Changeset 3488 for trunk/include/functions_comment.inc.php

Timestamp:

Jul 1, 2009, 10:56:41 PM (15 years ago)

Author:

rvelices

Message:

• remove warn on unset variable
• insert_user_comment expects now the comment content to be sql safe (works now exactly as update_user_comment)

File:

• trunk/include/functions_comment.inc.php (modified) (11 diffs)

trunk/include/functions_comment.inc.php

@@ -100 +100 @@
 SELECT COUNT(*) AS user_exists
   FROM '.USERS_TABLE.'
-  WHERE '.$conf['user_fields']['username']." = '".addslashes($comm['author'])."'";
+  WHERE '.$conf['user_fields']['username']." = '".$comm['author']."'";
       $row = mysql_fetch_assoc( pwg_query( $query ) );
       if ( $row['user_exists'] == 1 )
@@ -157 +157 @@
   (author, author_id, content, date, validated, validation_date, image_id)
   VALUES (
-    "'.addslashes($comm['author']).'",
+    "'.$comm['author'].'",
     '.$comm['author_id'].',
-    "'.addslashes($comm['content']).'",
+    "'.$comm['content'].'",
     NOW(),
     "'.($comment_action=='validate' ? 'true':'false').'",
@@ -172 +172 @@
 
     if (($comment_action=='validate' and $conf['email_admin_on_comment']) or
-        ($comment_action!='validate' 
+        ($comment_action!='validate'
          and $conf['email_admin_on_comment_validation']))
     {
@@ -179 +179 @@
       $del_url = get_absolute_root_url().'comments.php?delete='.$comm['id'];
 
-      if (empty($comm['author'])) 
+      if (empty($comm['author']))
       {
-        $author_name = $user['username'];
+        $author_name = $user['username'];
       }
       else
       {
-        $author_name = $comm['author'];
+        $author_name = stripslashes($comm['author']);
       }
       $keyargs_content = array
       (
         get_l10n_args('Author: %s', $author_name),
-        get_l10n_args('Comment: %s', $comm['content']),
+        get_l10n_args('Comment: %s', stripslashes($comm['content']) ),
         get_l10n_args('', ''),
         get_l10n_args('Delete: %s', $del_url)
@@ -217 +217 @@
  * Tries to delete a user comment in the database
  * only admin can delete all comments
- * other users can delete their own comments 
+ * other users can delete their own comments
  * so to avoid a new sql request we add author in where clause
  *
- * @param comment_id 
+ * @param comment_id
  */
 
@@ -246 +246 @@
  * so to avoid a new sql request we add author in where clause
  *
- * @param comment_id 
+ * @param comment_id
  * @param post_key
  * @param content
  */
 
-function update_user_comment($comment, $post_key) {
+function update_user_comment($comment, $post_key)
+{
   global $conf;
 
@@ -276 +277 @@
     if ( mysql_num_rows( pwg_query( $query ) ) > 0 )
     {
-      array_push( $infos, l10n('comment_anti-flood') );
+      //?? array_push( $infos, l10n('comment_anti-flood') );
       $comment_action='reject';
     }
@@ -282 +283 @@
 
   // perform more spam check
-  $comment_action = 
+  $comment_action =
     trigger_event('user_comment_check',
-                  $comment_action, 
-                  array_merge($comment, 
+                  $comment_action,
+                  array_merge($comment,
                               array('author' => $GLOBALS['user']['username'])
                               )
@@ -308 +309 @@
     if ($result) {
       email_admin('edit', array('author' => $GLOBALS['user']['username'],
-                                'content' => $comment['content']));
-    }
-  }
-}
-
-function email_admin($action, $comment) {
+                                'content' => stripslashes($comment['content'])) );
+    }
+  }
+}
+
+function email_admin($action, $comment)
+{
   global $conf;
 
@@ -324 +326 @@
 
   include_once(PHPWG_ROOT_PATH.'include/functions_mail.inc.php');
-  
+
   $keyargs_content = array();
   $keyargs_content[] = get_l10n_args('Author: %s', $comment['author']);
-  if ($action=='delete') 
-  {
-    $keyargs_content[] = get_l10n_args('This author remove comment with id %d',
+  if ($action=='delete')
+  {
+    $keyargs_content[] = get_l10n_args('This author removed the comment with id %d',
                                        $comment['comment_id']
                                        );
@@ -338 +340 @@
     $keyargs_content[] = get_l10n_args('Comment: %s', $comment['content']);
   }
-  
-  pwg_mail_notification_admins(get_l10n_args('Comment by %s', 
+
+  pwg_mail_notification_admins(get_l10n_args('Comment by %s',
                                              $comment['author']),
                                $keyargs_content