Changeset 1536

Timestamp:

Aug 14, 2006, 10:57:50 PM (18 years ago)

Author:

nikrou

Message:

fix bug 518: anyone can delete or validate a comment
comment_id must be int: use of intval function to use it in the query.

svn merge -r1534:1535 from branch 1.6 into trunk

File:

• trunk/comments.php (modified) (2 diffs)

trunk/comments.php

@@ -149 +149 @@
 // +-----------------------------------------------------------------------+
 // comments deletion
-if (isset($_POST['delete']) and count($_POST['comment_id']) > 0)
-{
+if (isset($_POST['delete']) and count($_POST['comment_id']) > 0 and is_admin())
+{
+  $_POST['comment_id'] = array_map('intval', $_POST['comment_id']);
   $query = '
 DELETE FROM '.COMMENTS_TABLE.'
@@ -158 +159 @@
 }
 // comments validation
-if (isset($_POST['validate']) and count($_POST['comment_id']) > 0)
-{
+if (isset($_POST['validate']) and count($_POST['comment_id']) > 0 
+   and is_admin())
+{
+  $_POST['comment_id'] = array_map('intval', $_POST['comment_id']);
   $query = '
 UPDATE '.COMMENTS_TABLE.'