Revision 1383
Added by FrankH almost 15 years ago
- Security fix for news module
- Some more Security fixes, thanks to Gerben van Veenendaal
| branches/2.8.x/CHANGELOG | ||
|---|---|---|
| 11 | 11 |
! = Update/Change |
| 12 | 12 |
|
| 13 | 13 |
------------------------------------- 2.8.2 ------------------------------------- |
| 14 |
15 Jan-2011 Build 1383 Frank Heyne (FrankH) |
|
| 15 |
# Security fix for news module |
|
| 16 |
# Some more Security fixes, thanks to Gerben van Veenendaal |
|
| 14 | 17 |
14 Jan-2011 Build 1382 Dietmar Woellbrink (Luisehahne) |
| 15 | 18 |
# fix known error in drag and drop |
| 16 | 19 |
14 Jan-2011 Build 1381 Dietmar Woellbrink (Luisehahne) |
| branches/2.8.x/wb/admin/interface/version.php | ||
|---|---|---|
| 52 | 52 |
|
| 53 | 53 |
// check if defined to avoid errors during installation (redirect to admin panel fails if PHP error/warnings are enabled) |
| 54 | 54 |
if(!defined('VERSION')) define('VERSION', '2.8.2.RC4');
|
| 55 |
if(!defined('REVISION')) define('REVISION', '1382');
|
|
| 55 |
if(!defined('REVISION')) define('REVISION', '1383');
|
|
| 56 | 56 |
|
| 57 | 57 |
?> |
| branches/2.8.x/wb/index.php | ||
|---|---|---|
| 35 | 35 |
* Clients akzeptieren jedoch auch relative URIs. |
| 36 | 36 |
*/ |
| 37 | 37 |
$host = $_SERVER['HTTP_HOST']; |
| 38 |
$uri = rtrim(dirname($_SERVER['PHP_SELF']), '/\\');
|
|
| 38 |
$uri = rtrim(dirname($_SERVER['SCRIPT_NAME']), '/\\');
|
|
| 39 | 39 |
$file = 'install/index.php'; |
| 40 | 40 |
$target_url = 'http://'.$host.$uri.'/'.$file; |
| 41 | 41 |
header('Location: '.$target_url);
|
| branches/2.8.x/wb/modules/form/view.php | ||
|---|---|---|
| 124 | 124 |
} |
| 125 | 125 |
|
| 126 | 126 |
?> |
| 127 |
<form <?php echo ( ( (strlen($form_name) > 0) AND (false == $use_xhtml_strict) ) ? "name=\"".$form_name."\"" : ""); ?> action="<?php echo htmlspecialchars(strip_tags($_SERVER['PHP_SELF'])); ?>#wb_<?PHP echo $section_id;?>" method="post">
|
|
| 127 |
<form <?php echo ( ( (strlen($form_name) > 0) AND (false == $use_xhtml_strict) ) ? "name=\"".$form_name."\"" : ""); ?> action="<?php echo htmlspecialchars(strip_tags($_SERVER['SCRIPT_NAME'])); ?>#wb_<?PHP echo $section_id;?>" method="post">
|
|
| 128 | 128 |
<div> |
| 129 | 129 |
<input type="hidden" name="submission_id" value="<?php echo $_SESSION['form_submission_id']; ?>" /> |
| 130 | 130 |
<?php echo $admin->getFTAN(); ?> |
| ... | ... | |
| 376 | 376 |
if(isset($captcha_error)) {
|
| 377 | 377 |
echo '<li>'.$captcha_error.'</li>'; |
| 378 | 378 |
} |
| 379 |
echo '</ul><a href="'.htmlspecialchars(strip_tags($_SERVER['PHP_SELF'])).'">'.$TEXT['BACK'].'</a>';
|
|
| 379 |
echo '</ul><a href="'.htmlspecialchars(strip_tags($_SERVER['SCRIPT_NAME'])).'">'.$TEXT['BACK'].'</a>';
|
|
| 380 | 380 |
} else {
|
| 381 | 381 |
if(isset($email_error)) {
|
| 382 | 382 |
echo '<br /><ul>'; |
| 383 | 383 |
echo '<li>'.$email_error.'</li>'; |
| 384 |
echo '</ul><a href="'.htmlspecialchars(strip_tags($_SERVER['PHP_SELF'])).'">'.$TEXT['BACK'].'</a>';
|
|
| 384 |
echo '</ul><a href="'.htmlspecialchars(strip_tags($_SERVER['SCRIPT_NAME'])).'">'.$TEXT['BACK'].'</a>';
|
|
| 385 | 385 |
} elseif(isset($captcha_error)) {
|
| 386 | 386 |
echo '<br /><ul>'; |
| 387 | 387 |
echo '<li>'.$captcha_error.'</li>'; |
| 388 |
echo '</ul><a href="'.htmlspecialchars(strip_tags($_SERVER['PHP_SELF'])).'">'.$TEXT['BACK'].'</a>';
|
|
| 388 |
echo '</ul><a href="'.htmlspecialchars(strip_tags($_SERVER['SCRIPT_NAME'])).'">'.$TEXT['BACK'].'</a>';
|
|
| 389 | 389 |
} else {
|
| 390 | 390 |
// Check how many times form has been submitted in last hour |
| 391 | 391 |
$last_hour = time()-3600; |
| branches/2.8.x/wb/modules/jsadmin/jsadmin_backend_include.php | ||
|---|---|---|
| 25 | 25 |
$JSADMIN_PATH = WB_URL.'/modules/jsadmin'; |
| 26 | 26 |
$YUI_PATH = WB_URL.'/include/yui'; |
| 27 | 27 |
$script = $_SERVER['SCRIPT_NAME']; |
| 28 |
if(!$script) |
|
| 29 |
$script = $PHP_SELF; |
|
| 30 | 28 |
|
| 31 | 29 |
if(strstr($script, $admin_folder."/pages/index.php")) |
| 32 | 30 |
$page_type = 'pages'; |
| branches/2.8.x/wb/modules/jsadmin/move_to.php | ||
|---|---|---|
| 1 | 1 |
<?php |
| 2 |
|
|
| 3 |
// $Id$ |
|
| 4 |
|
|
| 5 |
// JsAdmin module for Website Baker |
|
| 6 |
// Copyright (C) 2006, Stepan Riha |
|
| 7 |
// www.nonplus.net |
|
| 8 |
|
|
| 9 |
// modified by Swen Uth for Website Baker 2.7 |
|
| 10 |
|
|
| 11 |
/* |
|
| 12 |
|
|
| 13 |
Website Baker Project <http://www.websitebaker.org/> |
|
| 14 |
Copyright (C) 2004-2009, Ryan Djurovich |
|
| 15 |
|
|
| 16 |
Website Baker is free software; you can redistribute it and/or modify |
|
| 17 |
it under the terms of the GNU General Public License as published by |
|
| 18 |
the Free Software Foundation; either version 2 of the License, or |
|
| 19 |
