punbb-1.2.2/upload/admin_groups.php |
punbb-1.2.13/upload/admin_groups.php |
209: | 209: |
210: $title = trim($_POST['req_title']); | 210: $title = trim($_POST['req_title']); |
211: $user_title = trim($_POST['user_title']); | 211: $user_title = trim($_POST['user_title']); |
212: $read_board = isset($_POST['read_board']) ? $_POST['read_board'] : '1'; | 212: $read_board = isset($_POST['read_board']) ? intval($_POST['read_board']) : '1'; |
213: $post_replies = isset($_POST['post_replies']) ? $_POST['post_replies'] : '1'; | 213: $post_replies = isset($_POST['post_replies']) ? intval($_POST['post_replies']) : '1'; |
214: $post_topics = isset($_POST['post_topics']) ? $_POST['post_topics'] : '1'; | 214: $post_topics = isset($_POST['post_topics']) ? intval($_POST['post_topics']) : '1'; |
215: $edit_posts = isset($_POST['edit_posts']) ? $_POST['edit_posts'] : ($is_admin_group) ? '1' : '0'; | 215: $edit_posts = isset($_POST['edit_posts']) ? intval($_POST['edit_posts']) : ($is_admin_group) ? '1' : '0'; |
216: $delete_posts = isset($_POST['delete_posts']) ? $_POST['delete_posts'] : ($is_admin_group) ? '1' : '0'; | 216: $delete_posts = isset($_POST['delete_posts']) ? intval($_POST['delete_posts']) : ($is_admin_group) ? '1' : '0'; |
217: $delete_topics = isset($_POST['delete_topics']) ? $_POST['delete_topics'] : ($is_admin_group) ? '1' : '0'; | 217: $delete_topics = isset($_POST['delete_topics']) ? intval($_POST['delete_topics']) : ($is_admin_group) ? '1' : '0'; |
218: $set_title = isset($_POST['set_title']) ? $_POST['set_title'] : ($is_admin_group) ? '1' : '0'; | 218: $set_title = isset($_POST['set_title']) ? intval($_POST['set_title']) : ($is_admin_group) ? '1' : '0'; |
219: $search = isset($_POST['search']) ? $_POST['search'] : '1'; | 219: $search = isset($_POST['search']) ? intval($_POST['search']) : '1'; |
220: $search_users = isset($_POST['search_users']) ? $_POST['search_users'] : '1'; | 220: $search_users = isset($_POST['search_users']) ? intval($_POST['search_users']) : '1'; |
221: $edit_subjects_interval = isset($_POST['edit_subjects_interval']) ? intval($_POST['edit_subjects_interval']) : '0'; | 221: $edit_subjects_interval = isset($_POST['edit_subjects_interval']) ? intval($_POST['edit_subjects_interval']) : '0'; |
222: $post_flood = isset($_POST['post_flood']) ? intval($_POST['post_flood']) : '0'; | 222: $post_flood = isset($_POST['post_flood']) ? intval($_POST['post_flood']) : '0'; |
223: $search_flood = isset($_POST['search_flood']) ? intval($_POST['search_flood']) : '0'; | 223: $search_flood = isset($_POST['search_flood']) ? intval($_POST['search_flood']) : '0'; |
229: | 229: |
230: if ($_POST['mode'] == 'add') | 230: if ($_POST['mode'] == 'add') |
231: { | 231: { |
232: $db->query('SELECT 1 FROM '.$db->prefix.'groups WHERE g_title=\''.$db->escape($title).'\'') or error('Unable to check group title collision', __FILE__, __LINE__, $db->error()); | 232: $result = $db->query('SELECT 1 FROM '.$db->prefix.'groups WHERE g_title=\''.$db->escape($title).'\'') or error('Unable to check group title collision', __FILE__, __LINE__, $db->error()); |
233: if ($db->num_rows()) | 233: if ($db->num_rows($result)) |
234: message('There is already a group with the title \''.pun_htmlspecialchars($title).'\'.'); | 234: message('There is already a group with the title \''.pun_htmlspecialchars($title).'\'.'); |
235: | 235: |
236: $db->query('INSERT INTO '.$db->prefix.'groups (g_title, g_user_title, g_read_board, g_post_replies, g_post_topics, g_edit_posts, g_delete_posts, g_delete_topics, g_set_title, g_search, g_search_users, g_edit_subjects_interval, g_post_flood, g_search_flood) VALUES(\''.$db->escape($title).'\', '.$user_title.', '.$read_board.', '.$post_replies.', '.$post_topics.', '.$edit_posts.', '.$delete_posts.', '.$delete_topics.', '.$set_title.', '.$search.', '.$search_users.', '.$edit_subjects_interval.', '.$post_flood.', '.$search_flood.')') or error('Unable to add group', __FILE__, __LINE__, $db->error()); | 236: $db->query('INSERT INTO '.$db->prefix.'groups (g_title, g_user_title, g_read_board, g_post_replies, g_post_topics, g_edit_posts, g_delete_posts, g_delete_topics, g_set_title, g_search, g_search_users, g_edit_subjects_interval, g_post_flood, g_search_flood) VALUES(\''.$db->escape($title).'\', '.$user_title.', '.$read_board.', '.$post_replies.', '.$post_topics.', '.$edit_posts.', '.$delete_posts.', '.$delete_topics.', '.$set_title.', '.$search.', '.$search_users.', '.$edit_subjects_interval.', '.$post_flood.', '.$search_flood.')') or error('Unable to add group', __FILE__, __LINE__, $db->error()); |
242: $db->query('INSERT INTO '.$db->prefix.'forum_perms (group_id, forum_id, read_forum, post_replies, post_topics) VALUES('.$new_group_id.', '.$cur_forum_perm['forum_id'].', '.$cur_forum_perm['read_forum'].', '.$cur_forum_perm['post_replies'].', '.$cur_forum_perm['post_topics'].')') or error('Unable to insert group forum permissions', __FILE__, __LINE__, $db->error()); | 242: $db->query('INSERT INTO '.$db->prefix.'forum_perms (group_id, forum_id, read_forum, post_replies, post_topics) VALUES('.$new_group_id.', '.$cur_forum_perm['forum_id'].', '.$cur_forum_perm['read_forum'].', '.$cur_forum_perm['post_replies'].', '.$cur_forum_perm['post_topics'].')') or error('Unable to insert group forum permissions', __FILE__, __LINE__, $db->error()); |
243: } | 243: } |
244: else | 244: else |
245: $db->query('UPDATE '.$db->prefix.'groups SET g_title=\''.$db->escape($title).'\', g_user_title='.$user_title.', g_read_board='.$read_board.', g_post_replies='.$post_replies.', g_post_topics='.$post_topics.', g_edit_posts='.$edit_posts.', g_delete_posts='.$delete_posts.', g_delete_topics='.$delete_topics.', g_set_title='.$set_title.', g_search='.$search.', g_search_users='.$search_users.', g_edit_subjects_interval='.$edit_subjects_interval.', g_post_flood='.$post_flood.', g_search_flood='.$search_flood.' WHERE g_id='.$_POST['group_id']) or error('Unable to update group', __FILE__, __LINE__, $db->error()); | 245: { |
| 246: $result = $db->query('SELECT 1 FROM '.$db->prefix.'groups WHERE g_title=\''.$db->escape($title).'\' AND g_id!='.intval($_POST['group_id'])) or error('Unable to check group title collision', __FILE__, __LINE__, $db->error()); |
| 247: if ($db->num_rows($result)) |
| 248: message('There is already a group with the title \''.pun_htmlspecialchars($title).'\'.'); |
| 249: |
| 250: $db->query('UPDATE '.$db->prefix.'groups SET g_title=\''.$db->escape($title).'\', g_user_title='.$user_title.', g_read_board='.$read_board.', g_post_replies='.$post_replies.', g_post_topics='.$post_topics.', g_edit_posts='.$edit_posts.', g_delete_posts='.$delete_posts.', g_delete_topics='.$delete_topics.', g_set_title='.$set_title.', g_search='.$search.', g_search_users='.$search_users.', g_edit_subjects_interval='.$edit_subjects_interval.', g_post_flood='.$post_flood.', g_search_flood='.$search_flood.' WHERE g_id='.intval($_POST['group_id'])) or error('Unable to update group', __FILE__, __LINE__, $db->error()); |
| 251: } |
246: | 252: |
247: // Regenerate the quickjump cache | 253: // Regenerate the quickjump cache |
248: require_once PUN_ROOT.'include/cache.php'; | 254: require_once PUN_ROOT.'include/cache.php'; |
punbb-1.2.2/upload/admin_options.php |
punbb-1.2.13/upload/admin_options.php |
38: if (isset($_POST['form_sent'])) | 38: if (isset($_POST['form_sent'])) |
39: { | 39: { |
40: // Lazy referer check (in case base_url isn't correct) | 40: // Lazy referer check (in case base_url isn't correct) |
41: if (!preg_match('#/admin_options\.php#i', $_SERVER['HTTP_REFERER'])) | 41: if (!isset($_SERVER['HTTP_REFERER']) || !preg_match('#/admin_options\.php#i', $_SERVER['HTTP_REFERER'])) |
42: message($lang_common['Bad referrer']); | 42: message($lang_common['Bad referrer']); |
43: | 43: |
44: $form = array_map('trim', $_POST['form']); | 44: $form = array_map('trim', $_POST['form']); |
63: if (substr($form['base_url'], -1) == '/') | 63: if (substr($form['base_url'], -1) == '/') |
64: $form['base_url'] = substr($form['base_url'], 0, -1); | 64: $form['base_url'] = substr($form['base_url'], 0, -1); |
65: | 65: |
| 66: // Clean avatars_dir |
| 67: $form['avatars_dir'] = str_replace("\0", '', $form['avatars_dir']); |
| 68: |
66: // Make sure avatars_dir doesn't end with a slash | 69: // Make sure avatars_dir doesn't end with a slash |
67: if (substr($form['avatars_dir'], -1) == '/') | 70: if (substr($form['avatars_dir'], -1) == '/') |
68: $form['avatars_dir'] = substr($form['avatars_dir'], 0, -1); | 71: $form['avatars_dir'] = substr($form['avatars_dir'], 0, -1); |
117: while (list($key, $input) = @each($form)) | 120: while (list($key, $input) = @each($form)) |
118: { | 121: { |
119: // Only update values that have changed | 122: // Only update values that have changed |
120: if ($pun_config['o_'.$key] != $input) | 123: if (array_key_exists('o_'.$key, $pun_config) && $pun_config['o_'.$key] != $input) |
121: { | 124: { |
122: if ($input != '' || is_int($input)) | 125: if ($input != '' || is_int($input)) |
123: $value = '\''.$db->escape($input).'\''; | 126: $value = '\''.$db->escape($input).'\''; |
124: else | 127: else |
125: $value = 'NULL'; | 128: $value = 'NULL'; |
126: | 129: |
127: $db->query('UPDATE '.$db->prefix.'config SET conf_value='.$value.' WHERE conf_name=\'o_'.$key.'\'') or error('Unable to update board config', __FILE__, __LINE__, $db->error()); | 130: $db->query('UPDATE '.$db->prefix.'config SET conf_value='.$value.' WHERE conf_name=\'o_'.$db->escape($key).'\'') or error('Unable to update board config', __FILE__, __LINE__, $db->error()); |
128: } | 131: } |
129: } | 132: } |
130: | 133: |
