Index: /extensions/CommentEditor/classes/ce_plugin.class.php
===================================================================
--- /extensions/CommentEditor/classes/ce_plugin.class.php	(revision 3433)
+++ /extensions/CommentEditor/classes/ce_plugin.class.php	(revision 3434)
@@ -1,4 +1,4 @@
 <?php
-/* $Id: ce_plugin.class.php,v 1.5 2009/06/18 14:48:18 Criss Exp $ */
+/* $Id: ce_plugin.class.php,v 1.6 2009/06/18 21:02:12 Criss Exp $ */
 if (!defined('PHPWG_ROOT_PATH')) die('Hacking attempt!');
 
@@ -58,4 +58,8 @@
                 $this->updateComment();
                 break;
+            case CE_ACTION_ERROR:
+                $infos = array('comment_edit_forbidden');
+                $this->displayError($infos);
+                break;
             case CE_ACTION_NONE:
                 // Not an edit mode
@@ -94,5 +98,9 @@
         }
         if (CE_ACTION_EDIT == $action) {
-            $p_comment_id = $comment_id;
+            if (is_numeric($comment_id)) {
+                $p_comment_id = intval($comment_id);
+            } else {
+                $action = CE_ACTION_ERROR;
+            }
         }
         return $action;
@@ -100,4 +108,7 @@
 
     function isEditAllowed($p_comment) {
+        if (FALSE == $p_comment->getInfo()) {
+            return false;
+        }
         if (is_admin()) {
             return true;
@@ -115,5 +126,5 @@
         if (!$this->isEditAllowed($comment)) {
             // Not allowed
-            array_push($infos, l10n('comment_edit_forbidden'));
+            array_push($infos, 'comment_edit_forbidden');
             $this->displayError($infos);
             return;
@@ -127,6 +138,12 @@
 
         $infos = array();
-        if (!isset($_POST['commentid'])) {
-            array_push($infos, l10n('comment_access_invalid'));
+        if ((!isset($_POST['commentid'])) or
+            (!isset($_POST['imageid']))) {
+            array_push($infos, 'comment_access_invalid');
+            $this->displayError($infos);
+            return;
+        }
+        if (!is_numeric($_POST['imageid'])) {
+            array_push($infos, 'comment_access_invalid');
             $this->displayError($infos);
             return;
@@ -135,5 +152,11 @@
 
         if (!$this->isEditAllowed($comment)) {
-            array_push($infos, l10n('comment_edit_forbidden'));
+            array_push($infos, 'comment_edit_forbidden');
+            $this->displayError($infos);
+            return;
+        }
+        $image_id = $comment->getInfo('image_id');
+        if (intval($_POST['imageid']) != intval($image_id)) {
+            array_push($infos, 'comment_access_invalid');
             $this->displayError($infos);
             return;
@@ -141,5 +164,6 @@
         if (isset($_POST['author'])) {
             $comment->setInfo('author', $_POST['author']);
-        } else if (isset($_POST['freeauthorck'])) {
+        } else if ((isset($_POST['freeauthorck'])) and
+                   (isset($_POST['freeauthor']))) {
             // Free author
             $new_author = trim(stripslashes($_POST['freeauthor']));
@@ -151,6 +175,6 @@
             'author'        => trim( stripslashes($comment->getInfo('author')) ),
             'content'       => trim( stripslashes($_POST['content']) ),
-            'image_id'      => $_POST['imageid'],
-            'comment_id'    => $_POST['commentid'],
+            'image_id'      => $image_id,
+            'comment_id'    => $comment->getInfo('comment_id'),
         );
         $comment_action = update_user_comment($comment_array, @$_POST['key'], $infos );
@@ -158,11 +182,11 @@
         switch ($comment_action) {
             case 'moderate':
-              array_push( $infos, l10n('comment_to_validate') );
+              array_push( $infos, 'comment_to_validate' );
             case 'validate':
-              array_push( $infos, l10n('comment_added'));
+              array_push( $infos, 'comment_added');
               break;
             case 'reject':
               set_status_header(403);
-              array_push($infos, l10n('comment_not_added') );
+              array_push($infos, 'comment_not_added' );
               break;
             default:
@@ -215,5 +239,5 @@
         $messages = array();
         foreach ($p_message as $message) {
-            array_push($messages, $message);
+            array_push($messages, l10n($message));
         }
         $message_array = array(
Index: /extensions/CommentEditor/include/ce_common.inc.php
===================================================================
--- /extensions/CommentEditor/include/ce_common.inc.php	(revision 3433)
+++ /extensions/CommentEditor/include/ce_common.inc.php	(revision 3434)
@@ -1,7 +1,7 @@
 <?php
-/* $Id: ce_common.inc.php,v 1.3 2009/06/17 19:08:24 Criss Exp $ */
+/* $Id: ce_common.inc.php,v 1.5 2009/06/18 21:02:12 Criss Exp $ */
 if (!defined('PHPWG_ROOT_PATH')) die('Hacking attempt!');
 
-define('CE_VERSION',       '1.0.b');
+define('CE_VERSION',       '1.0.d');
 define('CE_INCLUDE_DIR',   'include/');
 define('CE_CLASSES_DIR',   'classes/');
@@ -19,8 +19,9 @@
 define('CE_PARAMS',        'params');
 define('CE_ID',            'comment_id');
-define('CE_ACTION',        'action');
+define('CE_ACTION',        'comment_action');
 define('CE_ACTION_NONE',   'none');
 define('CE_ACTION_EDIT',   'edit_comment');
 define('CE_ACTION_UPDATE', 'update_comment');
+define('CE_ACTION_ERROR',  'error_comment');
 
 // Include plugin functions
Index: /extensions/CommentEditor/main.inc.php
===================================================================
--- /extensions/CommentEditor/main.inc.php	(revision 3433)
+++ /extensions/CommentEditor/main.inc.php	(revision 3434)
@@ -1,7 +1,7 @@
 <?php
-/* $Id: main.inc.php,v 1.3 2009/06/17 19:08:25 Criss Exp $ */
+/* $Id: main.inc.php,v 1.6 2009/06/18 21:02:12 Criss Exp $ */
 /*
  Plugin Name: Comment Editor
- Version: 1.0.c
+ Version: 1.0.d
  Description: Allow to edit comment
  Plugin URI: http://piwigo.org/ext/extension_view.php?eid=296
@@ -11,4 +11,7 @@
 
 /** History **
+
+    2009-06-18 1.0.d
+                        Improve sanity checking
 
     2009-06-18 1.0.c
