Revision 1383
Added by FrankH almost 14 years ago
- Security fix for news module
- Some more Security fixes, thanks to Gerben van Veenendaal
branches/2.8.x/CHANGELOG | ||
---|---|---|
11 | 11 |
! = Update/Change |
12 | 12 |
|
13 | 13 |
------------------------------------- 2.8.2 ------------------------------------- |
14 |
15 Jan-2011 Build 1383 Frank Heyne (FrankH) |
|
15 |
# Security fix for news module |
|
16 |
# Some more Security fixes, thanks to Gerben van Veenendaal |
|
14 | 17 |
14 Jan-2011 Build 1382 Dietmar Woellbrink (Luisehahne) |
15 | 18 |
# fix known error in drag and drop |
16 | 19 |
14 Jan-2011 Build 1381 Dietmar Woellbrink (Luisehahne) |
branches/2.8.x/wb/admin/interface/version.php | ||
---|---|---|
52 | 52 |
|
53 | 53 |
// check if defined to avoid errors during installation (redirect to admin panel fails if PHP error/warnings are enabled) |
54 | 54 |
if(!defined('VERSION')) define('VERSION', '2.8.2.RC4'); |
55 |
if(!defined('REVISION')) define('REVISION', '1382');
|
|
55 |
if(!defined('REVISION')) define('REVISION', '1383');
|
|
56 | 56 |
|
57 | 57 |
?> |
branches/2.8.x/wb/index.php | ||
---|---|---|
35 | 35 |
* Clients akzeptieren jedoch auch relative URIs. |
36 | 36 |
*/ |
37 | 37 |
$host = $_SERVER['HTTP_HOST']; |
38 |
$uri = rtrim(dirname($_SERVER['PHP_SELF']), '/\\');
|
|
38 |
$uri = rtrim(dirname($_SERVER['SCRIPT_NAME']), '/\\');
|
|
39 | 39 |
$file = 'install/index.php'; |
40 | 40 |
$target_url = 'http://'.$host.$uri.'/'.$file; |
41 | 41 |
header('Location: '.$target_url); |
branches/2.8.x/wb/modules/form/view.php | ||
---|---|---|
124 | 124 |
} |
125 | 125 |
|
126 | 126 |
?> |
127 |
<form <?php echo ( ( (strlen($form_name) > 0) AND (false == $use_xhtml_strict) ) ? "name=\"".$form_name."\"" : ""); ?> action="<?php echo htmlspecialchars(strip_tags($_SERVER['PHP_SELF'])); ?>#wb_<?PHP echo $section_id;?>" method="post">
|
|
127 |
<form <?php echo ( ( (strlen($form_name) > 0) AND (false == $use_xhtml_strict) ) ? "name=\"".$form_name."\"" : ""); ?> action="<?php echo htmlspecialchars(strip_tags($_SERVER['SCRIPT_NAME'])); ?>#wb_<?PHP echo $section_id;?>" method="post">
|
|
128 | 128 |
<div> |
129 | 129 |
<input type="hidden" name="submission_id" value="<?php echo $_SESSION['form_submission_id']; ?>" /> |
130 | 130 |
<?php echo $admin->getFTAN(); ?> |
... | ... | |
376 | 376 |
if(isset($captcha_error)) { |
377 | 377 |
echo '<li>'.$captcha_error.'</li>'; |
378 | 378 |
} |
379 |
echo '</ul><a href="'.htmlspecialchars(strip_tags($_SERVER['PHP_SELF'])).'">'.$TEXT['BACK'].'</a>';
|
|
379 |
echo '</ul><a href="'.htmlspecialchars(strip_tags($_SERVER['SCRIPT_NAME'])).'">'.$TEXT['BACK'].'</a>';
|
|
380 | 380 |
} else { |
381 | 381 |
if(isset($email_error)) { |
382 | 382 |
echo '<br /><ul>'; |
383 | 383 |
echo '<li>'.$email_error.'</li>'; |
384 |
echo '</ul><a href="'.htmlspecialchars(strip_tags($_SERVER['PHP_SELF'])).'">'.$TEXT['BACK'].'</a>';
|
|
384 |
echo '</ul><a href="'.htmlspecialchars(strip_tags($_SERVER['SCRIPT_NAME'])).'">'.$TEXT['BACK'].'</a>';
|
|
385 | 385 |
} elseif(isset($captcha_error)) { |
386 | 386 |
echo '<br /><ul>'; |
387 | 387 |
echo '<li>'.$captcha_error.'</li>'; |
388 |
echo '</ul><a href="'.htmlspecialchars(strip_tags($_SERVER['PHP_SELF'])).'">'.$TEXT['BACK'].'</a>';
|
|
388 |
echo '</ul><a href="'.htmlspecialchars(strip_tags($_SERVER['SCRIPT_NAME'])).'">'.$TEXT['BACK'].'</a>';
|
|
389 | 389 |
} else { |
390 | 390 |
// Check how many times form has been submitted in last hour |
391 | 391 |
$last_hour = time()-3600; |
branches/2.8.x/wb/modules/jsadmin/jsadmin_backend_include.php | ||
---|---|---|
25 | 25 |
$JSADMIN_PATH = WB_URL.'/modules/jsadmin'; |
26 | 26 |
$YUI_PATH = WB_URL.'/include/yui'; |
27 | 27 |
$script = $_SERVER['SCRIPT_NAME']; |
28 |
if(!$script) |
|
29 |
$script = $PHP_SELF; |
|
30 | 28 |
|
31 | 29 |
if(strstr($script, $admin_folder."/pages/index.php")) |
32 | 30 |
$page_type = 'pages'; |
branches/2.8.x/wb/modules/jsadmin/move_to.php | ||
---|---|---|
1 | 1 |
<?php |
2 |
|
|
3 |
// $Id$ |
|
4 |
|
|
5 |
// JsAdmin module for Website Baker |
|
6 |
// Copyright (C) 2006, Stepan Riha |
|
7 |
// www.nonplus.net |
|
8 |
|
|
9 |
// modified by Swen Uth for Website Baker 2.7 |
|
10 |
|
|
11 |
/* |
|
12 |
|
|
13 |
Website Baker Project <http://www.websitebaker.org/> |
|
14 |
Copyright (C) 2004-2009, Ryan Djurovich |
|
15 |
|
|
16 |
Website Baker is free software; you can redistribute it and/or modify |
|
17 |
it under the terms of the GNU General Public License as published by |
|
18 |
the Free Software Foundation; either version 2 of the License, or |