229: $d = dir(PUN_ROOT.'lang'); | 232: $d = dir(PUN_ROOT.'lang'); |
230: while (($entry = $d->read()) !== false) | 233: while (($entry = $d->read()) !== false) |
231: { | 234: { |
232: if ($entry != '.' && $entry != '..' && is_dir(PUN_ROOT.'lang/'.$entry)) | 235: if ($entry != '.' && $entry != '..' && is_dir(PUN_ROOT.'lang/'.$entry) && file_exists(PUN_ROOT.'lang/'.$entry.'/common.php')) |
233: $languages[] = $entry; | 236: $languages[] = $entry; |
234: } | 237: } |
235: $d->close(); | 238: $d->close(); |
236: | 239: |
| 240: @natsort($languages); |
| 241: |
237: while (list(, $temp) = @each($languages)) | 242: while (list(, $temp) = @each($languages)) |
238: { | 243: { |
239: if ($pun_config['o_default_lang'] == $temp) | 244: if ($pun_config['o_default_lang'] == $temp) |
261: $styles[] = substr($entry, 0, strlen($entry)-4); | 266: $styles[] = substr($entry, 0, strlen($entry)-4); |
262: } | 267: } |
263: $d->close(); | 268: $d->close(); |
| 269: |
| 270: @natsort($styles); |
264: | 271: |
265: while (list(, $temp) = @each($styles)) | 272: while (list(, $temp) = @each($styles)) |
266: { | 273: { |
punbb-1.2.2/upload/admin_users.php |
punbb-1.2.13/upload/admin_users.php |
49: ?> | 49: ?> |
50: <div class="linkst"> | 50: <div class="linkst"> |
51: <div class="inbox"> | 51: <div class="inbox"> |
52: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 52: <div><a href="javascript:history.go(-1)">Go back</a></div> |
53: </div> | 53: </div> |
54: </div> | 54: </div> |
55: | 55: |
98: | 98: |
99: <div class="linksb"> | 99: <div class="linksb"> |
100: <div class="inbox"> | 100: <div class="inbox"> |
101: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 101: <div><a href="javascript:history.go(-1)">Go back</a></div> |
102: </div> | 102: </div> |
103: </div> | 103: </div> |
104: <?php | 104: <?php |
121: ?> | 121: ?> |
122: <div class="linkst"> | 122: <div class="linkst"> |
123: <div class="inbox"> | 123: <div class="inbox"> |
124: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 124: <div><a href="javascript:history.go(-1)">Go back</a></div> |
125: </div> | 125: </div> |
126: </div> | 126: </div> |
127: | 127: |
202: | 202: |
203: <div class="linksb"> | 203: <div class="linksb"> |
204: <div class="inbox"> | 204: <div class="inbox"> |
205: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 205: <div><a href="javascript:history.go(-1)">Go back</a></div> |
206: </div> | 206: </div> |
207: </div> | 207: </div> |
208: <?php | 208: <?php |
217: | 217: |
218: // trim() all elements in $form | 218: // trim() all elements in $form |
219: $form = array_map('trim', $form); | 219: $form = array_map('trim', $form); |
| 220: $conditions = array(); |
220: | 221: |
221: $posts_greater = trim($_POST['posts_greater']); | 222: $posts_greater = trim($_POST['posts_greater']); |
222: $posts_less = trim($_POST['posts_less']); | 223: $posts_less = trim($_POST['posts_less']); |
257: while (list($key, $input) = @each($form)) | 258: while (list($key, $input) = @each($form)) |
258: { | 259: { |
259: if ($input != '') | 260: if ($input != '') |
260: $conditions[] = 'u.'.$key.' '.$like_command.' \''.str_replace('*', '%', $input).'\''; | 261: $conditions[] = 'u.'.$db->escape($key).' '.$like_command.' \''.$db->escape(str_replace('*', '%', $input)).'\''; |
261: } | 262: } |
262: | 263: |
263: if ($posts_greater != '') | 264: if ($posts_greater != '') |
266: $conditions[] = 'u.num_posts<'.$posts_less; | 267: $conditions[] = 'u.num_posts<'.$posts_less; |
267: | 268: |
268: if ($user_group != 'all') | 269: if ($user_group != 'all') |
269: $conditions[] = 'u.group_id='.$user_group; | 270: $conditions[] = 'u.group_id='.$db->escape($user_group); |
270: | 271: |
271: if (!isset($conditions)) | 272: if (empty($conditions)) |
272: message('You didn\'t enter any search terms.'); | 273: message('You didn\'t enter any search terms.'); |
273: | 274: |
274: | 275: |
278: ?> | 279: ?> |
279: <div class="linkst"> | 280: <div class="linkst"> |
280: <div class="inbox"> | 281: <div class="inbox"> |
281: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 282: <div><a href="javascript:history.go(-1)">Go back</a></div> |
282: </div> | 283: </div> |
283: </div> | 284: </div> |
284: | 285: |
300: <tbody> | 301: <tbody> |
301: <?php | 302: <?php |
302: | 303: |
303: $result = $db->query('SELECT u.id, u.username, u.email, u.title, u.num_posts, u.admin_note, g.g_id, g.g_user_title FROM '.$db->prefix.'users AS u LEFT JOIN '.$db->prefix.'groups AS g ON g.g_id=u.group_id WHERE u.id>1 AND '.implode(' AND ', $conditions).' ORDER BY '.$order_by.' '.$direction) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); | 304: $result = $db->query('SELECT u.id, u.username, u.email, u.title, u.num_posts, u.admin_note, g.g_id, g.g_user_title FROM '.$db->prefix.'users AS u LEFT JOIN '.$db->prefix.'groups AS g ON g.g_id=u.group_id WHERE u.id>1 AND '.implode(' AND ', $conditions).' ORDER BY '.$db->escape($order_by).' '.$db->escape($direction)) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); |
304: if ($db->num_rows($result)) | 305: if ($db->num_rows($result)) |
305: { | 306: { |
306: while ($user_data = $db->fetch_assoc($result)) | 307: while ($user_data = $db->fetch_assoc($result)) |
338: | 339: |
339: <div class="linksb"> | 340: <div class="linksb"> |
340: <div class="inbox"> | 341: <div class="inbox"> |
341: <div><a href="javascript:history.go(-1)" />Go back</a></div> | 342: <div><a href="javascript:history.go(-1)">Go back</a></div> |
342: </div> | 343: </div> |
343: </div> | 344: </div> |
344: <?php | 345: <?php |
punbb-1.2.2/upload/include/email.php |
punbb-1.2.13/upload/include/email.php |
33: // | 33: // |
34: function is_valid_email($email) | 34: function is_valid_email($email) |
35: { | 35: { |
36: return preg_match('#^.{1,}@.{2,}\..{2,}$#', $email); | 36: if (strlen($email) > 50) |
| 37: return false; |
| 38: |
| 39: return preg_match('/^(([^<>()[\]\\.,;:\s@"\']+(\.[^<>()[\]\\.,;:\s@"\']+)*)|("[^"\']+"))@((\[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\])|(([a-zA-Z\d\-]+\.)+[a-zA-Z]{2,}))$/', $email); |
37: } | 40: } |
38: | 41: |
39: | 42: |
65: | 68: |
66: // Default sender/return address | 69: // Default sender/return address |
67: if (!$from) | 70: if (!$from) |
68: $from = '"'.$pun_config['o_board_title'].' '.$lang_common['Mailer'].'" <'.$pun_config['o_webmaster_email'].'>'; | 71: $from = '"'.str_replace('"', '', $pun_config['o_board_title'].' '.$lang_common['Mailer']).'" <'.$pun_config['o_webmaster_email'].'>'; |
69: | |
70: // Make sure the from line doesn't contain a colon (the character, that is :D) | |
71: $from = str_replace(':', ' ', $from); | |
72: | 72: |
73: // Detect what linebreak we should use for the headers | 73: // Do a little spring cleaning |
74: if (strtoupper(substr(PHP_OS, 0, 3) == 'WIN')) | 74: $to = trim(preg_replace('#[\n\r]+#s', '', $to)); |
75: $eol = "\r\n"; | 75: $subject = trim(preg_replace('#[\n\r]+#s', '', $subject)); |
76: else if (strtoupper(substr(PHP_OS, 0, 3) == 'MAC')) | 76: $from = trim(preg_replace('#[\n\r:]+#s', '', $from)); |
77: $eol = "\r"; | |
78: else | |
79: $eol = "\n"; | |
80: | 77: |
81: $headers = 'From: '.$from.$eol.'Date: '.date('r').$eol.'MIME-Version: 1.0'.$eol.'Content-transfer-encoding: 8bit'.$eol.'Content-type: text/plain; charset='.$lang_common['lang_encoding'].$eol.'X-Mailer: PunBB Mailer'; | 78: $headers = 'From: '.$from."\r\n".'Date: '.date('r')."\r\n".'MIME-Version: 1.0'."\r\n".'Content-transfer-encoding: 8bit'."\r\n".'Content-type: text/plain; charset='.$lang_common['lang_encoding']."\r\n".'X-Mailer: PunBB Mailer'; |
82: | 79: |
83: // Make sure all linebreaks are CRLF in message | 80: // Make sure all linebreaks are CRLF in message |
84: $message = str_replace("\n", "\r\n", pun_linebreaks($message)); | 81: $message = str_replace("\n", "\r\n", pun_linebreaks($message)); |
86: if ($pun_config['o_smtp_host'] != '') | 83: if ($pun_config['o_smtp_host'] != '') |
87: smtp_mail($to, $subject, $message, $headers); | 84: smtp_mail($to, $subject, $message, $headers); |
88: else | 85: else |
| 86: { |
| 87: // Change the linebreaks used in the headers according to OS |
| 88: if (strtoupper(substr(PHP_OS, 0, 3)) == 'MAC') |
| 89: $headers = str_replace("\r\n", "\r", $headers); |
| 90: else if (strtoupper(substr(PHP_OS, 0, 3)) != 'WIN') |
| 91: $headers = str_replace("\r\n", "\n", $headers); |
| 92: |
89: mail($to, $subject, $message, $headers); | 93: mail($to, $subject, $message, $headers); |
| 94: } |
90: } | 95: } |
91: | 96: |
92: | 97: |
punbb-1.2.2/upload/include/functions.php |
punbb-1.2.13/upload/include/functions.php |
46: $pun_user = $db->fetch_assoc($result); | 46: $pun_user = $db->fetch_assoc($result); |
47: | 47: |
48: // If user authorisation failed | 48: // If user authorisation failed |
49: if (!isset($pun_user['id']) || md5($cookie_seed.$pun_user['password']) != $cookie['password_hash']) | 49: if (!isset($pun_user['id']) || md5($cookie_seed.$pun_user['password']) !== $cookie['password_hash']) |
50: { | 50: { |
51: pun_setcookie(0, random_pass(8), $expire); | 51: pun_setcookie(0, random_pass(8), $expire); |
52: set_default_user(); | 52: set_default_user(); |
138: // Enable sending of a P3P header by removing // from the following line (try this if login is failing in IE6) | 138: // Enable sending of a P3P header by removing // from the following line (try this if login is failing in IE6) |
139: // @header('P3P: CP="CUR ADM"'); | 139: // @header('P3P: CP="CUR ADM"'); |
140: | 140: |
141: setcookie($cookie_name, serialize(array($user_id, md5($cookie_seed.$password_hash))), $expire, $cookie_path, $cookie_domain, $cookie_secure); | 141: if (version_compare(PHP_VERSION, '5.2.0', '>=')) |
