');
$form->addElement(
'text',
'api_key_generate',
get_lang('MyApiKey'),
['size' => 40, 'id' => 'id_api_key_generate']
);
$form->addElement('html', '
');
$form->addButton(
'generate_api_key',
get_lang('GenerateApiKey'),
'cogs',
'default',
'default',
null,
['id' => 'id_generate_api_key']
);
}
// SUBMIT
if (is_profile_editable()) {
$form->addButtonUpdate(get_lang('SaveSettings'), 'apply_change');
} else {
$form->freeze();
}
// Student cannot modified their user conditions
$extraConditions = api_get_configuration_value('show_conditions_to_user');
if ($extraConditions && isset($extraConditions['conditions'])) {
$extraConditions = $extraConditions['conditions'];
foreach ($extraConditions as $condition) {
$element = $form->getElement('extra_'.$condition['variable']);
if ($element) {
$element->freeze();
}
}
}
$form->setDefaults($user_data);
$filtered_extension = false;
if ($form->validate()) {
$hook = HookUpdateUser::create();
if ($hook) {
$hook->notifyUpdateUser(HOOK_EVENT_TYPE_PRE);
}
$wrong_current_password = false;
$user_data = $form->getSubmitValues(1);
/** @var User $user */
$user = UserManager::getRepository()->find(api_get_user_id());
// set password if a new one was provided
$validPassword = false;
$passwordWasChecked = false;
if ($user &&
(!empty($user_data['password0']) &&
!empty($user_data['password1'])) ||
(!empty($user_data['password0']) &&
api_get_setting('profile', 'email') == 'true')
) {
$passwordWasChecked = true;
$validPassword = UserManager::isPasswordValid(
$user->getPassword(),
$user_data['password0'],
$user->getSalt()
);
if ($validPassword) {
$password = $user_data['password1'];
} else {
Display::addFlash(
Display:: return_message(
get_lang('CurrentPasswordEmptyOrIncorrect'),
'warning',
false
)
);
}
}
$allow_users_to_change_email_with_no_password = true;
if (is_platform_authentication() &&
api_get_setting('allow_users_to_change_email_with_no_password') == 'false'
) {
$allow_users_to_change_email_with_no_password = false;
}
// If user sending the email to be changed (input available and not frozen )
if (api_get_setting('profile', 'email') == 'true') {
if ($allow_users_to_change_email_with_no_password) {
if (!check_user_email($user_data['email'])) {
$changeemail = $user_data['email'];
}
} else {
// Normal behaviour
if (!check_user_email($user_data['email']) && $validPassword) {
$changeemail = $user_data['email'];
}
if (!check_user_email($user_data['email']) && empty($user_data['password0'])) {
Display::addFlash(
Display:: return_message(
get_lang('ToChangeYourEmailMustTypeYourPassword'),
'error',
false
)
);
}
}
}
// Upload picture if a new one is provided
if ($_FILES['picture']['size']) {
$new_picture = UserManager::update_user_picture(
api_get_user_id(),
$_FILES['picture']['name'],
$_FILES['picture']['tmp_name'],
$user_data['picture_crop_result']
);
if ($new_picture) {
$user_data['picture_uri'] = $new_picture;
Display::addFlash(
Display:: return_message(
get_lang('PictureUploaded'),
'normal',
false
)
);
}
} elseif (!empty($user_data['remove_picture'])) {
// remove existing picture if asked
UserManager::deleteUserPicture(api_get_user_id());
$user_data['picture_uri'] = '';
}
// Remove production.
