Set correct 'My Account' link after changing username

Don't print messages (and the account form) in process_account_form()
anymore, but return them to the caller. When updating accounts, this
function will be called before the headers are written.

If a username has been changed by process_account_form(), the headers
now show the updated username from the database in the 'My Account'
link. Clicking on it immediately after changing a username will no
longer lead to a non-existing URL.

Signed-off-by: Marcel Korpel <marcel.korpel@gmail.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

1 files changed, 28 insertions, 10 deletions

diff --git a/web/html/account.php b/web/html/account.php
index f5e6c19..adc2542 100644
--- a/web/html/account.php
+++ b/web/html/account.php
@@ -19,6 +19,26 @@ if (in_array($action, $need_userinfo)) {
 	$PK = implode("\n", account_get_ssh_keys($row["ID"]));
 }
 
+/* This has to be done before the navigation headers are written,
+ * because html_header() fetches the current username from the database,
+ * which could be changed by process_account_form()
+ */
+if ($action == "UpdateAccount") {
+	$update_account_message = '';
+	/* Details for account being updated */
+	/* Verify user permissions and that the request is a valid POST */
+	if (can_edit_account($row) && check_token()) {
+		/* Update the details for the existing account */
+		list($success, $update_account_message) = process_account_form(
+			"edit", "UpdateAccount",
+			in_request("U"), in_request("T"), in_request("S"),
+			in_request("E"), in_request("P"), in_request("C"),
+			in_request("R"), in_request("L"), in_request("I"),
+			in_request("K"), in_request("PK"), in_request("J"),
+			in_request("ID"), $row["Username"]);
+	}
+}
+
 if ($action == "AccountInfo") {
 	html_header(__('Account') . ' ' . $row['Username']);
 } else {
@@ -91,17 +111,15 @@ if (isset($_COOKIE["AURSID"])) {
 		}
 
 	} elseif ($action == "UpdateAccount") {
-		/* Details for account being updated */
-		/* Verify user permissions and that the request is a valid POST */
-		if (can_edit_account($row) && check_token()) {
-			/* Update the details for the existing account */
-			process_account_form("edit", "UpdateAccount",
-					in_request("U"), in_request("T"), in_request("S"),
-					in_request("E"), in_request("P"), in_request("C"),
-					in_request("R"), in_request("L"), in_request("I"),
-					in_request("K"), in_request("PK"), in_request("J"),
-					in_request("ID"), $row["Username"]);
+		print $update_account_message;
+
+		if (!$success) {
+			display_account_form("UpdateAccount", in_request("U"), in_request("T"),
+				in_request("S"), in_request("E"), in_request("P"), in_request("C"),
+				in_request("R"), in_request("L"), in_request("I"), in_request("K"),
+				in_request("PK"), in_request("J"), in_request("ID"), $row["Username"]);
 		}
+
 	} else {
 		if (has_credential(CRED_ACCOUNT_SEARCH)) {
 			# display the search page if they're a TU/dev