Added functionality to update country + gender + added some xss security

--HG--
branch : quitta-gsoc-2013

code/ryzom/tools/server/ryzom_ams/www/html/func/change_info.php

@@ -19,17 +19,24 @@ function change_info(){
                     $webUser = new WebUsers();
                     //use current info to check for changes
                     $current_info = $webUser->getInfo($_POST['target_id']);
-                    //TODO: XSS filtering
 		    
-                    //make the query that will update the data.
+                    //TODO: XSS filtering
+		    $current_info['FirstName'] = filter_var($current_info['FirstName'], FILTER_SANITIZE_STRING);
+		    $current_info['LastName'] = filter_var($current_info['LastName'], FILTER_SANITIZE_STRING);
+		    $current_info['Country'] = filter_var($current_info['Country'], FILTER_SANITIZE_STRING);
+		    $current_info['Gender'] = filter_var($current_info['Gender'], FILTER_SANITIZE_NUMBER_INT);
+		
+                    
                     $updated = false;
                     $values = Array();
                     $values['user'] = $target_username;
+		    
+		    //make the query that will update the data.
                     $query = "UPDATE ams_user SET ";
                     if(($_POST['FirstName'] != "") && ($_POST['FirstName'] != $current_info['FirstName'])){
                         $query = $query . "FirstName = :fName ";
                         $updated = true;
-                        $values['fName'] = $_POST['FirstName'];
+                        $values['fName'] = filter_var($_POST['FirstName'], FILTER_SANITIZE_STRING);
                     }
                     if(($_POST['LastName'] != "") && ($_POST['LastName'] != $current_info['LastName'])){
 			if($updated){
@@ -38,9 +45,27 @@ function change_info(){
 			 $query = $query . "LastName = :lName ";
 			}
                         $updated = true;
-                        $values['lName'] = $_POST['LastName'];
+                        $values['lName'] = filter_var($_POST['LastName'], FILTER_SANITIZE_STRING);
                     }
-                    //TODO: add the other fields too
+		    if(($_POST['Country'] != "AA") && ($_POST['Country'] != $current_info['Country'])){
+			if($updated){
+			 $query = $query . ", Country = :country ";
+			}else{
+			 $query = $query . "Country = :country ";
+			}
+                        $updated = true;
+                        $values['country'] = filter_var($_POST['Country'], FILTER_SANITIZE_STRING);
+		    }
+		    if($_POST['Gender'] != $current_info['Gender']){
+			if($updated){
+			 $query = $query . ", Gender = :gender ";
+			}else{
+			 $query = $query . "Gender = :gender ";
+			}
+                        $updated = true;
+                        $values['gender'] = filter_var($_POST['Gender'], FILTER_SANITIZE_NUMBER_INT);
+		    } 
+                    //finish the query!
                     $query = $query . "WHERE Login = :user";
 
                     //if some field is update then:
@@ -61,23 +86,24 @@ function change_info(){
                     $result['username'] = $_SESSION['user'];
                     $result['no_visible_elements'] = 'FALSE';
                     $result['target_id'] = $_POST['target_id'];
-                    if(isset($_GET['id'])){
-                        if(WebUsers::isAdmin() && ($_POST['target_id'] != $_SESSION['id'])){
-                            $result['isAdmin'] = "TRUE";
-                        }
-                    }
                     helpers :: loadtemplate( 'settings', $result);
                     exit;
                     
                 }else{
                     //ERROR: permission denied!
+		    $_SESSION['error_code'] = "403";
+                    header("Location: index.php?page=error");
+                    exit;
                 }
         