(at your option) any later version. |
|
| 20 |
|
|
| 21 |
Website Baker is distributed in the hope that it will be useful, |
|
| 22 |
but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
| 23 |
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
| 24 |
GNU General Public License for more details. |
|
| 25 |
|
|
| 26 |
You should have received a copy of the GNU General Public License |
|
| 27 |
along with Website Baker; if not, write to the Free Software |
|
| 28 |
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
|
| 29 |
|
|
| 2 |
/** |
|
| 3 |
* |
|
| 4 |
* @category modules |
|
| 5 |
* @package JsAdmin |
|
| 6 |
* @author WebsiteBaker Project, modified by Swen Uth for Website Baker 2.7 |
|
| 7 |
* @copyright (C) 2006, Stepan Riha |
|
| 8 |
* @copyright 2009-2011, Website Baker Org. e.V. |
|
| 9 |
* @link http://www.websitebaker2.org/ |
|
| 10 |
* @license http://www.gnu.org/licenses/gpl.html |
|
| 11 |
* @platform WebsiteBaker 2.8.x |
|
| 12 |
* @requirements PHP 5.2.2 and higher |
|
| 13 |
* @version $Id$ |
|
| 14 |
* @filesource $HeadURL$ |
|
| 15 |
* @lastmodified $Date$ |
|
| 16 |
* |
|
| 30 | 17 |
*/ |
| 31 | 18 |
|
| 32 | 19 |
require('../../config.php');
|
| branches/2.8.x/wb/modules/fckeditor/fckeditor/editor/filemanager/connectors/php/io.php | ||
|---|---|---|
| 157 | 157 |
// #2124 ensure that no slash is at the end |
| 158 | 158 |
$sRealPath = rtrim($sRealPath,"\\/"); |
| 159 | 159 |
|
| 160 |
$sSelfPath = $_SERVER['PHP_SELF'] ;
|
|
| 160 |
$sSelfPath = $_SERVER['SCRIPT_NAME'] ;
|
|
| 161 | 161 |
$sSelfPath = substr( $sSelfPath, 0, strrpos( $sSelfPath, '/' ) ) ; |
| 162 | 162 |
|
| 163 | 163 |
$sSelfPath = str_replace( '/', DIRECTORY_SEPARATOR, $sSelfPath ) ; |
| branches/2.8.x/wb/modules/news/add_post.php | ||
|---|---|---|
| 36 | 36 |
$database->query("INSERT INTO ".TABLE_PREFIX."mod_news_posts (section_id,page_id,position,commenting,active) VALUES ('$section_id','$page_id','$position','$commenting','1')");
|
| 37 | 37 |
|
| 38 | 38 |
// Get the id |
| 39 |
$post_id = $database->get_one("SELECT LAST_INSERT_ID()");
|
|
| 39 |
$post_id = $admin->getIDKEY($database->get_one("SELECT LAST_INSERT_ID()"));
|
|
| 40 | 40 |
|
| 41 | 41 |
// Say that a new record has been added, then redirect to modify page |
| 42 | 42 |
if($database->is_error()) {
|
| branches/2.8.x/wb/modules/news/modify_settings.php | ||
|---|---|---|
| 64 | 64 |
|
| 65 | 65 |
<input type="hidden" name="section_id" value="<?php echo $section_id; ?>" /> |
| 66 | 66 |
<input type="hidden" name="page_id" value="<?php echo $page_id; ?>" /> |
| 67 |
|
|
| 67 |
<?php echo $admin->getFTAN(); ?> |
|
| 68 | 68 |
<table class="row_a" cellpadding="2" cellspacing="0" width="100%"> |
| 69 | 69 |
<tr> |
| 70 | 70 |
<td colspan="2"><strong><?php echo $HEADING['GENERAL_SETTINGS']; ?></strong></td> |
| branches/2.8.x/wb/modules/news/delete_post.php | ||
|---|---|---|
| 18 | 18 |
|
| 19 | 19 |
require('../../config.php');
|
| 20 | 20 |
|
| 21 |
// Get id |
|
| 22 |
if(!isset($_GET['post_id']) OR !is_numeric($_GET['post_id'])) {
|
|
| 23 |
header("Location: ".ADMIN_URL."/pages/index.php");
|
|
| 24 |
exit(0); |
|
| 25 |
} else {
|
|
| 26 |
$post_id = $_GET['post_id']; |
|
| 27 |
} |
|
| 28 |
|
|
| 29 | 21 |
// Include WB admin wrapper script |
| 30 | 22 |
$update_when_modified = true; // Tells script to update when this page was last updated |
| 31 | 23 |
require(WB_PATH.'/modules/admin.php'); |
| 32 | 24 |
|
| 25 |
$pid = $admin->checkIDKEY('post_id', false, 'GET');
|
|
| 26 |
if (!$pid) {
|
|
| 27 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
| 28 |
exit(); |
|
| 29 |
} else {
|
|
| 30 |
$post_id = $pid; |
|
| 31 |
} |
|
| 32 |
|
|
| 33 | 33 |
// Get post details |
| 34 | 34 |
$query_details = $database->query("SELECT * FROM ".TABLE_PREFIX."mod_news_posts WHERE post_id = '$post_id'");
|
| 35 | 35 |
if($query_details->numRows() > 0) {
|
| branches/2.8.x/wb/modules/news/modify_comment.php | ||
|---|---|---|
| 18 | 18 |
|
| 19 | 19 |
require('../../config.php');
|
| 20 | 20 |
|
| 21 |
// Get id |
|
| 22 |
if(!isset($_GET['comment_id']) OR !is_numeric($_GET['comment_id'])) {
|
|
| 23 |
header("Location: ".ADMIN_URL."/pages/index.php");
|
|
| 24 |
exit(0); |
|
| 25 |
} else {
|
|
| 26 |
$comment_id = $_GET['comment_id']; |
|
| 27 |
} |
|
| 28 |
|
|
| 29 | 21 |
// Include WB admin wrapper script |
| 30 | 22 |
require(WB_PATH.'/modules/admin.php'); |
| 31 | 23 |
|
| 24 |
$comment_id = $admin->checkIDKEY('comment_id', false, 'GET');
|
|
| 25 |
if (!$comment_id) {
|
|
| 26 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
| 27 |
exit(); |
|
| 28 |
} |
|
| 29 |
|
|
| 32 | 30 |
// Get header and footer |
| 33 | 31 |
$query_content = $database->query("SELECT post_id,title,comment FROM ".TABLE_PREFIX."mod_news_comments WHERE comment_id = '$comment_id'");
|
| 34 | 32 |
$fetch_content = $query_content->fetchRow(); |
| 35 |
|
|
| 36 | 33 |
?> |
| 37 | 34 |
|
| 38 | 35 |
<h2><?php echo $TEXT['MODIFY'].' '.$TEXT['COMMENT']; ?></h2> |
| ... | ... | |
| 43 | 40 |
<input type="hidden" name="page_id" value="<?php echo $page_id; ?>" /> |
| 44 | 41 |
<input type="hidden" name="post_id" value="<?php echo $fetch_content['post_id']; ?>" /> |
| 45 | 42 |
<input type="hidden" name="comment_id" value="<?php echo $comment_id; ?>" /> |
| 46 |
|
|
| 43 |
<?php echo $admin->getFTAN(); ?> |
|
| 47 | 44 |
<table class="row_a" cellpadding="2" cellspacing="0" border="0" width="100%"> |
| 48 | 45 |
<tr> |
| 49 | 46 |
<td width="80"><?php echo $TEXT['TITLE']; ?>:</td> |
| ... | ... | |
| 65 | 62 |
<input name="save" type="submit" value="<?php echo $TEXT['SAVE']; ?>" style="width: 100px; margin-top: 5px;" /> |
| 66 | 63 |
</td> |
| 67 | 64 |
<td align="right"> |
| 68 |
<input type="button" value="<?php echo $TEXT['CANCEL']; ?>" onclick="javascript: window.location = '<?php echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $fetch_content['post_id']; ?>';" style="width: 100px; margin-top: 5px;" /> |
|
| 65 |
<input type="button" value="<?php echo $TEXT['CANCEL']; ?>" onclick="javascript: window.location = '<?php |
|
| 66 |
echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php |
|
| 67 |
echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php |
|
| 68 |
echo $admin->getIDKEY($fetch_content['post_id']); ?>';" style="width: 100px; margin-top: 5px;" /> |
|
| 69 | 69 |
</td> |
| 70 | 70 |
</tr> |
| 71 | 71 |
</table> |
| branches/2.8.x/wb/modules/news/view.php | ||
|---|---|---|
| 209 | 209 |
{
|
| 210 | 210 |
?> |
| 211 | 211 |
<div class="selected-group-title"> |
| 212 |
<?php print '<a href="'.htmlspecialchars(strip_tags($_SERVER['PHP_SELF'])).'">'.PAGE_TITLE.'</a> >> '.$groups[$_GET['g']]['title']; ?>
|
|
| 212 |
<?php print '<a href="'.htmlspecialchars(strip_tags($_SERVER['SCRIPT_NAME'])).'">'.PAGE_TITLE.'</a> >> '.$groups[$_GET['g']]['title']; ?>
|
|
| 213 | 213 |
</div> |
| 214 | 214 |
<?php |
| 215 | 215 |
} |
| ... | ... | |
| 428 | 428 |
{
|
| 429 | 429 |
// Print comments header |
| 430 | 430 |
$vars = array('[ADD_COMMENT_URL]','[TEXT_COMMENTS]');
|
| 431 |
$values = array(WB_URL.'/modules/news/comment.php?post_id='.POST_ID.'&section_id='.$section_id, $MOD_NEWS['TEXT_COMMENTS']); |
|
| 431 |
$pid = $admin->getIDKEY(POST_ID); |
|
| 432 |
$values = array(WB_URL."/modules/news/comment.php?post_id=$pid&section_id=$section_id", $MOD_NEWS['TEXT_COMMENTS']); |
|
| 432 | 433 |
print str_replace($vars, $values, $setting_comments_header); |
| 433 | 434 |
|
| 434 | 435 |
// Query for comments |
| ... | ... | |
| 466 | 467 |
|
| 467 | 468 |
// Print comments footer |
| 468 | 469 |
$vars = array('[ADD_COMMENT_URL]','[TEXT_ADD_COMMENT]');
|
| 469 |
$values = array(WB_URL.'/modules/news/comment.php?post_id='.POST_ID.'&section_id='.$section_id, $MOD_NEWS['TEXT_ADD_COMMENT']);
|
|
| 470 |
$values = array(WB_URL."/modules/news/comment.php?post_id=$pid&section_id=$section_id", $MOD_NEWS['TEXT_ADD_COMMENT']);
|
|
| 470 | 471 |
print str_replace($vars, $values, $setting_comments_footer); |
| 471 | 472 |
|
| 472 | 473 |
} |
| branches/2.8.x/wb/modules/news/save_group.php | ||
|---|---|---|
| 33 | 33 |
$update_when_modified = true; // Tells script to update when this page was last updated |
| 34 | 34 |
require(WB_PATH.'/modules/admin.php'); |
| 35 | 35 |
|
| 36 |
if (!$admin->checkFTAN()) |
|
| 37 |
{
|
|
| 38 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
| 39 |
exit(); |
|
| 40 |
} |
|
| 41 |
|
|
| 36 | 42 |
// Include WB functions file |
| 37 | 43 |
require(WB_PATH.'/framework/functions.php'); |
| 38 | 44 |
|
| branches/2.8.x/wb/modules/news/move_up.php | ||
|---|---|---|
| 18 | 18 |
|
| 19 | 19 |
require('../../config.php');
|
| 20 | 20 |
|
| 21 |
// Include WB admin wrapper script |
|
| 22 |
require(WB_PATH.'/modules/admin.php'); |
|
| 23 |
|
|
| 21 | 24 |
// Get id |
| 22 |
if(!isset($_GET['post_id']) OR !is_numeric($_GET['post_id'])) {
|
|
| 23 |
if(!isset($_GET['group_id']) OR !is_numeric($_GET['group_id'])) {
|
|
| 24 |
|
|
| 25 |
header("Location: index.php");
|
|
| 26 |
exit( 0 ); |
|
| 25 |
$pid = $admin->checkIDKEY('post_id', false, 'GET');
|
|
| 26 |
$gid = $admin->checkIDKEY('group_id', false, 'GET');
|
|
| 27 |
if (!$pid) {
|
|
| 28 |
if (!$gid) {
|
|
| 29 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
| 30 |
exit(); |
|
| 27 | 31 |
} else {
|
| 28 |
$id = $_GET['group_id'];
|
|
| 32 |
$id = $gid;
|
|
| 29 | 33 |
$id_field = 'group_id'; |
| 30 | 34 |
$table = TABLE_PREFIX.'mod_news_groups'; |
| 31 | 35 |
} |
| 32 | 36 |
} else {
|
| 33 |
$id = $_GET['post_id'];
|
|
| 37 |
$id = $pid;
|
|
| 34 | 38 |
$id_field = 'post_id'; |
