1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
|
<?php
/**
* Elgg profile edit action
*
*/
$guid = get_input('guid');
$owner = get_entity($guid);
if (!$owner || !($owner instanceof ElggUser) || !$owner->canEdit()) {
register_error(elgg_echo('profile:edit:fail'));
forward(REFERER);
}
// grab the defined profile field names and their load the values from POST.
// each field can have its own access, so sort that too.
$input = array();
$accesslevel = get_input('accesslevel');
if (!is_array($accesslevel)) {
$accesslevel = array();
}
/**
* wrapper for recursive array walk decoding
*/
function profile_array_decoder(&$v) {
$v = html_entity_decode($v, ENT_COMPAT, 'UTF-8');
}
$profile_fields = elgg_get_config('profile_fields');
foreach ($profile_fields as $shortname => $valuetype) {
// the decoding is a stop gap to prevent && showing up in profile fields
// because it is escaped on both input (get_input()) and output (view:output/text). see #561 and #1405.
// must decode in utf8 or string corruption occurs. see #1567.
$value = get_input($shortname);
if (is_array($value)) {
array_walk_recursive($value, 'profile_array_decoder');
} else {
$value = html_entity_decode($value, ENT_COMPAT, 'UTF-8');
}
// limit to reasonable sizes
// @todo - throwing away changes due to this is dumb!
if (!is_array($value) && $valuetype != 'longtext' && elgg_strlen($value) > 250) {
$error = elgg_echo('profile:field_too_long', array(elgg_echo("profile:{$shortname}")));
register_error($error);
forward(REFERER);
}
if ($valuetype == 'tags') {
$value = string_to_tag_array($value);
}
$input[$shortname] = $value;
}
// display name is handled separately
$name = strip_tags(get_input('name'));
if ($name) {
if (elgg_strlen($name) > 50) {
register_error(elgg_echo('user:name:fail'));
} elseif ($owner->name != $name) {
$owner->name = $name;
// @todo this is weird...giving two notifications?
if ($owner->save()) {
system_message(elgg_echo('user:name:success'));
} else {
register_error(elgg_echo('user:name:fail'));
}
}
}
// go through custom fields
if (sizeof($input) > 0) {
foreach ($input as $shortname => $value) {
$options = array(
'guid' => $owner->guid,
'metadata_name' => $shortname
);
elgg_delete_metadata($options);
if (isset($accesslevel[$shortname])) {
$access_id = (int) $accesslevel[$shortname];
} else {
// this should never be executed since the access level should always be set
$access_id = ACCESS_DEFAULT;
}
if (is_array($value)) {
$i = 0;
foreach ($value as $interval) {
$i++;
$multiple = ($i > 1) ? TRUE : FALSE;
create_metadata($owner->guid, $shortname, $interval, 'text', $owner->guid, $access_id, $multiple);
}
} else {
create_metadata($owner->getGUID(), $shortname, $value, 'text', $owner->getGUID(), $access_id);
}
}
$owner->save();
// Notify of profile update
elgg_trigger_event('profileupdate', $owner->type, $owner);
system_message(elgg_echo("profile:saved"));
}
forward($owner->getUrl());
|
