From a9b7f9b1bc88b196a165ebb1bb74d01081d1e6fd Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Sat, 21 Sep 2013 12:51:23 +1000 Subject: begin implementation of in-built ban appealing --- inc/functions.php | 34 ++++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-) (limited to 'inc/functions.php') diff --git a/inc/functions.php b/inc/functions.php index cfde4640..078911ea 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -625,11 +625,16 @@ function displayBan($ban) { $ban['ip'] = $_SERVER['REMOTE_ADDR']; if ($ban['post'] && isset($ban['post']['board'], $ban['post']['id'])) { - openBoard($ban['post']['board']); - - $query = query(sprintf("SELECT `thumb`, `file` FROM ``posts_%s`` WHERE `id` = " . (int)$ban['post']['id'], $board['uri'])); - if ($_post = $query->fetch(PDO::FETCH_ASSOC)) { - $ban['post'] = array_merge($ban['post'], $_post); + if (openBoard($ban['post']['board'])) { + + $query = query(sprintf("SELECT `thumb`, `file` FROM ``posts_%s`` WHERE `id` = " . + (int)$ban['post']['id'], $board['uri'])); + if ($_post = $query->fetch(PDO::FETCH_ASSOC)) { + $ban['post'] = array_merge($ban['post'], $_post); + } else { + $ban['post']['file'] = 'deleted'; + $ban['post']['thumb'] = false; + } } else { $ban['post']['file'] = 'deleted'; $ban['post']['thumb'] = false; @@ -641,6 +646,21 @@ function displayBan($ban) { $post = new Thread($ban['post'], null, false, false); } } + + $denied_appeals = array(); + $pending_appeal = false; + + if ($config['ban_appeals']) { + $query = query("SELECT `time`, `denied` FROM `ban_appeals` WHERE `ban_id` = " . (int)$ban['id']) or error(db_error()); + while ($ban_appeal = $query->fetch(PDO::FETCH_ASSOC)) { + if ($ban_appeal['denied']) { + $denied_appeals[] = $ban_appeal['time']; + } else { + $pending_appeal = $ban_appeal['time']; + } + } + } + // Show banned page and exit die( Element('page.html', array( @@ -651,7 +671,9 @@ function displayBan($ban) { 'config' => $config, 'ban' => $ban, 'board' => $board, - 'post' => isset($post) ? $post->build(true) : false + 'post' => isset($post) ? $post->build(true) : false, + 'denied_appeals' => $denied_appeals, + 'pending_appeal' => $pending_appeal ) )) )); -- cgit v1.3 From 699279d84aab16594505aa394fc4c9ed22cbba11 Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Mon, 23 Sep 2013 12:41:27 +1000 Subject: Hardened secure tripcode? --- inc/functions.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'inc/functions.php') diff --git a/inc/functions.php b/inc/functions.php index 078911ea..02665952 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -1973,7 +1973,7 @@ function generate_tripcode($name) { if (isset($config['custom_tripcode']["##{$trip}"])) $trip = $config['custom_tripcode']["##{$trip}"]; else - $trip = '!!' . substr(crypt($trip, $config['secure_trip_salt']), -10); + $trip = '!!' . substr(crypt($trip, $salt . $config['secure_trip_salt']), -10); } else { if (isset($config['custom_tripcode']["#{$trip}"])) $trip = $config['custom_tripcode']["#{$trip}"]; -- cgit v1.3 From 9cf6814776a989cca12cf1249460268b50ae25b2 Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Mon, 23 Sep 2013 12:53:44 +1000 Subject: Fix secure tripcode hardening --- inc/functions.php | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'inc/functions.php') diff --git a/inc/functions.php b/inc/functions.php index 02665952..3448e7db 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -1973,14 +1973,13 @@ function generate_tripcode($name) { if (isset($config['custom_tripcode']["##{$trip}"])) $trip = $config['custom_tripcode']["##{$trip}"]; else - $trip = '!!' . substr(crypt($trip, $salt . $config['secure_trip_salt']), -10); + $trip = '!!' . substr(crypt($trip, substr(base64_encode(sha1($trip . $config['secure_trip_salt'], true)), 0, 9)), -10); } else { if (isset($config['custom_tripcode']["#{$trip}"])) $trip = $config['custom_tripcode']["#{$trip}"]; else $trip = '!' . substr(crypt($trip, $salt), -10); } - return array($name, $trip); } -- cgit v1.3 From 964bb83300a75095a19768d3e426a429d77c4d6a Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Mon, 23 Sep 2013 14:23:42 +1000 Subject: OK, now it is secure. --- inc/functions.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'inc/functions.php') diff --git a/inc/functions.php b/inc/functions.php index 3448e7db..7c6d3df3 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -1973,13 +1973,14 @@ function generate_tripcode($name) { if (isset($config['custom_tripcode']["##{$trip}"])) $trip = $config['custom_tripcode']["##{$trip}"]; else - $trip = '!!' . substr(crypt($trip, substr(base64_encode(sha1($trip . $config['secure_trip_salt'], true)), 0, 9)), -10); + $trip = '!!' . substr(crypt($trip, '_..A.' . substr(base64_encode(sha1($trip . $config['secure_trip_salt'], true)), 0, 4)), -10); } else { if (isset($config['custom_tripcode']["#{$trip}"])) $trip = $config['custom_tripcode']["#{$trip}"]; else $trip = '!' . substr(crypt($trip, $salt), -10); } + return array($name, $trip); } -- cgit v1.3 From 9fb63b053fbb552a2a8bbde1e230a8b73296fb6d Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Fri, 4 Oct 2013 20:13:58 +1000 Subject: new event: markup-url --- inc/functions.php | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) (limited to 'inc/functions.php') diff --git a/inc/functions.php b/inc/functions.php index 7c6d3df3..f6a217a5 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -1538,7 +1538,25 @@ function markup_url($matches) { $markup_urls[] = $url; - return '' . $url . '' . $after; + $link = (object) array( + 'href' => $url, + 'text' => $url, + 'rel' => 'nofollow', + 'target' => '_blank', + ); + + event('markup-url', $link); + $link = (array)$link; + + $parts = array(); + foreach ($link as $attr => $value) { + if ($attr == 'text' || $attr == 'after') + continue; + $parts[] = $attr . '="' . htmlspecialchars($value) . '"'; + } + if (isset($link['after'])) + $after = $link['after'] . $after; + return '' . utf8tohtml($link['text']) . '' . $after; } function unicodify($body) { -- cgit v1.3