Fix acceptance of outdated friendship requests (bug #861985)

If you submit an accept friendship form from the my friends or find
friends page, but the request has disappeared in the time since you
loaded the page, the user receives no feedback.  This patch ensures
that the form is actually submitted and validated, and provides an
appropriate message if the request has been denied or accepted.

This patch also ensures that friend acceptance is saved when the
submitted form appears on the second (or later) page of results.

Change-Id: I0bdc8fb370670a8ddb1c41c7db2f3e37c9d70d11
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

htdocs/lang/en.utf8/group.php

@@ -257,6 +257,7 @@ $string['friendrequestacceptedmessage'] = '%s has accepted your friend request a
 $string['friendrequestrejectedsubject'] = 'Friend request rejected';
 $string['friendrequestrejectedmessage'] = '%s has rejected your friend request.';
 $string['friendrequestrejectedmessagereason'] = '%s has rejected your friend request.  Their reason was: ';
+$string['acceptfriendshiprequestfailed'] = 'Failed to accept friendship request.';
 
 $string['allfriends']     = 'All Friends';
 $string['currentfriends'] = 'Current Friends';

htdocs/lib/user.php

@@ -1479,22 +1479,7 @@ function get_users_data($userids, $getviews=true) {
             $friend->views = $cleanviews[$friend->id];
         }
         if ($friend->pending) {
-            $friend->accept = pieform(array(
-                'name' => 'acceptfriend' . $friend->id,
-                'successcallback' => 'acceptfriend_submit',
-                'renderer' => 'div',
-                'autofocus' => 'false',
-                'elements' => array(
-                    'submit' => array(
-                        'type' => 'submit',
-                        'value' => get_string('approverequest', 'group')
-                    ),
-                    'id' => array(
-                        'type' => 'hidden',
-                        'value' => $friend->id
-                    )
-                )
-            ));
+            $friend->accept = acceptfriend_form($friend->id);
         }
         if (!$friend->friend && !$friend->pending && !$friend->requestedfriendship && $friend->friendscontrol == 'auto') {
             $friend->makefriend = pieform(array(
@@ -1743,11 +1728,53 @@ function friendscontrol_submit(Pieform $form, $values) {
     redirect($values['returnto'] == 'find' ? '/user/find.php' : '/user/myfriends.php');
 }
 
+function acceptfriend_form($friendid) {
+    return pieform(array(
+        'name' => 'acceptfriend' . (int) $friendid,
+        'validatecallback' => 'acceptfriend_validate',
+        'successcallback'  => 'acceptfriend_submit',
+        'renderer' => 'div',
+        'autofocus' => 'false',
+        'elements' => array(
+            'acceptfriend_submit' => array(
+                'type' => 'submit',
+                'value' => get_string('approverequest', 'group'),
+            ),
+            'id' => array(
+                'type' => 'hidden',
+                'value' => (int) $friendid,
+            ),
+        ),
+    ));
+}
+
+function acceptfriend_validate(Pieform $form, $values) {
+    global $USER, $SESSION;
+
+    $friendid = (int) $values['id'];
+
+    if (!get_record('usr_friend_request', 'owner', $USER->get('id'), 'requester', $friendid)) {
+        if (!is_friend($USER->get('id'), $friendid) && get_account_preference($friendid, 'friendscontrol') != 'auto') {
+            // Because the request is no longer valid, this form won't be redrawn in the new list of users.  So
+            // the error message is added to the $SESSION messages area, and a dummy error message is set on the
+            // form to stop submission from continuing.
+            $SESSION->add_error_msg(get_string('acceptfriendshiprequestfailed', 'group'));
+            $form->set_error(null, -1);
+        }
+    }
+}
+
 function acceptfriend_submit(Pieform $form, $values) {
     global $USER, $SESSION;
 
     $user = get_record('usr', 'id', $values['id']);
 
+    if (is_friend($USER->get('id'), $user->id)) {
+        $SESSION->add_info_msg(get_string('alreadyfriends', 'group', display_name($user)));
+        delete_records('usr_friend_request', 'owner', $USER->get('id'), 'requester', $user->id);
+        redirect('/user/view.php?id=' . $user->id);
+    }
+
     // friend db record
     $f = new StdClass;
     $f->ctime = db_format_timestamp(time());

htdocs/user/find.php

@@ -36,6 +36,10 @@ define('SECTION_PLUGINTYPE', 'core');
 define('SECTION_PLUGINNAME', 'user');
 define('SECTION_PAGE', 'find');
 
+if (param_variable('acceptfriend_submit', null)) {
+    acceptfriend_form(param_integer('id'));
+}
+
 $query = param_variable('query', '');
 $offset = param_integer('offset', 0);
 $filter = param_alpha('filter', $USER->get('admin') ? 'all' : 'myinstitutions');

htdocs/user/myfriends.php

@@ -35,6 +35,10 @@ define('SECTION_PLUGINTYPE', 'core');
 define('SECTION_PLUGINNAME', 'user');
 define('SECTION_PAGE', 'myfriends');
 
+if (param_variable('acceptfriend_submit', null)) {
+    acceptfriend_form(param_integer('id'));
+}
+
 $filter = param_alpha('filter', 'all');
 $offset = param_integer('offset', 0);
 $limit = 10;