Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Topics - thunderstrike

Pages: 1 2 3 4 [5] 6 7
61
Feedback & Suggestions / [FIX] - includes/sessions.php kill guest field after login.
« on: September 09, 2007, 05:43:24 PM »
Detail: This kill guest field in SESSIONS_TABLE after user login.

Find:

Quote
if ($this->user_info['user_id'] != GUEST) {
      $sql = "UPDATE ".USERS_TABLE."
              SET ".get_user_table_field("", "user_lastaction")." = $this->current_time, ".get_user_table_field("", "user_location")." = '$this->user_location'
              WHERE ".get_user_table_field("", "user_id")." = ".$this->user_info['user_id'];
      $site_db->query($sql);           
}

replace:

Code: [Select]
if ($this->user_info['user_id'] != GUEST) {
      $sql = "UPDATE ".USERS_TABLE."
              SET ".get_user_table_field("", "user_lastaction")." = $this->current_time, ".get_user_table_field("", "user_location")." = '$this->user_location'
              WHERE ".get_user_table_field("", "user_id")." = ".$this->user_info['user_id'];
      $site_db->query($sql);
      $sql1 = "DELETE FROM " . SESSIONS_TABLE . " WHERE session_user_id = '" . GUEST . "' AND session_ip = '" . $this->user_ip . "'";
      $site_db->query($sql1);
}

Find:

Quote
if (!isset($prev_session_ips[$row['session_ip']])) {
        $num_guests_online++;       
}

replace:

Code: [Select]
if (!isset($prev_session_ips[$row['session_ip']])) {
        $num_guests_online++;
        if ($row[$user_table_fields['user_level']] >= USER) {
            $num_guests_online--;
        }
}

62
Mods & Plugins (Releases & Support) / [MOD] - Categories users sessions
« on: September 09, 2007, 02:10:45 PM »
Hi, I create MOD for categories users sessions. Each user visit categories can see for session in categories foreach category ID (live). 8)

If category active - show.
If category no active - no show.
If user invisible - show * (same includes/sessions.php file). No show for user (is admin).
No HTML in PHP - all HTML template.

// Step 1

In categories.php file,

find:

Quote
unset($thumbnails);

add after:

Code: [Select]
// MOD: Categories users sessions.
$categories_time_out = time() - 300;
$categories_guest_level_sessions_counter = 0;

$additional_sql = "";
$additional_sql_array = array();
if (isset($additional_user_fields) && is_array($additional_user_fields) && !empty($additional_user_fields)) {
    foreach ($additional_user_fields as $key => $val) {
        $additional_sql .= ", u." . $key;
        $additional_sql_array[] = $key;
    }
}

if (function_exists('get_categories_sessions_info') && $user_info['user_level'] == GUEST) {
    get_categories_sessions_info($site_sess->session_id, 'check_sessions_table');
}

if (function_exists('get_categories_sessions_info') && $user_info['user_level'] >= USER) {
    get_categories_sessions_info($user_info['user_id'], 'check_sessions_table');
}

$sql1 = "

SELECT cst.cat_id, s.session_user_id" . get_user_table_field(", u.", "user_name") . get_user_table_field(", u.", "user_level") . get_user_table_field(", u.", "user_invisible") . $additional_sql . "
FROM (" . SESSIONS_TABLE . " s, " . CATEGORIES_SESSIONS_TABLE . " cst)
LEFT JOIN " . USERS_TABLE . " u ON (" . get_user_table_field("u.", "user_id") . " = s.session_user_id)
WHERE cst.user_id = s.session_user_id AND cst.cat_id = " . $cat_id . " AND cst.cat_sessions_microtime >= " . $categories_time_out . " AND s.session_user_id > '" . GUEST . "'
GROUP BY s.session_user_id
ORDER BY " . get_user_table_field("u.", "user_id") . " ASC, s.session_ip ASC";

$sessions_categories_result = $site_db->query($sql1);
$categories_num_rows = $site_db->get_numrows($sessions_categories_result);

if (isset($categories_num_rows) && $categories_num_rows > 0) {

$categories_sessions_template = "";

$categories_invisible_sessions_counter = 0;
$categories_registered_users_sessions_counter = 0;
$session_categories_id = 0;
while ($sessions_category_row = $site_db->fetch_array($sessions_categories_result)) {
    if ($sessions_category_row[$user_table_fields['user_invisible']] == 1) {
        $categories_invisible_sessions_counter++;
    }
    if ($sessions_category_row[$user_table_fields['user_level']] >= USER) {
        $categories_registered_users_sessions_counter++;
    }    
    $session_categories_user_id = $sessions_category_row['session_user_id'];
    $session_categories_id .= $sessions_category_row['cat_id'];
    $session_categories_name = $sessions_category_row[$user_table_fields['user_name']];
    $session_categories_invisible = $sessions_category_row[$user_table_fields['user_invisible']];
    
    $site_template->register_vars(array(
    "session_categories_user_url" => $site_sess->url(ROOT_PATH . "member.php?action=showprofile&" . URL_USER_ID . "=" . $session_categories_user_id),
    "session_categories_user_id" => (int)$session_categories_user_id,    
    "session_categories_name" => format_text(stripslashes($session_categories_name), 2),
    "session_categories_invisible" => ($session_categories_invisible == 1) ? 1 : 0,
    "invisible_categories_chars" => $lang['categories_notify_invisible_chars'],
    "need_separator" => (isset($categories_num_rows) && $categories_num_rows > 1) ? true : false
    ));
    
    if (isset($additional_sql_array) && is_array($additional_sql_array) && !empty($additional_sql_array)) {
        foreach ($additional_sql_array as $key => $val) {
            if ($val == $sessions_category_row[$val]) {
                $site_template->register_vars($val, $sessions_category_row[$val]);
            }
        }
    }
    $categories_sessions_template .= $site_template->parse_template("categories_sessions_content");
    
    }
    }

$sql2 = "

SELECT s.session_user_id" . $additional_sql . "
FROM (" . SESSIONS_TABLE . " s, " . CATEGORIES_SESSIONS_TABLE . " cst)
LEFT JOIN " . USERS_TABLE . " u ON (" . get_user_table_field("u.", "user_id") . " = s.session_user_id)
WHERE cst.cat_id = " . $cat_id . " AND cst.cat_sessions_microtime >= " . $categories_time_out . " AND s.session_user_id = '" . GUEST . "'
GROUP BY s.session_ip";

$sessions_guest_categories_result = $site_db->query($sql2);
$sessions_guest_num_rows = $site_db->get_numrows($sessions_guest_categories_result);

if (isset($sessions_guest_num_rows) && $sessions_guest_num_rows > 0) {
    while ($sessions_categories_guest_row = $site_db->fetch_array($sessions_guest_categories_result)) {
        $categories_guest_level_sessions_counter++;
    }
}
$total_categories_sessions = $categories_registered_users_sessions_counter + $categories_guest_level_sessions_counter;

// End of MOD: Categories users sessions.

