Mercurial > hg > fapweb
annotate usrajax.php @ 360:2af8458058ab
Implement CSRF token checks.
author | Matti Hamalainen <ccr@tnsp.org> |
---|---|
date | Tue, 03 Dec 2013 11:13:44 +0200 |
parents | 48d53945c6d3 |
children | cbe2693a3cd1 |
rev | line source |
---|---|
93 | 1 <? |
2 // | |
155
5b92f130ba87
Add copyright header blurbs.
Matti Hamalainen <ccr@tnsp.org>
parents:
153
diff
changeset
|
3 // FAPWeb Simple Demoparty System |
5b92f130ba87
Add copyright header blurbs.
Matti Hamalainen <ccr@tnsp.org>
parents:
153
diff
changeset
|
4 // User actions page AJAX backend module |
5b92f130ba87
Add copyright header blurbs.
Matti Hamalainen <ccr@tnsp.org>
parents:
153
diff
changeset
|
5 // (C) Copyright 2012-2013 Tecnic Software productions (TNSP) |
93 | 6 // |
7 $sessionType = "user"; | |
175
8df523e6326a
User require_once instead of require.
Matti Hamalainen <ccr@tnsp.org>
parents:
165
diff
changeset
|
8 require_once "mconfig.inc.php"; |
8df523e6326a
User require_once instead of require.
Matti Hamalainen <ccr@tnsp.org>
parents:
165
diff
changeset
|
9 require_once "msite.inc.php"; |
8df523e6326a
User require_once instead of require.
Matti Hamalainen <ccr@tnsp.org>
parents:
165
diff
changeset
|
10 require_once "msession.inc.php"; |
93 | 11 |
161 | 12 // |
316 | 13 // Update one vote (prevalidated) |
161 | 14 // |
316 | 15 function stUpdateVote($key_id, $entry_id, $vote) |
93 | 16 { |
161 | 17 // Check if the vote already exists |
316 | 18 $sql = stPrepareSQL("SELECT id FROM votes WHERE key_id=%d AND entry_id=%d", |
19 $key_id, $entry_id); | |
93 | 20 |
21 if (($res = stFetchSQLColumn($sql)) === false) | |
22 { | |
161 | 23 // Didn't exist, insert it |
93 | 24 $sql = stPrepareSQL( |
316 | 25 "INSERT INTO votes (key_id,entry_id,value) VALUES (%d,%d,%d)", |
26 $key_id, $entry_id, $vote); | |
93 | 27 } |
28 else | |
29 { | |
161 | 30 // Existed, thusly update |
93 | 31 $sql = stPrepareSQL( |
316 | 32 "UPDATE votes SET value=%d WHERE key_id=%d AND entry_id=%d", |
329
899a3583666d
Yay, noscript voting also works now.
Matti Hamalainen <ccr@tnsp.org>
parents:
325
diff
changeset
|
33 $vote, $key_id, $entry_id); |
93 | 34 } |
35 | |
225 | 36 return stExecSQL($sql); |
93 | 37 } |
38 | |
39 | |
165 | 40 // |
41 // Initialize | |
42 // | |
360
2af8458058ab
Implement CSRF token checks.
Matti Hamalainen <ccr@tnsp.org>
parents:
332
diff
changeset
|
43 if (!stUserSessionAuth() || !stCSRFCheck()) |
93 | 44 { |
45 stSetupCacheControl(); | |
46 | |
47 stSessionEnd(SESS_USER); | |
48 | |
123
5837b9333964
Add new "about" page, and setting for default page.
Matti Hamalainen <ccr@tnsp.org>
parents:
101
diff
changeset
|
49 header("Location: ".stGetSetting("defaultPage")); |
93 | 50 exit; |
51 } | |
52 | |
53 stSetupCacheControl(); | |
54 | |
55 if (!stConnectSQLDB()) | |
56 die("Could not connect to SQL database."); | |
57 | |
58 stReloadSettings(); | |
59 | |
310
8098b5b80f8c
We won't be checking key validity while session is in progress, thus get rid
Matti Hamalainen <ccr@tnsp.org>
parents:
294
diff
changeset
|
60 $voteKeyId = stGetSessionItem("key_id"); |
245
bb96aef874a9
Work on the voting backend code.
Matti Hamalainen <ccr@tnsp.org>
parents:
225
diff
changeset
|
61 $voteMin = stGetSetting("voteMin"); |
bb96aef874a9
Work on the voting backend code.
Matti Hamalainen <ccr@tnsp.org>
parents:
225
diff
changeset
|
62 $voteMax = stGetSetting("voteMax"); |
93 | 63 |
310
8098b5b80f8c
We won't be checking key validity while session is in progress, thus get rid
Matti Hamalainen <ccr@tnsp.org>
parents:
294
diff
changeset
|
64 |
161 | 65 // |
66 // Handle the request | |
67 // | |
216 | 68 switch (stGetRequestItem("action")) |
93 | 69 { |
70 case "set": | |
71 // | |
153
aecf145e7c70
Some work on the voting backend.
