diff -urbB punbb-1.1/upload/admin_bans.php punbb-1.1.2/upload/admin_bans.php --- punbb-1.1/upload/admin_bans.php 2004-03-21 16:29:25.000000000 +0100 +++ punbb-1.1.2/upload/admin_bans.php 2004-03-21 16:29:21.000000000 +0100 @@ -54,7 +54,7 @@ } else // Otherwise the username is in POST { - $ban_user = trim(strtolower($_POST['new_ban_user'])); + $ban_user = trim($_POST['new_ban_user']); if ($ban_user != '') { @@ -121,7 +121,7 @@ - + diff -urbB punbb-1.1/upload/admin_index.php punbb-1.1.2/upload/admin_index.php --- punbb-1.1/upload/admin_index.php 2004-03-21 16:29:25.000000000 +0100 +++ punbb-1.1.2/upload/admin_index.php 2004-03-21 16:29:21.000000000 +0100 @@ -67,7 +67,7 @@ // Get the server load averages (if possible) -if (file_exists('/proc/loadavg')) +if (@file_exists('/proc/loadavg')) { // We use @ just in case $fh = @fopen('/proc/loadavg', 'r'); diff -urbB punbb-1.1/upload/admin_maintenance.php punbb-1.1.2/upload/admin_maintenance.php --- punbb-1.1/upload/admin_maintenance.php 2004-03-21 16:29:25.000000000 +0100 +++ punbb-1.1.2/upload/admin_maintenance.php 2004-03-21 16:29:21.000000000 +0100 @@ -42,6 +42,8 @@ if (empty($per_page) || empty($start_at)) message($lang_common['Bad request']); + @set_time_limit(0); + // If this is the first cycle of posts we empty the search index before we proceed if (isset($_GET['empty_index'])) { @@ -115,7 +117,7 @@ else { // Get the first post ID from the db - $result = $db->query('SELECT id FROM '.$db->prefix.'topics ORDER BY id LIMIT 1') or error('Unable to create category', __FILE__, __LINE__, $db->error()); + $result = $db->query('SELECT id FROM '.$db->prefix.'topics ORDER BY id LIMIT 1') or error('Unable to fetch topic info', __FILE__, __LINE__, $db->error()); if ($db->num_rows($result)) $first_id = $db->result($result, 0); diff -urbB punbb-1.1/upload/admin_options.php punbb-1.1.2/upload/admin_options.php --- punbb-1.1/upload/admin_options.php 2004-03-21 16:29:25.000000000 +0100 +++ punbb-1.1.2/upload/admin_options.php 2004-03-21 16:29:22.000000000 +0100 @@ -392,11 +392,11 @@ - + - +
Username
The username to ban (case insensitive).		Username
The username to ban.
SMTP username
Username for SMTP server. Only enter a username if it is required by the SMTP server (most servers don't require authentication).
SMTP password
Password for SMTP server. Only enter a password if it is required by the SMTP server (most servers don't require authentication).
