From 31f657e550ab8b1ea00953cc3a26f4661ee4458c Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Wed, 24 Jul 2013 11:15:55 -0400 Subject: Long overdue: Salted password hashes --- inc/mod/auth.php | 34 +++++++++++++++++++++------------- inc/mod/pages.php | 24 ++++++++++++++++++------ 2 files changed, 39 insertions(+), 19 deletions(-) (limited to 'inc/mod') diff --git a/inc/mod/auth.php b/inc/mod/auth.php index 173190ab..1bc27dff 100644 --- a/inc/mod/auth.php +++ b/inc/mod/auth.php @@ -29,6 +29,11 @@ function mkhash($username, $password, $salt = false) { return $hash; } +function generate_salt() { + mt_srand(microtime(true) * 100000 + memory_get_usage(true)); + return md5(uniqid(mt_rand(), true)); +} + function login($username, $password, $makehash=true) { global $mod; @@ -37,20 +42,23 @@ function login($username, $password, $makehash=true) { $password = sha1($password); } - $query = prepare("SELECT `id`,`type`,`boards` FROM `mods` WHERE `username` = :username AND `password` = :password LIMIT 1"); + $query = prepare("SELECT `id`, `type`, `boards`, `password`, `salt` FROM `mods` WHERE `username` = :username"); $query->bindValue(':username', $username); - $query->bindValue(':password', $password); $query->execute() or error(db_error($query)); - if ($user = $query->fetch()) { - return $mod = array( - 'id' => $user['id'], - 'type' => $user['type'], - 'username' => $username, - 'hash' => mkhash($username, $password), - 'boards' => explode(',', $user['boards']) - ); - } else return false; + if ($user = $query->fetch(PDO::FETCH_ASSOC)) { + if ($user['password'] === hash('sha256', $user['salt'] . $password)) { + return $mod = array( + 'id' => $user['id'], + 'type' => $user['type'], + 'username' => $username, + 'hash' => mkhash($username, $user['password']), + 'boards' => explode(',', $user['boards']) + ); + } + } + + return false; } function setCookies() { @@ -104,10 +112,10 @@ if (isset($_COOKIE[$config['cookies']['mod']])) { exit; } - $query = prepare("SELECT `id`, `type`, `boards`, `password` FROM `mods` WHERE `username` = :username LIMIT 1"); + $query = prepare("SELECT `id`, `type`, `boards`, `password` FROM `mods` WHERE `username` = :username"); $query->bindValue(':username', $cookie[0]); $query->execute() or error(db_error($query)); - $user = $query->fetch(); + $user = $query->fetch(PDO::FETCH_ASSOC); // validate password hash if ($cookie[1] !== mkhash($cookie[0], $user['password'], $cookie[2])) { diff --git a/inc/mod/pages.php b/inc/mod/pages.php index cddecad0..1ed9a94b 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -1407,9 +1407,13 @@ function mod_user($uid) { } if ($_POST['password'] != '') { - $query = prepare('UPDATE `mods` SET `password` = SHA1(:password) WHERE `id` = :id'); + $salt = generate_salt(); + $password = hash('sha256', $salt . sha1($_POST['password'])); + + $query = prepare('UPDATE `mods` SET `password` = :password, `salt` = :salt WHERE `id` = :id'); $query->bindValue(':id', $uid); - $query->bindValue(':password', $_POST['password']); + $query->bindValue(':password', $password); + $query->bindValue(':salt', $salt); $query->execute() or error(db_error($query)); modLog('Changed password for ' . utf8tohtml($_POST['username']) . ' (#' . $user['id'] . ')'); @@ -1430,9 +1434,13 @@ function mod_user($uid) { if (hasPermission($config['mod']['change_password']) && $uid == $mod['id'] && isset($_POST['password'])) { if ($_POST['password'] != '') { - $query = prepare('UPDATE `mods` SET `password` = SHA1(:password) WHERE `id` = :id'); + $salt = generate_salt(); + $password = hash('sha256', $salt . sha1($_POST['password'])); + + $query = prepare('UPDATE `mods` SET `password` = :password, `salt` = :salt WHERE `id` = :id'); $query->bindValue(':id', $uid); - $query->bindValue(':password', $_POST['password']); + $query->bindValue(':password', $password); + $query->bindValue(':salt', $salt); $query->execute() or error(db_error($query)); modLog('Changed own password'); @@ -1494,9 +1502,13 @@ function mod_user_new() { if ($_POST['type'] !== JANITOR && $_POST['type'] !== MOD && $_POST['type'] !== ADMIN) error(sprintf($config['error']['invalidfield'], 'type')); - $query = prepare('INSERT INTO `mods` VALUES (NULL, :username, SHA1(:password), :type, :boards)'); + $salt = generate_salt(); + $password = hash('sha256', $salt . sha1($_POST['password'])); + + $query = prepare('INSERT INTO `mods` VALUES (NULL, :username, :password, :salt, :type, :boards)'); $query->bindValue(':username', $_POST['username']); - $query->bindValue(':password', $_POST['password']); + $query->bindValue(':password', $password); + $query->bindValue(':salt', $salt); $query->bindValue(':type', $_POST['type']); $query->bindValue(':boards', implode(',', $boards)); $query->execute() or error(db_error($query)); -- cgit v1.3 From 33a1c00bd51618a4b54fd6fdab721aaaa03bfd33 Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Wed, 24 Jul 2013 11:30:01 -0400 Subject: %length% in public ban messages --- inc/config.php | 4 +++- inc/mod/pages.php | 3 +++ 2 files changed, 6 insertions(+), 1 deletion(-) (limited to 'inc/mod') diff --git a/inc/config.php b/inc/config.php index b32f4266..98e127b3 100644 --- a/inc/config.php +++ b/inc/config.php @@ -879,8 +879,10 @@ // Check public ban message by default $config['mod']['check_ban_message'] = false; - // Default public ban message + // Default public ban message. + // In public ban messages, %length% is replaced with "for x days" or "permanently" (with %LENGTH% being the uppercase equivalent). $config['mod']['default_ban_message'] = 'USER WAS BANNED FOR THIS POST'; + // $config['mod']['default_ban_message'] = 'USER WAS BANNED %LENGTH% FOR THIS POST'; // Include length in ban message // What to append to the post for public bans ("%s" is the message) $config['mod']['ban_message'] = '(%s)'; diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 1ed9a94b..01794d2e 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -1152,6 +1152,9 @@ function mod_ban_post($board, $delete, $post, $token = false) { if (isset($_POST['public_message'], $_POST['message'])) { // public ban message + $length_english = parse_time($_POST['length']) ? 'for ' . until(parse_time($_POST['length'])) : 'permanently'; + $_POST['message'] = str_replace('%length%', $length_english, $_POST['message']); + $_POST['message'] = str_replace('%LENGTH%', strtoupper($length_english), $_POST['message']); $query = prepare(sprintf('UPDATE `posts_%s` SET `body` = CONCAT(`body`, :body) WHERE `id` = :id', $board)); $query->bindValue(':id', $post); $query->bindValue(':body', sprintf($config['mod']['ban_message'], utf8tohtml($_POST['message']))); -- cgit v1.3 From 58306bdc63b7dcaf964ab3541fe4b5a8e0c813b0 Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Mon, 29 Jul 2013 16:18:06 -0400 Subject: Search posts --- inc/config.php | 2 + inc/mod/pages.php | 41 +++++++++++++++-- templates/mod/search_results.html | 97 +++++++++++++++++++++++++++++++++++++-- 3 files changed, 132 insertions(+), 8 deletions(-) (limited to 'inc/mod') diff --git a/inc/config.php b/inc/config.php index 7dda86ab..582c3145 100644 --- a/inc/config.php +++ b/inc/config.php @@ -1035,6 +1035,8 @@ $config['mod']['rebuild'] = ADMIN; // Search through posts, IP address notes and bans $config['mod']['search'] = JANITOR; + // Allow searching posts (can be used with board configuration file to disallow searching through a certain board) + $config['mod']['search_posts'] = JANITOR; // Read the moderator noticeboard $config['mod']['noticeboard'] = JANITOR; // Post to the moderator noticeboard diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 01794d2e..8289d0b0 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -225,7 +225,7 @@ function mod_search($type, $search_query_escaped, $page_no = 1) { // Which `field` to search? if ($type == 'posts') - $sql_field = 'body'; + $sql_field = 'body_nomarkup'; if ($type == 'IP_notes') $sql_field = 'body'; if ($type == 'bans') @@ -246,7 +246,27 @@ function mod_search($type, $search_query_escaped, $page_no = 1) { // Compile SQL query if ($type == 'posts') { - error('Searching posts is under development. Sorry.'); + $query = ''; + + $boards = listBoards(); + if (empty($boards)) + error(_('There are no boards to search!')); + + foreach ($boards as $board) { + openBoard($board['uri']); + if (!hasPermission($config['mod']['search_posts'], $board['uri'])) + continue; + + if (!empty($query)) + $query .