| 35 | 39 |
$table = TABLE_PREFIX.'mod_news_posts'; |
| 36 | 40 |
} |
| 37 | 41 |
|
| 38 |
// Include WB admin wrapper script |
|
| 39 |
require(WB_PATH.'/modules/admin.php'); |
|
| 40 |
|
|
| 41 | 42 |
// Include the ordering class |
| 42 | 43 |
require(WB_PATH.'/framework/class.order.php'); |
| 43 | 44 |
|
| branches/2.8.x/wb/modules/news/save_settings.php | ||
|---|---|---|
| 22 | 22 |
$update_when_modified = true; // Tells script to update when this page was last updated |
| 23 | 23 |
require(WB_PATH.'/modules/admin.php'); |
| 24 | 24 |
|
| 25 |
if (!$admin->checkFTAN()) |
|
| 26 |
{
|
|
| 27 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
| 28 |
exit(); |
|
| 29 |
} |
|
| 30 |
|
|
| 25 | 31 |
// This code removes any <?php tags and adds slashes |
| 26 | 32 |
$friendly = array('<', '>', '?php');
|
| 27 | 33 |
$raw = array('<', '>', '');
|
| ... | ... | |
| 44 | 50 |
} |
| 45 | 51 |
|
| 46 | 52 |
// Update settings |
| 47 |
$database->query("UPDATE ".TABLE_PREFIX."mod_news_settings SET header = '$header', post_loop = '$post_loop', footer = '$footer', posts_per_page = '$posts_per_page', post_header = '$post_header', post_footer = '$post_footer', comments_header = '$comments_header', comments_loop = '$comments_loop', comments_footer = '$comments_footer', comments_page = '$comments_page', commenting = '$commenting', resize = '$resize', use_captcha = '$use_captcha' WHERE section_id = '$section_id'");
|
|
| 53 |
$database->query("UPDATE ".TABLE_PREFIX."mod_news_settings SET header = '$header', post_loop = '$post_loop', footer = '$footer',
|
|
| 54 |
posts_per_page = '$posts_per_page', post_header = '$post_header', post_footer = '$post_footer', |
|
| 55 |
comments_header = '$comments_header', comments_loop = '$comments_loop', comments_footer = '$comments_footer', |
|
| 56 |
comments_page = '$comments_page', commenting = '$commenting', resize = '$resize', use_captcha = '$use_captcha' |
|
| 57 |
WHERE section_id = '$section_id'"); |
|
| 48 | 58 |
|
| 49 | 59 |
// Check if there is a db error, otherwise say successful |
| 50 | 60 |
if($database->is_error()) {
|
| branches/2.8.x/wb/modules/news/delete_comment.php | ||
|---|---|---|
| 18 | 18 |
|
| 19 | 19 |
require('../../config.php');
|
| 20 | 20 |
|
| 21 |
// Get id |
|
| 22 |
if(!isset($_GET['comment_id']) OR !is_numeric($_GET['comment_id'])) {
|
|
| 23 |
|
|
| 24 |
header("Location: ".ADMIN_URL."/pages/index.php");
|
|
| 25 |
exit( 0 ); |
|
| 26 |
} |
|
| 27 |
else |
|
| 28 |
{
|
|
| 29 |
$comment_id = $_GET['comment_id']; |
|
| 30 |
} |
|
| 31 |
|
|
| 32 |
// Get post id |
|
| 33 |
if(!isset($_GET['post_id']) OR !is_numeric($_GET['post_id'])) |
|
| 34 |
{
|
|
| 35 |
|
|
| 36 |
header("Location: ".ADMIN_URL."/pages/index.php");
|
|
| 37 |
exit( 0 ); |
|
| 38 |
} |
|
| 39 |
else |
|
| 40 |
{
|
|
| 41 |
$post_id = $_GET['post_id']; |
|
| 42 |
} |
|
| 43 |
|
|
| 44 | 21 |
// Include WB admin wrapper script |
| 45 | 22 |
$update_when_modified = true; // Tells script to update when this page was last updated |
| 46 | 23 |
require(WB_PATH.'/modules/admin.php'); |
| 47 | 24 |
|
| 25 |
$cid = $admin->checkIDKEY('comment_id', false, 'GET');
|
|
| 26 |
$pid = $admin->checkIDKEY('post_id', false, 'GET');
|
|
| 27 |
if (!$pid || !$cid) {
|
|
| 28 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
| 29 |
exit(); |
|
| 30 |
} else {
|
|
| 31 |
$comment_id = $cid; |
|
| 32 |
$post_id = $admin->getIDKEY($pid); |
|
| 33 |
} |
|
| 34 |
|
|
| 48 | 35 |
// Update row |
| 49 | 36 |
$database->query("DELETE FROM ".TABLE_PREFIX."mod_news_comments WHERE comment_id = '$comment_id'");
|
| 50 | 37 |
|
| branches/2.8.x/wb/modules/news/modify.php | ||
|---|---|---|
| 56 | 56 |
<table cellpadding="2" cellspacing="0" border="0" width="100%"> |
| 57 | 57 |
<?php |
| 58 | 58 |
while($post = $query_posts->fetchRow()) {
|
| 59 |
$pid = $admin->getIDKEY($post['post_id']); |
|
| 59 | 60 |
?> |
| 60 | 61 |
<tr class="row_<?php echo $row; ?>"> |
| 61 | 62 |
<td width="20" style="padding-left: 5px;"> |
| 62 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $post['post_id']; ?>" title="<?php echo $TEXT['MODIFY']; ?>">
|
|
| 63 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $pid; ?>" title="<?php echo $TEXT['MODIFY']; ?>">
|
|
| 63 | 64 |
<img src="<?php echo THEME_URL; ?>/images/modify_16.png" border="0" alt="Modify - " /> |
| 64 | 65 |
</a> |
| 65 | 66 |
</td> |
| 66 | 67 |
<td> |
| 67 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $post['post_id']; ?>">
|
|
| 68 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $pid; ?>">
|
|
| 68 | 69 |
<?php echo ($post['title']); ?> |
| 69 | 70 |
</a> |
| 70 | 71 |
</td> |
| ... | ... | |
| 103 | 104 |
else |
| 104 | 105 |
$icon=THEME_URL.'/images/clock_red_16.png'; |
| 105 | 106 |
?> |