| 142: setcookie($cookie_name, serialize(array($user_id, md5($cookie_seed.$password_hash))), $expire, $cookie_path, $cookie_domain, $cookie_secure, true); |
| 143: else |
| 144: setcookie($cookie_name, serialize(array($user_id, md5($cookie_seed.$password_hash))), $expire, $cookie_path.'; HttpOnly', $cookie_domain, $cookie_secure); |
142: } | 145: } |
143: | 146: |
144: | 147: |
168: } | 171: } |
169: | 172: |
170: if ($cur_ban['username'] != '' && !strcasecmp($pun_user['username'], $cur_ban['username'])) | 173: if ($cur_ban['username'] != '' && !strcasecmp($pun_user['username'], $cur_ban['username'])) |
| 174: { |
| 175: $db->query('DELETE FROM '.$db->prefix.'online WHERE ident=\''.$db->escape($pun_user['username']).'\'') or error('Unable to delete from online list', __FILE__, __LINE__, $db->error()); |
171: message($lang_common['Ban message'].' '.(($cur_ban['expire'] != '') ? $lang_common['Ban message 2'].' '.strtolower(format_time($cur_ban['expire'], true)).'. ' : '').(($cur_ban['message'] != '') ? $lang_common['Ban message 3'].'<br /><br /><strong>'.pun_htmlspecialchars($cur_ban['message']).'</strong><br /><br />' : '<br /><br />').$lang_common['Ban message 4'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.', true); | 176: message($lang_common['Ban message'].' '.(($cur_ban['expire'] != '') ? $lang_common['Ban message 2'].' '.strtolower(format_time($cur_ban['expire'], true)).'. ' : '').(($cur_ban['message'] != '') ? $lang_common['Ban message 3'].'<br /><br /><strong>'.pun_htmlspecialchars($cur_ban['message']).'</strong><br /><br />' : '<br /><br />').$lang_common['Ban message 4'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.', true); |
| 177: } |
172: | 178: |
173: if ($cur_ban['ip'] != '') | 179: if ($cur_ban['ip'] != '') |
174: { | 180: { |
179: $cur_ban_ips[$i] = $cur_ban_ips[$i].'.'; | 185: $cur_ban_ips[$i] = $cur_ban_ips[$i].'.'; |
180: | 186: |
181: if (substr($user_ip, 0, strlen($cur_ban_ips[$i])) == $cur_ban_ips[$i]) | 187: if (substr($user_ip, 0, strlen($cur_ban_ips[$i])) == $cur_ban_ips[$i]) |
| 188: { |
| 189: $db->query('DELETE FROM '.$db->prefix.'online WHERE ident=\''.$db->escape($pun_user['username']).'\'') or error('Unable to delete from online list', __FILE__, __LINE__, $db->error()); |
182: message($lang_common['Ban message'].' '.(($cur_ban['expire'] != '') ? $lang_common['Ban message 2'].' '.strtolower(format_time($cur_ban['expire'], true)).'. ' : '').(($cur_ban['message'] != '') ? $lang_common['Ban message 3'].'<br /><br /><strong>'.pun_htmlspecialchars($cur_ban['message']).'</strong><br /><br />' : '<br /><br />').$lang_common['Ban message 4'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.', true); | 190: message($lang_common['Ban message'].' '.(($cur_ban['expire'] != '') ? $lang_common['Ban message 2'].' '.strtolower(format_time($cur_ban['expire'], true)).'. ' : '').(($cur_ban['message'] != '') ? $lang_common['Ban message 3'].'<br /><br /><strong>'.pun_htmlspecialchars($cur_ban['message']).'</strong><br /><br />' : '<br /><br />').$lang_common['Ban message 4'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.', true); |
| 191: } |
183: } | 192: } |
184: } | 193: } |
185: } | 194: } |
203: $now = time(); | 212: $now = time(); |
204: | 213: |
205: // Fetch all online list entries that are older than "o_timeout_online" | 214: // Fetch all online list entries that are older than "o_timeout_online" |
206: $result = $db->query('SELECT * FROM '.$db->prefix.'online WHERE logged<'.($now-$pun_config['o_timeout_online'])) or error('Unable to delete from online list', __FILE__, __LINE__, $db->error()); | 215: $result = $db->query('SELECT * FROM '.$db->prefix.'online WHERE logged<'.($now-$pun_config['o_timeout_online'])) or error('Unable to fetch old entries from online list', __FILE__, __LINE__, $db->error()); |
207: while ($cur_user = $db->fetch_assoc($result)) | 216: while ($cur_user = $db->fetch_assoc($result)) |
208: { | 217: { |
209: // If the entry is a guest, delete it | 218: // If the entry is a guest, delete it |
675: // | 684: // |
676: function get_remote_address() | 685: function get_remote_address() |
677: { | 686: { |
678: $remote_address = $_SERVER['REMOTE_ADDR']; | 687: return $_SERVER['REMOTE_ADDR']; |
679: | |
680: // If HTTP_X_FORWARDED_FOR is set, we try to grab the first non-LAN IP | |
681: if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) | |
682: { | |
683: if (preg_match_all('/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/', $_SERVER['HTTP_X_FORWARDED_FOR'], $address_list)) | |
684: { | |
685: $lan_ips = array('/^0\./', '/^127\.0\.0\.1/', '/^192\.168\..*/', '/^172\.((1[6-9])|(2[0-9])|(3[0-1]))\..*/', '/^10\..*/', '/^224\..*/', '/^240\..*/'); | |
686: $address_list = preg_replace($lan_ips, null, $address_list[0]); | |
687: | |
688: while (list(, $cur_address) = each($address_list)) | |
689: { | |
690: if ($cur_address) | |
691: { | |
692: $remote_address = $cur_address; | |
693: break; | |
694: } | |
695: } | |
696: } | |
697: } | |
698: | |
699: return $remote_address; | |
700: } | 688: } |
701: | 689: |
702: | 690: |
739: | 727: |
740: if (strpos($lang_common['lang_encoding'], '8859') !== false) | 728: if (strpos($lang_common['lang_encoding'], '8859') !== false) |
741: { | 729: { |
742: $fishy_chars = array(chr(0x81), chr(0x8D), chr(0x8F), chr(0x90), chr(0x9D), chr(0xA0), chr(0xCA)); | 730: $fishy_chars = array(chr(0x81), chr(0x8D), chr(0x8F), chr(0x90), chr(0x9D), chr(0xA0)); |
743: return trim(str_replace($fishy_chars, ' ', $str)); | 731: return trim(str_replace($fishy_chars, ' ', $str)); |
744: } | 732: } |
745: else | 733: else |
803: | 791: |
804: | 792: |
805: // START SUBST - <pun_include "*"> | 793: // START SUBST - <pun_include "*"> |
806: while (preg_match('<pun_include "(.*?)">', $tpl_maint, $cur_include)) | 794: while (preg_match('#<pun_include "([^/\\\\]*?)">#', $tpl_maint, $cur_include)) |
807: { | 795: { |
| 796: if (!file_exists(PUN_ROOT.'include/user/'.$cur_include[1])) |
| 797: error('Unable to process user include <pun_include "'.htmlspecialchars($cur_include[1]).'"> from template maintenance.tpl. There is no such file in folder /include/user/'); |
| 798: |
808: ob_start(); | 799: ob_start(); |
809: include PUN_ROOT.$cur_include[1]; | 800: include PUN_ROOT.'include/user/'.$cur_include[1]; |
810: $tpl_temp = ob_get_contents(); | 801: $tpl_temp = ob_get_contents(); |
811: $tpl_maint = str_replace('<'.$cur_include[0].'>', $tpl_temp, $tpl_maint); | 802: $tpl_maint = str_replace($cur_include[0], $tpl_temp, $tpl_maint); |
812: ob_end_clean(); | 803: ob_end_clean(); |
813: } | 804: } |
814: // END SUBST - <pun_include "*"> | 805: // END SUBST - <pun_include "*"> |
854: ob_start(); | 845: ob_start(); |
855: | 846: |
856: ?> | 847: ?> |
857: <meta http-equiv="refresh" content="<?php echo $pun_config['o_redirect_delay'] ?>;URL=<?php echo $destination_url ?>" /> | 848: <meta http-equiv="refresh" content="<?php echo $pun_config['o_redirect_delay'] ?>;URL=<?php echo str_replace(array('<', '>', '"'), array('<', '>', '"'), $destination_url) ?>" /> |
858: <title><?php echo pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_common['Redirecting'] ?></title> | 849: <title><?php echo pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_common['Redirecting'] ?></title> |
859: <link rel="stylesheet" type="text/css" href="style/<?php echo $pun_user['style'].'.css' ?>" /> | 850: <link rel="stylesheet" type="text/css" href="style/<?php echo $pun_user['style'].'.css' ?>" /> |
860: <?php | 851: <?php |
893: | 884: |
894: | 885: |
895: // START SUBST - <pun_include "*"> | 886: // START SUBST - <pun_include "*"> |
896: while (preg_match('<pun_include "(.*?)">', $tpl_redir, $cur_include)) | 887: while (preg_match('#<pun_include "([^/\\\\]*?)">#', $tpl_redir, $cur_include)) |
897: { | 888: { |
| 889: if (!file_exists(PUN_ROOT.'include/user/'.$cur_include[1])) |
| 890: error('Unable to process user include <pun_include "'.htmlspecialchars($cur_include[1]).'"> from template redirect.tpl. There is no such file in folder /include/user/'); |
| 891: |
898: ob_start(); | 892: ob_start(); |
899: include PUN_ROOT.$cur_include[1]; | 893: include PUN_ROOT.'include/user/'.$cur_include[1]; |
900: $tpl_temp = ob_get_contents(); | 894: $tpl_temp = ob_get_contents(); |
901: $tpl_redir = str_replace('<'.$cur_include[0].'>', $tpl_temp, $tpl_redir); | 895: $tpl_redir = str_replace($cur_include[0], $tpl_temp, $tpl_redir); |
902: ob_end_clean(); | 896: ob_end_clean(); |
903: } | 897: } |
904: // END SUBST - <pun_include "*"> | 898: // END SUBST - <pun_include "*"> |
1034: </div> | 1028: </div> |
1035: <?php | 1029: <?php |
1036: | 1030: |
| 1031: } |
| 1032: |
| 1033: |
| 1034: // |
| 1035: // Unset any variables instantiated as a result of register_globals being enabled |
| 1036: // |
| 1037: function unregister_globals() |
| 1038: { |
| 1039: // Prevent script.php?GLOBALS[foo]=bar |
| 1040: if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])) |
| 1041: exit('I\'ll have a steak sandwich and... a steak sandwich.'); |
| 1042: |
| 1043: // Variables that shouldn't be unset |
| 1044: $no_unset = array('GLOBALS', '_GET', '_POST', '_COOKIE', '_REQUEST', '_SERVER', '_ENV', '_FILES'); |
| 1045: |
| 1046: // Remove elements in $GLOBALS that are present in any of the superglobals |
| 1047: $input = array_merge($_GET, $_POST, $_COOKIE, $_SERVER, $_ENV, $_FILES, isset($_SESSION) && is_array($_SESSION) ? $_SESSION : array()); |
| 1048: foreach ($input as $k => $v) |
| 1049: { |
| 1050: if (!in_array($k, $no_unset) && isset($GLOBALS[$k])) |
| 1051: unset($GLOBALS[$k]); |
| 1052: } |
1037: } | 1053: } |
1038: | 1054: |
1039: | 1055: |
