Changeset 4304 for trunk/admin

Timestamp:

Nov 18, 2009, 9:07:20 PM (14 years ago)

Author:

Eric

Message:

Escape all login and username characters in database
Display correctly usernames

(I hope not to have made mistakes)

Location:

trunk/admin

Files:

• comments.php (modified) (1 diff)
• history.php (modified) (1 diff)
• include/c13y_internal.class.php (modified) (1 diff)
• include/functions.php (modified) (1 diff)
• include/functions_notification_by_mail.inc.php (modified) (5 diffs)
• notification_by_mail.php (modified) (5 diffs)
• rating.php (modified) (1 diff)
• upload.php (modified) (1 diff)
• user_list.php (modified) (1 diff)

trunk/admin/comments.php

@@ -161 +161 @@
   else
   {
-    $author_name = $row['username'];
+    $author_name = stripslashes($row['username']);
   }
   $template->append(

trunk/admin/history.php

@@ -260 +260 @@
     while ($row = mysql_fetch_assoc($result))
     {
-      $username_of[$row['id']] = $row['username'];
+      $username_of[$row['id']] = stripslashes($row['username']);
     }
   }

trunk/admin/include/c13y_internal.class.php

@@ -196 +196 @@
               array(
                 'id'       => $id,
-                'username' => $name,
+                'username' => addslashes($name),
                 'password' => $password
                 ),

trunk/admin/include/functions.php

@@ -2113 +2113 @@
   }
 
-  return $username;
+  return stripslashes($username);
 }
 

trunk/admin/include/functions_notification_by_mail.inc.php

@@ -289 +289 @@
 
   $env_nbm['sent_mail_count'] += 1;
-  array_push($page['infos'], sprintf($env_nbm['msg_info'], $nbm_user['username'], $nbm_user['mail_address']));
+  array_push($page['infos'], sprintf($env_nbm['msg_info'], stripslashes($nbm_user['username']), $nbm_user['mail_address']));
 }
 
@@ -302 +302 @@
 
   $env_nbm['error_on_mail_count'] += 1;
-  array_push($page['errors'], sprintf($env_nbm['msg_error'], $nbm_user['username'], $nbm_user['mail_address']));
+  array_push($page['errors'], sprintf($env_nbm['msg_error'], stripslashes($nbm_user['username']), $nbm_user['mail_address']));
 }
 
@@ -339 +339 @@
     array
     (
-      'USERNAME' => $nbm_user['username'],
+      'USERNAME' => stripslashes($nbm_user['username']),
 
       'SEND_AS_NAME' => $env_nbm['send_as_name'],
@@ -428 +428 @@
         if (pwg_mail
             (
-              format_email($nbm_user['username'], $nbm_user['mail_address']),
+              format_email(stripslashes($nbm_user['username']), $nbm_user['mail_address']),
               array
               (
@@ -466 +466 @@
         );
         $updated_data_count += 1;
-        array_push($page['infos'], sprintf($msg_info, $nbm_user['username'], $nbm_user['mail_address']));
+        array_push($page['infos'], sprintf($msg_info, stripslashes($nbm_user['username']), $nbm_user['mail_address']));
       }
       else
       {
         $error_on_updated_data_count += 1;
-        array_push($page['errors'], sprintf($msg_error, $nbm_user['username'], $nbm_user['mail_address']));
+        array_push($page['errors'], sprintf($msg_error, stripslashes($nbm_user['username']), $nbm_user['mail_address']));
       }
 

trunk/admin/notification_by_mail.php

@@ -176 +176 @@
         sprintf(
           l10n('nbm_user_x_added'),
-          $nbm_user['username'],
+          stripslashes($nbm_user['username']),
           get_email_address_as_display_text($nbm_user['mail_address'])
         )
@@ -389 +389 @@
               if (pwg_mail
                   (
-                    format_email($nbm_user['username'], $nbm_user['mail_address']),
+                    format_email(stripslashes($nbm_user['username']), $nbm_user['mail_address']),
                     array
                     (
@@ -666 +666 @@
       if (get_boolean($nbm_user['enabled']))
       {
-        $opt_true[ $nbm_user['check_key'] ] = $nbm_user['username'].'['.get_email_address_as_display_text($nbm_user['mail_address']).']';
+        $opt_true[ $nbm_user['check_key'] ] = stripslashes($nbm_user['username']).'['.get_email_address_as_display_text($nbm_user['mail_address']).']';
         if ((isset($_POST['falsify']) and isset($_POST['cat_true']) and in_array($nbm_user['check_key'], $_POST['cat_true'])))
         {
@@ -674 +674 @@
       else
       {
-        $opt_false[ $nbm_user['check_key'] ] = $nbm_user['username'].'['.get_email_address_as_display_text($nbm_user['mail_address']).']';
+        $opt_false[ $nbm_user['check_key'] ] = stripslashes($nbm_user['username']).'['.get_email_address_as_display_text($nbm_user['mail_address']).']';
         if (isset($_POST['trueify']) and isset($_POST['cat_false']) and in_array($nbm_user['check_key'], $_POST['cat_false']))
         {
@@ -719 +719 @@
                               !in_array($nbm_user['check_key'], $_POST['send_selection']) // not selected
                             )   ? '' : 'checked="checked"',
-              'USERNAME'=> $nbm_user['username'],
+              'USERNAME'=> stripslashes($nbm_user['username']),
               'EMAIL' => get_email_address_as_display_text($nbm_user['mail_address']),
               'LAST_SEND'=> $nbm_user['last_send']

trunk/admin/rating.php

@@ -97 +97 @@
 while ($row = mysql_fetch_assoc($result))
 {
-  $users[$row['id']]=$row['username'];
+  $users[$row['id']]=stripslashes($row['username']);
 }
 

trunk/admin/upload.php

@@ -178 +178 @@
       'PREVIEW_URL_IMG'=>$preview_url,
       'UPLOAD_EMAIL'=>get_email_address_as_display_text($row['mail_address']),
-      'UPLOAD_USERNAME'=>$row['username']
+      'UPLOAD_USERNAME'=>stripslashes($row['username'])
     );
 

trunk/admin/user_list.php

@@ -703 +703 @@
       'U_PROFILE' => $profile_url.$local_user['id'],
       'U_PERM' => $perm_url.$local_user['id'],
-      'USERNAME' => $local_user['username']
+      'USERNAME' => stripslashes($local_user['username'])
         .($local_user['id'] == $conf['guest_id']
           ? '<br>['.l10n('is_the_guest').']' : '')