[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] invitation validation: require {link} in email content and prevent CSV parsing warnings

Benoit Grégoire pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
6a9e023d by Landry Bitege at 2026-01-12T15:29:00+00:00
[FIX] invitation validation: require {link} in email content and prevent CSV parsing warnings
---
* [FIX] invitation validation: require {link} in email content and prevent CSV parsing warnings

See merge request tikiwiki/tiki!9305

- - - - -


2 changed files:

- templates/tiki-invite.tpl
- tiki-invite.php


Changes:

=====================================
templates/tiki-invite.tpl
=====================================
@@ -70,7 +70,7 @@
                 <br>
                 <div class="form-check">
                     <input class="form-check-input" type='radio' name='emailslist_format' value='all' {if $smarty.request.emailslist_format == 'all'}checked{/if}>
-                    <label class="form-check-label">{tr}Everything that appear as an email in the text will be detected and used (in that case, \{literal}{firstname} and {lastname}{/literal} will be ignored in the email content){/tr}</label>
+                    <label class="form-check-label">{tr}Everything that appear as an email in the text will be detected and used (in that case, {literal}{firstname} and {lastname}{/literal} will be ignored in the email content){/tr}</label>
                 </div>
             </div>
         </div>
@@ -83,9 +83,9 @@
         </div>
 
         <div class="mb-3 row">
-            <label class="col-form-label col-sm-5" for="emailcontent">{tr}Type here the email content you'll want to be sent to them (and let the \{literal}{link}{/literal} word, it will be replaced with the good link for registering){/tr}</label>
+            <label class="col-form-label col-sm-5" for="emailcontent">{tr}Type here the email content you'll want to be sent to them (and let the {literal}{link}{/literal} word, it will be replaced with the good link for registering){/tr}</label>
             <div class="col-sm-7">
-                <textarea name='emailcontent' class="form-control" style='width: 100%; height: 150px;'>{tr}{if isset($smarty.request.emailcontent)}{$smarty.request.emailcontent|escape}{else}Hi \{literal}{firstname} {lastname}{/literal},
+                <textarea name='emailcontent' class="form-control" style='width: 100%; height: 150px;'>{tr}{if isset($smarty.request.emailcontent)}{$smarty.request.emailcontent|escape}{else}Hi {literal}{firstname} {lastname}{/literal},
 
 We would like to invite you to register on our web site
 To register, just follow this link:
@@ -100,7 +100,7 @@ Kind regards
         <div class="mb-3 row">
             <label class="col-form-label col-sm-5" for="wikicontent">{tr}Type here the content that the user will see when he'll click on the link from the mail{/tr}</label>
             <div class="col-sm-7">
-                <textarea name='wikicontent' class="form-control" style='width: 100%; height: 150px;'>{tr}{if isset($smarty.request.emailcontent)}{$smarty.request.wikicontent|escape}{else}Hi \{literal}{firstname} {lastname}{/literal},
+                <textarea name='wikicontent' class="form-control" style='width: 100%; height: 150px;'>{tr}{if isset($smarty.request.emailcontent)}{$smarty.request.wikicontent|escape}{else}Hi {literal}{firstname} {lastname}{/literal},
 
 You are here because you have just clicked on the link from my invitation email.
 


=====================================
tiki-invite.php
=====================================
@@ -41,9 +41,21 @@ $prefs['feature_wiki_protect_email'] = 'n'; //not to alter the email
 function parsemails_csv($bloc)
 {
     $results = [];
+    $ignored = [];
     $lines = preg_split('/[\n\r]+/', $bloc);
     foreach ($lines as $line) {
-        $l = explode(',', $line);
+        $line = trim($line);
+        if ($line === '') {
+            continue;
+        }
+        $l = array_map('trim', explode(',', $line));
+
+        // Require lastname, firstname and email to safely access indexes 0–2
+        if (count($l) < 3) {
+            $ignored[] = $line;
+            continue;
+        }
+
         $r = [];
         $r['lastname'] = trim($l[0]);
         $r['firstname'] = trim($l[1]);
@@ -52,7 +64,7 @@ function parsemails_csv($bloc)
             $results[] = $r;
         }
     }
-    return $results;
+    return [$results, $ignored];
 }
 
 /* everything format */
@@ -127,17 +139,31 @@ if (isset($_REQUEST['send'])) {
     $_text = str_replace("\n\r", "\n", $_text);
     $_text = str_replace("\r", "\n", $_text);
 
+    if (strpos($_REQUEST['emailcontent'], '{link}') === false) {
+        Feedback::error(tra("The email content must include the {link} placeholder for the invitation link."));
+        $_REQUEST['send'] = false;
+    }
+
     $mails = $_REQUEST["emailslist"];
+    $ignoredLines = [];
     switch ($_REQUEST['emailslist_format']) {
         case 'all':
             $emails = parsemails_all($mails);
             break;
         case 'csv':
-            $emails = parsemails_csv($mails);
+            $parsed = parsemails_csv($mails);
+            $emails = $parsed[0];
+            $ignoredLines = $parsed[1];
             break;
         default:
             $emails = [];
     }
+    if (! empty($ignoredLines) && empty($_REQUEST['confirm'])) {
+        Feedback::warning(
+            tra('Some CSV lines were ignored because they are not in the expected format (lastname, firstname, email):')
+            . '<br><pre>' . htmlspecialchars(implode("\n", $ignoredLines)) . '</pre>'
+        );
+    }
 
     $igroups = $_REQUEST['invitegroups'] ?? [];
 



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/6a9e023d5dbaf923e73018bc8444ed8b59ed0103

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/6a9e023d5dbaf923e73018bc8444ed8b59ed0103
You're receiving this email because of your account on gitlab.com.

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs