| punbb-1.2.4/upload/admin_users.php |
punbb-1.2.5/upload/admin_users.php |
| 49: ?> | 49: ?> |
| 50: <div class="linkst"> | 50: <div class="linkst"> |
| 51: <div class="inbox"> | 51: <div class="inbox"> |
| 52: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 52: <div><a href="javascript:history.go(-1)">Go back</a></div> |
| 53: </div> | 53: </div> |
| 54: </div> | 54: </div> |
| 55: | 55: |
| 98: | 98: |
| 99: <div class="linksb"> | 99: <div class="linksb"> |
| 100: <div class="inbox"> | 100: <div class="inbox"> |
| 101: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 101: <div><a href="javascript:history.go(-1)">Go back</a></div> |
| 102: </div> | 102: </div> |
| 103: </div> | 103: </div> |
| 104: <?php | 104: <?php |
| 121: ?> | 121: ?> |
| 122: <div class="linkst"> | 122: <div class="linkst"> |
| 123: <div class="inbox"> | 123: <div class="inbox"> |
| 124: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 124: <div><a href="javascript:history.go(-1)">Go back</a></div> |
| 125: </div> | 125: </div> |
| 126: </div> | 126: </div> |
| 127: | 127: |
| 202: | 202: |
| 203: <div class="linksb"> | 203: <div class="linksb"> |
| 204: <div class="inbox"> | 204: <div class="inbox"> |
| 205: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 205: <div><a href="javascript:history.go(-1)">Go back</a></div> |
| 206: </div> | 206: </div> |
| 207: </div> | 207: </div> |
| 208: <?php | 208: <?php |
| 278: ?> | 278: ?> |
| 279: <div class="linkst"> | 279: <div class="linkst"> |
| 280: <div class="inbox"> | 280: <div class="inbox"> |
| 281: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 281: <div><a href="javascript:history.go(-1)">Go back</a></div> |
| 282: </div> | 282: </div> |
| 283: </div> | 283: </div> |
| 284: | 284: |
| 338: | 338: |
| 339: <div class="linksb"> | 339: <div class="linksb"> |
| 340: <div class="inbox"> | 340: <div class="inbox"> |
| 341: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 341: <div><a href="javascript:history.go(-1)">Go back</a></div> |
| 342: </div> | 342: </div> |
| 343: </div> | 343: </div> |
| 344: <?php | 344: <?php |
| punbb-1.2.4/upload/include/email.php |
punbb-1.2.5/upload/include/email.php |
| 33: // | 33: // |
| 34: function is_valid_email($email) | 34: function is_valid_email($email) |
| 35: { | 35: { |
| 36: return preg_match('/^(([^<>()[\]\\.,;:\s@\"]+(\.[^<>()[\]\\.,;:\s@\"]+)*)|(\".+\"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/', $email); | 36: if (strlen($email) > 50) |
| | 37: return false; |
| | 38: |
| | 39: return preg_match('/^(([^<>()[\]\\.,;:\s@"\']+(\.[^<>()[\]\\.,;:\s@"\']+)*)|("[^"\']+"))@((\[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\])|(([a-zA-Z\d\-]+\.)+[a-zA-Z]{2,}))$/', $email); |
| 37: } | 40: } |
| 38: | 41: |
| 39: | 42: |
| 65: | 68: |
| 66: // Default sender/return address | 69: // Default sender/return address |
| 67: if (!$from) | 70: if (!$from) |
| 68: $from = '"'.$pun_config['o_board_title'].' '.$lang_common['Mailer'].'" <'.$pun_config['o_webmaster_email'].'>'; | 71: $from = '"'.str_replace('"', '', $pun_config['o_board_title'].' '.$lang_common['Mailer']).'" <'.$pun_config['o_webmaster_email'].'>'; |
| 69: | 72: |
| 70: // Do a little spring cleaning | 73: // Do a little spring cleaning |
| 71: $to = trim(preg_replace('#[\n\r]+#s', '', $to)); | 74: $to = trim(preg_replace('#[\n\r]+#s', '', $to)); |
| punbb-1.2.4/upload/include/parser.php |
punbb-1.2.5/upload/include/parser.php |
| 45: $b = array('[b]', '[i]', '[u]', '[/b]', '[/i]', '[/u]'); | 45: $b = array('[b]', '[i]', '[u]', '[/b]', '[/i]', '[/u]'); |
| 46: $text = str_replace($a, $b, $text); | 46: $text = str_replace($a, $b, $text); |