= ' UNION ALL '; + $query .= sprintf("SELECT *, '%s' AS `board` FROM `posts_%s` WHERE %s", $board['uri'], $board['uri'], $sql_like); + } + + // You weren't allowed to search any boards + if (empty($query)) + error($config['error']['noaccess']); + + $query .= ' ORDER BY `sticky` DESC, `id` DESC'; } if ($type == 'IP_notes') { @@ -273,10 +293,15 @@ function mod_search($type, $search_query_escaped, $page_no = 1) { // Execute SQL query (with pages) $q = query($query . ' LIMIT ' . (($page_no - 1) * $config['mod']['search_page']) . ', ' . $config['mod']['search_page']) or error(db_error()); $results = $q->fetchAll(PDO::FETCH_ASSOC); - + // Get total result count - $q = query('SELECT COUNT(*) FROM `' . $sql_table . '` WHERE ' . $sql_like) or error(db_error()); - $result_count = $q->fetchColumn(); + if ($type == 'posts') { + $q = query("SELECT COUNT(*) FROM ($query) AS `tmp_table`") or error(db_error()); + $result_count = $q->fetchColumn(); + } else { + $q = query('SELECT COUNT(*) FROM `' . $sql_table . '` WHERE ' . $sql_like) or error(db_error()); + $result_count = $q->fetchColumn(); + } if ($type == 'bans') { foreach ($results as &$ban) { @@ -285,6 +310,12 @@ function mod_search($type, $search_query_escaped, $page_no = 1) { } } + if ($type == 'posts') { + foreach ($results as &$post) { + $post['snippet'] = pm_snippet($post['body']); + } + } + // $results now contains the search results mod_page(_('Search results'), 'mod/search_results.html', array( diff --git a/templates/mod/search_results.html b/templates/mod/search_results.html index b441a28f..035773fb 100644 --- a/templates/mod/search_results.html +++ b/templates/mod/search_results.html @@ -39,7 +39,7 @@ {% endfor %} -{% endif %} +{% endif %} {% if search_type == 'bans' %} @@ -125,7 +125,7 @@ {% endfor %}
-{% endif %} +{% endif %} {% if search_type == 'log' %} @@ -166,7 +166,98 @@ {% endfor %}
-{% endif %} +{% endif %} + +{% if search_type == 'posts' %} + + + + + + + + + + + + + {% for post in results %} + + + + + + + + + + + + {% endfor %} +
TimeBoardIDThreadIPNameSubjectFileBody (snippet)
+ {{ post.time | ago }} ago + + {{ config.board_abbreviation|sprintf(post.board) }} + + {% if post.thread %} + {% set thread = post.thread %} + {% else %} + {% set thread = post.id %} + {% endif %} + + {{ post.id }} + + + + {% if post.thread %} + {{ post.thread }} + {% else %} + (OP) + {% endif %} + + + {% if mod|hasPermission(config.mod.show_ip, post.board) %} + + {{ post.ip }} + + {% else %} + hidden + {% endif %} + + + {% if post.email|length > 0 %} + {# start email #} + + {% endif %} + {% if capcode %} + {{ capcode.cap }} + {% endif %} + + + {% if post.subject %} + {{ post.subject }} + {% else %} + – + {% endif %} + + {% if post.file %} + {{ post.file }} ({{ post.filesize | filesize }}) + {% else %} + – + {% endif %} + + {{ post.snippet }} +
+{% endif %} {% if result_count > results|count %}

-- cgit v1.3 From 1759ac2ea30d3c374beb6b5b6fa76bfa5501da9f Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Mon, 29 Jul 2013 20:20:07 -0400 Subject: Post search: Search other fields too --- inc/mod/pages.php | 16 ++++++++++++++-- templates/mod/search_results.html | 2 +- 2 files changed, 15 insertions(+), 3 deletions(-) (limited to 'inc/mod') diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 8289d0b0..d447fa51 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -174,6 +174,11 @@ function mod_search_redirect() { $query = str_replace('_', '%5F', $query); $query = str_replace('+', '_', $query); + if ($query === '') { + header('Location: ?/', true, $config['redirect_http']); + return; + } + header('Location: ?/search/' . $_POST['type'] . '/' . $query, true, $config['redirect_http']); } else { header('Location: ?/', true, $config['redirect_http']); @@ -225,7 +230,7 @@ function mod_search($type, $search_query_escaped, $page_no = 1) { // Which `field` to search? if ($type == 'posts') - $sql_field = 'body_nomarkup'; + $sql_field = array('body_nomarkup', 'filename', 'subject', 'filehash', 'ip', 'name', 'trip'); if ($type == 'IP_notes') $sql_field = 'body'; if ($type == 'bans') @@ -239,7 +244,14 @@ function mod_search($type, $search_query_escaped, $page_no = 1) { if (!empty($sql_like)) $sql_like .= ' AND '; $phrase = preg_replace('/^\'(.+)\'$/', '\'%$1%\'', $phrase); - $sql_like .= '`' . $sql_field . '` LIKE ' . $phrase . ' ESCAPE \'!\''; + if (is_array($sql_field)) { + foreach ($sql_field as $field) { + $sql_like .= '`' . $field . '` LIKE ' . $phrase . ' ESCAPE \'!\' OR'; + } + $sql_like = preg_replace('/ OR$/', '', $sql_like); + } else { + $sql_like .= '`' . $sql_field . '` LIKE ' . $phrase . ' ESCAPE \'!\''; + } } diff --git a/templates/mod/search_results.html b/templates/mod/search_results.html index fbad0381..0c87f75f 100644 --- a/templates/mod/search_results.html +++ b/templates/mod/search_results.html @@ -246,7 +246,7 @@ {% if post.file %} - {{ post.file }} ({{ post.filesize | filesize }}) + {{ post.filename }} ({{ post.filesize | filesize }}) {% else %} – {% endif %} -- cgit v1.3 From 343397d561183a72ed3a6351175b0d34ebe9ffc3 Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Tue, 30 Jul 2013 23:30:49 -0400 Subject: ?/IP/: Don't show posts for board user doesn't have access to --- inc/mod/pages.php | 2 ++ 1 file changed, 2 insertions(+) (limited to 'inc/mod') diff --git a/inc/mod/pages.php b/inc/mod/pages.php index d447fa51..fdf9d8e9 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -744,6 +744,8 @@ function mod_page_ip($ip) { $boards = listBoards(); foreach ($boards as $board) { openBoard($board['uri']); + if (!hasPermission($config['mod']['show_ip'], $board['uri'])) + continue; $query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `ip` = :ip ORDER BY `sticky` DESC, `id` DESC LIMIT :limit', $board['uri'])); $query->bindValue(':ip', $ip); -- cgit v1.3 From 42cba538878cb695ba8b3093f72bc66ccd2fa074 Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Wed, 31 Jul 2013 02:08:55 -0400 Subject: Allow Unicode in board URIs. --- inc/config.php | 3 +++ inc/display.php | 6 +++--- inc/functions.php | 8 ++++---- inc/mod/pages.php | 9 ++++----- install.php | 23 ++++++++++++++++++----- install.sql | 22 +++++++++++----------- mod.php | 33 +++++++++++++++++---------------- post.php | 6 +++--- 8 files changed, 63 insertions(+), 47 deletions(-) (limited to 'inc/mod') diff --git a/inc/config.php b/inc/config.php index 28a7a4db..36518028 100644 --- a/inc/config.php +++ b/inc/config.php @@ -1130,6 +1130,9 @@ // 'type' => 'scp' //); + // Regex for board URIs + $config['board_regex'] = '[0-9a-zA-Z$_\x{0080}-\x{FFFF}]{1,58}'; + // Complex regular expression to catch URLs $config['url_regex'] = '/' . '(https?|ftp):\/\/' . '(([\w\-]+\.)+[a-zA-Z]{2,6}|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})' . '(:\d+)?' . '(\/([\w\-~.#\/?=&;:+%!*\[\]@$\'()+,|\^]+)?)?' . '/'; diff --git a/inc/display.php b/inc/display.php index a7e4826e..0992166d 100644 --- a/inc/display.php +++ b/inc/display.php @@ -235,7 +235,7 @@ function bidi_cleanup($str){ function secure_link_confirm($text, $title, $confirm_message, $href) { global $config; - return '' . $text . ''; + return '' . $text . ''; } function secure_link($href) { return $href . '/' . make_secure_link_token($href); @@ -299,7 +299,7 @@ class Post { // Fix internal links // Very complicated regex $this->body = preg_replace( - '/ ':?/', // redirect to dashboard @@ -45,7 +45,7 @@ $pages = array( '/news/(\d+)' => 'news', // view news '/news/delete/(\d+)' => 'news_delete', // delete from news - '/edit/(\w+)' => 'edit_board', // edit board details + '/edit/(\%b)' => 'edit_board', // edit board details '/new-board' => 'new_board', // create a new board '/rebuild' => 'rebuild', // rebuild static files @@ -63,15 +63,15 @@ $pages = array( // CSRF-protected moderator actions '/ban' => 'secure_POST ban', // new ban - '/(\w+)/ban(&delete)?/(\d+)' => 'secure_POST ban_post', // ban poster - '/(\w+)/move/(\d+)' => 'secure_POST move', // move thread - '/(\w+)/edit(_raw)?