| punbb-1.2.4/upload/admin_bans.php |
punbb-1.2.6/upload/admin_bans.php |
| 44: if (isset($_GET['add_ban'])) | 44: if (isset($_GET['add_ban'])) |
| 45: { | 45: { |
| 46: $add_ban = intval($_GET['add_ban']); | 46: $add_ban = intval($_GET['add_ban']); |
| 47: if ($add_ban < 1) | 47: if ($add_ban < 2) |
| 48: message($lang_common['Bad request']); | 48: message($lang_common['Bad request']); |
| 49: | 49: |
| 50: $user_id = $add_ban; | 50: $user_id = $add_ban; |
| 61: | 61: |
| 62: if ($ban_user != '') | 62: if ($ban_user != '') |
| 63: { | 63: { |
| 64: $result = $db->query('SELECT id, group_id, username, email FROM '.$db->prefix.'users WHERE username=\''.$db->escape($ban_user).'\'') or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); | 64: $result = $db->query('SELECT id, group_id, username, email FROM '.$db->prefix.'users WHERE username=\''.$db->escape($ban_user).'\' AND id>1') or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); |
| 65: if ($db->num_rows($result)) | 65: if ($db->num_rows($result)) |
| 66: list($user_id, $group_id, $ban_user, $ban_email) = $db->fetch_row($result); | 66: list($user_id, $group_id, $ban_user, $ban_email) = $db->fetch_row($result); |
| 67: else | 67: else |
| 244: if ($_POST['mode'] == 'add') | 244: if ($_POST['mode'] == 'add') |
| 245: $db->query('INSERT INTO '.$db->prefix.'bans (username, ip, email, message, expire) VALUES('.$ban_user.', '.$ban_ip.', '.$ban_email.', '.$ban_message.', '.$ban_expire.')') or error('Unable to add ban', __FILE__, __LINE__, $db->error()); | 245: $db->query('INSERT INTO '.$db->prefix.'bans (username, ip, email, message, expire) VALUES('.$ban_user.', '.$ban_ip.', '.$ban_email.', '.$ban_message.', '.$ban_expire.')') or error('Unable to add ban', __FILE__, __LINE__, $db->error()); |
| 246: else | 246: else |
| 247: $db->query('UPDATE '.$db->prefix.'bans SET username='.$ban_user.', ip='.$ban_ip.', email='.$ban_email.', message='.$ban_message.', expire='.$ban_expire.' WHERE id='.$_POST['ban_id']) or error('Unable to update ban', __FILE__, __LINE__, $db->error()); | 247: $db->query('UPDATE '.$db->prefix.'bans SET username='.$ban_user.', ip='.$ban_ip.', email='.$ban_email.', message='.$ban_message.', expire='.$ban_expire.' WHERE id='.intval($_POST['ban_id'])) or error('Unable to update ban', __FILE__, __LINE__, $db->error()); |
| 248: | 248: |
| 249: // Regenerate the bans cache | 249: // Regenerate the bans cache |
| 250: require_once PUN_ROOT.'include/cache.php'; | 250: require_once PUN_ROOT.'include/cache.php'; |
| punbb-1.2.4/upload/admin_groups.php |
punbb-1.2.6/upload/admin_groups.php |
| 209: | 209: |
| 210: $title = trim($_POST['req_title']); | 210: $title = trim($_POST['req_title']); |
| 211: $user_title = trim($_POST['user_title']); | 211: $user_title = trim($_POST['user_title']); |
| 212: $read_board = isset($_POST['read_board']) ? $_POST['read_board'] : '1'; | 212: $read_board = isset($_POST['read_board']) ? intval($_POST['read_board']) : '1'; |
| 213: $post_replies = isset($_POST['post_replies']) ? $_POST['post_replies'] : '1'; | 213: $post_replies = isset($_POST['post_replies']) ? intval($_POST['post_replies']) : '1'; |
| 214: $post_topics = isset($_POST['post_topics']) ? $_POST['post_topics'] : '1'; | 214: $post_topics = isset($_POST['post_topics']) ? intval($_POST['post_topics']) : '1'; |
| 215: $edit_posts = isset($_POST['edit_posts']) ? $_POST['edit_posts'] : ($is_admin_group) ? '1' : '0'; | 215: $edit_posts = isset($_POST['edit_posts']) ? intval($_POST['edit_posts']) : ($is_admin_group) ? '1' : '0'; |
| 216: $delete_posts = isset($_POST['delete_posts']) ? $_POST['delete_posts'] : ($is_admin_group) ? '1' : '0'; | 216: $delete_posts = isset($_POST['delete_posts']) ? intval($_POST['delete_posts']) : ($is_admin_group) ? '1' : '0'; |
| 217: $delete_topics = isset($_POST['delete_topics']) ? $_POST['delete_topics'] : ($is_admin_group) ? '1' : '0'; | 217: $delete_topics = isset($_POST['delete_topics']) ? intval($_POST['delete_topics']) : ($is_admin_group) ? '1' : '0'; |
| 218: $set_title = isset($_POST['set_title']) ? $_POST['set_title'] : ($is_admin_group) ? '1' : '0'; | 218: $set_title = isset($_POST['set_title']) ? intval($_POST['set_title']) : ($is_admin_group) ? '1' : '0'; |
| 219: $search = isset($_POST['search']) ? $_POST['search'] : '1'; | 219: $search = isset($_POST['search']) ? intval($_POST['search']) : '1'; |
| 220: $search_users = isset($_POST['search_users']) ? $_POST['search_users'] : '1'; | 220: $search_users = isset($_POST['search_users']) ? intval($_POST['search_users']) : '1'; |
| 221: $edit_subjects_interval = isset($_POST['edit_subjects_interval']) ? intval($_POST['edit_subjects_interval']) : '0'; | 221: $edit_subjects_interval = isset($_POST['edit_subjects_interval']) ? intval($_POST['edit_subjects_interval']) : '0'; |
| 222: $post_flood = isset($_POST['post_flood']) ? intval($_POST['post_flood']) : '0'; | 222: $post_flood = isset($_POST['post_flood']) ? intval($_POST['post_flood']) : '0'; |
| 223: $search_flood = isset($_POST['search_flood']) ? intval($_POST['search_flood']) : '0'; | 223: $search_flood = isset($_POST['search_flood']) ? intval($_POST['search_flood']) : '0'; |
| 243: } | 243: } |
| 244: else | 244: else |
| 245: { | 245: { |
