diff -urbB punbb-1.1.1/upload/admin_bans.php punbb-1.1.4/upload/admin_bans.php --- punbb-1.1.1/upload/admin_bans.php 2004-03-21 16:29:19.000000000 +0100 +++ punbb-1.1.4/upload/admin_bans.php 2004-04-25 22:34:48.000000000 +0200 @@ -54,7 +54,7 @@ } else // Otherwise the username is in POST { - $ban_user = trim(strtolower($_POST['new_ban_user'])); + $ban_user = trim($_POST['new_ban_user']); if ($ban_user != '') { @@ -121,8 +121,8 @@ - - + + diff -urbB punbb-1.1.1/upload/admin_maintenance.php punbb-1.1.4/upload/admin_maintenance.php --- punbb-1.1.1/upload/admin_maintenance.php 2004-03-21 16:29:19.000000000 +0100 +++ punbb-1.1.4/upload/admin_maintenance.php 2004-03-21 16:29:24.000000000 +0100 @@ -42,6 +42,8 @@ if (empty($per_page) || empty($start_at)) message($lang_common['Bad request']); + @set_time_limit(0); + // If this is the first cycle of posts we empty the search index before we proceed if (isset($_GET['empty_index'])) { diff -urbB punbb-1.1.1/upload/admin_options.php punbb-1.1.4/upload/admin_options.php --- punbb-1.1.1/upload/admin_options.php 2004-03-21 16:29:19.000000000 +0100 +++ punbb-1.1.4/upload/admin_options.php 2004-03-21 16:29:24.000000000 +0100 @@ -94,13 +94,24 @@ $form['maintenance'] = '0'; } + $form['timeout_visit'] = intval($form['timeout_visit']); + $form['timeout_online'] = intval($form['timeout_online']); + $form['redirect_delay'] = intval($form['redirect_delay']); + $form['flood_interval'] = intval($form['flood_interval']); + $form['topic_review'] = intval($form['topic_review']); + $form['disp_topics_default'] = intval($form['disp_topics_default']); + $form['disp_posts_default'] = intval($form['disp_posts_default']); + $form['indent_num_spaces'] = intval($form['indent_num_spaces']); + $form['avatars_width'] = intval($form['avatars_width']); + $form['avatars_height'] = intval($form['avatars_height']); + $form['avatars_size'] = intval($form['avatars_size']); while (list($key, $input) = @each($form)) { // Only update values that have changed if ($pun_config['o_'.$key] != $input) { - if ($input != '') + if ($input != '' || is_int($input)) $value = '\''.escape($input).'\''; else $value = 'NULL'; @@ -392,11 +403,11 @@ - + - +
Username
The username to ban (case insensitive).		Username
The username to ban.
IP-adresses
The IP or IP-ranges you wish to ban (e.g. 150.11.110.1 or 150.11.110). Separate addresses with spaces. If an IP is entered already it is the last known IP of this user in the database.here to see IP statistics for this user.' ?>
SMTP username
Username for SMTP server. Only enter a username if it is required by the SMTP server (most servers don't require authentication).
SMTP password
Password for SMTP server. Only enter a password if it is required by the SMTP server (most servers don't require authentication).
diff -urbB punbb-1.1.1/upload/admin_permissions.php punbb-1.1.4/upload/admin_permissions.php --- punbb-1.1.1/upload/admin_permissions.php 2004-03-21 16:29:19.000000000 +0100 +++ punbb-1.1.4/upload/admin_permissions.php 2004-03-21 16:29:24.000000000 +0100 @@ -38,12 +38,15 @@ $form = array_map('trim', $_POST['form']); + $form['sig_length'] = intval($form['sig_length']); + $form['sig_lines'] = intval($form['sig_lines']); + while (list($key, $input) = @each($form)) { // Only update values that have changed if ($pun_config['p_'.$key] != $input) { - if ($input != '') + if ($input != '' || is_int($input)) $value = '\''.escape($input).'\''; else $value = 'NULL'; diff -urbB punbb-1.1.1/upload/admin_prune.php punbb-1.1.4/upload/admin_prune.php --- punbb-1.1.1/upload/admin_prune.php 2004-03-21 16:29:19.000000000 +0100 +++ punbb-1.1.4/upload/admin_prune.php 2004-03-21 16:29:24.000000000 +0100 @@ -87,7 +87,7 @@ $prune_from = $_POST['prune_from']; // Concatenate together the query for counting number or topics to prune - $sql = 'SELECT COUNT(id) FROM '.$db->prefix.'topics WHERE last_post<'.$prune_date; + $sql = 'SELECT COUNT(id) FROM '.$db->prefix.'topics WHERE last_post<'.$prune_date.' AND moved_to IS NULL'; if ($_POST['prune_sticky'] == '0') $sql .= ' AND sticky=\'0\''; @@ -98,7 +98,7 @@ // Fetch the forum name (just for cosmetic reasons) $result = $db->query('SELECT forum_name FROM '.$db->prefix.'forums WHERE id='.$prune_from) or error('Unable to fetch forum name', __FILE__, __LINE__, $db->error()); - $forum = '"'.$db->result($result, 0).'"'; + $forum = '"'.pun_htmlspecialchars($db->result($result, 0)).'"'; } else $forum = 'all forums'; diff -urbB punbb-1.1.1/upload/edit.php punbb-1.1.4/upload/edit.php --- punbb-1.1.1/upload/edit.php 2004-03-21 16:29:19.000000000 +0100 +++ punbb-1.1.4/upload/edit.php 2004-03-21 16:29:24.000000000 +0100 @@ -124,8 +124,7 @@ if ($smilies != '1') $smilies = '0'; - if (!isset($_POST['silent']) || !$is_admmod) - $edited_sql = ', edited='.time().', edited_by=\''.addslashes($cur_user['username']).'\''; + $edited_sql = (!isset($_POST['silent']) || !$is_admmod) ? $edited_sql = ', edited='.time().', edited_by=\''.addslashes($cur_user['username']).'\'' : ''; if ($is_topicpost && $is_admmod) { diff -urbB punbb-1.1.1/upload/footer.php punbb-1.1.4/upload/footer.php --- punbb-1.1.1/upload/footer.php 2004-03-21 16:29:19.000000000 +0100 +++ punbb-1.1.4/upload/footer.php 2004-03-21 16:29:24.000000000 +0100 @@ -72,10 +72,9 @@ + diff -urbB punbb-1.1.1/upload/moderate.php punbb-1.1.4/upload/moderate.php --- punbb-1.1.1/upload/moderate.php 2004-03-21 16:29:19.000000000 +0100 +++ punbb-1.1.4/upload/moderate.php 2004-03-21 16:29:24.000000000 +0100 @@ -316,7 +316,7 @@ $moved_to = $db->fetch_assoc($result); // Create the redirect topic - $db->query('INSERT INTO '.$db->prefix.'topics (poster, subject, posted, last_post, moved_to, forum_id) VALUES(\''.$moved_to['poster'].'\', \''.$moved_to['subject'].'\', '.$moved_to['posted'].', '.$moved_to['last_post'].', '.$cur_topic.', '.$fid.')') or error('Unable to create redirect topic', __FILE__, __LINE__, $db->error()); + $db->query('INSERT INTO '.$db->prefix.'topics (poster, subject, posted, last_post, moved_to, forum_id) VALUES(\''.addslashes($moved_to['poster']).'\', \''.addslashes($moved_to['subject']).'\', '.$moved_to['posted'].', '.$moved_to['last_post'].', '.$cur_topic.', '.