[aur-dev] [PATCH v2 1/3] Use username from the database if one is provided by the user
This fixes a bug where the new user name input by the user was invalid, causing the account deletion link and the form action to be wrong. Signed-off-by: Marcel Korpel <marcel.korpel@gmail.com> --- web/html/account.php | 4 ++-- web/lib/acctfuncs.inc.php | 8 +++++--- web/template/account_edit_form.php | 4 ++-- 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index c447de3..f5e6c19 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -61,7 +61,7 @@ if (isset($_COOKIE["AURSID"])) { $row["AccountTypeID"], $row["Suspended"], $row["Email"], "", "", $row["RealName"], $row["LangPreference"], $row["IRCNick"], $row["PGPKey"], $PK, - $row["InactivityTS"] ? 1 : 0, $row["ID"]); + $row["InactivityTS"] ? 1 : 0, $row["ID"], $row["Username"]); } else { print __("You do not have permission to edit this account."); } @@ -100,7 +100,7 @@ if (isset($_COOKIE["AURSID"])) { in_request("E"), in_request("P"), in_request("C"), in_request("R"), in_request("L"), in_request("I"), in_request("K"), in_request("PK"), in_request("J"), - in_request("ID")); + in_request("ID"), $row["Username"]); } } else { if (has_credential(CRED_ACCOUNT_SEARCH)) { diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index edd38ee..b5dc51d 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -56,11 +56,12 @@ function html_format_pgp_fingerprint($fingerprint) { * @param string $PK The list of SSH public keys * @param string $J The inactivity status of the displayed user * @param string $UID The user ID of the displayed user + * @param string $N The username as present in the database * * @return void */ function display_account_form($A,$U="",$T="",$S="",$E="",$P="",$C="",$R="", - $L="",$I="",$K="",$PK="",$J="", $UID=0) { + $L="",$I="",$K="",$PK="",$J="",$UID=0,$N="") { global $SUPPORTED_LANGS; include("account_edit_form.php"); @@ -86,11 +87,12 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$P="",$C="",$R="", * @param string $PK The list of public SSH keys * @param string $J The inactivity status of the user * @param string $UID The user ID of the modified account + * @param string $N The username as present in the database * * @return string|void Return void if successful, otherwise return error */ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", - $R="",$L="",$I="",$K="",$PK="",$J="",$UID=0) { + $R="",$L="",$I="",$K="",$PK="",$J="",$UID=0,$N="") { global $SUPPORTED_LANGS; $error = ''; @@ -247,7 +249,7 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", if ($error) { print "<ul class='errorlist'><li>".$error."</li></ul>\n"; display_account_form($A, $U, $T, $S, $E, "", "", - $R, $L, $I, $K, $PK, $J, $UID); + $R, $L, $I, $K, $PK, $J, $UID, $N); return; } diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 56bdd45..0aadb9d 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -1,9 +1,9 @@ <?php if ($A == "UpdateAccount"): ?> <p> - <?= __('Click %shere%s if you want to permanently delete this account.', '<a href="' . get_user_uri($U) . 'delete/' . '">', '</a>') ?> + <?= __('Click %shere%s if you want to permanently delete this account.', '<a href="' . get_user_uri($N) . 'delete/' . '">', '</a>') ?> </p> -<form id="edit-profile-form" action="<?= get_user_uri($U) . 'update/'; ?>" method="post"> +<form id="edit-profile-form" action="<?= get_user_uri($N) . 'update/'; ?>" method="post"> <?php else: ?> <form id="edit-profile-form" action="<?= get_uri('/register/'); ?>" method="post"> <?php endif; ?> -- 2.4.5
Signed-off-by: Marcel Korpel <marcel.korpel@gmail.com> --- web/html/register.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/html/register.php b/web/html/register.php index 014d802..cb3e8dd 100644 --- a/web/html/register.php +++ b/web/html/register.php @@ -25,7 +25,7 @@ if (in_request("Action") == "NewAccount") { in_request("PK")); } else { - print __("Use this form to create an account."); + print '<p>' . __("Use this form to create an account.") . '</p>'; display_account_form("NewAccount", "", "", "", "", "", "", "", $LANG); } -- 2.4.5
This fix uses the POST-Redirect-GET pattern to reload the account update page. Output if buffered to be able to send the correct headers after the account has been successfully modified. Signed-off-by: Marcel Korpel <marcel.korpel@gmail.com> --- web/html/account.php | 12 ++++++++++++ web/lib/acctfuncs.inc.php | 5 +++-- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index f5e6c19..d6b12aa 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -19,6 +19,13 @@ if (in_array($action, $need_userinfo)) { $PK = implode("\n", account_get_ssh_keys($row["ID"])); } +if (in_request("Update") == "Succeeded") { + $action = "UpdateSucceeded"; +} + +// start output buffering to be able to send headers at a later point +ob_start(); + if ($action == "AccountInfo") { html_header(__('Account') . ' ' . $row['Username']); } else { @@ -102,6 +109,10 @@ if (isset($_COOKIE["AURSID"])) { in_request("K"), in_request("PK"), in_request("J"), in_request("ID"), $row["Username"]); } + } elseif ($action == "UpdateSucceeded") { + // $tokens[2] contains current username + print __("The account, %s%s%s, has been successfully modified.", + "<strong>", htmlspecialchars($tokens[2], ENT_QUOTES), "</strong>"); } else { if (has_credential(CRED_ACCOUNT_SEARCH)) { # display the search page if they're a TU/dev @@ -124,4 +135,5 @@ echo "</div>"; html_footer(AURWEB_VERSION); +ob_end_flush(); ?> diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index b5dc51d..f3927a7 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -356,8 +356,9 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", print __("No changes were made to the account, %s%s%s.", "<strong>", htmlspecialchars($U,ENT_QUOTES), "</strong>"); } else { - print __("The account, %s%s%s, has been successfully modified.", - "<strong>", htmlspecialchars($U,ENT_QUOTES), "</strong>"); + // Redirect to account update page containing new username + header('HTTP/1.1 303 See Other'); + header('Location: ' . get_user_uri($U) . 'update/?Update=Succeeded'); } } } -- 2.4.5
On Mon, 13 Jul 2015 at 20:01:26, Marcel Korpel wrote:
This fix uses the POST-Redirect-GET pattern to reload the account update page. Output if buffered to be able to send the correct headers after the account has been successfully modified.
Thanks for looking into this!
Signed-off-by: Marcel Korpel <marcel.korpel@gmail.com> --- web/html/account.php | 12 ++++++++++++ web/lib/acctfuncs.inc.php | 5 +++-- 2 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/web/html/account.php b/web/html/account.php index f5e6c19..d6b12aa 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -19,6 +19,13 @@ if (in_array($action, $need_userinfo)) { $PK = implode("\n", account_get_ssh_keys($row["ID"])); }
+if (in_request("Update") == "Succeeded") { + $action = "UpdateSucceeded"; +} +
I'd prefer a more general solution, i.e. create a general "confirmation" action that we can use everywhere else as well.
+// start output buffering to be able to send headers at a later point
Use C-style comments (/* */) please.
+ob_start(); [...]
Can't we easily refactor the current code and move the account processing before the header is printed? Regards, Lukas
participants (2)
-
Lukas Fleischer
-
Marcel Korpel