php: remove trailing whitespaces

[tt-rss.git] / classes / pref / users.php

diff --git a/classes/pref/users.php b/classes/pref/users.php
index b23950bd3ba96331f8a3723dd223a32918c5aaba..ab8ac775b54319c77ff51d680a701efe4af6d59b 100644 (file)
--- a/classes/pref/users.php
+++ b/classes/pref/users.php
@@ -20,12 +20,14 @@ class Pref_Users extends Handler_Protected {
                function edit() {
                        global $access_level_names;
 
+                       print "<form id=\"user_edit_form\" onsubmit='return false' dojoType=\"dijit.form.Form\">";
+
                        print '<div dojoType="dijit.layout.TabContainer" style="height : 400px">
                        <div dojoType="dijit.layout.ContentPane" title="'.__('Edit user').'">';
 
-                       print "<form id=\"user_edit_form\" onsubmit='return false' dojoType=\"dijit.form.Form\">";
+                       //print "<form id=\"user_edit_form\" onsubmit='return false' dojoType=\"dijit.form.Form\">";
 
-                       $id = (int) $_REQUEST["id"];
+                       $id = (int) clean($_REQUEST["id"]);
 
                        print_hidden("id", "$id");
                        print_hidden("op", "pref-users");
@@ -87,8 +89,6 @@ class Pref_Users extends Handler_Protected {
 
                                print "</table>";
 
-                               print "</form>";
-                               
                        }
 
                        print '</div>'; #tab
@@ -99,16 +99,18 @@ class Pref_Users extends Handler_Protected {
                        print '</div>';
 
                        print "<div class=\"dlgButtons\">
-                               <button dojoType=\"dijit.form.Button\" type=\"submit\">".
+                               <button dojoType=\"dijit.form.Button\" class=\"btn-primary\" type=\"submit\" onclick=\"dijit.byId('userEditDlg').execute()\">".
                                __('Save')."</button>
                                <button dojoType=\"dijit.form.Button\" onclick=\"dijit.byId('userEditDlg').hide()\">".
                                __('Cancel')."</button></div>";
 
+                       print "</form>";
+
                        return;
                }
 
                function userdetails() {
-                       $id = (int) $_REQUEST["id"];
+                       $id = (int) clean($_REQUEST["id"]);
 
                        $sth = $this->pdo->prepare("SELECT login,
                                ".SUBSTRING_FOR_DATE."(last_login,1,16) AS last_login,
@@ -168,25 +170,25 @@ class Pref_Users extends Handler_Protected {
                                }
 
                                print "</ul>";
-                               
-                               
+
+
                        } else {
                                print "<h1>".__('User not found')."</h1>";
                        }
-               
+
                }
 
                function editSave() {
-                       $login = trim($_REQUEST["login"]);
-                       $uid = $_REQUEST["id"];
-                       $access_level = (int) $_REQUEST["access_level"];
-                       $email = trim($_REQUEST["email"]);
-                       $password = $_REQUEST["password"];
+                       $login = trim(clean($_REQUEST["login"]));
+                       $uid = clean($_REQUEST["id"]);
+                       $access_level = (int) clean($_REQUEST["access_level"]);
+                       $email = trim(clean($_REQUEST["email"]));
+                       $password = clean($_REQUEST["password"]);
 
                        if ($password) {
                                $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
                                $pwd_hash = encrypt_password($password, $salt, true);
-                               $pass_query_part = "pwd_hash = ".$this->pdo->quote($pwd_hash).", 
+                               $pass_query_part = "pwd_hash = ".$this->pdo->quote($pwd_hash).",
                                        salt = ".$this->pdo->quote($salt).",";
                        } else {
                                $pass_query_part = "";
@@ -199,7 +201,7 @@ class Pref_Users extends Handler_Protected {
                }
 
                function remove() {
-                       $ids = explode(",", $_REQUEST["ids"]);
+                       $ids = explode(",", clean($_REQUEST["ids"]));
 
                        foreach ($ids as $id) {
                                if ($id != $_SESSION["uid"] && $id != 1) {
@@ -217,7 +219,7 @@ class Pref_Users extends Handler_Protected {
 
                function add() {
 
-                       $login = trim($_REQUEST["login"]);
+                       $login = trim(clean($_REQUEST["login"]));
                        $tmp_user_pwd = make_password(8);
                        $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
                        $pwd_hash = encrypt_password($tmp_user_pwd, $salt, true);
@@ -263,7 +265,7 @@ class Pref_Users extends Handler_Protected {
                        $sth = $pdo->prepare("SELECT login, email
                                FROM ttrss_users WHERE id = ?");
                        $sth->execute([$uid]);
-                       
+
                        if ($row = $sth->fetch()) {
 
                                $login = $row["login"];
@@ -274,7 +276,7 @@ class Pref_Users extends Handler_Protected {
 
                                $pwd_hash = encrypt_password($tmp_user_pwd, $new_salt, true);
 
-                               $sth = $pdo->prepare("UPDATE ttrss_users 
+                               $sth = $pdo->prepare("UPDATE ttrss_users
                                          SET pwd_hash = ?, salt = ?, otp_enabled = false
                                        WHERE id = ?");
                                $sth->execute([$pwd_hash, $new_salt, $uid]);
@@ -311,12 +313,12 @@ class Pref_Users extends Handler_Protected {
 
                                        if (!$rc) print_error($mail->ErrorInfo);
                                }
-                               
+
                        }
                }
 
                function resetPass() {
-                       $uid = $_REQUEST["id"];
+                       $uid = clean($_REQUEST["id"]);
                        Pref_Users::resetUserPassword($uid, true);
                }
 
@@ -329,7 +331,7 @@ class Pref_Users extends Handler_Protected {
 
                        print "<div id=\"pref-user-toolbar\" dojoType=\"dijit.Toolbar\">";
 
-                       $user_search = trim($_REQUEST["search"]);
+                       $user_search = trim(clean($_REQUEST["search"]));
 
                        if (array_key_exists("search", $_REQUEST)) {
                                $_SESSION["prefs_user_search"] = $user_search;
@@ -344,7 +346,7 @@ class Pref_Users extends Handler_Protected {
                                        __('Search')."</button>
                                </div>";
 
-                       $sort = $_REQUEST["sort"];
+                       $sort = clean($_REQUEST["sort"]);
 
                        if (!$sort || $sort == "undefined") {
                                $sort = "login";