@@ -362,12 +366,17 @@
message($lang_profile['Move failed'].' '.$pun_config['o_admin_email'].'.');
// Now check the width/height
- list($width, $height, ,) = getimagesize($pun_config['o_avatars_dir'].'/'.$id.'.tmp');
+ list($width, $height, $type,) = getimagesize($pun_config['o_avatars_dir'].'/'.$id.'.tmp');
if (empty($width) || empty($height) || $width > $pun_config['o_avatars_width'] || $height > $pun_config['o_avatars_height'])
{
@unlink($pun_config['o_avatars_dir'].'/'.$id.'.tmp');
message($lang_profile['Too wide or high'].' '.$pun_config['o_avatars_width'].'x'.$pun_config['o_avatars_height'].' '.$lang_profile['pixels'].'.');
}
+ else if ($type == 1 && $uploaded_file['type'] != 'image/gif') // Prevent dodgy uploads
+ {
+ @unlink($pun_config['o_avatars_dir'].'/'.$id.'.tmp');
+ message($lang_profile['Bad type']);
+ }
// Delete any old avatars and put the new one in place
@unlink($pun_config['o_avatars_dir'].'/'.$id.$extensions[0]);
@@ -708,6 +717,14 @@
$form['email'] = strtolower(trim($_POST['req_email']));
if (!is_valid_email($form['email']))
message($lang_common['Invalid e-mail']);
+ }
+
+ // Make sure we got a valid language string
+ if (isset($form['language']))
+ {
+ $form['language'] = preg_replace('#[\.\\\/]#', '', $form['language']);
+ if (!file_exists(PUN_ROOT.'lang/'.$form['language'].'/common.php'))
+ message($lang_common['Bad request']);
}
break;
diff -urN punbb-1.2.6/upload/register.php punbb-1.2.14/upload/register.php
--- punbb-1.2.6/upload/register.php Thu May 5 00:26:04 2005
+++ punbb-1.2.14/upload/register.php Sun Oct 15 18:31:20 2006
@@ -79,6 +79,13 @@
else if (isset($_POST['form_sent']))
{
+ // Check that someone from this IP didn't register a user within the last hour (DoS prevention)
+ $result = $db->query('SELECT 1 FROM '.$db->prefix.'users WHERE registration_ip=\''.get_remote_address().'\' AND registered>'.(time() - 3600)) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error());
+
+ if ($db->num_rows($result))
+ message('A new user was registered with the same IP address as you within the last hour. To prevent registration flooding, at least an hour has to pass between registrations from the same IP. Sorry for the inconvenience.');
+
+
$username = pun_trim($_POST['req_username']);
$email1 = strtolower(trim($_POST['req_email1']));
@@ -166,12 +173,21 @@
$dupe_list[] = $cur_dupe['username'];
}
+ // Make sure we got a valid language string
+ if (isset($_POST['language']))
+ {
+ $language = preg_replace('#[\.\\\/]#', '', $_POST['language']);
+ if (!file_exists(PUN_ROOT.'lang/'.$language.'/common.php'))
+ message($lang_common['Bad request']);
+ }
+ else
+ $language = $pun_config['o_default_lang'];
+
$timezone = intval($_POST['timezone']);
- $language = isset($_POST['language']) ? $_POST['language'] : $pun_config['o_default_lang'];
$save_pass = (!isset($_POST['save_pass']) || $_POST['save_pass'] != '1') ? '0' : '1';
$email_setting = intval($_POST['email_setting']);
- if ($email_setting < 0 && $email_setting > 2) $email_setting = 1;
+ if ($email_setting < 0 || $email_setting > 2) $email_setting = 1;
// Insert the new user into the database. We do this now to get the last inserted id for later use.
