| PunBB 1.2.6 to 1.2.16 changes | Legend | |
|---|---|---|
| Lines removed | ||
| Lines changed | ||
| Lines added | ||
| punbb-1.2.6/upload/admin_bans.php | punbb-1.2.16/upload/admin_bans.php |
|---|---|
| 192: | 192: |
| 193: if ($ban_user == '' && $ban_ip == '' && $ban_email == '') | 193: if ($ban_user == '' && $ban_ip == '' && $ban_email == '') |
| 194: message('You must enter either a username, an IP address or an e-mail address (at least).'); | 194: message('You must enter either a username, an IP address or an e-mail address (at least).'); |
| 195: else if (strtolower($ban_user) == 'guest') | |
| 196: message('The guest user cannot be banned.'); | |
| 195: | 197: |
| 196: // Validate IP/IP range (it's overkill, I know) | 198: // Validate IP/IP range (it's overkill, I know) |
| 197: if ($ban_ip != '') | 199: if ($ban_ip != '') |
| punbb-1.2.6/upload/admin_categories.php | punbb-1.2.16/upload/admin_categories.php |
|---|---|
| 118: <fieldset> | 118: <fieldset> |
| 119: <legend>Confirm delete category</legend> | 119: <legend>Confirm delete category</legend> |
| 120: <div class="infldset"> | 120: <div class="infldset"> |
| 121: <p>Are you sure that you want to delete the category "<?php echo $cat_name ?>"?</p> | 121: <p>Are you sure that you want to delete the category "<?php echo pun_htmlspecialchars($cat_name) ?>"?</p> |
| 122: <p>WARNING! Deleting a category will delete all forums and posts (if any) in that category!</p> | 122: <p>WARNING! Deleting a category will delete all forums and posts (if any) in that category!</p> |
| 123: </div> | 123: </div> |
| 124: </fieldset> | 124: </fieldset> |
| 151: if ($cat_name[$i] == '') | 151: if ($cat_name[$i] == '') |
| 152: message('You must enter a category name.'); | 152: message('You must enter a category name.'); |
| 153: | 153: |
| 154: if (!preg_match('#^\d+$#', $cat_order[$i])) | 154: if (!@preg_match('#^\d+$#', $cat_order[$i])) |
| 155: message('Position must be an integer value.'); | 155: message('Position must be an integer value.'); |
| 156: | 156: |
| 157: list($cat_id, $position) = $db->fetch_row($result); | 157: list($cat_id, $position) = $db->fetch_row($result); |
| punbb-1.2.6/upload/admin_forums.php | punbb-1.2.16/upload/admin_forums.php |
|---|---|
| 137: | 137: |
| 138: while (list($forum_id, $disp_position) = @each($_POST['position'])) | 138: while (list($forum_id, $disp_position) = @each($_POST['position'])) |
| 139: { | 139: { |
| 140: if (!preg_match('#^\d+$#', $disp_position)) | 140: if (!@preg_match('#^\d+$#', $disp_position)) |
| 141: message('Position must be a positive integer value.'); | 141: message('Position must be a positive integer value.'); |
| 142: | 142: |
| 143: $db->query('UPDATE '.$db->prefix.'forums SET disp_position='.$disp_position.' WHERE id='.$forum_id) or error('Unable to update forum', __FILE__, __LINE__, $db->error()); | 143: $db->query('UPDATE '.$db->prefix.'forums SET disp_position='.$disp_position.' WHERE id='.intval($forum_id)) or error('Unable to update forum', __FILE__, __LINE__, $db->error()); |
| 144: } | 144: } |
| 145: | 145: |
| 146: // Regenerate the quickjump cache | 146: // Regenerate the quickjump cache |
| 186: $result = $db->query('SELECT g_id, g_read_board, g_post_replies, g_post_topics FROM '.$db->prefix.'groups WHERE g_id!='.PUN_ADMIN) or error('Unable to fetch user group list', __FILE__, __LINE__, $db->error()); | 186: $result = $db->query('SELECT g_id, g_read_board, g_post_replies, g_post_topics FROM '.$db->prefix.'groups WHERE g_id!='.PUN_ADMIN) or error('Unable to fetch user group list', __FILE__, __LINE__, $db->error()); |
| 187: while ($cur_group = $db->fetch_assoc($result)) | 187: while ($cur_group = $db->fetch_assoc($result)) |
| 188: { | 188: { |
| 189: $read_forum_new = ($cur_group['g_read_board'] == '1') ? isset($_POST['read_forum_new'][$cur_group['g_id']]) ? $_POST['read_forum_new'][$cur_group['g_id']] : '0' : $_POST['read_forum_old'][$cur_group['g_id']]; | 189: $read_forum_new = ($cur_group['g_read_board'] == '1') ? isset($_POST['read_forum_new'][$cur_group['g_id']]) ? '1' : '0' : intval($_POST['read_forum_old'][$cur_group['g_id']]); |
| 190: $post_replies_new = isset($_POST['post_replies_new'][$cur_group['g_id']]) ? $_POST['post_replies_new'][$cur_group['g_id']] : '0'; | 190: $post_replies_new = isset($_POST['post_replies_new'][$cur_group['g_id']]) ? '1' : '0'; |
| 191: $post_topics_new = isset($_POST['post_topics_new'][$cur_group['g_id']]) ? $_POST['post_topics_new'][$cur_group['g_id']] : '0'; | 191: $post_topics_new = isset($_POST['post_topics_new'][$cur_group['g_id']]) ? '1' : '0'; |
| 192: | 192: |
| 193: // Check if the new settings differ from the old | 193: // Check if the new settings differ from the old |
| 194: if ($read_forum_new != $_POST['read_forum_old'][$cur_group['g_id']] || $post_replies_new != $_POST['post_replies_old'][$cur_group['g_id']] || $post_topics_new != $_POST['post_topics_old'][$cur_group['g_id']]) | 194: if ($read_forum_new != $_POST['read_forum_old'][$cur_group['g_id']] || $post_replies_new != $_POST['post_replies_old'][$cur_group['g_id']] || $post_topics_new != $_POST['post_topics_old'][$cur_group['g_id']]) |
| punbb-1.2.6/upload/admin_groups.php | punbb-1.2.16/upload/admin_groups.php |
|---|---|
| 243: } | 243: } |
| 244: else | 244: else |
| 245: { | 245: { |
| 246: $result = $db->query('SELECT 1 FROM '.$db->prefix.'groups WHERE g_title=\''.$db->escape($title).'\' AND g_id!='.$_POST['group_id']) or error('Unable to check group title collision', __FILE__, __LINE__, $db->error()); | 246: $result = $db->query('SELECT 1 FROM '.$db->prefix.'groups WHERE g_title=\''.$db->escape($title).'\' AND g_id!='.intval($_POST['group_id'])) or error('Unable to check group title collision', __FILE__, __LINE__, $db->error()); |
| 247: if ($db->num_rows($result)) | 247: if ($db->num_rows($result)) |
| 248: message('There is already a group with the title \''.pun_htmlspecialchars($title).'\'.'); | 248: message('There is already a group with the title \''.pun_htmlspecialchars($title).'\'.'); |
| 249: | 249: |
