Re: #28519 [NEW]: TASK: identify orphan user notes and mass assign

Gabor Hojtsy wrote: > Jakub, I have committed your patch. It would be good if you could review > your code and fix the same errors you have fixed in the previous > magic_quotes/register_globals patch - since you submitted this patch > before the cleanup. Here it is. Jakub Vrana

Index: user-notes.php =================================================================== RCS file: /repository/php-master-web/manage/user-notes.php,v retrieving revision 1.47 diff -u -r1.47 user-notes.php --- user-notes.php 25 Jun 2004 15:01:10 -0000 1.47 +++ user-notes.php 25 Jun 2004 15:33:16 -0000 @@ -121,45 +121,52 @@ case 'mass': if (!allow_mass_change($user)) { die("You are not allowed to take this action!"); } head(); + $step = (isset($_REQUEST["step"]) ? $_REQUEST["step"] : 0); $where = array(); - if ($old_sect) - $where[] = "sect = '$old_sect'"; - if ($ids) - $where[] = "id IN ($ids)"; + if (!empty($_REQUEST["old_sect"])) { + $where[] = "sect = '". escape($_REQUEST["old_sect"]) ."'"; + } + if (!empty($_REQUEST["ids"])) { + if (preg_match('~^([0-9]+, *)*[0-9]+$~i', $_REQUEST["ids"])) { + $where[] = "id IN ($_REQUEST[ids])"; + } else { + echo "<p><b>Incorrect format of notes IDs.</b></p>\n"; + $step = 0; + } + } if ($step == 2) { - if (!mysql_query("UPDATE note SET sect = '$new_sect' WHERE " . implode(" AND ", $where))) - echo "<p>Mass change failed: " . mysql_error() . "</p>\n"; - else - echo "<p>Mass change succeeded.</p>\n"; + db_query("UPDATE note SET sect = '". escape($_REQUEST["new_sect"]) ."' WHERE " . implode(" AND ", $where)); + echo "<p>Mass change succeeded.</p>\n"; } elseif ($step == 1) { - if ($new_sect && ($ids || $old_sect)) { - if (!($result = mysql_query("SELECT COUNT(*) FROM note WHERE " . implode(" AND ", $where)))) - echo "<p>SQL error: " . mysql_error() . "</p>\n"; - elseif (!($count = mysql_result($result, 0, 0))) + if (!empty($_REQUEST["new_sect"]) && $where) { + db_query("SELECT COUNT(*) FROM note WHERE " . implode(" AND ", $where)); + if (!($count = mysql_result($result, 0, 0))) { echo "<p>There are no such notes.</p>\n"; - else { + } else { $step = 2; $msg = "Are you sure to change section of <b>$count note(s)</b>"; - $msg .= ($ids ? " with IDs <b>$ids</b>" : ""); - $msg .= ($old_sect ? " from section <b>$old_sect</b>" : ""); - $msg .= " to section <b>$new_sect</b>?"; + $msg .= (!empty($_REQUEST["ids"]) ? " with IDs <b>$_REQUEST[ids]</b>" : ""); + $msg .= (!empty($_REQUEST["old_sect"]) ? " from section <b>$_REQUEST[old_sect]</b>" : ""); + $msg .= " to section <b>$_REQUEST[new_sect]</b>?"; echo "<p>$msg</p>\n"; ?> <form action="<?php echo $_SERVER['PHP_SELF']; ?>?action=mass" method="post"> <input type="hidden" name="step" value="2"> -<input type="hidden" name="old_sect" value="<?php echo $old_sect; ?>"> -<input type="hidden" name="ids" value="<?php echo $ids; ?>"> -<input type="hidden" name="new_sect" value="<?php echo $new_sect; ?>"> +<input type="hidden" name="old_sect" value="<?php echo $_REQUEST["old_sect"]; ?>"> +<input type="hidden" name="ids" value="<?php echo $_REQUEST["ids"]; ?>"> +<input type="hidden" name="new_sect" value="<?php echo $_REQUEST["new_sect"]; ?>"> <input type="submit" value="Change"> </form> <?php } } else { - if (!$new_sect) + if (empty($_REQUEST["new_sect"])) { echo "<p><b>You have to fill-in new section.</b></p>\n"; - if (!$ids && !$old_sect) + } + if (!$where) { echo "<p><b>You have to fill-in curent section or notes IDs (or both).</b></p>\n"; + } } } if ($step < 2) { @@ -170,15 +177,15 @@ <table> <tr> <th align="right">Current section:</th> - <td><input type="text" name="old_sect" value="<?php echo $old_sect; ?>" size="30" maxlength="80" /> (filename without extension)</td> + <td><input type="text" name="old_sect" value="<?php echo $_REQUEST["old_sect"]; ?>" size="30" maxlength="80" /> (filename without extension)</td> </tr> <tr> <th align="right">Notes IDs:</th> - <td><input type="text" name="ids" value="<?php echo $ids; ?>" size="30" maxlength="80" /> (comma separated list)</td> + <td><input type="text" name="ids" value="<?php echo $_REQUEST["ids"]; ?>" size="30" maxlength="80" /> (comma separated list)</td> </tr> <tr> <th align="right">Move to section:</th> - <td><input type="text" name="new_sect" value="<?php echo $new_sect; ?>" size="30" maxlength="80" /></td> + <td><input type="text" name="new_sect" value="<?php echo $_REQUEST["new_sect"]; ?>" size="30" maxlength="80" /></td> </tr> <tr> <td align="center" colspan="2">