cvs: php-master-web /include functions.inc login.inc /manage user-notes.php

goba Sun Jun 20 05:55:13 2004 EDT Modified files: /php-master-web/include functions.inc login.inc /php-master-web/manage user-notes.php Log: register_globals cleanup - patch by Jakub Vrana

http://cvs.php.net/diff.php/php-master-web/include/functions.inc?r1=1.11&r2=1.12&ty=u Index: php-master-web/include/functions.inc diff -u php-master-web/include/functions.inc:1.11 php-master-web/include/functions.inc:1.12 --- php-master-web/include/functions.inc:1.11 Thu Jun 10 05:21:10 2004 +++ php-master-web/include/functions.inc Sun Jun 20 05:55:13 2004 @@ -1,5 +1,5 @@ <?php -// $Id: functions.inc,v 1.11 2004/06/10 09:21:10 goba Exp $ +// $Id: functions.inc,v 1.12 2004/06/20 09:55:13 goba Exp $ // ----------------------------------------------------------------------------------- @@ -45,6 +45,7 @@ function hsc($str) { return htmlspecialchars($str); } function strip($var) { return (get_magic_quotes_gpc() ? stripslashes($var) : $var); } +function escape($var) { return (get_magic_quotes_gpc() ? $var : addslashes($var)); } function clean($var) { return hsc(strip($var)); } function format_warn($message) { return "<p class=\"warning\">$message</p>"; } function warn($message) { echo format_warn($message); } http://cvs.php.net/diff.php/php-master-web/include/login.inc?r1=1.6&r2=1.7&ty=u Index: php-master-web/include/login.inc diff -u php-master-web/include/login.inc:1.6 php-master-web/include/login.inc:1.7 --- php-master-web/include/login.inc:1.6 Thu Jun 10 05:21:10 2004 +++ php-master-web/include/login.inc Sun Jun 20 05:55:13 2004 @@ -1,7 +1,8 @@ <?php -/* $Id: login.inc,v 1.6 2004/06/10 09:21:10 goba Exp $ */ +/* $Id: login.inc,v 1.7 2004/06/20 09:55:13 goba Exp $ */ include_once 'cvs-auth.inc'; +include_once 'functions.inc'; // User not logged in $user = $pw = FALSE; @@ -36,11 +37,11 @@ <table> <tr> <th align="right">Username:</th> - <td><input type="text" name="user" value="<?php echo htmlspecialchars(stripslashes($user));?>" /> + <td><input type="text" name="user" value="<?php echo clean($user);?>" /> </tr> <tr> <th align="right">Password:</th> - <td><input type="password" name="pw" value="<?php echo htmlspecialchars(stripslashes($pw));?>" /> + <td><input type="password" name="pw" value="<?php echo clean($pw);?>" /> </tr> <tr> <td align="center" colspan="2"><input type="submit" value="Login" /></td> @@ -57,14 +58,14 @@ function query_string() { - if ($_SERVER['QUERY_STRING']) { + if (!empty($_SERVER['QUERY_STRING'])) { return htmlspecialchars("?{$_SERVER['QUERY_STRING']}"); } } function preserve_form_fields() { - if ($_SERVER['REQUEST_METHOD'] == "POST" && @is_array($_POST['in'])) { + if (isset($_POST['in']) && is_array($_POST['in'])) { while (list($k, $v) = each($_POST['in'])) { echo "<input type=\"hidden\" name=\"in[", htmlspecialchars($k), "]\" value=\"", htmlspecialchars($v), "\" />\n"; http://cvs.php.net/diff.php/php-master-web/manage/user-notes.php?r1=1.45&r2=1.46&ty=u Index: php-master-web/manage/user-notes.php diff -u php-master-web/manage/user-notes.php:1.45 php-master-web/manage/user-notes.php:1.46 --- php-master-web/manage/user-notes.php:1.45 Sat Jun 12 13:25:10 2004 +++ php-master-web/manage/user-notes.php Sun Jun 20 05:55:13 2004 @@ -1,5 +1,5 @@ <?php -// $Id: user-notes.php,v 1.45 2004/06/12 17:25:10 goba Exp $ +// $Id: user-notes.php,v 1.46 2004/06/20 09:55:13 goba Exp $ // Force login before action can be taken include_once 'login.inc'; @@ -36,17 +36,20 @@ db_connect(); -if (!isset($action)) { +$action = (isset($_REQUEST['action']) ? $_REQUEST['action'] : ''); +$id = (isset($_REQUEST['id']) ? intval($_REQUEST['id']) : ''); + +if (!$action) { // search ! head(); // someting done before ? - if (isset($id)) { + if ($id) { $str = 'Note #' . $id . ' has been '; - switch ($was) { + switch ($_GET['was']) { case 'delete' : case 'reject' : - $str .= ($was == 'delete') ? 'deleted' : 'rejected'; + $str .= ($_GET['was'] == 'delete') ? 'deleted' : 'rejected'; $str .= ' and removed from the manual'; break; @@ -58,10 +61,10 @@ echo $str . '<br />'; } - if (isset($keyword)) { - $sql = 'SELECT *,UNIX_TIMESTAMP(ts) AS ts FROM note WHERE note LIKE "%' . addslashes($keyword) . '%"'; - if (is_numeric($keyword)) { - $sql .