if (isset($user_data['remove_production']) &&
is_array($user_data['remove_production'])
) {
foreach (array_keys($user_data['remove_production']) as $production) {
UserManager::remove_user_production(api_get_user_id(), urldecode($production));
}
if ($production_list = UserManager::build_production_list(api_get_user_id(), true, true)) {
$form->insertElementBefore(
$form->createElement('static', null, null, $production_list),
'productions_list'
);
}
$form->removeElement('productions_list');
Display::addFlash(
Display:: return_message(get_lang('FileDeleted'), 'normal', false)
);
}
// upload production if a new one is provided
if (isset($_FILES['production']) && $_FILES['production']['size']) {
$res = upload_user_production(api_get_user_id());
if (!$res) {
//it's a bit excessive to assume the extension is the reason why
// upload_user_production() returned false, but it's true in most cases
$filtered_extension = true;
} else {
Display::addFlash(
Display:: return_message(
get_lang('ProductionUploaded'),
'normal',
false
)
);
}
}
// remove values that shouldn't go in the database
unset(
$user_data['password0'],
$user_data['password1'],
$user_data['password2'],
$user_data['MAX_FILE_SIZE'],
$user_data['remove_picture'],
$user_data['apply_change'],
$user_data['email']
);
// Following RFC2396 (http://www.faqs.org/rfcs/rfc2396.html), a URI uses ':' as a reserved character
// we can thus ensure the URL doesn't contain any scheme name by searching for ':' in the string
$my_user_openid = isset($user_data['openid']) ? $user_data['openid'] : '';
if (!preg_match('/^[^:]*:\/\/.*$/', $my_user_openid)) {
//ensure there is at least a http:// scheme in the URI provided
$user_data['openid'] = 'http://'.$my_user_openid;
}
$extras = [];
//Checking the user language
$languages = api_get_languages();
if (!in_array($user_data['language'], $languages['folder'])) {
$user_data['language'] = api_get_setting('platformLanguage');
}
$_SESSION['_user']['language'] = $user_data['language'];
//Only update values that are request by the "profile" setting
$profile_list = api_get_setting('profile');
//Adding missing variables
$available_values_to_modify = [];
foreach ($profile_list as $key => $status) {
if ($status == 'true') {
switch ($key) {
case 'login':
$available_values_to_modify[] = 'username';
break;
case 'name':
$available_values_to_modify[] = 'firstname';
$available_values_to_modify[] = 'lastname';
break;
case 'picture':
$available_values_to_modify[] = 'picture_uri';
break;
default:
$available_values_to_modify[] = $key;
break;
}
}
}
//Fixing missing variables
$available_values_to_modify = array_merge(
$available_values_to_modify,
['competences', 'diplomas', 'openarea', 'teach', 'openid', 'address']
);
// build SQL query
$sql = "UPDATE $table_user SET";
unset($user_data['api_key_generate']);
foreach ($user_data as $key => $value) {
if (substr($key, 0, 6) === 'extra_') { //an extra field
continue;
} elseif (strpos($key, 'remove_extra_') !== false) {
} else {
if (in_array($key, $available_values_to_modify)) {
$sql .= " $key = '".Database::escape_string($value)."',";
}
}
}
$changePassword = false;
// Change email
if ($allow_users_to_change_email_with_no_password) {
if (isset($changeemail) && in_array('email', $available_values_to_modify)) {
$sql .= " email = '".Database::escape_string($changeemail)."' ";
}
if (isset($password) && in_array('password', $available_values_to_modify)) {
$changePassword = true;
}
} else {
if (isset($changeemail) && !isset($password) && in_array('email', $available_values_to_modify)) {
$sql .= " email = '".Database::escape_string($changeemail)."'";
} else {
if (isset($password) && in_array('password', $available_values_to_modify)) {
if (isset($changeemail) && in_array('email', $available_values_to_modify)) {
$sql .= " email = '".Database::escape_string($changeemail)."' ";
}
$changePassword = true;
}
}
}
$sql = rtrim($sql, ',');
if ($changePassword && !empty($password)) {
UserManager::updatePassword(api_get_user_id(), $password);
}
if (api_get_setting('profile', 'officialcode') === 'true' &&
isset($user_data['official_code'])
) {
$sql .= ", official_code = '".Database::escape_string($user_data['official_code'])."'";
}
$sql .= " WHERE id = '".api_get_user_id()."'";
Database::query($sql);
if ($passwordWasChecked == false) {
Display::addFlash(
Display:: return_message(get_lang('ProfileReg'), 'normal', false)
);
} else {
if ($validPassword) {
Display::addFlash(
Display:: return_message(get_lang('ProfileReg'), 'normal', false)
);
}
}
$extraField = new ExtraFieldValue('user');
$extraField->saveFieldValues($user_data);
$userInfo = api_get_user_info(
api_get_user_id(),
false,
false,
false,
false,
true,
true
);
Session::write('_user', $userInfo);
if ($hook) {
Database::getManager()->clear(User::class); //Avoid cache issue (user entity is used before)
$user = api_get_user_entity(api_get_user_id()); //Get updated user info for hook event
$hook->setEventData(['user' => $user]);
$hook->notifyUpdateUser(HOOK_EVENT_TYPE_POST);
}
$url = api_get_self();
header("Location: ".$url);
exit;
}
// the header
$actions = '';
if ($allowSocialTool) {
if (api_get_setting('extended_profile') === 'true') {
if (api_get_setting('allow_message_tool') === 'true') {
$actions .= ''.
