|
From: Garvin H. <gar...@us...> - 2004-09-14 12:56:19
|
Update of /cvsroot/php-blog/serendipity In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv18512 Modified Files: comment.php index.php serendipity_admin_comments.inc.php serendipity_admin_users.inc.php serendipity_functions.inc.php serendipity_functions_config.inc.php serendipity_functions_images.inc.php Log Message: fixed some more potential sql issues, beautify. Index: serendipity_admin_users.inc.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_admin_users.inc.php,v retrieving revision 1.10 retrieving revision 1.11 diff -u -d -r1.10 -r1.11 --- serendipity_admin_users.inc.php 9 Sep 2004 10:52:03 -0000 1.10 +++ serendipity_admin_users.inc.php 14 Sep 2004 12:56:08 -0000 1.11 @@ -22,7 +22,7 @@ } elseif ($_POST['userlevel'] > $serendipity['serendipityUserlevel']) { echo '<strong>' . CREATE_NOT_AUTHORIZED_USERLEVEL . '</strong>'; } else { - serendipity_db_query("DELETE FROM {$serendipity['dbPrefix']}authors WHERE authorid={$serendipity['POST']['user']}"); + serendipity_db_query("DELETE FROM {$serendipity['dbPrefix']}authors WHERE authorid=" . (int)$serendipity['POST']['user']); printf('<strong>' . DELETED_USER . '</strong>', $serendipity['POST']['user'], $user[0]['username']); } } @@ -37,8 +37,8 @@ password ) VALUES ( - '{$_POST['username']}', - '$enc_pass' + '" . serendipity_db_escape_string($_POST['username']) . "', + '" . serendipity_db_escape_String($enc_pass) . "' )"; serendipity_db_query($query); $serendipity['POST']['user'] = serendipity_db_insert_id('authors', 'authorid'); Index: serendipity_admin_comments.inc.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_admin_comments.inc.php,v retrieving revision 1.18 retrieving revision 1.19 diff -u -d -r1.18 -r1.19 --- serendipity_admin_comments.inc.php 14 Sep 2004 10:47:26 -0000 1.18 +++ serendipity_admin_comments.inc.php 14 Sep 2004 12:56:08 -0000 1.19 @@ -24,8 +24,8 @@ url = '" . serendipity_db_escape_string($serendipity['POST']['url']) . "', parent_id = '" . serendipity_db_escape_string($serendipity['POST']['replyTo']) . "', body = '" . serendipity_db_escape_string($serendipity['POST']['comment']) . "' - WHERE id = " . serendipity_db_escape_string($serendipity['GET']['id']) . " AND - entry_id = " . serendipity_db_escape_string($serendipity['POST']['entry_id']); + WHERE id = " . (int)$serendipity['GET']['id'] . " AND + entry_id = " . (int)$serendipity['POST']['entry_id']; serendipity_db_query($sql); echo COMMENT_EDITED; return true; @@ -38,7 +38,7 @@ FROM {$serendipity['dbPrefix']}comments c LEFT JOIN {$serendipity['dbPrefix']}entries e ON (e.id = c.entry_id) LEFT JOIN {$serendipity['dbPrefix']}authors a ON (e.authorid = a.authorid) - WHERE c.id = " . serendipity_db_escape_string($serendipity['GET']['id']) ." AND status = 'pending'"; + WHERE c.id = " . (int)$serendipity['GET']['id'] ." AND status = 'pending'"; $rs = serendipity_db_query($sql, true); if ($rs === false) { @@ -63,7 +63,7 @@ /* If we are not in preview, we need data from our database */ if (!isset($serendipity['POST']['preview']) ) { - $comment = serendipity_db_query("SELECT * FROM {$serendipity['dbPrefix']}comments WHERE id = ". $serendipity['GET']['id']); + $comment = serendipity_db_query("SELECT * FROM {$serendipity['dbPrefix']}comments WHERE id = ". (int)$serendipity['GET']['id']); $data['name'] = $comment[0]['author']; $data['email'] = $comment[0]['email']; $data['url'] = $comment[0]['url']; Index: serendipity_functions_images.inc.