Fix redirection on login and on forced password changes.

user.inc.php

@@ -504,13 +504,13 @@ function user_create($accounts_id, $conferences_id=0)
 /* Perform some checks.  Make sure the person is logged in, and that their
  * password hasn't expired (the password_expired var is set in the login page) 
  */
-function user_auth_required($all_required, $one_required = array())
+function user_auth_required($all_required = array(), $one_required = array())
 {
 	global $config;
 	$ok = true;
 
 	unset($_SESSION['request_uri']);
-	if(!isset($_SESSION['roles'])) {
+	if(!isset($_SESSION['roles'] || !isset($_SESSION['users_id']))) {
 		message_push(error(i18n("You must login to view that page")));
 		$_SESSION['request_uri'] = $_SERVER['REQUEST_URI'];
 		header("location: {$config['SFIABDIRECTORY']}/user_login.php?type=$type");

user_account.php

@@ -23,15 +23,16 @@
 */
 ?>
 <?
- require_once("common.inc.php");
+require_once("common.inc.php");
- require_once("account.inc.php");
+require_once("account.inc.php");
 
- /* Make sure the user is logged in  (accounts_id is set) */
+/* Make sure the user is logged in with just an account  (accounts_id is set), 
- if(!isset($_SESSION['accounts_id'])) {
+ * dont' call user_auth_required because they may not have a user */
+if(!isset($_SESSION['accounts_id'])) {
 	message_push(error(i18n("You must login to view that page")));
  	header("location: {$config['SFIABDIRECTORY']}/index.php");
  	exit;
- }
+}
 
  /* Superuser may edit this for any account, if the user is not a superuser, force
   * the accounts_id to be whatever is in the session */
@@ -42,12 +43,6 @@
  	$accounts_id = $_SESSION['accounts_id'];
  }
  
- if(array_key_exists('request_uri', $_SESSION))
- 	$back_link = $_SESSION['request_uri'];
- else 
-	$back_link = "user_main.php";
- unset($_SESSION['request_uri']);
-
 function user_account_check_username($accounts_id, $username)
 {
 	if(!account_valid_user($username)) return false;
@@ -76,38 +71,39 @@ case 'save':
 	$username_link = ($_POST['username_link'] == 'yes') ? true : false;
 	$username = $username_link ? $email : trim($_POST['username']);
 
-	if($a['email'] != $email && $email != '') {
+	if(array_key_exists('email', $_POST)) {
-		$save = true;
+		/* If this key doesn't exist, don't even try to update the email or the usename, the
-		/* Change email */
+		 * user is in a "must date their password" mode */
-		if(!account_valid_email($email)) {
+		if($a['email'] != $email && $email != '') {
-			error_('Invalid email address');
+			$save = true;
-			$save = false;
+			/* Change email */
+			if(!account_valid_email($email)) {
+				error_('Invalid email address');
+				$save = false;
+			}
+
+			if($save) {
+		//		action_create_set_email($accounts_id, $email);
+				happy_("An email has been sent to %1 to confirm the new email address", array($email));
+			} 
 		}
 
-		if($save) {
+		/* Update link */
-	//		action_create_set_email($accounts_id, $email);
+		$x = ($a['link_username_to_email'] == 'yes') ? true : false;
-			happy_("An email has been sent to %1 to confirm the new email address", array($email));
+		if($x != $username_link) {
-		} 
+			$l = $username_link ? 'yes' : 'no';
-	}
+			mysql_query("UPDATE accounts SET link_username_to_email='$l' WHERE id=$accounts_id");
+		}	
 
-	$x = ($a['link_username_to_email'] == 'yes') ? true : false;
+		/* Update username */
-	if($x != $username_link) {
+		if($a['username'] != $username) {
-		$l = $username_link ? 'yes' : 'no';
+			if(user_account_check_username($accounts_id, $username)) {
-		mysql_query("UPDATE accounts SET link_username_to_email='$l' WHERE id=$accounts_id");
+				/* Update it */
-	}
+				$u = mysql_real_escape_string($username);
-
+				mysql_query("UPDATE accounts SET username='$u' WHERE id=$accounts_id");
-	if($a['username'] != $username) {
+				happy_("Username updated");
-		$save = true;
+			} 
-		/* Make sure it isn't in use */
+		}
-		$x = user_account_check_username($accounts_id, $username);
-		if($x == false) $save = false;
-		
-		if($save) {
-			/* Update it */
-			$u = mysql_real_escape_string($username);
-			mysql_query("UPDATE accounts SET username='$u' WHERE id=$accounts_id");
-			happy_("Username updated");
-		} 
 	}
 
 	$pass1 = $_POST['pass1'];
@@ -119,6 +115,8 @@ case 'save':
 					id='$accounts_id' AND password='$pass'");
 
 		$save = false;
+		/* All of this, except matching the previous password, is checked
+		 * by the form validator */
 		if(mysql_num_rows($q))
 			error_("You cannot choose the same password again.  Please choose a different password");	
 		else if($pass1 == '') 
@@ -134,6 +132,16 @@ case 'save':
 			happy_('Password has been successfully updated');
 		} 
 	}
+	/* Forward to the request_uri if it's set */
+	if(isset($_SESSION['request_uri'])) {
+		$link = $_SESSION['request_uri'];
+		unset($_SESSION['request_uri']);
+?>
+		<script type="text/javascript">
+			window.document.location="<?=$link?>";
+		</script>
+<?
+	}
 	exit;
  }
 
@@ -153,12 +161,12 @@ case 'save':
  $email = $a['email'];
  $username_link = ($a['link_username_to_email'] == 'yes') ? 'checked="checked"' : '';
  $username = $email;
- $_SESSION['password_expired'] = true;
 
  if($_SESSION['password_expired'] == true) {
- 	echo notice(i18n('Your password has expired.  You must choose a new password now.'));
+ 	echo error(i18n('Your password has expired.  You must choose a new password now.'));
 	$d = 'disabled="disabled"';
 	$validator_passreq = 'required: true,';
+	echo "drect to: {$_SESSION['request_uri']}";;
  }
 
 ?>

user_login.php

@@ -144,7 +144,7 @@ if(isset($_SESSION['accounts_id'])) {
 	$q = mysql_query("SELECT id FROM users WHERE accounts_id=$accounts_id AND conferences_id={$_SESSION['conferences_id']}");
 	if(mysql_num_rows($q) == 0) {
 		/* FIXME: this should probably just return false, but for now, see if there's an error */
-		echo "No user for that conference";
+		echo "No user {$accounts_id} for conference {$_SESSION['conferences_id']}";
 		exit;
 	} 
 	if(mysql_num_rows($q) > 1) {
@@ -193,7 +193,7 @@ if(isset($_SESSION['accounts_id'])) {
 		if($now > $expires) {
 			$_SESSION['password_expired'] = true;
 		} else {
-				unset($_SESSION['password_expired']);
+			unset($_SESSION['password_expired']);
 		}
 	}
 	/* If password_expired == true, the main page (or any

user_main.php

@@ -31,6 +31,8 @@
 	header("location: index.php");
 	exit;
  }
+ user_auth_required();
+
 
  $u = user_load($_SESSION['users_id']);
 

user_personal.php

@@ -26,11 +26,8 @@
  require_once("common.inc.php");
  require_once("user.inc.php");
 
- if(!isset($_SESSION['users_id'])) {
+ /* Ensure they're logged in as something, anything */
- 	/* No user set, invalid session for editting a user */
+ user_auth_required();
-	echo "ERROR: session is invalid";
-	exit;
- }
 
  $user_personal_fields = array(
 		'salutation' => array('name' => 'Salutation'),