| 47: | 47: |
| 48: // Do the more complex BBCodes (and strip excessive whitespace) | 48: // Do the more complex BBCodes (also strip excessive whitespace and useless quotes) |
| 49: $a = array( '#\[url=(.*?)\]\s*#i', | 49: $a = array( '#\[url=("|\'|)(.*?)\\1\]\s*#i', |
| 50: '#\[url\]\s*#i', | 50: '#\[url\]\s*#i', |
| 51: '#\s*\[/url\]#i', | 51: '#\s*\[/url\]#i', |
| 52: '#\[email=(.*?)\]\s*#i', | 52: '#\[email=("|\'|)(.*?)\\1\]\s*#i', |
| 53: '#\[email\]\s*#i', | 53: '#\[email\]\s*#i', |
| 54: '#\s*\[/email\]#i', | 54: '#\s*\[/email\]#i', |
| 55: '#\[img\]\s*(.*?)\s*\[/img\]#is', | 55: '#\[img\]\s*(.*?)\s*\[/img\]#is', |
| 56: '#\[colou?r=(.*?)\](.*?)\[/colou?r\]#is'); | 56: '#\[colou?r=("|\'|)(.*?)\\1\](.*?)\[/colou?r\]#is'); |
| 57: | 57: |
| 58: $b = array( '[url=$1]', | 58: $b = array( '[url=$2]', |
| 59: '[url]', | 59: '[url]', |
| 60: '[/url]', | 60: '[/url]', |
| 61: '[email=$1]', | 61: '[email=$2]', |
| 62: '[email]', | 62: '[email]', |
| 63: '[/email]', | 63: '[/email]', |
| 64: '[img]$1[/img]', | 64: '[img]$1[/img]', |
| 65: '[color=$1]$2[/color]'); | 65: '[color=$2]$3[/color]'); |
| 66: | 66: |
| 67: if (!$is_signature) | 67: if (!$is_signature) |
| 68: { | 68: { |
| 182: // We found a [code] | 182: // We found a [code] |
| 183: else if ($c_start < min($c_end, $q_start, $q_end)) | 183: else if ($c_start < min($c_end, $q_start, $q_end)) |
| 184: { | 184: { |
| | 185: // Make sure there's a [/code] and that any new [code] doesn't occur before the end tag |
| 185: $tmp = strpos($text, '[/code]'); | 186: $tmp = strpos($text, '[/code]'); |
| 186: if ($tmp === false) | 187: $tmp2 = strpos(substr($text, 6), '[code]'); |
| | 188: if ($tmp === false || ($tmp2 !== false && $tmp2 < $tmp)) |
| 187: { | 189: { |
| 188: $error = $lang_common['BBCode error'].' '.$lang_common['BBCode error 2']; | 190: $error = $lang_common['BBCode error'].' '.$lang_common['BBCode error 2']; |
| 189: return; | 191: return; |
| punbb-1.2.4/upload/login.php |
punbb-1.2.5/upload/login.php |
| 40: $form_username = trim($_POST['req_username']); | 40: $form_username = trim($_POST['req_username']); |
| 41: $form_password = trim($_POST['req_password']); | 41: $form_password = trim($_POST['req_password']); |
| 42: | 42: |
| 43: $result = $db->query('SELECT id, group_id, password, save_pass FROM '.$db->prefix.'users WHERE username=\''.$db->escape($form_username).'\'') or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); | 43: $username_sql = ($db_type == 'mysql' || $db_type == 'mysqli') ? 'username=\''.$db->escape($form_username).'\'' : 'LOWER(username)=LOWER(\''.$db->escape($form_username).'\')'; |
| | 44: |
| | 45: $result = $db->query('SELECT id, group_id, password, save_pass FROM '.$db->prefix.'users WHERE '.$username_sql) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); |
| 44: list($user_id, $group_id, $db_password_hash, $save_pass) = $db->fetch_row($result); | 46: list($user_id, $group_id, $db_password_hash, $save_pass) = $db->fetch_row($result); |
| 45: | 47: |
| 46: $authorized = false; | 48: $authorized = false; |
| punbb-1.2.4/upload/misc.php |
punbb-1.2.5/upload/misc.php |
| 118: | 118: |
| 119: require_once PUN_ROOT.'include/email.php'; | 119: require_once PUN_ROOT.'include/email.php'; |
| 120: | 120: |
| 121: pun_mail($recipient_email, $mail_subject, $mail_message, $pun_user['username'].' <'.$pun_user['email'].'>'); | 121: pun_mail($recipient_email, $mail_subject, $mail_message, '"'.str_replace('"', '', $pun_user['username']).'" <'.$pun_user['email'].'>'); |
| 122: | 122: |