|
19 |
(at your option) any later version. |
|
20 |
|
|
21 |
Website Baker is distributed in the hope that it will be useful, |
|
22 |
but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
23 |
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
24 |
GNU General Public License for more details. |
|
25 |
|
|
26 |
You should have received a copy of the GNU General Public License |
|
27 |
along with Website Baker; if not, write to the Free Software |
|
28 |
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
|
29 |
|
|
2 |
/** |
|
3 |
* |
|
4 |
* @category modules |
|
5 |
* @package JsAdmin |
|
6 |
* @author WebsiteBaker Project, modified by Swen Uth for Website Baker 2.7 |
|
7 |
* @copyright (C) 2006, Stepan Riha |
|
8 |
* @copyright 2009-2011, Website Baker Org. e.V. |
|
9 |
* @link http://www.websitebaker2.org/ |
|
10 |
* @license http://www.gnu.org/licenses/gpl.html |
|
11 |
* @platform WebsiteBaker 2.8.x |
|
12 |
* @requirements PHP 5.2.2 and higher |
|
13 |
* @version $Id$ |
|
14 |
* @filesource $HeadURL$ |
|
15 |
* @lastmodified $Date$ |
|
16 |
* |
|
30 | 17 |
*/ |
31 | 18 |
|
32 | 19 |
require('../../config.php'); |
branches/2.8.x/wb/modules/fckeditor/fckeditor/editor/filemanager/connectors/php/io.php | ||
---|---|---|
157 | 157 |
// #2124 ensure that no slash is at the end |
158 | 158 |
$sRealPath = rtrim($sRealPath,"\\/"); |
159 | 159 |
|
160 |
$sSelfPath = $_SERVER['PHP_SELF'] ;
|
|
160 |
$sSelfPath = $_SERVER['SCRIPT_NAME'] ;
|
|
161 | 161 |
$sSelfPath = substr( $sSelfPath, 0, strrpos( $sSelfPath, '/' ) ) ; |
162 | 162 |
|
163 | 163 |
$sSelfPath = str_replace( '/', DIRECTORY_SEPARATOR, $sSelfPath ) ; |
branches/2.8.x/wb/modules/news/add_post.php | ||
---|---|---|
36 | 36 |
$database->query("INSERT INTO ".TABLE_PREFIX."mod_news_posts (section_id,page_id,position,commenting,active) VALUES ('$section_id','$page_id','$position','$commenting','1')"); |
37 | 37 |
|
38 | 38 |
// Get the id |
39 |
$post_id = $database->get_one("SELECT LAST_INSERT_ID()");
|
|
39 |
$post_id = $admin->getIDKEY($database->get_one("SELECT LAST_INSERT_ID()"));
|
|
40 | 40 |
|
41 | 41 |
// Say that a new record has been added, then redirect to modify page |
42 | 42 |
if($database->is_error()) { |
branches/2.8.x/wb/modules/news/modify_settings.php | ||
---|---|---|
64 | 64 |
|
65 | 65 |
<input type="hidden" name="section_id" value="<?php echo $section_id; ?>" /> |
66 | 66 |
<input type="hidden" name="page_id" value="<?php echo $page_id; ?>" /> |
67 |
|
|
67 |
<?php echo $admin->getFTAN(); ?> |
|
68 | 68 |
<table class="row_a" cellpadding="2" cellspacing="0" width="100%"> |
69 | 69 |
<tr> |
70 | 70 |
<td colspan="2"><strong><?php echo $HEADING['GENERAL_SETTINGS']; ?></strong></td> |
branches/2.8.x/wb/modules/news/delete_post.php | ||
---|---|---|
18 | 18 |
|
19 | 19 |
require('../../config.php'); |
20 | 20 |
|
21 |
// Get id |
|
22 |
if(!isset($_GET['post_id']) OR !is_numeric($_GET['post_id'])) { |
|
23 |
header("Location: ".ADMIN_URL."/pages/index.php"); |
|
24 |
exit(0); |
|
25 |
} else { |
|
26 |
$post_id = $_GET['post_id']; |
|
27 |
} |
|
28 |
|
|
29 | 21 |
// Include WB admin wrapper script |
30 | 22 |
$update_when_modified = true; // Tells script to update when this page was last updated |
31 | 23 |
require(WB_PATH.'/modules/admin.php'); |
32 | 24 |
|
25 |
$pid = $admin->checkIDKEY('post_id', false, 'GET'); |
|
26 |
if (!$pid) { |
|
27 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
28 |
exit(); |
|
29 |
} else { |
|
30 |
$post_id = $pid; |
|
31 |
} |
|
32 |
|
|
33 | 33 |
// Get post details |
34 | 34 |
$query_details = $database->query("SELECT * FROM ".TABLE_PREFIX."mod_news_posts WHERE post_id = '$post_id'"); |
35 | 35 |
if($query_details->numRows() > 0) { |
branches/2.8.x/wb/modules/news/modify_comment.php | ||
---|---|---|
18 | 18 |
|
19 | 19 |
require('../../config.php'); |
20 | 20 |
|
21 |
// Get id |
|
22 |
if(!isset($_GET['comment_id']) OR !is_numeric($_GET['comment_id'])) { |
|
23 |
header("Location: ".ADMIN_URL."/pages/index.php"); |
|
24 |
exit(0); |
|
25 |
} else { |
|
26 |
$comment_id = $_GET['comment_id']; |
|
27 |
} |
|
28 |
|
|
29 | 21 |
// Include WB admin wrapper script |
30 | 22 |
require(WB_PATH.'/modules/admin.php'); |
31 | 23 |
|
24 |
$comment_id = $admin->checkIDKEY('comment_id', false, 'GET'); |
|
25 |
if (!$comment_id) { |
|
26 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
27 |
exit(); |
|
28 |
} |
|
29 |
|
|
32 | 30 |
// Get header and footer |
33 | 31 |
$query_content = $database->query("SELECT post_id,title,comment FROM ".TABLE_PREFIX."mod_news_comments WHERE comment_id = '$comment_id'"); |
