protected void UserView_ItemUpdating(object sender, DetailsViewUpdateEventArgs e)
{
UserObject userObj = FooSessionHelper.GetUserObjectFromCookie(HttpContext.Current);
string userId = userObj.UserId;
string userName = userObj.Username;
if (!FooStringHelper.IsValidAlphanumeric(userId, 16))
{
errorLabel.Text = "Invalid request.";
Reset_Page();
return;
}
var txtUserAlias = (TextBox)userView.FindControl("txtUserAlias");
var txtUserEmail = (TextBox)userView.FindControl("txtUserEmail");
var txtUserAddress = (TextBox)userView.FindControl("txtUserAddress");
var txtUserCity = (TextBox)userView.FindControl("txtUserCity");
var txtUserCountry = (TextBox)userView.FindControl("txtUserCountry");
var txtUserBody = (TextBox)userView.FindControl("txtUserBody");
var imageUploadForm = (FileUpload)userView.FindControl("imageUploadForm");
if (!string.IsNullOrEmpty(txtUserAlias.Text) && !string.IsNullOrEmpty(txtUserEmail.Text) &&
!string.IsNullOrEmpty(txtUserAddress.Text) && !string.IsNullOrEmpty(txtUserCity.Text) &&
!string.IsNullOrEmpty(txtUserCountry.Text) && !string.IsNullOrEmpty(txtUserBody.Text) &&
!string.IsNullOrEmpty(txtUserEmail.Text) && FooStringHelper.IsValidEmailAddress(txtUserEmail.Text) &&
!FooEmailHelper.CheckIfEmailExists(txtUserEmail.Text, userName))
{
try
{
if (FooSessionHelper.IsValidRequest(HttpContext.Current, RequestToken.Value))
{
using (var conn = new NpgsqlConnection())
{
conn.ConnectionString =
ConfigurationManager.ConnectionStrings["fooPostgreSQL"].ConnectionString;
conn.Open();
var cmd = new NpgsqlCommand
{
CommandText =
"UPDATE users SET (useralias, email, address, city, country, profilebody) = (@USERALIAS, @EMAIL, @ADDRESS, @CITY, @COUNTRY, @PROFILEBODY) WHERE userid= @USERID",
CommandType = CommandType.Text,
Connection = conn
};
var idParam = new NpgsqlParameter
{
ParameterName = "@USERID",
NpgsqlDbType = NpgsqlDbType.Varchar,
Size = 16,
Direction = ParameterDirection.Input,
Value = FooStringHelper.RemoveInvalidChars(userId)
};
cmd.Parameters.Add(idParam);
var aliasParam = new NpgsqlParameter
{
ParameterName = "@USERALIAS",
NpgsqlDbType = NpgsqlDbType.Varchar,
Size = 32,
Direction = ParameterDirection.Input,
Value = txtUserAlias.Text
};
cmd.Parameters.Add(aliasParam);
var emailParam = new NpgsqlParameter
{
ParameterName = "@EMAIL",
NpgsqlDbType = NpgsqlDbType.Varchar,
Size = 64,
Direction = ParameterDirection.Input,
Value = txtUserEmail.Text
};
cmd.Parameters.Add(emailParam);
var addressParam = new NpgsqlParameter
{
ParameterName = "@ADDRESS",
NpgsqlDbType = NpgsqlDbType.Varchar,
Size = 128,
Direction = ParameterDirection.Input,
Value = txtUserAddress.Text
};
cmd.Parameters.Add(addressParam);
var cityParam = new NpgsqlParameter
{
ParameterName = "@CITY",
NpgsqlDbType = NpgsqlDbType.Varchar,
Size = 32,
Direction = ParameterDirection.Input,
Value = txtUserCity.Text
};
cmd.Parameters.Add(cityParam);
var countryParam = new NpgsqlParameter
{
ParameterName = "@COUNTRY",
NpgsqlDbType = NpgsqlDbType.Varchar,
Size = 32,
Direction = ParameterDirection.Input,
Value = txtUserCountry.Text
};
cmd.Parameters.Add(countryParam);
var bodyParam = new NpgsqlParameter
{
ParameterName = "@PROFILEBODY",
NpgsqlDbType = NpgsqlDbType.Varchar,
Size = 1024,
Direction = ParameterDirection.Input,
Value = txtUserBody.Text
};
cmd.Parameters.Add(bodyParam);
cmd.ExecuteNonQuery();
cmd.Dispose();
}
if (imageUploadForm.HasFile)
{
string path = HttpContext.Current.Server.MapPath("~/uploads");
if (!Directory.Exists(path))
{
Directory.CreateDirectory(path);
