Skip to content

Commit 5a7ef72

Browse files
zTheArchitectzTheArchitect
committed
messagesystem: Makes zorg Messaging work again
1 parent 5eef679 commit 5a7ef72

File tree

9 files changed

+92
-77
lines changed

9 files changed

+92
-77
lines changed

‎app/templates/layout/partials/messages/messages_list.tpl‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -4,35 +4,35 @@
44
<strong>Ausgew&auml;hlte Nachricht wurde gel&ouml;scht</strong>
55
</div>
66
{/if}
7-
<form name="inboxform" method="POST" action="{$form_action}">
7+
<style>
8+
table .messages > tbody > tr:nth-child(odd){ldelim}background-color:{$smarty.const.TABLEBACKGROUNDCOLOR}{rdelim}
9+
table .messages > tbody > .new{ldelim}background-color:{$smarty.const.NEWCOMMENTCOLOR} !important{rdelim}
10+
table .messages > tbody > .my{ldelim}background-color:{$smarty.const.OWNCOMMENTCOLOR} !important{rdelim}
11+
</style>
12+
<table class="border messages" width="100%">{assign var="cols_total" value=5}
13+
<thead>
14+
<tr>
15+
<th align="right" colspan="{$cols_total-2}">
16+
<h3>{if $box == 'inbox'}
17+
Empfangen / <a href="{get_changed_url change="box=outbox&user_id=`$user->id`"}">Gesendet</a>
18+
{elseif $box == 'outbox'}
19+
<a href="{get_changed_url change="box=inbox&user_id=`$user->id`"}">Empfangen</a> / Gesendet
20+
{/if}</h3>
21+
</th>
22+
<th align="right" colspan="{$cols_total-3}">
23+
<a href="/profil.php?do=newmsg&user_id={$user->id}"><button class="button primary" name="button_newMessage" style="float:right;">Neue Nachricht</button></a>
24+
</th>
25+
</tr>
26+
<tr>
27+
<th style="width:5%"><input class="button" onClick="selectAllMessages();" type="button" value="Alle"></th>
28+
<th style="width:20%"><a href="{get_changed_url change="sort=date&order=asc"}">Datum</a></th>
29+
<th style="width:35%;text-align:left;"><a href="{get_changed_url change="sort=subject"}">Message</a></th>
30+
<th style="width:15%"><a href="{get_changed_url change="sort=from_user_id"}">Sender</a></th>
31+
<th style="width:25%">Empf&auml;nger</th>
32+
</tr>
33+
</thead>
34+
<form name="inboxform" method="POST" action="{$form_action}">
835
<input type="hidden" name="url" value="{$form_url}">
9-
<style>
10-
table .messages > tbody > tr:nth-child(odd){ldelim}background-color:{$smarty.const.TABLEBACKGROUNDCOLOR}{rdelim}
11-
table .messages > tbody > .new{ldelim}background-color:{$smarty.const.NEWCOMMENTCOLOR} !important{rdelim}
12-
table .messages > tbody > .my{ldelim}background-color:{$smarty.const.OWNCOMMENTCOLOR} !important{rdelim}
13-
</style>
14-
<table class="border messages" width="100%">{assign var="cols_total" value=5}
15-
<thead>
16-
<tr>
17-
<th align="right" colspan="{$cols_total-2}">
18-
<h3>{if $box == 'inbox'}
19-
Empfangen / <a href="{get_changed_url change='box=outbox'}">Gesendet</a>
20-
{elseif $box == 'outbox'}
21-
<a href="{get_changed_url change='box=inbox'}">Empfangen</a> / Gesendet
22-
{/if}</h3>
23-
</th>
24-
<th align="right" colspan="{$cols_total-3}">
25-
<a href="{get_changed_url change="do=newmsg"}{*$newmsg_url*}"><button class="button primary" name="button_newMessage" style="float:right;">Neue Nachricht</button></a>
26-
</th>
27-
</tr>
28-
<tr>
29-
<th style="width:5%"><input class="button" onClick="selectAllMessages();" type="button" value="Alle"></th>
30-
<th style="width:20%"><a href="{get_changed_url change="sort=date&order=asc"}">Datum</a></th>
31-
<th style="width:35%;text-align:left;"><a href="{get_changed_url change="sort=subject"}">Message</a></th>
32-
<th style="width:15%"><a href="{get_changed_url change="sort=from_user_id"}">Sender</a></th>
33-
<th style="width:25%">Empf&auml;nger</th>
34-
</tr>
35-
</thead>
3636
<tbody>
3737
{section name='message' loop=$messages}
3838
<tr {if $messages[message].isread == 0}class="new"{elseif $messages[message].from_user_id == $user->id}class="my"{/if}>
@@ -89,5 +89,5 @@
8989
</td>
9090
</tr>
9191
</tfoot>
92-
</table>
93-
</form>
92+
</form>
93+
</table>

