diff options
Diffstat (limited to 'includes/pages/admin_news.php')
-rw-r--r-- | includes/pages/admin_news.php | 37 |
1 files changed, 24 insertions, 13 deletions
diff --git a/includes/pages/admin_news.php b/includes/pages/admin_news.php index 4eafd3e2..eb3a250e 100644 --- a/includes/pages/admin_news.php +++ b/includes/pages/admin_news.php @@ -7,7 +7,7 @@ use Engelsystem\Database\DB; */ function admin_news() { - global $user; + global $user, $privileges; $request = request(); if (!$request->has('action')) { @@ -30,21 +30,31 @@ function admin_news() case 'edit': $user_source = User($news['UID']); - $html .= form([ - form_info(_('Date'), date('Y-m-d H:i', $news['Datum'])), - form_info(_('Author'), User_Nick_render($user_source)), - form_text('eBetreff', _('Subject'), $news['Betreff']), - form_textarea('eText', _('Message'), $news['Text']), - form_checkbox('eTreffen', _('Meeting'), $news['Treffen'] == 1, 1), - form_submit('submit', _('Save')) - ], page_link_to('admin_news&action=save&id=' . $news_id)); + $html .= form( + [ + form_info(_('Date'), date('Y-m-d H:i', $news['Datum'])), + form_info(_('Author'), User_Nick_render($user_source)), + form_text('eBetreff', _('Subject'), $news['Betreff']), + form_textarea('eText', _('Message'), $news['Text']), + form_checkbox('eTreffen', _('Meeting'), $news['Treffen'] == 1, 1), + form_submit('submit', _('Save')) + ], + page_link_to('admin_news', ['action' => 'save', 'id' => $news_id]) + ); - $html .= '<a class="btn btn-danger" href="' . page_link_to('admin_news&action=delete&id=' . $news_id) . '">' + $html .= '<a class="btn btn-danger" href="' + . page_link_to('admin_news', ['action' => 'delete', 'id' => $news_id]) + . '">' . '<span class="glyphicon glyphicon-trash"></span> ' . _('Delete') . '</a>'; break; case 'save': + $text = $request->postData('eText'); + if (!in_array('admin_news_html', $privileges)) { + $text = strip_tags($text); + } + DB::update(' UPDATE `News` SET `Datum`=?, @@ -56,14 +66,15 @@ function admin_news() ', [ time(), - $request->post('eBetreff'), - $request->post('eText'), + strip_tags($request->postData('eBetreff')), + $text, $user['UID'], $request->has('eTreffen') ? 1 : 0, $news_id ] ); - engelsystem_log('News updated: ' . $request->post('eBetreff')); + + engelsystem_log('News updated: ' . $request->postData('eBetreff')); success(_('News entry updated.')); redirect(page_link_to('news')); break; |