/[drupal]/contributions/modules/phplist/phplist.module
ViewVC logotype

Diff of /contributions/modules/phplist/phplist.module

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph | View Patch Patch

revision 1.12.2.29 by paulbeaney, Thu Oct 29 10:03:33 2009 UTC revision 1.12.2.30 by pwolanin, Wed Nov 18 14:36:46 2009 UTC
# Line 1  Line 1 
1  <?php  <?php
2  // $Id: phplist.module,v 1.12.2.28 2009/10/29 09:45:45 paulbeaney Exp $  // $Id: phplist.module,v 1.12.2.29 2009/10/29 10:03:33 paulbeaney Exp $
3    
4  /**  /**
5   * @module phplist   * @module phplist
# Line 414  function _phplist_get_prefix() { Line 414  function _phplist_get_prefix() {
414    static $prefix;    static $prefix;
415    
416    if ($prefix === NULL) {    if ($prefix === NULL) {
417      $prefix['prefix'] = variable_get('phplist_prefix', 'phplist_');      $prefix['prefix'] = db_escape_table(variable_get('phplist_prefix', 'phplist_'));
418      $prefix['user']   = variable_get('phplist_user_prefix', $prefix['prefix']);      $prefix['user']   = db_escape_table(variable_get('phplist_user_prefix', $prefix['prefix']));
419    
420      if ($prefix['user'] == '') $prefix['user'] = $prefix['prefix'];      if ($prefix['user'] == '') $prefix['user'] = $prefix['prefix'];
421    }    }
# Line 513  function phplist_user($op, &$edit, &$use Line 513  function phplist_user($op, &$edit, &$use
513          db_set_active('phplist');          db_set_active('phplist');
514    
515                  // Completely remove this user from PHPlist - could be enabled using another system variable                  // Completely remove this user from PHPlist - could be enabled using another system variable
516          db_query("DELETE FROM $strprefix%s WHERE userid = %d", $prefix['prefix']."listuser", $phplistid);          /*db_query("DELETE FROM $strprefix%s WHERE userid = %d", $prefix['prefix']."listuser", $phplistid);
517          db_query("DELETE FROM %s WHERE userid = %d", $prefix['user']."attribute", $phplistid);          db_query("DELETE FROM %s WHERE userid = %d", $prefix['user']."attribute", $phplistid);
518          db_query("DELETE FROM $strprefix%s WHERE userid = %d", $prefix['prefix']."usermessage", $phplistid);          db_query("DELETE FROM $strprefix%s WHERE userid = %d", $prefix['prefix']."usermessage", $phplistid);
519          db_query("DELETE FROM $strprefix%s WHERE user = %d", $prefix['user']."message_bounce", $phplistid);          db_query("DELETE FROM $strprefix%s WHERE user = %d", $prefix['user']."message_bounce", $phplistid);
520          db_query("DELETE FROM %s WHERE id = %d", $prefix['user']."user", $phplistid);          db_query("DELETE FROM %s WHERE id = %d", $prefix['user']."user", $phplistid);
521          db_query("DELETE FROM %s WHERE userid = %d", $prefix['user']."user_history", $phplistid);          db_query("DELETE FROM %s WHERE userid = %d", $prefix['user']."user_history", $phplistid);
522          db_query("DELETE FROM $strprefix%s WHERE userid = %d", $prefix['user']."rss", $phplistid);          db_query("DELETE FROM $strprefix%s WHERE userid = %d", $prefix['user']."rss", $phplistid);
523            */
524          db_set_active('default');          db_set_active('default');
525        }        }
526        break;        break;
# Line 578  function _phplist_manage_subscription($e Line 578  function _phplist_manage_subscription($e
578    $lid    = intval($lid);    $lid    = intval($lid);
579    $userid = intval($userid);    $userid = intval($userid);
580    
581    if ($userid > 0 && user_access("manage subscriptions")) {    // Check token - CSRF protection
582      // This is a manager updating another user's account    $path = preg_replace('/\/'. $value .'$/', '', $_GET['q']);
583      $user = user_load(array('uid' => $userid));    if ($redirect && (!isset($_GET['token']) || !phplist_check_token($_GET['token'], arg(4)))) {
584      $email = $user->mail;      drupal_set_message(t('Got an invalid token. Subscription not updated.'), 'error');
585        drupal_goto('user/'. $userid .'/edit/phplist');
586    }    }
587    else {    else {