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_functions_images.inc.php,v retrieving revision 1.36 retrieving revision 1.37 diff -u -d -r1.36 -r1.37 --- serendipity_functions_images.inc.php 2 Sep 2004 13:41:00 -0000 1.36 +++ serendipity_functions_images.inc.php 14 Sep 2004 12:56:08 -0000 1.37 @@ -6,11 +6,12 @@ function serendipity_fetchImagesFromDatabase($start=0, $limit=0, &$total, $order = false, $ordermode = false, $directory = '') { global $serendipity; - if (empty($order)) { + $orderfields = serendipity_getImageFields(); + if (empty($order) || !isset($orderfields[$order])) { $order = 'date'; } - if (empty($ordermode)) { + if (empty($ordermode) || ($ordermode != 'DESC' && $ordermode != 'ASC')) { $ordermode = 'DESC'; } @@ -39,7 +40,7 @@ function serendipity_fetchImageFromDatabase($id) { global $serendipity; - $rs = serendipity_db_query("SELECT * FROM {$serendipity['dbPrefix']}images WHERE id = ". $id, true, 'assoc'); + $rs = serendipity_db_query("SELECT * FROM {$serendipity['dbPrefix']}images WHERE id = ". (int)$id, true, 'assoc'); return $rs; } @@ -54,9 +55,9 @@ $i=0; if (sizeof($updates) > 0) { foreach ($updates as $k => $v) { - $q[] = $k ." = '" . $v . "'"; + $q[] = $k ." = '" . serendipity_db_escape_string($v) . "'"; } - serendipity_db_query("UPDATE {$serendipity['dbPrefix']}images SET ". implode($q, ',') ." WHERE id = $id $admin"); + serendipity_db_query("UPDATE {$serendipity['dbPrefix']}images SET ". implode($q, ',') ." WHERE id = " . (int)$id . " $admin"); $i++; } return $i; @@ -87,7 +88,7 @@ } else { printf(FILE_NOT_FOUND . '<br />', $dFile); } - serendipity_db_query("DELETE FROM {$serendipity['dbPrefix']}images WHERE id = ". $id); + serendipity_db_query("DELETE FROM {$serendipity['dbPrefix']}images WHERE id = ". (int)$id); } /** @@ -159,12 +160,12 @@ serendipity_db_escape_string($filename), serendipity_db_escape_string($extension), serendipity_db_escape_string($mimetype), - serendipity_db_escape_string($filesize), - serendipity_db_escape_string($width), - serendipity_db_escape_string($height), + (int)$filesize, + (int)$width, + (int)$height, serendipity_db_escape_string($thumbnail), - serendipity_db_escape_string($date), - serendipity_db_escape_string($authorid), + (int)$date, + (int)$authorid, serendipity_db_escape_string($directory) ); @@ -542,8 +543,8 @@ $rs = serendipity_db_query("SELECT * FROM {$serendipity['dbPrefix']}images WHERE name = '" . serendipity_db_escape_string($fbase) . "' - " . ($fdir != '' ? "AND path = '$fdir'" : '') . " - AND mime = '$fdim[mime]'", true, 'assoc'); + " . ($fdir != '' ? "AND path = '" . serendipity_db_escape_string($fdir) . "'" : '') . " + AND mime = '" . serendipity_db_escape_string($fdim['mime']) . "'", true, 'assoc'); if (is_array($rs)) { $update = array(); $checkfile = $serendipity['serendipityPath'] . $serendipity['uploadPath'] . $rs['path'] . $rs['name'] . '.' . $rs['thumbnail_name'] . '.' . $rs['extension']; @@ -694,15 +695,7 @@ $left = '<input type="button" value="<<<" onclick="location.href=\'?'. $extraParems .'serendipity[page]=' . ($page-1) . '\';" '. (($start <= 0) ? 'disabled' : '') .'>' . "\n"; $right = '<input type="button" value=">>>" onclick="location.href=\'?'. $extraParems .'serendipity[page]=' . ($page+1) . '\';" '. (($totalImages < $start+$perPage) ? 'disabled' : '') .'>' . "\n"; - $sort_order = array( - 'date' => SORT_ORDER_DATE, - 'name' => SORT_ORDER_NAME, - 'authorid' => AUTHOR, - 'extension' => SORT_ORDER_EXTENSION, - 'size' => SORT_ORDER_SIZE, - 'dimensions_width' => SORT_ORDER_WIDTH, - 'dimensions_height' => SORT_ORDER_HEIGHT - ); + $sort_order = serendipity_getImageFields(); serendipity_traversePath( $paths, @@ -1035,4 +1028,16 @@ return $fdim; } -?> + +function serendipity_getImageFields() { + return array( + 'date' => SORT_ORDER_DATE, + 'name' => SORT_ORDER_NAME, + 'authorid' => AUTHOR, + 'extension' => SORT_ORDER_EXTENSION, + 'size' => SORT_ORDER_SIZE, + 'dimensions_width' => SORT_ORDER_WIDTH, + 'dimensions_height' => SORT_ORDER_HEIGHT + ); +} +?