/(\d+)' => 'secure_POST edit_post', // edit post - '/(\w+)/delete/(\d+)' => 'secure delete', // delete post - '/(\w+)/deletefile/(\d+)' => 'secure deletefile', // delete file from post - '/(\w+)/deletebyip/(\d+)(/global)?' => 'secure deletebyip', // delete all posts by IP address - '/(\w+)/(un)?lock/(\d+)' => 'secure lock', // lock thread - '/(\w+)/(un)?sticky/(\d+)' => 'secure sticky', // sticky thread - '/(\w+)/bump(un)?lock/(\d+)' => 'secure bumplock', // "bumplock" thread + '/(\%b)/ban(&delete)?/(\d+)' => 'secure_POST ban_post', // ban poster + '/(\%b)/move/(\d+)' => 'secure_POST move', // move thread + '/(\%b)/edit(_raw)?/(\d+)' => 'secure_POST edit_post', // edit post + '/(\%b)/delete/(\d+)' => 'secure delete', // delete post + '/(\%b)/deletefile/(\d+)' => 'secure deletefile', // delete file from post + '/(\%b)/deletebyip/(\d+)(/global)?' => 'secure deletebyip', // delete all posts by IP address + '/(\%b)/(un)?lock/(\d+)' => 'secure lock', // lock thread + '/(\%b)/(un)?sticky/(\d+)' => 'secure sticky', // sticky thread + '/(\%b)/bump(un)?lock/(\d+)' => 'secure bumplock', // "bumplock" thread '/themes' => 'themes_list', // manage themes '/themes/(\w+)' => 'theme_configure', // configure/reconfigure theme @@ -86,10 +86,10 @@ $pages = array( '/debug/sql' => 'secure_POST debug_sql', // This should always be at the end: - '/(\w+)/' => 'view_board', - '/(\w+)/' . preg_quote($config['file_index'], '!') => 'view_board', - '/(\w+)/' . str_replace('%d', '(\d+)', preg_quote($config['file_page'], '!')) => 'view_board', - '/(\w+)/' . preg_quote($config['dir']['res'], '!') . + '/(\%b)/' => 'view_board', + '/(\%b)/' . preg_quote($config['file_index'], '!') => 'view_board', + '/(\%b)/' . str_replace('%d', '(\d+)', preg_quote($config['file_page'], '!')) => 'view_board', + '/(\%b)/' . preg_quote($config['dir']['res'], '!') . str_replace('%d', '(\d+)', preg_quote($config['file_page'], '!')) => 'view_thread', ); @@ -109,7 +109,8 @@ $new_pages = array(); foreach ($pages as $key => $callback) { if (is_string($callback) && preg_match('/^secure /', $callback)) $key .= '(/(?P[a-f0-9]{8}))?'; - $new_pages[@$key[0] == '!' ? $key : '!^' . $key . '(?:&[^&=]+=[^&]*)*$!'] = $callback; + $key = str_replace('\%b', $config['board_regex'], $key); + $new_pages[@$key[0] == '!' ? $key : '!^' . $key . '(?:&[^&=]+=[^&]*)*$!u'] = $callback; } $pages = $new_pages; diff --git a/post.php b/post.php index d1749fd1..85dc2d05 100644 --- a/post.php +++ b/post.php @@ -170,7 +170,7 @@ if (isset($_POST['delete'])) { error($config['error']['bot']); // Check the referrer - if (!isset($_SERVER['HTTP_REFERER']) || !preg_match($config['referer_match'], $_SERVER['HTTP_REFERER'])) + if (!isset($_SERVER['HTTP_REFERER']) || !preg_match($config['referer_match'], urldecode($_SERVER['HTTP_REFERER']))) error($config['error']['referer']); checkDNSBL(); @@ -547,9 +547,9 @@ if (isset($_POST['delete'])) { // Remove board directories before inserting them into the database. if ($post['has_file']) { $post['file_path'] = $post['file']; - $post['file'] = substr_replace($post['file'], '', 0, mb_strlen($board['dir'] . $config['dir']['img'])); + $post['file'] = mb_substr($post['file'], mb_strlen($board['dir'] . $config['dir']['img'])); if ($is_an_image && $post['thumb'] != 'spoiler') - $post['thumb'] = substr_replace($post['thumb'], '', 0, mb_strlen($board['dir'] . $config['dir']['thumb'])); + $post['thumb'] = mb_substr($post['thumb'], mb_strlen($board['dir'] . $config['dir']['thumb'])); } $post = (object)$post; -- cgit v1.3 From 439795e63b1468000992275320b6c7e3f43fa9c0 Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Wed, 31 Jul 2013 06:40:57 -0400 Subject: Disallow board names which are too large for the filesytem to handle --- inc/mod/pages.php | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'inc/mod') diff --git a/inc/mod/pages.php b/inc/mod/pages.php index ab4cdaaf..08604039 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -446,6 +446,23 @@ function mod_new_board() { if (!preg_match('/^' . $config['board_regex'] . '$/u', $_POST['uri'])) error(sprintf($config['error']['invalidfield'], 'URI')); + $bytes = 0; + $chars = preg_split('//u', $_POST['uri'], -1, PREG_SPLIT_NO_EMPTY); + foreach ($chars as $char) { + $o = 0; + $ord = ordutf8($char, $o); + if ($ord > 0x0080) + $bytes += 5; // @01ff + else + $bytes ++; + } + $bytes + strlen('posts_.frm'); + + if ($bytes > 255) { + error('Your filesystem cannot handle a board URI of that length (' . $bytes . '/255 bytes)'); + exit; + } + if (openBoard($_POST['uri'])) { error(sprintf($config['error']['boardexists'], $board['url'])); } -- cgit v1.3 From 6d52c8b42813722c49890b6e4f776dc0dabf382c Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Wed, 31 Jul 2013 18:59:54 -0400 Subject: Markup modifiers. Fix issue #66 (public ban message lost when rebuilding post body) --- inc/functions.php | 36 +++++++++++++++++++++++++++++++++++- inc/mod/pages.php | 10 ++++++++-- post.php | 3 ++- 3 files changed, 45 insertions(+), 4 deletions(-) (limited to 'inc/mod') diff --git a/inc/functions.php b/inc/functions.php index 7826d41b..e638f016 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -1456,13 +1456,43 @@ function markup(&$body, $track_cites = false) { } } + if (preg_match_all('@<tinyboard ([\w\s]+)>(.+)</tinyboard>@', $body, $modifiers, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) { + $skip_chars = 0; + $body_tmp = $body; + + foreach ($modifiers as $modifier) { + // preg_match_all is not multibyte-safe + foreach ($modifier as &$match) { + $match[1] = mb_strlen(substr($body_tmp, 0, $match[1])); + } + + $modifier['type'] = $modifier[1][0]; + $modifier['content'] = $modifier[2][0]; + + if ($modifier['type'] == 'ban message') { + // Public ban message + $replacement = sprintf($config['mod']['ban_message'], $modifier['content']); + } elseif (preg_match('/^escape /', $modifier['type'])) { + // Escaped (not a real modifier) + $replacement = '<tinyboard ' . substr($modifier['type'], strlen('escape ')) . '>' . $modifier['content'] . '</tinyboard>'; + } else { + // Unknown + $replacement = ''; + } + + $body = mb_substr_replace($body, $replacement, $modifier[0][1] + $skip_chars, mb_strlen($modifier[0][0])); + $skip_chars += mb_strlen($replacement) - mb_strlen($modifier[0][0]); + + } + } + // replace tabs with 8 spaces $body = str_replace("\t", ' ', $body); $tracked_cites = array(); // Cites - if (isset($board) && preg_match_all('/(^|\s)>>(\d+?)([\s,.)?]|$)/m', $body, $cites, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) { + if (isset($board) && preg_match_all('/(^|\s)>>(\d+?)([\s,.)?]|$)/m', $body, $cites, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) { if (count($cites[0]) > $config['max_cites']) { error($config['error']['toomanycites']); } @@ -1561,6 +1591,10 @@ function markup(&$body, $track_cites = false) { return $tracked_cites; } +function escape_markup_modifiers($string) { + return preg_replace('@(.+)@', '$2', $string); +} + function utf8tohtml($utf8) { return htmlspecialchars($utf8, ENT_NOQUOTES, 'UTF-8'); } diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 08604039..351d3203 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -507,6 +507,7 @@ function mod_noticeboard($page_no = 1) { if (!hasPermission($config['mod']['noticeboard_post'])) error($config['error']['noaccess']); + $_POST['body'] = escape_markup_modifiers($_POST['body']); markup($_POST['body']); $query = prepare('INSERT INTO `noticeboard` VALUES (NULL, :mod, :time, :subject, :body)'); @@ -568,6 +569,7 @@ function mod_news($page_no = 1) { if (!hasPermission($config['mod']['news'])) error($config['error']['noaccess']); + $_POST['body'] = escape_markup_modifiers($_POST['body']); markup($_POST['body']); $query = prepare('INSERT INTO `news` VALUES (NULL, :name, :time, :subject, :body)'); @@ -737,6 +739,7 @@ function mod_page_ip($ip) { if (!hasPermission($config['mod']['create_notes'])) error($config['error']['noaccess']); + $_POST['note'] = escape_markup_modifiers($_POST['note']); markup($_POST['note']); $query = prepare('INSERT INTO `ip_notes` VALUES (NULL, :ip, :mod, :time, :body)'); $query->bindValue(':ip', $ip); @@ -1214,12 +1217,14 @@ function mod_ban_post($board, $delete, $post, $token = false) { if (isset($_POST['public_message'], $_POST['message'])) { // public ban message $length_english = parse_time($_POST['length']) ? 