| 250: $db->query('UPDATE '.$db->prefix.'groups SET g_title=\''.$db->escape($title).'\', g_user_title='.$user_title.', g_read_board='.$read_board.', g_post_replies='.$post_replies.', g_post_topics='.$post_topics.', g_edit_posts='.$edit_posts.', g_delete_posts='.$delete_posts.', g_delete_topics='.$delete_topics.', g_set_title='.$set_title.', g_search='.$search.', g_search_users='.$search_users.', g_edit_subjects_interval='.$edit_subjects_interval.', g_post_flood='.$post_flood.', g_search_flood='.$search_flood.' WHERE g_id='.$_POST['group_id']) or error('Unable to update group', __FILE__, __LINE__, $db->error()); | 250: $db->query('UPDATE '.$db->prefix.'groups SET g_title=\''.$db->escape($title).'\', g_user_title='.$user_title.', g_read_board='.$read_board.', g_post_replies='.$post_replies.', g_post_topics='.$post_topics.', g_edit_posts='.$edit_posts.', g_delete_posts='.$delete_posts.', g_delete_topics='.$delete_topics.', g_set_title='.$set_title.', g_search='.$search.', g_search_users='.$search_users.', g_edit_subjects_interval='.$edit_subjects_interval.', g_post_flood='.$post_flood.', g_search_flood='.$search_flood.' WHERE g_id='.intval($_POST['group_id'])) or error('Unable to update group', __FILE__, __LINE__, $db->error()); |
| 251: } | 251: } |
| 252: | 252: |
| 253: // Regenerate the quickjump cache | 253: // Regenerate the quickjump cache |
| 264: confirm_referrer('admin_groups.php'); | 264: confirm_referrer('admin_groups.php'); |
| 265: | 265: |
| 266: $group_id = intval($_POST['default_group']); | 266: $group_id = intval($_POST['default_group']); |
| 267: if ($group_id < 1) | 267: if ($group_id < 4) |
| 268: message($lang_common['Bad request']); | 268: message($lang_common['Bad request']); |
| 269: | 269: |
| 270: $db->query('UPDATE '.$db->prefix.'config SET conf_value='.$group_id.' WHERE conf_name=\'o_default_user_group\'') or error('Unable to update board config', __FILE__, __LINE__, $db->error()); | 270: $db->query('UPDATE '.$db->prefix.'config SET conf_value='.$group_id.' WHERE conf_name=\'o_default_user_group\'') or error('Unable to update board config', __FILE__, __LINE__, $db->error()); |
| punbb-1.2.6/upload/admin_index.php | punbb-1.2.16/upload/admin_index.php |
|---|---|
| 86: $load_averages = @explode(' ', $load_averages); | 86: $load_averages = @explode(' ', $load_averages); |
| 87: $server_load = isset($load_averages[2]) ? $load_averages[0].' '.$load_averages[1].' '.$load_averages[2] : 'Not available'; | 87: $server_load = isset($load_averages[2]) ? $load_averages[0].' '.$load_averages[1].' '.$load_averages[2] : 'Not available'; |
| 88: } | 88: } |
| 89: else if (preg_match('/averages?: ([0-9\.]+),[\s]+([0-9\.]+),[\s]+([0-9\.]+)/i', @exec('uptime'), $load_averages)) | 89: else if (!in_array(PHP_OS, array('WINNT', 'WIN32')) && preg_match('/averages?: ([0-9\.]+),[\s]+([0-9\.]+),[\s]+([0-9\.]+)/i', @exec('uptime'), $load_averages)) |
| 90: $server_load = $load_averages[1].' '.$load_averages[2].' '.$load_averages[3]; | 90: $server_load = $load_averages[1].' '.$load_averages[2].' '.$load_averages[3]; |
| 91: else | 91: else |
| 92: $server_load = 'Not available'; | 92: $server_load = 'Not available'; |
| punbb-1.2.6/upload/admin_loader.php | punbb-1.2.16/upload/admin_loader.php |
|---|---|
| 37: | 37: |
| 38: // The plugin to load should be supplied via GET | 38: // The plugin to load should be supplied via GET |
| 39: $plugin = isset($_GET['plugin']) ? $_GET['plugin'] : ''; | 39: $plugin = isset($_GET['plugin']) ? $_GET['plugin'] : ''; |
| 40: if (!preg_match('/^AM?P_(\w*?)\.php$/i', $plugin)) | 40: if (!@preg_match('/^AM?P_(\w*?)\.php$/i', $plugin)) |
| 41: message($lang_common['Bad request']); | 41: message($lang_common['Bad request']); |
| 42: | 42: |
| 43: // AP_ == Admins only, AMP_ == admins and moderators | 43: // AP_ == Admins only, AMP_ == admins and moderators |
| punbb-1.2.6/upload/admin_maintenance.php | punbb-1.2.16/upload/admin_maintenance.php |
|---|---|
| 52: // This is the only potentially "dangerous" thing we can do here, so we check the referer | 52: // This is the only potentially "dangerous" thing we can do here, so we check the referer |
| 53: confirm_referrer('admin_maintenance.php'); | 53: confirm_referrer('admin_maintenance.php'); |
| 54: | 54: |
| 55: $truncate_sql = ($db_type != 'sqlite') ? 'TRUNCATE TABLE ' : 'DELETE FROM '; | 55: $truncate_sql = ($db_type != 'sqlite' && $db_type != 'pgsql') ? 'TRUNCATE TABLE ' : 'DELETE FROM '; |
| 56: $db->query($truncate_sql.$db->prefix.'search_matches') or error('Unable to empty search index match table', __FILE__, __LINE__, $db->error()); | 56: $db->query($truncate_sql.$db->prefix.'search_matches') or error('Unable to empty search index match table', __FILE__, __LINE__, $db->error()); |
| 57: $db->query($truncate_sql.$db->prefix.'search_words') or error('Unable to empty search index words table', __FILE__, __LINE__, $db->error()); | 57: $db->query($truncate_sql.$db->prefix.'search_words') or error('Unable to empty search index words table', __FILE__, __LINE__, $db->error()); |
| 58: | 58: |
| 65: break; | 65: break; |
| 66: | 66: |
| 67: case 'pgsql'; | 67: case 'pgsql'; |
| 68: $result = $db->query('SELECT setval(\'search_words_id_seq\', 1, false)') or error('Unable to update sequence', __FILE__, __LINE__, $db->error()); | 68: $result = $db->query('SELECT setval(\''.$db->prefix.'search_words_id_seq\', 1, false)') or error('Unable to update sequence', __FILE__, __LINE__, $db->error()); |
| 69: } | 69: } |
| 70: } | 70: } |
| 71: | 71: |
| punbb-1.2.6/upload/admin_options.php | punbb-1.2.16/upload/admin_options.php |
|---|---|
| 37: | 37: |
| 38: if (isset($_POST['form_sent'])) | 38: if (isset($_POST['form_sent'])) |
| 39: { | 39: { |
| 40: // Lazy referer check (in case base_url isn't correct) | 40: // Custom referrer check (so we can output a custom error message) |
| 41: if (!isset($_SERVER['HTTP_REFERER']) || !preg_match('#/admin_options\.php#i', $_SERVER['HTTP_REFERER'])) | 41: if (!preg_match('#^'.preg_quote(str_replace('www.', '', $pun_config['o_base_url']).'/admin_options.php', '#').'#i', str_replace('www.', '', (isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '')))) |
