@@ -362,12 +366,17 @@
message($lang_profile['Move failed'].' '.$pun_config['o_admin_email'].'.');
// Now check the width/height
- list($width, $height, ,) = getimagesize($pun_config['o_avatars_dir'].'/'.$id.'.tmp');
+ list($width, $height, $type,) = getimagesize($pun_config['o_avatars_dir'].'/'.$id.'.tmp');
if (empty($width) || empty($height) || $width > $pun_config['o_avatars_width'] || $height > $pun_config['o_avatars_height'])
{
@unlink($pun_config['o_avatars_dir'].'/'.$id.'.tmp');
message($lang_profile['Too wide or high'].' '.$pun_config['o_avatars_width'].'x'.$pun_config['o_avatars_height'].' '.$lang_profile['pixels'].'.');
}
+ else if ($type == 1 && $uploaded_file['type'] != 'image/gif') // Prevent dodgy uploads
+ {
+ @unlink($pun_config['o_avatars_dir'].'/'.$id.'.tmp');
+ message($lang_profile['Bad type']);
+ }
// Delete any old avatars and put the new one in place
@unlink($pun_config['o_avatars_dir'].'/'.$id.$extensions[0]);
@@ -708,6 +717,14 @@
$form['email'] = strtolower(trim($_POST['req_email']));
if (!is_valid_email($form['email']))
message($lang_common['Invalid e-mail']);
+ }
+
+ // Make sure we got a valid language string
+ if (isset($form['language']))
+ {
+ $form['language'] = preg_replace('#[\.\\\/]#', '', $form['language']);
+ if (!file_exists(PUN_ROOT.'lang/'.$form['language'].'/common.php'))
+ message($lang_common['Bad request']);
}
break;
diff -urN punbb-1.2.6/upload/register.php punbb-1.2.13/upload/register.php
--- punbb-1.2.6/upload/register.php Thu May 5 00:26:04 2005
+++ punbb-1.2.13/upload/register.php Tue Feb 28 20:21:40 2006
@@ -79,6 +79,13 @@
else if (isset($_POST['form_sent']))
{
+ // Check that someone from this IP didn't register a user within the last hour (DoS prevention)
+ $result = $db->query('SELECT 1 FROM '.$db->prefix.'users WHERE registration_ip=\''.get_remote_address().'\' AND registered>'.(time() - 3600)) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error());
+
+ if ($db->num_rows($result))
+ message('A new user was registered with the same IP address as you within the last hour. To prevent registration flooding, at least an hour has to pass between registrations from the same IP. Sorry for the inconvenience.');
+
+
$username = pun_trim($_POST['req_username']);
$email1 = strtolower(trim($_POST['req_email1']));
@@ -171,7 +178,7 @@
$save_pass = (!isset($_POST['save_pass']) || $_POST['save_pass'] != '1') ? '0' : '1';
$email_setting = intval($_POST['email_setting']);
- if ($email_setting < 0 && $email_setting > 2) $email_setting = 1;
+ if ($email_setting < 0 || $email_setting > 2) $email_setting = 1;
// Insert the new user into the database. We do this now to get the last inserted id for later use.
$now = time();
diff -urN punbb-1.2.6/upload/search.php punbb-1.2.13/upload/search.php
--- punbb-1.2.6/upload/search.php Thu Jul 7 18:58:46 2005
+++ punbb-1.2.13/upload/search.php Sun Oct 16 11:48:28 2005
@@ -51,6 +51,7 @@
$action = (isset($_GET['action'])) ? $_GET['action'] : null;
$forum = (isset($_GET['forum'])) ? intval($_GET['forum']) : -1;
$sort_dir = (isset($_GET['sort_dir'])) ? (($_GET['sort_dir'] == 'DESC') ? 'DESC' : 'ASC') : 'DESC';
+ if (isset($search_id)) unset($search_id);
// If a search_id was supplied
if (isset($_GET['search_id']))
@@ -386,6 +387,7 @@
// Prune "old" search results
+ $old_searches = array();
$result = $db->query('SELECT ident FROM '.$db->prefix.'online') or error('Unable to fetch online list', __FILE__, __LINE__, $db->error());
if ($db->num_rows($result))
diff -urN punbb-1.2.6/upload/userlist.php punbb-1.2.13/upload/userlist.php
--- punbb-1.2.6/upload/userlist.php Thu Mar 3 02:08:18 2005
+++ punbb-1.2.13/upload/userlist.php Sat May 20 17:53:28 2006
@@ -116,7 +116,7 @@
$where_sql[] = 'u.group_id='.$show_group;
// Fetch user count
-$result = $db->query('SELECT COUNT(id) FROM '.$db->prefix.'users AS u'.(!empty($where_sql) ? ' WHERE u.id>1 AND '.implode(' AND ', $where_sql) : '')) or error('Unable to fetch user list count', __FILE__, __LINE__, $db->error());
+$result = $db->query('SELECT COUNT(id) FROM '.$db->prefix.'users AS u WHERE u.id>1'.(!empty($where_sql) ? ' AND '.implode(' AND ', $where_sql) : '')) or error('Unable to fetch user list count', __FILE__, __LINE__, $db->error());
$num_users = $db->result($result);
diff -urN punbb-1.2.6/upload/viewforum.php punbb-1.2.13/upload/viewforum.php
--- punbb-1.2.6/upload/viewforum.php Tue Feb 1 17:16:46 2005
+++ punbb-1.2.13/upload/viewforum.php Thu Sep 22 00:39:30 2005
@@ -242,7 +242,7 @@