'for ' . until(parse_time($_POST['length'])) : 'permanently'; + $_POST['message'] = preg_replace('/[\r\n]/', '', $_POST['message']); $_POST['message'] = str_replace('%length%', $length_english, $_POST['message']); $_POST['message'] = str_replace('%LENGTH%', strtoupper($length_english), $_POST['message']); - $query = prepare(sprintf('UPDATE `posts_%s` SET `body` = CONCAT(`body`, :body) WHERE `id` = :id', $board)); + $query = prepare(sprintf('UPDATE `posts_%s` SET `body_nomarkup` = CONCAT(`body_nomarkup`, :body_nomarkup) WHERE `id` = :id', $board)); $query->bindValue(':id', $post); - $query->bindValue(':body', sprintf($config['mod']['ban_message'], utf8tohtml($_POST['message']))); + $query->bindValue(':body_nomarkup', sprintf('%s', $_POST['message'])); $query->execute() or error(db_error($query)); + rebuildPost($post); modLog("Attached a public ban message to post #{$post}: " . utf8tohtml($_POST['message'])); buildThread($thread ? $thread : $post); @@ -1713,6 +1718,7 @@ function mod_new_pm($username) { } if (isset($_POST['message'])) { + $_POST['message'] = escape_markup_modifiers($_POST['message']); markup($_POST['message']); $query = prepare("INSERT INTO `pms` VALUES (NULL, :me, :id, :message, :time, 1)"); diff --git a/post.php b/post.php index 8820db2d..adb44b58 100644 --- a/post.php +++ b/post.php @@ -107,7 +107,7 @@ if (isset($_POST['delete'])) { if (count($report) > $config['report_limit']) error($config['error']['toomanyreports']); - $reason = &$_POST['reason']; + $reason = escape_markup_modifiers($_POST['reason']); markup($reason); foreach ($report as &$id) { @@ -377,6 +377,7 @@ if (isset($_POST['delete'])) { error(sprintf($config['error']['toolong'], 'password')); wordfilters($post['body']); + $post['body'] = escape_markup_modifiers($post['body']); if (mysql_version() >= 50503) { $post['body_nomarkup'] = $post['body']; // Assume we're using the utf8mb4 charset -- cgit v1.3 From 328484bee7cab9ce354121413cc8d96c3e227aea Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Wed, 31 Jul 2013 20:51:43 -0400 Subject: SQL cleanup --- inc/functions.php | 63 +++++++++++++++++++------------------- inc/mod/auth.php | 2 +- inc/mod/pages.php | 32 +++++++++---------- post.php | 10 +++--- templates/themes/catalog/theme.php | 2 +- templates/themes/recent/theme.php | 19 +++++------- templates/themes/rrdtool/theme.php | 5 ++- 7 files changed, 64 insertions(+), 69 deletions(-) (limited to 'inc/mod') diff --git a/inc/functions.php b/inc/functions.php index 7cde156b..0b4ac211 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -243,7 +243,7 @@ function rebuildThemes($action, $board = false) { // List themes $query = query("SELECT `theme` FROM `theme_settings` WHERE `name` IS NULL AND `value` IS NULL") or error(db_error()); - while ($theme = $query->fetch()) { + while ($theme = $query->fetch(PDO::FETCH_ASSOC)) { rebuildTheme($theme['theme'], $action, $board); } } @@ -281,7 +281,7 @@ function themeSettings($theme) { $query->execute() or error(db_error($query)); $settings = array(); - while ($s = $query->fetch()) { + while ($s = $query->fetch(PDO::FETCH_ASSOC)) { $settings[$s['name']] = $s['value']; } @@ -351,7 +351,7 @@ function getBoardInfo($uri) { $query->bindValue(':uri', $uri); $query->execute() or error(db_error($query)); - if ($board = $query->fetch()) { + if ($board = $query->fetch(PDO::FETCH_ASSOC)) { if ($config['cache']['enabled']) cache::set('board_' . $uri, $board); return $board; @@ -543,7 +543,7 @@ function checkFlood($post) { $query->bindValue(':floodsametime', time()-$config['flood_time_same'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); - $flood = (bool)$query->fetch(); + $flood = (bool) $query->fetch(PDO::FETCH_ASSOC); if (event('check-flood', $post)) return true; @@ -647,7 +647,7 @@ function checkBan($board = 0) { $query->execute() or error(db_error($query)); } - if ($ban = $query->fetch()) { + if ($ban = $query->fetch(PDO::FETCH_ASSOC)) { if ($ban['expires'] && $ban['expires'] < time()) { // Ban expired $query = prepare("DELETE FROM `bans` WHERE `id` = :id"); @@ -685,12 +685,12 @@ function threadLocked($id) { $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error()); - if (!$post = $query->fetch()) { + if (($locked = $query->fetchColumn()) === false) { // Non-existant, so it can't be locked... return false; } - return (bool)$post['locked']; + return (bool)$locked; } function threadSageLocked($id) { @@ -703,12 +703,12 @@ function threadSageLocked($id) { $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error()); - if (!$post = $query->fetch()) { + if (($sagelocked = $query->fetchColumn()) === false) { // Non-existant, so it can't be locked... return false; } - return (bool) $post['sage']; + return (bool)$sagelocked; } function threadExists($id) { @@ -842,7 +842,7 @@ function deleteFile($id, $remove_entirely_if_already=true) { $query = prepare(sprintf("SELECT `thread`,`thumb`,`file` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri'])); $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); - if (!$post = $query->fetch()) + if (!$post = $query->fetch(PDO::FETCH_ASSOC)) error($config['error']['invalidpost']); if ($post['file'] == 'deleted' && !$post['thread']) @@ -880,7 +880,7 @@ function rebuildPost($id) { $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); - if ((!$post = $query->fetch()) || !$post['body_nomarkup']) + if ((!$post = $query->fetch(PDO::FETCH_ASSOC)) || !$post['body_nomarkup']) return false; markup($body = &$post['body_nomarkup']); @@ -913,7 +913,7 @@ function deletePost($id, $error_if_doesnt_exist=true, $rebuild_after=true) { $ids = array(); // Delete posts and maybe replies - while ($post = $query->fetch()) { + while ($post = $query->fetch(PDO::FETCH_ASSOC)) { if (!$post['thread']) { // Delete thread HTML page file_unlink($board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], $post['id'])); @@ -946,7 +946,7 @@ function deletePost($id, $error_if_doesnt_exist=true, $rebuild_after=true) { $query = prepare("SELECT `board`, `post` FROM `cites` WHERE `target_board` = :board AND (`target` = " . implode(' OR `target` = ', $ids) . ")"); $query->bindValue(':board', $board['uri']); $query->execute() or error(db_error($query)); - while ($cite = $query->fetch()) { + while ($cite = $query->fetch(PDO::FETCH_ASSOC)) { if ($board['uri'] != $cite['board']) { if (!isset($tmp_board)) $tmp_board = $board['uri']; @@ -979,7 +979,7 @@ function clean() { $query->bindValue(':offset', $offset, PDO::PARAM_INT); $query->execute() or error(db_error($query)); - while ($post = $query->fetch()) { + while ($post = $query->fetch(PDO::FETCH_ASSOC)) { deletePost($post['id']); } } @@ -1000,7 +1000,7 @@ function index($page, $mod=false) { if ($query->rowCount() < 1 && $page > 1) return false; - while ($th = $query->fetch()) { + while ($th = $query->fetch(PDO::FETCH_ASSOC)) { $thread = new Thread( $th['id'], $th['subject'], $th['email'], $th['name'], $th['trip'], $th['capcode'], $th['body'], $th['time'], $th['thumb'], $th['thumbwidth'], $th['thumbheight'], $th['file'], $th['filewidth'], $th['fileheight'], $th['filesize'], $th['filename'], $th['ip'], @@ -1115,7 +1115,7 @@ function getPages($mod=false) { $count = $board['thread_count']; } else { // Count threads - $query = query(sprintf("SELECT COUNT(`id`) FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error()); + $query = query(sprintf("SELECT COUNT(*) FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error()); $count = $query->fetchColumn(); } $count = floor(($config['threads_per_page'] + $count - 1) / $config['threads_per_page']); @@ -1155,7 +1155,7 @@ function checkRobot($body) { $query->bindValue(':hash', $body); $query->execute() or error(db_error($query)); - if ($query->fetch()) { + if ($query->fetchColumn()) { return true; } @@ -1163,20 +1163,19 @@ function checkRobot($body) { $query = prepare("INSERT INTO `robot` VALUES (:hash)"); $query->bindValue(':hash', $body); $query->execute() or error(db_error($query)); + return false; } // Returns an associative array with 'replies' and 'images' keys function numPosts($id) { global $board; - $query = prepare(sprintf("SELECT COUNT(*) as `num` FROM `posts_%s` WHERE `thread` = :thread UNION ALL SELECT COUNT(*) FROM `posts_%s` WHERE `file` IS NOT NULL AND `thread` = :thread", $board['uri'], $board['uri'])); + $query = prepare(sprintf("SELECT COUNT(*) FROM `posts_%s` WHERE `thread` = :thread UNION ALL SELECT COUNT(*) FROM `posts_%s` WHERE `file` IS NOT NULL AND `thread` = :thread", $board['uri'], $board['uri'])); $query->bindValue(':thread', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); - $num_posts = $query->fetch(); - $num_posts = $num_posts['num']; - $num_images = $query->fetch(); - $num_images = $num_images['num']; + $num_posts = $query->fetchColumn(); + $num_images = $query->fetchColumn(); return array('replies' => $num_posts, 'images' => $num_images); } @@ -1188,14 +1187,14 @@ function muteTime() { return $time; // Find number of mutes in the past X hours - $query = prepare("SELECT COUNT(*) as `count` FROM `mutes` WHERE `time` >= :time AND `ip` = :ip"); + $query = prepare("SELECT COUNT(*) FROM `mutes` WHERE `time` >= :time AND `ip` = :ip"); $query->bindValue(':time', time()-($config['robot_mute_hour']*3600), PDO::PARAM_INT); $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']); $query->execute() or error(db_error($query)); - $result = $query->fetch(); - if ($result['count'] == 0) return 0; - return pow($config['robot_mute_multiplier'], $result['count']); + if (!$result = $query->fetchColumn()) + return 0; + return pow($config['robot_mute_multiplier'], $result); } function mute() { @@ -1225,7 +1224,7 @@ function checkMute() { $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']); $query->execute() or error(db_error($query)); - if (!$mute = $query->fetch()) { + if (!$mute = $query->fetch(PDO::FETCH_ASSOC)) { // What!? He's muted but he's not muted... return; } @@ -1514,7 +1513,7 @@ function markup(&$body, $track_cites = false) { $match[1] = mb_strlen(substr($body_tmp, 0, $match[1])); } - if ($post = $query->fetch()) { + if ($post = $query->fetch(PDO::FETCH_ASSOC)) { $replacement = '' . '>>' . $cite . @@ -1557,7 +1556,7 @@ function markup(&$body, $track_cites = false) { $query->bindValue(':id', $cite); $query->execute() or error(db_error($query)); - if ($post = $query->fetch()) { + if ($post = $query->fetch(PDO::FETCH_ASSOC)) { $replacement = '' . '>>>/' . $_board . '/' . $cite . @@ -1666,7 +1665,7 @@ function buildThread($id, $return = false, $mod = false) { $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); - while ($post = $query->fetch()) { + while ($post = $query->fetch(PDO::FETCH_ASSOC)) { if (!isset($thread)) { $thread = new Thread( $post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], @@ -1801,7 +1800,7 @@ function getPostByHash($hash) { $query->bindValue(':hash', $hash, PDO::PARAM_STR); $query->execute() or error(db_error($query)); - if ($post = $query->fetch()) { + if ($post = $query->fetch(PDO::FETCH_ASSOC)) { return $post; } @@ -1815,7 +1814,7 @@ function getPostByHashInThread($hash, $thread) { $query->bindValue(':thread', $thread, PDO::PARAM_INT); $query->execute() or error(db_error($query)); - if ($post = $query->fetch()) { + if ($post = $query->fetch(PDO::FETCH_ASSOC)) { return $post; } diff --git a/inc/mod/auth.php b/inc/mod/auth.php index 1bc27dff..a0986a1f 100644 --- a/inc/mod/auth.php +++ b/inc/mod/auth.php @@ -147,7 +147,7 @@ function create_pm_header() { $query->bindValue(':id', $mod['id'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); - if ($pm = $query->fetch()) + if ($pm = $query->fetch(PDO::FETCH_ASSOC)) $header = array('id' => $pm['id'], 'waiting' => $query->rowCount() - 1); else $header = true; diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 351d3203..f5b1101d 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -96,14 +96,14 @@ function mod_dashboard() { $query = prepare('SELECT COUNT(*) FROM `pms` WHERE `to` = :id AND `unread` = 1'); $query->bindValue(':id', $mod['id']); $query->execute() or error(db_error($query)); - $args['unread_pms'] = $query->fetchColumn(0); + $args['unread_pms'] = $query->fetchColumn(); if ($config['cache']['enabled']) cache::set('pm_unreadcount_' . $mod['id'], $args['unread_pms']); } $query = query('SELECT COUNT(*) FROM `reports`') or error(db_error($query)); - $args['reports'] = $query->fetchColumn(0); + $args['reports'] = $query->fetchColumn(); if ($mod['type'] >= ADMIN && $config['check_updates']) { if (!$config['version']) @@ -536,7 +536,7 @@ function mod_noticeboard($page_no = 1) { $query = prepare("SELECT COUNT(*) FROM `noticeboard`"); $query->execute() or error(db_error($query)); - $count = $query->fetchColumn(0); + $count = $query->fetchColumn(); mod_page(_('Noticeboard'), 'mod/noticeboard.html', array('noticeboard' => $noticeboard, 'count' => $count)); } @@ -597,7 +597,7 @@ function mod_news($page_no = 1) { $query = prepare("SELECT COUNT(*) FROM `news`"); $query->execute() or error(db_error($query)); - $count = $query->fetchColumn(0); + $count = $query->fetchColumn(); mod_page(_('News'), 'mod/news.html', array('news' => $news, 'count' => $count)); } @@ -637,7 +637,7 @@ function mod_log($page_no = 1) { $query = prepare("SELECT COUNT(*) FROM `modlogs`"); $query->execute() or error(db_error($query)); - $count = $query->fetchColumn(0); + $count = $query->fetchColumn(); mod_page(_('Moderation log'), 'mod/log.html', array('logs' => $logs, 'count' => $count)); } @@ -664,7 +664,7 @@ function mod_user_log($username, $page_no = 1) { $query = prepare("SELECT COUNT(*) FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `username` = :username"); $query->bindValue(':username', $username); $query->execute() or error(db_error($query)); - $count = $query->fetchColumn(0); + $count = $query->fetchColumn(); mod_page(_('Moderation log'), 'mod/log.html', array('logs' => $logs, 'count' => $count, 'username' => $username)); } @@ -906,7 +906,7 @@ function mod_bans($page_no = 1) { $query = prepare("SELECT COUNT(*) FROM `bans`"); $query->execute() or error(db_error($query)); - $count = $query->fetchColumn(0); + $count = $query->fetchColumn(); foreach ($bans as &$ban) { if (filter_var($ban['ip'], FILTER_VALIDATE_IP) !== false) @@ -1058,7 +1058,7 @@ function mod_move($originBoard, $postID) { $replies = array(); - while ($post = $query->fetch()) { + while ($post = $query->fetch(PDO::FETCH_ASSOC)) { $post['mod'] = true; $post['thread'] = $newID; @@ -1365,7 +1365,7 @@ function mod_deletebyip($boardName, $post, $global = false) { $query = prepare(sprintf('SELECT `ip` FROM `posts_%s` WHERE `id` = :id', $boardName)); $query->bindValue(':id', $post); $query->execute() or error(db_error($query)); - if (!$ip = $query->fetchColumn(0)) + if (!$ip = $query->fetchColumn()) error($config['error']['invalidpost']); $boards = $global ? listBoards() : array(array('uri' => $boardName)); @@ -1387,7 +1387,7 @@ function mod_deletebyip($boardName, $post, $global = false) { $threads_to_rebuild = array(); $threads_deleted = array(); - while ($post = $query->fetch()) { + while ($post = $query->fetch(PDO::FETCH_ASSOC)) { openBoard($post['board']); deletePost($post['id'], false, false); @@ -1684,7 +1684,7 @@ function mod_inbox() { $query = prepare('SELECT COUNT(*) FROM `pms` WHERE `to` = :mod AND `unread` = 1'); $query->bindValue(':mod', $mod['id']); $query->execute() or error(db_error($query)); - $unread = $query->fetchColumn(0); + $unread = $query->fetchColumn(); foreach ($messages as &$message) { $message['snippet'] = pm_snippet($message['message']); @@ -1706,12 +1706,12 @@ function mod_new_pm($username) { $query = prepare("SELECT `id` FROM `mods` WHERE `username` = :username"); $query->bindValue(':username', $username); $query->execute() or error(db_error($query)); - if (!$id = $query->fetchColumn(0)) { + if (!$id = $query->fetchColumn()) { // Old style ?/PM: by user ID $query = prepare("SELECT `username` FROM `mods` WHERE `id` = :username"); $query->bindValue(':username', $username); $query->execute() or error(db_error($query)); - if ($username = $query->fetchColumn(0)) + if ($username = $query->fetchColumn()) header('Location: ?