Find:

Quote
$site_template->register_vars(array(
  "msg" => $msg,
  "clickstream" => $clickstream

replace:

Code: [Select]
$site_template->register_vars(array(
  "msg" => $msg,
  "clickstream" => $clickstream,
  // MOD: Image users sessions.  
  "lang_categories_notify_sessions_title" => $lang['categories_notify_sessions_title'],
  "lang_categories_notify_current_sessions_title" => $lang['categories_notify_current_sessions_title'],
  "categories_sessions_template" => (isset($categories_sessions_template)) ? trim($categories_sessions_template) : "",
  "total_invisible_categories_sessions" => (isset($categories_invisible_sessions_counter)) ? preg_replace("/" . $site_template->start . "invisible_count" . $site_template->end . "/siU", (int)$categories_invisible_sessions_counter, $lang['categories_notify_invisible_count']) : preg_replace("/" . $site_template->start . "invisible_count" . $site_template->end . "/siU", 0, $lang['categories_notify_invisible_count']),
  "total_registered_users_categories_sessions" => (isset($categories_registered_users_sessions_counter)) ? preg_replace("/" . $site_template->start . "registered_users_count" . $site_template->end . "/siU", (int)$categories_registered_users_sessions_counter, $lang['categories_notify_registered_users_count']) : preg_replace("/" . $site_template->start . "registered_users_count" . $site_template->end . "/siU", 0, $lang['categories_notify_registered_users_count']),
  "total_guest_level_categories_sessions" => (isset($categories_guest_level_sessions_counter)) ? preg_replace("/" . $site_template->start . "guest_level_count" . $site_template->end . "/siU", (int)$categories_guest_level_sessions_counter, $lang['categories_notify_guest_level_count']) : preg_replace("/" . $site_template->start . "guest_level_count" . $site_template->end . "/siU", 0, $lang['categories_notify_guest_level_count']),
  "total_categories_sessions" => (isset($total_categories_sessions)) ? (int)$total_categories_sessions : false,  
  // End of MOD: Image users sessions.

// Step 2

In includes/functions.php file,

add top ?>:

Code: [Select]
// MOD: Categories sessions user.
function get_categories_sessions_info($user_id = -1, $status = "") {
    global $site_db, $session_info, $cat_id, $user_table_fields, $table_prefix;

    if (!isset($user_id) || $user_id == -1) {
        return;
    }    

    if (!isset($status) || $status == "") {
        return;
    }    

    if (isset($user_id) && $user_id > 0) {
        $user_id = preg_replace("/[^0-9]+/i", "", $user_id);

        if ($user_row = get_user_info($user_id)) {
            if ($user_id != $user_row[$user_table_fields['user_id']]) {
                return;
            }
            unset ($user_row);
        }
        $status = preg_replace("/[^A-Za-z0-9\_]+/i", "", $status);

        

        $date = date('Y-m-d');
        $time = date('H:i:s');
        $microtime = time();        

        switch($status) {            

            case 'check_sessions_table' :            

            if (!defined('CATEGORIES_SESSIONS_TABLE')) {                
                define('CATEGORIES_SESSIONS_TABLE', $table_prefix . "categories_sessions");
            }              

                $sql = "              

                CREATE TABLE IF NOT EXISTS " . CATEGORIES_SESSIONS_TABLE . " (
                field_id INT(11) NOT NULL AUTO_INCREMENT,
                user_id VARCHAR(32) NOT NULL DEFAULT '0',
                cat_id INT(11) NOT NULL DEFAULT '0',
                cat_sessions_date VARCHAR(48) NOT NULL DEFAULT '0000-00-00',
                cat_sessions_time VARCHAR(48) NOT NULL DEFAULT '00:00:00',
                cat_sessions_microtime VARCHAR(255) NOT NULL DEFAULT '0',
                cat_sessions_ip VARCHAR(48) NOT NULL DEFAULT '0.0.0.0',
                PRIMARY KEY (field_id)
                ) TYPE=MyISAM;              

                ";              

                $result = $site_db->query($sql);

                $sql = "SELECT user_id, cat_id FROM " . CATEGORIES_SESSIONS_TABLE . " WHERE user_id = " . $user_id . " AND cat_id = " . $cat_id;
                $result = $site_db->query($sql);
                $num_rows = $site_db->get_numrows($result);
                
                if (isset($num_rows) && $num_rows <= 0) {
                    
                    $cat_sessions_ip = $session_info['session_ip'];

                    $sql1 = "                  

                    INSERT INTO " . CATEGORIES_SESSIONS_TABLE . "
                    (field_id, user_id, cat_id, cat_sessions_date, cat_sessions_time, cat_sessions_microtime, cat_sessions_ip)
                    VALUES (NULL, '" . $user_id . "', '" . $cat_id . "', '" . $date . "', '" . $time . "', '" . $microtime . "', '" . $cat_sessions_ip . "')

                    ";                  

                    $result = $site_db->query($sql1);                    
                }
                
                $get_sessions_microtime = $microtime - 300;
                
                if (isset($num_rows) && $num_rows > 0) {                    
                        $site_db->query("DELETE FROM " . CATEGORIES_SESSIONS_TABLE . " WHERE cat_sessions_microtime < " . $get_sessions_microtime);
                        //$site_db->query("UPDATE " . CATEGORIES_SESSIONS_TABLE . " SET cat_sessions_microtime = '" . $microtime . "', cat_id = '" . $cat_id . "' WHERE user_id = '" . $user_id . "'");
                }
                
                return $user_id;
                break;        
        }
    }
}
// End of MOD: Categories sessions user.

// Step 3

If no install:

http://www.4homepages.de/forum/index.php?topic=18572.0
or
http://www.4homepages.de/forum/index.php?topic=18573.0

find:

Quote
$this->current_time = time();

add before:

Code: [Select]
$this->current_date = date('Y-m-d');
$this->current_clocktime = date('H:i:s');

Find:

Quote
function logout($user_id) {
    global $site_db;
    $sql = "DELETE FROM ".SESSIONS_TABLE."
            WHERE session_id = '".addslashes($this->session_id)."' OR session_user_id = " . $user_id;
    $site_db->query($sql);    
    
    $this->set_cookie_data("userpass", "", 0);
    $this->set_cookie_data("userid", GUEST);

    $this->session_info = array();

    return true;
  }

replace:

Code: [Select]
function logout($user_id) {
    global $site_db;
    $sql = "DELETE FROM ".SESSIONS_TABLE."
            WHERE session_id = '".addslashes($this->session_id)."' OR session_user_id = " . $user_id;
    $site_db->query($sql);
    $sql = "DELETE FROM " . CATEGORIES_SESSIONS_TABLE . "
            WHERE user_id = '" . addslashes($this->session_id) ."' OR user_id = " . $user_id;
    $site_db->query($sql);
    
    $this->set_cookie_data("userpass", "", 0);
    $this->set_cookie_data("userid", GUEST);

    $this->session_info = array();

    return true;
  }

Find:

Quote
function update_session() {
    global $site_db;

replace:

Code: [Select]
function update_session() {
    global $site_db, $cat_id, $url;

If no install:

http://www.4homepages.de/forum/index.php?topic=18572.0
or
http://www.4homepages.de/forum/index.php?topic=18573.0

replace:

Code: [Select]
function update_session() {
    global $site_db, $cat_id, $image_id, $url;

Find:

Quote
$this->session_info['session_lastaction'] = $this->current_time;
$this->session_info['session_location'] = $this->user_location;
$this->session_info['session_ip'] = $this->user_ip;

add after:

Code: [Select]
if (preg_match("/categories.php/", $url)) {          
    
    $sql = "REPLACE INTO " . CATEGORIES_SESSIONS_TABLE . "
            (field_id, user_id, cat_id, cat_sessions_date, cat_sessions_time, cat_sessions_microtime)
            VALUES (NULL, '" . addslashes($this->session_id) . "', '" . $cat_id . "', '" . $this->current_date . "', '" . $this->current_clocktime . "', $this->current_time)                  
            
           ";          
    $site_db->query($sql);
    
    }

Find:

Quote
if ($this->user_info['user_id'] != GUEST) {
      $sql = "UPDATE ".USERS_TABLE."
              SET ".get_user_table_field("", "user_lastaction")." = $this->current_time, ".get_user_table_field("", "user_location")." = '$this->user_location'
              WHERE ".get_user_table_field("", "user_id")." = ".$this->user_info['user_id'];
      $site_db->query($sql);            
    }

replace:

Code: [Select]
if ($this->user_info['user_id'] != GUEST) {
      $sql = "UPDATE ".USERS_TABLE."
              SET ".get_user_table_field("", "user_lastaction")." = $this->current_time, ".get_user_table_field("", "user_location")." = '$this->user_location'
              WHERE ".get_user_table_field("", "user_id")." = ".$this->user_info['user_id'];
      $site_db->query($sql);                  
      $sql3 = "DELETE FROM " . CATEGORIES_SESSIONS_TABLE . " WHERE user_id = '" . GUEST . "' AND cat_sessions_ip = '" . $this->user_ip . "'";
      $site_db->query($sql3);
}

// Step 4

In lang/english/main.php file,

add top ?>:

Code: [Select]
// MOD: Categories sessions.
//-----------------------------------------------------
//--- Categories sessions -----------------------------
//-----------------------------------------------------
$lang['categories_notify_count'] = "Total: {count}";
$lang['categories_notify_sessions_title'] = "Currently active image users: ";
$lang['categories_notify_invisible_chars'] = "*";
$lang['categories_notify_current_sessions_title'] = "There are currently ";
$lang['categories_notify_registered_users_count'] = "<b>{registered_users_count}</b> registered user(s) ";
$lang['categories_notify_invisible_count'] = "({invisible_count} among them invisible) ";
$lang['categories_notify_guest_level_count'] = "and <b>{guest_level_count}</b> guest(s) online.";

// Step 5

In templates/your_template/categories.html file,

find:

Quote
{paging}
<br />
<br />

add after:

Code: [Select]
{if is_admin}<! -- Categories users sessions -- >{endif is_admin}  
<table width="100%" border="0" cellpadding="0" cellspacing="0">
                          <tr>
                            <td valign="top" class="head1">&nbsp;{lang_categories_notify_sessions_title} {total_categories_sessions}</td>
 </tr>
   </table>  
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
 <tr>  
   <td class="row1">&nbsp;{lang_categories_notify_current_sessions_title} {total_registered_users_categories_sessions} {total_invisible_categories_sessions} {total_guest_level_categories_sessions}</td>
 </tr>
    </table>
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
 <tr>
  {if categories_sessions_template}<td width="100%" class="row1" />&nbsp;{categories_sessions_template}</td>{endif categories_sessions_template}
  {if sessions_categories_no_content_msg}<td width="100%" class="row1" align="center" /><b>{sessions_categories_no_content_msg}</b></td>{endif sessions_categories_no_content_msg}
 </tr>  
                        </table>          
 <br />
 {if is_admin}<! -- End of Categories users sessions -- >{endif is_admin}

// Step 6

In includes/constants.php file,

find:

Quote
define('CATEGORIES_TABLE', $table_prefix.'categories');

add after:

Code: [Select]
define('CATEGORIES_SESSIONS_TABLE', $table_prefix . "categories_sessions");

// Step 7

In templates/your_template , create file: categories_sessions_content.html.

Add:

Code: [Select]
{if is_admin}{if session_comment_invisible}<a href="{session_comment_user_url}"><b>{session_comment_name}</b></a>{invisible_comment_chars}{if need_separator} {endif need_separator}&nbsp;{endif session_comment_invisible}{endif is_admin}
{if user_loggedin}{ifnot session_comment_invisible}<a href="{session_comment_user_url}"><b>{session_comment_name}</b></a>{if need_separator} {endif need_separator}&nbsp;{endifnot session_comment_invisible}{endif user_loggedin}

All done. 8)

(For fix - reset table).

63
Feedback & Suggestions / [FIX] - admin/validateimages.php
« on: September 08, 2007, 08:01:18 PM »
Detail: Check variable for right result.

Find:

Quote
$image_name = trim($HTTP_POST_VARS['image_name']);
  $image_description = trim($HTTP_POST_VARS['image_description']);

  $image_keywords = trim($HTTP_POST_VARS['image_keywords']);
  $image_keywords = preg_replace("/[\n\r]/is", " ", $image_keywords);
  $image_keywords = str_replace(","," ",$image_keywords);
  $image_keywords = ereg_replace("( ){2,}", " ", $image_keywords);

  $cat_id = intval($HTTP_POST_VARS['cat_id']);
  $user_id = (intval($HTTP_POST_VARS['user_id']) != 0) ? intval($HTTP_POST_VARS['user_id']) : $user_info['user_id'];

  $image_date = (trim($HTTP_POST_VARS['image_date']) != "") ? "UNIX_TIMESTAMP('".trim($HTTP_POST_VARS['image_date'])."')" : time();

  $remote_file = trim($HTTP_POST_VARS['remote_file']);
  $remote_thumb_file = trim($HTTP_POST_VARS['remote_thumb_file']);

  $old_file_name = trim($HTTP_POST_VARS['old_file_name']);
  $old_thumb_file_name = trim($HTTP_POST_VARS['old_thumb_file_name']);

  $image_download_url = trim($HTTP_POST_VARS['image_download_url']);

replace:

Code: [Select]
$image_name = (isset($HTTP_POST_VARS['image_name'])) ? trim($HTTP_POST_VARS['image_name']) : "";
$image_name = preg_replace("/[^A-Za-z0-9_-]+/i", "", $image_name);
$image_description = (isset($HTTP_POST_VARS['image_description']) && preg_match("/[a-zA-Z0-9\.\,;:%&#@!\^-_~`\"'\[\]\{\}\*\/\?\(\)\n\r]/", $HTTP_POST_VARS['image_description'])) ? trim($HTTP_POST_VARS['image_description']) : "";

$cat_id = (isset($HTTP_POST_VARS['cat_id'])) ? intval($HTTP_POST_VARS['cat_id']) : 0;
$cat_id = preg_replace("[^0-9]+/i", "", $cat_id);
$user_id = (isset($HTTP_POST_VARS['user_id']) && intval($HTTP_POST_VARS['user_id']) != 0) ? intval($HTTP_POST_VARS['user_id']) : $user_info['user_id'];
$user_id = preg_replace("/[^0-9]+/i", "", $user_id);

$image_date = (isset($HTTP_POST_VARS['image_date']) && trim($HTTP_POST_VARS['image_date']) != "") ? "UNIX_TIMESTAMP('".trim($HTTP_POST_VARS['image_date'])."')" : time();

$remote_file = (isset($HTTP_POST_VARS['remote_file'])) ? trim($HTTP_POST_VARS['remote_file']) : "";
$remote_thumb_file = (isset($HTTP_POST_VARS['remote_thumb_file'])) ? trim($HTTP_POST_VARS['remote_thumb_file']) : "";

$old_file_name = (isset($HTTP_POST_VARS['old_file_name'])) ? trim($HTTP_POST_VARS['old_file_name']) : "";
$old_thumb_file_name = (isset($HTTP_POST_VARS['old_thumb_file_name'])) ? trim($HTTP_POST_VARS['old_thumb_file_name']) : "";

$image_download_url = (isset($HTTP_POST_VARS['image_download_url']) && preg_match('@^(?:http://)?([^/]+)@i', $HTTP_POST_VARS['image_download_url'])) ? trim($HTTP_POST_VARS['image_download_url']) : "";

64
Feedback & Suggestions / [FIX] - admin/user.php
« on: September 08, 2007, 07:50:04 PM »
Detail: Check variable for right result.

