed.')); - redirect(page_link_to('users') . '&action=view&user_id=' . $shifts_user['UID']); + redirect(page_link_to('users', ['action' => 'view', 'user_id' => $shifts_user['UID']])); } return page_with_title(_('Reset API key'), [ error( _('If you reset the key, the url to your iCal- and JSON-export and your atom feed changes! You have to update it in every application using one of these exports.'), true ), - button(page_link_to('user_myshifts') . '&reset=ack', _('Continue'), 'btn-danger') + button(page_link_to('user_myshifts', ['reset' => 'ack']), _('Continue'), 'btn-danger') ]); - } elseif ($request->has('edit') && preg_match('/^\d*$/', $request->input('edit'))) { + } elseif ($request->has('edit') && preg_match('/^\d+$/', $request->input('edit'))) { $user_id = $request->input('edit'); $shift = DB::selectOne(' SELECT @@ -106,7 +106,7 @@ function user_myshifts() . '. Freeloaded: ' . ($freeloaded ? 'YES Comment: ' . $freeload_comment : 'NO') ); success(_('Shift saved.')); - redirect(page_link_to('users') . '&action=view&user_id=' . $shifts_user['UID']); + redirect(page_link_to('users', ['action' => 'view', 'user_id' => $shifts_user['UID']])); } } @@ -124,7 +124,7 @@ function user_myshifts() } else { redirect(page_link_to('user_myshifts')); } - } elseif ($request->has('cancel') && preg_match('/^\d*$/', $request->input('cancel'))) { + } elseif ($request->has('cancel') && preg_match('/^\d+$/', $request->input('cancel'))) { $user_id = $request->input('cancel'); $shift = DB::selectOne(' SELECT * @@ -164,6 +164,6 @@ function user_myshifts() } } - redirect(page_link_to('users') . '&action=view&user_id=' . $shifts_user['UID']); + redirect(page_link_to('users', ['action' => 'view', 'user_id' => $shifts_user['UID']])); return ''; } diff --git a/includes/pages/user_news.php b/includes/pages/user_news.php index 3cf11a6b..b51b0a4c 100644 --- a/includes/pages/user_news.php +++ b/includes/pages/user_news.php @@ -35,8 +35,8 @@ function user_meetings() $html = '

' . meetings_title() . '

' . msg(); $request = request(); - if ($request->has('page') && preg_match('/^\d{1,}$/', $request->input('page'))) { - $page = $request->input('page'); + if (preg_match('/^\d{1,}$/', $request->input('page', 0))) { + $page = $request->input('page', 0); } else { $page = 0; } @@ -57,14 +57,14 @@ function user_meetings() $dis_rows = ceil(count(DB::select('SELECT `ID` FROM `News`')) / $display_news); $html .= '
' . '
    '; for ($i = 0; $i < $dis_rows; $i++) { - if ($request->has('page') && $i == $request->input('page')) { + if ($request->has('page') && $i == $request->input('page', 0)) { $html .= '
  • '; } elseif (!$request->has('page') && $i == 0) { $html .= '
  • '; } else { $html .= '
  • '; } - $html .= '' . ($i + 1) . '
    • '; + $html .= '' . ($i + 1) . ''; } $html .= '
'; @@ -89,7 +89,7 @@ function display_news($news) $html .= '
'; if (in_array('admin_news', $privileges)) { $html .= '
' - . button_glyph(page_link_to('admin_news') . '&action=edit&id=' . $news['ID'], 'edit', 'btn-xs') + . button_glyph(page_link_to('admin_news', ['action' => 'edit', 'id' => $news['ID']]), 'edit', 'btn-xs') . '
'; } $html .= ' ' . date('Y-m-d H:i', $news['Datum']) . ' '; @@ -98,7 +98,7 @@ function display_news($news) $html .= User_Nick_render($user_source); if ($page != 'news_comments') { - $html .= ' ' + $html .= ' ' . ' ' . _('Comments') . ' » ' . '' @@ -154,7 +154,7 @@ function user_news_comments() $user_source = User($comment['UID']); $html .= '
'; - $html .= '
' . nl2br($comment['Text']) . '
'; + $html .= '
' . nl2br(htmlspecialchars($comment['Text'])) . '
'; $html .= '
'; $html .= ' ' . $comment['Datum'] . ' '; $html .= User_Nick_render($user_source); @@ -166,7 +166,7 @@ function user_news_comments() $html .= form([ form_textarea('text', _('Message'), ''), form_submit('submit', _('Save')) - ], page_link_to('news_comments') . '&nid=' . $news['ID']); + ], page_link_to('news_comments', ['nid' => $news['ID']])); } else { $html .= _('Invalid request.'); } @@ -185,30 +185,36 @@ function user_news() $html = '