| 42: message($lang_common['Bad referrer']); | 42: message('Bad HTTP_REFERER. If you have moved these forums from one location to another or switched domains, you need to update the Base URL manually in the database (look for o_base_url in the config table) and then clear the cache by deleting all .php files in the /cache directory.'); |
| 43: | 43: |
| 44: $form = array_map('trim', $_POST['form']); | 44: $form = array_map('trim', $_POST['form']); |
| 45: | 45: |
| 46: if ($form['board_title'] == '') | 46: if ($form['board_title'] == '') |
| 47: message('You must enter a board title.'); | 47: message('You must enter a board title.'); |
| 48: | 48: |
| 49: // Clean default_lang | |
| 50: $form['default_lang'] = preg_replace('#[\.\\\/]#', '', $form['default_lang']); | |
| 51: | |
| 49: require PUN_ROOT.'include/email.php'; | 52: require PUN_ROOT.'include/email.php'; |
| 50: | 53: |
| 51: $form['admin_email'] = strtolower($form['admin_email']); | 54: $form['admin_email'] = strtolower($form['admin_email']); |
| 63: if (substr($form['base_url'], -1) == '/') | 66: if (substr($form['base_url'], -1) == '/') |
| 64: $form['base_url'] = substr($form['base_url'], 0, -1); | 67: $form['base_url'] = substr($form['base_url'], 0, -1); |
| 65: | 68: |
| 69: // Clean avatars_dir | |
| 70: $form['avatars_dir'] = str_replace("\0", '', $form['avatars_dir']); | |
| 71: | |
| 66: // Make sure avatars_dir doesn't end with a slash | 72: // Make sure avatars_dir doesn't end with a slash |
| 67: if (substr($form['avatars_dir'], -1) == '/') | 73: if (substr($form['avatars_dir'], -1) == '/') |
| 68: $form['avatars_dir'] = substr($form['avatars_dir'], 0, -1); | 74: $form['avatars_dir'] = substr($form['avatars_dir'], 0, -1); |
| 117: while (list($key, $input) = @each($form)) | 123: while (list($key, $input) = @each($form)) |
| 118: { | 124: { |
| 119: // Only update values that have changed | 125: // Only update values that have changed |
| 120: if (isset($pun_config['o_'.$key]) && $pun_config['o_'.$key] != $input) | 126: if (array_key_exists('o_'.$key, $pun_config) && $pun_config['o_'.$key] != $input) |
| 121: { | 127: { |
| 122: if ($input != '' || is_int($input)) | 128: if ($input != '' || is_int($input)) |
| 123: $value = '\''.$db->escape($input).'\''; | 129: $value = '\''.$db->escape($input).'\''; |
| punbb-1.2.6/upload/admin_permissions.php | punbb-1.2.16/upload/admin_permissions.php |
|---|---|
| 39: { | 39: { |
| 40: confirm_referrer('admin_permissions.php'); | 40: confirm_referrer('admin_permissions.php'); |
| 41: | 41: |
| 42: $form = array_map('trim', $_POST['form']); | 42: $form = array_map('intval', $_POST['form']); |
| 43: | |
| 44: $form['sig_length'] = intval($form['sig_length']); | |
| 45: $form['sig_lines'] = intval($form['sig_lines']); | |
| 46: | 43: |
| 47: while (list($key, $input) = @each($form)) | 44: while (list($key, $input) = @each($form)) |
| 48: { | 45: { |
| 49: // Only update values that have changed | 46: // Only update values that have changed |
| 50: if (isset($pun_config['p_'.$key]) && $pun_config['p_'.$key] != $input) | 47: if (array_key_exists('p_'.$key, $pun_config) && $pun_config['p_'.$key] != $input) |
| 51: { | 48: $db->query('UPDATE '.$db->prefix.'config SET conf_value='.$input.' WHERE conf_name=\'p_'.$db->escape($key).'\'') or error('Unable to update board config', __FILE__, __LINE__, $db->error()); |
| 52: if ($input != '' || is_int($input)) | |
| 53: $value = '\''.$db->escape($input).'\''; | |
| 54: else | |
| 55: $value = 'NULL'; | |
| 56: | |
| 57: $db->query('UPDATE '.$db->prefix.'config SET conf_value='.$value.' WHERE conf_name=\'p_'.$key.'\'') or error('Unable to update board config', __FILE__, __LINE__, $db->error()); | |
| 58: } | |
| 59: } | 49: } |
| 60: | 50: |
| 61: // Regenerate the config cache | 51: // Regenerate the config cache |
| punbb-1.2.6/upload/admin_prune.php | punbb-1.2.16/upload/admin_prune.php |
|---|---|
| 84: | 84: |
| 85: | 85: |
| 86: $prune_days = $_POST['req_prune_days']; | 86: $prune_days = $_POST['req_prune_days']; |
| 87: if (!preg_match('#^\d+$#', $prune_days)) | 87: if (!@preg_match('#^\d+$#', $prune_days)) |
| 88: message('Days to prune must be a positive integer.'); | 88: message('Days to prune must be a positive integer.'); |
| 89: | 89: |
| 90: $prune_date = time() - ($prune_days*86400); | 90: $prune_date = time() - ($prune_days*86400); |
| punbb-1.2.6/upload/admin_ranks.php | punbb-1.2.16/upload/admin_ranks.php |
|---|---|
| 46: if ($rank == '') | 46: if ($rank == '') |
| 47: message('You must enter a rank title.'); | 47: message('You must enter a rank title.'); |
| 48: | 48: |
| 49: if (!preg_match('#^\d+$#', $min_posts)) | 49: if (!@preg_match('#^\d+$#', $min_posts)) |
| 50: message('Minimum posts must be a positive integer value.'); | 50: message('Minimum posts must be a positive integer value.'); |
| 51: | 51: |
| 52: // Make sure there isn't already a rank with the same min_posts value | 52: // Make sure there isn't already a rank with the same min_posts value |
| 77: if ($rank == '') | 77: if ($rank == '') |
| 78: message('You must enter a rank title.'); | 78: message('You must enter a rank title.'); |
| 79: | 79: |
| 80: if (!preg_match('#^\d+$#', $min_posts)) | 80: if (!@preg_match('#^\d+$#', $min_posts)) |
| 81: message('Minimum posts must be a positive integer value.'); | 81: message('Minimum posts must be a positive integer value.'); |
| 82: | 82: |
| 83: // Make sure there isn't already a rank with the same min_posts value | 83: // Make sure there isn't already a rank with the same min_posts value |
| 84: $result = $db->query('SELECT 1 FROM '.$db->prefix.'ranks WHERE id!='.$id.' && min_posts='.$min_posts) or error('Unable to fetch rank info', __FILE__, __LINE__, $db->error()); | 84: $result = $db->query('SELECT 1 FROM '.$db->prefix.'ranks WHERE id!='.$id.' AND min_posts='.$min_posts) or error('Unable to fetch rank info', __FILE__, __LINE__, $db->error()); |
| 85: if ($db->num_rows($result)) | 85: if ($db->num_rows($result)) |
| 86: message('There is already a rank with a minimun posts value of '.$min_posts.'.'); | 86: message('There is already a rank with a minimun posts value of '.$min_posts.'.'); |
| 87: | 87: |
| punbb-1.2.6/upload/admin_users.php | punbb-1.2.16/upload/admin_users.php |