$now = time();
diff -urN punbb-1.2.6/upload/search.php punbb-1.2.14/upload/search.php
--- punbb-1.2.6/upload/search.php Thu Jul 7 18:58:46 2005
+++ punbb-1.2.14/upload/search.php Sun Oct 15 18:36:14 2006
@@ -51,6 +51,7 @@
$action = (isset($_GET['action'])) ? $_GET['action'] : null;
$forum = (isset($_GET['forum'])) ? intval($_GET['forum']) : -1;
$sort_dir = (isset($_GET['sort_dir'])) ? (($_GET['sort_dir'] == 'DESC') ? 'DESC' : 'ASC') : 'DESC';
+ if (isset($search_id)) unset($search_id);
// If a search_id was supplied
if (isset($_GET['search_id']))
@@ -169,6 +170,7 @@
$word_count = 0;
$match_type = 'and';
+ $result_list = array();
@reset($keywords_array);
while (list(, $cur_word) = @each($keywords_array))
{
@@ -386,6 +388,7 @@
// Prune "old" search results
+ $old_searches = array();
$result = $db->query('SELECT ident FROM '.$db->prefix.'online') or error('Unable to fetch online list', __FILE__, __LINE__, $db->error());
if ($db->num_rows($result))
@@ -463,7 +466,7 @@
$sql = 'SELECT p.id AS pid, p.poster AS pposter, p.posted AS pposted, p.poster_id, '.$substr_sql.'(p.message, 1, 1000) AS message, t.id AS tid, t.poster, t.subject, t.last_post, t.last_post_id, t.last_poster, t.num_replies, t.forum_id FROM '.$db->prefix.'posts AS p INNER JOIN '.$db->prefix.'topics AS t ON t.id=p.topic_id WHERE p.id IN('.$search_results.') ORDER BY '.$sort_by_sql;
}
else
- $sql = 'SELECT t.id AS tid, t.poster, t.subject, t.last_post, t.last_post_id, t.last_poster, t.num_replies, t.closed, t.forum_id FROM '.$db->prefix.'posts AS p INNER JOIN '.$db->prefix.'topics AS t ON t.id=p.topic_id WHERE t.id IN('.$search_results.') GROUP BY t.id, t.poster, t.subject, t.last_post, t.last_post_id, t.last_poster, t.num_replies, t.closed, t.forum_id'.$group_by_sql.' ORDER BY '.$sort_by_sql;
+ $sql = 'SELECT t.id AS tid, t.poster, t.subject, t.last_post, t.last_post_id, t.last_poster, t.num_replies, t.closed, t.forum_id FROM '.$db->prefix.'topics AS t WHERE t.id IN('.$search_results.') GROUP BY t.id, t.poster, t.subject, t.last_post, t.last_post_id, t.last_poster, t.num_replies, t.closed, t.forum_id'.$group_by_sql.' ORDER BY '.$sort_by_sql;
// Determine the topic or post offset (based on $_GET['p'])
diff -urN punbb-1.2.6/upload/style/imports/base.css punbb-1.2.14/upload/style/imports/base.css
--- punbb-1.2.6/upload/style/imports/base.css Tue Feb 1 17:16:46 2005
+++ punbb-1.2.14/upload/style/imports/base.css Tue Oct 10 17:48:32 2006
@@ -43,12 +43,19 @@
DIV>DIV>DIV.postfootleft, DIV>DIV>DIV.postfootright {PADDING-TOP: 1px; MARGIN-TOP: -1px}
-/* 3.2 This is only visible to IE Windows and cures various bugs. Do not alter comments */
-
-/* Begin IEWin Fix \*/
-* HTML .inbox, * HTML .inform, * HTML .pun, * HTML .intd, * HTML .tclcon {HEIGHT: 1px}
+/* 3.2 This is only visible to IE6 Windows and cures various bugs. Do not alter comments */
+
+/* Begin IE6Win Fix \*/
+* HTML .inbox, * HTML .inform, * HTML .pun, * HTML .intd, * HTML .tclcon {HEIGHT: 1px}
* HTML .inbox DIV.postmsg {WIDTH: 98%}
-/* End of IEWin Fix */
+/* End of IE6Win Fix */
+
+/* 3.3 This is the equivelant of 3.2 but for IE7. It is visible to other browsers
+but does no harm */
+
+/*Begin IE7Win Fix */
+.pun, .pun .inbox, .pun .inform, .pun .intd, .pun .tclcon {min-height: 1px}
+/* End of IE7Win Fix */
/****************************************************************/
/* 4. HIDDEN ELEMENTS */
diff -urN punbb-1.2.6/upload/userlist.php punbb-1.2.14/upload/userlist.php
--- punbb-1.2.6/upload/userlist.php Thu Mar 3 02:08:18 2005
+++ punbb-1.2.14/upload/userlist.php Sat May 20 17:53:30 2006
@@ -116,7 +116,7 @@
$where_sql[] = 'u.group_id='.$show_group;
// Fetch user count
-$result = $db->query('SELECT COUNT(id) FROM '.$db->prefix.'users AS u'.(!empty($where_sql) ? ' WHERE u.id>1 AND '.implode(' AND ', $where_sql) : '')) or error('Unable to fetch user list count', __FILE__, __LINE__, $db->error());
+$result = $db->query('SELECT COUNT(id) FROM '.$db->prefix.'users AS u WHERE u.id>1'.(!empty($where_sql) ? ' AND '.implode(' AND ', $where_sql) : '')) or error('Unable to fetch user list count', __FILE__, __LINE__, $db->error());
$num_users = $db->result($result);
diff -urN punbb-1.2.6/upload/viewforum.php punbb-1.2.14/upload/viewforum.php
--- punbb-1.2.6/upload/viewforum.php Tue Feb 1 17:16:46 2005
+++ punbb-1.2.14/upload/viewforum.php Thu Sep 22 00:39:32 2005
@@ -242,7 +242,7 @@