34 | 32 |
$fetch_content = $query_content->fetchRow(); |
35 |
|
|
36 | 33 |
?> |
37 | 34 |
|
38 | 35 |
<h2><?php echo $TEXT['MODIFY'].' '.$TEXT['COMMENT']; ?></h2> |
... | ... | |
43 | 40 |
<input type="hidden" name="page_id" value="<?php echo $page_id; ?>" /> |
44 | 41 |
<input type="hidden" name="post_id" value="<?php echo $fetch_content['post_id']; ?>" /> |
45 | 42 |
<input type="hidden" name="comment_id" value="<?php echo $comment_id; ?>" /> |
46 |
|
|
43 |
<?php echo $admin->getFTAN(); ?> |
|
47 | 44 |
<table class="row_a" cellpadding="2" cellspacing="0" border="0" width="100%"> |
48 | 45 |
<tr> |
49 | 46 |
<td width="80"><?php echo $TEXT['TITLE']; ?>:</td> |
... | ... | |
65 | 62 |
<input name="save" type="submit" value="<?php echo $TEXT['SAVE']; ?>" style="width: 100px; margin-top: 5px;" /> |
66 | 63 |
</td> |
67 | 64 |
<td align="right"> |
68 |
<input type="button" value="<?php echo $TEXT['CANCEL']; ?>" onclick="javascript: window.location = '<?php echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $fetch_content['post_id']; ?>';" style="width: 100px; margin-top: 5px;" /> |
|
65 |
<input type="button" value="<?php echo $TEXT['CANCEL']; ?>" onclick="javascript: window.location = '<?php |
|
66 |
echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php |
|
67 |
echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php |
|
68 |
echo $admin->getIDKEY($fetch_content['post_id']); ?>';" style="width: 100px; margin-top: 5px;" /> |
|
69 | 69 |
</td> |
70 | 70 |
</tr> |
71 | 71 |
</table> |
branches/2.8.x/wb/modules/news/view.php | ||
---|---|---|
209 | 209 |
{ |
210 | 210 |
?> |
211 | 211 |
<div class="selected-group-title"> |
212 |
<?php print '<a href="'.htmlspecialchars(strip_tags($_SERVER['PHP_SELF'])).'">'.PAGE_TITLE.'</a> >> '.$groups[$_GET['g']]['title']; ?>
|
|
212 |
<?php print '<a href="'.htmlspecialchars(strip_tags($_SERVER['SCRIPT_NAME'])).'">'.PAGE_TITLE.'</a> >> '.$groups[$_GET['g']]['title']; ?>
|
|
213 | 213 |
</div> |
214 | 214 |
<?php |
215 | 215 |
} |
... | ... | |
428 | 428 |
{ |
429 | 429 |
// Print comments header |
430 | 430 |
$vars = array('[ADD_COMMENT_URL]','[TEXT_COMMENTS]'); |
431 |
$values = array(WB_URL.'/modules/news/comment.php?post_id='.POST_ID.'&section_id='.$section_id, $MOD_NEWS['TEXT_COMMENTS']); |
|
431 |
$pid = $admin->getIDKEY(POST_ID); |
|
432 |
$values = array(WB_URL."/modules/news/comment.php?post_id=$pid&section_id=$section_id", $MOD_NEWS['TEXT_COMMENTS']); |
|
432 | 433 |
print str_replace($vars, $values, $setting_comments_header); |
433 | 434 |
|
434 | 435 |
// Query for comments |
... | ... | |
466 | 467 |
|
467 | 468 |
// Print comments footer |
468 | 469 |
$vars = array('[ADD_COMMENT_URL]','[TEXT_ADD_COMMENT]'); |
469 |
$values = array(WB_URL.'/modules/news/comment.php?post_id='.POST_ID.'&section_id='.$section_id, $MOD_NEWS['TEXT_ADD_COMMENT']);
|
|
470 |
$values = array(WB_URL."/modules/news/comment.php?post_id=$pid&section_id=$section_id", $MOD_NEWS['TEXT_ADD_COMMENT']);
|
|
470 | 471 |
print str_replace($vars, $values, $setting_comments_footer); |
471 | 472 |
|
472 | 473 |
} |
branches/2.8.x/wb/modules/news/save_group.php | ||
---|---|---|
33 | 33 |
$update_when_modified = true; // Tells script to update when this page was last updated |
34 | 34 |
require(WB_PATH.'/modules/admin.php'); |
35 | 35 |
|
36 |
if (!$admin->checkFTAN()) |
|
37 |
{ |
|
38 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
39 |
exit(); |
|
40 |
} |
|
41 |
|
|
36 | 42 |
// Include WB functions file |
37 | 43 |
require(WB_PATH.'/framework/functions.php'); |
38 | 44 |
|
branches/2.8.x/wb/modules/news/move_up.php | ||
---|---|---|
18 | 18 |
|
19 | 19 |
require('../../config.php'); |
20 | 20 |
|
21 |
// Include WB admin wrapper script |
|
22 |
require(WB_PATH.'/modules/admin.php'); |
|
23 |
|
|
21 | 24 |
// Get id |
22 |
if(!isset($_GET['post_id']) OR !is_numeric($_GET['post_id'])) { |
|
23 |
if(!isset($_GET['group_id']) OR !is_numeric($_GET['group_id'])) { |
|
24 |
|
|
25 |
header("Location: index.php"); |
|
26 |
exit( 0 ); |
|
25 |
$pid = $admin->checkIDKEY('post_id', false, 'GET'); |
|
26 |
$gid = $admin->checkIDKEY('group_id', false, 'GET'); |
|
27 |
if (!$pid) { |
|
28 |
if (!$gid) { |
|
29 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
30 |
exit(); |
|
27 | 31 |
} else { |
28 |
$id = $_GET['group_id'];
|
|
32 |
$id = $gid;
|
|
29 | 33 |
$id_field = 'group_id'; |
30 | 34 |
$table = TABLE_PREFIX.'mod_news_groups'; |
31 | 35 |
} |
32 | 36 |
} else { |
33 |
$id = $_GET['post_id'];
|
|
37 |
$id = $pid;
|
|
34 | 38 |