diff -urbB punbb-1.1/upload/admin_prune.php punbb-1.1.2/upload/admin_prune.php --- punbb-1.1/upload/admin_prune.php 2004-03-21 16:29:25.000000000 +0100 +++ punbb-1.1.2/upload/admin_prune.php 2004-03-21 16:29:22.000000000 +0100 @@ -87,7 +87,7 @@ $prune_from = $_POST['prune_from']; // Concatenate together the query for counting number or topics to prune - $sql = 'SELECT COUNT(id) FROM '.$db->prefix.'topics WHERE last_post<'.$prune_date; + $sql = 'SELECT COUNT(id) FROM '.$db->prefix.'topics WHERE last_post<'.$prune_date.' AND moved_to IS NULL'; if ($_POST['prune_sticky'] == '0') $sql .= ' AND sticky=\'0\''; @@ -98,7 +98,7 @@ // Fetch the forum name (just for cosmetic reasons) $result = $db->query('SELECT forum_name FROM '.$db->prefix.'forums WHERE id='.$prune_from) or error('Unable to fetch forum name', __FILE__, __LINE__, $db->error()); - $forum = '"'.$db->result($result, 0).'"'; + $forum = '"'.pun_htmlspecialchars($db->result($result, 0)).'"'; } else $forum = 'all forums'; diff -urbB punbb-1.1/upload/admin_users.php punbb-1.1.2/upload/admin_users.php --- punbb-1.1/upload/admin_users.php 2004-03-21 16:29:25.000000000 +0100 +++ punbb-1.1.2/upload/admin_users.php 2004-03-21 16:29:22.000000000 +0100 @@ -362,7 +362,7 @@ Username - + E-mail address @@ -385,59 +385,63 @@ + MSN Messenger + + + AOL IM - + Yahoo! Messenger - + Location - + Signature - + Admin note - + Number of posts greater than - + Number of posts less than - + Last post is after
(yyyy-mm-dd hh:mm:ss) - + Last post is before
(yyyy-mm-dd hh:mm:ss) - + Registered after
(yyyy-mm-dd hh:mm:ss) - + Registered before
(yyyy-mm-dd hh:mm:ss) - + Order by - -        @@ -446,7 +450,7 @@ User group - @@ -474,8 +478,8 @@ - - + +
IP address
The IP address to search for in the post database.
diff -urbB punbb-1.1/upload/edit.php punbb-1.1.2/upload/edit.php --- punbb-1.1/upload/edit.php 2004-03-21 16:29:25.000000000 +0100 +++ punbb-1.1.2/upload/edit.php 2004-03-21 16:29:22.000000000 +0100 @@ -124,8 +124,7 @@ if ($smilies != '1') $smilies = '0'; - if (!isset($_POST['silent']) || !$is_admmod) - $edited_sql = ', edited='.time().', edited_by=\''.addslashes($cur_user['username']).'\''; + $edited_sql = (!isset($_POST['silent']) || !$is_admmod) ? $edited_sql = ', edited='.time().', edited_by=\''.addslashes($cur_user['username']).'\'' : ''; if ($is_topicpost && $is_admmod) { diff -urbB punbb-1.1/upload/footer.php punbb-1.1.2/upload/footer.php --- punbb-1.1/upload/footer.php 2004-03-21 16:29:25.000000000 +0100 +++ punbb-1.1.2/upload/footer.php 2004-03-21 16:29:22.000000000 +0100 @@ -72,10 +72,9 @@ + diff -urbB punbb-1.1/upload/moderate.php punbb-1.1.2/upload/moderate.php --- punbb-1.1/upload/moderate.php 2004-03-21 16:29:25.000000000 +0100 +++ punbb-1.1.2/upload/moderate.php 2004-03-21 16:29:22.000000000 +0100 @@ -39,6 +39,9 @@ message($lang_common['No permission']); $result = $db->query('SELECT poster_ip FROM '.$db->prefix.'posts WHERE id='.$get_host) or error('Unable to fetch post IP address', __FILE__, __LINE__, $db->error()); + if (!$db->num_rows($result)) + message($lang_common['Bad request']); + $ip = $db->result($result, 0); message('The IP address is: '.$ip.'
The host name is: '.gethostbyaddr($ip).'