' . news_title() . '

' . msg(); - $isMeeting = $request->post('treffen'); + $isMeeting = $request->postData('treffen'); if ($request->has('text') && $request->has('betreff') && in_array('admin_news', $privileges)) { - if (!$request->has('treffen') || !in_array('admin_news', $privileges)) { + if (!$request->has('treffen')) { $isMeeting = 0; } + + $text = $request->postData('text'); + if (!in_array('admin_news_html', $privileges)) { + $text = strip_tags($text); + } + DB::insert(' INSERT INTO `News` (`Datum`, `Betreff`, `Text`, `UID`, `Treffen`) VALUES (?, ?, ?, ?, ?) ', [ time(), - $request->post('betreff'), - $request->post('text'), + strip_tags($request->postData('betreff')), + $text, $user['UID'], $isMeeting, ] ); - engelsystem_log('Created news: ' . $_POST['betreff'] . ', treffen: ' . $isMeeting); + engelsystem_log('Created news: ' . $request->postData('betreff') . ', treffen: ' . $isMeeting); success(_('Entry saved.')); redirect(page_link_to('news')); } - if ($request->has('page') && preg_match('/^\d{1,}$/', $request->input('page'))) { - $page = $request->input('page'); + if (preg_match('/^\d{1,}$/', $request->input('page', 0))) { + $page = $request->input('page', 0); } else { $page = 0; } @@ -229,14 +235,14 @@ function user_news() $dis_rows = ceil(count(DB::select('SELECT `ID` FROM `News`')) / $display_news); $html .= '
' . '
    '; for ($i = 0; $i < $dis_rows; $i++) { - if ($request->has('page') && $i == $request->input('page')) { + if ($request->has('page') && $i == $request->input('page', 0)) { $html .= '
  • '; } elseif (!$request->has('page') && $i == 0) { $html .= '
  • '; } else { $html .= '
  • '; } - $html .= '' . ($i + 1) . '
    • '; + $html .= '' . ($i + 1) . ''; } $html .= '
'; diff --git a/includes/pages/user_questions.php b/includes/pages/user_questions.php index e4f35577..41fbe64d 100644 --- a/includes/pages/user_questions.php +++ b/includes/pages/user_questions.php @@ -33,7 +33,11 @@ function user_questions() $question['answer_user'] = User_Nick_render($answer_user_source); } - return Questions_view($open_questions, $answered_questions, page_link_to('user_questions') . '&action=ask'); + return Questions_view( + $open_questions, + $answered_questions, + page_link_to('user_questions', ['action' => 'ask']) + ); } else { switch ($request->input('action')) { case 'ask': diff --git a/includes/pages/user_settings.php b/includes/pages/user_settings.php index 7edee7b5..0ba8bbcb 100644 --- a/includes/pages/user_settings.php +++ b/includes/pages/user_settings.php @@ -84,7 +84,7 @@ function user_settings_main($user_source, $enable_tshirt_size, $tshirt_sizes) if ($valid) { User_update($user_source); - + success(_('Settings saved.')); redirect(page_link_to('user_settings')); } @@ -102,15 +102,15 @@ function user_settings_password($user_source) $request = request(); if ( !$request->has('password') - || !verify_password($request->post('password'), $user_source['Passwort'], $user_source['UID']) + || !verify_password($request->postData('password'), $user_source['Passwort'], $user_source['UID']) ) { error(_('-> not OK. Please try again.')); - } elseif (strlen($request->post('new_password')) < config('min_password_length')) { + } elseif (strlen($request->postData('new_password')) < config('min_password_length')) { error(_('Your password is to short (please use at least 6 characters).')); - } elseif ($request->post('new_password') != $request->post('new_password2')) { + } elseif ($request->postData('new_password') != $request->postData('new_password2')) { error(_('Your passwords don\'t match.')); } else { - set_password($user_source['UID'], $request->post('new_password')); + set_password($user_source['UID'], $request->postData('new_password')); success(_('Password saved.')); } redirect(page_link_to('user_settings')); @@ -164,6 +164,7 @@ function user_settings_locale($user_source, $locales) { $valid = true; $request = request(); + $session = session(); if ($request->has('language') && isset($locales[$request->input('language')])) { $user_source['Sprache'] = $request->input('language'); @@ -182,7 +183,7 @@ function user_settings_locale($user_source, $locales) $user_source['UID'], ] ); - $_SESSION['locale'] = $user_source['Sprache']; + $session->set('locale', $user_source['Sprache']); success('Language changed.'); redirect(page_link_to('user_settings')); diff --git a/includes/pages/user_shifts.php b/includes/pages/user_shifts.php index 813cb9b3..2bd7688f 100644 --- a/includes/pages/user_shifts.php +++ b/includes/pages/user_shifts.php @@ -167,20 +167,23 @@ function view_user_shifts() { global $user, $privileges, $ical_shifts; + $session = session(); $ical_shifts = []; $days = load_days(); $rooms = load_rooms(); $types = load_types(); - if (!isset($_SESSION['ShiftsFilter'])) { + if (!$session->has('ShiftsFilter')) { $room_ids = [ $rooms[0]['id'] ]; $type_ids = array_map('get_ids_from_array', $types); - $_SESSION['ShiftsFilter'] = new ShiftsFilter(in_array('user_shifts_admin', $privileges), $room_ids, $type_ids); + $shiftsFilter = new ShiftsFilter(in_array('user_shifts_admin', $privileges), $room_ids, $type_ids); + $session->set('ShiftsFilter', $shiftsFilter); } - update_ShiftsFilter($_SESSION['ShiftsFilter'], in_array('user_shifts_admin', $privileges), $days); - $shiftsFilter = $_SESSION['ShiftsFilter']; + + $shiftsFilter = $session->get('ShiftsFilter'); + update_ShiftsFilter($shiftsFilter, in_array('user_shifts_admin', $privileges), $days); $shiftCalendarRenderer = shiftCalendarRendererByShiftFilter($shiftsFilter); @@ -203,6 +206,11 @@ function view_user_shifts() $end_day = date('Y-m-d', $shiftsFilter->getEndTime()); $end_time = date('H:i', $shiftsFilter->getEndTime()); + $assignNotice = ''; + if (config('signup_requires_arrival') && !$user['Gekommen']) { + $assignNotice = info(render_user_arrived_hint(), true); + } + return page([ div('col-md-12', [ msg(), @@ -223,15 +231,16 @@ function view_user_shifts() 'task_notice' => '1' . _('The tasks shown here are influenced by the angeltypes you joined already!') - . ' ' + . ' ' . _('Description of the jobs.') . '', + 'assign_notice' => $assignNotice, 'shifts_table' => msg() . $shiftCalendarRenderer->render(), 'ical_text' => '