|---|---|
| 111: { | 111: { |
| 112: $ip = $_GET['show_users']; | 112: $ip = $_GET['show_users']; |
| 113: | 113: |
| 114: if (!preg_match('/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/', $ip)) | 114: if (!@preg_match('/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/', $ip)) |
| 115: message('The supplied IP address is not correctly formatted.'); | 115: message('The supplied IP address is not correctly formatted.'); |
| 116: | 116: |
| 117: | 117: |
| 217: | 217: |
| 218: // trim() all elements in $form | 218: // trim() all elements in $form |
| 219: $form = array_map('trim', $form); | 219: $form = array_map('trim', $form); |
| 220: $conditions = array(); | |
| 220: | 221: |
| 221: $posts_greater = trim($_POST['posts_greater']); | 222: $posts_greater = trim($_POST['posts_greater']); |
| 222: $posts_less = trim($_POST['posts_less']); | 223: $posts_less = trim($_POST['posts_less']); |
| 256: $like_command = ($db_type == 'pgsql') ? 'ILIKE' : 'LIKE'; | 257: $like_command = ($db_type == 'pgsql') ? 'ILIKE' : 'LIKE'; |
| 257: while (list($key, $input) = @each($form)) | 258: while (list($key, $input) = @each($form)) |
| 258: { | 259: { |
| 259: if ($input != '') | 260: if ($input != '' && in_array($key, array('username', 'email', 'title', 'realname', 'url', 'jabber', 'icq', 'msn', 'aim', 'yahoo', 'location', 'signature', 'admin_note'))) |
| 260: $conditions[] = 'u.'.$db->escape($key).' '.$like_command.' \''.$db->escape(str_replace('*', '%', $input)).'\''; | 261: $conditions[] = 'u.'.$db->escape($key).' '.$like_command.' \''.$db->escape(str_replace('*', '%', $input)).'\''; |
| 261: } | 262: } |
| 262: | 263: |
| 266: $conditions[] = 'u.num_posts<'.$posts_less; | 267: $conditions[] = 'u.num_posts<'.$posts_less; |
| 267: | 268: |
| 268: if ($user_group != 'all') | 269: if ($user_group != 'all') |
| 269: $conditions[] = 'u.group_id='.$db->escape($user_group); | 270: $conditions[] = 'u.group_id='.intval($user_group); |
| 270: | 271: |
| 271: if (!isset($conditions)) | 272: if (empty($conditions)) |
| 272: message('You didn\'t enter any search terms.'); | 273: message('You didn\'t enter any search terms.'); |
| 273: | 274: |
| 274: | 275: |
| punbb-1.2.6/upload/edit.php | punbb-1.2.16/upload/edit.php |
|---|---|
| 175: else if (isset($_POST['preview'])) | 175: else if (isset($_POST['preview'])) |
| 176: { | 176: { |
| 177: require_once PUN_ROOT.'include/parser.php'; | 177: require_once PUN_ROOT.'include/parser.php'; |
| 178: $message = parse_message(trim($_POST['req_message']), $hide_smilies); | 178: $preview_message = parse_message($message, $hide_smilies); |
| 179: | 179: |
| 180: ?> | 180: ?> |
| 181: <div id="postpreview" class="blockpost"> | 181: <div id="postpreview" class="blockpost"> |
| 184: <div class="inbox"> | 184: <div class="inbox"> |
| 185: <div class="postright"> | 185: <div class="postright"> |
| 186: <div class="postmsg"> | 186: <div class="postmsg"> |
| 187: <?php echo $message."\n" ?> | 187: <?php echo $preview_message."\n" ?> |
| 188: </div> | 188: </div> |
| 189: </div> | 189: </div> |
| 190: </div> | 190: </div> |
| 208: <?php if ($can_edit_subject): ?> <label><?php echo $lang_common['Subject'] ?><br /> | 208: <?php if ($can_edit_subject): ?> <label><?php echo $lang_common['Subject'] ?><br /> |
| 209: <input class="longinput" type="text" name="req_subject" size="80" maxlength="70" tabindex="<?php echo $cur_index++ ?>" value="<?php echo pun_htmlspecialchars(isset($_POST['req_subject']) ? $_POST['req_subject'] : $cur_post['subject']) ?>" /><br /></label> | 209: <input class="longinput" type="text" name="req_subject" size="80" maxlength="70" tabindex="<?php echo $cur_index++ ?>" value="<?php echo pun_htmlspecialchars(isset($_POST['req_subject']) ? $_POST['req_subject'] : $cur_post['subject']) ?>" /><br /></label> |
| 210: <?php endif; ?> <label><?php echo $lang_common['Message'] ?><br /> | 210: <?php endif; ?> <label><?php echo $lang_common['Message'] ?><br /> |
| 211: <textarea name="req_message" rows="20" cols="95" tabindex="<?php echo $cur_index++ ?>"><?php echo pun_htmlspecialchars(isset($_POST['req_message']) ? $_POST['req_message'] : $cur_post['message']) ?></textarea><br /></label> | 211: <textarea name="req_message" rows="20" cols="95" tabindex="<?php echo $cur_index++ ?>"><?php echo pun_htmlspecialchars(isset($_POST['req_message']) ? $message : $cur_post['message']) ?></textarea><br /></label> |
| 212: <ul class="bblinks"> | 212: <ul class="bblinks"> |
| 213: <li><a href="help.php#bbcode" onclick="window.open(this.href); return false;"><?php echo $lang_common['BBCode'] ?></a>: <?php echo ($pun_config['p_message_bbcode'] == '1') ? $lang_common['on'] : $lang_common['off']; ?></li> | 213: <li><a href="help.php#bbcode" onclick="window.open(this.href); return false;"><?php echo $lang_common['BBCode'] ?></a>: <?php echo ($pun_config['p_message_bbcode'] == '1') ? $lang_common['on'] : $lang_common['off']; ?></li> |
| 214: <li><a href="help.php#img" onclick="window.open(this.href); return false;"><?php echo $lang_common['img tag'] ?></a>: <?php echo ($pun_config['p_message_img_tag'] == '1') ? $lang_common['on'] : $lang_common['off']; ?></li> | 214: <li><a href="help.php#img" onclick="window.open(this.href); return false;"><?php echo $lang_common['img tag'] ?></a>: <?php echo ($pun_config['p_message_img_tag'] == '1') ? $lang_common['on'] : $lang_common['off']; ?></li> |
| punbb-1.2.6/upload/extern.php | punbb-1.2.16/upload/extern.php |
|---|---|
| 116: exit('The file \'config.php\' doesn\'t exist or is corrupt. Please run install.php to install PunBB first.'); | 116: exit('The file \'config.php\' doesn\'t exist or is corrupt. Please run install.php to install PunBB first.'); |
| 117: | 117: |
| 118: | 118: |
| 119: // Disable error reporting for uninitialized variables | 119: // Make sure PHP reports all errors except E_NOTICE |
| 120: error_reporting(E_ALL); | 120: error_reporting(E_ALL ^ E_NOTICE); |
| 121: | 121: |
| 122: // Turn off magic_quotes_runtime | 122: // Turn off magic_quotes_runtime |
| 123: set_magic_quotes_runtime(0); | 123: set_magic_quotes_runtime(0); |