punbb-1.2.2/upload/include/parser.php |
punbb-1.2.13/upload/include/parser.php |
45: $b = array('[b]', '[i]', '[u]', '[/b]', '[/i]', '[/u]'); | 45: $b = array('[b]', '[i]', '[u]', '[/b]', '[/i]', '[/u]'); |
46: $text = str_replace($a, $b, $text); | 46: $text = str_replace($a, $b, $text); |
47: | 47: |
48: // Do the more complex BBCodes (and strip excessive whitespace) | 48: // Do the more complex BBCodes (also strip excessive whitespace and useless quotes) |
49: $a = array( '#\[url=(.*?)\]\s*#i', | 49: $a = array( '#\[url=("|\'|)(.*?)\\1\]\s*#i', |
50: '#\[url\]\s*#i', | 50: '#\[url\]\s*#i', |
51: '#\s*\[/url\]#i', | 51: '#\s*\[/url\]#i', |
52: '#\[email=(.*?)\]\s*#i', | 52: '#\[email=("|\'|)(.*?)\\1\]\s*#i', |
53: '#\[email\]\s*#i', | 53: '#\[email\]\s*#i', |
54: '#\s*\[/email\]#i', | 54: '#\s*\[/email\]#i', |
55: '#\[img\]\s*(.*?)\s*\[/img\]#is', | 55: '#\[img\]\s*(.*?)\s*\[/img\]#is', |
56: '#\[colou?r=(.*?)\](.*?)\[/colou?r\]#is'); | 56: '#\[colou?r=("|\'|)(.*?)\\1\](.*?)\[/colou?r\]#is'); |
57: | 57: |
58: $b = array( '[url=$1]', | 58: $b = array( '[url=$2]', |
59: '[url]', | 59: '[url]', |
60: '[/url]', | 60: '[/url]', |
61: '[email=$1]', | 61: '[email=$2]', |
62: '[email]', | 62: '[email]', |
63: '[/email]', | 63: '[/email]', |
64: '[img]$1[/img]', | 64: '[img]$1[/img]', |
65: '[color=$1]$2[/color]'); | 65: '[color=$2]$3[/color]'); |
66: | 66: |
67: if (!$is_signature) | 67: if (!$is_signature) |
68: { | 68: { |
69: // For non-signatures, we have to do the quote and code tags as well | 69: // For non-signatures, we have to do the quote and code tags as well |
70: $a[] = '#\[quote=("|"|\'|)(.*)\\1\]\s*#i'; | 70: $a[] = '#\[quote=("|"|\'|)(.*?)\\1\]\s*#i'; |
71: $a[] = '#\[quote\]\s*#i'; | 71: $a[] = '#\[quote\]\s*#i'; |
72: $a[] = '#\s*\[/quote\]\s*#i'; | 72: $a[] = '#\s*\[/quote\]\s*#i'; |
73: $a[] = '#\[code\][\r\n]*(.*?)\s*\[/code\]\s*#is'; | 73: $a[] = '#\[code\][\r\n]*(.*?)\s*\[/code\]\s*#is'; |
182: // We found a [code] | 182: // We found a [code] |
183: else if ($c_start < min($c_end, $q_start, $q_end)) | 183: else if ($c_start < min($c_end, $q_start, $q_end)) |
184: { | 184: { |
| 185: // Make sure there's a [/code] and that any new [code] doesn't occur before the end tag |
185: $tmp = strpos($text, '[/code]'); | 186: $tmp = strpos($text, '[/code]'); |
186: if ($tmp === false) | 187: $tmp2 = strpos(substr($text, $c_start+6), '[code]'); |
| 188: if ($tmp2 !== false) |
| 189: $tmp2 += $c_start+6; |
| 190: |
| 191: if ($tmp === false || ($tmp2 !== false && $tmp2 < $tmp)) |
187: { | 192: { |
188: $error = $lang_common['BBCode error'].' '.$lang_common['BBCode error 2']; | 193: $error = $lang_common['BBCode error'].' '.$lang_common['BBCode error 2']; |
189: return; | 194: return; |
259: { | 264: { |
260: global $pun_user; | 265: global $pun_user; |
261: | 266: |
262: $full_url = str_replace(' ', '%20', $url); | 267: $full_url = str_replace(array(' ', '\'', '`', '"'), array('%20', '', '', ''), $url); |
263: if (strpos($url, 'www.') === 0) // If it starts with www, we add http:// | 268: if (strpos($url, 'www.') === 0) // If it starts with www, we add http:// |
264: $full_url = 'http://'.$full_url; | 269: $full_url = 'http://'.$full_url; |
265: else if (strpos($url, 'ftp.') === 0) // Else if it starts with ftp, we add ftp:// | 270: else if (strpos($url, 'ftp.') === 0) // Else if it starts with ftp, we add ftp:// |
299: { | 304: { |
300: global $lang_common, $pun_user; | 305: global $lang_common, $pun_user; |
301: | 306: |
| 307: if (strpos($text, 'quote') !== false) |
| 308: { |
| 309: $text = str_replace('[quote]', '</p><blockquote><div class="incqbox"><p>', $text); |
| 310: $text = preg_replace('#\[quote=("|"|\'|)(.*)\\1\]#seU', '"</p><blockquote><div class=\"incqbox\"><h4>".str_replace(array(\'[\', \'\\"\'), array(\'[\', \'"\'), \'$2\')." ".$lang_common[\'wrote\'].":</h4><p>"', $text); |
| 311: $text = preg_replace('#\[\/quote\]\s*#', '</p></div></blockquote><p>', $text); |
| 312: } |
| 313: |
302: $pattern = array('#\[b\](.*?)\[/b\]#s', | 314: $pattern = array('#\[b\](.*?)\[/b\]#s', |
303: '#\[i\](.*?)\[/i\]#s', | 315: '#\[i\](.*?)\[/i\]#s', |
304: '#\[u\](.*?)\[/u\]#s', | 316: '#\[u\](.*?)\[/u\]#s', |
305: '#\[url\](.*?)\[/url\]#e', | 317: '#\[url\]([^\[]*?)\[/url\]#e', |
306: '#\[url=(.*?)\](.*?)\[/url\]#e', | 318: '#\[url=([^\[]*?)\](.*?)\[/url\]#e', |
307: '#\[email\](.*?)\[/email\]#', | 319: '#\[email\]([^\[]*?)\[/email\]#', |
308: '#\[email=(.*?)\](.*?)\[/email\]#', | 320: '#\[email=([^\[]*?)\](.*?)\[/email\]#', |
309: '#\[color=([a-zA-Z]*|\#?[0-9a-fA-F]{6})](.*?)\[/color\]#s'); | 321: '#\[color=([a-zA-Z]*|\#?[0-9a-fA-F]{6})](.*?)\[/color\]#s'); |
310: | 322: |
311: $replace = array('<strong>$1</strong>', | 323: $replace = array('<strong>$1</strong>', |
319: | 331: |
320: // This thing takes a while! :) | 332: // This thing takes a while! :) |
321: $text = preg_replace($pattern, $replace, $text); | 333: $text = preg_replace($pattern, $replace, $text); |
322: | |
323: if (strpos($text, 'quote') !== false) | |
324: { | |
325: $text = str_replace('[quote]', '</p><blockquote><div class="incqbox"><p>', $text); | |
326: $text = preg_replace('#\[quote=("|"|\'|)(.*)\\1\]#seU', '"</p><blockquote><div class=\"incqbox\"><h4>".str_replace(\'[\', \'[\', \'$2\')." ".$lang_common[\'wrote\'].":</h4><p>"', $text); | |
327: $text = preg_replace('#\[\/quote\]\s*#', '</p></div></blockquote><p>', $text); | |
328: } | |
329: | 334: |
330: return $text; | 335: return $text; |
331: } | 336: } |
punbb-1.2.2/upload/include/search_idx.php |
punbb-1.2.13/upload/include/search_idx.php |
43: | 43: |
44: if (empty($noise_match)) | 44: if (empty($noise_match)) |
45: { | 45: { |
46: $noise_match = array('quote', 'code', 'url', 'img', 'email', 'color', 'colour', '^', '$', '&', '(', ')', '<', '>', '`', '\'', '"', '|', ',', '@', '_', '?', '%', '~', '+', '[', ']', '{', '}', ':', '\\', '/', '=', '#', ';', '!', '*'); | 46: $noise_match = array('[quote', '[code', '[url', '[img', '[email', '[color', '[colour', 'quote]', 'code]', 'url]', 'img]', 'email]', 'color]', 'colour]', '^', '$', '&', '(', ')', '<', '>', '`', '\'', '"', '|', ',', '@', '_', '?', '%', '~', '+', '[', ']', '{', '}', ':', '\\', '/', '=', '#', ';', '!', '*'); |
47: $noise_replace = array('', '', '', '', '', '', '', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '', '', ' ', ' ', ' ', ' ', '', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '' , ' ', ' ', ' ', ' ', ' ', ' '); | 47: $noise_replace = array('', '', '', '', '', '', '', '', '', '', '', '', '', '', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '', '', ' ', ' ', ' ', ' ', '', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '' , ' ', ' ', ' ', ' ', ' ', ' '); |
48: | 48: |
49: $stopwords = (array)@file(PUN_ROOT.'lang/'.$pun_user['language'].'/stopwords.txt'); | 49: $stopwords = (array)@file(PUN_ROOT.'lang/'.$pun_user['language'].'/stopwords.txt'); |
50: $stopwords = array_map('trim', $stopwords); | 50: $stopwords = array_map('trim', $stopwords); |
69: { | 69: { |
70: while (list($i, $word) = @each($words)) | 70: while (list($i, $word) = @each($words)) |
71: { | 71: { |
| 72: $words[$i] = trim($word, '.'); |
72: $num_chars = pun_strlen($word); | 73: $num_chars = pun_strlen($word); |
73: | |
74: if (strrpos($word, '.') == ($num_chars-1)) | |
75: $words[$i] = substr($word, 0, -1); | |
76: | 74: |
77: if ($num_chars < 3 || $num_chars > 20 || in_array($word, $stopwords)) | 75: if ($num_chars < 3 || $num_chars > 20 || in_array($word, $stopwords)) |
78: unset($words[$i]); | 76: unset($words[$i]); |
punbb-1.2.2/upload/install.php |
punbb-1.2.13/upload/install.php |
24: | 24: |
25: | 25: |
26: // The PunBB version this script installs | 26: // The PunBB version this script installs |
27: $punbb_version = '1.2.2'; | 27: $punbb_version = '1.2.13'; |
28: | 28: |
29: | 29: |
30: define('PUN_ROOT', './'); | 30: define('PUN_ROOT', './'); |
165: <fieldset> | 165: <fieldset> |
166: <legend>Enter then name of your database</legend> | 166: <legend>Enter then name of your database</legend> |
167: <div class="infldset"> | 167: <div class="infldset"> |
168: <p>The name of the database that PunBB will be installed into. The database must exist. For SQLite, this is the relative path to the database file. If it doesn't exists, PunBB will attempt to create it.</p> | 168: <p>The name of the database that PunBB will be installed into. The database must exist. For SQLite, this is the relative path to the database file. If the SQLite database file does not exist, PunBB will attempt to create it.</p> |
169: <label for="req_db_name"><strong>Database name</strong><br /><input id="req_db_name" type="text" name="req_db_name" size="30" maxlength="50" /><br /></label> | 169: <label for="req_db_name"><strong>Database name</strong><br /><input id="req_db_name" type="text" name="req_db_name" size="30" maxlength="50" /><br /></label> |
170: </div> | 170: </div> |
171: </fieldset> | 171: </fieldset> |
324: if (preg_match('#\[b\]|\[/b\]|\[u\]|\[/u\]|\[i\]|\[/i\]|\[color|\[/color\]|\[quote\]|\[/quote\]|\[code\]|\[/code\]|\[img\]|\[/img\]|\[url|\[/url\]|\[email|\[/email\]#i', $username)) | 324: if (preg_match('#\[b\]|\[/b\]|\[u\]|\[/u\]|\[i\]|\[/i\]|\[color|\[/color\]|\[quote\]|\[/quote\]|\[code\]|\[/code\]|\[img\]|\[/img\]|\[url|\[/url\]|\[email|\[/email\]#i', $username)) |
325: error('Usernames may not contain any of the text formatting tags (BBCode) that the forum uses. Please go back and correct.'); | 325: error('Usernames may not contain any of the text formatting tags (BBCode) that the forum uses. Please go back and correct.'); |
326: | 326: |
