Changeset 4304 for trunk/include/functions_mail.inc.php

Timestamp:

Nov 18, 2009, 9:07:20 PM (14 years ago)

Author:

Eric

Message:

Escape all login and username characters in database
Display correctly usernames

(I hope not to have made mistakes)

File:

• trunk/include/functions_mail.inc.php (modified) (3 diffs)

trunk/include/functions_mail.inc.php

@@ -365 +365 @@
     $keyargs_content_admin_info = array
     (
-      get_l10n_args('Connected user: %s', $user['username']),
+      get_l10n_args('Connected user: %s', stripslashes($user['username'])),
       get_l10n_args('IP: %s', $_SERVER['REMOTE_ADDR']),
       get_l10n_args('Browser: %s', $_SERVER['HTTP_USER_AGENT'])
@@ -484 +484 @@
           if (!empty($row['mail_address']))
           {
-            array_push($Bcc, format_email($row['username'], $row['mail_address']));
+            array_push($Bcc, format_email(stripslashes($row['username']), $row['mail_address']));
           }
         }
@@ -795 +795 @@
     if ( mkgetdir( $dir,  MKGETDIR_DEFAULT&~MKGETDIR_DIE_ON_ERROR) )
     {
-      $filename = $dir.'/mail.'.$user['username'].'.'.$lang_info['code'].'.'.$args['template'].'.'.$args['theme'];
+      $filename = $dir.'/mail.'.stripslashes($user['username']).'.'.$lang_info['code'].'.'.$args['template'].'.'.$args['theme'];
       if ($args['content_format'] == 'text/plain')
       {