Display::return_icon('shared_profile.png', get_lang('ViewSharedProfile')).'';
$actions .= ''.
Display::return_icon('inbox.png', get_lang('Messages')).'';
}
$show = isset($_GET['show']) ? '&show='.Security::remove_XSS($_GET['show']) : '';
if (isset($_GET['type']) && $_GET['type'] === 'extended') {
$actions .= ''.
Display::return_icon('edit.png', get_lang('EditNormalProfile'), '', 16).'';
} else {
$actions .= ''.
Display::return_icon('edit.png', get_lang('EditExtendProfile'), '', 16).'';
}
}
}
$show_delete_account_button = api_get_setting('platform_unsubscribe_allowed') === 'true' ? true : false;
$tpl = new Template(get_lang('ModifyProfile'));
if ($actions) {
$tpl->assign(
'actions',
Display::toolbarAction('toolbar', [$actions])
);
}
SocialManager::setSocialUserBlock($tpl, api_get_user_id(), 'messages');
if ($allowSocialTool) {
SocialManager::setSocialUserBlock($tpl, api_get_user_id(), 'home');
$menu = SocialManager::show_social_menu(
'home',
null,
api_get_user_id(),
false,
$show_delete_account_button
);
$tpl->assign('social_menu_block', $menu);
$tpl->assign('social_right_content', $form->returnForm());
$social_layout = $tpl->get_template('social/edit_profile.tpl');
$tpl->display($social_layout);
} else {
$bigImage = UserManager::getUserPicture(api_get_user_id(), USER_IMAGE_SIZE_BIG);
$normalImage = UserManager::getUserPicture(api_get_user_id(), USER_IMAGE_SIZE_ORIGINAL);
$imageToShow = '';
$content = $imageToShow.$form->returnForm();
$tpl->assign('content', $content);
$tpl->display_one_col_template();
}
// Helper functions defined below this point
/**
* Is user auth_source is platform ?
*
* @return bool Whether auth_source is 'platform' or not
*/
function is_platform_authentication()
{
$tabUserInfo = api_get_user_info();
return $tabUserInfo['auth_source'] == PLATFORM_AUTH_SOURCE;
}
/**
* Can a user edit his/her profile?
*
* @return bool Whether the profile can be edited by the user or not
*/
function is_profile_editable()
{
if (isset($GLOBALS['profileIsEditable'])) {
return (bool) $GLOBALS['profileIsEditable'];
}
return true;
}
/**
* Upload a submitted user production.
*
* @param int $userId User id
*
* @return mixed The filename of the new production or FALSE if the upload has failed
*/
function upload_user_production($userId)
{
$productionRepository = UserManager::getUserPathById($userId, 'system');
if (!file_exists($productionRepository)) {
@mkdir($productionRepository, api_get_permissions_for_new_directories(), true);
}
$filename = api_replace_dangerous_char($_FILES['production']['name']);
$filename = disable_dangerous_file($filename);
if (filter_extension($filename)) {
if (@move_uploaded_file($_FILES['production']['tmp_name'], $productionRepository.$filename)) {
return $filename;
}
}
return false; // this should be returned if anything went wrong with the upload
}
/**
* Check current user's current password.
*
* @param string $email E-mail
*
* @return bool Whether this e-mail is already in use or not
*/
function check_user_email($email)
{
$userId = api_get_user_id();
if ($userId != strval(intval($userId)) || empty($email)) {
return false;
}
$tableUser = Database::get_main_table(TABLE_MAIN_USER);
$email = Database::escape_string($email);
$sql = "SELECT * FROM $tableUser WHERE user_id = $userId AND email = '$email'";
$result = Database::query($sql);
return Database::num_rows($result) != 0;
}