| 246: $result = $db->query('SELECT 1 FROM '.$db->prefix.'groups WHERE g_title=\''.$db->escape($title).'\' && g_id!='.$_POST['group_id']) or error('Unable to check group title collision', __FILE__, __LINE__, $db->error()); | 246: $result = $db->query('SELECT 1 FROM '.$db->prefix.'groups WHERE g_title=\''.$db->escape($title).'\' AND g_id!='.$_POST['group_id']) or error('Unable to check group title collision', __FILE__, __LINE__, $db->error()); |
| 247: if ($db->num_rows($result)) | 247: if ($db->num_rows($result)) |
| 248: message('There is already a group with the title \''.pun_htmlspecialchars($title).'\'.'); | 248: message('There is already a group with the title \''.pun_htmlspecialchars($title).'\'.'); |
| 249: | 249: |
| punbb-1.2.4/upload/admin_options.php |
punbb-1.2.6/upload/admin_options.php |
| 117: while (list($key, $input) = @each($form)) | 117: while (list($key, $input) = @each($form)) |
| 118: { | 118: { |
| 119: // Only update values that have changed | 119: // Only update values that have changed |
| 120: if ($pun_config['o_'.$key] != $input) | 120: if (isset($pun_config['o_'.$key]) && $pun_config['o_'.$key] != $input) |
| 121: { | 121: { |
| 122: if ($input != '' || is_int($input)) | 122: if ($input != '' || is_int($input)) |
| 123: $value = '\''.$db->escape($input).'\''; | 123: $value = '\''.$db->escape($input).'\''; |
| 124: else | 124: else |
| 125: $value = 'NULL'; | 125: $value = 'NULL'; |
| 126: | 126: |
| 127: $db->query('UPDATE '.$db->prefix.'config SET conf_value='.$value.' WHERE conf_name=\'o_'.$key.'\'') or error('Unable to update board config', __FILE__, __LINE__, $db->error()); | 127: $db->query('UPDATE '.$db->prefix.'config SET conf_value='.$value.' WHERE conf_name=\'o_'.$db->escape($key).'\'') or error('Unable to update board config', __FILE__, __LINE__, $db->error()); |
| 128: } | 128: } |
| 129: } | 129: } |
| 130: | 130: |
| 229: $d = dir(PUN_ROOT.'lang'); | 229: $d = dir(PUN_ROOT.'lang'); |
| 230: while (($entry = $d->read()) !== false) | 230: while (($entry = $d->read()) !== false) |
| 231: { | 231: { |
| 232: if ($entry != '.' && $entry != '..' && is_dir(PUN_ROOT.'lang/'.$entry)) | 232: if ($entry != '.' && $entry != '..' && is_dir(PUN_ROOT.'lang/'.$entry) && file_exists(PUN_ROOT.'lang/'.$entry.'/common.php')) |
| 233: $languages[] = $entry; | 233: $languages[] = $entry; |
| 234: } | 234: } |
| 235: $d->close(); | 235: $d->close(); |
| 236: | 236: |
| | 237: @natsort($languages); |
| | 238: |
| 237: while (list(, $temp) = @each($languages)) | 239: while (list(, $temp) = @each($languages)) |
| 238: { | 240: { |
| 239: if ($pun_config['o_default_lang'] == $temp) | 241: if ($pun_config['o_default_lang'] == $temp) |
| 261: $styles[] = substr($entry, 0, strlen($entry)-4); | 263: $styles[] = substr($entry, 0, strlen($entry)-4); |
| 262: } | 264: } |
| 263: $d->close(); | 265: $d->close(); |
| | 266: |
| | 267: @natsort($styles); |
| 264: | 268: |
| 265: while (list(, $temp) = @each($styles)) | 269: while (list(, $temp) = @each($styles)) |
| 266: { | 270: { |
| punbb-1.2.4/upload/admin_prune.php |
punbb-1.2.6/upload/admin_prune.php |
| 62: } | 62: } |
| 63: else | 63: else |
| 64: { | 64: { |
| | 65: $prune_from = intval($prune_from); |
| 65: prune($prune_from, $_POST['prune_sticky'], $prune_date); | 66: prune($prune_from, $_POST['prune_sticky'], $prune_date); |
| 66: update_forum($prune_from); | 67: update_forum($prune_from); |
| 67: } | 68: } |
| 97: | 98: |
| 98: if ($prune_from != 'all') | 99: if ($prune_from != 'all') |
| 99: { | 100: { |
| | 101: $prune_from = intval($prune_from); |
| 100: $sql .= ' AND forum_id='.$prune_from; | 102: $sql .= ' AND forum_id='.$prune_from; |
| 101: | 103: |
| 102: // Fetch the forum name (just for cosmetic reasons) | 104: // Fetch the forum name (just for cosmetic reasons) |
| 135: </div> | 137: </div> |
| 136: </fieldset> | 138: </fieldset> |
| 137: </div> | 139: </div> |
| 138: <p><input type="submit" name="prune_comply" value="Prune" /> <a href="javascript:history.go(-1)" />Go back</a></p> | 140: <p><input type="submit" name="prune_comply" value="Prune" /><a href="javascript:history.go(-1)">Go back</a></p> |
| 139: </form> | 141: </form> |
| 140: </div> | 142: </div> |
| 141: </div> | 143: </div> |
| punbb-1.2.4/upload/admin_users.php |
punbb-1.2.6/upload/admin_users.php |
| 49: ?> | 49: ?> |
| 50: <div class="linkst"> | 50: <div class="linkst"> |
| 51: <div class="inbox"> | 51: <div class="inbox"> |
| 52: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 52: <div><a href="javascript:history.go(-1)">Go back</a></div> |
| 53: </div> | 53: </div> |
| 54: </div> | 54: </div> |
| 55: | 55: |
| 98: | 98: |
| 99: <div class="linksb"> | 99: <div class="linksb"> |
| 100: <div class="inbox"> | 100: <div class="inbox"> |
| 101: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 101: <div><a href="javascript:history.go(-1)">Go back</a></div> |
| 102: </div> | 102: </div> |
| 103: </div> | 103: </div> |
| 104: <?php | 104: <?php |
| 121: ?> | 121: ?> |
| 122: <div class="linkst"> | 122: <div class="linkst"> |
| 123: <div class="inbox"> | 123: <div class="inbox"> |
| 124: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 124: <div><a href="javascript:history.go(-1)">Go back</a></div> |
| 125: </div> | 125: </div> |
| 126: </div> | 126: </div> |
| 127: | 127: |
| 202: | 202: |
| 203: <div class="linksb"> | 203: <div class="linksb"> |
| 204: <div class="inbox"> | 204: <div class="inbox"> |
| 205: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 205: <div><a href="javascript:history.go(-1)">Go back</a></div> |