$id_field = 'post_id'; |
35 | 39 |
$table = TABLE_PREFIX.'mod_news_posts'; |
36 | 40 |
} |
37 | 41 |
|
38 |
// Include WB admin wrapper script |
|
39 |
require(WB_PATH.'/modules/admin.php'); |
|
40 |
|
|
41 | 42 |
// Include the ordering class |
42 | 43 |
require(WB_PATH.'/framework/class.order.php'); |
43 | 44 |
|
branches/2.8.x/wb/modules/news/save_settings.php | ||
---|---|---|
22 | 22 |
$update_when_modified = true; // Tells script to update when this page was last updated |
23 | 23 |
require(WB_PATH.'/modules/admin.php'); |
24 | 24 |
|
25 |
if (!$admin->checkFTAN()) |
|
26 |
{ |
|
27 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
28 |
exit(); |
|
29 |
} |
|
30 |
|
|
25 | 31 |
// This code removes any <?php tags and adds slashes |
26 | 32 |
$friendly = array('<', '>', '?php'); |
27 | 33 |
$raw = array('<', '>', ''); |
... | ... | |
44 | 50 |
} |
45 | 51 |
|
46 | 52 |
// Update settings |
47 |
$database->query("UPDATE ".TABLE_PREFIX."mod_news_settings SET header = '$header', post_loop = '$post_loop', footer = '$footer', posts_per_page = '$posts_per_page', post_header = '$post_header', post_footer = '$post_footer', comments_header = '$comments_header', comments_loop = '$comments_loop', comments_footer = '$comments_footer', comments_page = '$comments_page', commenting = '$commenting', resize = '$resize', use_captcha = '$use_captcha' WHERE section_id = '$section_id'"); |
|
53 |
$database->query("UPDATE ".TABLE_PREFIX."mod_news_settings SET header = '$header', post_loop = '$post_loop', footer = '$footer', |
|
54 |
posts_per_page = '$posts_per_page', post_header = '$post_header', post_footer = '$post_footer', |
|
55 |
comments_header = '$comments_header', comments_loop = '$comments_loop', comments_footer = '$comments_footer', |
|
56 |
comments_page = '$comments_page', commenting = '$commenting', resize = '$resize', use_captcha = '$use_captcha' |
|
57 |
WHERE section_id = '$section_id'"); |
|
48 | 58 |
|
49 | 59 |
// Check if there is a db error, otherwise say successful |
50 | 60 |
if($database->is_error()) { |
branches/2.8.x/wb/modules/news/delete_comment.php | ||
---|---|---|
18 | 18 |
|
19 | 19 |
require('../../config.php'); |
20 | 20 |
|
21 |
// Get id |
|
22 |
if(!isset($_GET['comment_id']) OR !is_numeric($_GET['comment_id'])) { |
|
23 |
|
|
24 |
header("Location: ".ADMIN_URL."/pages/index.php"); |
|
25 |
exit( 0 ); |
|
26 |
} |
|
27 |
else |
|
28 |
{ |
|
29 |
$comment_id = $_GET['comment_id']; |
|
30 |
} |
|
31 |
|
|
32 |
// Get post id |
|
33 |
if(!isset($_GET['post_id']) OR !is_numeric($_GET['post_id'])) |
|
34 |
{ |
|
35 |
|
|
36 |
header("Location: ".ADMIN_URL."/pages/index.php"); |
|
37 |
exit( 0 ); |
|
38 |
} |
|
39 |
else |
|
40 |
{ |
|
41 |
$post_id = $_GET['post_id']; |
|
42 |
} |
|
43 |
|
|
44 | 21 |
// Include WB admin wrapper script |
45 | 22 |
$update_when_modified = true; // Tells script to update when this page was last updated |
46 | 23 |
require(WB_PATH.'/modules/admin.php'); |
47 | 24 |
|
25 |
$cid = $admin->checkIDKEY('comment_id', false, 'GET'); |
|
26 |
$pid = $admin->checkIDKEY('post_id', false, 'GET'); |
|
27 |
if (!$pid || !$cid) { |
|
28 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
29 |
exit(); |
|
30 |
} else { |
|
31 |
$comment_id = $cid; |
|
32 |
$post_id = $admin->getIDKEY($pid); |
|
33 |
} |
|
34 |
|
|
48 | 35 |
// Update row |
49 | 36 |
$database->query("DELETE FROM ".TABLE_PREFIX."mod_news_comments WHERE comment_id = '$comment_id'"); |
50 | 37 |
|
branches/2.8.x/wb/modules/news/modify.php | ||
---|---|---|
56 | 56 |
<table cellpadding="2" cellspacing="0" border="0" width="100%"> |
57 | 57 |
<?php |
58 | 58 |
while($post = $query_posts->fetchRow()) { |
59 |
$pid = $admin->getIDKEY($post['post_id']); |
|
59 | 60 |
?> |
60 | 61 |
<tr class="row_<?php echo $row; ?>"> |
61 | 62 |
<td width="20" style="padding-left: 5px;"> |
62 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $post['post_id']; ?>" title="<?php echo $TEXT['MODIFY']; ?>">
|
|
63 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $pid; ?>" title="<?php echo $TEXT['MODIFY']; ?>">
|
|
63 | 64 |
<img src="<?php echo THEME_URL; ?>/images/modify_16.png" border="0" alt="Modify - " /> |
64 | 65 |
</a> |
65 | 66 |
</td> |
66 | 67 |
<td> |
67 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $post['post_id']; ?>">
|
|
68 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $pid; ?>">
|
|
68 | 69 |
<?php echo ($post['title']); ?> |
69 | 70 |
</a> |
70 | 71 |
</td> |
... | ... | |
103 | 104 |
else |
104 | 105 |
$icon=THEME_URL.'/images/clock_red_16.png'; |
105 | 106 |
?> |