Matti Hamalainen <ccr@tnsp.org>
parents:
123
diff
changeset
|
72 // Set vote, if voting is enabled |
93 | 73 // |
245
bb96aef874a9
Work on the voting backend code.
Matti Hamalainen <ccr@tnsp.org>
parents:
225
diff
changeset
|
74 if (!stChkSetting("allowVoting")) |
294 | 75 stError("Voting is not enabled."); |
245
bb96aef874a9
Work on the voting backend code.
Matti Hamalainen <ccr@tnsp.org>
parents:
225
diff
changeset
|
76 else |
bb96aef874a9
Work on the voting backend code.
Matti Hamalainen <ccr@tnsp.org>
parents:
225
diff
changeset
|
77 if (stChkRequestItem("entry_id", $entry_id, |
bb96aef874a9
Work on the voting backend code.
Matti Hamalainen <ccr@tnsp.org>
parents:
225
diff
changeset
|
78 array(CHK_TYPE, VT_INT, "Invalid data.")) && |
bb96aef874a9
Work on the voting backend code.
Matti Hamalainen <ccr@tnsp.org>
parents:
225
diff
changeset
|
79 stChkRequestItem("vote", $vote, |
bb96aef874a9
Work on the voting backend code.
Matti Hamalainen <ccr@tnsp.org>
parents:
225
diff
changeset
|
80 array(CHK_TYPE, VT_INT, "Invalid data."), |
294 | 81 array(CHK_RANGE, VT_INT, array($voteMin, $voteMax), "Invalid vote value."))) |
93 | 82 { |
316 | 83 // Check if the entry_id is actually valid |
84 $sql = stPrepareSQL("SELECT * FROM entries WHERE id=%d", $entry_id); | |
85 if (($entry = stFetchSQL($sql)) !== false) | |
86 { | |
87 // Check if the compo is valid for the entry | |
88 $sql = stPrepareSQL("SELECT * FROM compos WHERE id=%d", $entry["compo_id"]); | |
89 if (($compo = stFetchSQL($sql)) !== false && $compo["voting"] != 0) | |
90 { | |
91 stUpdateVote($voteKeyId, $entry_id, $vote); | |
92 } | |
93 } | |
93 | 94 } |
245
bb96aef874a9
Work on the voting backend code.
Matti Hamalainen <ccr@tnsp.org>
parents:
225
diff
changeset
|
95 break; |
bb96aef874a9
Work on the voting backend code.
Matti Hamalainen <ccr@tnsp.org>
parents:
225
diff
changeset
|
96 |
bb96aef874a9
Work on the voting backend code.
Matti Hamalainen <ccr@tnsp.org>
parents:
225
diff
changeset
|
97 case "submit": |
bb96aef874a9
Work on the voting backend code.
Matti Hamalainen <ccr@tnsp.org>
parents:
225
diff
changeset
|
98 if (!stChkSetting("allowVoting")) |
294 | 99 stError("Voting is not enabled."); |
93 | 100 else |
245
bb96aef874a9
Work on the voting backend code.
Matti Hamalainen <ccr@tnsp.org>
parents:
225
diff
changeset
|
101 { |
316 | 102 foreach (stExecSQL("SELECT * FROM compos WHERE visible<>0 AND voting<>0") as $compo) |
103 { | |
104 $cid = $compo["id"]; | |
105 foreach (stExecSQL("SELECT * FROM entries WHERE compo_id=".$cid) as $entry) | |
106 { | |
329
899a3583666d
Yay, noscript voting also works now.
Matti Hamalainen <ccr@tnsp.org>
parents:
325
diff
changeset
|
107 $value = stGetRequestItem("ventry".$entry["id"], 0); |
325 | 108 if (!stUpdateVote($voteKeyId, $entry["id"], $value)) |
109 { | |
110 stError("Could not set vote for compo #".$cid.", entry #".$entry["id"]); | |
111 break; | |
112 } | |
316 | 113 } |
114 } | |
325 | 115 if (!$errorSet) |
116 { | |
117 stSetSessionItem("mode", "done"); | |
118 header("Location: ".stGetRequestItem("goto", "vote")); | |
119 } | |
245
bb96aef874a9
Work on the voting backend code.
Matti Hamalainen <ccr@tnsp.org>
parents:
225
diff
changeset
|
120 } |
93 | 121 break; |
122 | |
123 default: | |
124 stSetStatus(404, "Not Found"); | |
125 break; | |
126 } | |
127 | |
211
5bae42020034
Factorize some code into msitegen.
Matti Hamalainen <ccr@tnsp.org>
parents:
175
diff
changeset
|
128 stDumpAJAXStatusErrors(); |
93 | 129 ?> |