Find:

Quote
$delcomments = intval($HTTP_POST_VARS['delcomments']);
$delimages = intval($HTTP_POST_VARS['delimages']);

replace:

Code: [Select]
$delcomments = (isset($HTTP_POST_VARS['delcomments'])) ? intval($HTTP_POST_VARS['delcomments']) : 0;
$delimages = (isset($HTTP_POST_VARS['delimages'])) ? intval($HTTP_POST_VARS['delimages']) : 0;

Find:

Quote
$user_ids = $HTTP_POST_VARS['deleteusers'];

replace:

Code: [Select]
$user_ids = intval($HTTP_POST_VARS['deleteusers']);

Action: Updateuser

find:

Quote
$user_id = (isset($HTTP_POST_VARS['user_id'])) ? intval($HTTP_POST_VARS['user_id']) : intval($HTTP_GET_VARS['user_id']);

  $user_level = intval($HTTP_POST_VARS['user_level']);
  $user_name = trim($HTTP_POST_VARS['user_name']);
  $user_email = trim($HTTP_POST_VARS['user_email']);
  $user_password = trim($HTTP_POST_VARS['user_password']);
  $user_homepage = trim($HTTP_POST_VARS['user_homepage']);
  $user_icq = (intval(trim($HTTP_POST_VARS['user_icq']))) ? intval(trim($HTTP_POST_VARS['user_icq'])) : "";
  $user_joindate = trim($HTTP_POST_VARS['user_joindate']);
  $user_lastaction = trim($HTTP_POST_VARS['user_lastaction']);
  $user_showemail = intval($HTTP_POST_VARS['user_showemail']);
  $user_allowemails = intval($HTTP_POST_VARS['user_allowemails']);
  $user_invisible = intval($HTTP_POST_VARS['user_invisible']);

replace:

Code: [Select]
  $user_id = (isset($HTTP_POST_VARS['user_id'])) ? intval($HTTP_POST_VARS['user_id']) : intval($HTTP_GET_VARS['user_id']);
  $user_id = preg_replace("/[^0-9]+/i", "", $user_id);

  $user_level = (isset($HTTP_POST_VARS['user_level'])) ? intval($HTTP_POST_VARS['user_level']) : 0;
  $user_level = preg_replace("/[^0-9]+/i", "", $user_level);
  $user_name = (isset($HTTP_POST_VARS['user_name'])) ? trim($HTTP_POST_VARS['user_name']) : "";
  $user_name = preg_replace("/[^A-Za-z0-9_-]+/i", "", $user_name);
  $user_email = isset($HTTP_POST_VARS['user_email'])) ? trim($HTTP_POST_VARS['user_email']) : "";
  if (isset($user_email)) { 
      if (function_exists('mailchek') && !function_exists('check_email') && mailchek($user_email, 2)) {         
          } elseif (function_exists('check_email') && !function_exists('mailchek') && check_email($user_email)) {             
      }             
  }
  $user_password = (isset($HTTP_POST_VARS['user_password'])) ? trim($HTTP_POST_VARS['user_password']) : "";
  $user_password = preg_replace("/[^A-Za-z0-9_-]+/i", "", $user_password);
  $user_homepage = (isset($HTTP_POST_VARS['user_homepage']) && preg_match('@^(?:http|https://)?([^/]+)@i', $HTTP_POST_VARS['user_homepage'])) ? trim($HTTP_POST_VARS['user_homepage']) : "";
  $user_icq = (isset($HTTP_POST_VARS['user_icq'])) ? intval(trim($HTTP_POST_VARS['user_icq']))) ? intval(trim($HTTP_POST_VARS['user_icq'])) : 0;
  $user_icq = preg_replace("/[^0-9]+/i", "", $user_icq);
  $user_joindate = (isset($HTTP_POST_VARS['user_joindate'])) ? trim($HTTP_POST_VARS['user_joindate']) : "";
  $user_lastaction = (isset($HTTP_POST_VARS['user_lastaction'])) ? trim($HTTP_POST_VARS['user_lastaction']) : "";
  $user_showemail = (isset($HTTP_POST_VARS['user_showemail'])) ? intval($HTTP_POST_VARS['user_showemail']) : 0;
  $user_showemail = preg_replace("/[^0-9]+/i", "", $user_showemail);
  $user_allowemails = (isset($HTTP_POST_VARS['user_allowemails'])) ? intval($HTTP_POST_VARS['user_allowemails']) : 0;
  $user_allowemails = preg_replace("/[^0-9]+/i", "", $user_allowemails);
  $user_invisible = (isset($HTTP_POST_VARS['user_invisible'])) ? intval($HTTP_POST_VARS['user_invisible']) : 0;
  $user_invisible = preg_replace("/[^0-9]+/i", "", $user_invisible);

65
Feedback & Suggestions / [FIX] - admin/usergroups.php
« on: September 08, 2007, 07:33:39 PM »
Detail: Check variable for right result.

Find:

Quote
$start_date = trim($HTTP_POST_VARS['group_start_date'][$key]);

$end_date = trim($HTTP_POST_VARS['group_end_date'][$key]);

replace:

Code: [Select]
$start_date = (isset($HTTP_POST_VARS['group_start_date'][$key])) ? trim($HTTP_POST_VARS['group_start_date'][$key]) : "";

$end_date = (isset($HTTP_POST_VARS['group_end_date'][$key])) ? trim($HTTP_POST_VARS['group_end_date'][$key]) : "";

Find:

Quote
$group_id = intval($HTTP_POST_VARS['group_id']);

replace:

Code: [Select]
$group_id = (isset($HTTP_POST_VARS['group_id'])) ? intval($HTTP_POST_VARS['group_id']) : intval($HTTP_GET_VARS['group_id']);
$group_id = preg_replace("/[^0-9]+/i", "", $group_id);

Find (2 time):

Quote
$group_name = trim($HTTP_POST_VARS['group_name']);

replace:

Code: [Select]
$group_name = (isset($HTTP_POST_VARS['group_name'])) ? trim($HTTP_POST_VARS['group_name']) : "";
$group_name = preg_replace("/[^A-Za-z0-9_-]+/i", "", $group_name);

66
Feedback & Suggestions / [FIX] - admin/stats.php
« on: September 08, 2007, 07:25:28 PM »
Detail: Check variable for right result.

Find:

Quote
$cat_id = intval($HTTP_POST_VARS['cat_id']);
$cat_hits = trim($HTTP_POST_VARS['cat_hits']);
$image_hits = trim($HTTP_POST_VARS['image_hits']);
$image_downloads = trim($HTTP_POST_VARS['image_downloads']);
$image_rating = trim($HTTP_POST_VARS['image_rating']);
$image_votes = trim($HTTP_POST_VARS['image_votes']);

replace:

Code: [Select]
$cat_id = (isset($HTTP_POST_VARS['cat_id'])) ? intval($HTTP_POST_VARS['cat_id']) : 0;
$cat_id = preg_replace("/[^0-9]+/i", "", $cat_id);
$cat_hits = (isset($HTTP_POST_VARS['cat_hits'])) ? intval($HTTP_POST_VARS['cat_hits']) : 0;
$cat_hits = preg_replace("/[^0-9]+/i", "", $cat_hits);
$image_hits = (isset($HTTP_POST_VARS['image_hits'])) ? intval($HTTP_POST_VARS['image_hits']) : 0;
$image_hits = preg_replace("/[^0-9]+/i", "", $image_hits);
$image_downloads = (isset($HTTP_POST_VARS['image_downloads'])) ? intval($HTTP_POST_VARS['image_downloads']) : 0;
$image_downloads = preg_replace("/[^0-9]+/i", "", $image_downloads);
$image_rating = (isset($HTTP_POST_VARS['image_rating'])) ? trim($HTTP_POST_VARS['image_rating']) : "0.00";
$image_rating = preg_replace("/[^\.0-9]+/i", "", $image_rating);
$image_votes = (isset($HTTP_POST_VARS['image_votes'])) ? intval($HTTP_POST_VARS['image_votes']) : 0;
$image_votes = preg_replace("/[^0-9]+/i", "", $image_votes);

67
Feedback & Suggestions / [FIX] - admin/resizer.php
« on: September 08, 2007, 07:20:09 PM »
Detail: Check variable for right result.

find ( 2 time):

Quote
$path = ($HTTP_POST_VARS['image_type'] == "media") ? MEDIA_PATH : THUMB_PATH;
$sql_image_type = ($HTTP_POST_VARS['image_type'] == "media") ? "image_media_file" : "image_thumb_file";

replace:

Code: [Select]
$path = (isset($HTTP_POST_VARS['image_type']) && $HTTP_POST_VARS['image_type'] == "media") ? MEDIA_PATH : THUMB_PATH;
$sql_image_type = (isset($HTTP_POST_VARS['image_type']) && $HTTP_POST_VARS['image_type'] == "media") ? "image_media_file" : "image_thumb_file";

68
Feedback & Suggestions / [FIX] - admin/images.php
« on: September 08, 2007, 07:07:00 PM »
Detail: Check for number of variable.