> \ No newline at end of file Index: serendipity_functions.inc.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_functions.inc.php,v retrieving revision 1.423 retrieving revision 1.424 diff -u -d -r1.423 -r1.424 --- serendipity_functions.inc.php 14 Sep 2004 10:47:26 -0000 1.423 +++ serendipity_functions.inc.php 14 Sep 2004 12:56:08 -0000 1.424 @@ -650,15 +650,15 @@ } } elseif (is_array($range) && count($range)==2) { - $startts = $range[0]; - $endts = $range[1]; + $startts = (int)$range[0]; + $endts = (int)$range[1]; $and = " WHERE timestamp >= $startts AND timestamp <= $endts"; } else { if ($modified_since) { $unix_modified = strtotime($modified_since); if ($unix_modified != -1) { - $and = ' WHERE last_modified >= ' . $unix_modified; + $and = ' WHERE last_modified >= ' . (int)$unix_modified; if (!empty($limit)) { $limit = ($limit > $serendipity['max_fetch_limit'] ? $limit : $serendipity['max_fetch_limit']); } @@ -834,7 +834,7 @@ {$serendipity['dbPrefix']}authors a WHERE a.authorid = e.authorid - AND e.$key LIKE $val + AND e.$key LIKE '" . serendipity_db_escape_string($val) . "' $admin $drafts LIMIT 1"; @@ -858,7 +858,7 @@ $authorid = 'all'; } - if ($authorid != 'all') { + if ($authorid != 'all' && is_numeric($authorid)) { $where = " WHERE (c.authorid = $authorid OR c.authorid = 0) OR a.userlevel < ".$serendipity['serendipityUserlevel']; } else { $where = ''; @@ -1813,7 +1813,7 @@ $sql = "SELECT $pgsql_insert author, email, type FROM {$serendipity['dbPrefix']}comments WHERE entry_id = '". (int)$entry_id ."' - AND email <> '$posterMail' + AND email <> '" . serendipity_db_escape_string($posterMail) . "' AND subscribed = 'true' $mysql_insert"; $subscribers = serendipity_db_query($sql); @@ -1855,7 +1855,7 @@ $sql = "UPDATE {$serendipity['dbPrefix']}comments SET subscribed = 'false' WHERE entry_id = '". (int)$entry_id ."' - AND email = '$email'"; + AND email = '" . serendipity_db_escape_string($email) . "'"; serendipity_db_query($sql); return serendipity_db_affected_rows(); @@ -2671,9 +2671,7 @@ serendipity_purgeEntry($id, $result[0]); serendipity_db_query("DELETE FROM {$serendipity["dbPrefix"]}entries WHERE id=$id"); - serendipity_db_query("DELETE FROM {$serendipity["dbPrefix"]}comments WHERE entry_id=$id"); - serendipity_db_query("DELETE FROM {$serendipity['dbPrefix']}references WHERE entry_id='$id'"); } @@ -3123,8 +3121,8 @@ FROM $serendipity[dbPrefix]authors WHERE - username = '$username' - AND password = '$password'"; + username = '" . serendipity_db_escape_string($username) . "' + AND password = '" . serendipity_db_escape_string($password) . "'"; $row = serendipity_db_query($query, true, 'assoc'); if (is_array($row)) { @@ -3176,31 +3174,41 @@ if (rand(0, 100) < 1) { serendipity_track_referrer_gc(); } - if(preg_match('/^mysqli?/', $serendipity['dbType'])) + + if(preg_match('/^mysqli?/', $serendipity['dbType'])) { $interval = 900; - else + } else { $interval = "interval '900'"; + } $suppressq = "SELECT count(1) FROM $serendipity[dbPrefix]suppress - WHERE ip = '$_SERVER[REMOTE_ADDR]' - AND scheme = '$url_parts[scheme]' - AND port = '$url_parts[port]' - AND host = '$url_parts[host]' - AND path = '$url_parts[path]' - AND query = '$url_parts[query]' + WHERE ip = '" . serendipity_db_escape_string($_SERVER['REMOTE_ADDR']) . "' + AND scheme = '" . serendipity_db_escape_string($url_parts['scheme']) . "' + AND port = '" . serendipity_db_escape_string($url_parts['port']) . "' + AND host = '" . serendipity_db_escape_string($url_parts['host']) . "' + AND path = '" . serendipity_db_escape_string($url_parts['path']) . "' + AND query = '" . serendipity_db_escape_string($url_parts['query']) . "' AND