/new_PM/' . $username, true, $config['redirect_http']); else error($config['error']['404']); @@ -1832,7 +1832,7 @@ function mod_reports() { $report_posts[$board] = array(); $query = query(sprintf('SELECT * FROM `posts_%s` WHERE `id` = ' . implode(' OR `id` = ', $posts), $board)) or error(db_error()); - while ($post = $query->fetch()) { + while ($post = $query->fetch(PDO::FETCH_ASSOC)) { $report_posts[$board][$post['id']] = $post; } } @@ -2169,10 +2169,10 @@ function mod_debug_antispam() { } $query = query('SELECT COUNT(*) FROM `antispam`' . ($where ? " WHERE $where" : '')) or error(db_error()); - $args['total'] = number_format($query->fetchColumn(0)); + $args['total'] = number_format($query->fetchColumn()); $query = query('SELECT COUNT(*) FROM `antispam` WHERE `expires` IS NOT NULL' . ($where ? " AND $where" : '')) or error(db_error()); - $args['expiring'] = number_format($query->fetchColumn(0)); + $args['expiring'] = number_format($query->fetchColumn()); $query = query('SELECT * FROM `antispam` ' . ($where ? "WHERE $where" : '') . ' ORDER BY `passed` DESC LIMIT 40') or error(db_error()); $args['top'] = $query->fetchAll(PDO::FETCH_ASSOC); diff --git a/post.php b/post.php index db077866..f4499845 100644 --- a/post.php +++ b/post.php @@ -52,7 +52,7 @@ if (isset($_POST['delete'])) { $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); - if ($post = $query->fetch()) { + if ($post = $query->fetch(PDO::FETCH_ASSOC)) { if ($password != '' && $post['password'] != $password) error($config['error']['invalidpassword']); @@ -115,12 +115,12 @@ if (isset($_POST['delete'])) { $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); - $post = $query->fetch(); + $thread = $query->fetchColumn(); - if ($post) { + if ($thread) { if ($config['syslog']) _syslog(LOG_INFO, 'Reported post: ' . - '/' . $board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], $post['thread'] ? $post['thread'] : $id) . ($post['thread'] ? '#' . $id : '') . + '/' . $board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], $thread ? $thread : $id) . ($thread ? '#' . $id : '') . ' for "' . $reason . '"' ); $query = prepare("INSERT INTO `reports` VALUES (NULL, :time, :ip, :board, :post, :reason)"); @@ -231,7 +231,7 @@ if (isset($_POST['delete'])) { $query->bindValue(':id', $post['thread'], PDO::PARAM_INT); $query->execute() or error(db_error()); - if (!$thread = $query->fetch()) { + if (!$thread = $query->fetch(PDO::FETCH_ASSOC)) { // Non-existant error($config['error']['nonexistant']); } diff --git a/templates/themes/catalog/theme.php b/templates/themes/catalog/theme.php index e585cf17..5c9f6769 100644 --- a/templates/themes/catalog/theme.php +++ b/templates/themes/catalog/theme.php @@ -39,7 +39,7 @@ $query = query(sprintf("SELECT *, `id` AS `thread_id`, (SELECT COUNT(*) FROM `posts_%s` WHERE `thread` = `thread_id`) AS `reply_count`, '%s' AS `board` FROM `posts_%s` WHERE `thread` IS NULL ORDER BY `bump` DESC", $board_name, $board_name, $board_name)) or error(db_error()); - while ($post = $query->fetch()) { + while ($post = $query->fetch(PDO::FETCH_ASSOC)) { $post['link'] = $config['root'] . $board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], ($post['thread'] ? $post['thread'] : $post['id'])); $post['board_name'] = $board['name']; $post['file'] = $config['uri_thumb'] . $post['thumb']; diff --git a/templates/themes/recent/theme.php b/templates/themes/recent/theme.php index 75907e77..98fabfa1 100644 --- a/templates/themes/recent/theme.php +++ b/templates/themes/recent/theme.php @@ -47,7 +47,7 @@ $query = preg_replace('/UNION ALL $/', 'ORDER BY `time` DESC LIMIT ' . (int)$settings['limit_images'], $query); $query = query($query) or error(db_error()); - while ($post = $query->fetch()) { + while ($post = $query->fetch(PDO::FETCH_ASSOC)) { openBoard($post['board']); // board settings won't be available in the template file, so generate links now @@ -67,7 +67,7 @@ $query = preg_replace('/UNION ALL $/', 'ORDER BY `time` DESC LIMIT ' . (int)$settings['limit_posts'], $query); $query = query($query) or error(db_error()); - while ($post = $query->fetch()) { + while ($post = $query->fetch(PDO::FETCH_ASSOC)) { openBoard($post['board']); $post['link'] = $config['root'] . $board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], ($post['thread'] ? $post['thread'] : $post['id'])) . '#' . $post['id']; @@ -78,7 +78,7 @@ } // Total posts - $query = 'SELECT SUM(`top`) AS `count` FROM ('; + $query = 'SELECT SUM(`top`) FROM ('; foreach ($boards as &$_board) { if (in_array($_board['uri'], $this->excluded)) continue; @@ -86,11 +86,10 @@ } $query = preg_replace('/UNION ALL $/', ') AS `posts_all`', $query); $query = query($query) or error(db_error()); - $res = $query->fetch(); - $stats['total_posts'] = number_format($res['count']); + $stats['total_posts'] = number_format($query->fetchColumn()); // Unique IPs - $query = 'SELECT COUNT(DISTINCT(`ip`)) AS `count` FROM ('; + $query = 'SELECT COUNT(DISTINCT(`ip`)) FROM ('; foreach ($boards as &$_board) { if (in_array($_board['uri'], $this->excluded)) continue; @@ -98,11 +97,10 @@ } $query = preg_replace('/UNION ALL $/', ') AS `posts_all`', $query); $query = query($query) or error(db_error()); - $res = $query->fetch(); - $stats['unique_posters'] = number_format($res['count']); + $stats['unique_posters'] = number_format($query->fetchColumn()); // Active content - $query = 'SELECT SUM(`filesize`) AS `count` FROM ('; + $query = 'SELECT SUM(`filesize`) FROM ('; foreach ($boards as &$_board) { if (in_array($_board['uri'], $this->excluded)) continue; @@ -110,8 +108,7 @@ } $query = preg_replace('/UNION ALL $/', ') AS `posts_all`', $query); $query = query($query) or error(db_error()); - $res = $query->fetch(); - $stats['active_content'] = $res['count']; + $stats['active_content'] = $query->fetchColumn(); return Element('themes/recent/recent.html', Array( 'settings' => $settings, diff --git a/templates/themes/rrdtool/theme.php b/templates/themes/rrdtool/theme.php index 68fc1850..0e0a2f15 100644 --- a/templates/themes/rrdtool/theme.php +++ b/templates/themes/rrdtool/theme.php @@ -61,9 +61,8 @@ // debug just the graphing (not updating) with the --debug switch if (!isset($argv[1]) || $argv[1] != '--debug') { // Update graph - $query = query(sprintf("SELECT MAX(`id`) AS `count` FROM `posts_%s`", $board)); - $count = $query->fetch(); - $count = $count['count']; + $query = query(sprintf("SELECT MAX(`id`) FROM `posts_%s`", $board)); + $count = $query->fetchColumn(); if (!rrd_update($file, Array( '-t', -- cgit v1.3 From 0f9df0ac6608d3398cd480465dcab1b0227ec9c0 Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Wed, 31 Jul 2013 20:54:20 -0400 Subject: Newline before --- inc/mod/pages.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'inc/mod') diff --git a/inc/mod/pages.php b/inc/mod/pages.php index f5b1101d..7edc0ee6 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -1222,7 +1222,7 @@ function mod_ban_post($board, $delete, $post, $token = false) { $_POST['message'] = str_replace('%LENGTH%', strtoupper($length_english), $_POST['message']); $query = prepare(sprintf('UPDATE `posts_%s` SET `body_nomarkup` = CONCAT(`body_nomarkup`, :body_nomarkup) WHERE `id` = :id', $board)); $query->bindValue(':id', $post); - $query->bindValue(':body_nomarkup', sprintf('%s', $_POST['message'])); + $query->bindValue(':body_nomarkup', sprintf("\n%s", $_POST['message'])); $query->execute() or error(db_error($query)); rebuildPost($post); -- cgit v1.3 From ea2b8cce077a092e0cbf136f9a45158668cc5ecf Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Wed, 31 Jul 2013 21:24:17 -0400 Subject: Bugfix: HTML injection in post editing (introduces and fixes yet another bug) --- inc/functions.php | 4 ++-- inc/mod/pages.php | 9 ++++++--- templates/mod/edit_post_form.html | 2 +- 3 files changed, 9 insertions(+), 6 deletions(-) (limited to 'inc/mod') diff --git a/inc/functions.php b/inc/functions.php index b40b40d2..9e1ce1fa 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -1420,7 +1420,7 @@ function markup(&$body, $track_cites = false) { $body = str_replace("\r", '', $body); $body = utf8tohtml($body); - if (preg_match_all('@<tinyboard ([\w\s]+)>(.+)</tinyboard>@um', $body, $modifiers, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) { + if (preg_match_all('@<tinyboard ([\w\s]+)>(.+?)