[mxbb-commits] mx_shoutbox mx_shoutbox.php,1.1,1.1.2.1

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Update of /cvsroot/mxbb/mx_shoutbox
In directory sc8-pr-cvs16.sourceforge.net:/tmp/cvs-serv8594

Modified Files:
      Tag: core28x
	mx_shoutbox.php 
Log Message:
Security fixes for mx_shotbox,Jon you can add this to head too.

Index: mx_shoutbox.php
===================================================================
RCS file: /cvsroot/mxbb/mx_shoutbox/mx_shoutbox.php,v
retrieving revision 1.1
retrieving revision 1.1.2.1
diff -C2 -d -r1.1 -r1.1.2.1
*** mx_shoutbox.php	21 Jun 2007 18:21:04 -0000	1.1
--- mx_shoutbox.php	5 Feb 2008 19:23:55 -0000	1.1.2.1
***************
*** 11,25 ****
  // -------------------------------------------------------------	
  
! if( !isset($HTTP_POST_VARS) )
!       {
!          $HTTP_POST_VARS    = &$_POST;
!          $HTTP_GET_VARS     = &$_GET;
!          $HTTP_SESSION_VARS = &$_SESSION;
!          $HTTP_SERVER_VARS  = &$_SERVER;
!       } 
! 
! if ($_GET[page]) {
! 	$page = "page=".$_GET[page]."&";
! }
  
  if ( defined('IN_PORTAL') )
--- 11,15 ----
  // -------------------------------------------------------------	
  
! $page_id = ($page_id) ? intval($page_id) : $mx_request_vars->request('page', MX_TYPE_NO_TAGS, 1);
  
  if ( defined('IN_PORTAL') )
***************
*** 63,88 ****
  	}
  
! 	$page_limit = $shout_config['list_index'];
  
  	/*******************************
   	Get mode from passed arguments
  	********************************/
! 
! 	if( isset($HTTP_POST_VARS['sbmode']) || isset($HTTP_GET_VARS['sbmode']) )
! 	{
! 		$mode = ( isset($HTTP_POST_VARS['sbmode']) ) ? $HTTP_POST_VARS['sbmode'] : $HTTP_GET_VARS['sbmode'];
! 	}
! 	else
! 	{
! 		$mode = "";
! 	}
  
  	switch ($mode)
  	{
  		case 'add':
! 			$username = ( !empty($HTTP_POST_VARS['username']) ) ? prepare_message(trim($HTTP_POST_VARS['username']), 0, 0, 0, 0) : $lang['guest'];
! 			$user_id = ( isset($HTTP_POST_VARS['user_id']) ) ? $HTTP_POST_VARS['user_id'] : $HTTP_GET_VARS['user_id'];
! 			$message = ( isset($HTTP_POST_VARS['message']) ) ? $HTTP_POST_VARS['message'] : $HTTP_GET_VARS['message'];
! 			$bbcode_on = ( isset($HTTP_POST_VARS['bbcode']) ) ? $HTTP_POST_VARS['bbcode'] : $HTTP_GET_VARS['bbcode'];
  			$time = time();
  			$bbcode_uid = make_bbcode_uid();
--- 53,74 ----
  	}
  
! 	$page_id_limit = $shout_config['list_index'];
  
  	/*******************************
   	Get mode from passed arguments
  	********************************/
! 	$mode = $mx_request_vars->request('sbmode', MX_TYPE_NO_TAGS, '');
  
  	switch ($mode)
  	{
  		case 'add':
! 			$username = ($user_data['user_id'] !== 1) ? prepare_message(trim($user_data['user_name']), 0, 0, 0, 0) : $lang['guest'];
! 			$user_id = $user_data['user_id'];
! 			$message = $mx_request_vars->request('message', MX_TYPE_NO_TAGS, '');
! 			if (!($message))
! 			{
! 				mx_message_die(GENERAL_MESSAGE, 'You most type a message');
! 			}
! 			$bbcode_on = $mx_request_vars->request('bbcode', MX_TYPE_NO_TAGS, '');
  			$time = time();
  			$bbcode_uid = make_bbcode_uid();
***************
*** 104,108 ****
  	
  		case 'delete':
! 			$id = ( isset($HTTP_POST_VARS['id']) ) ? $HTTP_POST_VARS['id'] : $HTTP_GET_VARS['id'];
  			if ( empty($id))
  			{
--- 90,94 ----
  	
  		case 'delete':
! 			$id = $mx_request_vars->request('id', MX_TYPE_INT, '');
  			if ( empty($id))
  			{
***************
*** 122,126 ****
  		case 'edit':
  		