| 106 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $post['post_id']; ?>" title="<?php echo $TEXT['MODIFY']; ?>">
|
|
| 107 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $pid; ?>" title="<?php echo $TEXT['MODIFY']; ?>">
|
|
| 107 | 108 |
<img src="<?php echo $icon; ?>" border="0" alt="" /> |
| 108 | 109 |
</a> |
| 109 | 110 |
</td> |
| 110 | 111 |
<td width="20"> |
| 111 | 112 |
<?php if($post['position'] != $num_posts) { ?>
|
| 112 |
<a href="<?php echo WB_URL; ?>/modules/news/move_down.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $post['post_id']; ?>" title="<?php echo $TEXT['MOVE_UP']; ?>">
|
|
| 113 |
<a href="<?php echo WB_URL; ?>/modules/news/move_down.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $pid; ?>" title="<?php echo $TEXT['MOVE_DOWN']; ?>">
|
|
| 113 | 114 |
<img src="<?php echo THEME_URL; ?>/images/up_16.png" border="0" alt="^" /> |
| 114 | 115 |
</a> |
| 115 | 116 |
<?php } ?> |
| 116 | 117 |
</td> |
| 117 | 118 |
<td width="20"> |
| 118 | 119 |
<?php if($post['position'] != 1) { ?>
|
| 119 |
<a href="<?php echo WB_URL; ?>/modules/news/move_up.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $post['post_id']; ?>" title="<?php echo $TEXT['MOVE_DOWN']; ?>">
|
|
| 120 |
<a href="<?php echo WB_URL; ?>/modules/news/move_up.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $pid; ?>" title="<?php echo $TEXT['MOVE_UP']; ?>">
|
|
| 120 | 121 |
<img src="<?php echo THEME_URL; ?>/images/down_16.png" border="0" alt="v" /> |
| 121 | 122 |
</a> |
| 122 | 123 |
<?php } ?> |
| 123 | 124 |
</td> |
| 124 | 125 |
<td width="20"> |
| 125 |
<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php echo WB_URL; ?>/modules/news/delete_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $post['post_id']; ?>');" title="<?php echo $TEXT['DELETE']; ?>">
|
|
| 126 |
<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php echo WB_URL; ?>/modules/news/delete_post.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $pid; ?>');" title="<?php echo $TEXT['DELETE']; ?>">
|
|
| 126 | 127 |
<img src="<?php echo THEME_URL; ?>/images/delete_16.png" border="0" alt="X" /> |
| 127 | 128 |
</a> |
| 128 | 129 |
</td> |
| ... | ... | |
| 157 | 158 |
<table cellpadding="2" cellspacing="0" border="0" width="100%"> |
| 158 | 159 |
<?php |
| 159 | 160 |
while($group = $query_groups->fetchRow()) {
|
| 161 |
$gid = $admin->getIDKEY($group['group_id']); |
|
| 160 | 162 |
?> |
| 161 | 163 |
<tr class="row_<?php echo $row; ?>"> |
| 162 | 164 |
<td width="20" style="padding-left: 5px;"> |
| 163 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_group.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $group['group_id']; ?>" title="<?php echo $TEXT['MODIFY']; ?>">
|
|
| 165 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_group.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $gid; ?>" title="<?php echo $TEXT['MODIFY']; ?>">
|
|
| 164 | 166 |
<img src="<?php echo THEME_URL; ?>/images/modify_16.png" border="0" alt="Modify - " /> |
| 165 | 167 |
</a> |
| 166 | 168 |
</td> |
| 167 | 169 |
<td> |
| 168 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_group.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $group['group_id']; ?>">
|
|
| 170 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_group.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $gid; ?>">
|
|
| 169 | 171 |
<?php echo $group['title']; ?> |
| 170 | 172 |
</a> |
| 171 | 173 |
</td> |
| ... | ... | |
| 174 | 176 |
</td> |
| 175 | 177 |
<td width="20"> |
| 176 | 178 |
<?php if($group['position'] != 1) { ?>
|
| 177 |
<a href="<?php echo WB_URL; ?>/modules/news/move_up.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $group['group_id']; ?>" title="<?php echo $TEXT['MOVE_UP']; ?>">
|
|
| 179 |
<a href="<?php echo WB_URL; ?>/modules/news/move_up.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $gid; ?>" title="<?php echo $TEXT['MOVE_UP']; ?>">
|
|
| 178 | 180 |
<img src="<?php echo THEME_URL; ?>/images/up_16.png" border="0" alt="^" /> |
| 179 | 181 |
</a> |
| 180 | 182 |
<?php } ?> |
| 181 | 183 |
</td> |
| 182 | 184 |
<td width="20"> |
| 183 | 185 |
<?php if($group['position'] != $num_groups) { ?>
|
| 184 |
<a href="<?php echo WB_URL; ?>/modules/news/move_down.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $group['group_id']; ?>" title="<?php echo $TEXT['MOVE_DOWN']; ?>">
|
|
| 186 |
<a href="<?php echo WB_URL; ?>/modules/news/move_down.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $gid; ?>" title="<?php echo $TEXT['MOVE_DOWN']; ?>">
|
|
| 185 | 187 |
<img src="<?php echo THEME_URL; ?>/images/down_16.png" border="0" alt="v" /> |
| 186 | 188 |
</a> |
| 187 | 189 |
<?php } ?> |
| 188 | 190 |
</td> |
| 189 | 191 |
<td width="20"> |
| 190 |