| 123: redirect($_POST['redirect_url'], $lang_misc['E-mail sent redirect']); | 123: redirect($_POST['redirect_url'], $lang_misc['E-mail sent redirect']); |
| 124: } | 124: } |
| punbb-1.2.4/upload/moderate.php |
punbb-1.2.5/upload/moderate.php |
| 472: if (empty($topics)) | 472: if (empty($topics)) |
| 473: message($lang_misc['No topics selected']); | 473: message($lang_misc['No topics selected']); |
| 474: | 474: |
| 475: $db->query('UPDATE '.$db->prefix.'topics SET closed='.$action.' WHERE id IN('.implode(',', array_keys($topics)).')') or error('Unable to close topics', __FILE__, __LINE__, $db->error()); | 475: $db->query('UPDATE '.$db->prefix.'topics SET closed='.$action.' WHERE id IN('.implode(',', $topics).')') or error('Unable to close topics', __FILE__, __LINE__, $db->error()); |
| 476: | 476: |
| 477: $redirect_msg = ($action) ? $lang_misc['Close topics redirect'] : $lang_misc['Open topics redirect']; | 477: $redirect_msg = ($action) ? $lang_misc['Close topics redirect'] : $lang_misc['Open topics redirect']; |
| 478: redirect('moderate.php?fid='.$fid, $redirect_msg); | 478: redirect('moderate.php?fid='.$fid, $redirect_msg); |
| punbb-1.2.4/upload/profile.php |
punbb-1.2.5/upload/profile.php |
| 194: message($lang_profile['E-mail key bad'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.'); | 194: message($lang_profile['E-mail key bad'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.'); |
| 195: else | 195: else |
| 196: { | 196: { |
| 197: $db->query('UPDATE '.$db->prefix.'users SET email=\''.$new_email.'\', activate_string=NULL, activate_key=NULL WHERE id='.$id) or error('Unable to update e-mail address', __FILE__, __LINE__, $db->error()); | 197: $db->query('UPDATE '.$db->prefix.'users SET email=activate_string, activate_string=NULL, activate_key=NULL WHERE id='.$id) or error('Unable to update e-mail address', __FILE__, __LINE__, $db->error()); |
| 198: | 198: |
| 199: message($lang_profile['E-mail updated'], true); | 199: message($lang_profile['E-mail updated'], true); |
| 200: } | 200: } |
| 303: | 303: |
| 304: if (isset($_POST['form_sent'])) | 304: if (isset($_POST['form_sent'])) |
| 305: { | 305: { |
| | 306: if (!isset($_FILES['req_file'])) |
| | 307: message($lang_profile['No file']); |
| | 308: |
| 306: $uploaded_file = $_FILES['req_file']; | 309: $uploaded_file = $_FILES['req_file']; |
| 307: | 310: |
| 308: // Make sure the upload went smooth | 311: // Make sure the upload went smooth |
| 360: | 363: |
| 361: // Now check the width/height | 364: // Now check the width/height |
| 362: list($width, $height, ,) = getimagesize($pun_config['o_avatars_dir'].'/'.$id.'.tmp'); | 365: list($width, $height, ,) = getimagesize($pun_config['o_avatars_dir'].'/'.$id.'.tmp'); |
| 363: if ($width > $pun_config['o_avatars_width'] || $height > $pun_config['o_avatars_height']) | 366: if (empty($width) || empty($height) || $width > $pun_config['o_avatars_width'] || $height > $pun_config['o_avatars_height']) |
| 364: { | 367: { |
| 365: @unlink($pun_config['o_avatars_dir'].'/'.$id.'.tmp'); | 368: @unlink($pun_config['o_avatars_dir'].'/'.$id.'.tmp'); |
| 366: message($lang_profile['Too wide or high'].' '.$pun_config['o_avatars_width'].'x'.$pun_config['o_avatars_height'].' '.$lang_profile['pixels'].'.'); | 369: message($lang_profile['Too wide or high'].' '.$pun_config['o_avatars_width'].'x'.$pun_config['o_avatars_height'].' '.$lang_profile['pixels'].'.'); |
| 1232: <legend><?php echo $lang_profile['Contact details legend'] ?></legend> | 1235: <legend><?php echo $lang_profile['Contact details legend'] ?></legend> |
| 1233: <div class="infldset"> | 1236: <div class="infldset"> |