588      $user = user_load(array('mail' => $email));      if ($userid > 0 && user_access("manage subscriptions")) {
589    }        // This is a manager updating another user's account
590          $user = user_load(array('uid' => $userid));
591    if ($email == '') {        $email = $user->mail;
592      form_set_error("", t('Email address is empty for UID '. $userid));      }
593      return;      else {
594    }        $user = user_load(array('mail' => $email));
595    if ($lid == 0 || $lid == '') return;      }
596    
597    $phplistid = _phplist_lookup_phplistid($email);      if ($email == '') {
598    if (PHPLIST_DEBUG) drupal_set_message("Found phplistid [$phplistid] for email $email");        form_set_error("", t('Email address is empty for UID '. $userid));
599          return;
600        }
601        if ($lid == 0 || $lid == '') return;
602    
   // This bit of code is for administrators who have forgotten to "sync users" first !!  
   // Thanks to Dave Cohen, http://drupal.org/node/249559  
   if (!$phplistid) {  
     $account = user_load(array('mail' => $email));  
     if ($account)  
       _phplist_sync_user($phplistid, $account);  
603      $phplistid = _phplist_lookup_phplistid($email);      $phplistid = _phplist_lookup_phplistid($email);
604    }      if (PHPLIST_DEBUG) drupal_set_message("Found phplistid [$phplistid] for email $email");
605    
606    $booOK = false;      // This bit of code is for administrators who have forgotten to "sync users" first !!
607    if ($phplistid) {      // Thanks to Dave Cohen, http://drupal.org/node/249559
608      if ($action == 'subscribe') {      if (!$phplistid) {
609        // Check user is allowed to subscribe to this list        $account = user_load(array('mail' => $email));
610        $roles = array();        if ($account)
611        if (isset($user->roles)) {          _phplist_sync_user($phplistid, $account);
612          foreach ($user->roles as $rid => $role) {        $phplistid = _phplist_lookup_phplistid($email);
613            $roles[] = $rid;      }
614    
615        $booOK = false;
616        if ($phplistid) {
617          if ($action == 'subscribe') {
618            // Check user is allowed to subscribe to this list
619            $roles = array();
620            if (isset($user->roles)) {
621              foreach ($user->roles as $rid => $role) {
622                $roles[] = $rid;
623              }
624          }          }
625            $roles = implode(",", $roles);
626    
627            if (db_result(db_query("SELECT lid FROM {phplist_access} WHERE lid=%d AND rid IN (%s)", $lid, $roles))) $booOK = true;
628          }
629          else {
630            $booOK = true;
631          }
632    
633          db_set_active('phplist');
634    
635          switch ($action) {
636            case 'subscribe';
637              if ($booOK) {
638                db_query("INSERT INTO {$prefix['prefix']}listuser(userid, listid, entered) VALUES(%d, %d, NOW())", $phplistid, $lid);
639                if (PHPLIST_DEBUG) drupal_set_message("Subscribing $phplistid to list $lid");
640              }
641              break;
642            case 'unsubscribe':
643              db_query("DELETE FROM {$prefix['prefix']}listuser WHERE userid=%d AND listid=%d", $phplistid, $lid);
644              if (PHPLIST_DEBUG) drupal_set_message("Unsubscribing $phplistid from list $lid");
645              break;
646        }        }
647        $roles = implode(",", $roles);  
648          db_set_active('default');
649    
650        if (db_result(db_query("SELECT lid FROM {phplist_access} WHERE lid=%d AND rid IN (%s)", $lid, $roles))) $booOK = true;        if ($redirect) {
651            if ($booOK) drupal_set_message(t("Your subscriptions have been updated"));
652            else drupal_set_message(t('You do not have permission to subscribe to this list'));
653            drupal_goto('user/'. $userid .'/edit/phplist');
654          }
655      }      }
656      else {      else {
657        $booOK = true;        drupal_set_message(t('Failed to update email newsletter subscription.'));
658      }      }
   