106 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $post['post_id']; ?>" title="<?php echo $TEXT['MODIFY']; ?>">
|
|
107 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $pid; ?>" title="<?php echo $TEXT['MODIFY']; ?>">
|
|
107 | 108 |
<img src="<?php echo $icon; ?>" border="0" alt="" /> |
108 | 109 |
</a> |
109 | 110 |
</td> |
110 | 111 |
<td width="20"> |
111 | 112 |
<?php if($post['position'] != $num_posts) { ?> |
112 |
<a href="<?php echo WB_URL; ?>/modules/news/move_down.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $post['post_id']; ?>" title="<?php echo $TEXT['MOVE_UP']; ?>">
|
|
113 |
<a href="<?php echo WB_URL; ?>/modules/news/move_down.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $pid; ?>" title="<?php echo $TEXT['MOVE_DOWN']; ?>">
|
|
113 | 114 |
<img src="<?php echo THEME_URL; ?>/images/up_16.png" border="0" alt="^" /> |
114 | 115 |
</a> |
115 | 116 |
<?php } ?> |
116 | 117 |
</td> |
117 | 118 |
<td width="20"> |
118 | 119 |
<?php if($post['position'] != 1) { ?> |
119 |
<a href="<?php echo WB_URL; ?>/modules/news/move_up.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $post['post_id']; ?>" title="<?php echo $TEXT['MOVE_DOWN']; ?>">
|
|
120 |
<a href="<?php echo WB_URL; ?>/modules/news/move_up.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $pid; ?>" title="<?php echo $TEXT['MOVE_UP']; ?>">
|
|
120 | 121 |
<img src="<?php echo THEME_URL; ?>/images/down_16.png" border="0" alt="v" /> |
121 | 122 |
</a> |
122 | 123 |
<?php } ?> |
123 | 124 |
</td> |
124 | 125 |
<td width="20"> |
125 |
<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php echo WB_URL; ?>/modules/news/delete_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $post['post_id']; ?>');" title="<?php echo $TEXT['DELETE']; ?>">
|
|
126 |
<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php echo WB_URL; ?>/modules/news/delete_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $pid; ?>');" title="<?php echo $TEXT['DELETE']; ?>">
|
|
126 | 127 |
<img src="<?php echo THEME_URL; ?>/images/delete_16.png" border="0" alt="X" /> |
127 | 128 |
</a> |
128 | 129 |
</td> |
... | ... | |
157 | 158 |
<table cellpadding="2" cellspacing="0" border="0" width="100%"> |
158 | 159 |
<?php |
159 | 160 |
while($group = $query_groups->fetchRow()) { |
161 |
$gid = $admin->getIDKEY($group['group_id']); |
|
160 | 162 |
?> |
161 | 163 |
<tr class="row_<?php echo $row; ?>"> |
162 | 164 |
<td width="20" style="padding-left: 5px;"> |
163 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_group.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $group['group_id']; ?>" title="<?php echo $TEXT['MODIFY']; ?>">
|
|
165 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_group.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $gid; ?>" title="<?php echo $TEXT['MODIFY']; ?>">
|
|
164 | 166 |
<img src="<?php echo THEME_URL; ?>/images/modify_16.png" border="0" alt="Modify - " /> |
165 | 167 |
</a> |
166 | 168 |
</td> |
167 | 169 |
<td> |
168 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_group.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $group['group_id']; ?>">
|
|
170 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_group.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $gid; ?>">
|
|
169 | 171 |
<?php echo $group['title']; ?> |
170 | 172 |
</a> |
171 | 173 |
</td> |
... | ... | |
174 | 176 |
</td> |
175 | 177 |
<td width="20"> |
176 | 178 |
<?php if($group['position'] != 1) { ?> |
177 |
<a href="<?php echo WB_URL; ?>/modules/news/move_up.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $group['group_id']; ?>" title="<?php echo $TEXT['MOVE_UP']; ?>">
|
|
179 |
<a href="<?php echo WB_URL; ?>/modules/news/move_up.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $gid; ?>" title="<?php echo $TEXT['MOVE_UP']; ?>">
|
|
178 | 180 |
<img src="<?php echo THEME_URL; ?>/images/up_16.png" border="0" alt="^" /> |
179 | 181 |
</a> |
180 | 182 |
<?php } ?> |
181 | 183 |
</td> |
182 | 184 |
<td width="20"> |
183 | 185 |
<?php if($group['position'] != $num_groups) { ?> |
184 |
<a href="<?php echo WB_URL; ?>/modules/news/move_down.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $group['group_id']; ?>" title="<?php echo $TEXT['MOVE_DOWN']; ?>">
|
|
186 |
<a href="<?php echo WB_URL; ?>/modules/news/move_down.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $gid; ?>" title="<?php echo $TEXT['MOVE_DOWN']; ?>">
|
|
185 | 187 |
<img src="<?php echo THEME_URL; ?>/images/down_16.png" border="0" alt="v" /> |
186 | 188 |
</a> |
187 | 189 |
<?php } ?> |
188 | 190 |
</td> |
189 | 191 |
<td width="20"> |