! 			$id = ( isset($HTTP_POST_VARS['id']) ) ? $HTTP_POST_VARS['id'] : $HTTP_GET_VARS['id'];
  			if ( empty($id) )
  			{
--- 108,112 ----
  		case 'edit':
  		
! 			$id = $mx_request_vars->request('id', MX_TYPE_INT, '');
  			if ( empty($id) )
  			{
***************
*** 160,169 ****
  				$template->assign_vars(array(
  					'L_EDIT_SHOUT_INFO' => $lang['Edit_Shout_Info'],
! 					'SHOUT_TEXT' => $thisshout['text'],
  					'BOX_HEIGHT' => $box_height,
  					'L_SUBMIT' => $lang['Submit'],
  					'SHOUT_SIZE' => $shout_config['shout_size'],
  					'SHOUT_SIZE_EXPL' => $lang['shout_size_expl'],
! 					'S_SHOUT_ACTION' => append_sid("$_SERVER[PHP_SELF]?".$page."sbmode=edit_shout&id=$id"),	
  					)
  				);
--- 146,155 ----
  				$template->assign_vars(array(
  					'L_EDIT_SHOUT_INFO' => $lang['Edit_Shout_Info'],
! 					'SHOUT_TEXT' => $shout_startthisshout['text'],
  					'BOX_HEIGHT' => $box_height,
  					'L_SUBMIT' => $lang['Submit'],
  					'SHOUT_SIZE' => $shout_config['shout_size'],
  					'SHOUT_SIZE_EXPL' => $lang['shout_size_expl'],
! 					'S_SHOUT_ACTION' => append_sid($mx_root_path.'index.php?page='.$page_id."&amp;sbmode=edit_shout&id=$id"),	
  					)
  				);
***************
*** 182,186 ****
  		case 'edit_shout':
  			
! 			$id = ( isset($HTTP_POST_VARS['id']) ) ? $HTTP_POST_VARS['id'] : $HTTP_GET_VARS['id'];
  			if ( empty($id) )
  			{
--- 168,172 ----
  		case 'edit_shout':
  			
! 			$id = $mx_request_vars->request('id', MX_TYPE_INT, '');
  			if ( empty($id) )
  			{
***************
*** 203,208 ****
  			if ($userdata['user_level'] == ADMIN || $shoutnameid == $userdata['user_id'])
  			{
! 				$shout_text = str_replace("\'", "''", htmlspecialchars(trim($HTTP_POST_VARS['shout_text'])));
! 				$id = intval($HTTP_GET_VARS['id']);
  		
  				$sql = "UPDATE ". SHOUTBOX_TABLE ."
--- 189,195 ----
  			if ($userdata['user_level'] == ADMIN || $shoutnameid == $userdata['user_id'])
  			{
! 				$shout_text = $mx_request_vars->request('shout_text', MX_TYPE_NO_TAGS, '');
! 				$shout_text = str_replace("\'", "''", htmlspecialchars(trim($shout_text)));
! 				$id = $mx_request_vars->request('id', MX_TYPE_INT, '');
  		
  				$sql = "UPDATE ". SHOUTBOX_TABLE ."
***************
*** 235,239 ****
  	****************************/
  
! 	$s_form_action = append_sid($_SERVER[PHP_SELF]."?".$page);
  	$s_hidden_fields = '<input name="sid" type="hidden" value="' . $userdata['session_id'] . '" />' 
  		.'<input name="user_id" type="hidden" value="' . $userdata['user_id'] . '" />' 
--- 222,226 ----
  	****************************/
  