last > now() - $interval"; $suppressp = "DELETE FROM $serendipity[dbPrefix]suppress - WHERE ip = '$_SERVER[REMOTE_ADDR]' - AND scheme = '$url_parts[scheme]' - AND host = '$url_parts[host]' - AND port = '$url_parts[port]' - AND query = '$url_parts[query]' - AND path = '$url_parts[path]'"; + WHERE ip = '" . serendipity_db_escape_string($_SERVER['REMOTE_ADDR']) . "' + AND scheme = '" . serendipity_db_escape_string($url_parts['scheme']) . "' + AND host = '" . serendipity_db_escape_string($url_parts['host']) . "' + AND port = '" . serendipity_db_escape_string($url_parts['port']) . "' + AND query = '" . serendipity_db_escape_string($url_parts['query']) . "' + AND path = '" . serendipity_db_escape_string($url_parts['path']) . "'"; $suppressu = "INSERT INTO $serendipity[dbPrefix]suppress (ip, last, scheme, host, port, path, query) - VALUES ('$_SERVER[REMOTE_ADDR]', now(), '$url_parts[scheme]', '$url_parts[host]', '$url_parts[port]', '$url_parts[path]', '$url_parts[query]')"; + VALUES ( + '" . serendipity_db_escape_string($_SERVER['REMOTE_ADDR']) . "', + now(), + '" . serendipity_db_escape_string($url_parts['scheme']) . "', + '" . serendipity_db_escape_string($url_parts['host']) . "', + '" . serendipity_db_escape_string($url_parts['port']) . "', + '" . serendipity_db_escape_string($url_parts['path']) . "', + '" . serendipity_db_escape_string($url_parts['query']) . "' + )"; $count = serendipity_db_query($suppressq, true); @@ -3248,11 +3256,11 @@ $serendipity['dbPrefix'], $list, - $url_parts['scheme'], - $url_parts['host'], - $url_parts['port'], - $url_parts['path'], - $url_parts['query'], + serendipity_db_escape_string($url_parts['scheme']), + serendipity_db_escape_string($url_parts['host']), + serendipity_db_escape_string($url_parts['port']), + serendipity_db_escape_string($url_parts['path']), + serendipity_db_escape_string($url_parts['query']), ($entry_id != 0) ? "AND entry_id = '". (int)$entry_id ."'" : '' ) ); @@ -3266,12 +3274,12 @@ $serendipity['dbPrefix'], $list, - $entry_id, - $url_parts['scheme'], - $url_parts['host'], - $url_parts['port'], - $url_parts['path'], - $url_parts['query'] + (int)$entry_id, + serendipity_db_escape_string($url_parts['scheme']), + serendipity_db_escape_string($url_parts['host']), + serendipity_db_escape_string($url_parts['port']), + serendipity_db_escape_string($url_parts['path']), + serendipity_db_escape_string($url_parts['query']) ) ); } @@ -3424,10 +3432,10 @@ return; } - $query = "DELETE FROM $serendipity[dbPrefix]entrycat WHERE entryid = $postid"; + $query = "DELETE FROM $serendipity[dbPrefix]entrycat WHERE entryid = " . (int)$postid; serendipity_db_query($query); - $query = "INSERT INTO $serendipity[dbPrefix]entrycat (entryid, categoryid) VALUES ($categories[0], $postid)"; + $query = "INSERT INTO $serendipity[dbPrefix]entrycat (entryid, categoryid) VALUES (" . (int)$categories[0] . ", " . (int)$postid . ")"; serendipity_db_query($query); } Index: index.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/index.php,v retrieving revision 1.49 retrieving revision 1.50 diff -u -d -r1.49 -r1.50 --- index.php 24 Aug 2004 17:32:45 -0000 1.49 +++ index.php 14 Sep 2004 12:56:08 -0000 1.50 @@ -114,7 +114,7 @@ } } - $id = $matches[1]; + $id = (int)$matches[1]; serendipity_track_referrer($id); $track_referer = false; @@ -122,8 +122,7 @@ $_GET['serendipity']['action'] = 'read'; $_GET['serendipity']['id'] = $id; - $title = serendipity_db_query("SELECT title FROM {$serendipity['dbPrefix']}entries " . - 'WHERE id=' . serendipity_db_escape_string($id), true); + $title = serendipity_db_query("SELECT title FROM {$serendipity['dbPrefix']}entries WHERE id=$id", true); $title = $title[0]; $serendipity['blogSubTitle'] = $serendipity['blogTitle']; @@ -176,7 +175,7 @@ } else if (preg_match(PAT_CATEGORIES, $uri, $matches) || preg_match('@/(index\.