' . _('iCal export') . '

' . sprintf( _('Export of shown shifts. iCal format or JSON format available (please keep secret, otherwise reset the api key).'), - page_link_to_absolute('ical') . '&key=' . $user['api_key'], - page_link_to_absolute('shifts_json_export') . '&key=' . $user['api_key'], - page_link_to('user_myshifts') . '&reset' + page_link_to('ical', ['key' => $user['api_key']]), + page_link_to('shifts_json_export', ['key' => $user['api_key']]), + page_link_to('user_myshifts', ['reset' => 1]) ) . '

', 'filter' => _('Filter') ]) diff --git a/includes/sys_auth.php b/includes/sys_auth.php index e0ed67e5..4242261b 100644 --- a/includes/sys_auth.php +++ b/includes/sys_auth.php @@ -10,8 +10,10 @@ function load_auth() global $user, $privileges; $user = null; - if (isset($_SESSION['uid'])) { - $user = DB::selectOne('SELECT * FROM `User` WHERE `UID`=? LIMIT 1', [$_SESSION['uid']]); + $session = session(); + + if ($session->has('uid')) { + $user = DB::selectOne('SELECT * FROM `User` WHERE `UID`=? LIMIT 1', [$session->get('uid')]); if (!empty($user)) { // User ist eingeloggt, Datensatz zur Verfügung stellen und Timestamp updaten DB::update(' @@ -21,16 +23,17 @@ function load_auth() LIMIT 1 ', [ time(), - $_SESSION['uid'], + $session->get('uid'), ]); $privileges = privileges_for_user($user['UID']); return; } - unset($_SESSION['uid']); + + $session->remove('uid'); } // guest privileges - $privileges = privileges_for_group(-1); + $privileges = privileges_for_group(-10); } /** diff --git a/includes/sys_form.php b/includes/sys_form.php index f890b7a7..7fa0682d 100644 --- a/includes/sys_form.php +++ b/includes/sys_form.php @@ -10,7 +10,7 @@ */ function form_hidden($name, $value) { - return ''; + return ''; } /** @@ -25,7 +25,7 @@ function form_spinner($name, $label, $value) { return form_element($label, '
- +
-
%task_notice%
- +
%assign_notice%
+
+
+

%task_notice%

+