‎public/.htaccess‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,11 @@ ErrorDocument 500 /error_static.html
1515
RewriteRule smarty.php / [R=301,QSA,NC,NE,L]
1616

1717
# Pretty URL for User Profile page
18+
# Redirect /user/X to /profil.php?user_id=X (preserve other params)
1819
# https://httpd.apache.org/docs/trunk/rewrite/remapping.html#rewrite-query
19-
RewriteCond %{QUERY_STRING} user_id=([0-9]+)
20-
RewriteRule profil.php /user/%1 [R=301,QSA,L]
20+
RewriteRule ^user/([^/]+)/?$ /profil.php?user_id=$1 [R=301,QSA,NC,L]
21+
# Redirect /user to /profil.php (preserve query params)
22+
RewriteRule ^user/?$ /profil.php [R=301,QSA,NC,L]
2123

2224
# Pretty URL for Bugtracker Bug pages
2325
RewriteCond %{QUERY_STRING} bug_id=([0-9]+)

‎public/includes/messagesystem.inc.php‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -47,11 +47,12 @@ class Messagesystem
4747
*
4848
* Controller für diverse Message Actions
4949
*
50-
* @version 2.2
50+
* @version 2.3
5151
* @since 1.0 `[z]milamber` method added
5252
* @since 2.0 `IneX` code optimizations
5353
* @since 2.1 `04.04.2021` `IneX` fixed wrong check if own message, and PHP Deprecated: Non-static method Messagesystem::sendMessage()
5454
* @since 2.2 `04.12.2024` `IneX` fixed passing NULL to htmlspecialchars_decode() stringg parameter is deprecated
55+
* @since 2.3 `15.11.2025` `IneX` Code hardenings
5556
*
5657
* @uses BARBARA_HARRIS
5758
* @uses Messagesystem::sendMessage()
@@ -64,7 +65,7 @@ static function execActions($doAction=null)
6465
global $user;
6566

6667
/** Validate parameters */
67-
$doAction = filter_var($doAction, FILTER_DEFAULT, FILTER_REQUIRE_SCALAR) ?? null;
68+
$doAction = filter_var($doAction, FILTER_SANITIZE_SPECIAL_CHARS) ?? null;
6869
zorgDebugger::log()->debug('$doAction: %s', [$doAction]);
6970
if (isset($_POST['message_id']) && is_array($_POST['message_id'])) { // $_POST['message_id'] (multiple)
7071
$i=0;
@@ -78,7 +79,7 @@ static function execActions($doAction=null)
7879
$deleteMessageId = filter_input(INPUT_POST, 'delete_message_id', FILTER_VALIDATE_INT) ?? null; // $_POST['delete_message_id']
7980
$msgSubject = htmlspecialchars_decode(filter_input(INPUT_POST, 'subject', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?: '', ENT_COMPAT | ENT_SUBSTITUTE);
8081
$msgText = htmlspecialchars_decode(filter_input(INPUT_POST, 'text', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?: '', ENT_COMPAT | ENT_SUBSTITUTE);
81-
$headerLocation = base64url_decode(filter_input(INPUT_POST, 'url', FILTER_SANITIZE_FULL_SPECIAL_CHARS)) ?? sprintf('%s/user/%d?box=inbox', SITE_URL, $user->id);
82+
$headerLocation = base64url_decode(filter_input(INPUT_POST, 'url', FILTER_SANITIZE_ENCODED)) ?? sprintf('%s/user/%d?box=inbox', SITE_URL, $user->id);
8283
zorgDebugger::log()->debug('header() Location: %s', [$headerLocation]);
8384

8485
if($doAction === 'sendmessage')
@@ -206,7 +207,7 @@ static function execActions($doAction=null)
206207
* @param integer $deleter_userid User-ID welcher die Nachricht(en) löscht
207208
* @global object $db Globales Class-Object mit allen MySQL-Methoden
208209
*/
209-
function deleteMessage($messageid, $deleter_userid)
210+
static function deleteMessage($messageid, $deleter_userid)
210211
{
211212
global $db;
212213

