Changeset 1535

Timestamp:

Aug 14, 2006, 10:56:10 PM (18 years ago)

Author:

nikrou

Message:

fix bug 518: anyone can delete or validate a comment
comment_id must be int: use of intval function to use it in the query.

File:

• branches/branch-1_6/comments.php (modified) (2 diffs)

branches/branch-1_6/comments.php

@@ -149 +149 @@
 // +-----------------------------------------------------------------------+
 // comments deletion
-if (isset($_POST['delete']) and count($_POST['comment_id']) > 0)
-{
+if (isset($_POST['delete']) and count($_POST['comment_id']) > 0 and is_admin())
+{
+  $_POST['comment_id'] = array_map('intval', $_POST['comment_id']);
   $query = '
 DELETE FROM '.COMMENTS_TABLE.'
@@ -158 +159 @@
 }
 // comments validation
-if (isset($_POST['validate']) and count($_POST['comment_id']) > 0)
-{
+if (isset($_POST['validate']) and count($_POST['comment_id']) > 0
+   and is_admin())
+{
+  $_POST['comment_id'] = array_map('intval', $_POST['comment_id']);
   $query = '
 UPDATE '.COMMENTS_TABLE.'