     db_set_active('phplist');  
   
     switch ($action) {  
       case 'subscribe';  
         if ($booOK) {  
           db_query("INSERT INTO {$prefix['prefix']}listuser(userid, listid, entered) VALUES(%d, %d, NOW())", $phplistid, $lid);  
           if (PHPLIST_DEBUG) drupal_set_message("Subscribing $phplistid to list $lid");  
         }  
         break;  
       case 'unsubscribe':  
         db_query("DELETE FROM {$prefix['prefix']}listuser WHERE userid=%d AND listid=%d", $phplistid, $lid);  
         if (PHPLIST_DEBUG) drupal_set_message("Unsubscribing $phplistid from list $lid");  
         break;  
     }  
   
     db_set_active('default');  
   
     if ($redirect) {  
       if ($booOK) drupal_set_message(t("Your subscriptions have been updated"));  
       else drupal_set_message(t('You do not have permission to subscribe to this list'));  
       drupal_goto('user/'. $userid .'/edit/phplist');  
     }  
   }  
   else {  
     drupal_set_message(t('Failed to update email newsletter subscription.'));  
659    }    }
660  }  }
661    
# Line 681  function phplist_lists($user, $op='list' Line 689  function phplist_lists($user, $op='list'
689    foreach ($lists as $list) {    foreach ($lists as $list) {
690      if ($list->userid == '' && !$subonly) {      if ($list->userid == '' && !$subonly) {
691        $rows[] = array('name' => "<b>". $list->name ."</b>". ($booshowdescription ? " <br />". $list->description : ""),        $rows[] = array('name' => "<b>". $list->name ."</b>". ($booshowdescription ? " <br />". $list->description : ""),
692          'subscribe' => l(t('Subscribe'), "user/". $user->uid ."/phplist/subscribe/". $list->lid)          'subscribe' => l(t('Subscribe'), "user/". $user->uid ."/phplist/subscribe/". $list->lid, array('query' => array('token' => phplist_get_token($list->lid))))
693        );        );
694      }      }
695      elseif ($list->userid != '') {      elseif ($list->userid != '') {
696        $rows[] = array('name' => "<b>". $list->name ."</b>". ($booshowdescription ? " <br />". $list->description : ""),        $rows[] = array('name' => "<b>". $list->name ."</b>". ($booshowdescription ? " <br />". $list->description : ""),
697          'unsubscribe' => l(t('Unsubscribe'), "user/". $user->uid ."/phplist/unsubscribe/". $list->lid)          'unsubscribe' => l(t('Unsubscribe'), "user/". $user->uid ."/phplist/unsubscribe/". $list->lid, array('query' => array('token' => phplist_get_token($list->lid))))
698        );        );
699      }      }
700    }    }
# Line 1477  function phplist_confirm_subscription() Line 1485  function phplist_confirm_subscription()
1485    }    }
1486    
1487    return $form;    return $form;
1488    }
1489    
1490    /**
1491     * Get a private token used to protect links from CSRF attacks.
1492     * "Borrowed" from 5 Star module :D
1493     */
1494    function phplist_get_token($value) {
1495      global $user;
1496    
1497      // Anonymous users don't get a session ID, which breaks page caching.
1498      $session_id = $user->uid ? session_id() : '';
1499      $private_key = drupal_get_private_key();
1500      return md5($session_id . $value . $private_key);
1501    }
1502    
1503    /**
1504     * Check to see if a token value matches the specified node.
1505     * "Borrowed" from 5 Star module :D
1506     */
1507    function phplist_check_token($token, $value) {
1508      return phplist_get_token($value) == $token;
1509  }  }
Legend:
Removed from v.1.12.2.29  
changed lines
  Added in v.1.12.2.30
  ViewVC Help
Powered by ViewVC 1.1.3