@@ -328,12 +329,9 @@ static function getFormDelete($id)
328329
*
329330
* Baut das HTML-Formular um eine neue Nachrichten zu versenden
330331
*
331-
* @author [z]milamber
332-
* @author IneX
333-
* @date 23.06.2018
334332
* @version 2.0
335-
* @since 1.0 initial method release
336-
* @since 2.0 frontend is now a template - as it should be
333+
* @since 1.0 `[z]milamber`initial method release
334+
* @since 2.0 `23.06.2018` `IneX` frontend is now a template - as it should be
337335
*
338336
* @param string $to_users Alle Empfänger der Nachricht
339337
* @param string $subject Titel der Nachricht
@@ -348,11 +346,11 @@ static function getFormSend($to_users, $subject, $text, $delete_message_id=0)
348346
global $user, $smarty;
349347

350348
$smarty->assign('form_action', base64url_decode(getURL()));
351-
$smarty->assign('form_url', getURL());
349+
$smarty->assign('form_url', base64url_encode('/profil.php?user_id='.strval($user->id).'&box=outbox'));
352350
$smarty->assign('subject', $subject);
353351
$smarty->assign('text', $text);
354352
$smarty->assign('userlist', $user->getFormFieldUserlist('to_users[]', 15, $to_users, 4));
355-
$smarty->assign('backlink_url', '/user/'.$user->id.'?box=inbox');
353+
$smarty->assign('backlink_url', '/profil.php?user_id='.strval($user->id).'&box=inbox');
356354
$smarty->assign('delete_message_id', $delete_message_id);
357355

358356
return $smarty->fetch('file:layout/partials/messages/messages_send.tpl');
@@ -632,7 +630,7 @@ static function getPrevMessageid($id)
632630
* @global object $db Globales Class-Object mit allen MySQL-Methoden
633631
* @return boolean Returns true or false, depening on the susccessful execution
634632
*/
635-
function sendMessage($from_user_id, $owner, $subject, $text='', $to_users='', $isread='0')
633+
static function sendMessage($from_user_id, $owner, $subject, $text='', $to_users='', $isread='0')
636634
{
637635
global $db, $notification;
638636

‎public/includes/notifications.inc.php‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,8 +124,14 @@ public function send($user_id, $notification_source, $content)
124124
/** Validate $content for $notification_type 'message' */
125125
if (!empty($content['message']) && !is_numeric($content['message']) && !is_array($content['message']))
126126
{
127+
/** If $notification_source is 'messagesystem' add some more Context for Telegram */
128+
if ($notification_source === 'messagesystem')
129+
{
130+
$zMessageSenderName = (isset($content['from_user_id']) ? $user->id2user($content['from_user_id'], true) : 'someone');
131+
$content['subject'] = sprintf('<blockquote>zorg Message from %s</blockquote>\n%s', $zMessageSenderName, $content['subject']);
132+
}
127133
/** Send notification */
128-
$content['parameters'] = ['disable_web_page_preview' => 'false']; // TODO TEMP - REMOVE LATER! / Re-enabled because don't know why disabled... [17.01.2024/IneX]
134+
$content['parameters'] = ['disable_web_page_preview' => 'false'];
129135
if (isset($content['subject']) && !empty($content['subject'])) $content['message'] = $content['subject'].': '.$content['message']; // Merge Subject + Message
130136
$telegram->send->message($user_id, $content['message'], $content['parameters']);
131137
} else {

‎public/includes/telegrambot.inc.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ public function send($userScope, $messageType, $content)
100100
if (isset($botconfigs) && is_array($botconfigs))
101101
{
102102
/** Get the corresponding Telegram Chat-ID */
103-
if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> $userScope: %s', __METHOD__, __LINE__, $userScope));
103+
zorgDebugger::log()->debug('$userScope: %s', [$userScope]);
104104
switch ($userScope)
105105
{
106106
/** USER: If $userScope = User-ID: get the Telegram Chat-ID */
@@ -125,7 +125,7 @@ public function send($userScope, $messageType, $content)
125125
/** When we got a Telegram Chat-ID... */
126126
if (!empty($telegramChatId))
127127
{
128-
if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> found Telegram Chat-ID: %s', __METHOD__, __LINE__, $telegramChatId));
128+
zorgDebugger::log()->debug('Found Telegram Chat-ID: %s', [$telegramChatId]);
129129