190 |
<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php echo WB_URL; ?>/modules/news/delete_group.php?page_id=<?php echo $page_id; ?>&group_id=<?php echo $group['group_id']; ?>');" title="<?php echo $TEXT['DELETE']; ?>">
|
|
192 |
<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php echo WB_URL; ?>/modules/news/delete_group.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $gid; ?>');" title="<?php echo $TEXT['DELETE']; ?>">
|
|
191 | 193 |
<img src="<?php echo THEME_URL; ?>/images/delete_16.png" border="0" alt="X" /> |
192 | 194 |
</a> |
193 | 195 |
</td> |
branches/2.8.x/wb/modules/news/modify_post.php | ||
---|---|---|
18 | 18 |
|
19 | 19 |
require('../../config.php'); |
20 | 20 |
|
21 |
// Get id |
|
22 |
if(!isset($_GET['post_id']) OR !is_numeric($_GET['post_id'])) { |
|
23 |
header("Location: ".ADMIN_URL."/pages/index.php"); |
|
24 |
exit(0); |
|
25 |
} else { |
|
26 |
$post_id = $_GET['post_id']; |
|
27 |
} |
|
28 |
|
|
29 | 21 |
// Include WB admin wrapper script |
30 | 22 |
require(WB_PATH.'/modules/admin.php'); |
31 | 23 |
|
24 |
$post_id = $admin->checkIDKEY('post_id', false, 'GET'); |
|
25 |
if (!$post_id) { |
|
26 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
27 |
exit(); |
|
28 |
} |
|
29 |
|
|
32 | 30 |
// Get header and footer |
33 | 31 |
$query_content = $database->query("SELECT * FROM ".TABLE_PREFIX."mod_news_posts WHERE post_id = '$post_id'"); |
34 | 32 |
$fetch_content = $query_content->fetchRow(); |
... | ... | |
54 | 52 |
<input type="hidden" name="page_id" value="<?php echo $page_id; ?>" /> |
55 | 53 |
<input type="hidden" name="post_id" value="<?php echo $post_id; ?>" /> |
56 | 54 |
<input type="hidden" name="link" value="<?php echo $fetch_content['link']; ?>" /> |
55 |
<?php echo $admin->getFTAN(); ?> |
|
57 | 56 |
|
58 | 57 |
<table class="row_a" cellpadding="2" cellspacing="0" width="100%"> |
59 | 58 |
<tr> |
... | ... | |
205 | 204 |
$query_comments = $database->query("SELECT * FROM `".TABLE_PREFIX."mod_news_comments` WHERE section_id = '$section_id' AND post_id = '$post_id' ORDER BY commented_when DESC"); |
206 | 205 |
if($query_comments->numRows() > 0) { |
207 | 206 |
$row = 'a'; |
207 |
$pid = $admin->getIDKEY($post_id); |
|
208 | 208 |
?> |
209 | 209 |
<table cellpadding="2" cellspacing="0" border="0" width="100%"> |
210 | 210 |
<?php |
211 | 211 |
while($comment = $query_comments->fetchRow()) { |
212 |
$cid = $admin->getIDKEY($comment['comment_id']); |
|
212 | 213 |
?> |
213 | 214 |
<tr class="row_<?php echo $row; ?>" > |
214 | 215 |
<td width="20" style="padding-left: 5px;"> |
215 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_comment.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&comment_id=<?php echo $comment['comment_id']; ?>" title="<?php echo $TEXT['MODIFY']; ?>"> |
|
216 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_comment.php?page_id=<?php echo $page_id; ?>&section_id=<?php |
|
217 |
echo $section_id; ?>&comment_id=<?php echo $cid; ?>" title="<?php echo $TEXT['MODIFY']; ?>"> |
|
216 | 218 |
<img src="<?php echo THEME_URL; ?>/images/modify_16.png" border="0" alt="^" /> |
217 | 219 |
</a> |
218 | 220 |
</td> |
219 | 221 |
<td> |
220 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_comment.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&comment_id=<?php echo $comment['comment_id']; ?>"> |
|
222 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_comment.php?page_id=<?php echo $page_id; ?>&section_id=<?php |
|
223 |
echo $section_id; ?>&comment_id=<?php echo $cid; ?>"> |
|
221 | 224 |
<?php echo $comment['title']; ?> |
222 | 225 |
</a> |
223 | 226 |
</td> |
224 | 227 |
<td width="20"> |
225 |
<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php echo WB_URL; ?>/modules/news/delete_comment.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $post_id; ?>&comment_id=<?php echo $comment['comment_id']; ?>');" title="<?php echo $TEXT['DELETE']; ?>"> |
|
228 |
<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php |
|
229 |
echo WB_URL; ?>/modules/news/delete_comment.php?page_id=<?php echo $page_id; ?>&section_id=<?php |
|
230 |
echo $section_id; ?>&post_id=<?php echo $pid; ?>&comment_id=<?php echo $cid; ?>');" title="<?php |
|
231 |
echo $TEXT['DELETE']; ?>"> |
|
226 | 232 |
<img src="<?php echo THEME_URL; ?>/images/delete_16.png" border="0" alt="X" /> |
227 | 233 |
</a> |
228 | 234 |
</td> |
branches/2.8.x/wb/modules/news/move_down.php | ||
---|---|---|
18 | 18 |
|
19 | 19 |
require('../../config.php'); |
20 | 20 |
|
21 |
// Include WB admin wrapper script |
|
22 |
require(WB_PATH.'/modules/admin.php'); |