327: if (!preg_match('/^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,4})$/', $email)) | 327: if (strlen($email) > 50 || !preg_match('/^(([^<>()[\]\\.,;:\s@"\']+(\.[^<>()[\]\\.,;:\s@"\']+)*)|("[^"\']+"))@((\[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\])|(([a-zA-Z\d\-]+\.)+[a-zA-Z]{2,}))$/', $email)) |
328: error('The administrator e-mail address you entered is invalid. Please go back and correct.'); | 328: error('The administrator e-mail address you entered is invalid. Please go back and correct.'); |
329: | 329: |
330: | 330: |
346: case 'sqlite': | 346: case 'sqlite': |
347: require PUN_ROOT.'include/dblayer/sqlite.php'; | 347: require PUN_ROOT.'include/dblayer/sqlite.php'; |
348: break; | 348: break; |
| 349: |
| 350: default: |
| 351: error('\''.$db_type.'\' is not a valid database type.'); |
349: } | 352: } |
350: | 353: |
351: // Create the database object (and connect/select db) | 354: // Create the database object (and connect/select db) |
525: break; | 528: break; |
526: } | 529: } |
527: | 530: |
528: $db->query($sql) or error('Unable to create table '.$db_prefix.'online. Please check your settings and try again.', __FILE__, __LINE__, $db->error()); | 531: $db->query($sql) or error('Unable to create table '.$db_prefix.'config. Please check your settings and try again.', __FILE__, __LINE__, $db->error()); |
529: | 532: |
530: | 533: |
531: | 534: |
1420: <div class="fakeform"> | 1423: <div class="fakeform"> |
1421: <div class="inform"> | 1424: <div class="inform"> |
1422: <div class="forminfo"> | 1425: <div class="forminfo"> |
1423: <p>To finalize the installation all you need to do is to <strong>copy and paste the text in the text box below into a file called config.php and then upload this file to the root directory of your PunBB installation</strong>. Make sure there are no linebreaks or spaces before <?php and after ?> in the file. You can later edit config.php if you reconfigure your setup (e.g. change the database password or ).</p> | 1426: <p>To finalize the installation all you need to do is to <strong>copy and paste the text in the text box below into a file called config.php and then upload this file to the root directory of your PunBB installation</strong>. Make sure there are no linebreaks or spaces before <?php. You can later edit config.php if you reconfigure your setup (e.g. change the database password or ).</p> |
1424: <?php if ($alerts != ''): ?> <?php echo $alerts."\n" ?> | 1427: <?php if ($alerts != ''): ?> <?php echo $alerts."\n" ?> |
1425: <?php endif; ?> </div> | 1428: <?php endif; ?> </div> |
1426: <fieldset> | 1429: <fieldset> |
punbb-1.2.2/upload/post.php |
punbb-1.2.13/upload/post.php |
33: | 33: |
34: $tid = isset($_GET['tid']) ? intval($_GET['tid']) : 0; | 34: $tid = isset($_GET['tid']) ? intval($_GET['tid']) : 0; |
35: $fid = isset($_GET['fid']) ? intval($_GET['fid']) : 0; | 35: $fid = isset($_GET['fid']) ? intval($_GET['fid']) : 0; |
36: if ($tid < 1 && $fid < 1) | 36: if ($tid < 1 && $fid < 1 || $tid > 0 && $fid > 0) |
37: message($lang_common['Bad request']); | 37: message($lang_common['Bad request']); |
38: | 38: |
39: // Fetch some info about the topic and/or the forum | 39: // Fetch some info about the topic and/or the forum |
207: | 207: |
208: update_forum($cur_posting['id']); | 208: update_forum($cur_posting['id']); |
209: | 209: |
210: | 210: // Should we send out notifications? |
211: // Get the post time for the previous post in this topic | 211: if ($pun_config['o_subscriptions'] == '1') |
212: $result = $db->query('SELECT posted FROM '.$db->prefix.'posts WHERE topic_id='.$tid.' ORDER BY id DESC LIMIT 1, 1') or error('Unable to fetch post info', __FILE__, __LINE__, $db->error()); | |
213: $previous_post_time = $db->result($result); | |
214: | |
215: // Get any subscribed users that should be notified (banned users are excluded) | |
216: $result = $db->query('SELECT u.id, u.email, u.notify_with_post, u.language FROM '.$db->prefix.'users AS u INNER JOIN '.$db->prefix.'subscriptions AS s ON u.id=s.user_id LEFT JOIN '.$db->prefix.'forum_perms AS fp ON (fp.forum_id='.$cur_posting['id'].' AND fp.group_id=u.group_id) LEFT JOIN '.$db->prefix.'online AS o ON u.id=o.user_id LEFT JOIN '.$db->prefix.'bans AS b ON u.username=b.username WHERE b.username IS NULL AND COALESCE(o.logged, u.last_visit)>'.$previous_post_time.' AND (fp.read_forum IS NULL OR fp.read_forum=1) AND s.topic_id='.$tid.' AND u.id!='.intval($pun_user['id'])) or error('Unable to fetch subscription info', __FILE__, __LINE__, $db->error()); | |
217: if ($db->num_rows($result)) | |
218: { | 212: { |
219: require_once PUN_ROOT.'include/email.php'; | 213: // Get the post time for the previous post in this topic |
| 214: $result = $db->query('SELECT posted FROM '.$db->prefix.'posts WHERE topic_id='.$tid.' ORDER BY id DESC LIMIT 1, 1') or error('Unable to fetch post info', __FILE__, __LINE__, $db->error()); |
| 215: $previous_post_time = $db->result($result); |
| 216: |
| 217: // Get any subscribed users that should be notified (banned users are excluded) |
| 218: $result = $db->query('SELECT u.id, u.email, u.notify_with_post, u.language FROM '.$db->prefix.'users AS u INNER JOIN '.$db->prefix.'subscriptions AS s ON u.id=s.user_id LEFT JOIN '.$db->prefix.'forum_perms AS fp ON (fp.forum_id='.$cur_posting['id'].' AND fp.group_id=u.group_id) LEFT JOIN '.$db->prefix.'online AS o ON u.id=o.user_id LEFT JOIN '.$db->prefix.'bans AS b ON u.username=b.username WHERE b.username IS NULL AND COALESCE(o.logged, u.last_visit)>'.$previous_post_time.' AND (fp.read_forum IS NULL OR fp.read_forum=1) AND s.topic_id='.$tid.' AND u.id!='.intval($pun_user['id'])) or error('Unable to fetch subscription info', __FILE__, __LINE__, $db->error()); |
| 219: if ($db->num_rows($result)) |
| 220: { |
| 221: require_once PUN_ROOT.'include/email.php'; |
220: | 222: |
221: $notification_emails = array(); | 223: $notification_emails = array(); |
222: | 224: |
223: // Loop through subscribed users and send e-mails | 225: // Loop through subscribed users and send e-mails |
224: while ($cur_subscriber = $db->fetch_assoc($result)) | 226: while ($cur_subscriber = $db->fetch_assoc($result)) |
225: { | |
226: // Is the subscription e-mail for $cur_subscriber['language'] cached or not? | |
227: if (!isset($notification_emails[$cur_subscriber['language']])) | |
228: { | 227: { |
229: if (file_exists(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_reply.tpl')) | 228: // Is the subscription e-mail for $cur_subscriber['language'] cached or not? |
| 229: if (!isset($notification_emails[$cur_subscriber['language']])) |
230: { | 230: { |
231: // Load the "new reply" template | 231: if (file_exists(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_reply.tpl')) |
232: $mail_tpl = trim(file_get_contents(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_reply.tpl')); | 232: { |
233: | 233: // Load the "new reply" template |
234: // Load the "new reply full" template (with post included) | 234: $mail_tpl = trim(file_get_contents(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_reply.tpl')); |
235: $mail_tpl_full = trim(file_get_contents(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_reply_full.tpl')); | 235: |
236: | 236: // Load the "new reply full" template (with post included) |
237: // The first row contains the subject (it also starts with "Subject:") | 237: $mail_tpl_full = trim(file_get_contents(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_reply_full.tpl')); |
238: $first_crlf = strpos($mail_tpl, "\n"); | 238: |
239: $mail_subject = trim(substr($mail_tpl, 8, $first_crlf-8)); | 239: // The first row contains the subject (it also starts with "Subject:") |
240: $mail_message = trim(substr($mail_tpl, $first_crlf)); | 240: $first_crlf = strpos($mail_tpl, "\n"); |
241: | 241: $mail_subject = trim(substr($mail_tpl, 8, $first_crlf-8)); |
242: $first_crlf = strpos($mail_tpl_full, "\n"); | 242: $mail_message = trim(substr($mail_tpl, $first_crlf)); |
243: $mail_subject_full = trim(substr($mail_tpl_full, 8, $first_crlf-8)); | 243: |
244: $mail_message_full = trim(substr($mail_tpl_full, $first_crlf)); | 244: $first_crlf = strpos($mail_tpl_full, "\n"); |
245: | 245: $mail_subject_full = trim(substr($mail_tpl_full, 8, $first_crlf-8)); |
246: $mail_subject = str_replace('<topic_subject>', '\''.$cur_posting['subject'].'\'', $mail_subject); | 246: $mail_message_full = trim(substr($mail_tpl_full, $first_crlf)); |
247: $mail_message = str_replace('<topic_subject>', '\''.$cur_posting['subject'].'\'', $mail_message); | 247: |
248: $mail_message = str_replace('<replier>', $username, $mail_message); | 248: $mail_subject = str_replace('<topic_subject>', '\''.$cur_posting['subject'].'\'', $mail_subject); |
249: $mail_message = str_replace('<post_url>', $pun_config['o_base_url'].'/viewtopic.php?pid='.$new_pid.'#p'.$new_pid, $mail_message); | 249: $mail_message = str_replace('<topic_subject>', '\''.$cur_posting['subject'].'\'', $mail_message); |
250: $mail_message = str_replace('<unsubscribe_url>', $pun_config['o_base_url'].'/misc.php?unsubscribe='.$tid, $mail_message); | 250: $mail_message = str_replace('<replier>', $username, $mail_message); |
251: $mail_message = str_replace('<board_mailer>', $pun_config['o_board_title'].' '.$lang_common['Mailer'], $mail_message); | 251: $mail_message = str_replace('<post_url>', $pun_config['o_base_url'].'/viewtopic.php?pid='.$new_pid.'#p'.$new_pid, $mail_message); |
252: | 252: $mail_message = str_replace('<unsubscribe_url>', $pun_config['o_base_url'].'/misc.php?unsubscribe='.$tid, $mail_message); |
253: $mail_subject_full = str_replace('<topic_subject>', '\''.$cur_posting['subject'].'\'', $mail_subject_full); | 253: $mail_message = str_replace('<board_mailer>', $pun_config['o_board_title'].' '.$lang_common['Mailer'], $mail_message); |