| 206: </div> | 206: </div> |
| 207: </div> | 207: </div> |
| 208: <?php | 208: <?php |
| 257: while (list($key, $input) = @each($form)) | 257: while (list($key, $input) = @each($form)) |
| 258: { | 258: { |
| 259: if ($input != '') | 259: if ($input != '') |
| 260: $conditions[] = 'u.'.$key.' '.$like_command.' \''.str_replace('*', '%', $input).'\''; | 260: $conditions[] = 'u.'.$db->escape($key).' '.$like_command.' \''.$db->escape(str_replace('*', '%', $input)).'\''; |
| 261: } | 261: } |
| 262: | 262: |
| 263: if ($posts_greater != '') | 263: if ($posts_greater != '') |
| 278: ?> | 278: ?> |
| 279: <div class="linkst"> | 279: <div class="linkst"> |
| 280: <div class="inbox"> | 280: <div class="inbox"> |
| 281: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 281: <div><a href="javascript:history.go(-1)">Go back</a></div> |
| 282: </div> | 282: </div> |
| 283: </div> | 283: </div> |
| 284: | 284: |
| 338: | 338: |
| 339: <div class="linksb"> | 339: <div class="linksb"> |
| 340: <div class="inbox"> | 340: <div class="inbox"> |
| 341: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 341: <div><a href="javascript:history.go(-1)">Go back</a></div> |
| 342: </div> | 342: </div> |
| 343: </div> | 343: </div> |
| 344: <?php | 344: <?php |
| punbb-1.2.4/upload/extern.php |
punbb-1.2.6/upload/extern.php |
| 129: // Load DB abstraction layer and try to connect | 129: // Load DB abstraction layer and try to connect |
| 130: require PUN_ROOT.'include/dblayer/common_db.php'; | 130: require PUN_ROOT.'include/dblayer/common_db.php'; |
| 131: | 131: |
| 132: // Get the forum config | 132: // Load cached config |
| 133: $result = $db->query('SELECT * FROM '.$db->prefix.'config') or error('Unable to fetch forum config', __FILE__, __LINE__, $db->error()); | 133: @include PUN_ROOT.'cache/cache_config.php'; |
| 134: while ($cur_config_item = $db->fetch_row($result)) | 134: if (!defined('PUN_CONFIG_LOADED')) |
| 135: $pun_config[$cur_config_item[0]] = $cur_config_item[1]; | 135: { |
| | 136: require PUN_ROOT.'include/cache.php'; |
| | 137: generate_config_cache(); |
| | 138: require PUN_ROOT.'cache/cache_config.php'; |
| | 139: } |
| 136: | 140: |
| 137: // Make sure we (guests) have permission to read the forums | 141: // Make sure we (guests) have permission to read the forums |
| 138: $result = $db->query('SELECT g_read_board FROM '.$db->prefix.'groups WHERE g_id=3') or error('Unable to fetch group info', __FILE__, __LINE__, $db->error()); | 142: $result = $db->query('SELECT g_read_board FROM '.$db->prefix.'groups WHERE g_id=3') or error('Unable to fetch group info', __FILE__, __LINE__, $db->error()); |
| punbb-1.2.4/upload/footer.php |
punbb-1.2.6/upload/footer.php |
| 140: | 140: |
| 141: | 141: |
| 142: // START SUBST - <pun_include "*"> | 142: // START SUBST - <pun_include "*"> |
| 143: while (preg_match('/<pun_include "(.*?)">/', $tpl_main, $cur_include)) | 143: while (preg_match('#<pun_include "([^/\\\\]*?)">#', $tpl_main, $cur_include)) |
| 144: { | 144: { |
| | 145: if (!file_exists(PUN_ROOT.'include/user/'.$cur_include[1])) |
| | 146: error('Unable to process user include <pun_include "'.htmlspecialchars($cur_include[1]).'"> from template main.tpl. There is no such file in folder /include/user/'); |
| | 147: |
| 145: ob_start(); | 148: ob_start(); |
| 146: include PUN_ROOT.$cur_include[1]; | 149: include PUN_ROOT.'include/user/'.$cur_include[1]; |
| 147: $tpl_temp = ob_get_contents(); | 150: $tpl_temp = ob_get_contents(); |
| 148: $tpl_main = str_replace($cur_include[0], $tpl_temp, $tpl_main); | 151: $tpl_main = str_replace($cur_include[0], $tpl_temp, $tpl_main); |
| 149: ob_end_clean(); | 152: ob_end_clean(); |
| punbb-1.2.4/upload/include/cache.php |
punbb-1.2.6/upload/include/cache.php |
| 129: global $db; | 129: global $db; |
| 130: | 130: |
| 131: // Get the rank list from the DB | 131: // Get the rank list from the DB |
| 132: $result = $db->query('SELECT * FROM '.$db->prefix.'ranks', true) or error('Unable to fetch rank list', __FILE__, __LINE__, $db->error()); | 132: $result = $db->query('SELECT * FROM '.$db->prefix.'ranks ORDER BY min_posts', true) or error('Unable to fetch rank list', __FILE__, __LINE__, $db->error()); |
| 133: | 133: |
| 134: $output = array(); | 134: $output = array(); |
| 135: while ($cur_rank = $db->fetch_assoc($result)) | 135: while ($cur_rank = $db->fetch_assoc($result)) |
| 174: if (!$fh) | 174: if (!$fh) |
| 175: error('Unable to write quickjump cache file to cache directory. Please make sure PHP has write access to the directory \'cache\'', __FILE__, __LINE__); | 175: error('Unable to write quickjump cache file to cache directory. Please make sure PHP has write access to the directory \'cache\'', __FILE__, __LINE__); |
| 176: | 176: |
| 177: $output = '<?php'."\n\n".'define(\'PUN_QJ_LOADED\', 1);'."\n\n".'?>'; | 177: $output = '<?php'."\n\n".'if (!defined(\'PUN\')) exit;'."\n".'define(\'PUN_QJ_LOADED\', 1);'."\n\n".'?>'; |
| 178: $output .= "\t\t\t\t".'<form id="qjump" method="get" action="viewforum.php">'."\n\t\t\t\t\t".'<div><label><?php echo $lang_common[\'Jump to\'] ?>'."\n\n\t\t\t\t\t".'<br /><select name="id" onchange="window.location=(\'viewforum.php?id=\'+this.options[this.selectedIndex].value)">'."\n"; | 178: $output .= "\t\t\t\t".'<form id="qjump" method="get" action="viewforum.php">'."\n\t\t\t\t\t".'<div><label><?php echo $lang_common[\'Jump to\'] ?>'."\n\n\t\t\t\t\t".'<br /><select name="id" onchange="window.location=(\'viewforum.php?id=\'+this.options[this.selectedIndex].value)">'."\n"; |