|
23 |
|
|
21 | 24 |
// Get id |
22 |
if(!isset($_GET['post_id']) OR !is_numeric($_GET['post_id'])) { |
|
23 |
if(!isset($_GET['group_id']) OR !is_numeric($_GET['group_id'])) { |
|
24 |
header("Location: index.php"); |
|
25 |
exit(0); |
|
25 |
$pid = $admin->checkIDKEY('post_id', false, 'GET'); |
|
26 |
$gid = $admin->checkIDKEY('group_id', false, 'GET'); |
|
27 |
if (!$pid) { |
|
28 |
if (!$gid) { |
|
29 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
30 |
exit(); |
|
26 | 31 |
} else { |
27 |
$id = $_GET['group_id'];
|
|
32 |
$id = $gid;
|
|
28 | 33 |
$id_field = 'group_id'; |
29 | 34 |
$table = TABLE_PREFIX.'mod_news_groups'; |
30 | 35 |
} |
31 | 36 |
} else { |
32 |
$id = $_GET['post_id'];
|
|
37 |
$id = $pid;
|
|
33 | 38 |
$id_field = 'post_id'; |
34 | 39 |
$table = TABLE_PREFIX.'mod_news_posts'; |
35 | 40 |
} |
36 | 41 |
|
37 |
// Include WB admin wrapper script |
|
38 |
require(WB_PATH.'/modules/admin.php'); |
|
39 |
|
|
40 | 42 |
// Include the ordering class |
41 | 43 |
require(WB_PATH.'/framework/class.order.php'); |
42 | 44 |
|
branches/2.8.x/wb/modules/news/comment_page.php | ||
---|---|---|
78 | 78 |
<input id="comment" name="comment" size="60" value="" /><br /> |
79 | 79 |
</p> |
80 | 80 |
<?php } |
81 |
?>
|
|
82 |
<?php echo $TEXT['TITLE']; ?>:
|
|
81 |
echo $admin->getFTAN();
|
|
82 |
echo $TEXT['TITLE']; ?>: |
|
83 | 83 |
<br /> |
84 | 84 |
<input type="text" name="title" maxlength="255" style="width: 90%;"<?php if(isset($_SESSION['comment_title'])) { echo ' value="'.$_SESSION['comment_title'].'"'; unset($_SESSION['comment_title']); } ?> /> |
85 | 85 |
<br /><br /> |
branches/2.8.x/wb/modules/news/comment.php | ||
---|---|---|
18 | 18 |
|
19 | 19 |
// Include config file |
20 | 20 |
require('../../config.php'); |
21 |
require_once(WB_PATH.'/framework/class.wb.php'); |
|
22 |
$wb = new wb; |
|
21 | 23 |
|
22 | 24 |
// Check if there is a post id |
23 |
if(!isset($_GET['post_id']) OR !is_numeric($_GET['post_id']) |
|
24 |
OR !isset($_GET['section_id']) OR !is_numeric($_GET['section_id'])) |
|
25 |
{ |
|
26 |
header("Location: ".WB_URL.PAGES_DIRECTORY.""); |
|
27 |
exit( 0 ); |
|
25 |
$post_id = $wb->checkIDKEY('post_id', false, 'GET'); |
|
26 |
if (!$post_id OR !isset($_GET['section_id']) OR !is_numeric($_GET['section_id'])) { |
|
27 |
$wb->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], WB_URL); |
|
28 |
exit(); |
|
28 | 29 |
} |
29 |
$post_id = $_GET['post_id']; |
|
30 | 30 |
$section_id = $_GET['section_id']; |
31 | 31 |
|
32 | 32 |
// Query post for page id |
branches/2.8.x/wb/modules/news/modify_group.php | ||
---|---|---|
18 | 18 |
|
19 | 19 |
require('../../config.php'); |
20 | 20 |
|
21 |
// Get id |
|
22 |
if(!isset($_GET['group_id']) OR !is_numeric($_GET['group_id'])) { |
|
23 |
header("Location: ".ADMIN_URL."/pages/index.php"); |
|
24 |
exit(0); |
|
25 |
} else { |
|
26 |
$group_id = $_GET['group_id']; |
|
27 |
} |
|
28 |
|
|
29 | 21 |
// Include WB admin wrapper script |
30 | 22 |
require(WB_PATH.'/modules/admin.php'); |
31 | 23 |
|
24 |
$group_id = $admin->checkIDKEY('group_id', false, 'GET'); |
|
25 |
if (!$group_id) { |
|
26 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
27 |
exit(); |
|
28 |
} |
|
29 |
|
|
32 | 30 |
// Get header and footer |
33 | 31 |
$query_content = $database->query("SELECT * FROM ".TABLE_PREFIX."mod_news_groups WHERE group_id = '$group_id'"); |
34 | 32 |
$fetch_content = $query_content->fetchRow(); |
... | ... | |
42 | 40 |
<input type="hidden" name="section_id" value="<?php echo $section_id; ?>" /> |
43 | 41 |
<input type="hidden" name="page_id" value="<?php echo $page_id; ?>" /> |
44 | 42 |
<input type="hidden" name="group_id" value="<?php echo $group_id; ?>" /> |
45 |
|
|
43 |
<?php echo $admin->getFTAN(); ?> |
|
46 | 44 |
<table class="row_a" cellpadding="2" cellspacing="0" border="0" width="100%"> |
47 | 45 |
<tr> |
48 | 46 |
<td width="80"><?php echo $TEXT['TITLE']; ?>:</td> |
branches/2.8.x/wb/modules/news/save_post.php | ||
---|---|---|
32 | 32 |
$post_id = $id; |
33 | 33 |
} |
34 | 34 |
|
35 |
// Include WB admin wrapper script |
|
36 |
$update_when_modified = true; // Tells script to update when this page was last updated |
|
37 |
require(WB_PATH.'/modules/admin.php'); |
|
38 |
|
|
39 |
if (!$admin->checkFTAN()) |
|
40 |
{ |
|
41 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
42 |
exit(); |
|
43 |
} |
|
44 |
|
|
35 | 45 |
function create_file($filename, $filetime=NULL ) |
36 | 46 |
{ |
37 | 47 |
global $page_id, $section_id, $post_id; |
... | ... | |
80 | 90 |
|
81 | 91 |
} |
82 | 92 |
|