$fid.')') or error('Unable to create redirect topic', __FILE__, __LINE__, $db->error()); } } diff -urbB punbb-1.1.1/upload/post.php punbb-1.1.4/upload/post.php --- punbb-1.1.1/upload/post.php 2004-03-21 16:29:19.000000000 +0100 +++ punbb-1.1.4/upload/post.php 2004-04-25 22:14:22.000000000 +0200 @@ -40,7 +40,7 @@ message($lang_post['Flood start'].' '.$pun_config['o_flood_interval'].' '.$lang_post['flood end']); // Make sure form_user is correct - if (($cookie['is_guest'] && $_POST['form_user'] != 'Guest') || (!$cookie['is_guest'] && $_POST['form_user'] != $cur_user['username'])) + if (($cookie['is_guest'] && $_POST['form_user'] != 'Guest') || (!$cookie['is_guest'] && unescape($_POST['form_user']) != $cur_user['username'])) message($lang_common['Bad request']); $smilies = $_POST['smilies']; @@ -110,7 +110,7 @@ else { $username = trim(unescape($_POST['req_username'])); - $email = trim($_POST['req_email']); + $email = strtolower(trim($_POST['req_email'])); // Load the register.php/profile.php language files require $pun_root.'lang/'.$language.'/'.$language.'_prof_reg.php'; diff -urbB punbb-1.1.1/upload/profile.php punbb-1.1.4/upload/profile.php --- punbb-1.1.1/upload/profile.php 2004-03-21 16:29:19.000000000 +0100 +++ punbb-1.1.4/upload/profile.php 2004-04-25 14:52:38.000000000 +0200 @@ -49,7 +49,10 @@ { // If the user is already logged in we shouldn't be here :) if (!$cookie['is_guest']) + { header('Location: index.php'); + exit; + } $key = $_GET['key']; @@ -600,7 +603,15 @@ if ($cur_user['id'] != $id && $cur_user['status'] < PUN_MOD) message($lang_common['No permission']); - $form = $_POST['form']; + // Extract elements from $_POST['form'] + $wanted_elements = array('realname', 'url', 'icq', 'msn', 'aim', 'yahoo', 'location', 'use_avatar', 'disp_topics', 'disp_posts', 'timezone', 'email_setting', 'save_pass', 'notify_with_post', 'smilies', 'show_img', 'show_avatars', 'show_sig', 'link_to_new_win', 'style'); + $form = array(); + + while (list($key, $value) = @each($_POST['form'])) + { + if (in_array($key, $wanted_elements)) + $form[$key] = $value; + } if ($cur_user['status'] > PUN_USER) @@ -612,6 +623,8 @@ if (strlen($username) < 2) message($lang_prof_reg['Username too short']); + else if (pun_strlen($username) > 25) // This usually doesn't happen since the form element only accepts 25 characters + message($lang_common['Bad request']); else if (!strcasecmp($username, 'Guest') || !strcasecmp($username, $lang_common['Guest'])) message($lang_prof_reg['Username guest']); else if (preg_match('/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/', $username)) @@ -669,7 +682,7 @@ $form['url'] = 'http://'.$form['url']; // If the ICQ UIN contains anything other than digits it's invalid - if ($form['icq'] != '' && preg_match('/[^0-9]/', $form[icq])) + if ($form['icq'] != '' && preg_match('/[^0-9]/', $form['icq'])) message($lang_prof_reg['Bad ICQ']); @@ -940,7 +953,7 @@ { $username_field = ''; $email_field = ' - '.$lang_common['Send e-mail'].''; - $user_title_field = '  '.$lang_prof_reg['Leave blank']; + $user_title_field = '  '.$lang_profile['Leave blank']; if ($cur_user['status'] == PUN_ADMIN && $img_size) $avatar_field .= '
 '.$lang_profile['Delete avatar'].''; @@ -955,7 +968,7 @@ $email_field = ''; if ($pun_config['p_users_set_title'] == '1') - $user_title_field = '  '.$lang_prof_reg['Leave blank']; + $user_title_field = '  '.$lang_profile['Leave blank']; else { $user_title_field = get_title($user); @@ -1040,7 +1053,7 @@
