Changeset 4508 for branches/2.0/comments.php

Timestamp:

Dec 17, 2009, 11:47:31 PM (14 years ago)

Author:

plg

Message:

bug 1328: implement check_pwg_token for emails on user comments management.

The check_pwg_token and get_pwg_token functions were moved to the public side
(for use on comments.php)

The email sent to admins on new user comment does not directly includes
validate/delete actions.

File:

• branches/2.0/comments.php (modified) (4 diffs)

branches/2.0/comments.php

@@ -114 +114 @@
 }
 
+// search a specific comment (if you're coming directly from an admin
+// notification email)
+if (!empty($_GET['comment_id']))
+{
+  check_input_parameter('comment_id', $_GET['comment_id'], false, PATTERN_ID);
+
+  // currently, the $_GET['comment_id'] is only used by admins from email
+  // for management purpose (validate/delete)
+  if (!is_admin())
+  {
+    $login_url =
+      get_root_url().'identification.php?redirect='
+      .urlencode(urlencode($_SERVER['REQUEST_URI']))
+      ;
+    redirect($login_url);
+  }
+
+  $page['where_clauses'][] = 'com.id = '.$_GET['comment_id'];
+}
+
 // search a substring among comments content
 if (!empty($_GET['keyword']))
@@ -153 +173 @@
 // |                         comments management                           |
 // +-----------------------------------------------------------------------+
-if (isset($_GET['delete']) and is_numeric($_GET['delete'])
-      and !is_adviser() )
-{// comments deletion
-  check_status(ACCESS_ADMINISTRATOR);
-  $query = '
-DELETE FROM '.COMMENTS_TABLE.'
-  WHERE id='.$_GET['delete'].'
-;';
-  pwg_query($query);
-}
-
-if (isset($_GET['validate']) and is_numeric($_GET['validate'])
-      and !is_adviser() )
-{  // comments validation
-  check_status(ACCESS_ADMINISTRATOR);
-  $query = '
+
+if (isset($_GET['delete']) or isset($_GET['validate']))
+{
+  check_pwg_token();
+  
+  if (!is_adviser())
+  {
+    check_status(ACCESS_ADMINISTRATOR);
+
+    if (isset($_GET['delete']))
+    {
+      check_input_parameter('delete', $_GET['delete'], false, PATTERN_ID);
+      
+      $query = '
+DELETE
+  FROM '.COMMENTS_TABLE.'
+  WHERE id = '.$_GET['delete'].'
+;';
+      pwg_query($query);
+    }
+
+    if (isset($_GET['validate']))
+    {
+      check_input_parameter('validate', $_GET['validate'], false, PATTERN_ID);
+      
+      $query = '
 UPDATE '.COMMENTS_TABLE.'
-  SET validated = \'true\'
-  , validation_date = NOW()
-  WHERE id='.$_GET['validate'].'
-;';
-  pwg_query($query);
+  SET validated = "true"
+    , validation_date = NOW()
+  WHERE id = '.$_GET['validate'].'
+;';
+      pwg_query($query);
+    }
+
+    $redirect_url =
+      PHPWG_ROOT_PATH
+      .'comments.php'
+      .get_query_string_diff(array('delete','validate','pwg_token'));
+    redirect($redirect_url);
+  }
 }
 
@@ -269 +307 @@
 $url = PHPWG_ROOT_PATH
     .'comments.php'
-    .get_query_string_diff(array('start','delete','validate'));
+  .get_query_string_diff(array('start','delete','validate','pwg_token'));
 
 $navbar = create_navigation_bar($url,
@@ -381 +419 @@
     if ( is_admin() )
     {
-      $url = get_root_url().'comments.php'.get_query_string_diff(array('delete','validate'));
-      $tpl_comment['U_DELETE'] = add_url_params($url,
-                          array('delete'=>$comment['comment_id'])
-                         );
+      $url = get_root_url().'comments.php'.get_query_string_diff(array('delete','validate','pwg_token'));
+      
+      $tpl_comment['U_DELETE'] = add_url_params(
+        $url,
+        array(
+          'delete' => $comment['comment_id'],
+          'pwg_token' => get_pwg_token(),
+          )
+        );
 
       if ($comment['validated'] != 'true')
       {
-        $tpl_comment['U_VALIDATE'] = add_url_params($url,
-                            array('validate'=>$comment['comment_id'])
-                           );
+        $tpl_comment['U_VALIDATE'] = add_url_params(
+          $url,
+          array(
+            'validate' => $comment['comment_id'],
+            'pwg_token' => get_pwg_token(),
+            )
+          );
       }
     }