<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php echo WB_URL; ?>/modules/news/delete_group.php?page_id=<?php echo $page_id; ?>&group_id=<?php echo $group['group_id']; ?>');" title="<?php echo $TEXT['DELETE']; ?>">
|
|
| 192 |
<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php echo WB_URL; ?>/modules/news/delete_group.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&group_id=<?php echo $gid; ?>');" title="<?php echo $TEXT['DELETE']; ?>">
|
|
| 191 | 193 |
<img src="<?php echo THEME_URL; ?>/images/delete_16.png" border="0" alt="X" /> |
| 192 | 194 |
</a> |
| 193 | 195 |
</td> |
| branches/2.8.x/wb/modules/news/modify_post.php | ||
|---|---|---|
| 18 | 18 |
|
| 19 | 19 |
require('../../config.php');
|
| 20 | 20 |
|
| 21 |
// Get id |
|
| 22 |
if(!isset($_GET['post_id']) OR !is_numeric($_GET['post_id'])) {
|
|
| 23 |
header("Location: ".ADMIN_URL."/pages/index.php");
|
|
| 24 |
exit(0); |
|
| 25 |
} else {
|
|
| 26 |
$post_id = $_GET['post_id']; |
|
| 27 |
} |
|
| 28 |
|
|
| 29 | 21 |
// Include WB admin wrapper script |
| 30 | 22 |
require(WB_PATH.'/modules/admin.php'); |
| 31 | 23 |
|
| 24 |
$post_id = $admin->checkIDKEY('post_id', false, 'GET');
|
|
| 25 |
if (!$post_id) {
|
|
| 26 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
| 27 |
exit(); |
|
| 28 |
} |
|
| 29 |
|
|
| 32 | 30 |
// Get header and footer |
| 33 | 31 |
$query_content = $database->query("SELECT * FROM ".TABLE_PREFIX."mod_news_posts WHERE post_id = '$post_id'");
|
| 34 | 32 |
$fetch_content = $query_content->fetchRow(); |
| ... | ... | |
| 54 | 52 |
<input type="hidden" name="page_id" value="<?php echo $page_id; ?>" /> |
| 55 | 53 |
<input type="hidden" name="post_id" value="<?php echo $post_id; ?>" /> |
| 56 | 54 |
<input type="hidden" name="link" value="<?php echo $fetch_content['link']; ?>" /> |
| 55 |
<?php echo $admin->getFTAN(); ?> |
|
| 57 | 56 |
|
| 58 | 57 |
<table class="row_a" cellpadding="2" cellspacing="0" width="100%"> |
| 59 | 58 |
<tr> |
| ... | ... | |
| 205 | 204 |
$query_comments = $database->query("SELECT * FROM `".TABLE_PREFIX."mod_news_comments` WHERE section_id = '$section_id' AND post_id = '$post_id' ORDER BY commented_when DESC");
|
| 206 | 205 |
if($query_comments->numRows() > 0) {
|
| 207 | 206 |
$row = 'a'; |
| 207 |
$pid = $admin->getIDKEY($post_id); |
|
| 208 | 208 |
?> |
| 209 | 209 |
<table cellpadding="2" cellspacing="0" border="0" width="100%"> |
| 210 | 210 |
<?php |
| 211 | 211 |
while($comment = $query_comments->fetchRow()) {
|
| 212 |
$cid = $admin->getIDKEY($comment['comment_id']); |
|
| 212 | 213 |
?> |
| 213 | 214 |
<tr class="row_<?php echo $row; ?>" > |
| 214 | 215 |
<td width="20" style="padding-left: 5px;"> |
| 215 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_comment.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&comment_id=<?php echo $comment['comment_id']; ?>" title="<?php echo $TEXT['MODIFY']; ?>"> |
|
| 216 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_comment.php?page_id=<?php echo $page_id; ?>&section_id=<?php |
|
| 217 |
echo $section_id; ?>&comment_id=<?php echo $cid; ?>" title="<?php echo $TEXT['MODIFY']; ?>"> |
|
| 216 | 218 |
<img src="<?php echo THEME_URL; ?>/images/modify_16.png" border="0" alt="^" /> |
| 217 | 219 |
</a> |
| 218 | 220 |
</td> |
| 219 | 221 |
<td> |
| 220 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_comment.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&comment_id=<?php echo $comment['comment_id']; ?>"> |
|
| 222 |
<a href="<?php echo WB_URL; ?>/modules/news/modify_comment.php?page_id=<?php echo $page_id; ?>&section_id=<?php |
|
| 223 |
echo $section_id; ?>&comment_id=<?php echo $cid; ?>"> |
|
| 221 | 224 |
<?php echo $comment['title']; ?> |
| 222 | 225 |
</a> |
| 223 | 226 |
</td> |
| 224 | 227 |
<td width="20"> |
| 225 |
<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php echo WB_URL; ?>/modules/news/delete_comment.php?page_id=<?php echo $page_id; ?>&section_id=<?php echo $section_id; ?>&post_id=<?php echo $post_id; ?>&comment_id=<?php echo $comment['comment_id']; ?>');" title="<?php echo $TEXT['DELETE']; ?>">
|
|
| 228 |
<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php
|
|
| 229 |
echo WB_URL; ?>/modules/news/delete_comment.php?page_id=<?php echo $page_id; ?>&section_id=<?php |
|
| 230 |
echo $section_id; ?>&post_id=<?php echo $pid; ?>&comment_id=<?php echo $cid; ?>');" title="<?php |
|
| 231 |
echo $TEXT['DELETE']; ?>"> |
|
| 226 | 232 |
<img src="<?php echo THEME_URL; ?>/images/delete_16.png" border="0" alt="X" /> |
| 227 | 233 |
</a> |
| 228 | 234 |
</td> |
| branches/2.8.x/wb/modules/news/move_down.php | ||
|---|---|---|
| 18 | 18 |
|
| 19 | 19 |
require('../../config.php');
|
| 20 | 20 |
|
| 21 |
// Include WB admin wrapper script |
|
| 22 |
require(WB_PATH.'/modules/admin.php'); |
|
| 23 |
|
|
| 21 | 24 |
// Get id |
| 22 |