254: $mail_message_full = str_replace('<topic_subject>', '\''.$cur_posting['subject'].'\'', $mail_message_full); | 254: |
255: $mail_message_full = str_replace('<replier>', $username, $mail_message_full); | 255: $mail_subject_full = str_replace('<topic_subject>', '\''.$cur_posting['subject'].'\'', $mail_subject_full); |
256: $mail_message_full = str_replace('<message>', $message, $mail_message_full); | 256: $mail_message_full = str_replace('<topic_subject>', '\''.$cur_posting['subject'].'\'', $mail_message_full); |
257: $mail_message_full = str_replace('<post_url>', $pun_config['o_base_url'].'/viewtopic.php?pid='.$new_pid.'#p'.$new_pid, $mail_message_full); | 257: $mail_message_full = str_replace('<replier>', $username, $mail_message_full); |
258: $mail_message_full = str_replace('<unsubscribe_url>', $pun_config['o_base_url'].'/misc.php?unsubscribe='.$tid, $mail_message_full); | 258: $mail_message_full = str_replace('<message>', $message, $mail_message_full); |
259: $mail_message_full = str_replace('<board_mailer>', $pun_config['o_board_title'].' '.$lang_common['Mailer'], $mail_message_full); | 259: $mail_message_full = str_replace('<post_url>', $pun_config['o_base_url'].'/viewtopic.php?pid='.$new_pid.'#p'.$new_pid, $mail_message_full); |
260: | 260: $mail_message_full = str_replace('<unsubscribe_url>', $pun_config['o_base_url'].'/misc.php?unsubscribe='.$tid, $mail_message_full); |
261: $notification_emails[$cur_subscriber['language']][0] = $mail_subject; | 261: $mail_message_full = str_replace('<board_mailer>', $pun_config['o_board_title'].' '.$lang_common['Mailer'], $mail_message_full); |
262: $notification_emails[$cur_subscriber['language']][1] = $mail_message; | 262: |
263: $notification_emails[$cur_subscriber['language']][2] = $mail_subject_full; | 263: $notification_emails[$cur_subscriber['language']][0] = $mail_subject; |
264: $notification_emails[$cur_subscriber['language']][3] = $mail_message_full; | 264: $notification_emails[$cur_subscriber['language']][1] = $mail_message; |
| 265: $notification_emails[$cur_subscriber['language']][2] = $mail_subject_full; |
| 266: $notification_emails[$cur_subscriber['language']][3] = $mail_message_full; |
265: | 267: |
266: $mail_subject = $mail_message = $mail_subject_full = $mail_message_full = null; | 268: $mail_subject = $mail_message = $mail_subject_full = $mail_message_full = null; |
| 269: } |
267: } | 270: } |
268: } | |
269: | 271: |
270: // We have to double check here because the templates could be missing | 272: // We have to double check here because the templates could be missing |
271: if (isset($notification_emails[$cur_subscriber['language']])) | 273: if (isset($notification_emails[$cur_subscriber['language']])) |
272: { | 274: { |
273: if ($cur_subscriber['notify_with_post'] == '0') | 275: if ($cur_subscriber['notify_with_post'] == '0') |
274: pun_mail($cur_subscriber['email'], $notification_emails[$cur_subscriber['language']][0], $notification_emails[$cur_subscriber['language']][1]); | 276: pun_mail($cur_subscriber['email'], $notification_emails[$cur_subscriber['language']][0], $notification_emails[$cur_subscriber['language']][1]); |
275: else | 277: else |
276: pun_mail($cur_subscriber['email'], $notification_emails[$cur_subscriber['language']][2], $notification_emails[$cur_subscriber['language']][3]); | 278: pun_mail($cur_subscriber['email'], $notification_emails[$cur_subscriber['language']][2], $notification_emails[$cur_subscriber['language']][3]); |
| 279: } |
277: } | 280: } |
278: } | 281: } |
279: } | 282: } |
335: if ($qid < 1) | 338: if ($qid < 1) |
336: message($lang_common['Bad request']); | 339: message($lang_common['Bad request']); |
337: | 340: |
338: $result = $db->query('SELECT poster, message FROM '.$db->prefix.'posts WHERE id='.$qid) or error('Unable to fetch quote info', __FILE__, __LINE__, $db->error()); | 341: $result = $db->query('SELECT poster, message FROM '.$db->prefix.'posts WHERE id='.$qid.' AND topic_id='.$tid) or error('Unable to fetch quote info', __FILE__, __LINE__, $db->error()); |
339: if (!$db->num_rows($result)) | 342: if (!$db->num_rows($result)) |
340: message($lang_common['Bad request']); | 343: message($lang_common['Bad request']); |
341: | 344: |
437: else if (isset($_POST['preview'])) | 440: else if (isset($_POST['preview'])) |
438: { | 441: { |
439: require_once PUN_ROOT.'include/parser.php'; | 442: require_once PUN_ROOT.'include/parser.php'; |
440: $message = parse_message($message, $hide_smilies); | 443: $preview_message = parse_message($message, $hide_smilies); |
441: | 444: |
442: ?> | 445: ?> |
443: <div id="postpreview" class="blockpost"> | 446: <div id="postpreview" class="blockpost"> |
446: <div class="inbox"> | 449: <div class="inbox"> |
447: <div class="postright"> | 450: <div class="postright"> |
448: <div class="postmsg"> | 451: <div class="postmsg"> |
449: <?php echo $message."\n" ?> | 452: <?php echo $preview_message."\n" ?> |
450: </div> | 453: </div> |
451: </div> | 454: </div> |
452: </div> | 455: </div> |
488: if ($fid): ?> | 491: if ($fid): ?> |
489: <label><strong><?php echo $lang_common['Subject'] ?></strong><br /><input class="longinput" type="text" name="req_subject" value="<?php if (isset($_POST['req_subject'])) echo pun_htmlspecialchars($subject); ?>" size="80" maxlength="70" tabindex="<?php echo $cur_index++ ?>" /><br /></label> | 492: <label><strong><?php echo $lang_common['Subject'] ?></strong><br /><input class="longinput" type="text" name="req_subject" value="<?php if (isset($_POST['req_subject'])) echo pun_htmlspecialchars($subject); ?>" size="80" maxlength="70" tabindex="<?php echo $cur_index++ ?>" /><br /></label> |
490: <?php endif; ?> <label><strong><?php echo $lang_common['Message'] ?></strong><br /> | 493: <?php endif; ?> <label><strong><?php echo $lang_common['Message'] ?></strong><br /> |
491: <textarea name="req_message" rows="20" cols="95" tabindex="<?php echo $cur_index++ ?>"><?php echo isset($_POST['req_message']) ? pun_htmlspecialchars(trim($_POST['req_message'])) : (isset($quote) ? $quote : ''); ?></textarea><br /></label> | 494: <textarea name="req_message" rows="20" cols="95" tabindex="<?php echo $cur_index++ ?>"><?php echo isset($_POST['req_message']) ? pun_htmlspecialchars($message) : (isset($quote) ? $quote : ''); ?></textarea><br /></label> |
492: <ul class="bblinks"> | 495: <ul class="bblinks"> |
493: <li><a href="help.php#bbcode" onclick="window.open(this.href); return false;"><?php echo $lang_common['BBCode'] ?></a>: <?php echo ($pun_config['p_message_bbcode'] == '1') ? $lang_common['on'] : $lang_common['off']; ?></li> | 496: <li><a href="help.php#bbcode" onclick="window.open(this.href); return false;"><?php echo $lang_common['BBCode'] ?></a>: <?php echo ($pun_config['p_message_bbcode'] == '1') ? $lang_common['on'] : $lang_common['off']; ?></li> |
494: <li><a href="help.php#img" onclick="window.open(this.href); return false;"><?php echo $lang_common['img tag'] ?></a>: <?php echo ($pun_config['p_message_img_tag'] == '1') ? $lang_common['on'] : $lang_common['off']; ?></li> | 497: <li><a href="help.php#img" onclick="window.open(this.href); return false;"><?php echo $lang_common['img tag'] ?></a>: <?php echo ($pun_config['p_message_img_tag'] == '1') ? $lang_common['on'] : $lang_common['off']; ?></li> |
punbb-1.2.2/upload/profile.php |
punbb-1.2.13/upload/profile.php |
59: $result = $db->query('SELECT activate_string, activate_key FROM '.$db->prefix.'users WHERE id='.$id) or error('Unable to fetch new password', __FILE__, __LINE__, $db->error()); | 59: $result = $db->query('SELECT activate_string, activate_key FROM '.$db->prefix.'users WHERE id='.$id) or error('Unable to fetch new password', __FILE__, __LINE__, $db->error()); |
60: list($new_password_hash, $new_password_key) = $db->fetch_row($result); | 60: list($new_password_hash, $new_password_key) = $db->fetch_row($result); |
61: | 61: |
62: if ($key != $new_password_key) | 62: if ($key == '' || $key != $new_password_key) |
63: message($lang_profile['Pass key bad'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.'); | 63: message($lang_profile['Pass key bad'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.'); |
64: else | 64: else |
65: { | 65: { |
194: message($lang_profile['E-mail key bad'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.'); | 194: message($lang_profile['E-mail key bad'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.'); |
195: else | 195: else |
196: { | 196: { |
197: $db->query('UPDATE '.$db->prefix.'users SET email=\''.$new_email.'\', activate_string=NULL, activate_key=NULL WHERE id='.$id) or error('Unable to update e-mail address', __FILE__, __LINE__, $db->error()); | 197: $db->query('UPDATE '.$db->prefix.'users SET email=activate_string, activate_string=NULL, activate_key=NULL WHERE id='.$id) or error('Unable to update e-mail address', __FILE__, __LINE__, $db->error()); |
198: | 198: |
199: message($lang_profile['E-mail updated'], true); | 199: message($lang_profile['E-mail updated'], true); |
200: } | 200: } |
201: } | 201: } |
202: else if (isset($_POST['form_sent'])) | 202: else if (isset($_POST['form_sent'])) |
203: { | 203: { |
| 204: if (pun_hash($_POST['req_password']) !== $pun_user['password']) |
| 205: message($lang_profile['Wrong pass']); |
| 206: |
204: require PUN_ROOT.'include/email.php'; | 207: require PUN_ROOT.'include/email.php'; |
205: | 208: |
206: // Validate the email-address | 209: // Validate the email-address |
264: } | 267: } |
265: | 268: |
