login/pass: separate include to parse user input

[minimedit.git] / login / edit.php

diff --git a/login/edit.php b/login/edit.php
index 116abb302e7df0806346a55f91af3034c29d7fb9..563a3a567b6771c2962ea03a08589acce23676f5 100644 (file)
--- a/login/edit.php
+++ b/login/edit.php
@@ -1,56 +1,97 @@
 <?php
 global $User;
-if (empty($User)) {
+if (empty($user = $User)) {
        return;
 }
 
-$userdir = $User['dir'];
-$setfile = "$userdir/email.txt";
+if (!empty($User['admin']) and $Page == 'login/edit' and $Args) {
+       $username = ltrim($Args, '/');
+       $user = [
+               'dir' => "profile/$username",
+               'name' => $username,
+       ];
+       if (!is_writable($user['dir'])) {
+               print "<p class=warn>Het is niet mogelijk om de gebruiker <em>{$user['name']}</em> aan te passen.</p>\n\n";
+               return;
+       }
+}
+
+$cols = [
+       'name'  => ['label' => 'volledige naam'],
+       'email' => ['label' => 'e-mailadres', 'type' => 'email'],
+];
+
+foreach ($cols as $col => &$colconf) {
+       $colpath = "{$user['dir']}/$col.txt";
+       if (file_exists($colpath)) {
+               $colconf['value'] = file_get_contents($colpath);
+       }
+       if (!is_writable($user['dir'])) {
+               continue;  # locked parent directory
+       }
+       if (isset($colconf['value']) and !is_writable($colpath)) {
+               continue;  # locked column file
+       }
+       $colconf['target'] = $colpath;  # editing allowed
+}
+
+$cols = [
+       'login' => ['label' => 'login', 'value' => $user['name'], 'target' => NULL],
+] + $cols;
 
-$error = NULL;
+$colwarn = [];
 if ($_POST) {
-       foreach (@$_POST['email'] as $val) {
-               if (!isset($val)) {
-                       continue;
+       foreach ($_POST as $col => $val) {
+               if (!isset($cols[$col])) {
+                       continue; # unknown
+               }
+               if (isset($cols[$col]['value']) and $cols[$col]['value'] === $val) {
+                       continue; # unaltered
                }
-               if (!is_writable(file_exists($setfile) ? $setfile : $userdir)) {
-                       $error = "Kan niet worden aangepast.";
+               $cols[$col]['value'] = $val;  # update form value
+               if (empty($cols[$col]['target'])) {
+                       $colwarn[$col] = "Kan niet worden aangepast.";
                        continue;
                }
-               if (!file_put_contents($setfile, $val)) {
-                       $error = "Fout bij opslaan.";
+               if (!file_put_contents($cols[$col]['target'], $val)) {
+                       $colwarn[$col] = "Fout bij opslaan.";
                }
        }
 
-       if ($error) {
+       if ($colwarn) {
                print "<p class=warn>Instellingen zijn niet (volledig) opgeslagen. Probeer het later nog eens.</p>\n\n";
        }
        else {
-               print "<p>Het e-mailadres is ingesteld.</p>\n\n";
+               print "<p>Alle instellingen zijn opgeslagen.</p>\n\n";
        }
 }
 
-$usermail = @file_get_contents($setfile);
 ?>
-<form method="post" class="inline">
+<form method="post">
        <p>
        Geef een e-mailadres op waarmee we u kunnen bereiken indien nodig.
        Wij zullen dit adres nooit vrij- of doorgeven.
        </p>
        <p>
 <?php
-       print "\t<input";
+foreach ($cols as $col => &$colconf) {
+       print "\t";
+       printf('<label for="%s">%s:</label> ', $col, ucfirst($colconf['label']));
+       print "<input";
+       if (empty($colconf['target'])) print ' readonly';
        printf(' type="%s" name="%s" id="%1$s" value="%s"',
-               'email',
-               'email',
-               htmlspecialchars($usermail)
+               @$colconf['type'] ?: 'text',
+               $col,
+               htmlspecialchars(@$colconf['value'])
        );
-       print ' placeholder="Geen e-mailadres ingesteld"';
-       print " />\n";
+       print ' placeholder="Niet ingesteld"';
+       print " />";
 
-       if ($error) {
-               print "<span class=warn>$error</span>\n";
+       if ($error = @$colwarn[$col]) {
+               print " <span class=warn>$error</span>\n";
        }
+       print "<br />\n";
+}
 ?>
        <input type="submit" value="Opslaan" />
        </p>