diff options
| author | czaks <marcin@6irc.net> | 2013-07-31 19:25:04 -0400 |
|---|---|---|
| committer | czaks <marcin@6irc.net> | 2013-07-31 19:25:04 -0400 |
| commit | b35ea557634af42c3f63b7219cd1bfd46cf486a6 (patch) | |
| tree | 0530d3025764e09265fa934f8ae1e906efcad7c6 /inc/mod/pages.php | |
| parent | dc9df2b9b3d2994bce02474503b3ebbb56c38ece (diff) | |
| parent | 6bbe407e18681f2812db4345036bb5ae639f5973 (diff) | |
Merge branch 'master' of https://github.com/savetheinternet/Tinyboard
Conflicts:
templates/thread.html
Diffstat (limited to 'inc/mod/pages.php')
| -rw-r--r-- | inc/mod/pages.php | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 08604039..351d3203 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -507,6 +507,7 @@ function mod_noticeboard($page_no = 1) { if (!hasPermission($config['mod']['noticeboard_post'])) error($config['error']['noaccess']); + $_POST['body'] = escape_markup_modifiers($_POST['body']); markup($_POST['body']); $query = prepare('INSERT INTO `noticeboard` VALUES (NULL, :mod, :time, :subject, :body)'); @@ -568,6 +569,7 @@ function mod_news($page_no = 1) { if (!hasPermission($config['mod']['news'])) error($config['error']['noaccess']); + $_POST['body'] = escape_markup_modifiers($_POST['body']); markup($_POST['body']); $query = prepare('INSERT INTO `news` VALUES (NULL, :name, :time, :subject, :body)'); @@ -737,6 +739,7 @@ function mod_page_ip($ip) { if (!hasPermission($config['mod']['create_notes'])) error($config['error']['noaccess']); + $_POST['note'] = escape_markup_modifiers($_POST['note']); markup($_POST['note']); $query = prepare('INSERT INTO `ip_notes` VALUES (NULL, :ip, :mod, :time, :body)'); $query->bindValue(':ip', $ip); @@ -1214,12 +1217,14 @@ function mod_ban_post($board, $delete, $post, $token = false) { if (isset($_POST['public_message'], $_POST['message'])) { // public ban message $length_english = parse_time($_POST['length']) ? 'for ' . until(parse_time($_POST['length'])) : 'permanently'; + $_POST['message'] = preg_replace('/[\r\n]/', '', $_POST['message']); $_POST['message'] = str_replace('%length%', $length_english, $_POST['message']); $_POST['message'] = str_replace('%LENGTH%', strtoupper($length_english), $_POST['message']); - $query = prepare(sprintf('UPDATE `posts_%s` SET `body` = CONCAT(`body`, :body) WHERE `id` = :id', $board)); + $query = prepare(sprintf('UPDATE `posts_%s` SET `body_nomarkup` = CONCAT(`body_nomarkup`, :body_nomarkup) WHERE `id` = :id', $board)); $query->bindValue(':id', $post); - $query->bindValue(':body', sprintf($config['mod']['ban_message'], utf8tohtml($_POST['message']))); + $query->bindValue(':body_nomarkup', sprintf('<tinyboard ban message>%s</tinyboard>', $_POST['message'])); $query->execute() or error(db_error($query)); + rebuildPost($post); modLog("Attached a public ban message to post #{$post}: " . utf8tohtml($_POST['message'])); buildThread($thread ? $thread : $post); @@ -1713,6 +1718,7 @@ function mod_new_pm($username) { } if (isset($_POST['message'])) { + $_POST['message'] = escape_markup_modifiers($_POST['message']); markup($_POST['message']); $query = prepare("INSERT INTO `pms` VALUES (NULL, :me, :id, :message, :time, 1)"); |