| 179: | 179: |
| 180: | 180: |
| punbb-1.2.4/upload/include/common.php |
punbb-1.2.6/upload/include/common.php |
| 43: list($usec, $sec) = explode(' ', microtime()); | 43: list($usec, $sec) = explode(' ', microtime()); |
| 44: $pun_start = ((float)$usec + (float)$sec); | 44: $pun_start = ((float)$usec + (float)$sec); |
| 45: | 45: |
| 46: // Enable full error, warning and notice reporting | 46: // Make sure PHP reports all errors except E_NOTICE. PunBB supports E_ALL, but a lot of scripts it may interact with, do not. |
| 47: error_reporting(E_ALL); | 47: error_reporting(E_ALL ^ E_NOTICE); |
| 48: | 48: |
| 49: // Turn off magic_quotes_runtime | 49: // Turn off magic_quotes_runtime |
| 50: set_magic_quotes_runtime(0); | 50: set_magic_quotes_runtime(0); |
| 117: // Attempt to load the common language file | 117: // Attempt to load the common language file |
| 118: @include PUN_ROOT.'lang/'.$pun_user['language'].'/common.php'; | 118: @include PUN_ROOT.'lang/'.$pun_user['language'].'/common.php'; |
| 119: if (!isset($lang_common)) | 119: if (!isset($lang_common)) |
| 120: exit('There is no valid language pack \''.$pun_user['language'].'\' installed. Please reinstall a language of that name.'); | 120: exit('There is no valid language pack \''.pun_htmlspecialchars($pun_user['language']).'\' installed. Please reinstall a language of that name.'); |
| 121: | 121: |
| 122: // Check if we are to display a maintenance message | 122: // Check if we are to display a maintenance message |
| 123: if ($pun_config['o_maintenance'] && $pun_user['g_id'] > PUN_ADMIN && !defined('PUN_TURN_OFF_MAINT')) | 123: if ($pun_config['o_maintenance'] && $pun_user['g_id'] > PUN_ADMIN && !defined('PUN_TURN_OFF_MAINT')) |
| punbb-1.2.4/upload/include/email.php |
punbb-1.2.6/upload/include/email.php |
| 33: // | 33: // |
| 34: function is_valid_email($email) | 34: function is_valid_email($email) |
| 35: { | 35: { |
| 36: return preg_match('/^(([^<>()[\]\\.,;:\s@\"]+(\.[^<>()[\]\\.,;:\s@\"]+)*)|(\".+\"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/', $email); | 36: if (strlen($email) > 50) |
| | 37: return false; |
| | 38: |
| | 39: return preg_match('/^(([^<>()[\]\\.,;:\s@"\']+(\.[^<>()[\]\\.,;:\s@"\']+)*)|("[^"\']+"))@((\[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\])|(([a-zA-Z\d\-]+\.)+[a-zA-Z]{2,}))$/', $email); |
| 37: } | 40: } |
| 38: | 41: |
| 39: | 42: |
| 65: | 68: |
| 66: // Default sender/return address | 69: // Default sender/return address |
| 67: if (!$from) | 70: if (!$from) |
| 68: $from = '"'.$pun_config['o_board_title'].' '.$lang_common['Mailer'].'" <'.$pun_config['o_webmaster_email'].'>'; | 71: $from = '"'.str_replace('"', '', $pun_config['o_board_title'].' '.$lang_common['Mailer']).'" <'.$pun_config['o_webmaster_email'].'>'; |
| 69: | 72: |
| 70: // Do a little spring cleaning | 73: // Do a little spring cleaning |
| 71: $to = trim(preg_replace('#[\n\r]+#s', '', $to)); | 74: $to = trim(preg_replace('#[\n\r]+#s', '', $to)); |
| punbb-1.2.4/upload/include/functions.php |
punbb-1.2.6/upload/include/functions.php |
| 803: | 803: |
| 804: | 804: |
| 805: // START SUBST - <pun_include "*"> | 805: // START SUBST - <pun_include "*"> |
| 806: while (preg_match('<pun_include "(.*?)">', $tpl_maint, $cur_include)) | 806: while (preg_match('#<pun_include "([^/\\\\]*?)">#', $tpl_maint, $cur_include)) |
| 807: { | 807: { |
| | 808: if (!file_exists(PUN_ROOT.'include/user/'.$cur_include[1])) |
| | 809: error('Unable to process user include <pun_include "'.htmlspecialchars($cur_include[1]).'"> from template maintenance.tpl. There is no such file in folder /include/user/'); |
| | 810: |
| 808: ob_start(); | 811: ob_start(); |
| 809: include PUN_ROOT.$cur_include[1]; | 812: include PUN_ROOT.'include/user/'.$cur_include[1]; |
| 810: $tpl_temp = ob_get_contents(); | 813: $tpl_temp = ob_get_contents(); |
| 811: $tpl_maint = str_replace('<'.$cur_include[0].'>', $tpl_temp, $tpl_maint); | 814: $tpl_maint = str_replace($cur_include[0], $tpl_temp, $tpl_maint); |
| 812: ob_end_clean(); | 815: ob_end_clean(); |
| 813: } | 816: } |
| 814: // END SUBST - <pun_include "*"> | 817: // END SUBST - <pun_include "*"> |
| 854: ob_start(); | 857: ob_start(); |
| 855: | 858: |
| 856: ?> | 859: ?> |
| 857: <meta http-equiv="refresh" content="<?php echo $pun_config['o_redirect_delay'] ?>;URL=<?php echo $destination_url ?>" /> | 860: <meta http-equiv="refresh" content="<?php echo $pun_config['o_redirect_delay'] ?>;URL=<?php echo str_replace(array('<', '>', '"'), array('<', '>', '"'), $destination_url) ?>" /> |
| 858: <title><?php echo pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_common['Redirecting'] ?></title> | 861: <title><?php echo pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_common['Redirecting'] ?></title> |
| 859: <link rel="stylesheet" type="text/css" href="style/<?php echo $pun_user['style'].'.css' ?>" /> | 862: <link rel="stylesheet" type="text/css" href="style/<?php echo $pun_user['style'].'.css' ?>" /> |
| 860: <?php | 863: <?php |
| 893: | 896: |
| 894: | 897: |
| 895: // START SUBST - <pun_include "*"> | 898: // START SUBST - <pun_include "*"> |
| 896: while (preg_match('<pun_include "(.*?)">', $tpl_redir, $cur_include)) | 899: while (preg_match('#<pun_include "([^/\\\\]*?)">#', $tpl_redir, $cur_include)) |