266: $page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_common['Profile']; | 269: $page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_common['Profile']; |
267: $required_fields = array('req_new_email' => $lang_profile['New e-mail']); | 270: $required_fields = array('req_new_email' => $lang_profile['New e-mail'], 'req_password' => $lang_common['Password']); |
268: $focus_element = array('change_email', 'req_new_email'); | 271: $focus_element = array('change_email', 'req_new_email'); |
269: require PUN_ROOT.'header.php'; | 272: require PUN_ROOT.'header.php'; |
270: | 273: |
279: <div class="infldset"> | 282: <div class="infldset"> |
280: <input type="hidden" name="form_sent" value="1" /> | 283: <input type="hidden" name="form_sent" value="1" /> |
281: <label><strong><?php echo $lang_profile['New e-mail'] ?></strong><br /><input type="text" name="req_new_email" size="50" maxlength="50" /><br /></label> | 284: <label><strong><?php echo $lang_profile['New e-mail'] ?></strong><br /><input type="text" name="req_new_email" size="50" maxlength="50" /><br /></label> |
| 285: <label><strong><?php echo $lang_common['Password'] ?></strong><br /><input type="password" name="req_password" size="16" maxlength="16" /><br /></label> |
282: <p><?php echo $lang_profile['E-mail instructions'] ?></p> | 286: <p><?php echo $lang_profile['E-mail instructions'] ?></p> |
283: </div> | 287: </div> |
284: </fieldset> | 288: </fieldset> |
303: | 307: |
304: if (isset($_POST['form_sent'])) | 308: if (isset($_POST['form_sent'])) |
305: { | 309: { |
| 310: if (!isset($_FILES['req_file'])) |
| 311: message($lang_profile['No file']); |
| 312: |
306: $uploaded_file = $_FILES['req_file']; | 313: $uploaded_file = $_FILES['req_file']; |
307: | 314: |
308: // Make sure the upload went smooth | 315: // Make sure the upload went smooth |
359: message($lang_profile['Move failed'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.'); | 366: message($lang_profile['Move failed'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.'); |
360: | 367: |
361: // Now check the width/height | 368: // Now check the width/height |
362: list($width, $height, ,) = getimagesize($pun_config['o_avatars_dir'].'/'.$id.'.tmp'); | 369: list($width, $height, $type,) = getimagesize($pun_config['o_avatars_dir'].'/'.$id.'.tmp'); |
363: if ($width > $pun_config['o_avatars_width'] || $height > $pun_config['o_avatars_height']) | 370: if (empty($width) || empty($height) || $width > $pun_config['o_avatars_width'] || $height > $pun_config['o_avatars_height']) |
364: { | 371: { |
365: @unlink($pun_config['o_avatars_dir'].'/'.$id.'.tmp'); | 372: @unlink($pun_config['o_avatars_dir'].'/'.$id.'.tmp'); |
366: message($lang_profile['Too wide or high'].' '.$pun_config['o_avatars_width'].'x'.$pun_config['o_avatars_height'].' '.$lang_profile['pixels'].'.'); | 373: message($lang_profile['Too wide or high'].' '.$pun_config['o_avatars_width'].'x'.$pun_config['o_avatars_height'].' '.$lang_profile['pixels'].'.'); |
367: } | 374: } |
| 375: else if ($type == 1 && $uploaded_file['type'] != 'image/gif') // Prevent dodgy uploads |
| 376: { |
| 377: @unlink($pun_config['o_avatars_dir'].'/'.$id.'.tmp'); |
| 378: message($lang_profile['Bad type']); |
| 379: } |
368: | 380: |
369: // Delete any old avatars and put the new one in place | 381: // Delete any old avatars and put the new one in place |
370: @unlink($pun_config['o_avatars_dir'].'/'.$id.$extensions[0]); | 382: @unlink($pun_config['o_avatars_dir'].'/'.$id.$extensions[0]); |
527: $result = $db->query('SELECT group_id, username FROM '.$db->prefix.'users WHERE id='.$id) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); | 539: $result = $db->query('SELECT group_id, username FROM '.$db->prefix.'users WHERE id='.$id) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); |
528: list($group_id, $username) = $db->fetch_row($result); | 540: list($group_id, $username) = $db->fetch_row($result); |
529: | 541: |
| 542: if ($group_id == PUN_ADMIN) |
| 543: message('Administrators cannot be deleted. In order to delete this user, you must first move him/her to a different user group.'); |
| 544: |
530: if (isset($_POST['delete_user_comply'])) | 545: if (isset($_POST['delete_user_comply'])) |
531: { | 546: { |
532: // If the user is a moderator or an administrator, we remove him/her from the moderator list in all forums as well | 547: // If the user is a moderator or an administrator, we remove him/her from the moderator list in all forums as well |
704: message($lang_common['Invalid e-mail']); | 719: message($lang_common['Invalid e-mail']); |
705: } | 720: } |
706: | 721: |
| 722: // Make sure we got a valid language string |
| 723: if (isset($form['language'])) |
| 724: { |
| 725: $form['language'] = preg_replace('#[\.\\\/]#', '', $form['language']); |
| 726: if (!file_exists(PUN_ROOT.'lang/'.$form['language'].'/common.php')) |
| 727: message($lang_common['Bad request']); |
| 728: } |
| 729: |
707: break; | 730: break; |
708: } | 731: } |
709: | 732: |
795: { | 818: { |
796: $form = extract_elements(array('email_setting', 'save_pass', 'notify_with_post')); | 819: $form = extract_elements(array('email_setting', 'save_pass', 'notify_with_post')); |
797: | 820: |
798: $form['email_setting'] == intval($form['email_setting']); | 821: $form['email_setting'] = intval($form['email_setting']); |
799: if ($form['email_setting'] < 0 && $form['email_setting'] > 2) $form['email_setting'] = 1; | 822: if ($form['email_setting'] < 0 && $form['email_setting'] > 2) $form['email_setting'] = 1; |
800: | 823: |
801: if (!isset($form['save_pass']) || $form['save_pass'] != '1') $form['save_pass'] = '0'; | 824: if (!isset($form['save_pass']) || $form['save_pass'] != '1') $form['save_pass'] = '0'; |
817: | 840: |
818: | 841: |
819: // Singlequotes around non-empty values and NULL for empty values | 842: // Singlequotes around non-empty values and NULL for empty values |
| 843: $temp = array(); |
820: while (list($key, $input) = @each($form)) | 844: while (list($key, $input) = @each($form)) |
821: { | 845: { |
822: $value = ($input !== '') ? '\''.$db->escape($input).'\'' : 'NULL'; | 846: $value = ($input !== '') ? '\''.$db->escape($input).'\'' : 'NULL'; |
824: $temp[] = $key.'='.$value; | 848: $temp[] = $key.'='.$value; |
825: } | 849: } |
826: | 850: |
| 851: if (empty($temp)) |
| 852: message($lang_common['Bad request']); |
| 853: |
827: | 854: |
828: $db->query('UPDATE '.$db->prefix.'users SET '.implode(',', $temp).' WHERE id='.$id) or error('Unable to update profile', __FILE__, __LINE__, $db->error()); | 855: $db->query('UPDATE '.$db->prefix.'users SET '.implode(',', $temp).' WHERE id='.$id) or error('Unable to update profile', __FILE__, __LINE__, $db->error()); |
829: | 856: |
864: } | 891: } |
865: | 892: |
866: | 893: |
867: $result = $db->query('SELECT u.username, u.email, u.title, u.realname, u.url, u.jabber, u.icq, u.msn, u.aim, u.yahoo, u.location, u.use_avatar, u.signature, u.disp_topics, u.disp_posts, u.email_setting, u.save_pass, u.notify_with_post, u.show_smilies, u.show_img, u.show_img_sig, u.show_avatars, u.show_sig, u.timezone, u.style, u.num_posts, u.last_post, u.registered, u.registration_ip, u.admin_note, g.g_id, g.g_user_title FROM '.$db->prefix.'users AS u LEFT JOIN '.$db->prefix.'groups AS g ON g.g_id=u.group_id WHERE u.id='.$id) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); | 894: $result = $db->query('SELECT u.username, u.email, u.title, u.realname, u.url, u.jabber, u.icq, u.msn, u.aim, u.yahoo, u.location, u.use_avatar, u.signature, u.disp_topics, u.disp_posts, u.email_setting, u.save_pass, u.notify_with_post, u.show_smilies, u.show_img, u.show_img_sig, u.show_avatars, u.show_sig, u.timezone, u.language, u.style, u.num_posts, u.last_post, u.registered, u.registration_ip, u.admin_note, g.g_id, g.g_user_title FROM '.$db->prefix.'users AS u LEFT JOIN '.$db->prefix.'groups AS g ON g.g_id=u.group_id WHERE u.id='.$id) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error()); |
868: if (!$db->num_rows($result)) | 895: if (!$db->num_rows($result)) |
869: message($lang_common['Bad request']); | 896: message($lang_common['Bad request']); |
870: | 897: |
966: <div class="infldset"> | 993: <div class="infldset"> |
967: <dl> | 994: <dl> |
968: <dt><?php echo $lang_profile['Jabber'] ?>: </dt> | 995: <dt><?php echo $lang_profile['Jabber'] ?>: </dt> |
969: <dd><?php echo ($user['jabber'] !='') ? $user['jabber'] : $lang_profile['Unknown']; ?></dd> | 996: <dd><?php echo ($user['jabber'] !='') ? pun_htmlspecialchars($user['jabber']) : $lang_profile['Unknown']; ?></dd> |
970: <dt><?php echo $lang_profile['ICQ'] ?>: </dt> | 997: <dt><?php echo $lang_profile['ICQ'] ?>: </dt> |
971: <dd><?php echo ($user['icq'] !='') ? $user['icq'] : $lang_profile['Unknown']; ?></dd> | 998: <dd><?php echo ($user['icq'] !='') ? $user['icq'] : $lang_profile['Unknown']; ?></dd> |
972: <dt><?php echo $lang_profile['MSN'] ?>: </dt> | 999: <dt><?php echo $lang_profile['MSN'] ?>: </dt> |
1128: $d = dir(PUN_ROOT.'lang'); | 1155: $d = dir(PUN_ROOT.'lang'); |
1129: while (($entry = $d->read()) !== false) | 1156: while (($entry = $d->read()) !== false) |
1130: { | 1157: { |
1131: if ($entry != '.' && $entry != '..' && is_dir(PUN_ROOT.'lang/'.$entry)) | 1158: if ($entry != '.' && $entry != '..' && is_dir(PUN_ROOT.'lang/'.$entry) && file_exists(PUN_ROOT.'lang/'.$entry.'/common.php')) |
1132: $languages[] = $entry; | 1159: $languages[] = $entry; |
1133: } | 1160: } |
1134: $d->close(); | 1161: $d->close(); |
1136: // Only display the language selection box if there's more than one language available | 1163: // Only display the language selection box if there's more than one language available |