130130
/** Build API Call */
131131
$parameters = array_merge( $content, [ 'chat_id' => $telegramChatId ] );
@@ -262,13 +262,13 @@ public function formatText($notificationText)
262262
/**
263263
* Strip away all HTML-tags & unix line breaks
264264
* Except from the whitelist:
265-
* <b>, <strong>, <i>, <em>, <a>, <code>, <pre>
265+
* <a>, <b>, <blockquote>, <code>, <em>, <i>, <pre>, <strong>
266266
* -> However: "Tags must not be nested"!
267267
*/
268268
$notificationText = stripslashes($notificationText); // remove escaping slashes
269269
$notificationText = str_replace(array('&nbsp;', ' '), ' ', $notificationText); // spaces
270270
$notificationText = str_replace(array("\r\n", "\r\n ", "\r", "\r ", "\n "), "\n", $notificationText); // line-breaks
271-
$notificationText = remove_html($notificationText, '<b><strong><i><em><a><code><pre>'); // html-tags
271+
$notificationText = remove_html($notificationText, '<b><strong><i><em><a><code><pre><blockquote>'); // html-tags
272272

273273
/**
274274
* Cleanup nested HTML-Tags, e.g. <a ...><i>text</i></a>

‎public/includes/usersystem.inc.php‎

Lines changed: 22 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1264,35 +1264,38 @@ function userImage($userid, $large=false)
12641264
/**
12651265
* Retrieve list of Users for Notification-Messages in Comments or Personal Messages
12661266
*
1267-
* @deprecated
1268-
*
1269-
* @author IneX
1270-
* @date 26.12.2017
1271-
*
1272-
* @TODO remove this function 'getFormFieldUserlist()' & make sure to remove all references in corresponding files pointing to it
1267+
* // TODO Make this method obsolete / deprecated once all forms referencing it support inline "@mention" / IneX
1268+
*
1269+
* @1.6
1270+
* @version 1.0 method added
1271+
* @version 1.5 `26.12.2017` `IneX` Corde hardening, and using SQL prepared statement
1272+
* @version 1.5 `26.12.2017` `IneX` Corde hardening, and using SQL prepared statement
1273+
*
1274+
* @param string $name Name to use for the Select-Container
1275+
* @param integer $size (Optional) Column-based Width of the Select-Container. Default: 15 (cols)
1276+
* @param array $users_selected Array (Optional) with User-IDs that should be pre-selected. Default: none
1277+
* @param integer $tabindex (Optional) Keyboard Tabbing index of the element. Default: 10
1278+
* @return string Full HTML-markup of the Select-Container
12731279
*/
1274-
function getFormFieldUserlist($name, $size, $users_selected=0, $tabindex=10) {
1280+
function getFormFieldUserlist($name, $size=15, $users_selected=0, $tabindex=10) {
12751281
global $db;
12761282

12771283
/** Wenn User ganz neue Message schreibt */
1278-
if (empty($users_selected) || $users_selected === 0) $users_selected = [];
1284+
if (empty($users_selected)) $users_selected = [];
1285+
/** Make an Array, if comma-separated String - or only 1 value (UserID) provided */
1286+
else if (!is_array($users_selected)) $users_selected = explode(',', $users_selected);
12791287

1280-
/** check and make an Array, if necessary */
1281-
if (!is_array($users_selected)) // Fixes: PHP Warning: strpos() expects parameter 1 to be string, array given
1282-
{
1283-
if (strpos($users_selected, ',') !== false) $users_selected = explode(',', $users_selected);
1284-
}
12851288
/** Remove any duplicate User-IDs */
12861289
$users_selected = array_unique($users_selected);
12871290

1288-
$sql = 'SELECT id, clan_tag, username FROM user'
1289-
.' WHERE UNIX_TIMESTAMP(lastlogin) > (UNIX_TIMESTAMP(NOW())-?)'
1290-
.' OR z_gremium = "1" OR (vereinsmitglied != "0" AND vereinsmitglied != "")'
1291-
.(!empty($users_selected) ? ' OR id IN (?)' : null)
1291+
$sql = 'SELECT id, clan_tag, username FROM user
1292+
WHERE UNIX_TIMESTAMP(lastlogin) > (UNIX_TIMESTAMP(NOW())-?)
1293+
OR z_gremium = "1" OR (vereinsmitglied != "0" AND vereinsmitglied != "")
1294+
'.(!empty($users_selected) ? ' OR id IN (?)' : null)
12921295
.' ORDER BY clan_tag DESC, username ASC'
12931296
;
1294-
$params = [ USER_OLD_AFTER*2 ];
1295-
if (!empty($users_selected)) { $params[] = implode(',', $users_selected); }
1297+
$params[] = USER_OLD_AFTER*2;
1298+
if (!empty($users_selected)) $params[] = implode(',', $users_selected);
12961299
$result = $db->query($sql, __FILE__, __LINE__, __METHOD__, $params);
12971300

