Commit in phpslash-dev on MAIN
CHANGES+6-11.163 -> 1.164
include/modules/author/Author.class+43-131.4 -> 1.5
                      /index.php+4-41.5 -> 1.6
include/modules/story/Story_base.class+24-51.12 -> 1.13
+77-23
4 modified files
Author.class, author/index.php, Story_base.class - correct permission issues when saving profile and saving stories reported by tobozo and crashfr.

phpslash-dev
CHANGES 1.163 -> 1.164
diff -u -r1.163 -r1.164
--- CHANGES	9 May 2005 02:24:19 -0000	1.163
+++ CHANGES	11 May 2005 19:07:22 -0000	1.164
@@ -1,4 +1,4 @@
-$Id: CHANGES,v 1.163 2005/05/09 02:24:19 lems1 Exp $
+$Id: CHANGES,v 1.164 2005/05/11 19:07:22 joestewart Exp $
 
 Changes Legend...
 
@@ -12,6 +12,11 @@
  W - General Work on something
  9 - Removal of something (kill -9 :)
 
+2005-May 11  Joe Stewart <joe@php-slash.org> 
+[B] - Author.class, author/index.php, Story_base.class - correct permission 
+      issues when saving profile and saving stories reported by tobozo and 
+      crashfr.
+
 2005-May 08  Luis Mondesi <lemsx1@php-slash.org> 
 [B] - profile.php - turned off caching on user's profile updating page.
 

phpslash-dev/include/modules/author
Author.class 1.4 -> 1.5
diff -u -r1.4 -r1.5
--- Author.class	29 Oct 2004 18:09:53 -0000	1.4
+++ Author.class	11 May 2005 19:07:23 -0000	1.5
@@ -1,6 +1,6 @@
 <?php
 
-/* $Id: Author.class,v 1.4 2004/10/29 18:09:53 lems1 Exp $ */
+/* $Id: Author.class,v 1.5 2005/05/11 19:07:23 joestewart Exp $ */
 
 /**
 * Provides an API to the PHPSlash Author Management.
@@ -304,15 +304,12 @@
 
       global $HTTP_COOKIE_VARS;
 
-      if ($ary['author_name'] == "") {
-        $this->message .= "There is no author_name in Author.class::saveProfile";
-        return false;
-      }
-
+      // set the author id to the current user's session uid.
+      $ary['author_id'] = $this->auth->auth['uid'];
+      $ary['author_name'] = $this->auth->auth['uanme'];
+     
       /* addslashes for the (') AND str_replace for the (") */
       $ary["quote"] = clean($ary["quote"]);
-      $ary['author_name'] = clean($ary["author_name"]);
-      // $ary['author_name'] = clean($ary["author_name"]);
       $ary['author_realname'] = clean($ary["author_realname"]);
 
       $optionname_ary = $ary[optionname];
@@ -372,11 +369,11 @@
                         FROM psl_author
                         WHERE author_id = '".$ary['author_id']."'");
 
+      // skip update if user id not found
       if ($this->db->next_record()) {
          if ($ary['password'] == "") {
             $q  = "UPDATE psl_author
-                      SET author_name     = '$ary[author_name]',
-                          author_realname = '$ary[author_realname]',
+                      SET author_realname = '$ary[author_realname]',
                           url      = '$ary[url]',
                           email    = '$ary[email]',
                           quote    = '$ary[quote]',
@@ -384,8 +381,7 @@
                     WHERE author_id   = '$ary[author_id]'";
          } else {
             $q  = "UPDATE psl_author
-                   SET author_name     = '$ary[author_name]',
-                       author_realname = '$ary[author_realname]',
+                   SET author_realname = '$ary[author_realname]',
                        url      = '$ary[url]',
                        email    = '$ary[email]',
                        quote    = '$ary[quote]',
@@ -825,6 +821,28 @@
       };
    }
 