| 149: if (!isset($lang_common)) | 149: if (!isset($lang_common)) |
| 150: exit('There is no valid language pack \''.$pun_config['o_default_lang'].'\' installed. Please reinstall a language of that name.'); | 150: exit('There is no valid language pack \''.$pun_config['o_default_lang'].'\' installed. Please reinstall a language of that name.'); |
| 151: | 151: |
| 152: // Check if we are to display a maintenance message | |
| 153: if ($pun_config['o_maintenance'] && !defined('PUN_TURN_OFF_MAINT')) | |
| 154: maintenance_message(); | |
| 155: | |
| 152: if (!isset($_GET['action'])) | 156: if (!isset($_GET['action'])) |
| 153: exit('No parameters supplied. See extern.php for instructions.'); | 157: exit('No parameters supplied. See extern.php for instructions.'); |
| 154: | 158: |
| punbb-1.2.6/upload/footer.php | punbb-1.2.16/upload/footer.php |
|---|---|
| 139: // END SUBST - <pun_footer> | 139: // END SUBST - <pun_footer> |
| 140: | 140: |
| 141: | 141: |
| 142: // START SUBST - <pun_include "*"> | |
| 143: while (preg_match('#<pun_include "([^/\\\\]*?)">#', $tpl_main, $cur_include)) | |
| 144: { | |
| 145: if (!file_exists(PUN_ROOT.'include/user/'.$cur_include[1])) | |
| 146: error('Unable to process user include <pun_include "'.htmlspecialchars($cur_include[1]).'"> from template main.tpl. There is no such file in folder /include/user/'); | |
| 147: | |
| 148: ob_start(); | |
| 149: include PUN_ROOT.'include/user/'.$cur_include[1]; | |
| 150: $tpl_temp = ob_get_contents(); | |
| 151: $tpl_main = str_replace($cur_include[0], $tpl_temp, $tpl_main); | |
| 152: ob_end_clean(); | |
| 153: } | |
| 154: // END SUBST - <pun_include "*"> | |
| 155: | |
| 156: | |
| 157: // Close the db connection (and free up any result data) | 142: // Close the db connection (and free up any result data) |
| 158: $db->close(); | 143: $db->close(); |
| 159: | 144: |
| punbb-1.2.6/upload/header.php | punbb-1.2.16/upload/header.php |
|---|---|
| 43: $tpl_main = file_get_contents(PUN_ROOT.'include/template/main.tpl'); | 43: $tpl_main = file_get_contents(PUN_ROOT.'include/template/main.tpl'); |
| 44: | 44: |
| 45: | 45: |
| 46: // START SUBST - <pun_include "*"> | |
| 47: while (preg_match('#<pun_include "([^/\\\\]*?)\.(php[45]?|inc|html?|txt)">#', $tpl_main, $cur_include)) | |
| 48: { | |
| 49: if (!file_exists(PUN_ROOT.'include/user/'.$cur_include[1].'.'.$cur_include[2])) | |
| 50: error('Unable to process user include '.htmlspecialchars($cur_include[0]).' from template main.tpl. There is no such file in folder /include/user/'); | |
| 51: | |
| 52: ob_start(); | |
| 53: include PUN_ROOT.'include/user/'.$cur_include[1].'.'.$cur_include[2]; | |
| 54: $tpl_temp = ob_get_contents(); | |
| 55: $tpl_main = str_replace($cur_include[0], $tpl_temp, $tpl_main); | |
| 56: ob_end_clean(); | |
| 57: } | |
| 58: // END SUBST - <pun_include "*"> | |
| 59: | |
| 60: | |
| 46: // START SUBST - <pun_content_direction> | 61: // START SUBST - <pun_content_direction> |
| 47: $tpl_main = str_replace('<pun_content_direction>', $lang_common['lang_direction'], $tpl_main); | 62: $tpl_main = str_replace('<pun_content_direction>', $lang_common['lang_direction'], $tpl_main); |
| 48: // END SUBST - <pun_content_direction> | 63: // END SUBST - <pun_content_direction> |
| 131: | 146: |
| 132: | 147: |
| 133: // START SUBST - <pun_page> | 148: // START SUBST - <pun_page> |
| 134: $tpl_main = str_replace('<pun_page>', basename($_SERVER['PHP_SELF'], '.php'), $tpl_main); | 149: $tpl_main = str_replace('<pun_page>', htmlspecialchars(basename($_SERVER['PHP_SELF'], '.php')), $tpl_main); |
| 135: // END SUBST - <pun_title> | 150: // END SUBST - <pun_title> |
| 136: | 151: |
| 137: | 152: |
| punbb-1.2.6/upload/include/common.php | punbb-1.2.16/upload/include/common.php |
|---|---|
| 32: if (!defined('PUN_ROOT')) | 32: if (!defined('PUN_ROOT')) |
| 33: exit('The constant PUN_ROOT must be defined and point to a valid PunBB installation root directory.'); | 33: exit('The constant PUN_ROOT must be defined and point to a valid PunBB installation root directory.'); |
| 34: | 34: |
| 35: | |
| 36: // Load the functions script | |
| 37: require PUN_ROOT.'include/functions.php'; | |
| 38: | |
| 39: // Reverse the effect of register_globals | |
| 40: unregister_globals(); | |
| 41: | |
| 42: | |
| 35: @include PUN_ROOT.'config.php'; | 43: @include PUN_ROOT.'config.php'; |
| 36: | 44: |
| 37: // If PUN isn't defined, config.php is missing or corrupt | 45: // If PUN isn't defined, config.php is missing or corrupt |
| 77: define('PUN_MEMBER', 4); | 85: define('PUN_MEMBER', 4); |
| 78: | 86: |
| 79: | 87: |
| 80: // Load the functions script | |
| 81: require PUN_ROOT.'include/functions.php'; | |
| 82: | |
| 83: // Load DB abstraction layer and connect | 88: // Load DB abstraction layer and connect |
| 84: require PUN_ROOT.'include/dblayer/common_db.php'; | 89: require PUN_ROOT.'include/dblayer/common_db.php'; |
| 85: | 90: |
| punbb-1.2.6/upload/include/dblayer/mysql.php | punbb-1.2.16/upload/include/dblayer/mysql.php |
|---|---|
| 156: | 156: |
| 157: function escape($str) | 157: function escape($str) |
| 158: { | 158: { |
| 159: if (function_exists('mysql_real_escape_string')) | 159: if (is_array($str)) |
| 160: return ''; | |
| 161: else if (function_exists('mysql_real_escape_string')) | |
| 160: return mysql_real_escape_string($str, $this->link_id); | 162: return mysql_real_escape_string($str, $this->link_id); |
| 161: else | 163: else |
| 162: return mysql_escape_string($str); | 164: return mysql_escape_string($str); |
| punbb-1.2.6/upload/include/dblayer/mysqli.php | punbb-1.2.16/upload/include/dblayer/mysqli.php |
|---|---|
| 159: | 159: |
| 160: function escape($str) | 160: function escape($str) |
| 161: { | 161: { |
| 162: return mysqli_real_escape_string($this->link_id, $str); | 162: return is_array($str) ? '' : mysqli_real_escape_string($this->link_id, $str); |
| 163: } | 163: } |
| 164: | 164: |
| 165: | 165: |
| punbb-1.2.6/upload/include/dblayer/pgsql.php | punbb-1.2.16/upload/include/dblayer/pgsql.php |
|---|---|
| 217: | 217: |
| 218: function escape($str) | 218: function escape($str) |
| 219: { | 219: { |