}
HttpPostedFile file = HttpContext.Current.Request.Files[0];
if (file.ContentLength < 2097152)
{
string fileName;
if (HttpContext.Current.Request.Browser.Browser.ToUpper() == "IE")
{
string[] files = file.FileName.Split(new[] { '\\' });
fileName = files[files.Length - 1];
}
else
{
fileName = file.FileName;
}
fileName = FooStringHelper.RandomFileName(fileName);
string filePath = Path.Combine(path, fileName);
try
{
file.SaveAs(filePath);
Insert_NewImage(fileName, userId);
Reset_Page();
}
catch (Exception ex)
{
FooLogging.WriteLog(ex.ToString());
errorLabel.Text = "Upload failed.";
}
}
else
{
errorLabel.Text = "Invalid file.";
}
}
}
}
catch (Exception ex)
{
FooLogging.WriteLog(ex.ToString());
errorLabel.Text = "Something has gone wrong. A log has been forwarded to the site administrator.";
}
}
else
{
errorLabel.Text = "Incomplete or invalid input.";
}
Reset_Page();
}
protected void Insert_NewImage(string merchId, HttpPostedFile file)
{
string fileName = "profile_default.jpg";
string path = HttpContext.Current.Server.MapPath("~/uploads");
if (!Directory.Exists(path))
{
Directory.CreateDirectory(path);
}
if (file != null)
{
var uploadCompleted = false;
byte[] fileBytes = FooFileHelper.GetFileBytesFromHttpStream(file);
if (FooFileHelper.IsImage(fileBytes) && fileBytes.Length < 2097152)
{
if (HttpContext.Current.Request.Browser.Browser.ToUpper() == "IE")
{
string[] files = file.FileName.Split(new[] { '\\' });
fileName = files[files.Length - 1];
}
else
{
fileName = file.FileName;
}
fileName = FooStringHelper.RandomFileName(fileName);
string filePath = Path.Combine(path, fileName);
try
{
File.WriteAllBytes(filePath, fileBytes);
uploadCompleted = true;
}
catch (Exception ex)
{
FooLogging.WriteLog(ex.ToString());
errorLabel.Text = "Upload failed.";
}
}
else
{
errorLabel.Text = "Invalid file.";
}
if (uploadCompleted)
{
try
{
using (var conn = new NpgsqlConnection())
{
conn.ConnectionString =
ConfigurationManager.ConnectionStrings["fooPostgreSQL"].ConnectionString;
conn.Open();
var cmd =
new NpgsqlCommand(
"SELECT merchimg FROM merchandise WHERE merchid= @MERCHID",
conn);
var idParam = new NpgsqlParameter
{
ParameterName = "@MERCHID",
NpgsqlDbType = NpgsqlDbType.Varchar,
Size = 16,
Direction = ParameterDirection.Input,
Value = merchId
};
cmd.Parameters.Add(idParam);
NpgsqlDataReader dr = cmd.ExecuteReader();
string imageFile = string.Empty;
while (dr.Read())
{
imageFile = dr["merchimg"].ToString();
}
dr.Close();
if (imageFile != string.Empty && imageFile != "merch_default.jpg")
{
string currentFile = Path.Combine(path, imageFile);
if (File.Exists(currentFile))
{
File.Delete(currentFile);
}
}
}
using (var conn = new NpgsqlConnection())
{
conn.ConnectionString =
ConfigurationManager.ConnectionStrings["fooPostgreSQL"].ConnectionString;
conn.Open();
var cmd =
new NpgsqlCommand(
"UPDATE merchandise SET (merchimg) = (@MERCHIMG) WHERE merchid= @MERCHID",
conn);
var idParam = new NpgsqlParameter
{
ParameterName = "@MERCHID",
NpgsqlDbType = NpgsqlDbType.Varchar,
Size = 16,
Direction = ParameterDirection.Input,
Value = merchId
};
cmd.Parameters.Add(idParam);
var imgParam = new NpgsqlParameter
{
ParameterName = "@MERCHIMG",
NpgsqlDbType = NpgsqlDbType.Varchar,
Size = 64,
Direction = ParameterDirection.Input,
Value = fileName
};
cmd.Parameters.Add(imgParam);
cmd.ExecuteNonQuery();
}
}
catch (Exception ex)
{
FooLogging.WriteLog(ex.ToString());
errorLabel.Text =
"Something has gone wrong. A log has been forwarded to the site administrator.";
}
}
}
}