+   /**
+   * getEmail -  return email assign to name
+   *
+   * when given an id, getEmail returns the email 
+   *
+   * @param string name
+   * @access public
+   * return author_email
+   */
+   function getEmail($id) {
+       if (!$id) {
+          return false;
+       } else {
+          $id = (int) $id;
+          $q = "SELECT email
+                  FROM psl_author
+                 WHERE author_id = '$id' ";
+          $this->db->query($q);
+          $this->db->next_record();
+          return $this->db->f("email");
+       };
+    }
 
    /**
    * getAuthors - returns array with author ids and names
@@ -1096,6 +1114,18 @@
          } 
          return false;
    }
-  
+ 
+   /**
+   * getMessage - returns message text
+   *
+   * simply returns the contents of the message variable
+   *
+   * @access public
+   */
+   function getMessage() {
+      return pslgetText($this->message);
+   }
+
+ 
 }  /* end of Author.class */
 ?>

phpslash-dev/include/modules/author
index.php 1.5 -> 1.6
diff -u -r1.5 -r1.6
--- index.php	7 Jul 2004 17:26:00 -0000	1.5
+++ index.php	11 May 2005 19:07:24 -0000	1.6
@@ -1,6 +1,6 @@
 <?php
 
-/* $Id: index.php,v 1.5 2004/07/07 17:26:00 krabu Exp $ */
+/* $Id: index.php,v 1.6 2005/05/11 19:07:24 joestewart Exp $ */
 
 global $_PSL, $auth, $perm, $HTTP_GET_VARS, $HTTP_POST_VARS;
 
@@ -32,14 +32,14 @@
       case "update":
          if ($perm->have_perm("authorprofileSave")) {
             if($author->saveProfile($ary)) {
-               $content .= getMessage("Profile Updated");
-
+	       $content .= getMessage($author->getMessage());
                if (function_exists('jpcache_gc')) {
                   // expire cache for this session
                   jpcache_gc('string', "-slashSess-" . $sess->id, "100");
                }
 	         } else {
-               $content .= getError("Profile not updated");
+                    $content .= getError("Profile not updated");
+		    $content .= getError($author->getMessage());
 	         }
          }
       case "edit":

phpslash-dev/include/modules/story
Story_base.class 1.12 -> 1.13
diff -u -r1.12 -r1.13
--- Story_base.class	4 Nov 2004 23:01:57 -0000	1.12
+++ Story_base.class	11 May 2005 19:07:24 -0000	1.13
@@ -1,6 +1,6 @@
 <?php
 
-/* $Id: Story_base.class,v 1.12 2004/11/04 23:01:57 joestewart Exp $ */
+/* $Id: Story_base.class,v 1.13 2005/05/11 19:07:24 joestewart Exp $ */
 
 /* 
  * Class:   Story_base
@@ -464,11 +464,11 @@
     */
    function saveStory($ary) {
 
-      // Normal users can't edit another user's stories            
-      if((!$this->perm->have_perm('storyeditothers')) AND                
-         ( $ary['author_id'] != $this->auth->auth['uid'])) {               
+            // Normal users can't edit another user's stories
+      if((!$this->perm->have_perm('storyeditothers')) AND (($this->authorStory($ary[story_id]) != $this->auth->auth['uid']) OR ( $ary['author_id'] != $this->auth->auth['uid']))) {
          $this->message .= pslgetText("Sorry. You do not have the necessary privilege to view this page.");
-         return false;            
+         logwrite("Possibly a sucker trying to crack Story_base::saveStory()", $_SERVER['REMOTE_ADDR']);
+         return false;
       }
 
       $isOK = true;
@@ -901,6 +901,25 @@
       }
    }
 
+   /*
+    * authorStory - return the Author id for a Story
+    *
+    * @param integer id
+    * @access public
+    *
+    */
+   function authorStory($id_story){
+      $q = "SELECT author_id
+            FROM psl_author, psl_story
+            WHERE psl_story.story_id = '$id_story'
+            AND psl_author.author_id = psl_story.user_id";
+      $this->db->query($q);
+      if($this->db->next_record()){
+         return $this->db->f("author_id");
+      }
+      return false;
+   }
+
 }     // end of Story_base
 
 ?>
CVSspam 0.2.10