| 220: return pg_escape_string($str); | 220: return is_array($str) ? '' : pg_escape_string($str); |
| 221: } | 221: } |
| 222: | 222: |
| 223: | 223: |
| punbb-1.2.6/upload/include/dblayer/sqlite.php | punbb-1.2.16/upload/include/dblayer/sqlite.php |
|---|---|
| 219: | 219: |
| 220: function escape($str) | 220: function escape($str) |
| 221: { | 221: { |
| 222: return sqlite_escape_string($str); | 222: return is_array($str) ? '' : sqlite_escape_string($str); |
| 223: } | 223: } |
| 224: | 224: |
| 225: | 225: |
| punbb-1.2.6/upload/include/email.php | punbb-1.2.16/upload/include/email.php |
|---|---|
| 75: $subject = trim(preg_replace('#[\n\r]+#s', '', $subject)); | 75: $subject = trim(preg_replace('#[\n\r]+#s', '', $subject)); |
| 76: $from = trim(preg_replace('#[\n\r:]+#s', '', $from)); | 76: $from = trim(preg_replace('#[\n\r:]+#s', '', $from)); |
| 77: | 77: |
| 78: // Detect what linebreak we should use for the headers | 78: $headers = 'From: '.$from."\r\n".'Date: '.date('r')."\r\n".'MIME-Version: 1.0'."\r\n".'Content-transfer-encoding: 8bit'."\r\n".'Content-type: text/plain; charset='.$lang_common['lang_encoding']."\r\n".'X-Mailer: PunBB Mailer'; |
| 79: if (strtoupper(substr(PHP_OS, 0, 3) == 'WIN')) | |
| 80: $eol = "\r\n"; | |
| 81: else if (strtoupper(substr(PHP_OS, 0, 3) == 'MAC')) | |
| 82: $eol = "\r"; | |
| 83: else | |
| 84: $eol = "\n"; | |
| 85: | |
| 86: $headers = 'From: '.$from.$eol.'Date: '.date('r').$eol.'MIME-Version: 1.0'.$eol.'Content-transfer-encoding: 8bit'.$eol.'Content-type: text/plain; charset='.$lang_common['lang_encoding'].$eol.'X-Mailer: PunBB Mailer'; | |
| 87: | 79: |
| 88: // Make sure all linebreaks are CRLF in message | 80: // Make sure all linebreaks are CRLF in message (and strip out any NULL bytes) |
| 89: $message = str_replace("\n", "\r\n", pun_linebreaks($message)); | 81: $message = str_replace(array("\n", "\0"), array("\r\n", ''), pun_linebreaks($message)); |
| 90: | 82: |
| 91: if ($pun_config['o_smtp_host'] != '') | 83: if ($pun_config['o_smtp_host'] != '') |
| 92: smtp_mail($to, $subject, $message, $headers); | 84: smtp_mail($to, $subject, $message, $headers); |
| 93: else | 85: else |
| 86: { | |
| 87: // Change the linebreaks used in the headers according to OS | |
| 88: if (strtoupper(substr(PHP_OS, 0, 3)) == 'MAC') | |
| 89: $headers = str_replace("\r\n", "\r", $headers); | |
| 90: else if (strtoupper(substr(PHP_OS, 0, 3)) != 'WIN') | |
| 91: $headers = str_replace("\r\n", "\n", $headers); | |
| 92: | |
| 94: mail($to, $subject, $message, $headers); | 93: mail($to, $subject, $message, $headers); |
| 94: } | |
| 95: } | 95: } |
| 96: | 96: |
| 97: | 97: |
| punbb-1.2.6/upload/include/functions.php | punbb-1.2.16/upload/include/functions.php |
|---|---|
| 27: // | 27: // |
| 28: function check_cookie(&$pun_user) | 28: function check_cookie(&$pun_user) |
| 29: { | 29: { |
| 30: global $db, $pun_config, $cookie_name, $cookie_seed; | 30: global $db, $db_type, $pun_config, $cookie_name, $cookie_seed; |
| 31: | 31: |
| 32: $now = time(); | 32: $now = time(); |
| 33: $expire = $now + 31536000; // The cookie expires after a year | 33: $expire = $now + 31536000; // The cookie expires after a year |
| 75: { | 75: { |
| 76: // Update the online list | 76: // Update the online list |
| 77: if (!$pun_user['logged']) | 77: if (!$pun_user['logged']) |
| 78: $db->query('INSERT INTO '.$db->prefix.'online (user_id, ident, logged) VALUES('.$pun_user['id'].', \''.$db->escape($pun_user['username']).'\', '.$now.')') or error('Unable to insert into online list', __FILE__, __LINE__, $db->error()); | 78: { |
| 79: $pun_user['logged'] = $now; | |
| 80: | |
| 81: // With MySQL/MySQLi, REPLACE INTO avoids a user having two rows in the online table | |
| 82: switch ($db_type) | |
| 83: { | |
| 84: case 'mysql': | |
| 85: case 'mysqli': | |
| 86: $db->query('REPLACE INTO '.$db->prefix.'online (user_id, ident, logged) VALUES('.$pun_user['id'].', \''.$db->escape($pun_user['username']).'\', '.$pun_user['logged'].')') or error('Unable to insert into online list', __FILE__, __LINE__, $db->error()); | |
| 87: break; | |
| 88: | |
| 89: default: | |
| 90: $db->query('INSERT INTO '.$db->prefix.'online (user_id, ident, logged) VALUES('.$pun_user['id'].', \''.$db->escape($pun_user['username']).'\', '.$pun_user['logged'].')') or error('Unable to insert into online list', __FILE__, __LINE__, $db->error()); | |
| 91: break; | |
| 92: } | |
| 93: } | |
| 79: else | 94: else |
| 80: { | 95: { |
| 81: // Special case: We've timed out, but no other user has browsed the forums since we timed out | 96: // Special case: We've timed out, but no other user has browsed the forums since we timed out |
| 102: // | 117: // |
| 103: function set_default_user() | 118: function set_default_user() |
| 104: { | 119: { |
| 105: global $db, $pun_user, $pun_config; | 120: global $db, $db_type, $pun_user, $pun_config; |
| 106: | 121: |
| 107: $remote_addr = get_remote_address(); | 122: $remote_addr = get_remote_address(); |
| 108: | 123: |
| 115: | 130: |
| 116: // Update online list | 131: // Update online list |
| 117: if (!$pun_user['logged']) | 132: if (!$pun_user['logged']) |
| 118: $db->query('INSERT INTO '.$db->prefix.'online (user_id, ident, logged) VALUES(1, \''.$db->escape($remote_addr).'\', '.time().')') or error('Unable to insert into online list', __FILE__, __LINE__, $db->error()); | 133: { |
| 134: $pun_user['logged'] = time(); | |
| 135: | |
| 136: // With MySQL/MySQLi, REPLACE INTO avoids a user having two rows in the online table | |
| 137: switch ($db_type) | |
| 138: { | |
| 139: case 'mysql': | |
| 140: case 'mysqli': | |
| 141: $db->query('REPLACE INTO '.$db->prefix.'online (user_id, ident, logged) VALUES(1, \''.$db->escape($remote_addr).'\', '.$pun_user['logged'].')') or error('Unable to insert into online list', __FILE__, __LINE__, $db->error()); | |
| 142: break; | |
| 143: | |
| 144: default: | |
| 145: $db->query('INSERT INTO '.$db->prefix.'online (user_id, ident, logged) VALUES(1, \''.$db->escape($remote_addr).'\', '.$pun_user['logged'].')') or error('Unable to insert into online list', __FILE__, __LINE__, $db->error()); | |
| 146: break; | |
| 147: } | |
| 148: } | |