| 897: { | 900: { |
| | 901: if (!file_exists(PUN_ROOT.'include/user/'.$cur_include[1])) |
| | 902: error('Unable to process user include <pun_include "'.htmlspecialchars($cur_include[1]).'"> from template redirect.tpl. There is no such file in folder /include/user/'); |
| | 903: |
| 898: ob_start(); | 904: ob_start(); |
| 899: include PUN_ROOT.$cur_include[1]; | 905: include PUN_ROOT.'include/user/'.$cur_include[1]; |
| 900: $tpl_temp = ob_get_contents(); | 906: $tpl_temp = ob_get_contents(); |
| 901: $tpl_redir = str_replace('<'.$cur_include[0].'>', $tpl_temp, $tpl_redir); | 907: $tpl_redir = str_replace($cur_include[0], $tpl_temp, $tpl_redir); |
| 902: ob_end_clean(); | 908: ob_end_clean(); |
| 903: } | 909: } |
| 904: // END SUBST - <pun_include "*"> | 910: // END SUBST - <pun_include "*"> |
| punbb-1.2.4/upload/include/parser.php |
punbb-1.2.6/upload/include/parser.php |
| 45: $b = array('[b]', '[i]', '[u]', '[/b]', '[/i]', '[/u]'); | 45: $b = array('[b]', '[i]', '[u]', '[/b]', '[/i]', '[/u]'); |
| 46: $text = str_replace($a, $b, $text); | 46: $text = str_replace($a, $b, $text); |
| 47: | 47: |
| 48: // Do the more complex BBCodes (and strip excessive whitespace) | 48: // Do the more complex BBCodes (also strip excessive whitespace and useless quotes) |
| 49: $a = array( '#\[url=(.*?)\]\s*#i', | 49: $a = array( '#\[url=("|\'|)(.*?)\\1\]\s*#i', |
| 50: '#\[url\]\s*#i', | 50: '#\[url\]\s*#i', |
| 51: '#\s*\[/url\]#i', | 51: '#\s*\[/url\]#i', |
| 52: '#\[email=(.*?)\]\s*#i', | 52: '#\[email=("|\'|)(.*?)\\1\]\s*#i', |
| 53: '#\[email\]\s*#i', | 53: '#\[email\]\s*#i', |
| 54: '#\s*\[/email\]#i', | 54: '#\s*\[/email\]#i', |
| 55: '#\[img\]\s*(.*?)\s*\[/img\]#is', | 55: '#\[img\]\s*(.*?)\s*\[/img\]#is', |
| 56: '#\[colou?r=(.*?)\](.*?)\[/colou?r\]#is'); | 56: '#\[colou?r=("|\'|)(.*?)\\1\](.*?)\[/colou?r\]#is'); |
| 57: | 57: |
| 58: $b = array( '[url=$1]', | 58: $b = array( '[url=$2]', |
| 59: '[url]', | 59: '[url]', |
| 60: '[/url]', | 60: '[/url]', |
| 61: '[email=$1]', | 61: '[email=$2]', |
| 62: '[email]', | 62: '[email]', |
| 63: '[/email]', | 63: '[/email]', |
| 64: '[img]$1[/img]', | 64: '[img]$1[/img]', |
| 65: '[color=$1]$2[/color]'); | 65: '[color=$2]$3[/color]'); |
| 66: | 66: |
| 67: if (!$is_signature) | 67: if (!$is_signature) |
| 68: { | 68: { |
| 182: // We found a [code] | 182: // We found a [code] |
| 183: else if ($c_start < min($c_end, $q_start, $q_end)) | 183: else if ($c_start < min($c_end, $q_start, $q_end)) |
| 184: { | 184: { |
| | 185: // Make sure there's a [/code] and that any new [code] doesn't occur before the end tag |
| 185: $tmp = strpos($text, '[/code]'); | 186: $tmp = strpos($text, '[/code]'); |
| 186: if ($tmp === false) | 187: $tmp2 = strpos(substr($text, $c_start+6), '[code]'); |
| | 188: if ($tmp2 !== false) |
| | 189: $tmp2 += $c_start+6; |
| | 190: |
| | 191: if ($tmp === false || ($tmp2 !== false && $tmp2 < $tmp)) |
| 187: { | 192: { |
| 188: $error = $lang_common['BBCode error'].' '.$lang_common['BBCode error 2']; | 193: $error = $lang_common['BBCode error'].' '.$lang_common['BBCode error 2']; |
| 189: return; | 194: return; |
| 299: { | 304: { |
| 300: global $lang_common, $pun_user; | 305: global $lang_common, $pun_user; |
| 301: | 306: |
| | 307: if (strpos($text, 'quote') !== false) |
| | 308: { |
| | 309: $text = str_replace('[quote]', '</p><blockquote><div class="incqbox"><p>', $text); |
| | 310: $text = preg_replace('#\[quote=("|"|\'|)(.*)\\1\]#seU', '"</p><blockquote><div class=\"incqbox\"><h4>".str_replace(array(\'[\', \'\\"\'), array(\'[\', \'"\'), \'$2\')." ".$lang_common[\'wrote\'].":</h4><p>"', $text); |
| | 311: $text = preg_replace('#\[\/quote\]\s*#', '</p></div></blockquote><p>', $text); |
| | 312: } |
| | 313: |
| 302: $pattern = array('#\[b\](.*?)\[/b\]#s', | 314: $pattern = array('#\[b\](.*?)\[/b\]#s', |
| 303: '#\[i\](.*?)\[/i\]#s', | 315: '#\[i\](.*?)\[/i\]#s', |
| 304: '#\[u\](.*?)\[/u\]#s', | 316: '#\[u\](.*?)\[/u\]#s', |
| 319: | 331: |
| 320: // This thing takes a while! :) | 332: // This thing takes a while! :) |
| 321: $text = preg_replace($pattern, $replace, $text); | 333: $text = preg_replace($pattern, $replace, $text); |
| 322: | |
| 323: if (strpos($text, 'quote') !== false) | |
| 324: { | |
| 325: $text = str_replace('[quote]', '</p><blockquote><div class="incqbox"><p>', $text); | |
| 326: $text = preg_replace('#\[quote=("|"|\'|)(.*)\\1\]#seU', '"</p><blockquote><div class=\"incqbox\"><h4>".str_replace(\'[\', \'[\', \'$2\')." ".$lang_common[\'wrote\'].":</h4><p>"', $text); | |
| 327: $text = preg_replace('#\[\/quote\]\s*#', '</p></div></blockquote><p>', $text); | |
| 328: } | |
| 329: | 334: |
| 330: return $text; | 335: return $text; |
| 331: } | 336: } |
| punbb-1.2.4/upload/include/search_idx.php |
punbb-1.2.6/upload/include/search_idx.php |
| 43: | 43: |
| 44: if (empty($noise_match)) | 44: if (empty($noise_match)) |
| 45: { | 45: { |
| 46: $noise_match = array('quote', 'code', 'url', 'img', 'email', 'color', 'colour', '^', '$', '&', '(', ')', '<', '>', '`', '\'', '"', '|', ',', '@', '_', '?', '%', '~', '+', '[', ']', '{', '}', ':', '\\', '/', '=', '#', ';', '!', '*'); | 46: $noise_match = array('[quote', '[code', '[url', '[img', '[email', '[color', '[colour', 'quote]', 'code]', 'url]', 'img]', 'email]', 'color]', 'colour]', '^', '$', '&', '(', ')', '<', '>', '`', '\'', '"', '|', ',', '@', '_', '?', '%', '~', '+', '[', ']', '{', '}', ':', '\\', '/', '=', '#', ';', '!', '*'); |