-   

+   

:   
:   
:   
diff -urbB punbb-1.1.1/upload/register.php punbb-1.1.4/upload/register.php --- punbb-1.1.1/upload/register.php 2004-03-21 16:29:19.000000000 +0100 +++ punbb-1.1.4/upload/register.php 2004-04-25 14:14:32.000000000 +0200 @@ -29,7 +29,10 @@ // If we are logged in, we shouldn't be here if (!$cookie['is_guest']) +{ header('Location: index.php'); + exit; +} // Load the register.php language file require $pun_root.'lang/'.$language.'/'.$language.'_register.php'; @@ -99,6 +102,8 @@ // Validate username and passwords if (strlen($username) < 2) message($lang_prof_reg['Username too short']); + else if (pun_strlen($username) > 25) // This usually doesn't happen since the form element only accepts 25 characters + message($lang_common['Bad request']); else if (strlen($password1) < 4) message($lang_prof_reg['Pass too short']); else if ($password1 != $password2) diff -urbB punbb-1.1.1/upload/search.php punbb-1.1.4/upload/search.php --- punbb-1.1.1/upload/search.php 2004-03-21 16:29:19.000000000 +0100 +++ punbb-1.1.4/upload/search.php 2004-03-21 16:29:24.000000000 +0100 @@ -53,7 +53,7 @@ // Detect two byte character sets -$multibyte = (in_array($lang_common['lang_encoding'], array('utf-8', 'gb2312', 'big5', 'shift_jis', 'euc-kr'))) ? true : false; +$multibyte = (isset($lang_common['lang_multibyte']) && $lang_common['lang_multibyte']) ? true : false; // Figure out what to do :-) @@ -188,17 +188,16 @@ while (list(, $word) = @each($stopwords)) { $word = trim($word); - if ($word != 'and' || $word != 'or' || $word != 'not') - $text = preg_replace('#\b'.preg_quote($word).'\b#', ' ', $text); + if ($word != 'and' && $word != 'or' && $word != 'not') + $keywords = preg_replace('#\b'.preg_quote($word).'\b#', ' ', $keywords); } } // Split up keywords - $keywords_array = preg_split('#[\s]+#', substr($keywords, 1, -1)); + $keywords_array = preg_split('#[\s]+#', trim($keywords)); // Should we search in message body or topic subject specifically? - if ($search_in) - $search_in_cond = ($search_in > 0) ? ' AND m.subject_match = 0' : ' AND m.subject_match = 1'; + $search_in_cond = ($search_in) ? (($search_in > 0) ? ' AND m.subject_match = 0' : ' AND m.subject_match = 1') : ''; } $match_type = 'or'; @@ -565,7 +564,7 @@ if ($search_set[$i]['poster_id'] > 1) $pposter = ''.$pposter.''; - if (pun_strlen($message) == 140) + if (pun_strlen($message) >= 140) $message .= ' ...'; ?> @@ -693,8 +692,7 @@ echo "\t\t\t\t\t".''."\n"; -if ($cur_user['status'] < PUN_USER) - $extra = ' WHERE f.admmod_only=\'0\''; +$extra_sql = ($cur_user['status'] < PUN_MOD) ? ' WHERE f.admmod_only=\'0\'' : ''; $result = $db->query('SELECT c.id AS cid, c.cat_name, f.id AS fid, f.forum_name FROM '.$db->prefix.'categories AS c INNER JOIN '.$db->prefix.'forums AS f ON c.id=f.cat_id'.$extra.' ORDER BY c.disp_position, c.id, f.disp_position') or error('Unable to fetch category/forum list', __FILE__, __LINE__, $db->error()); $num_forums = $db->num_rows($result); diff -urbB punbb-1.1.1/upload/userlist.php punbb-1.1.4/upload/userlist.php --- punbb-1.1.1/upload/userlist.php 2004-03-21 16:29:19.000000000 +0100 +++ punbb-1.1.4/upload/userlist.php 2004-03-21 16:29:24.000000000 +0100 @@ -161,7 +161,7 @@ - +
result($result, 0); if ($last_post_id) + { header('Location: viewtopic.php?pid='.$last_post_id.'#'.$last_post_id); + exit; + } }