Find:

Quote
$image_name = un_htmlspecialchars(trim($HTTP_POST_VARS['image_name']));
$image_description = un_htmlspecialchars(trim($HTTP_POST_VARS['image_description']));

replace:

Quote
$image_name = (isset($HTTP_POST_VARS['image_name']) && preg_match("/[A-Za-z0-9_-]+/i", $HTTP_POST_VARS['image_name'])) ? un_htmlspecialchars(trim((string)$HTTP_POST_VARS['image_name'])) : "";
$image_description = (isset($HTTP_POST_VARS['image_description']) && preg_match("/[a-zA-Z0-9\.\,;:%&#@!\^-_~`\"'\[\]\{\}\*\/\?\(\)\n\r]/", $HTTP_POST_VARS['image_description'])) ? un_htmlspecialchars(trim((string)$HTTP_POST_VARS['image_description'])) : "";

Find:

Quote
$cat_id = intval($HTTP_POST_VARS['cat_id']);
$old_cat_id = intval($HTTP_POST_VARS['old_cat_id']);

$user_id = (intval($HTTP_POST_VARS['user_id']) != 0) ? intval($HTTP_POST_VARS['user_id']) : $user_info['user_id'];

$image_date = (trim($HTTP_POST_VARS['image_date']) != "") ? "UNIX_TIMESTAMP('".trim($HTTP_POST_VARS['image_date'])."')" : time();
$image_active = intval($HTTP_POST_VARS['image_active']);
$image_allow_comments = intval($HTTP_POST_VARS['image_allow_comments']);
$image_downloads = (trim($HTTP_POST_VARS['image_downloads']) != "") ? intval($HTTP_POST_VARS['image_downloads']) : 0;
$image_votes = (trim($HTTP_POST_VARS['image_votes']) != "") ? intval($HTTP_POST_VARS['image_votes']) : 0;
$image_rating = (trim($HTTP_POST_VARS['image_rating']) != "") ? sprintf("%.2f", trim($HTTP_POST_VARS['image_rating'])) : "0.00";
$image_hits = (trim($HTTP_POST_VARS['image_hits']) != "") ? intval(trim($HTTP_POST_VARS['image_hits'])) : 0;

$remote_file = trim($HTTP_POST_VARS['remote_file']);
$remote_thumb_file = trim($HTTP_POST_VARS['remote_thumb_file']);

$old_file_name = trim($HTTP_POST_VARS['old_file_name']);
$old_thumb_file_name = trim($HTTP_POST_VARS['old_thumb_file_name']);

$image_download_url = trim($HTTP_POST_VARS['image_download_url']);

replace:

Code: [Select]
$cat_id = (isset($HTTP_POST_VARS['cat_id'])) ? intval($HTTP_POST_VARS['cat_id']) : 0;
$cat_id = preg_replace("/[^0-9]+/i", "", $cat_id);
$old_cat_id = (isset($HTTP_POST_VARS['old_cat_id'])) ? intval($HTTP_POST_VARS['old_cat_id']) : 0;
$old_cat_id = preg_replace("/[^0-9]+/i", "", $old_cat_id);

$user_id = (isset($HTTP_POST_VARS['user_id']) && intval($HTTP_POST_VARS['user_id']) != 0) ? intval($HTTP_POST_VARS['user_id']) : $user_info['user_id'];
$user_id = preg_replace("/[^0-9]+/i", "", $user_id);

$image_date = (isset($HTTP_POST_VARS['image_date']) && trim($HTTP_POST_VARS['image_date']) != "") ? "UNIX_TIMESTAMP('".trim($HTTP_POST_VARS['image_date'])."')" : time();
$image_active = (isset($HTTP_POST_VARS['image_active']) && intval($HTTP_POST_VARS['image_active']) : 0;
$image_active = preg_replace("/[^0-9]+/i", "", $image_active);
$image_allow_comments = (isset($HTTP_POST_VARS['image_allow_comments'])) ? intval($HTTP_POST_VARS['image_allow_comments']) : 0;
$image_allow_comments = preg_replace("/[^0-9]+/i", "", $image_allow_comments);
$image_downloads = (isset($HTTP_POST_VARS['image_downloads']) && trim($HTTP_POST_VARS['image_downloads']) != "") ? intval($HTTP_POST_VARS['image_downloads']) : 0;
$image_downloads = preg_replace("/[^0-9]+/i", "", $image_downloads);
$image_votes = (isset($HTTP_POST_VARS['image_votes']) && trim($HTTP_POST_VARS['image_votes']) != "") ? intval($HTTP_POST_VARS['image_votes']) : 0;
$image_votes = preg_replace("/[^0-9]+/i", "", $image_votes);
$image_rating = (isset($HTTP_POST_VARS['image_rating']) && trim($HTTP_POST_VARS['image_rating']) != "") ? sprintf("%.2f", trim($HTTP_POST_VARS['image_rating'])) : "0.00";
$image_rating = preg_replace("/[^\.0-9]+/", "", $image_rating);
$image_hits = (isset($HTTP_POST_VARS['image_hits']) && trim($HTTP_POST_VARS['image_hits']) != "") ? intval(trim($HTTP_POST_VARS['image_hits'])) : 0;
$image_hits = preg_replace("/[^0-9]+/i", "", $image_hits);

$remote_file = (isset($HTTP_POST_VARS['remote_file'])) ? get_basefile(stripslashes($HTTP_POST_VARS['remote_file'])) : "";
$remote_thumb_file = (isset($HTTP_POST_VARS['remote_thumb_file'])) ?
get_basefile(stripslashes($HTTP_POST_VARS['remote_thumb_file'])) : "";

$old_file_name = (isset($HTTP_POST_VARS['old_file_name']) && is_remote($HTTP_POST_VARS['old_file_name'])) ? get_basefile(stripslashes($HTTP_POST_VARS['old_file_name'])) : "";
$old_thumb_file_name = (isset($HTTP_POST_VARS['old_thumb_file_name']) && is_remote($HTTP_POST_VARS['old_thumb_file_name'])) ? get_basefile(stripslashes($HTTP_POST_VARS['old_thumb_file_name'])) : "";

$image_download_url = (isset($HTTP_POST_VARS['image_download_url']) && preg_match('@^(?:http|https://)?([^/]+)@i', $HTTP_POST_VARS['image_download_url'])) ? trim($HTTP_POST_VARS['image_download_url']) : "";

Find:

Quote
//Save to Database
      if (!$uploaderror) {
        $image_description = un_htmlspecialchars(trim($HTTP_POST_VARS['image_description_'.$i]));

replace:

Code: [Select]
//Save to Database
      if (!$uploaderror) {
        $image_description = (isset($HTTP_POST_VARS['image_description']) && preg_match("/[A-Za-z0-9_-]+/i", $HTTP_POST_VARS['image_description'])) ? un_htmlspecialchars(trim((string)$HTTP_POST_VARS['image_description_'.$i])) : "";

Find (line: 509):

