Menu
▾
▴
[Phpbb-checkins] CVS: phpBB2/admin admin_users.php,1.57.2.3,1.57.2.4
|
From: Doug K. <dou...@us...> - 2002-06-12 05:33:56
|
Update of /cvsroot/phpbb/phpBB2/admin
In directory usw-pr-cvs1:/tmp/cvs-serv21627/admin
Modified Files:
Tag: phpBB-2_0_0
admin_users.php
Log Message:
Ok, several things accomplished here...
1) Improvements to deletion of users in admin_users.
This includes bug 166 and Sourceforge tracker task #49374.
2) Two security holes were patched, both pointed out by
Nick Cleaton <nick at cleaton dot net>.
Thanks for letting us know, Nick!
That's about it for now, and it took almost all day. :P
Bye for now!
-Doug
Index: admin_users.php
===================================================================
RCS file: /cvsroot/phpbb/phpBB2/admin/admin_users.php,v
retrieving revision 1.57.2.3
retrieving revision 1.57.2.4
diff -C2 -r1.57.2.3 -r1.57.2.4
*** admin_users.php 28 May 2002 18:30:45 -0000 1.57.2.3
--- admin_users.php 12 Jun 2002 05:33:53 -0000 1.57.2.4
***************
*** 526,530 ****
$sql = "UPDATE " . POSTS_TABLE . "
! SET poster_id = " . ANONYMOUS . ", post_username = '$username'
WHERE poster_id = $user_id";
if( !$db->sql_query($sql) )
--- 526,530 ----
$sql = "UPDATE " . POSTS_TABLE . "
! SET poster_id = " . DELETED . ", post_username = '$username'
WHERE poster_id = $user_id";
if( !$db->sql_query($sql) )
***************
*** 534,538 ****
$sql = "UPDATE " . TOPICS_TABLE . "
! SET topic_poster = " . ANONYMOUS . "
WHERE topic_poster = $user_id";
if( !$db->sql_query($sql) )
--- 534,538 ----
$sql = "UPDATE " . TOPICS_TABLE . "
! SET topic_poster = " . DELETED . "
WHERE topic_poster = $user_id";
if( !$db->sql_query($sql) )
***************
*** 540,543 ****
--- 540,577 ----
message_die(GENERAL_ERROR, 'Could not update topics for this user', '', __LINE__, __FILE__, $sql);
}
+
+ $sql = "UPDATE " . VOTE_USERS_TABLE . "
+ SET vote_user_id = " . DELETED . "
+ WHERE vote_user_id = $user_id";
+ if( !$db->sql_query($sql) )
+ {
+ message_die(GENERAL_ERROR, 'Could not update votes for this user', '', __LINE__, __FILE__, $sql);
+ }
+
+ $sql = "SELECT group_id
+ FROM " . GROUPS_TABLE . "
+ WHERE group_moderator = $user_id";
+ if( !($result = $db->sql_query($sql)) )
+ {
+ message_die(GENERAL_ERROR, 'Could not select groups where user was moderator', '', __LINE__, __FILE__, $sql);
+ }
+
+ while ( $row_group = $db->sql_fetchrow($result) )
+ {
+ $group_moderator[] = $row_group['group_id'];
+ }
+
+ if ( count($group_moderator) )
+ {
+ $update_moderator_id = implode(', ', $group_moderator);
+
+ $sql = "UPDATE " . GROUPS_TABLE . "
+ SET group_moderator = " . $userdata['user_id'] . "
+ WHERE group_moderator IN ($update_moderator_id)";
+ if( !$db->sql_query($sql) )
+ {
+ message_die(GENERAL_ERROR, 'Could not update group moderators', '', __LINE__, __FILE__, $sql);
+ }
+ }
$sql = "DELETE FROM " . USERS_TABLE . "
***************
*** 576,579 ****
--- 610,687 ----
}
+ $sql = "SELECT privmsgs_id
+ FROM " . PRIVMSGS_TABLE . "
+ WHERE ( ( privmsgs_from_userid = $user_id
+ AND privmsgs_type = " . PRIVMSGS_NEW_MAIL . " )
+ OR ( privmsgs_from_userid = $user_id
+ AND privmsgs_type = " . PRIVMSGS_SENT_MAIL . " )
+ OR ( privmsgs_to_userid = $user_id
+ AND privmsgs_type = " . PRIVMSGS_READ_MAIL . " )
+ OR ( privmsgs_to_userid = $user_id
+ AND privmsgs_type = " . PRIVMSGS_SAVED_IN_MAIL . " )
+ OR ( privmsgs_from_userid = $user_id
+ AND privmsgs_type = " . PRIVMSGS_SAVED_OUT_MAIL . " ) )";
+ if ( !($result = $db->sql_query($sql)) )
+ {
+ message_die(GENERAL_ERROR, 'Could not select all user\'s private messages', '', __LINE__, __FILE__, $sql);
+ }
+
+ //
+ // This little bit of code directly from the private messaging section.
+ // Thanks Paul!
+ //
+
+ while ( $row_privmsgs = $db->sql_fetchrow($result) )
+ {
+ $mark_list[] = $row_privmsgs['privmsgs_id'];
+ }
+
+ if ( count($mark_list) )
+ {
+ $delete_sql_id = implode(', ', $mark_list);
+
+ //
+ // We shouldn't need to worry about updating conters here...
+ // They are already gone!
+ //
+
+ $delete_text_sql = "DELETE FROM " . PRIVMSGS_TEXT_TABLE . "
+ WHERE privmsgs_text_id IN ($delete_sql_id)";
+ $delete_sql = "DELETE FROM " . PRIVMSGS_TABLE . "
+ WHERE privmsgs_id IN ($delete_sql_id)";
+
+ //
+ // Shouldn't need the switch statement here, either, as we just want
+ // to take out all of the private messages. This will not affect
+ // the other messages we want to keep; the ids are unique.
+ //
+
+ if ( !$db->sql_query($delete_sql) )
+ {
+ message_die(GENERAL_ERROR, 'Could not delete private message info', '', __LINE__, __FILE__, $delete_sql);
+ }
+
+ if ( !$db->sql_query($delete_text_sql) )
+ {
+ message_die(GENERAL_ERROR, 'Could not delete private message text', '', __LINE__, __FILE__, $delete_text_sql);
+ }
+ }
+
+ $sql = "UPDATE " . PRIVMSGS_TABLE . "
+ SET privmsgs_to_userid = " . DELETED . "
+ WHERE privmsgs_to_userid = $user_id";
+ if ( !$db->sql_query($sql) )
+ {
+ message_die(GENERAL_ERROR, 'Could not update private messages saved to the user', '', __LINE__, __FILE__, $sql);
+ }
+
+ $sql = "UPDATE " . PRIVMSGS_TABLE . "
+ SET privmsgs_from_userid = " . DELETED . "
+ WHERE privmsgs_from_userid = $user_id";
+ if ( !$db->sql_query($sql) )
+ {
+ message_die(GENERAL_ERROR, 'Could not update private messages saved from the user', '', __LINE__, __FILE__, $sql);
+ }
+
$message = $lang['User_deleted'];
***************
*** 1032,1036 ****
$template->pparse('body');
-
}
else
--- 1140,1143 ----
|