if(!isset($_GET['post_id']) OR !is_numeric($_GET['post_id'])) {
|
|
| 23 |
if(!isset($_GET['group_id']) OR !is_numeric($_GET['group_id'])) {
|
|
| 24 |
header("Location: index.php");
|
|
| 25 |
exit(0); |
|
| 25 |
$pid = $admin->checkIDKEY('post_id', false, 'GET');
|
|
| 26 |
$gid = $admin->checkIDKEY('group_id', false, 'GET');
|
|
| 27 |
if (!$pid) {
|
|
| 28 |
if (!$gid) {
|
|
| 29 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
| 30 |
exit(); |
|
| 26 | 31 |
} else {
|
| 27 |
$id = $_GET['group_id'];
|
|
| 32 |
$id = $gid;
|
|
| 28 | 33 |
$id_field = 'group_id'; |
| 29 | 34 |
$table = TABLE_PREFIX.'mod_news_groups'; |
| 30 | 35 |
} |
| 31 | 36 |
} else {
|
| 32 |
$id = $_GET['post_id'];
|
|
| 37 |
$id = $pid;
|
|
| 33 | 38 |
$id_field = 'post_id'; |
| 34 | 39 |
$table = TABLE_PREFIX.'mod_news_posts'; |
| 35 | 40 |
} |
| 36 | 41 |
|
| 37 |
// Include WB admin wrapper script |
|
| 38 |
require(WB_PATH.'/modules/admin.php'); |
|
| 39 |
|
|
| 40 | 42 |
// Include the ordering class |
| 41 | 43 |
require(WB_PATH.'/framework/class.order.php'); |
| 42 | 44 |
|
| branches/2.8.x/wb/modules/news/comment_page.php | ||
|---|---|---|
| 78 | 78 |
<input id="comment" name="comment" size="60" value="" /><br /> |
| 79 | 79 |
</p> |
| 80 | 80 |
<?php } |
| 81 |
?>
|
|
| 82 |
<?php echo $TEXT['TITLE']; ?>:
|
|
| 81 |
echo $admin->getFTAN();
|
|
| 82 |
echo $TEXT['TITLE']; ?>: |
|
| 83 | 83 |
<br /> |
| 84 | 84 |
<input type="text" name="title" maxlength="255" style="width: 90%;"<?php if(isset($_SESSION['comment_title'])) { echo ' value="'.$_SESSION['comment_title'].'"'; unset($_SESSION['comment_title']); } ?> />
|
| 85 | 85 |
<br /><br /> |
| branches/2.8.x/wb/modules/news/comment.php | ||
|---|---|---|
| 18 | 18 |
|
| 19 | 19 |
// Include config file |
| 20 | 20 |
require('../../config.php');
|
| 21 |
require_once(WB_PATH.'/framework/class.wb.php'); |
|
| 22 |
$wb = new wb; |
|
| 21 | 23 |
|
| 22 | 24 |
// Check if there is a post id |
| 23 |
if(!isset($_GET['post_id']) OR !is_numeric($_GET['post_id']) |
|
| 24 |
OR !isset($_GET['section_id']) OR !is_numeric($_GET['section_id'])) |
|
| 25 |
{
|
|
| 26 |
header("Location: ".WB_URL.PAGES_DIRECTORY."");
|
|
| 27 |
exit( 0 ); |
|
| 25 |
$post_id = $wb->checkIDKEY('post_id', false, 'GET');
|
|
| 26 |
if (!$post_id OR !isset($_GET['section_id']) OR !is_numeric($_GET['section_id'])) {
|
|
| 27 |
$wb->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], WB_URL); |
|
| 28 |
exit(); |
|
| 28 | 29 |
} |
| 29 |
$post_id = $_GET['post_id']; |
|
| 30 | 30 |
$section_id = $_GET['section_id']; |
| 31 | 31 |
|
| 32 | 32 |
// Query post for page id |
| branches/2.8.x/wb/modules/news/modify_group.php | ||
|---|---|---|
| 18 | 18 |
|
| 19 | 19 |
require('../../config.php');
|
| 20 | 20 |
|
| 21 |
// Get id |
|
| 22 |
if(!isset($_GET['group_id']) OR !is_numeric($_GET['group_id'])) {
|
|
| 23 |
header("Location: ".ADMIN_URL."/pages/index.php");
|
|
| 24 |
exit(0); |
|
| 25 |
} else {
|
|
| 26 |
$group_id = $_GET['group_id']; |
|
| 27 |
} |
|
| 28 |
|
|
| 29 | 21 |
// Include WB admin wrapper script |
| 30 | 22 |
require(WB_PATH.'/modules/admin.php'); |
| 31 | 23 |
|
| 24 |
$group_id = $admin->checkIDKEY('group_id', false, 'GET');
|
|
| 25 |
if (!$group_id) {
|
|
| 26 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
| 27 |
exit(); |
|
| 28 |
} |
|
| 29 |
|
|
| 32 | 30 |
// Get header and footer |
| 33 | 31 |
$query_content = $database->query("SELECT * FROM ".TABLE_PREFIX."mod_news_groups WHERE group_id = '$group_id'");
|
| 34 | 32 |
$fetch_content = $query_content->fetchRow(); |
| ... | ... | |
| 42 | 40 |
<input type="hidden" name="section_id" value="<?php echo $section_id; ?>" /> |
| 43 | 41 |
<input type="hidden" name="page_id" value="<?php echo $page_id; ?>" /> |
| 44 | 42 |
<input type="hidden" name="group_id" value="<?php echo $group_id; ?>" /> |
| 45 |
|
|
| 43 |
<?php echo $admin->getFTAN(); ?> |
|
| 46 | 44 |
<table class="row_a" cellpadding="2" cellspacing="0" border="0" width="100%"> |
| 47 | 45 |
<tr> |
| 48 | 46 |
<td width="80"><?php echo $TEXT['TITLE']; ?>:</td> |
| branches/2.8.x/wb/modules/news/save_post.php | ||
|---|---|---|
| 32 | 32 |
$post_id = $id; |
| 33 | 33 |
} |
| 34 | 34 |
|
| 35 |
// Include WB admin wrapper script |
|
| 36 |
$update_when_modified = true; // Tells script to update when this page was last updated |
|
| 37 |
require(WB_PATH.'/modules/admin.php'); |
|
| 38 |
|
|
| 39 |
if (!$admin->checkFTAN()) |
|
| 40 |
{
|
|
| 41 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
| 42 |
exit(); |
|
| 43 |
} |
|
| 44 |
|
|
| 35 | 45 |
function create_file($filename, $filetime=NULL ) |
| 36 | 46 |
{
|
| 37 | 47 |
global $page_id, $section_id, $post_id; |
| ... | ... | |
| 80 | 90 |
|
| 81 | 91 |
} |
| 82 | 92 |
|
| 83 |