Quote
$image_active = trim($HTTP_POST_VARS['image_active_'.$i]);
$image_allow_comments = trim($HTTP_POST_VARS['image_allow_comments_'.$i]);

$image_download_url = trim($HTTP_POST_VARS['image_download_url_'.$i]);

replace:

Code: [Select]
$image_active = (isset($HTTP_POST_VARS['image_active_'.$i])) ? trim($HTTP_POST_VARS['image_active_'.$i]) : 0;
$image_allow_comments = (isset($HTTP_POST_VARS['image_allow_comments_'.$i])) ? trim($HTTP_POST_VARS['image_allow_comments_'.$i]) : 0;

$image_download_url = (isset($HTTP_POST_VARS['image_download_url_'.$i]) && preg_match('@^(?:http|https://)?([^/]+)@i', $HTTP_POST_VARS['image_download_url_'.$i])) ? trim($HTTP_POST_VARS['image_download_url_'.$i]) : "";

Find:

Quote
$condition = "1=1";

  $image_id = intval($HTTP_POST_VARS['image_id']);
  if ($image_id != "") {
    $condition .= " AND INSTR(LCASE(i.image_id),'$image_id')>0";
  }
  $image_name = trim($HTTP_POST_VARS['image_name']);
  if ($image_name != "") {
    $condition .= " AND INSTR(LCASE(i.image_name),'".strtolower($image_name)."')>0";
  }
  $image_description = trim($HTTP_POST_VARS['image_description']);
  if ($image_description != "") {
    $condition .= " AND INSTR(LCASE(i.image_description),'".strtolower($image_description)."')>0";
  }
  $image_keywords = trim($HTTP_POST_VARS['image_keywords']);
  if ($image_keywords != "") {
    $condition .= " AND INSTR(LCASE(i.image_keywords),'".strtolower($image_keywords)."')>0";
  }
  $cat_id = intval(trim($HTTP_POST_VARS['cat_id']));
  if ($cat_id != 0 && $cat_id != "") {
    $condition .= " AND i.cat_id = '$cat_id'";
  }
  $image_media_file = trim($HTTP_POST_VARS['image_media_file']);
  if ($image_media_file != "") {
    $condition .= " AND INSTR(LCASE(i.image_media_file),'".strtolower($image_media_file)."')>0";
  }
  $image_thumb_file = trim($HTTP_POST_VARS['image_thumb_file']);
  if ($image_thumb_file != "") {
    $condition .= " AND INSTR(LCASE(i.image_thumb_file),'".strtolower($image_thumb_file)."')>0";
  }
  $dateafter = trim($HTTP_POST_VARS['dateafter']);
  if ($dateafter != "") {
    $condition .= " AND i.image_date > UNIX_TIMESTAMP('$dateafter')";
  }
  $datebefore = trim($HTTP_POST_VARS['datebefore']);
  if ($datebefore != "") {
    $condition .= " AND i.image_date < UNIX_TIMESTAMP('$datebefore')";
  }
  $downloadslower = trim($HTTP_POST_VARS['downloadslower']);
  if ($downloadslower != "") {
    $condition .= " AND i.image_downloads < '$downloadslower'";
  }
  $downloadsupper = trim($HTTP_POST_VARS['downloadsupper']);
  if ($downloadsupper != "") {
    $condition .= " AND i.image_downloads > '$downloadsupper'";
  }
  $ratinglower = trim($HTTP_POST_VARS['ratinglower']);
  if ($ratinglower != "") {
    $condition .= " AND i.image_rating < '$ratinglower'";
  }
  $ratingupper = trim($HTTP_POST_VARS['ratingupper']);
  if ($ratingupper != "") {
    $condition .= " AND i.image_rating > '$ratingupper'";
  }
  $voteslower = trim($HTTP_POST_VARS['voteslower']);
  if ($voteslower != "") {
    $condition .= " AND i.image_votes < '$voteslower'";
  }
  $votesupper = trim($HTTP_POST_VARS['votesupper']);
  if ($votesupper != "") {
    $condition .= " AND i.image_votes > '$votesupper'";
  }
  $hitslower = trim($HTTP_POST_VARS['hitslower']);
  if ($hitslower != "") {
    $condition .= " AND i.image_hits < '$hitslower'";
  }
  $hitsupper = trim($HTTP_POST_VARS['hitsupper']);
  if ($hitsupper != "") {
    $condition .= " AND i.image_votes > '$hitsupper'";
  }
  $orderby = trim($HTTP_POST_VARS['orderby']);
  if ($orderby == "") {
    $orderby = "i.image_name";
  }

Do same type replace of topic:

http://www.4homepages.de/forum/index.php?topic=18665.0

69
Feedback & Suggestions / [FIX] - admin/email.php
« on: September 08, 2007, 06:43:35 PM »
Detail: Check for subject and message chars.

Find:

Quote
$subject = stripslashes(trim($HTTP_POST_VARS['subject']));
$message = stripslashes(trim($HTTP_POST_VARS['message']));

replace:

Code: [Select]
$subject = (isset($HTTP_POST_VARS['subject']) && preg_match("/[a-zA-Z0-9\.\,;:%&#@!\^-_~`\"'\[\]\{\}\*\/\?\(\)\n\r]/", $HTTP_POST_VARS['subject'])) ? stripslashes(trim($HTTP_POST_VARS['subject'])) : "";
$message = (isset($HTTP_POST_VARS['message']) && preg_match("/[a-zA-Z0-9\.\,;:%&#@!\^-_~`\"'\[\]\{\}\*\/\?\(\)\n\r]/", $HTTP_POST_VARS['message'])) ? stripslashes(trim($HTTP_POST_VARS['message'])) : "";

70
Feedback & Suggestions / [FIX] - admin/comments.php
« on: September 08, 2007, 06:40:13 PM »
Detail: Check variable for right result.

Find:

Quote
$user_name = (isset($HTTP_POST_VARS['user_name'])) ? trim($HTTP_POST_VARS['user_name']) : "";
$user_name = preg_replace("/[^A-Za-z0-9_-]+/i", "", $user_name);
$comment_headline = (isset($HTTP_POST_VARS['comment_headline']) && preg_match("/[a-zA-Z0-9\.\,;:%&#@!\^-_~`\"'\[\]\{\}\*\/\?\(\)\n\r]/", $HTTP_POST_VARS['comment_headline'])) ? trim($HTTP_POST_VARS['comment_headline']) : "";
$comment_text = (isset($HTTP_POST_VARS['comment_text']) && preg_match("/[a-zA-Z0-9\.\,;:%&#@!\^-_~`\"'\[\]\{\}\*\/\?\(\)\n\r]/", $HTTP_POST_VARS['comment_text'])) ? trim($HTTP_POST_VARS['comment_text']) : "";
$comment_ip = (isset($HTTP_POST_VARS['comment_ip'])) ? trim($HTTP_POST_VARS['comment_ip']) : "";
$comment_ip = preg_replace("/[^\.0-9]+/", "", $comment_ip);
$comment_date = (isset($HTTP_POST_VARS['comment_date'])) ? trim($HTTP_POST_VARS['comment_date']) : "";

Find:

Quote
$image_name = trim($HTTP_POST_VARS['image_name']);
  if ($image_name != "") {
    $condition .= " AND INSTR(LCASE(i.image_name),'".strtolower($image_name)."')>0";
  }
  $image_id = intval($HTTP_POST_VARS['image_id']);
  if ($image_id != 0) {
    $condition .= " AND INSTR(LCASE(c.image_id),'".strtolower($image_id)."')>0";
  }
  $user_name = trim($HTTP_POST_VARS['user_name']);
  if ($user_name != "") {
    $condition .= " AND INSTR(LCASE(c.user_name),'".strtolower($user_name)."')>0";
  }
  $comment_headline = trim($HTTP_POST_VARS['comment_headline']);
  if ($comment_headline != "") {
    $condition .= " AND INSTR(LCASE(c.comment_headline),'".strtolower($comment_headline)."')>0";
  }
  $comment_text = trim($HTTP_POST_VARS['comment_text']);
  if ($comment_text != "") {
    $condition .= " AND INSTR(LCASE(c.comment_text),'".strtolower($comment_text)."')>0";
  }
  $dateafter = trim($HTTP_POST_VARS['dateafter']);
  if ($dateafter != "") {
    $condition .= " AND c.comment_date > UNIX_TIMESTAMP('$dateafter')";
  }
  $datebefore = trim($HTTP_POST_VARS['datebefore']);
  if ($datebefore != "") {
    $condition .= " AND c.comment_date < UNIX_TIMESTAMP('$datebefore')";
  }
  $orderby = trim($HTTP_POST_VARS['orderby']);
  if ($orderby == "") {
    $orderby = "i.image_name";
  }
  $limitstart = (isset($HTTP_POST_VARS['limitstart'])) ? trim($HTTP_POST_VARS['limitstart']) : "";
  if ($limitstart == "") {
    $limitstart = 0;
  }
  else {
    $limitstart--;
  }
  $limitnumber = trim($HTTP_POST_VARS['limitnumber']);
  if ($limitnumber == "") {
    $limitnumber = 5000;
  }

replace:

Code: [Select]
$image_name = (isset($HTTP_POST_VARS['image_name'])) ? trim($HTTP_POST_VARS['image_name']) : "";
$image_name = preg_replace("/[^A-Za-z0-9_-]+/i", "", $image_name);
  if ($image_name != "") {
    $condition .= " AND INSTR(LCASE(i.image_name),'".strtolower($image_name)."') > 0";
  }
$image_id = (isset($HTTP_POST_VARS['image_id'])) ? intval($HTTP_POST_VARS['image_id']) : 0;
$image_id = preg_replace("/[^0-9]+/i", "", $image_id);
  if ($image_id != 0) {
    $condition .= " AND INSTR(LCASE(c.image_id),'".strtolower($image_id)."') > 0";
  }
$user_name = (isset($HTTP_POST_VARS['user_name'])) ? trim($HTTP_POST_VARS['user_name']) : "";
$user_name = preg_replace("/[^A-Za-z0-9_-]+/i", "", $user_name);
  if ($user_name != "") {
    $condition .= " AND INSTR(LCASE(c.user_name),'".strtolower($user_name)."') > 0";
  }
$comment_headline = (isset($HTTP_POST_VARS['comment_headline']) && preg_match("/[a-zA-Z0-9\.\,;:%&#@!\^-_~`\"'\[\]\{\}\*\/\?\(\)\n\r]/", $HTTP_POST_VARS['comment_headline'])) ? trim($HTTP_POST_VARS['comment_headline']) : "";
  if ($comment_headline != "") {
    $condition .= " AND INSTR(LCASE(c.comment_headline),'".strtolower($comment_headline)."') > 0";
  }
$comment_text = (isset($HTTP_POST_VARS['comment_text']) && preg_match("/[a-zA-Z0-9\.\,;:%&#@!\^-_~`\"'\[\]\{\}\*\/\?\(\)\n\r]/", $HTTP_POST_VARS['comment_text'])) ? trim($HTTP_POST_VARS['comment_text']) : "";
  if ($comment_text != "") {
    $condition .= " AND INSTR(LCASE(c.comment_text),'".strtolower($comment_text)."') > 0";
  }
$dateafter = (isset($HTTP_POST_VARS['dateafter'])) ? trim($HTTP_POST_VARS['dateafter']) : "";
  if ($dateafter != "") {
    $condition .= " AND c.comment_date > UNIX_TIMESTAMP('$dateafter')";
  }
$datebefore = (isset($HTTP_POST_VARS['datebefore'])) ? trim($HTTP_POST_VARS['datebefore']) : "";
  if ($datebefore != "") {
    $condition .= " AND c.comment_date < UNIX_TIMESTAMP('$datebefore')";
  }
$orderby = (isset($HTTP_POST_VARS['orderby'])) ? trim($HTTP_POST_VARS['orderby']) : "";
  if ($orderby == "") {
    $orderby = "i.image_name";
  }
  $limitstart = (isset($HTTP_POST_VARS['limitstart'])) ? trim($HTTP_POST_VARS['limitstart']) : "";
  if ($limitstart == "") {
    $limitstart = 0;
  }
  else {
    $limitstart--;
  }
  $limitnumber = (isset($HTTP_POST_VARS['limitnumber'])) ? trim($HTTP_POST_VARS['limitnumber']) : "";
  if ($limitnumber == "") {
    $limitnumber = 5000;
  }

71
Feedback & Suggestions / [FIX] - admin/checkimages.php
« on: September 08, 2007, 06:24:57 PM »
Detail: Check for variable for right result.

Find:

Quote
$num_newimages = $HTTP_POST_VARS['num_newimages'];
$detailed = $HTTP_POST_VARS['detailed'];

replace:

Code: [Select]
$num_newimages = (isset($HTTP_POST_VARS['num_newimages'])) ? intval(trim($HTTP_POST_VARS['num_newimages'])) : 0;
$detailed = (isset($HTTP_POST_VARS['detailed'])) ? trim($HTTP_POST_VARS['detailed']) : "";

Find:

Quote
$image_media_file = trim($HTTP_POST_VARS['image_media_file_'.$i]);
$image_thumb_file = trim($HTTP_POST_VARS['image_thumb_file_'.$i]);
$image_name = trim($HTTP_POST_VARS['image_name_'.$i]);

$cat_id = intval($HTTP_POST_VARS['cat_id_'.$i]);
$old_cat_id = intval($HTTP_POST_VARS['old_cat_id_'.$i]);

replace:

Code: [Select]
$image_media_file = (isset($HTTP_POST_VARS['image_media_file_'.$i]) && is_local_file($HTTP_POST_VARS['image_media_file_'.$i])) ? trim($HTTP_POST_VARS['image_media_file_'.$i]) : "";
$image_thumb_file = (isset($HTTP_POST_VARS['image_thumb_file_'.$i]) && is_local_file($HTTP_POST_VARS['image_thumb_file_'.$i])) ? trim($HTTP_POST_VARS['image_thumb_file_'.$i]) : "";
$image_name = (isset($HTTP_POST_VARS['image_name_'.$i])) ? trim($HTTP_POST_VARS['image_name_'.$i]) : "";

$cat_id = (isset($HTTP_POST_VARS['cat_id_'.$i])) ? intval(trim($HTTP_POST_VARS['cat_id_'.$i])) : 0;
$old_cat_id = isset($HTTP_POST_VARS['old_cat_id_'.$i])) ? intval($HTTP_POST_VARS['old_cat_id_'.$i]) : 0;

Find:

Quote
$image_active = intval($HTTP_POST_VARS['image_active_'.$i]);
$image_allow_comments = intval($HTTP_POST_VARS['image_allow_comments_'.$i]);

replace:

Code: [Select]
$image_active = (isset($HTTP_POST_VARS['image_active_'.$i])) ? intval(trim($HTTP_POST_VARS['image_active_'.$i])) : 0;
$image_allow_comments = (isset($HTTP_POST_VARS['image_allow_comments_'.$i])) ? intval(trim($HTTP_POST_VARS['image_allow_comments_'.$i])) : 0;

72
Feedback & Suggestions / [FIX] - login.php
« on: September 08, 2007, 06:05:36 PM »
Detail: Check for valid chars for username & password.