1137: if (count($languages) > 1) | 1164: if (count($languages) > 1) |
1138: { | 1165: { |
| 1166: natsort($languages); |
1139: | 1167: |
1140: ?> | 1168: ?> |
1141: <label><?php echo $lang_prof_reg['Language'] ?>: <?php echo $lang_prof_reg['Language info'] ?> | 1169: <label><?php echo $lang_prof_reg['Language'] ?>: <?php echo $lang_prof_reg['Language info'] ?> |
1144: | 1172: |
1145: while (list(, $temp) = @each($languages)) | 1173: while (list(, $temp) = @each($languages)) |
1146: { | 1174: { |
1147: if ($pun_user['language'] == $temp) | 1175: if ($user['language'] == $temp) |
1148: echo "\t\t\t\t\t\t\t\t".'<option value="'.$temp.'" selected="selected">'.$temp.'</option>'."\n"; | 1176: echo "\t\t\t\t\t\t\t\t".'<option value="'.$temp.'" selected="selected">'.$temp.'</option>'."\n"; |
1149: else | 1177: else |
1150: echo "\t\t\t\t\t\t\t\t".'<option value="'.$temp.'">'.$temp.'</option>'."\n"; | 1178: echo "\t\t\t\t\t\t\t\t".'<option value="'.$temp.'">'.$temp.'</option>'."\n"; |
1232: <legend><?php echo $lang_profile['Contact details legend'] ?></legend> | 1260: <legend><?php echo $lang_profile['Contact details legend'] ?></legend> |
1233: <div class="infldset"> | 1261: <div class="infldset"> |
1234: <input type="hidden" name="form_sent" value="1" /> | 1262: <input type="hidden" name="form_sent" value="1" /> |
1235: <label><?php echo $lang_profile['Jabber'] ?><br /><input id="jabber" type="text" name="form[jabber]" value="<?php echo $user['jabber'] ?>" size="40" maxlength="75" /><br /></label> | 1263: <label><?php echo $lang_profile['Jabber'] ?><br /><input id="jabber" type="text" name="form[jabber]" value="<?php echo pun_htmlspecialchars($user['jabber']) ?>" size="40" maxlength="75" /><br /></label> |
1236: <label><?php echo $lang_profile['ICQ'] ?><br /><input id="icq" type="text" name="form[icq]" value="<?php echo $user['icq'] ?>" size="12" maxlength="12" /><br /></label> | 1264: <label><?php echo $lang_profile['ICQ'] ?><br /><input id="icq" type="text" name="form[icq]" value="<?php echo $user['icq'] ?>" size="12" maxlength="12" /><br /></label> |
1237: <label><?php echo $lang_profile['MSN'] ?><br /><input id="msn" type="text" name="form[msn]" value="<?php echo pun_htmlspecialchars($user['msn']) ?>" size="40" maxlength="50" /><br /></label> | 1265: <label><?php echo $lang_profile['MSN'] ?><br /><input id="msn" type="text" name="form[msn]" value="<?php echo pun_htmlspecialchars($user['msn']) ?>" size="40" maxlength="50" /><br /></label> |
1238: <label><?php echo $lang_profile['AOL IM'] ?><br /><input id="aim" type="text" name="form[aim]" value="<?php echo pun_htmlspecialchars($user['aim']) ?>" size="20" maxlength="30" /><br /></label> | 1266: <label><?php echo $lang_profile['AOL IM'] ?><br /><input id="aim" type="text" name="form[aim]" value="<?php echo pun_htmlspecialchars($user['aim']) ?>" size="20" maxlength="30" /><br /></label> |
1347: echo "\t\t\t".'<div><input type="hidden" name="form[style]" value="'.$styles[0].'" /></div>'."\n"; | 1375: echo "\t\t\t".'<div><input type="hidden" name="form[style]" value="'.$styles[0].'" /></div>'."\n"; |
1348: else if (count($styles) > 1) | 1376: else if (count($styles) > 1) |
1349: { | 1377: { |
| 1378: natsort($styles); |
1350: | 1379: |
1351: ?> | 1380: ?> |
1352: <div class="inform"> | 1381: <div class="inform"> |
1485: } | 1514: } |
1486: else | 1515: else |
1487: { | 1516: { |
| 1517: if ($pun_user['id'] != $id) |
| 1518: { |
1488: | 1519: |
1489: ?> | 1520: ?> |
1490: <legend><?php echo $lang_profile['Group membership legend'] ?></legend> | 1521: <legend><?php echo $lang_profile['Group membership legend'] ?></legend> |
1492: <select id="group_id" name="group_id"> | 1523: <select id="group_id" name="group_id"> |
1493: <?php | 1524: <?php |
1494: | 1525: |
1495: $result = $db->query('SELECT g_id, g_title FROM '.$db->prefix.'groups WHERE g_id!='.PUN_GUEST.' ORDER BY g_title') or error('Unable to fetch user group list', __FILE__, __LINE__, $db->error()); | 1526: $result = $db->query('SELECT g_id, g_title FROM '.$db->prefix.'groups WHERE g_id!='.PUN_GUEST.' ORDER BY g_title') or error('Unable to fetch user group list', __FILE__, __LINE__, $db->error()); |
1496: | 1527: |
1497: while ($cur_group = $db->fetch_assoc($result)) | 1528: while ($cur_group = $db->fetch_assoc($result)) |
1498: { | 1529: { |
1499: if ($cur_group['g_id'] == $user['g_id'] || ($cur_group['g_id'] == $pun_config['o_default_user_group'] && $user['g_id'] == '')) | 1530: if ($cur_group['g_id'] == $user['g_id'] || ($cur_group['g_id'] == $pun_config['o_default_user_group'] && $user['g_id'] == '')) |
1500: echo "\t\t\t\t\t\t\t\t".'<option value="'.$cur_group['g_id'].'" selected="selected">'.pun_htmlspecialchars($cur_group['g_title']).'</option>'."\n"; | 1531: echo "\t\t\t\t\t\t\t\t".'<option value="'.$cur_group['g_id'].'" selected="selected">'.pun_htmlspecialchars($cur_group['g_title']).'</option>'."\n"; |
1501: else | 1532: else |
1502: echo "\t\t\t\t\t\t\t\t".'<option value="'.$cur_group['g_id'].'">'.pun_htmlspecialchars($cur_group['g_title']).'</option>'."\n"; | 1533: echo "\t\t\t\t\t\t\t\t".'<option value="'.$cur_group['g_id'].'">'.pun_htmlspecialchars($cur_group['g_title']).'</option>'."\n"; |
1503: } | 1534: } |
1504: | 1535: |
1505: ?> | 1536: ?> |
1506: </select> | 1537: </select> |
1510: </div> | 1541: </div> |
1511: <div class="inform"> | 1542: <div class="inform"> |
1512: <fieldset> | 1543: <fieldset> |
| 1544: <?php |
| 1545: |
| 1546: } |
| 1547: |
| 1548: ?> |
1513: <legend><?php echo $lang_profile['Delete ban legend'] ?></legend> | 1549: <legend><?php echo $lang_profile['Delete ban legend'] ?></legend> |
1514: <div class="infldset"> | 1550: <div class="infldset"> |
1515: <input type="submit" name="delete_user" value="<?php echo $lang_profile['Delete user'] ?>" /> <input type="submit" name="ban" value="<?php echo $lang_profile['Ban user'] ?>" /> | 1551: <input type="submit" name="delete_user" value="<?php echo $lang_profile['Delete user'] ?>" /> <input type="submit" name="ban" value="<?php echo $lang_profile['Ban user'] ?>" /> |
punbb-1.2.2/upload/search.php |
punbb-1.2.13/upload/search.php |
51: $action = (isset($_GET['action'])) ? $_GET['action'] : null; | 51: $action = (isset($_GET['action'])) ? $_GET['action'] : null; |
52: $forum = (isset($_GET['forum'])) ? intval($_GET['forum']) : -1; | 52: $forum = (isset($_GET['forum'])) ? intval($_GET['forum']) : -1; |
53: $sort_dir = (isset($_GET['sort_dir'])) ? (($_GET['sort_dir'] == 'DESC') ? 'DESC' : 'ASC') : 'DESC'; | 53: $sort_dir = (isset($_GET['sort_dir'])) ? (($_GET['sort_dir'] == 'DESC') ? 'DESC' : 'ASC') : 'DESC'; |
| 54: if (isset($search_id)) unset($search_id); |
54: | 55: |
55: // If a search_id was supplied | 56: // If a search_id was supplied |
56: if (isset($_GET['search_id'])) | 57: if (isset($_GET['search_id'])) |
65: $keywords = (isset($_GET['keywords'])) ? strtolower(trim($_GET['keywords'])) : null; | 66: $keywords = (isset($_GET['keywords'])) ? strtolower(trim($_GET['keywords'])) : null; |
66: $author = (isset($_GET['author'])) ? strtolower(trim($_GET['author'])) : null; | 67: $author = (isset($_GET['author'])) ? strtolower(trim($_GET['author'])) : null; |
67: | 68: |
| 69: if (preg_match('#^[\*%]+$#', $keywords) || strlen(str_replace(array('*', '%'), '', $keywords)) < 3) |
| 70: $keywords = ''; |
| 71: |
| 72: if (preg_match('#^[\*%]+$#', $author) || strlen(str_replace(array('*', '%'), '', $author)) < 3) |
| 73: $author = ''; |
| 74: |
68: if (!$keywords && !$author) | 75: if (!$keywords && !$author) |
69: message($lang_search['No terms']); | 76: message($lang_search['No terms']); |
70: | 77: |
380: | 387: |
381: | 388: |
382: // Prune "old" search results | 389: // Prune "old" search results |
| 390: $old_searches = array(); |
383: $result = $db->query('SELECT ident FROM '.$db->prefix.'online') or error('Unable to fetch online list', __FILE__, __LINE__, $db->error()); | 391: $result = $db->query('SELECT ident FROM '.$db->prefix.'online') or error('Unable to fetch online list', __FILE__, __LINE__, $db->error()); |
384: | 392: |
385: if ($db->num_rows($result)) | 393: if ($db->num_rows($result)) |
704: if ($pun_config['o_search_all_forums'] == '1' || $pun_user['g_id'] < PUN_GUEST) | 712: if ($pun_config['o_search_all_forums'] == '1' || $pun_user['g_id'] < PUN_GUEST) |
705: echo "\t\t\t\t\t\t\t".'<option value="-1">'.$lang_search['All forums'].'</option>'."\n"; | 713: echo "\t\t\t\t\t\t\t".'<option value="-1">'.$lang_search['All forums'].'</option>'."\n"; |
706: | 714: |
707: $result = $db->query('SELECT c.id AS cid, c.cat_name, f.id AS fid, f.forum_name, f.redirect_url FROM '.$db->prefix.'categories AS c INNER JOIN '.$db->prefix.'forums AS f ON c.id=f.cat_id LEFT JOIN '.$db->prefix.'forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['group_id'].') WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND f.redirect_url IS NULL ORDER BY c.disp_position, c.id, f.disp_position', true) or error('Unable to fetch category/forum list', __FILE__, __LINE__, $db->error()); | 715: $result = $db->query('SELECT c.id AS cid, c.cat_name, f.id AS fid, f.forum_name, f.redirect_url FROM '.$db->prefix.'categories AS c INNER JOIN '.$db->prefix.'forums AS f ON c.id=f.cat_id LEFT JOIN '.$db->prefix.'forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['g_id'].') WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND f.redirect_url IS NULL ORDER BY c.disp_position, c.id, f.disp_position', true) or error('Unable to fetch category/forum list', __FILE__, __LINE__, $db->error()); |
708: | 716: |
709: $cur_category = 0; | 717: $cur_category = 0; |
710: while ($cur_forum = $db->fetch_assoc($result)) | 718: while ($cur_forum = $db->fetch_assoc($result)) |