punbb-1.2.10/upload/header.php |
punbb-1.2.11/upload/header.php |
131: | 131: |
132: | 132: |
133: // START SUBST - <pun_page> | 133: // START SUBST - <pun_page> |
134: $tpl_main = str_replace('<pun_page>', basename($_SERVER['PHP_SELF'], '.php'), $tpl_main); | 134: $tpl_main = str_replace('<pun_page>', htmlspecialchars(basename($_SERVER['PHP_SELF'], '.php')), $tpl_main); |
135: // END SUBST - <pun_title> | 135: // END SUBST - <pun_title> |
136: | 136: |
137: | 137: |
punbb-1.2.10/upload/register.php |
punbb-1.2.11/upload/register.php |
79: | 79: |
80: else if (isset($_POST['form_sent'])) | 80: else if (isset($_POST['form_sent'])) |
81: { | 81: { |
| 82: // Check that someone from this IP didn't register a user within the last hour (DoS prevention) |
| 83: $result = $db->query('SELECT 1 FROM '.$db->prefix.'users WHERE registration_ip=\''.get_remote_address().'\' AND registered>'.(time() - 3600)) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); |
| 84: |
| 85: if ($db->num_rows($result)) |
| 86: message('A new user was registered with the same IP address as you within the last hour. To prevent registration flooding, at least an hour has to pass between registrations from the same IP. Sorry for the inconvenience.'); |
| 87: |
| 88: |
82: $username = pun_trim($_POST['req_username']); | 89: $username = pun_trim($_POST['req_username']); |
83: $email1 = strtolower(trim($_POST['req_email1'])); | 90: $email1 = strtolower(trim($_POST['req_email1'])); |
84: | 91: |