From 7d08d848ca65ee92e7303201321871bb46707b86 Mon Sep 17 00:00:00 2001
From: Mischa POSLAWSKY <perl@shiar.org>
Date: Sat, 16 Jun 2018 14:48:01 +0200
Subject: [PATCH] login/edit: save file uploads for avatar option

---
 login/edit.php | 33 +++++++++++++++++++++++++++++++--
 1 file changed, 31 insertions(+), 2 deletions(-)

diff --git a/login/edit.php b/login/edit.php
index 75811ed..bb2278f 100644
--- a/login/edit.php
+++ b/login/edit.php
@@ -15,12 +15,17 @@ if (!empty($User['admin']) and $Page == 'login/edit' and $Args) {
 $cols = [
 	'name'  => ['label' => 'volledige naam'],
 	'email' => ['label' => 'e-mailadres', 'type' => 'email'],
+	'avatar' => [
+		'label' => 'portretfoto',
+		'type' => 'file',
+	],
 ];
 
 foreach ($cols as $col => &$colconf) {
 	$colpath = "{$user['dir']}/$col.txt";
 	if (file_exists($colpath)) {
-		$colconf['value'] = file_get_contents($colpath);
+		$colconf['value'] = @$colconf['type'] == 'file' ? '' :
+			file_get_contents($colpath);
 	}
 	if (file_exists($user['dir']) and !is_writable($user['dir'])) {
 		continue;  # locked parent directory
@@ -41,6 +46,7 @@ if ($_POST) {
 		print "<p class=warn>Fout bij het aanmaken van gebruikersprofiel voor <em>{$user['name']}</em>.</p>\n\n";
 		return;
 	}
+
 	foreach ($_POST as $col => $val) {
 		if (!isset($cols[$col])) {
 			continue; # unknown
@@ -58,6 +64,29 @@ if ($_POST) {
 		}
 	}
 
+	foreach ($_FILES as $col => $val) {
+		if (!isset($cols[$col]) and @$cols[$col]['type'] == 'file') {
+			continue; # unknown
+		}
+		switch ($val['error']) {
+		case UPLOAD_ERR_OK:
+			break;
+		case UPLOAD_ERR_NO_FILE:
+			continue 2; # current
+		default:
+			$colwarn[$col] = "Afbeelding niet goed ontvangen.";
+			continue 2;
+		}
+		if (empty($cols[$col]['target'])) {
+			$colwarn[$col] = "Kan niet worden aangepast.";
+			continue;
+		}
+		if (!@move_uploaded_file($val['tmp_name'], $cols[$col]['target'])) {
+			$colwarn[$col] = "Fout bij opslaan.";
+		}
+		$cols[$col]['value'] = '';
+	}
+
 	if (!empty($_POST['newpass'])) {
 		require_once('login/pass.inc.php');
 		if ($error = passform($user, $_POST)) {
@@ -74,7 +103,7 @@ if ($_POST) {
 }
 
 ?>
-<form method="post">
+<form method="post" enctype="multipart/form-data">
 	<p>
 	Geef een e-mailadres op waarmee we u kunnen bereiken indien nodig.
 	Wij zullen dit adres nooit vrij- of doorgeven.
-- 
2.30.0