// Include WB admin wrapper script |
|
| 84 |
$update_when_modified = true; // Tells script to update when this page was last updated |
|
| 85 |
require(WB_PATH.'/modules/admin.php'); |
|
| 86 |
|
|
| 87 | 93 |
// Validate all fields |
| 88 | 94 |
if($admin->get_post('title') == '' AND $admin->get_post('url') == '')
|
| 89 | 95 |
{
|
| branches/2.8.x/wb/modules/news/add_group.php | ||
|---|---|---|
| 31 | 31 |
$database->query("INSERT INTO ".TABLE_PREFIX."mod_news_groups (section_id,page_id,position,active) VALUES ('$section_id','$page_id','$position','1')");
|
| 32 | 32 |
|
| 33 | 33 |
// Get the id |
| 34 |
$group_id = $database->get_one("SELECT LAST_INSERT_ID()");
|
|
| 34 |
$group_id = $admin->getIDKEY($database->get_one("SELECT LAST_INSERT_ID()"));
|
|
| 35 | 35 |
|
| 36 | 36 |
// Say that a new record has been added, then redirect to modify page |
| 37 | 37 |
if($database->is_error()) {
|
| 38 | 38 |
$admin->print_error($database->get_error(), WB_URL.'/modules/news/modify_group.php?page_id='.$page_id.'§ion_id='.$section_id.'&group_id='.$group_id); |
| 39 | 39 |
} else {
|
| 40 |
$admin->print_success($TEXT['SUCCESS'], WB_URL.'/modules/news/modify_group.php?page_id='.$page_id.'§ion_id='.$section_id.'&group_id='.$group_id); |
|
| 40 |
$admin->print_success($TEXT['SUCCESS'], WB_URL.'/modules/news/modify_group.php?page_id='.$page_id.'§ion_id='.$section_id.'&group_id='.$group_id);
|
|
| 41 | 41 |
} |
| 42 | 42 |
|
| 43 | 43 |
// Print admin footer |
| branches/2.8.x/wb/modules/news/rss.php | ||
|---|---|---|
| 31 | 31 |
// Include WB files |
| 32 | 32 |
require_once('../../config.php');
|
| 33 | 33 |
require_once(WB_PATH.'/framework/class.frontend.php'); |
| 34 |
$database = new database(); |
|
| 35 | 34 |
$wb = new frontend(); |
| 36 | 35 |
$wb->page_id = $page_id; |
| 37 | 36 |
$wb->get_page_details(); |
| branches/2.8.x/wb/modules/news/delete_group.php | ||
|---|---|---|
| 18 | 18 |
|
| 19 | 19 |
require('../../config.php');
|
| 20 | 20 |
|
| 21 |
// Get id |
|
| 22 |
if(!isset($_GET['group_id']) OR !is_numeric($_GET['group_id'])) {
|
|
| 23 |
header("Location: ".ADMIN_URL."/pages/index.php");
|
|
| 24 |
exit(0); |
|
| 25 |
} else {
|
|
| 26 |
$group_id = $_GET['group_id']; |
|
| 27 |
} |
|
| 28 |
|
|
| 29 | 21 |
// Include WB admin wrapper script |
| 30 | 22 |
$update_when_modified = true; // Tells script to update when this page was last updated |
| 31 | 23 |
require(WB_PATH.'/modules/admin.php'); |
| 32 | 24 |
|
| 25 |
$gid = $admin->checkIDKEY('group_id', false, 'GET');
|
|
| 26 |
if (!$pid) {
|
|
| 27 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
| 28 |
exit(); |
|
| 29 |
} else {
|
|
| 30 |
$group_id = $gid; |
|
| 31 |
} |
|
| 32 |
|
|
| 33 | 33 |
$database->query("UPDATE ".TABLE_PREFIX."mod_news_posts SET group_id = '0' where group_id='$group_id'");
|
| 34 | 34 |
// Update row |
| 35 | 35 |
$database->query("DELETE FROM ".TABLE_PREFIX."mod_news_groups WHERE group_id = '$group_id'");
|
| branches/2.8.x/wb/modules/news/save_comment.php | ||
|---|---|---|
| 21 | 21 |
// Get id |
| 22 | 22 |
if(!isset($_POST['comment_id']) OR !is_numeric($_POST['comment_id']) OR !isset($_POST['post_id']) OR !is_numeric($_POST['post_id'])) |
| 23 | 23 |
{
|
| 24 |
|
|
| 25 | 24 |
header("Location: ".ADMIN_URL."/pages/index.php");
|
| 26 | 25 |
exit( 0 ); |
| 27 | 26 |
} |
| ... | ... | |
| 34 | 33 |
$update_when_modified = true; // Tells script to update when this page was last updated |
| 35 | 34 |
require(WB_PATH.'/modules/admin.php'); |
| 36 | 35 |
|
| 36 |
if (!$admin->checkFTAN()) |
|
| 37 |
{
|
|
| 38 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL); |
|
| 39 |
exit(); |
|
| 40 |
} |
|
| 41 |
|
|
| 42 |
$id = $admin->getIDKEY($comment_id); |
|
| 43 |
|
|
| 37 | 44 |
// Validate all fields |
| 38 | 45 |
if($admin->get_post('title') == '' AND $admin->get_post('comment') == '')
|
| 39 | 46 |
{
|
| ... | ... | |
| 43 | 50 |
{
|
| 44 | 51 |
$title = strip_tags($admin->get_post_escaped('title'));
|
| 45 | 52 |
$comment = strip_tags($admin->get_post_escaped('comment'));
|
| 46 |
$post_id = $admin->get_post('post_id');
|
|
| 53 |
$post_id = $admin->getIDKEY($admin->get_post('post_id'));
|
|
| 47 | 54 |
} |
| 48 | 55 |
|
| 49 | 56 |
// Update row |
| branches/2.8.x/wb/modules/news/submit_comment.php | ||
|---|---|---|
| 28 | 28 |
$wb = new wb; |
| 29 | 29 |
/* */ |
| 30 | 30 |
|
| 31 |
if (!$wb->checkFTAN()) |
|
| 32 |
{
|
|
| 33 |
$wb->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], WB_URL); |
|
| 34 |
exit(); |
|
| 35 |
} |
|
| 36 |
|
|
| 31 | 37 |
// Check if we should show the form or add a comment |
| 32 | 38 |
if(isset($_GET['page_id']) AND is_numeric($_GET['page_id']) |
| 33 | 39 |
AND isset($_GET['section_id']) AND is_numeric($_GET['section_id']) |
Also available in: Unified diff