Find:

Quote
else {
  $user_name = trim($HTTP_POST_VARS['user_name']);
  $user_password = trim($HTTP_POST_VARS['user_password']);

replace:

Code: [Select]
else {
  $user_name = (isset($HTTP_POST_VARS['user_name'])) ? trim($HTTP_POST_VARS['user_name']) : "";
  $user_name = preg_replace("/[^A-Za-z0-9_-]+/i", "", $user_name);
  $user_password = (isset($HTTP_POST_VARS['user_password'])) ? trim($HTTP_POST_VARS['user_password']) : "";
  $user_password = preg_replace("/[^A-Za-z0-9_-]+/i", "", $user_password);

user no use other char with A-Z a-z0-9_- for user name and password.

73
Feedback & Suggestions / [FIX & Question] - rss.php
« on: September 08, 2007, 05:59:49 PM »
Detail: Redirect to index if fail (no exit). No get why exit ...

Find:

Quote
case 'comments':
    if (!$image_id) {
      exit;
    }

    $sql = "SELECT i.image_id, i.cat_id, i.user_id, i.image_name, i.image_description, i.image_keywords, i.image_date, i.image_active, i.image_media_file, i.image_thumb_file, i.image_download_url, i.image_allow_comments, i.image_comments, i.image_downloads, i.image_votes, i.image_rating, i.image_hits, c.cat_name".get_user_table_field(", u.", "user_name").get_user_table_field(", u.", "user_email")."
            FROM (".IMAGES_TABLE." i,  ".CATEGORIES_TABLE." c)
            LEFT JOIN ".USERS_TABLE." u ON (".get_user_table_field("u.", "user_id")." = i.user_id)
            WHERE i.image_id = $image_id AND c.cat_id = i.cat_id";
    $image_row = $site_db->query_firstrow($sql);

    if (!isset($image_row['image_id'])) {
      exit;
    }

replace:

Quote
case 'comments':
    if (!$image_id) {
      redirect($url);
    }

    $sql = "SELECT i.image_id, i.cat_id, i.user_id, i.image_name, i.image_description, i.image_keywords, i.image_date, i.image_active, i.image_media_file, i.image_thumb_file, i.image_download_url, i.image_allow_comments, i.image_comments, i.image_downloads, i.image_votes, i.image_rating, i.image_hits, c.cat_name".get_user_table_field(", u.", "user_name").get_user_table_field(", u.", "user_email")."
            FROM (".IMAGES_TABLE." i,  ".CATEGORIES_TABLE." c)
            LEFT JOIN ".USERS_TABLE." u ON (".get_user_table_field("u.", "user_id")." = i.user_id)
            WHERE i.image_id = $image_id AND c.cat_id = i.cat_id AND ";
    $image_row = $site_db->query_firstrow($sql);

    if (!isset($image_row['image_id'])) {
      redirect($url);
    }

Question - No get why is there:

Quote
'link' => $site_sess->url($script_url."/details.php?".URL_IMAGE_ID."=".$row['image_id']),

is use:

Code: [Select]
'link' => $site_sess->url(ROOT_PATH."details.php?".URL_IMAGE_ID."=".$row['image_id']),

or is use:

Code: [Select]
'link' => format_url($script_url."/details.php?".URL_IMAGE_ID."=".$row['image_id']),

Which good ?

74
Feedback & Suggestions / [FIX] - Register.php
« on: September 08, 2007, 05:40:00 PM »
Detail: Check valid chars before register account in DB.

Action: Register

Find:

Quote
$user_name = (isset($HTTP_POST_VARS['user_name'])) ? un_htmlspecialchars(trim($HTTP_POST_VARS['user_name'])) : "";
$user_name = ereg_replace("( ){2,}", " ", $user_name);
$user_password = (isset($HTTP_POST_VARS['user_password'])) ? trim($HTTP_POST_VARS['user_password']) : "";  
$user_email = (isset($HTTP_POST_VARS['user_email'])) ? un_htmlspecialchars(trim($HTTP_POST_VARS['user_email'])) : "";
$user_showemail = (isset($HTTP_POST_VARS['user_showemail'])) ? intval($HTTP_POST_VARS['user_showemail']) : 0;
$user_allowemails = (isset($HTTP_POST_VARS['user_allowemails'])) ? intval($HTTP_POST_VARS['user_allowemails']) : 1;
$user_invisible = (isset($HTTP_POST_VARS['user_invisible'])) ? intval($HTTP_POST_VARS['user_invisible']) : 0;
$user_homepage = (isset($HTTP_POST_VARS['user_homepage'])) ? un_htmlspecialchars(trim($HTTP_POST_VARS['user_homepage'])) : "";
$user_icq = (isset($HTTP_POST_VARS['user_icq'])) ? ((intval(trim($HTTP_POST_VARS['user_icq']))) ? intval(trim($HTTP_POST_VARS['user_icq'])) : "") : "";

replace:

Code: [Select]
$user_name = (isset($HTTP_POST_VARS['user_name'])) ? un_htmlspecialchars(trim((string)$HTTP_POST_VARS['user_name'])) : "";
$user_name = preg_replace("/'[^a-z0-9_-]+/i", "", $user_name);
$user_name = preg_replace("/( ){2,}+/i", " ", $user_name);
$user_name = format_text(trim($user_name), 2);
$user_password = (isset($HTTP_POST_VARS['user_password'])) ? un_htmlspecialchars(trim((string)$HTTP_POST_VARS['user_password'])) : "";  
$user_password = preg_replace("/[^A-Za-z0-9_-]+/i", "", $user_password);  
$user_password = format_text(trim($user_password), 2);
$user_email = (isset($HTTP_POST_VARS['user_email'])) ? un_htmlspecialchars(trim((string)$HTTP_POST_VARS['user_email'])) : "";
  if (isset($user_email)) {  
      if (function_exists('mailchek') && !function_exists('check_email') && mailchek($user_email, 2)) {        
          } elseif (function_exists('check_email') && !function_exists('mailchek') && check_email($user_email)) {              
      }              
  }
$user_showemail = (isset($HTTP_POST_VARS['user_showemail'])) ? intval($HTTP_POST_VARS['user_showemail']) : 0;
$user_showemail = preg_replace("/[^0-9]+/i", "", $user_showemail);
$user_allowemails = (isset($HTTP_POST_VARS['user_allowemails'])) ? intval($HTTP_POST_VARS['user_allowemails']) : 1;
$user_allowemails = preg_replace("/[^0-9]+/i", "", $user_allowemails);
$user_invisible = (isset($HTTP_POST_VARS['user_invisible'])) ? intval($HTTP_POST_VARS['user_invisible']) : 0;
$user_invisible = preg_replace("/[^0-9]+/i", "", $user_invisible);
  if (isset($HTTP_POST_VARS['user_homepage']) && preg_match('@^(?:http|https://)?([^/]+)@i', $HTTP_POST_VARS['user_homepage'])) {
  $user_homepage = (isset($HTTP_POST_VARS['user_homepage'])) ? un_htmlspecialchars(trim((string)$HTTP_POST_VARS['user_homepage'])) : "";
  }
$user_icq = (isset($HTTP_POST_VARS['user_icq'])) ? ((intval(trim($HTTP_POST_VARS['user_icq']))) ? intval(trim($HTTP_POST_VARS['user_icq'])) : "") : "";
$user_icq = preg_replace("/[^0-9]+/i", "", $user_icq);

75
Feedback & Suggestions / [FIX] - Install.php
« on: September 08, 2007, 05:24:12 PM »
Detail: Check rational chars like global.php file.

Find:

Quote
$action = (isset($HTTP_GET_VARS['action'])) ? stripslashes(trim($HTTP_GET_VARS['action'])) : stripslashes(trim($HTTP_POST_VARS['action']));

add after:

Code: [Select]
$action = preg_replace("/[^a-z0-9_-]+/i", "", $action);

(Do same for all update file from ZIP).

Pages: 1 2 3 4 [5] 6 7