editgroup.php

<?php

include_once('internal/Smarty.class.php');
$main_smarty = new Smarty;

include('config.php');
include(mnminclude.'html1.php');
include(mnminclude.'link.php');
include(mnminclude.'group.php');
include(mnminclude.'smartyvariables.php');
include(mnminclude.'csrf.php');

check_referrer();

if (isset($_REQUEST['id'])) {
    $requestID = strip_tags($_REQUEST['id']);
}
if (!is_numeric($requestID)) {
    $requestID = 0;
}
if (isset($_REQUEST['title'])) {
    $requestTitle = $db->escape(strip_tags($_REQUEST['title']));
}

//check group admin
$canIhaveAccess = checklevel('admin') || checklevel('moderator');

if ($current_user->user_id != get_group_creator($requestID) && $canIhaveAccess != 1) {
    //page redirect
    $redirect = '';
    $redirect = getmyurl("group_story", $requestID);
//	header("Location: $redirect");
    die;
}

// pagename
define('pagename', 'editgroup');
$main_smarty->assign('pagename', pagename);

$CSRF = new csrf();

// uploading avatar
if ($_POST["avatar"] == "uploaded") {
    $CSRF->check_expired('edit_group');
    if ($CSRF->check_valid(sanitize($_POST['token'], 3), 'edit_group')) {
        $user_image_path = "avatars/groups_uploaded"."/";
        $user_image_apath = "/".$user_image_path;
        $allowedFileTypes = array("image/jpeg","image/gif","image/png",'image/x-png','image/pjpeg');
        unset($imagename);
        $myfile = $_FILES['image_file']['name'];
        $imagename = basename($myfile);
        $mytmpfile = $_FILES['image_file']['tmp_name'];
        if (!in_array($_FILES['image_file']['type'], $allowedFileTypes)) {
            $error['Type'] = 'Only these file types are allowed : jpeg, gif, png';
        }

        if (empty($error)) {
            $imagesize = getimagesize($mytmpfile);
            $width = $imagesize[0];
            $height = $imagesize[1];
            $idname = $_POST["idname"];
            if (!is_numeric($idname)) {
                die();
            }
            $imagename = $idname."_original.jpg";
            $newimage = $user_image_path.$imagename ;
            $result = @move_uploaded_file($_FILES['image_file']['tmp_name'], $newimage);
            if (empty($result)) {
                $error["result"] = "There was an error moving the uploaded file.";
            } else {
                $avatar_source = cleanit($_POST['avatarsource']);

                $sql = "UPDATE ".table_groups." set group_avatar='uploaded' WHERE group_id=$idname";
                $db->query($sql);
                $main_smarty->assign('Avatar_uploaded', 'Avatar uploaded successfully! You may need to refresh the page to see the new image.');
                /*if($avatar_source != "" && $avatar_source != "useruploaded"){
                    loghack('Updating profile, avatar source is not one of the list options.', 'username: ' . $_POST["username"].'|email: '.$_POST["email"]);
                    $avatar_source == "";
                }*/
                //$user->avatar_source=$avatar_source;
                //$user->store();
            }
        }
        // create large avatar
        include mnminclude."class.pThumb.php";
        $img = new pThumb();
        $img->pSetSize(group_avatar_size_width, group_avatar_size_height);
        $img->pSetQuality(100);
        $img->pCreate($newimage);
        $img->pSave($user_image_path.$idname."_".group_avatar_size_width.".jpg");
        $img = "";
    } else {
        $CSRF->show_invalid_error(1);
        exit;
    }
} elseif (isset($_POST["action"])) {
    $CSRF->check_expired('edit_group');
    if ($CSRF->check_valid(sanitize($_POST['token'], 3), 'edit_group')) {
        if (isset($_POST['group_title'])) {
            $group_title = mysql_real_escape_string(stripslashes(strip_tags(trim($_POST['group_title']))));
        }
        if (isset($_POST['group_description'])) {
            $group_description = mysql_real_escape_string(stripslashes(strip_tags(trim($_POST['group_description']))));
        }
        if (isset($_POST['group_vote_to_publish'])) {
            $group_vote_to_publish = mysql_real_escape_string(stripslashes(strip_tags(trim($_POST['group_vote_to_publish']))));
        }
        if ($_POST['group_notify_email']>0) {
            $group_notify_email = 1;
        } else {
            $group_notify_email = 0;
        }
        $group_name = $group_title;
        $group_safename = makeUrlFriendly($group_title, true);
        if (isset($_POST['group_privacy'])) {
            $group_privacy = $db->escape(sanitize($_POST['group_privacy'], 3));
        }

        if (!$group_title) {
            $errors = $main_smarty->get_config_vars('PLIGG_Visual_Group_Empty_Title');
        } elseif ($group_vote_to_publish <= 0) {
            $errors = $main_smarty->get_config_vars('PLIGG_Visual_Group_Empty_Votes');
        } else {
            $exists = $db->get_var("select COUNT(*) from ".table_groups." WHERE group_name='$group_name' AND group_id != '$requestID'");
            if ($exists) {
                $errors = $main_smarty->get_config_vars('PLIGG_Visual_Group_Title_Exists');
            }
        }

        if (!$errors &&
        $db->query("update ".table_groups." set group_name = '".$group_title."', group_safename='$group_safename', group_description = '".$group_description."', group_privacy = '".$group_privacy."', group_vote_to_publish = '".$group_vote_to_publish."', group_notify_email=$group_notify_email where group_id = '".$requestID."'")) {
            $errors = $main_smarty->get_config_vars('PLIGG_Visual_Group_Saved_Changes');
        }

        $main_smarty->assign("errors", $errors);
    } else {
        $CSRF->show_invalid_error(1);
        exit;
    }
}
$CSRF->create('edit_group', true, true);

//displaying group as story
if (isset($requestID)) {
    group_display($requestID);
}

$main_smarty->assign('tpl_center', $the_template.'/edit_group_center');
$main_smarty->display($the_template.'/pligg.tpl');

function cleanit($value)
{
    $value = strip_tags($value);
    $value = trim($value);
    return $value;
}