83 |
// Include WB admin wrapper script |
|
84 |
$update_when_modified = true; // Tells script to update when this page was last updated |
|
85 |
require(WB_PATH.'/modules/admin.php'); |
|
86 |
|
|
87 | 93 |
// Validate all fields |
88 | 94 |
if($admin->get_post('title') == '' AND $admin->get_post('url') == '') |
89 | 95 |
{ |
branches/2.8.x/wb/modules/news/add_group.php | ||
---|---|---|
31 | 31 |
$database->query("INSERT INTO ".TABLE_PREFIX."mod_news_groups (section_id,page_id,position,active) VALUES ('$section_id','$page_id','$position','1')"); |
32 | 32 |
|
33 | 33 |
// Get the id |
34 |
$group_id = $database->get_one("SELECT LAST_INSERT_ID()");
|
|
34 |
$group_id = $admin->getIDKEY($database->get_one("SELECT LAST_INSERT_ID()"));
|
|
35 | 35 |
|
36 | 36 |
// Say that a new record has been added, then redirect to modify page |
37 | 37 |
if($database->is_error()) { |
38 | 38 |
$admin->print_error($database->get_error(), WB_URL.'/modules/news/modify_group.php?page_id='.$page_id.'§ion_id='.$section_id.'&group_id='.$group_id); |
39 | 39 |
} else { |
40 |
$admin->print_success($TEXT['SUCCESS'], WB_URL.'/modules/news/modify_group.php?page_id='.$page_id.'§ion_id='.$section_id.'&group_id='.$group_id); |
|
40 |
$admin->print_success($TEXT['SUCCESS'], WB_URL.'/modules/news/modify_group.php?page_id='.$page_id.'§ion_id='.$section_id.'&group_id='.$group_id);
|
|
41 | 41 |
} |
42 | 42 |
|
43 | 43 |
// Print admin footer |
branches/2.8.x/wb/modules/news/rss.php | ||
---|---|---|
31 | 31 |
// Include WB files |
32 | 32 |
require_once('../../config.php'); |
33 | 33 |
require_once(WB_PATH.'/framework/class.frontend.php'); |
34 |
$database = new database(); |
|
35 | 34 |
$wb = new frontend(); |
36 | 35 |
$wb->page_id = $page_id; |
37 | 36 |
$wb->get_page_details(); |
branches/2.8.x/wb/modules/news/delete_group.php | ||
---|---|---|
18 | 18 |
|
19 | 19 |
require('../../config.php'); |
20 | 20 |
|
21 |
// Get id |
|
22 |
if(!isset($_GET['group_id']) OR !is_numeric($_GET['group_id'])) { |
|
23 |
header("Location: ".ADMIN_URL."/pages/index.php"); |
|
24 |
exit(0); |
|
25 |
} else { |
|
26 |
$group_id = $_GET['group_id']; |
|
27 |
} |
|
28 |
|
|
29 | 21 |
// Include WB admin wrapper script |
30 | 22 |
$update_when_modified = true; // Tells script to update when this page was last updated |
31 | 23 |
require(WB_PATH.'/modules/admin.php'); |
32 | 24 |
|
25 |
$gid = $admin->checkIDKEY('group_id', false, 'GET'); |
|
26 |
if (!$pid) { |
|
27 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
28 |
exit(); |
|
29 |
} else { |
|
30 |
$group_id = $gid; |
|
31 |
} |
|
32 |
|
|
33 | 33 |
$database->query("UPDATE ".TABLE_PREFIX."mod_news_posts SET group_id = '0' where group_id='$group_id'"); |
34 | 34 |
// Update row |
35 | 35 |
$database->query("DELETE FROM ".TABLE_PREFIX."mod_news_groups WHERE group_id = '$group_id'"); |
branches/2.8.x/wb/modules/news/save_comment.php | ||
---|---|---|
21 | 21 |
// Get id |
22 | 22 |
if(!isset($_POST['comment_id']) OR !is_numeric($_POST['comment_id']) OR !isset($_POST['post_id']) OR !is_numeric($_POST['post_id'])) |
23 | 23 |
{ |
24 |
|
|
25 | 24 |
header("Location: ".ADMIN_URL."/pages/index.php"); |
26 | 25 |
exit( 0 ); |
27 | 26 |
} |
... | ... | |
34 | 33 |
$update_when_modified = true; // Tells script to update when this page was last updated |
35 | 34 |
require(WB_PATH.'/modules/admin.php'); |
36 | 35 |
|
36 |
if (!$admin->checkFTAN()) |
|
37 |
{ |
|
38 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
39 |
exit(); |
|
40 |
} |
|
41 |
|
|
42 |
$id = $admin->getIDKEY($comment_id); |
|
43 |
|
|
37 | 44 |
// Validate all fields |
38 | 45 |
if($admin->get_post('title') == '' AND $admin->get_post('comment') == '') |
39 | 46 |
{ |
... | ... | |
43 | 50 |
{ |
44 | 51 |
$title = strip_tags($admin->get_post_escaped('title')); |
45 | 52 |
$comment = strip_tags($admin->get_post_escaped('comment')); |
46 |
$post_id = $admin->get_post('post_id');
|
|
53 |
$post_id = $admin->getIDKEY($admin->get_post('post_id'));
|
|
47 | 54 |
} |
48 | 55 |
|
49 | 56 |
// Update row |
branches/2.8.x/wb/modules/news/submit_comment.php | ||
---|---|---|
28 | 28 |
$wb = new wb; |
29 | 29 |
/* */ |
30 | 30 |
|
31 |
if (!$wb->checkFTAN()) |
|
32 |
{ |
|
33 |
$wb->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], WB_URL); |
|
34 |
exit(); |
|
35 |
} |
|
36 |
|
|
31 | 37 |
// Check if we should show the form or add a comment |
32 | 38 |
if(isset($_GET['page_id']) AND is_numeric($_GET['page_id']) |
33 | 39 |
AND isset($_GET['section_id']) AND is_numeric($_GET['section_id']) |
Also available in: Unified diff