| 47: $noise_replace = array('', '', '', '', '', '', '', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '', '', ' ', ' ', ' ', ' ', '', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '' , ' ', ' ', ' ', ' ', ' ', ' '); | 47: $noise_replace = array('', '', '', '', '', '', '', '', '', '', '', '', '', '', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '', '', ' ', ' ', ' ', ' ', '', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '' , ' ', ' ', ' ', ' ', ' ', ' '); |
| 48: | 48: |
| 49: $stopwords = (array)@file(PUN_ROOT.'lang/'.$pun_user['language'].'/stopwords.txt'); | 49: $stopwords = (array)@file(PUN_ROOT.'lang/'.$pun_user['language'].'/stopwords.txt'); |
| 50: $stopwords = array_map('trim', $stopwords); | 50: $stopwords = array_map('trim', $stopwords); |
| punbb-1.2.4/upload/install.php |
punbb-1.2.6/upload/install.php |
| 24: | 24: |
| 25: | 25: |
| 26: // The PunBB version this script installs | 26: // The PunBB version this script installs |
| 27: $punbb_version = '1.2.4'; | 27: $punbb_version = '1.2.6'; |
| 28: | 28: |
| 29: | 29: |
| 30: define('PUN_ROOT', './'); | 30: define('PUN_ROOT', './'); |
| 165: <fieldset> | 165: <fieldset> |
| 166: <legend>Enter then name of your database</legend> | 166: <legend>Enter then name of your database</legend> |
| 167: <div class="infldset"> | 167: <div class="infldset"> |
| 168: <p>The name of the database that PunBB will be installed into. The database must exist. For SQLite, this is the relative path to the database file. If it doesn't exists, PunBB will attempt to create it.</p> | 168: <p>The name of the database that PunBB will be installed into. The database must exist. For SQLite, this is the relative path to the database file. If the SQLite database file does not exist, PunBB will attempt to create it.</p> |
| 169: <label for="req_db_name"><strong>Database name</strong><br /><input id="req_db_name" type="text" name="req_db_name" size="30" maxlength="50" /><br /></label> | 169: <label for="req_db_name"><strong>Database name</strong><br /><input id="req_db_name" type="text" name="req_db_name" size="30" maxlength="50" /><br /></label> |
| 170: </div> | 170: </div> |
| 171: </fieldset> | 171: </fieldset> |
| 324: if (preg_match('#\[b\]|\[/b\]|\[u\]|\[/u\]|\[i\]|\[/i\]|\[color|\[/color\]|\[quote\]|\[/quote\]|\[code\]|\[/code\]|\[img\]|\[/img\]|\[url|\[/url\]|\[email|\[/email\]#i', $username)) | 324: if (preg_match('#\[b\]|\[/b\]|\[u\]|\[/u\]|\[i\]|\[/i\]|\[color|\[/color\]|\[quote\]|\[/quote\]|\[code\]|\[/code\]|\[img\]|\[/img\]|\[url|\[/url\]|\[email|\[/email\]#i', $username)) |
| 325: error('Usernames may not contain any of the text formatting tags (BBCode) that the forum uses. Please go back and correct.'); | 325: error('Usernames may not contain any of the text formatting tags (BBCode) that the forum uses. Please go back and correct.'); |
| 326: | 326: |
| 327: if (!preg_match('/^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,4})$/', $email)) | 327: if (strlen($email) > 50 || !preg_match('/^(([^<>()[\]\\.,;:\s@"\']+(\.[^<>()[\]\\.,;:\s@"\']+)*)|("[^"\']+"))@((\[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\])|(([a-zA-Z\d\-]+\.)+[a-zA-Z]{2,}))$/', $email)) |
| 328: error('The administrator e-mail address you entered is invalid. Please go back and correct.'); | 328: error('The administrator e-mail address you entered is invalid. Please go back and correct.'); |
| 329: | 329: |
| 330: | 330: |
| 346: case 'sqlite': | 346: case 'sqlite': |
| 347: require PUN_ROOT.'include/dblayer/sqlite.php'; | 347: require PUN_ROOT.'include/dblayer/sqlite.php'; |
| 348: break; | 348: break; |
| | 349: |
| | 350: default: |
| | 351: error('\''.$db_type.'\' is not a valid database type.'); |
| 349: } | 352: } |
| 350: | 353: |
| 351: // Create the database object (and connect/select db) | 354: // Create the database object (and connect/select db) |
| 1420: <div class="fakeform"> | 1423: <div class="fakeform"> |
| 1421: <div class="inform"> | 1424: <div class="inform"> |
| 1422: <div class="forminfo"> | 1425: <div class="forminfo"> |
| 1423: <p>To finalize the installation all you need to do is to <strong>copy and paste the text in the text box below into a file called config.php and then upload this file to the root directory of your PunBB installation</strong>. Make sure there are no linebreaks or spaces before <?php and after ?> in the file. You can later edit config.php if you reconfigure your setup (e.g. change the database password or ).</p> | 1426: <p>To finalize the installation all you need to do is to <strong>copy and paste the text in the text box below into a file called config.php and then upload this file to the root directory of your PunBB installation</strong>. Make sure there are no linebreaks or spaces before <?php. You can later edit config.php if you reconfigure your setup (e.g. change the database password or ).</p> |
| 1424: <?php if ($alerts != ''): ?> <?php echo $alerts."\n" ?> | 1427: <?php if ($alerts != ''): ?> <?php echo $alerts."\n" ?> |
| 1425: <?php endif; ?> </div> | 1428: <?php endif; ?> </div> |
| 1426: <fieldset> | 1429: <fieldset> |
| punbb-1.2.4/upload/login.php |
punbb-1.2.6/upload/login.php |
| 40: $form_username = trim($_POST['req_username']); | 40: $form_username = trim($_POST['req_username']); |
