[svn r20622] Slightly improved filtering, presentation and documentation (related to FS#4187)

main/inc/lib/message.lib.php

@@ -22,8 +22,8 @@
 ==============================================================================
 */
 
-include_once(api_get_path(LIBRARY_PATH).'/online.inc.php');
-require_once '../messages/message.class.php';
+require_once api_get_path(LIBRARY_PATH).'online.inc.php';
+require_once api_get_path(SYS_CODE_PATH).'messages/message.class.php';
 function inbox_display() {
 	$charset = api_get_setting('platform_charset');
 	$table_message = Database::get_main_table(TABLE_MESSAGE); 
@@ -32,23 +32,22 @@ function inbox_display() {
 		$redirect="#remote-tab-2";	
 		if (api_get_setting('allow_social_tool')=='true' && api_get_setting('allow_message_tool')=='true') {
 			$success= get_lang('SelectedMessagesDeleted').
-			"&nbsp
+			" 
 			<br /><a href=\"".
 			"../social/index.php?$redirect\">".
 			get_lang('BackToInbox').
 			"</a>";
 		} else {
 			$success= get_lang('SelectedMessagesDeleted').
-			"&nbsp
+			"&nbsp;
 			<br /><a href=\"".
 			"../social/index.php?$redirect\">".
 			get_lang('BackToInbox').
 			"</a>";				
 		}
-			
 	} else {
 		$success= get_lang('SelectedMessagesDeleted').
-			"&nbsp
+			"&nbsp;
 			<br /><a href=\"".
 			"inbox.php\">".
 			get_lang('BackToOutbox').

main/messages/send_message.php

@@ -25,20 +25,20 @@
 */
 $language_file = array('registration','messages','userInfo','admin');
 $cidReset=true;
-include_once ('../inc/global.inc.php');
+require_once '../inc/global.inc.php';
 require_once '../messages/message.class.php';
-include_once(api_get_path(LIBRARY_PATH).'/usermanager.lib.php');
-include_once(api_get_path(LIBRARY_PATH).'/message.lib.php');
-include_once(api_get_path(LIBRARY_PATH).'/social.lib.php');
+require_once api_get_path(LIBRARY_PATH).'usermanager.lib.php';
+require_once api_get_path(LIBRARY_PATH).'message.lib.php';
+require_once api_get_path(LIBRARY_PATH).'social.lib.php';
 
 if (api_is_anonymous()) {
 	api_not_allowed();
 }
 
-$user_id=$_POST['user_id'];
-$panel_id=$_POST['panel_id'];
-$content_message=$_POST['txt_content'];
-$subject_message=$_POST['txt_subject'];
+$user_id=intval($_POST['user_id']);
+$panel_id=intval($_POST['panel_id']);
+$content_message=$_POST['txt_content']; //check this is filtered on output
+$subject_message=$_POST['txt_subject']; //check this is filtered on output
 $user_info=array();
 $user_info=api_get_user_info($user_id);
 if ($panel_id==2) {

main/messages/send_message_to_userfriend.inc.php

@@ -2,11 +2,11 @@
 /* For licensing terms, see /dokeos_license.txt */
 $language_file = array('registration','messages','userInfo','admin');
 $cidReset=true;
-include_once ('../inc/global.inc.php');
+require_once '../inc/global.inc.php';
 require_once '../messages/message.class.php';
-include_once(api_get_path(LIBRARY_PATH).'/usermanager.lib.php');
-include_once(api_get_path(LIBRARY_PATH).'/message.lib.php');
-include_once(api_get_path(LIBRARY_PATH).'/social.lib.php');
+require_once api_get_path(LIBRARY_PATH).'usermanager.lib.php';
+require_once api_get_path(LIBRARY_PATH).'message.lib.php';
+require_once api_get_path(LIBRARY_PATH).'social.lib.php';
 if (api_is_anonymous()) {
 	api_not_allowed();
 }

main/social/register_friend.php

@@ -1,27 +1,25 @@
-<?php
-/*
- * Created on 24/01/2009
- *
- * To change the template for this generated file go to
- * Window - Preferences - PHPeclipse - PHP - Code Templates
+<?php //$id: $
+/* For licensing terms, see /dokeos_license.txt */
+/**
+ * Provides a short controller for friends registration
  */
- // name of the language file that needs to be included
+ // names of the language files that needs to be included
 $language_file = array('registration','messages','userInfo','admin');
 require '../inc/global.inc.php';
-include_once (api_get_path(LIBRARY_PATH).'image.lib.php');
-require_once (api_get_path(LIBRARY_PATH).'usermanager.lib.php');
+require_once api_get_path(LIBRARY_PATH).'image.lib.php';
+require_once api_get_path(LIBRARY_PATH).'usermanager.lib.php';
 require_once api_get_path(LIBRARY_PATH).'social.lib.php';
 $the_current_user_id	 = api_get_user_id();
-$my_current_friend		 = $_POST['friend_id'];
-$my_denied_current_friend= $_POST['denied_friend_id'];
-$my_delete_friend        = $_POST['delete_friend_id'];
-$friend_id_qualify       = $_POST['user_id_friend_q'];
-$type_friend_qualify     = $_POST['type_friend_q'];
-$is_my_friend            = $_POST['is_my_friend'];
+$my_current_friend		 = intval($_POST['friend_id']);
+$my_denied_current_friend= intval($_POST['denied_friend_id']);
+$my_delete_friend        = intval($_POST['delete_friend_id']);
+$friend_id_qualify       = intval($_POST['user_id_friend_q']);
+$type_friend_qualify     = $_POST['type_friend_q']; //filtered?
+$is_my_friend            = $_POST['is_my_friend']; //filtered?
 if (isset($is_my_friend)) {
 	$relation_type='3';//my friend
 } else {
-	$relation_type='1';//Contact unknow	
+	$relation_type='1';//Contact unknown	
 }
 
 

main/social/select_friend_response.php

@@ -122,4 +122,3 @@ cellpadding="0" cellspacing="0" bgcolor="#9DACBF">
 <br/>
 <?php
 }
-?>