Changeset 931

Timestamp:

04/08/07 17:14:20 (1 year ago)

Author:

Neal

Message:

Added stricter permissions checks for actions in moderate.php.

Files:

• trunk/upload/moderate.php (modified) (7 diffs)

trunk/upload/moderate.php

@@ -100 +100 @@
-
-                        if (preg_match('/[^0-9,]/', $posts))
+                                message($lang_common['Bad request']);
+
+                        // Verify that the post IDs are valid
+                        $result = $db->query('SELECT 1 FROM '.$db->prefix.'posts WHERE id IN('.$posts.') AND topic_id='.$tid) or error('Unable to check posts', __FILE__, __LINE__, $db->error());
+
+                        if ($db->num_rows($result) != substr_count($posts, ',') + 1)
-                                message($lang_common['Bad request']);
-
@@ -290 +296 @@
-                        message($lang_common['Bad request']);
-
+                // Verify that the topic IDs are valid
+                $result = $db->query('SELECT 1 FROM '.$db->prefix.'topics WHERE id IN('.implode(',',$topics).') AND forum_id='.$fid) or error('Unable to check topics', __FILE__, __LINE__, $db->error());
+
+                if ($db->num_rows($result) != count($topics))
+                        message($lang_common['Bad request']);
+
-                // Delete any redirect topics if there are any (only if we moved/copied the topic back to where it where it was once moved from)
-                $db->query('DELETE FROM '.$db->prefix.'topics WHERE forum_id='.$move_to_forum.' AND moved_to IN('.implode(',',$topics).')') or error('Unable to delete redirect topics', __FILE__, __LINE__, $db->error());
@@ -405 +417 @@
-
-                require PUN_ROOT.'include/search_idx.php';
+
+                // Verify that the topic IDs are valid
+                $result = $db->query('SELECT 1 FROM '.$db->prefix.'topics WHERE id IN('.$topics.') AND forum_id='.$fid) or error('Unable to check topics', __FILE__, __LINE__, $db->error());
+
+                if ($db->num_rows($result) != substr_count($topics, ',') + 1)
+                        message($lang_common['Bad request']);
-
-                // Delete the topics and any redirect topics
@@ -473 +491 @@
-                        message($lang_misc['No topics selected']);
-
-'
+ AND forum_id='.$fid
-
-                $redirect_msg = ($action) ? $lang_misc['Close topics redirect'] : $lang_misc['Open topics redirect'];
@@ -487 +505 @@
-                        message($lang_common['Bad request']);
-
-
+.' AND forum_id='.$fid
-
-                $redirect_msg = ($action) ? $lang_misc['Close topic redirect'] : $lang_misc['Open topic redirect'];
@@ -504 +522 @@
-                message($lang_common['Bad request']);
-
-
+.' AND forum_id='.$fid
-
-        redirect('viewtopic.php?id='.$stick, $lang_misc['Stick topic redirect']);
@@ -519 +537 @@
-                message($lang_common['Bad request']);
-
-
+.' AND forum_id='.$fid
-
-        redirect('viewtopic.php?id='.$unstick, $lang_misc['Unstick topic redirect']);