| 41: $form_password = trim($_POST['req_password']); | 41: $form_password = trim($_POST['req_password']); |
| 42: | 42: |
| 43: $result = $db->query('SELECT id, group_id, password, save_pass FROM '.$db->prefix.'users WHERE username=\''.$db->escape($form_username).'\'') or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); | 43: $username_sql = ($db_type == 'mysql' || $db_type == 'mysqli') ? 'username=\''.$db->escape($form_username).'\'' : 'LOWER(username)=LOWER(\''.$db->escape($form_username).'\')'; |
| | 44: |
| | 45: $result = $db->query('SELECT id, group_id, password, save_pass FROM '.$db->prefix.'users WHERE '.$username_sql) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); |
| 44: list($user_id, $group_id, $db_password_hash, $save_pass) = $db->fetch_row($result); | 46: list($user_id, $group_id, $db_password_hash, $save_pass) = $db->fetch_row($result); |
| 45: | 47: |
| 46: $authorized = false; | 48: $authorized = false; |
| 189: header('Location: index.php'); | 191: header('Location: index.php'); |
| 190: | 192: |
| 191: // Try to determine if the data in HTTP_REFERER is valid (if not, we redirect to index.php after login) | 193: // Try to determine if the data in HTTP_REFERER is valid (if not, we redirect to index.php after login) |
| 192: $redirect_url = (isset($_SERVER['HTTP_REFERER']) && preg_match('#^'.preg_quote($pun_config['o_base_url']).'/(.*?)\.php#i', $_SERVER['HTTP_REFERER'])) ? $_SERVER['HTTP_REFERER'] : 'index.php'; | 194: $redirect_url = (isset($_SERVER['HTTP_REFERER']) && preg_match('#^'.preg_quote($pun_config['o_base_url']).'/(.*?)\.php#i', $_SERVER['HTTP_REFERER'])) ? htmlspecialchars($_SERVER['HTTP_REFERER']) : 'index.php'; |
| 193: | 195: |
| 194: $page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_common['Login']; | 196: $page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_common['Login']; |
| 195: $required_fields = array('req_username' => $lang_common['Username'], 'req_password' => $lang_common['Password']); | 197: $required_fields = array('req_username' => $lang_common['Username'], 'req_password' => $lang_common['Password']); |
| punbb-1.2.4/upload/misc.php |
punbb-1.2.6/upload/misc.php |
| 76: message($lang_common['No permission']); | 76: message($lang_common['No permission']); |
| 77: | 77: |
| 78: $recipient_id = intval($_GET['email']); | 78: $recipient_id = intval($_GET['email']); |
| 79: if ($recipient_id < 1) | 79: if ($recipient_id < 2) |
| 80: message($lang_common['Bad request']); | 80: message($lang_common['Bad request']); |
| 81: | 81: |
| 82: $result = $db->query('SELECT username, email, email_setting FROM '.$db->prefix.'users WHERE id='.$recipient_id) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); | 82: $result = $db->query('SELECT username, email, email_setting FROM '.$db->prefix.'users WHERE id='.$recipient_id) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); |
| 118: | 118: |
| 119: require_once PUN_ROOT.'include/email.php'; | 119: require_once PUN_ROOT.'include/email.php'; |
| 120: | 120: |
| 121: pun_mail($recipient_email, $mail_subject, $mail_message, $pun_user['username'].' <'.$pun_user['email'].'>'); | 121: pun_mail($recipient_email, $mail_subject, $mail_message, '"'.str_replace('"', '', $pun_user['username']).'" <'.$pun_user['email'].'>'); |
| 122: | 122: |
| 123: redirect($_POST['redirect_url'], $lang_misc['E-mail sent redirect']); | 123: redirect($_POST['redirect_url'], $lang_misc['E-mail sent redirect']); |
| 124: } | 124: } |
| punbb-1.2.4/upload/moderate.php |
punbb-1.2.6/upload/moderate.php |
| 351: <br /><select name="move_to_forum"> | 351: <br /><select name="move_to_forum"> |
| 352: <?php | 352: <?php |
| 353: | 353: |
| 354: $result = $db->query('SELECT c.id AS cid, c.cat_name, f.id AS fid, f.forum_name FROM '.$db->prefix.'categories AS c INNER JOIN '.$db->prefix.'forums AS f ON c.id=f.cat_id LEFT JOIN '.$db->prefix.'forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['group_id'].') WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND f.redirect_url IS NULL ORDER BY c.disp_position, c.id, f.disp_position', true) or error('Unable to fetch category/forum list', __FILE__, __LINE__, $db->error()); | 354: $result = $db->query('SELECT c.id AS cid, c.cat_name, f.id AS fid, f.forum_name FROM '.$db->prefix.'categories AS c INNER JOIN '.$db->prefix.'forums AS f ON c.id=f.cat_id LEFT JOIN '.$db->prefix.'forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['g_id'].') WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND f.redirect_url IS NULL ORDER BY c.disp_position, c.id, f.disp_position', true) or error('Unable to fetch category/forum list', __FILE__, __LINE__, $db->error()); |
| 355: | 355: |
| 356: $cur_category = 0; | 356: $cur_category = 0; |
| 357: while ($cur_forum = $db->fetch_assoc($result)) | 357: while ($cur_forum = $db->fetch_assoc($result)) |
| 472: if (empty($topics)) | 472: if (empty($topics)) |
| 473: message($lang_misc['No topics selected']); | 473: message($lang_misc['No topics selected']); |
| 474: | 474: |
| 475: $db->query('UPDATE '.$db->prefix.'topics SET closed='.$action.' WHERE id IN('.implode(',', array_keys($topics)).')') or error('Unable to close topics', __FILE__, __LINE__, $db->error()); | 475: $db->query('UPDATE '.$db->prefix.'topics SET closed='.$action.' WHERE id IN('.implode(',', $topics).')') or error('Unable to close topics', __FILE__, __LINE__, $db->error()); |
| 476: | 476: |