             }else{
                 //ERROR: The form was not filled in correclty
+		header("Location: index.php?page=settings");
+		exit;
             }    
         }else{
             //ERROR: user is not logged in
+	    header("Location: index.php");
 	    exit;
         }
                   

code/ryzom/tools/server/ryzom_ams/www/html/func/change_mail.php

@@ -28,10 +28,10 @@ function change_mail(){
 		    }else{
 			$result['EMAIL_ERROR'] = 'FALSE';
 		    }
-		    $result['prevNewEmail'] = $_POST["NewEmail"];
+		    $result['prevNewEmail'] = filter_var($_POST["NewEmail"], FILTER_SANITIZE_EMAIL);
 		    
                     if ($reply== "success"){
-                        $status = WebUsers::setEmail($target_username, $_POST["NewEmail"] );
+                        $status = WebUsers::setEmail($target_username, filter_var($_POST["NewEmail"], FILTER_SANITIZE_EMAIL) );
                         if($status == 'ok'){
                             $result['SUCCESS_MAIL'] = "OK";
                         }else if($status == 'shardoffline'){
@@ -66,13 +66,19 @@ function change_mail(){
                     
                 }else{
                     //ERROR: permission denied!
+		    $_SESSION['error_code'] = "403";
+                    header("Location: index.php?page=error");
+                    exit;
                 }
         
             }else{
                 //ERROR: The form was not filled in correclty
+		header("Location: index.php?page=settings");
+		exit;
             }    
         }else{
             //ERROR: user is not logged in
+	    header("Location: index.php");
 	    exit;
         }
                   

code/ryzom/tools/server/ryzom_ams/www/html/func/change_password.php

@@ -42,12 +42,12 @@ function change_password(){
                         exit;
                          
                     }else{
-                        $result['prevCurrentPass'] = $_POST["CurrentPass"];
+                        $result['prevCurrentPass'] = filter_var($_POST["CurrentPass"], FILTER_SANITIZE_STRING);
-                        $result['prevNewPass'] = $_POST["NewPass"];
+                        $result['prevNewPass'] = filter_var($_POST["NewPass"], FILTER_SANITIZE_STRING);
-                        $result['prevConfirmNewPass'] = $_POST["ConfirmNewPass"];
+                        $result['prevConfirmNewPass'] = filter_var($_POST["ConfirmNewPass"], FILTER_SANITIZE_STRING);
                         $result['permission'] = $_SESSION['permission'];
                         $result['no_visible_elements'] = 'FALSE';
-                        $return['username'] = $_SESSION['user'];
+                        $result['username'] = $_SESSION['user'];
                         $result['target_id'] = $_POST['target_id'];
 
                         global $SITEBASE;
@@ -61,13 +61,19 @@ function change_password(){
                     
                 }else{
                     //ERROR: permission denied!
+		    $_SESSION['error_code'] = "403";
+                    header("Location: index.php?page=error");
+                    exit;
                 }
         
             }else{
                 //ERROR: The form was not filled in correclty
+		header("Location: index.php?page=settings");
+		exit;
             }    
         }else{
             //ERROR: user is not logged in
+	    header("Location: index.php");
 	    exit;
         }
                   

code/ryzom/tools/server/ryzom_ams/www/html/inc/settings.php

@@ -21,6 +21,14 @@ function settings(){
                 $result = WebUsers::getInfo($_SESSION['id']);
                 $result['target_id'] = $_SESSION['id'];
                 $result['current_mail'] = WebUsers::getEmail($_SESSION['id']);
+                
+                //Sanitize Data
+                $result['current_mail'] = filter_var($result['current_mail'], FILTER_SANITIZE_EMAIL);
+                $result['Login'] = filter_var($result['Login'], FILTER_SANITIZE_STRING);
+                $result['FirstName'] = filter_var($result['FirstName'], FILTER_SANITIZE_STRING);
+                $result['LastName'] = filter_var($result['LastName'], FILTER_SANITIZE_STRING);
+                $result['Country'] = filter_var($result['Country'], FILTER_SANITIZE_STRING);
+                $result['Gender'] = filter_var($result['Gender'], FILTER_SANITIZE_NUMBER_INT);
             }
             $result['country_array'] = getCountryArray();
             return $result;