= ' OR id = ' . (int)$keyword; + if (isset($_REQUEST['keyword'])) { + $sql = 'SELECT *,UNIX_TIMESTAMP(ts) AS ts FROM note WHERE note LIKE "%' . escape($_REQUEST['keyword']) . '%"'; + if (is_numeric($_REQUEST['keyword'])) { + $sql .= ' OR id = ' . $_REQUEST['keyword']; } $sql .= ' LIMIT 20'; @@ -69,9 +72,9 @@ if (mysql_num_rows($result) != 0) { while ($row = mysql_fetch_assoc($result)) { $id = $row['id']; - echo "<p class=\"notepreview\">",clean_note(stripslashes($row['note'])), + echo "<p class=\"notepreview\">",clean_note($row['note']), "<br /><span class=\"author\">",date("d-M-Y h:i",$row['ts'])," ", - clean($row['user']),"</span><br />", + hsc($row['user']),"</span><br />", "Note id: $id<br />\n", "<a href=\"http://www.php.net/manual/en/{$row['sect']}.php\">Manual page</a><br />\n", "<a href=\"http://master.php.net/manage/user-notes.php?action=edit+$id\" target=\"_blank\">Edit Note</a><br />", @@ -86,15 +89,13 @@ } } - $searched = isset($keyword) ? $keyword : ''; - ?> <p>Search the notes table.</p> -<form method="post" action="<?php echo $PHP_SELF;?>"> +<form method="post" action="<?php echo $_SERVER['PHP_SELF'];?>"> <table> <tr> <th align="right">Keyword or ID:</th> - <td><input type="text" name="keyword" value="<?php echo $searched; ?>" size="10" maxlength="32" /></td> + <td><input type="text" name="keyword" value="<?php echo (isset($_REQUEST['keyword']) ? $_REQUEST['keyword'] : ''); ?>" size="10" maxlength="32" /></td> </tr> <tr> <td align="center" colspan="2"> @@ -159,7 +160,7 @@ } //if we came from an email, report _something_ - if (isset ($_GET['report'])) { + if (isset($_GET['report'])) { header('Location: user-notes.php?id=' . $id . '&was=' . $action); exit; } else { @@ -173,14 +174,15 @@ case 'preview': case 'edit': if ($id) { + $note = (isset($_POST['note']) ? escape($_POST['note']) : null); if (!isset($note) || $action == 'preview') { head(); } $row = note_get_by_id($id); - $email = isset($email) ? $email : addslashes($row['user']); - $sect = isset($sect) ? $sect : addslashes($row['sect']); + $email = (isset($_POST['email']) ? escape($_POST['email']) : addslashes($row['user'])); + $sect = (isset($_POST['sect']) ? escape($_POST['sect']) : addslashes($row['sect'])); if (isset($note) && $action == "edit") { if (db_query("UPDATE note SET note='$note',user='$email',sect='$sect',updated=NOW() WHERE id=$id")) { @@ -206,22 +208,22 @@ if ($action == "preview") { echo "<p class=\"notepreview\">",clean_note(stripslashes($note)), "<br /><span class=\"author\">",date("d-M-Y h:i",$row['ts'])," ", - clean($email),"</span></p>"; + stripslashes($email),"</span></p>"; } ?> -<form method="post" action="<?php echo $PHP_SELF;?>"> +<form method="post" action="<?php echo $_SERVER['PHP_SELF'];?>"> <input type="hidden" name="id" value="<?php echo $id;?>" /> <table> <tr> <th align="right">Section:</th> - <td><input type="text" name="sect" value="<?php echo clean($sect);?>" size="30" maxlength="80" /></td> + <td><input type="text" name="sect" value="<?php echo stripslashes($sect);?>" size="30" maxlength="80" /></td> </tr> <tr> <th align="right">email:</th> - <td><input type="text" name="email" value="<?php echo clean($email);?>" size="30" maxlength="80" /></td> + <td><input type="text" name="email" value="<?php echo stripslashes($email);?>" size="30" maxlength="80" /></td> </tr> <tr> - <td colspan="2"><textarea name="note" cols="70" rows="15" wrap="virtual"><?php echo clean($note);?></textarea></td> + <td colspan="2"><textarea name="note" cols="70" rows="15"><?php echo stripslashes($note);?></textarea></td> </tr> <tr> <td align="center" colspan="2"> @@ -305,8 +307,8 @@ // Send out a mail to the note submitter, with an envelope sender ignoring bounces function note_mail_user($mailto, $subject, $message) { - $email = clean_antispam($email); - if (is_emailable_address($email)) { + $mailto = clean_antispam($mailto); + if (is_emailable_address($mailto)) { mail( $mailto, $subject, @@ -320,7 +322,6 @@ // Return data about a note by its ID function note_get_by_id($id) { - $id = intval($id); if ($result = db_query("SELECT *, UNIX_TIMESTAMP(ts) AS ts FROM note WHERE id='$id'")) { if (!mysql_num_rows($result)) { die("Note #$id doesn't exist. It has probably been deleted/rejected already.");