! 	$s_form_action = append_sid($mx_root_path.'index.php?page='.$page_id);
  	$s_hidden_fields = '<input name="sid" type="hidden" value="' . $userdata['session_id'] . '" />' 
  		.'<input name="user_id" type="hidden" value="' . $userdata['user_id'] . '" />' 
***************
*** 249,260 ****
   	Get variables for paginate
  	*****************************/
! 	if( isset($HTTP_POST_VARS['shout_start']) || isset($HTTP_GET_VARS['shout_start']) )
! 	{
! 		$shout_start = ( isset($HTTP_POST_VARS['shout_start']) ) ? $HTTP_POST_VARS['shout_start'] : $HTTP_GET_VARS['shout_start'];
! 	}
! 	else
! 	{
! 		$shout_start = 0;
! 	}
  			
  	/****************************
--- 236,241 ----
   	Get variables for paginate
  	*****************************/
! 	$shout_start = $mx_request_vars->request('shout_start', MX_TYPE_NO_TAGS, 0);
! 	$shout_start = ($shout_start < 0) ? 0 : $shout_start;
  			
  	/****************************
***************
*** 268,277 ****
  	}
  	$count = $db->sql_fetchrow($result);
! 	if ($page_limit == 0)
  	{
! 		$page_limit = $count['total'];
  	}
  
! 	$pagination = ( !empty($shout_config) ) ? eregi_replace('&amp;start', 'shout_start',generate_pagination($mx_root_path.'index.'.$phpEx.'?', $count['total'], $page_limit, $shout_start, FALSE)) : "";
  
  	if ($shout_config['static_box']==1)
--- 249,258 ----
  	}
  	$count = $db->sql_fetchrow($result);
! 	if ($page_id_limit == 0)
  	{
! 		$page_id_limit = $count['total'];
  	}
  
! 	$pagination = ( !empty($shout_config) ) ? eregi_replace('&amp;start', 'shout_start',generate_pagination($mx_root_path.'index.'.$phpEx.'?', $count['total'], $page_id_limit, $shout_start, FALSE)) : "";
  
  	if ($shout_config['static_box']==1)
***************
*** 327,331 ****
  		FROM " . SHOUTBOX_TABLE . " 
  		ORDER BY id DESC 
! 		LIMIT $shout_start,$page_limit";
  	if ( !($result = $db->sql_query($sql)) )
  	{
--- 308,312 ----
  		FROM " . SHOUTBOX_TABLE . " 
  		ORDER BY id DESC 
! 		LIMIT $shout_start,$page_id_limit";
  	if ( !($result = $db->sql_query($sql)) )
  	{
***************
*** 371,378 ****
  			if ( $userdata['session_logged_in'] )
  			{
! 				$delurl_tmp = append_sid("$_SERVER[PHP_SELF]?".$page."sbmode=delete&amp;id=$shoutid&amp;sid=" . $userdata['session_id']);
  				$delimg_tmp = '<img src="' . $images['icon_delpost'] . '" align="right" border="0" alt="' . $lang['alt_delete'] . '" />';
  		
! 				$edturl_tmp = append_sid("$_SERVER[PHP_SELF]?".$page."sbmode=edit&amp;id=$shoutid&amp;sid=" . $userdata['session_id']);
  				$edtimg_tmp = '<img src="' . $images['icon_edit'] . '" align="right" border="0" alt="' . $lang['alt_edit'] . '" />';
  			
--- 352,359 ----
  			if ( $userdata['session_logged_in'] )
  			{
! 				$delurl_tmp = append_sid($mx_root_path.'index.php?page='.$page_id."&amp;sbmode=delete&amp;id=$shoutid&amp;sid=" . $userdata['session_id']);
  				$delimg_tmp = '<img src="' . $images['icon_delpost'] . '" align="right" border="0" alt="' . $lang['alt_delete'] . '" />';
  		
! 				$edturl_tmp = append_sid($mx_root_path.'index.php?page='.$page_id."&amp;sbmode=edit&amp;id=$shoutid&amp;sid=" . $userdata['session_id']);
  				$edtimg_tmp = '<img src="' . $images['icon_edit'] . '" align="right" border="0" alt="' . $lang['alt_edit'] . '" />';