| 119: else | 149: else |
| 120: $db->query('UPDATE '.$db->prefix.'online SET logged='.time().' WHERE ident=\''.$db->escape($remote_addr).'\'') or error('Unable to update online list', __FILE__, __LINE__, $db->error()); | 150: $db->query('UPDATE '.$db->prefix.'online SET logged='.time().' WHERE ident=\''.$db->escape($remote_addr).'\'') or error('Unable to update online list', __FILE__, __LINE__, $db->error()); |
| 121: | 151: |
| 138: // Enable sending of a P3P header by removing // from the following line (try this if login is failing in IE6) | 168: // Enable sending of a P3P header by removing // from the following line (try this if login is failing in IE6) |
| 139: // @header('P3P: CP="CUR ADM"'); | 169: // @header('P3P: CP="CUR ADM"'); |
| 140: | 170: |
| 141: setcookie($cookie_name, serialize(array($user_id, md5($cookie_seed.$password_hash))), $expire, $cookie_path, $cookie_domain, $cookie_secure); | 171: if (version_compare(PHP_VERSION, '5.2.0', '>=')) |
| 172: setcookie($cookie_name, serialize(array($user_id, md5($cookie_seed.$password_hash))), $expire, $cookie_path, $cookie_domain, $cookie_secure, true); | |
| 173: else | |
| 174: setcookie($cookie_name, serialize(array($user_id, md5($cookie_seed.$password_hash))), $expire, $cookie_path.'; HttpOnly', $cookie_domain, $cookie_secure); | |
| 142: } | 175: } |
| 143: | 176: |
| 144: | 177: |
| 168: } | 201: } |
| 169: | 202: |
| 170: if ($cur_ban['username'] != '' && !strcasecmp($pun_user['username'], $cur_ban['username'])) | 203: if ($cur_ban['username'] != '' && !strcasecmp($pun_user['username'], $cur_ban['username'])) |
| 204: { | |
| 205: $db->query('DELETE FROM '.$db->prefix.'online WHERE ident=\''.$db->escape($pun_user['username']).'\'') or error('Unable to delete from online list', __FILE__, __LINE__, $db->error()); | |
| 171: message($lang_common['Ban message'].' '.(($cur_ban['expire'] != '') ? $lang_common['Ban message 2'].' '.strtolower(format_time($cur_ban['expire'], true)).'. ' : '').(($cur_ban['message'] != '') ? $lang_common['Ban message 3'].'<br /><br /><strong>'.pun_htmlspecialchars($cur_ban['message']).'</strong><br /><br />' : '<br /><br />').$lang_common['Ban message 4'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.', true); | 206: message($lang_common['Ban message'].' '.(($cur_ban['expire'] != '') ? $lang_common['Ban message 2'].' '.strtolower(format_time($cur_ban['expire'], true)).'. ' : '').(($cur_ban['message'] != '') ? $lang_common['Ban message 3'].'<br /><br /><strong>'.pun_htmlspecialchars($cur_ban['message']).'</strong><br /><br />' : '<br /><br />').$lang_common['Ban message 4'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.', true); |
| 207: } | |
| 172: | 208: |
| 173: if ($cur_ban['ip'] != '') | 209: if ($cur_ban['ip'] != '') |
| 174: { | 210: { |
| 179: $cur_ban_ips[$i] = $cur_ban_ips[$i].'.'; | 215: $cur_ban_ips[$i] = $cur_ban_ips[$i].'.'; |
| 180: | 216: |
| 181: if (substr($user_ip, 0, strlen($cur_ban_ips[$i])) == $cur_ban_ips[$i]) | 217: if (substr($user_ip, 0, strlen($cur_ban_ips[$i])) == $cur_ban_ips[$i]) |
| 218: { | |
| 219: $db->query('DELETE FROM '.$db->prefix.'online WHERE ident=\''.$db->escape($pun_user['username']).'\'') or error('Unable to delete from online list', __FILE__, __LINE__, $db->error()); | |
| 182: message($lang_common['Ban message'].' '.(($cur_ban['expire'] != '') ? $lang_common['Ban message 2'].' '.strtolower(format_time($cur_ban['expire'], true)).'. ' : '').(($cur_ban['message'] != '') ? $lang_common['Ban message 3'].'<br /><br /><strong>'.pun_htmlspecialchars($cur_ban['message']).'</strong><br /><br />' : '<br /><br />').$lang_common['Ban message 4'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.', true); | 220: message($lang_common['Ban message'].' '.(($cur_ban['expire'] != '') ? $lang_common['Ban message 2'].' '.strtolower(format_time($cur_ban['expire'], true)).'. ' : '').(($cur_ban['message'] != '') ? $lang_common['Ban message 3'].'<br /><br /><strong>'.pun_htmlspecialchars($cur_ban['message']).'</strong><br /><br />' : '<br /><br />').$lang_common['Ban message 4'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.', true); |
| 221: } | |
| 183: } | 222: } |
| 184: } | 223: } |
| 185: } | 224: } |
| 203: $now = time(); | 242: $now = time(); |
| 204: | 243: |
| 205: // Fetch all online list entries that are older than "o_timeout_online" | 244: // Fetch all online list entries that are older than "o_timeout_online" |
| 206: $result = $db->query('SELECT * FROM '.$db->prefix.'online WHERE logged<'.($now-$pun_config['o_timeout_online'])) or error('Unable to delete from online list', __FILE__, __LINE__, $db->error()); | 245: $result = $db->query('SELECT * FROM '.$db->prefix.'online WHERE logged<'.($now-$pun_config['o_timeout_online'])) or error('Unable to fetch old entries from online list', __FILE__, __LINE__, $db->error()); |
| 207: while ($cur_user = $db->fetch_assoc($result)) | 246: while ($cur_user = $db->fetch_assoc($result)) |
| 208: { | 247: { |
| 209: // If the entry is a guest, delete it | 248: // If the entry is a guest, delete it |
| 313: | 352: |
| 314: | 353: |
| 315: // | 354: // |
| 316: // Update posts, topics, last_post, last_post_id and last_poster for a forum (redirect topics are not included) | 355: // Update posts, topics, last_post, last_post_id and last_poster for a forum |
| 317: // | 356: // |
| 318: function update_forum($forum_id) | 357: function update_forum($forum_id) |
| 319: { | 358: { |
| 320: global $db; | 359: global $db; |
| 321: | 360: |
| 322: $result = $db->query('SELECT COUNT(id), SUM(num_replies) FROM '.$db->prefix.'topics WHERE moved_to IS NULL AND forum_id='.$forum_id) or error('Unable to fetch forum topic count', __FILE__, __LINE__, $db->error()); | 361: $result = $db->query('SELECT COUNT(id), SUM(num_replies) FROM '.$db->prefix.'topics WHERE forum_id='.$forum_id) or error('Unable to fetch forum topic count', __FILE__, __LINE__, $db->error()); |
| 323: list($num_topics, $num_posts) = $db->fetch_row($result); | 362: list($num_topics, $num_posts) = $db->fetch_row($result); |
| 324: | 363: |