Show more users for this IP'); diff -urbB punbb-1.1/upload/post.php punbb-1.1.2/upload/post.php --- punbb-1.1/upload/post.php 2004-03-21 16:29:25.000000000 +0100 +++ punbb-1.1.2/upload/post.php 2004-03-21 16:29:22.000000000 +0100 @@ -116,14 +116,16 @@ require $pun_root.'lang/'.$language.'/'.$language.'_prof_reg.php'; require $pun_root.'lang/'.$language.'/'.$language.'_register.php'; - // It's a guest, so we have to check the username + // It's a guest, so we have to validate the username if (strlen($username) < 2) message($lang_prof_reg['Username too short']); else if (!strcasecmp($username, 'Guest') || !strcasecmp($username, $lang_common['Guest'])) message($lang_prof_reg['Username guest']); else if (preg_match('/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/', $username)) message($lang_prof_reg['Username IP']); - else if (preg_match('#\[b\]|\[/b\]|\[u\]|\[/u\]|\[i\]|\[/i\]|\[color|\[/color\]|\[quote\]|\[/quote\]|\[code\]|\[/code\]|\[img\]|\[/img\]|\[url|\[/url\]|\[email|\[/email\]#i', $username)) + else if ((strpos($username, '[') !== false || strpos($username, ']') !== false) && strpos($username, '\'') !== false && strpos($username, '"') !== false) + message($lang_prof_reg['Username reserved chars']); + else if (preg_match('#\[b\]|\[/b\]|\[u\]|\[/u\]|\[i\]|\[/i\]|\[color|\[/color\]|\[quote\]|\[quote=|\[/quote\]|\[code\]|\[/code\]|\[img\]|\[/img\]|\[url|\[/url\]|\[email|\[/email\]#i', $username)) message($lang_prof_reg['Username BBCode']); // Check username for any censored words @@ -368,11 +370,22 @@ else $q_poster = '\''.$q_poster.'\''; } + else + { + // Get the characters at the start and end of $q_poster + $ends = substr($q_poster, 0, 1).substr($q_poster, -1, 1); + + // Deal with quoting "Username" or 'Username' (becomes '"Username"' or "'Username'") + if ($ends == '\'\'') + $q_poster = '"'.$q_poster.'"'; + else if ($ends == '""') + $q_poster = '\''.$q_poster.'\''; + } $quote = '[quote='.$q_poster.']'.$q_message.'[/quote]'."\n"; } else - $quote = '> '.$q_poster.' '.$lang_post['wrote'].':'."\n\n".'> '.$q_message."\n"; + $quote = '> '.$q_poster.' '.$lang_common['wrote'].':'."\n\n".'> '.$q_message."\n"; } // We have to fetch the forum name in order to display Title / Forum / Topic @@ -525,7 +538,7 @@ ?> - + '; $email_field = ' - '.$lang_common['Send e-mail'].''; - $user_title_field = '  '.$lang_prof_reg['Leave blank']; + $user_title_field = '  '.$lang_profile['Leave blank']; if ($cur_user['status'] == PUN_ADMIN && $img_size) $avatar_field .= '
 '.$lang_profile['Delete avatar'].''; @@ -955,7 +958,7 @@ $email_field = ''; if ($pun_config['p_users_set_title'] == '1') - $user_title_field = '  '.$lang_prof_reg['Leave blank']; + $user_title_field = '  '.$lang_profile['Leave blank']; else { $user_title_field = get_title($user); @@ -1125,7 +1128,7 @@  
- +
result($result, 0); if ($last_post_id) + { header('Location: viewtopic.php?pid='.$last_post_id.'#'.$last_post_id); + exit; + } } @@ -257,16 +262,15 @@ $info .= $lang_common['Registered'].': '.$registered.'
'; - if ($pun_config['o_show_post_count'] == '1') - $info .= "\n\t\t\t\t\t\t\t".$lang_common['Posts'].': '.$cur_post['num_posts']; - if ($cur_user['status'] > PUN_USER) { - $info .= '
'."\n\t\t\t\t\t\t\t".'IP: '.$cur_post['poster_ip'].''; + $info .= "\n\t\t\t\t\t\t\t".$lang_common['Posts'].': '.$cur_post['num_posts'].'
'."\n\t\t\t\t\t\t\t".'IP: '.$cur_post['poster_ip'].''; if ($cur_post['admin_note'] != '') $info .= '

'."\n\t\t\t\t\t\t\t".$lang_topic['Note'].': '.$cur_post['admin_note'].''; } + else if ($pun_config['o_show_post_count'] == '1') + $info .= "\n\t\t\t\t\t\t\t".$lang_common['Posts'].': '.$cur_post['num_posts']; // Generate an array of links that appear at the bottom of every message. $links = array();