update to pages.php minor exploit

A lot of bans can be removed from a tinyboard database because it isn't limited A staff member could select 100 users all at once with a simple javascript function and unban them all this needs to be limited because a staff member on an image board if they feel hostile they can just remove all bans on the tinyboard site easily without being limited to how many people they can unban at a time, this adds an option to limit it.

1 files changed, 16 insertions, 1 deletions

diff --git a/inc/mod/pages.php b/inc/mod/pages.php
index 5d736a1a..6a780474 100644
--- a/inc/mod/pages.php
+++ b/inc/mod/pages.php
@@ -651,7 +651,8 @@ function mod_bans($page_no = 1) {
 			if (preg_match('/^ban_(\d+)$/', $name, $match))
 				$unban[] = $match[1];
 		}
-		
+		if (isset($config['mod']['unban_limit'])){
+		if (count($unban) <= $config['mod']['unban_limit'] || $config['mod']['unban_limit'] == -1){ 
 		if (!empty($unban)) {
 			query('DELETE FROM `bans` WHERE `id` = ' . implode(' OR `id` = ', $unban)) or error(db_error());
 		
@@ -659,7 +660,21 @@ function mod_bans($page_no = 1) {
 				modLog("Removed ban #{$id}");
 			}
 		}
+		} else {
+		error(sprintf($config['error']['toomanyunban'], $config['mod']['unban_limit'], count($unban) ));
+		}
+		
+	} else {
+		
+			if (!empty($unban)) {
+			query('DELETE FROM `bans` WHERE `id` = ' . implode(' OR `id` = ', $unban)) or error(db_error());
+		
+			foreach ($unban as $id) {
+				modLog("Removed ban #{$id}");
+			}
+		}	
 		
+	}
 		header('Location: ?/bans', true, $config['redirect_http']);
 	}