| 477: $redirect_msg = ($action) ? $lang_misc['Close topics redirect'] : $lang_misc['Open topics redirect']; | 477: $redirect_msg = ($action) ? $lang_misc['Close topics redirect'] : $lang_misc['Open topics redirect']; |
| 478: redirect('moderate.php?fid='.$fid, $redirect_msg); | 478: redirect('moderate.php?fid='.$fid, $redirect_msg); |
| punbb-1.2.4/upload/profile.php |
punbb-1.2.6/upload/profile.php |
| 194: message($lang_profile['E-mail key bad'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.'); | 194: message($lang_profile['E-mail key bad'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.'); |
| 195: else | 195: else |
| 196: { | 196: { |
| 197: $db->query('UPDATE '.$db->prefix.'users SET email=\''.$new_email.'\', activate_string=NULL, activate_key=NULL WHERE id='.$id) or error('Unable to update e-mail address', __FILE__, __LINE__, $db->error()); | 197: $db->query('UPDATE '.$db->prefix.'users SET email=activate_string, activate_string=NULL, activate_key=NULL WHERE id='.$id) or error('Unable to update e-mail address', __FILE__, __LINE__, $db->error()); |
| 198: | 198: |
| 199: message($lang_profile['E-mail updated'], true); | 199: message($lang_profile['E-mail updated'], true); |
| 200: } | 200: } |
| 303: | 303: |
| 304: if (isset($_POST['form_sent'])) | 304: if (isset($_POST['form_sent'])) |
| 305: { | 305: { |
| | 306: if (!isset($_FILES['req_file'])) |
| | 307: message($lang_profile['No file']); |
| | 308: |
| 306: $uploaded_file = $_FILES['req_file']; | 309: $uploaded_file = $_FILES['req_file']; |
| 307: | 310: |
| 308: // Make sure the upload went smooth | 311: // Make sure the upload went smooth |
| 360: | 363: |
| 361: // Now check the width/height | 364: // Now check the width/height |
| 362: list($width, $height, ,) = getimagesize($pun_config['o_avatars_dir'].'/'.$id.'.tmp'); | 365: list($width, $height, ,) = getimagesize($pun_config['o_avatars_dir'].'/'.$id.'.tmp'); |
| 363: if ($width > $pun_config['o_avatars_width'] || $height > $pun_config['o_avatars_height']) | 366: if (empty($width) || empty($height) || $width > $pun_config['o_avatars_width'] || $height > $pun_config['o_avatars_height']) |
| 364: { | 367: { |
| 365: @unlink($pun_config['o_avatars_dir'].'/'.$id.'.tmp'); | 368: @unlink($pun_config['o_avatars_dir'].'/'.$id.'.tmp'); |
| 366: message($lang_profile['Too wide or high'].' '.$pun_config['o_avatars_width'].'x'.$pun_config['o_avatars_height'].' '.$lang_profile['pixels'].'.'); | 369: message($lang_profile['Too wide or high'].' '.$pun_config['o_avatars_width'].'x'.$pun_config['o_avatars_height'].' '.$lang_profile['pixels'].'.'); |
| 527: $result = $db->query('SELECT group_id, username FROM '.$db->prefix.'users WHERE id='.$id) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); | 530: $result = $db->query('SELECT group_id, username FROM '.$db->prefix.'users WHERE id='.$id) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); |
| 528: list($group_id, $username) = $db->fetch_row($result); | 531: list($group_id, $username) = $db->fetch_row($result); |
| 529: | 532: |
| | 533: if ($group_id == PUN_ADMIN) |
| | 534: message('Administrators cannot be deleted. In order to delete this user, you must first move him/her to a different user group.'); |
| | 535: |
| 530: if (isset($_POST['delete_user_comply'])) | 536: if (isset($_POST['delete_user_comply'])) |
| 531: { | 537: { |
| 532: // If the user is a moderator or an administrator, we remove him/her from the moderator list in all forums as well | 538: // If the user is a moderator or an administrator, we remove him/her from the moderator list in all forums as well |
| 795: { | 801: { |
| 796: $form = extract_elements(array('email_setting', 'save_pass', 'notify_with_post')); | 802: $form = extract_elements(array('email_setting', 'save_pass', 'notify_with_post')); |
| 797: | 803: |
| 798: $form['email_setting'] == intval($form['email_setting']); | 804: $form['email_setting'] = intval($form['email_setting']); |
| 799: if ($form['email_setting'] < 0 && $form['email_setting'] > 2) $form['email_setting'] = 1; | 805: if ($form['email_setting'] < 0 && $form['email_setting'] > 2) $form['email_setting'] = 1; |
| 800: | 806: |
| 801: if (!isset($form['save_pass']) || $form['save_pass'] != '1') $form['save_pass'] = '0'; | 807: if (!isset($form['save_pass']) || $form['save_pass'] != '1') $form['save_pass'] = '0'; |
| 817: | 823: |
| 818: | 824: |
| 819: // Singlequotes around non-empty values and NULL for empty values | 825: // Singlequotes around non-empty values and NULL for empty values |
| | 826: $temp = array(); |
| 820: while (list($key, $input) = @each($form)) | 827: while (list($key, $input) = @each($form)) |
| 821: { | 828: { |
| 822: $value = ($input !== '') ? '\''.$db->escape($input).'\'' : 'NULL'; | 829: $value = ($input !== '') ? '\''.$db->escape($input).'\'' : 'NULL'; |
| 824: $temp[] = $key.'='.$value; | 831: $temp[] = $key.'='.$value; |
| 825: } | 832: } |
| 826: | 833: |
| | 834: if (empty($temp)) |
| | 835: message($lang_common['Bad request']); |
| | 836: |
| 827: | 837: |
| 828: $db->query('UPDATE '.$db->prefix.'users SET '.implode(',', $temp).' WHERE id='.$id) or error('Unable to update profile', __FILE__, __LINE__, $db->error()); | 838: $db->query('UPDATE '.$db->prefix.'users SET '.implode(',', $temp).' WHERE id='.$id) or error('Unable to update profile', __FILE__, __LINE__, $db->error()); |
| 829: | 839: |
|