| 1234: <input type="hidden" name="form_sent" value="1" /> | 1237: <input type="hidden" name="form_sent" value="1" /> |
| 1235: <label><?php echo $lang_profile['Jabber'] ?><br /><input id="jabber" type="text" name="form[jabber]" value="<?php echo $user['jabber'] ?>" size="40" maxlength="75" /><br /></label> | 1238: <label><?php echo $lang_profile['Jabber'] ?><br /><input id="jabber" type="text" name="form[jabber]" value="<?php echo pun_htmlspecialchars($user['jabber']) ?>" size="40" maxlength="75" /><br /></label> |
| 1236: <label><?php echo $lang_profile['ICQ'] ?><br /><input id="icq" type="text" name="form[icq]" value="<?php echo $user['icq'] ?>" size="12" maxlength="12" /><br /></label> | 1239: <label><?php echo $lang_profile['ICQ'] ?><br /><input id="icq" type="text" name="form[icq]" value="<?php echo $user['icq'] ?>" size="12" maxlength="12" /><br /></label> |
| 1237: <label><?php echo $lang_profile['MSN'] ?><br /><input id="msn" type="text" name="form[msn]" value="<?php echo pun_htmlspecialchars($user['msn']) ?>" size="40" maxlength="50" /><br /></label> | 1240: <label><?php echo $lang_profile['MSN'] ?><br /><input id="msn" type="text" name="form[msn]" value="<?php echo pun_htmlspecialchars($user['msn']) ?>" size="40" maxlength="50" /><br /></label> |
| 1238: <label><?php echo $lang_profile['AOL IM'] ?><br /><input id="aim" type="text" name="form[aim]" value="<?php echo pun_htmlspecialchars($user['aim']) ?>" size="20" maxlength="30" /><br /></label> | 1241: <label><?php echo $lang_profile['AOL IM'] ?><br /><input id="aim" type="text" name="form[aim]" value="<?php echo pun_htmlspecialchars($user['aim']) ?>" size="20" maxlength="30" /><br /></label> |
| punbb-1.2.4/upload/viewtopic.php |
punbb-1.2.5/upload/viewtopic.php |
| 183: $post_count = 0; // Keep track of post numbers | 183: $post_count = 0; // Keep track of post numbers |
| 184: | 184: |
| 185: // Retrieve the posts (and their respective poster/online status) | 185: // Retrieve the posts (and their respective poster/online status) |
| 186: $result = $db->query('SELECT DISTINCT u.email, u.title, u.url, u.location, u.use_avatar, u.signature, u.email_setting, u.num_posts, u.registered, u.admin_note, p.id, p.poster AS username, p.poster_id, p.poster_ip, p.poster_email, p.message, p.hide_smilies, p.posted, p.edited, p.edited_by, g.g_id, g.g_user_title, o.user_id AS is_online FROM '.$db->prefix.'posts AS p INNER JOIN '.$db->prefix.'users AS u ON u.id=p.poster_id INNER JOIN '.$db->prefix.'groups AS g ON g.g_id=u.group_id LEFT JOIN '.$db->prefix.'online AS o ON (o.user_id=u.id AND o.idle=0) WHERE p.topic_id='.$id.' ORDER BY p.id LIMIT '.$start_from.','.$pun_user['disp_posts'], true) or error('Unable to fetch post info', __FILE__, __LINE__, $db->error()); | 186: $result = $db->query('SELECT u.email, u.title, u.url, u.location, u.use_avatar, u.signature, u.email_setting, u.num_posts, u.registered, u.admin_note, p.id, p.poster AS username, p.poster_id, p.poster_ip, p.poster_email, p.message, p.hide_smilies, p.posted, p.edited, p.edited_by, g.g_id, g.g_user_title, o.user_id AS is_online FROM '.$db->prefix.'posts AS p INNER JOIN '.$db->prefix.'users AS u ON u.id=p.poster_id INNER JOIN '.$db->prefix.'groups AS g ON g.g_id=u.group_id LEFT JOIN '.$db->prefix.'online AS o ON (o.user_id=u.id AND o.idle=0) WHERE p.topic_id='.$id.' ORDER BY p.id LIMIT '.$start_from.','.$pun_user['disp_posts'], true) or error('Unable to fetch post info', __FILE__, __LINE__, $db->error()); |
| 187: while ($cur_post = $db->fetch_assoc($result)) | 187: while ($cur_post = $db->fetch_assoc($result)) |
| 188: { | 188: { |
| 189: $post_count++; | 189: $post_count++; |