12981301
$html = '<select multiple="multiple" name="'.$name.'" size="'.$size.'" tabindex="'.$tabindex.'">';

‎public/index.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
switch ($routeSwitch)
2828
{
2929
/** Route: /user/[user-id|username] */
30-
case 'username':
30+
case 'user_id':
3131
$getUserId = ( is_numeric($routeValue) ? $routeValue : $user->user2id($routeValue) );
3232
if (!empty($getUserId)) {
3333
$_GET['user_id'] = $getUserId;

‎public/messagesystem.php‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -65,11 +65,14 @@
6565
}
6666

6767
$html .= '<br />';
68+
$preselect_to_users = [];
69+
if (intval($messageDetails['from_user_id']) === $user->id) $preselect_to_users = $messageDetails['to_users'];
70+
else $preselect_to_users[] = intval($messageDetails['from_user_id']);
6871
$html .= Messagesystem::getFormSend(
69-
array(intval($messageDetails['from_user_id']))
70-
, $subject, '> '.str_replace("\n", "\n> "
71-
, $messageDetails['text'])
72-
, $messageId
72+
$preselect_to_users
73+
,$subject, '> '.str_replace("\n", "\n> "
74+
,$messageDetails['text'])
75+
,$messageId
7376
);
7477
}
7578
/** User darf diese Nachricht nicht lesen (weil es nicht seine ist, doh!) */

‎public/profil.php‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,17 +9,20 @@
99
* File includes
1010
* @include main.inc.php required
1111
* @include core.model.php required
12+
* @include messagesystem.inc.php required
1213
*/
1314
require_once __DIR__.'/includes/config.inc.php';
15+
require_once INCLUDES_DIR.'messagesystem.inc.php';
1416
require_once MODELS_DIR.'core.model.php';
1517

1618
/**
1719
* Validate GET-Parameters
1820
*/
19-
$doAction = (isset($doAction) ? $doAction : (filter_input(INPUT_GET, 'do', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR) ?? null)); // $_GET['do']
20-
$postDoAction = filter_input(INPUT_POST, 'do', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR) ?? null; // $_POST['do']
21-
$user_id = (isset($getUserId) ? intval($getUserId) : (filter_input(INPUT_GET, 'user_id', FILTER_VALIDATE_INT) ?? null)); // $_GET['user_id']
21+
$doAction = filter_input(INPUT_GET, 'do', FILTER_SANITIZE_SPECIAL_CHARS) ?? null; // $_GET['do']
22+
$postDoAction = filter_input(INPUT_POST, 'action', FILTER_SANITIZE_SPECIAL_CHARS) ?? null; // $_POST['action']
2223
$userRegcode = filter_input(INPUT_GET, 'regcode', FILTER_SANITIZE_SPECIAL_CHARS) ?? null; // $_GET['regcode']
24+
$user_id = (isset($getUserId) ? $getUserId : (filter_input(INPUT_GET, 'user_id', FILTER_SANITIZE_SPECIAL_CHARS) ?? null)); // $_GET['user_id']
25+
$user_id = !empty($user_id) ? (ctype_digit($user_id) ? intval($user_id) : $user->user2id($user_id)) : null;
2326
$view_as_user = filter_input(INPUT_GET, 'viewas', FILTER_VALIDATE_INT) ?? null; // $_GET['viewas']
2427
$messageToUsers = filter_input(INPUT_GET, 'msgusers', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?? null; // $_GET['msgusers']
2528
$messageSubject = filter_input(INPUT_GET, 'msgsubject', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?? null; // $_GET['msgsubject']
@@ -220,7 +223,7 @@
220223

221224
/** Der User ist jemand anderes */
222225
} else {
223-
$htmlOutput .= Messagesystem::getFormSend(array($user_id), '', '');
226+
$htmlOutput .= Messagesystem::getFormSend([$user_id], '', '');
224227
}
225228

226229
/** User markierte Gallery-Pics */

0 commit comments

Comments
 (0)