| 325: $num_posts = $num_posts + $num_topics; // $num_posts is only the sum of all replies (we have to add the topic posts) | 364: $num_posts = $num_posts + $num_topics; // $num_posts is only the sum of all replies (we have to add the topic posts) |
| 332: $db->query('UPDATE '.$db->prefix.'forums SET num_topics='.$num_topics.', num_posts='.$num_posts.', last_post='.$last_post.', last_post_id='.$last_post_id.', last_poster=\''.$db->escape($last_poster).'\' WHERE id='.$forum_id) or error('Unable to update last_post/last_post_id/last_poster', __FILE__, __LINE__, $db->error()); | 371: $db->query('UPDATE '.$db->prefix.'forums SET num_topics='.$num_topics.', num_posts='.$num_posts.', last_post='.$last_post.', last_post_id='.$last_post_id.', last_poster=\''.$db->escape($last_poster).'\' WHERE id='.$forum_id) or error('Unable to update last_post/last_post_id/last_poster', __FILE__, __LINE__, $db->error()); |
| 333: } | 372: } |
| 334: else // There are no topics | 373: else // There are no topics |
| 335: $db->query('UPDATE '.$db->prefix.'forums SET num_topics=0, num_posts=0, last_post=NULL, last_post_id=NULL, last_poster=NULL WHERE id='.$forum_id) or error('Unable to update last_post/last_post_id/last_poster', __FILE__, __LINE__, $db->error()); | 374: $db->query('UPDATE '.$db->prefix.'forums SET num_topics='.$num_topics.', num_posts='.$num_posts.', last_post=NULL, last_post_id=NULL, last_poster=NULL WHERE id='.$forum_id) or error('Unable to update last_post/last_post_id/last_poster', __FILE__, __LINE__, $db->error()); |
| 336: } | 375: } |
| 337: | 376: |
| 338: | 377: |
| 675: // | 714: // |
| 676: function get_remote_address() | 715: function get_remote_address() |
| 677: { | 716: { |
| 678: $remote_address = $_SERVER['REMOTE_ADDR']; | 717: return $_SERVER['REMOTE_ADDR']; |
| 679: | |
| 680: // If HTTP_X_FORWARDED_FOR is set, we try to grab the first non-LAN IP | |
| 681: if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) | |
| 682: { | |
| 683: if (preg_match_all('/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/', $_SERVER['HTTP_X_FORWARDED_FOR'], $address_list)) | |
| 684: { | |
| 685: $lan_ips = array('/^0\./', '/^127\.0\.0\.1/', '/^192\.168\..*/', '/^172\.((1[6-9])|(2[0-9])|(3[0-1]))\..*/', '/^10\..*/', '/^224\..*/', '/^240\..*/'); | |
| 686: $address_list = preg_replace($lan_ips, null, $address_list[0]); | |
| 687: | |
| 688: while (list(, $cur_address) = each($address_list)) | |
| 689: { | |
| 690: if ($cur_address) | |
| 691: { | |
| 692: $remote_address = $cur_address; | |
| 693: break; | |
| 694: } | |
| 695: } | |
| 696: } | |
| 697: } | |
| 698: | |
| 699: return $remote_address; | |
| 700: } | 718: } |
| 701: | 719: |
| 702: | 720: |
| 764: $tpl_maint = trim(file_get_contents(PUN_ROOT.'include/template/maintenance.tpl')); | 782: $tpl_maint = trim(file_get_contents(PUN_ROOT.'include/template/maintenance.tpl')); |
| 765: | 783: |
| 766: | 784: |
| 785: // START SUBST - <pun_include "*"> | |
| 786: while (preg_match('#<pun_include "([^/\\\\]*?)\.(php[45]?|inc|html?|txt)">#', $tpl_maint, $cur_include)) | |
| 787: { | |
| 788: if (!file_exists(PUN_ROOT.'include/user/'.$cur_include[1].'.'.$cur_include[2])) | |
| 789: error('Unable to process user include '.htmlspecialchars($cur_include[0]).' from template maintenance.tpl. There is no such file in folder /include/user/'); | |
| 790: | |
| 791: ob_start(); | |
| 792: include PUN_ROOT.'include/user/'.$cur_include[1].'.'.$cur_include[2]; | |
| 793: $tpl_temp = ob_get_contents(); | |
| 794: $tpl_maint = str_replace($cur_include[0], $tpl_temp, $tpl_maint); | |
| 795: ob_end_clean(); | |
| 796: } | |
| 797: // END SUBST - <pun_include "*"> | |
| 798: | |
| 799: | |
| 767: // START SUBST - <pun_content_direction> | 800: // START SUBST - <pun_content_direction> |
| 768: $tpl_maint = str_replace('<pun_content_direction>', $lang_common['lang_direction'], $tpl_maint); | 801: $tpl_maint = str_replace('<pun_content_direction>', $lang_common['lang_direction'], $tpl_maint); |
| 769: // END SUBST - <pun_content_direction> | 802: // END SUBST - <pun_content_direction> |
| 802: $db->end_transaction(); | 835: $db->end_transaction(); |
| 803: | 836: |
| 804: | 837: |
| 805: // START SUBST - <pun_include "*"> | |
| 806: while (preg_match('#<pun_include "([^/\\\\]*?)">#', $tpl_maint, $cur_include)) | |
| 807: { | |
| 808: if (!file_exists(PUN_ROOT.'include/user/'.$cur_include[1])) | |
| 809: error('Unable to process user include <pun_include "'.htmlspecialchars($cur_include[1]).'"> from template maintenance.tpl. There is no such file in folder /include/user/'); | |
| 810: | |
| 811: ob_start(); | |
| 812: include PUN_ROOT.'include/user/'.$cur_include[1]; | |
| 813: $tpl_temp = ob_get_contents(); | |
| 814: $tpl_maint = str_replace($cur_include[0], $tpl_temp, $tpl_maint); | |
| 815: ob_end_clean(); | |
| 816: } | |
| 817: // END SUBST - <pun_include "*"> | |
| 818: | |
| 819: | |
| 820: // Close the db connection (and free up any result data) | 838: // Close the db connection (and free up any result data) |
| 821: $db->close(); | 839: $db->close(); |
| 822: | 840: |
| 831: { | 849: { |
| 832: global $db, $pun_config, $lang_common, $pun_user; | 850: global $db, $pun_config, $lang_common, $pun_user; |
| 833: | 851: |
| 834: if ($destination_url == '') | 852: // Prefix with o_base_url (unless it's there already) |
| 835: $destination_url = 'index.php'; | 853: if (strpos($destination_url, $pun_config['o_base_url']) !== 0) |
| 854: $destination_url = $pun_config['o_base_url'].'/'.$destination_url; | |
| 855: | |
| 856: // Do a little spring cleaning | |
| 857: $destination_url = preg_replace('/([\r\n])|(%0[ad])|(;[\s]*data[\s]*:)/i', '', $destination_url); | |
| 836: | 858: |
| 837: // If the delay is 0 seconds, we might as well skip the redirect all together | 859: // If the delay is 0 seconds, we might as well skip the redirect all together |
| 838: if ($pun_config['o_redirect_delay'] == '0') | 860: if ($pun_config['o_redirect_delay'] == '0') |
| 843: $tpl_redir = trim(file_get_contents(PUN_ROOT.'include/template/redirect.tpl')); | 865: $tpl_redir = trim(file_get_contents(PUN_ROOT.'include/template/redirect.tpl')); |
| 844: | 866: |
| 845: | 867: |
| 868: // START SUBST - <pun_include "*"> | |