(php|html))?@', $uri) || preg_match('@/(' . preg_quote($serendipity['indexFile']) . ')?@', $uri)) { - + if (count($serendipity['GET']) == 2) { if (isset($matches) && is_array($matches) && isset($matches[1])) { $serendipity['GET']['category'] = $matches[1]; Index: serendipity_functions_config.inc.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_functions_config.inc.php,v retrieving revision 1.10 retrieving revision 1.11 diff -u -d -r1.10 -r1.11 --- serendipity_functions_config.inc.php 30 Aug 2004 09:13:59 -0000 1.10 +++ serendipity_functions_config.inc.php 14 Sep 2004 12:56:08 -0000 1.11 @@ -3,7 +3,7 @@ function serendipity_set_config_var($name, $val, $authorid = 0) { global $serendipity; - serendipity_db_query("DELETE FROM {$serendipity['dbPrefix']}config where name='" . serendipity_db_escape_string($name) . "' AND authorid = " . serendipity_db_escape_string($authorid)); + serendipity_db_query("DELETE FROM {$serendipity['dbPrefix']}config where name='" . serendipity_db_escape_string($name) . "' AND authorid = " . (int)$authorid); $r = serendipity_db_insert('config', array('name' => $name, 'value' => $val, 'authorid' => $authorid)); $serendipity[$name] = $val; if (is_string($r)) { @@ -27,7 +27,7 @@ function serendipity_get_user_var($name, $authorid, $default) { global $serendipity; - $r = serendipity_db_query("SELECT $name FROM {$serendipity['dbPrefix']}authors WHERE authorid = " . serendipity_db_escape_string($authorid), true); + $r = serendipity_db_query("SELECT $name FROM {$serendipity['dbPrefix']}authors WHERE authorid = " . (int)$authorid, true); if (is_array($r)) { return $r[0]; @@ -64,7 +64,7 @@ break; } - serendipity_db_query("UPDATE {$serendipity['dbPrefix']}authors SET $name = '" . serendipity_db_escape_string($val) . "' WHERE authorid = " . serendipity_db_escape_string($authorid)); + serendipity_db_query("UPDATE {$serendipity['dbPrefix']}authors SET $name = '" . serendipity_db_escape_string($val) . "' WHERE authorid = " . (int)$authorid); if ($copy_to_s9y) { if (isset($user_map_array[$name])) { Index: comment.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/comment.php,v retrieving revision 1.46 retrieving revision 1.47 diff -u -d -r1.46 -r1.47 --- comment.php 13 Sep 2004 20:06:26 -0000 1.46 +++ comment.php 14 Sep 2004 12:56:08 -0000 1.47 @@ -38,12 +38,12 @@ $uri = $_SERVER['REQUEST_URI']; if (isset($_REQUEST['entry_id'])) { - $id = $_REQUEST['entry_id']; + $id = (int)$_REQUEST['entry_id']; } else if ($_REQUEST['amp;entry_id']) { // For possible buggy variable transmission caused by an intermediate CVS-release of s9y - $id = $_REQUEST['amp;entry_id']; + $id = (int)$_REQUEST['amp;entry_id']; } else if (preg_match('@/(\d+)_[^/]*$@', $uri, $matches)) { - $id = $matches[1]; + $id = (int)$matches[1]; } if ($tb_logging) { @@ -76,7 +76,7 @@ report_pingback_failure(); } } else { - $id = (!empty($serendipity['POST']['entry_id']) ? $serendipity['POST']['entry_id'] : $serendipity['GET']['entry_id']); + $id = (int)(!empty($serendipity['POST']['entry_id']) ? $serendipity['POST']['entry_id'] : $serendipity['GET']['entry_id']); $html_header = ''; @@ -125,7 +125,7 @@ ?> <div class="serendipity_commentsTitle"><?php echo COMMENTS; ?></div> <?php - $query = "SELECT allow_comments, moderate_comments FROM {$serendipity['dbPrefix']}entries WHERE id = '$id'"; + $query = "SELECT allow_comments, moderate_comments FROM {$serendipity['dbPrefix']}entries WHERE id = '" . $id . "'"; $ca = serendipity_db_query($query, true); serendipity_printComments(serendipity_fetchComments($id), (isset($ca['allow_comments']) ? $ca['allow_comments'] : true)); |
