cvs: pearweb /public_html account-edit.php /sql users.sql
| From: | Helgi �ormar �orbj�rnsson | Date: | Tue, 25 Oct 2005 01:13:01 +0000 |
| Subject: | cvs: pearweb /public_html account-edit.php /sql users.sql | ||
| Groups: | php.pear.cvs php.pear.core | ||
| Request: | Send a blank email to pear-cvs+get-35824@lists.php.net to get a copy of this message | ||
dufuz Mon Oct 24 21:13:01 2005 EDT
Modified files:
/pearweb/public_html account-edit.php
/pearweb/sql users.sql
Log:
Making sure that users do not write essays into their user info fields.
http://cvs.php.net/diff.php/pearweb/public_html/account-edit.php?r1=1.46&r2=1.47&ty=u
Index: pearweb/public_html/account-edit.php
diff -u pearweb/public_html/account-edit.php:1.46 pearweb/public_html/account-edit.php:1.47
--- pearweb/public_html/account-edit.php:1.46 Sun Jul 10 01:12:13 2005
+++ pearweb/public_html/account-edit.php Mon Oct 24 21:13:00 2005
@@ -15,7 +15,7 @@
+----------------------------------------------------------------------+
| Authors: |
+----------------------------------------------------------------------+
- $Id: account-edit.php,v 1.46 2005/07/10 05:12:13 rasmus Exp $
+ $Id: account-edit.php,v 1.47 2005/10/25 01:13:00 dufuz Exp $
*/
auth_require();
@@ -79,7 +79,14 @@
response_footer();
exit();
}
+
$user_data_post[$k] = htmlspecialchars($_POST[$k]);
+
+ if ($k == 'userinfo' && strlen($user_data_post[$k]) >
'255') {
+ report_error('User information exceeds the allowed length (255 chars).');
+ response_footer();
+ exit();
+ }
}
$user = user::update($user_data_post);
@@ -179,7 +186,8 @@
. '<p class="cell_note">(Without leading 0x)</p>',
$row['pgpkeyid'], 40, 20);
$form->addTextarea('userinfo',
- 'Additional User Information:',
+ 'Additional User Information:'
+ . '<p class="cell_note">(limited to 255 chars)</p>',
$row['userinfo'], 40, 5, null);
$form->addTextarea('cvs_acl',
'CVS Access:',
http://cvs.php.net/diff.php/pearweb/sql/users.sql?r1=1.13&r2=1.14&ty=u
Index: pearweb/sql/users.sql
diff -u pearweb/sql/users.sql:1.13 pearweb/sql/users.sql:1.14
--- pearweb/sql/users.sql:1.13 Tue Oct 5 16:29:18 2004
+++ pearweb/sql/users.sql Mon Oct 24 21:13:01 2005
@@ -10,7 +10,7 @@
showemail tinyint(1) default NULL,
registered tinyint(1) default NULL,
admin tinyint(1) default NULL,
- userinfo text,
+ userinfo varchar(255) default NULL,
pgpkeyid varchar(20) default NULL,
pgpkey text,
wishlist varchar(255) NOT NULL default '',