Changeset 1716 for trunk/comments.php

Timestamp:

Jan 12, 2007, 12:15:26 AM (17 years ago)

Author:

rvelices

Message:

plugins improvements: allow plugins to fail the installation/activation
comments.php improvements:

• no more double sql escaping on author & keyword (once in common.inc.php and

once in comments.php)

• now can search comment content on all special char ( ', ", <, >, & )
• author & keyword are correctly redisplayed in browser when they are MySql

escaped

File:

• trunk/comments.php (modified) (7 diffs)

trunk/comments.php

@@ -3 +3 @@
 // | PhpWebGallery - a PHP based picture gallery                           |
 // | Copyright (C) 2002-2003 Pierrick LE GALL - pierrick@phpwebgallery.net |
-// | Copyright (C) 2003-2005 PhpWebGallery Team - http://phpwebgallery.net |
+// | Copyright (C) 2003-2007 PhpWebGallery Team - http://phpwebgallery.net |
 // +-----------------------------------------------------------------------+
 // | branch        : BSF (Best So Far)
@@ -64 +64 @@
   );
 
-$page['since'] = isset($_GET['since']) ? $_GET['since'] : 3;
+$page['since'] = isset($_GET['since']) ? $_GET['since'] : 4;
 
 // on which field sorting
@@ -92 +92 @@
 }
 
+$page['where_clauses'] = array();
+
 // which category to filter on ?
-$page['cat_clause'] = '1=1';
 if (isset($_GET['cat']) and 0 != $_GET['cat'])
 {
-  $page['cat_clause'] =
+  $page['where_clauses'][] =
     'category_id IN ('.implode(',', get_subcat_ids(array($_GET['cat']))).')';
 }
 
 // search a particular author
-$page['author_clause'] = '1=1';
 if (isset($_GET['author']) and !empty($_GET['author']))
 {
-  if (function_exists('mysql_real_escape_string'))
-  {
-    $author = mysql_real_escape_string($_GET['author']);
-  }
-  else
-  {
-    $author = mysql_escape_string($_GET['author']);
-  }
-
-  $page['author_clause'] = 'author = \''.$author.'\'';
+  $page['where_clauses'][] = 'com.author = \''.$_GET['author'].'\'';
 }
 
 // search a substring among comments content
-$page['keyword_clause'] = '1=1';
 if (isset($_GET['keyword']) and !empty($_GET['keyword']))
 {
-  if (function_exists('mysql_real_escape_string'))
-  {
-    $keyword = mysql_real_escape_string($_GET['keyword']);
-  }
-  else
-  {
-    $keyword = mysql_escape_string($_GET['keyword']);
-  }
-  $page['keyword_clause'] =
+  // fors some odd reason comment content is htmlspecialchars in the database 
+  $keyword = addslashes( 
+      htmlspecialchars( stripslashes($_GET['keyword']), ENT_QUOTES) 
+    );
+  $page['where_clauses'][] =
     '('.
     implode(' AND ',
@@ -142 +128 @@
 }
 
+$page['where_clauses'][] = $since_options[$page['since']]['clause'];
+
 // which status to filter on ?
-if ( is_admin() )
-{
-  $page['status_clause'] = '1=1';
-}
-else
-{
-  $page['status_clause'] = 'validated="true"';
-}
-
+if ( !is_admin() )
+{
+  $page['where_clauses'][] = 'validated="true"';
+}
+
+$page['where_clauses'][] = get_sql_condition_FandF
+  (
+    array
+      (
+        'forbidden_categories' => 'category_id',
+        'visible_categories' => 'category_id',
+        'visible_images' => 'ic.image_id'
+      ),
+    '', true
+  );
 
 // +-----------------------------------------------------------------------+
@@ -194 +188 @@
 
     'F_ACTION'=>PHPWG_ROOT_PATH.'comments.php',
-    'F_KEYWORD'=>@htmlentities($_GET['keyword']),
-    'F_AUTHOR'=>@htmlentities($_GET['author']),
+    'F_KEYWORD'=>@htmlentities(stripslashes($_GET['keyword'])),
+    'F_AUTHOR'=>@htmlentities(stripslashes($_GET['author'])),
 
     'U_HOME' => make_index_url(),
@@ -308 +302 @@
     INNER JOIN '.COMMENTS_TABLE.' AS com
     ON ic.image_id = com.image_id
-  WHERE '.$since_options[$page['since']]['clause'].'
-    AND '.$page['cat_clause'].'
-    AND '.$page['author_clause'].'
-    AND '.$page['keyword_clause'].'
-    AND '.$page['status_clause'].'
-'.get_sql_condition_FandF
-  (
-    array
-      (
-        'forbidden_categories' => 'category_id',
-        'visible_categories' => 'category_id',
-        'visible_images' => 'ic.image_id'
-      ),
-    'AND'
-  ).'
+  WHERE '.implode('
+    AND ', $page['where_clauses']).'
 ;';
 list($counter) = mysql_fetch_row(pwg_query($query));
@@ -358 +339 @@
     INNER JOIN '.COMMENTS_TABLE.' AS com
     ON ic.image_id = com.image_id
-  WHERE '.$since_options[$page['since']]['clause'].'
-    AND '.$page['cat_clause'].'
-    AND '.$page['author_clause'].'
-    AND '.$page['keyword_clause'].'
-    AND '.$page['status_clause'].'
-'.get_sql_condition_FandF
-  (
-    array
-      (
-        'forbidden_categories' => 'category_id',
-        'visible_categories' => 'category_id',
-        'visible_images' => 'ic.image_id'
-      ),
-    'AND'
-  ).'
+  WHERE '.implode('
+    AND ', $page['where_clauses']).'
   GROUP BY comment_id
   ORDER BY '.$page['sort_by'].' '.$page['sort_order'];