</tinyboard>@um', $body, $modifiers, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) { $skip_chars = 0; $body_tmp = $body; $end_markup = false; @@ -1436,7 +1436,7 @@ function markup(&$body, $track_cites = false) { if ($modifier['type'] == 'ban message') { // Public ban message - $replacement = sprintf($config['mod']['ban_message'], $modifier['content']); + $replacement = sprintf($config['mod']['ban_message'], html_entity_decode($modifier['content'])); if ($end_markup) { $body .= $replacement; } diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 7edc0ee6..2808dc56 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -1222,7 +1222,7 @@ function mod_ban_post($board, $delete, $post, $token = false) { $_POST['message'] = str_replace('%LENGTH%', strtoupper($length_english), $_POST['message']); $query = prepare(sprintf('UPDATE `posts_%s` SET `body_nomarkup` = CONCAT(`body_nomarkup`, :body_nomarkup) WHERE `id` = :id', $board)); $query->bindValue(':id', $post); - $query->bindValue(':body_nomarkup', sprintf("\n%s", $_POST['message'])); + $query->bindValue(':body_nomarkup', sprintf("\n%s", utf8tohtml($_POST['message']))); $query->execute() or error(db_error($query)); rebuildPost($post); @@ -1298,10 +1298,13 @@ function mod_edit_post($board, $edit_raw_html, $postID) { header('Location: ?/' . sprintf($config['board_path'], $board) . $config['dir']['res'] . sprintf($config['file_page'], $post['thread'] ? $post['thread'] : $postID) . '#' . $postID, true, $config['redirect_http']); } else { if ($config['minify_html']) { - $post['body_nomarkup'] = str_replace("\n", ' ', $post['body_nomarkup']); - $post['body'] = str_replace("\n", ' ', $post['body']); + // $post['body_nomarkup'] = str_replace("\n", ' ', $post['body_nomarkup']); + // $post['body'] = str_replace("\n", ' ', $post['body']); } + // Minifying this page causes an issue with newlines in the textarea. This is a temporary solution. + $config['minify_html'] = false; + mod_page(_('Edit post'), 'mod/edit_post_form.html', array('token' => $security_token, 'board' => $board, 'raw' => $edit_raw_html, 'post' => $post)); } } diff --git a/templates/mod/edit_post_form.html b/templates/mod/edit_post_form.html index 146e725b..b9359c68 100644 --- a/templates/mod/edit_post_form.html +++ b/templates/mod/edit_post_form.html @@ -32,7 +32,7 @@ {% trans %}Comment{% endtrans %} - + -- cgit v1.3 From ab364525433a7194d050e4ec13ae08d603fdad43 Mon Sep 17 00:00:00 2001 From: czaks Date: Wed, 31 Jul 2013 19:50:25 -0400 Subject: fix post editing for tinyboard markup --- inc/mod/pages.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'inc/mod') diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 2808dc56..3ff6a9b1 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -1276,7 +1276,7 @@ function mod_edit_post($board, $edit_raw_html, $postID) { if (isset($_POST['name'], $_POST['email'], $_POST['subject'], $_POST['body'])) { if ($edit_raw_html) - $query = prepare(sprintf('UPDATE `posts_%s` SET `name` = :name, `email` = :email, `subject` = :subject, `body` = :body WHERE `id` = :id', $board)); + $query = prepare(sprintf('UPDATE `posts_%s` SET `name` = :name, `email` = :email, `subject` = :subject, `body` = :body, `body_nomarkup` = :body_nomarkup WHERE `id` = :id', $board)); else $query = prepare(sprintf('UPDATE `posts_%s` SET `name` = :name, `email` = :email, `subject` = :subject, `body_nomarkup` = :body WHERE `id` = :id', $board)); $query->bindValue(':id', $postID); @@ -1284,6 +1284,10 @@ function mod_edit_post($board, $edit_raw_html, $postID) { $query->bindValue(':email', $_POST['email']); $query->bindValue(':subject', $_POST['subject']); $query->bindValue(':body', $_POST['body']); + if ($edit_raw_html) { + $body_nomarkup = '' . $_POST['body'] . ''; + $query->bindValue(':body_nomarkup', $body_nomarkup); + } $query->execute() or error(db_error($query)); if ($edit_raw_html) { -- cgit v1.3 From a052a791b553c770ef407f91b697bef7a62df5b1 Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Wed, 31 Jul 2013 22:14:26 -0400 Subject: Add optional database table prefix (issue #118; see issue comments for details) --- inc/anti-bot.php | 12 +-- inc/config.php | 2 + inc/database.php | 4 + inc/filters.php | 2 +- inc/functions.php | 80 +++++++-------- inc/mod/auth.php | 8 +- inc/mod/ban.php | 6 +- inc/mod/pages.php | 188 +++++++++++++++++----------------- install.php | 6 +- post.php | 10 +- templates/posts.sql | 2 +- templates/themes/basic/theme.php | 2 +- templates/themes/catalog/theme.php | 2 +- templates/themes/categories/theme.php | 2 +- templates/themes/frameset/theme.php | 2 +- templates/themes/recent/theme.php | 10 +- templates/themes/rrdtool/theme.php | 2 +- templates/themes/sitemap/theme.php | 2 +- 18 files changed, 177 insertions(+), 165 deletions(-) (limited to 'inc/mod') diff --git a/inc/anti-bot.php b/inc/anti-bot.php index bf29b3cb..fde97096 100644 --- a/inc/anti-bot.php +++ b/inc/anti-bot.php @@ -182,12 +182,12 @@ function _create_antibot($board, $thread) { $antibot = new AntiBot(array($board, $thread)); - query('DELETE FROM `antispam` WHERE `expires` < UNIX_TIMESTAMP()') or error(db_error()); + query('DELETE FROM ``antispam`` WHERE `expires` < UNIX_TIMESTAMP()') or error(db_error()); if ($thread) - $query = prepare('UPDATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE `board` = :board AND `thread` = :thread AND `expires` IS NULL'); + $query = prepare('UPDATE ``antispam`` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE `board` = :board AND `thread` = :thread AND `expires` IS NULL'); else - $query = prepare('UPDATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE `board` = :board AND `thread` IS NULL AND `expires` IS NULL'); + $query = prepare('UPDATE ``antispam`` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE `board` = :board AND `thread` IS NULL AND `expires` IS NULL'); $query->bindValue(':board', $board); if ($thread) @@ -195,7 +195,7 @@ function _create_antibot($board, $thread) { $query->bindValue(':expires', $config['spam']['hidden_inputs_expire']); $query->execute() or error(db_error($query)); - $query = prepare('INSERT INTO `antispam` VALUES (:board, :thread, :hash, UNIX_TIMESTAMP(), NULL, 0)'); + $query = prepare('INSERT INTO ``antispam`` VALUES (:board, :thread, :hash, UNIX_TIMESTAMP(), NULL, 0)'); $query->bindValue(':board', $board); $query->bindValue(':thread', $thread); $query->bindValue(':hash', $antibot->hash()); @@ -248,7 +248,7 @@ function checkSpam(array $extra_salt = array()) { if ($hash != $_hash) return true; - $query = prepare('SELECT `passed` FROM `antispam` WHERE `hash` = :hash'); + $query = prepare('SELECT `passed` FROM ``antispam`` WHERE `hash` = :hash'); $query->bindValue(':hash', $hash); $query->execute() or error(db_error($query)); if ((($passed = $query->fetchColumn(0)) === false) || ($passed > $config['spam']['hidden_inputs_max_pass'])) { @@ -260,7 +260,7 @@ function checkSpam(array $extra_salt = array()) { } function incrementSpamHash($hash) { - $query = prepare('UPDATE `antispam` SET `passed` = `passed` + 1 WHERE `hash` = :hash'); + $query = prepare('UPDATE ``antispam`` SET `passed` = `passed` + 1 WHERE `hash` = :hash'); $query->bindValue(':hash', $hash); $query->execute() or error(db_error($query)); } diff --git a/inc/config.php b/inc/config.php index 6f2371ec..75384d3f 100644 --- a/inc/config.php +++ b/inc/config.php @@ -76,6 +76,8 @@ $config['db']['password'] = ''; // Tinyboard database $config['db']['database'] = ''; + // Table prefix + $config['db']['prefix'] = ''; // Use a persistent connection (experimental) $config['db']['persistent'] = false; // Anything more to add to the DSN string (eg. port=xxx;foo=bar) diff --git a/inc/database.php b/inc/database.php index 3dc0f0ce..7be001ea 100644 --- a/inc/database.php +++ b/inc/database.php @@ -87,6 +87,8 @@ function mysql_version() { function prepare($query) { global $pdo, $debug, $config; + $query = preg_replace('/``([0-9a-zA-Z$_\x{0080}-\x{FFFF}]+)``/u', '`' . $config['db']['prefix'] . '$1`', $query); + sql_open(); if ($config['debug']) @@ -98,6 +100,8 @@ function prepare($query) { function query($query) { global $pdo, $debug, $config; + $query = preg_replace('/``([0-9a-zA-Z$_\x{0080}-\x{FFFF}]+)``/u', '`' . $config['db']['prefix'] . '$1`', $query); + sql_open(); if ($config['debug']) { diff --git a/inc/filters.php b/inc/filters.php index 524d37cf..9f03154d 100644 --- a/inc/filters.php +++ b/inc/filters.php @@ -81,7 +81,7 @@ class Filter { else $all_boards = false; - $query = prepare("INSERT INTO `bans` VALUES (NULL, :ip, :mod, :set, :expires, :reason, :board, 0)"); + $query = prepare("INSERT INTO ``bans`` VALUES (NULL, :ip, :mod, :set, :expires, :reason, :board, 0)"); $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']); $query->bindValue(':mod', -1); $query->bindValue(':set', time()); diff --git a/inc/functions.php b/inc/functions.php index 403f6112..e871fee0 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -241,7 +241,7 @@ function create_antibot($board, $thread = null) { function rebuildThemes($action, $board = false) { // List themes - $query = query("SELECT `theme` FROM `theme_settings` WHERE `name` IS NULL AND `value` IS NULL") or error(db_error()); + $query = query("SELECT `theme` FROM ``theme_settings`` WHERE `name` IS NULL AND `value` IS NULL") or error(db_error()); while ($theme = $query->fetch(PDO::FETCH_ASSOC)) { rebuildTheme($theme['theme'], $action, $board); @@ -276,7 +276,7 @@ function rebuildTheme($theme, $action, $board = false) { function themeSettings($theme) { - $query = prepare("SELECT `name`, `value` FROM `theme_settings` WHERE `theme` = :theme AND `name` IS NOT NULL"); + $query = prepare("SELECT `name`, `value` FROM ``theme_settings`` WHERE `theme` = :theme AND `name` IS NOT NULL"); $query->bindValue(':theme', $theme); $query->execute() or error(db_error($query)); @@ -347,7 +347,7 @@ function getBoardInfo($uri) { return $board; } - $query = prepare("SELECT * FROM `boards` WHERE `uri` = :uri LIMIT 1"); + $query = prepare("SELECT * FROM ``boards`` WHERE `uri` = :uri LIMIT 1"); $query->bindValue(':uri', $uri); $query->execute() or error(db_error($query)); @@ -523,7 +523,7 @@ function listBoards() { if ($config['cache']['enabled'] && ($boards = cache::get('all_boards'))) return $boards; - $query = query("SELECT * FROM `boards` ORDER BY `uri`") or error(db_error()); + $query = query("SELECT * FROM ``boards`` ORDER BY `uri`") or error(db_error()); $boards = $query->fetchAll(); if ($config['cache']['enabled']) @@ -535,7 +535,7 @@ function listBoards() { function checkFlood($post) { global $board, $config; - $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE (`ip` = :ip AND `time` >= :floodtime) OR (`ip` = :ip AND `body` != '' AND `body` = :body AND `time` >= :floodsameiptime) OR (`body` != '' AND `body` = :body AND `time` >= :floodsametime) LIMIT 1", $board['uri'])); + $query = prepare(sprintf("SELECT * FROM ``posts_%s`` WHERE (`ip` = :ip AND `time` >= :floodtime) OR (`ip` = :ip AND `body` != '' AND `body` = :body AND `time` >= :floodsameiptime) OR (`body` != '' AND `body` = :body AND `time` >= :floodsametime) LIMIT 1", $board['uri'])); $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']); $query->bindValue(':body', $post['body']); $query->bindValue(':floodtime', time()-$config['flood_time'], PDO::PARAM_INT); @@ -589,7 +589,7 @@ function displayBan($ban) { global $config; if (!$ban['seen']) { - $query = prepare("UPDATE `bans` SET `seen` = 1 WHERE `id` = :id"); + $query = prepare("UPDATE ``bans`` SET `seen` = 1 WHERE `id` = :id"); $query->bindValue(':id', $ban['id'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); } @@ -620,12 +620,12 @@ function checkBan($board = 0) { if (event('check-ban', $board)) return true; - $query = prepare("SELECT `set`, `expires`, `reason`, `board`, `seen`, `bans`.`id` FROM `bans` WHERE (`board` IS NULL OR `board` = :board) AND `ip` = :ip ORDER BY `expires` IS NULL DESC, `expires` DESC, `expires` DESC LIMIT 1"); + $query = prepare("SELECT `set`, `expires`, `reason`, `board`, `seen`, ``bans``.`id` FROM ``bans`` WHERE (`board` IS NULL OR `board` = :board) AND `ip` = :ip ORDER BY `expires` IS NULL DESC, `expires` DESC, `expires` DESC LIMIT 1"); $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']); $query->bindValue(':board', $board); $query->execute() or error(db_error($query)); if ($query->rowCount() < 1 && $config['ban_range']) { - $query = prepare("SELECT `set`, `expires`, `reason`, `board`, `seen`, `bans`.`id` FROM `bans` WHERE (`board` IS NULL OR `board` = :board) AND :ip LIKE REPLACE(REPLACE(`ip`, '%', '!%'), '*', '%') ESCAPE '!' ORDER BY `expires` IS NULL DESC, `expires` DESC LIMIT 1"); + $query = prepare("SELECT `set`, `expires`, `reason`, `board`, `seen`, ``bans``.`id` FROM ``bans`` WHERE (`board` IS NULL OR `board` = :board) AND :ip LIKE REPLACE(REPLACE(`ip`, '%', '!%'), '*', '%') ESCAPE '!' ORDER BY `expires` IS NULL DESC, `expires` DESC LIMIT 1"); $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']); $query->bindValue(':board', $board); $query->execute() or error(db_error($query)); @@ -633,7 +633,7 @@ function checkBan($board = 0) { if ($query->rowCount() < 1 && $config['ban_cidr'] && !isIPv6()) { // my most insane SQL query yet - $query = prepare("SELECT `set`, `expires`, `reason`, `board`, `seen`, `bans`.`id` FROM `bans` WHERE (`board` IS NULL OR `board` = :board) + $query = prepare("SELECT `set`, `expires`, `reason`, `board`, `seen`, ``bans``.`id` FROM ``bans`` WHERE (`board` IS NULL OR `board` = :board) AND ( `ip` REGEXP '^(\[0-9]+\.\[0-9]+\.\[0-9]+\.\[0-9]+\)\/(\[0-9]+)$' AND @@ -650,7 +650,7 @@ function checkBan($board = 0) { if ($ban = $query->fetch(PDO::FETCH_ASSOC)) { if ($ban['expires'] && $ban['expires'] < time()) { // Ban expired - $query = prepare("DELETE FROM `bans` WHERE `id` = :id"); + $query = prepare("DELETE FROM ``bans`` WHERE `id` = :id"); $query->bindValue(':id', $ban['id'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -670,7 +670,7 @@ function checkBan($board = 0) { // No reason to keep expired bans in the database (except those that haven't been viewed yet) function purge_bans() { - $query = prepare("DELETE FROM `bans` WHERE `expires` IS NOT NULL AND `expires` < :time AND `seen` = 1"); + $query = prepare("DELETE FROM ``bans`` WHERE `expires` IS NOT NULL AND `expires` < :time AND `seen` = 1"); $query->bindValue(':time', time()); $query->execute() or error(db_error($query)); } @@ -681,7 +681,7 @@ function threadLocked($id) { if (event('check-locked', $id)) return true; - $query = prepare(sprintf("SELECT `locked` FROM `posts_%s` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri'])); + $query = prepare(sprintf("SELECT `locked` FROM ``posts_%s`` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri'])); $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error()); @@ -699,7 +699,7 @@ function threadSageLocked($id) { if (event('check-sage-locked', $id)) return true; - $query = prepare(sprintf("SELECT `sage` FROM `posts_%s` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri'])); + $query = prepare(sprintf("SELECT `sage` FROM ``posts_%s`` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri'])); $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error()); @@ -714,7 +714,7 @@ function threadSageLocked($id) { function threadExists($id) { global $board; - $query = prepare(sprintf("SELECT 1 FROM `posts_%s` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri'])); + $query = prepare(sprintf("SELECT 1 FROM ``posts_%s`` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri'])); $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error()); @@ -727,7 +727,7 @@ function threadExists($id) { function post(array $post) { global $pdo, $board; - $query = prepare(sprintf("INSERT INTO `posts_%s` (`id`, `thread`, `subject`, `email`, `name`, `trip`, `capcode`, `body`, `body_nomarkup`, `time`, `bump`, `thumb`, `thumbwidth`, `thumbheight`, `file`, `filewidth`, `fileheight`, `filesize`, `filename`, `filehash`, `password`, `ip`, `sticky`, `locked`, `sage`, `embed`) VALUES ( NULL, :thread, :subject, :email, :name, :trip, :capcode, :body, :body_nomarkup, :time, :time, :thumb, :thumbwidth, :thumbheight, :file, :width, :height, :filesize, :filename, :filehash, :password, :ip, :sticky, :locked, 0, :embed)", $board['uri'])); + $query = prepare(sprintf("INSERT INTO ``posts_%s`` VALUES ( NULL, :thread, :subject, :email, :name, :trip, :capcode, :body, :body_nomarkup, :time, :time, :thumb, :thumbwidth, :thumbheight, :file, :width, :height, :filesize, :filename, :filehash, :password, :ip, :sticky, :locked, 0, :embed)", $board['uri'])); // Basic stuff if (!empty($post['subject'])) { @@ -829,7 +829,7 @@ function bumpThread($id) { if (event('bump', $id)) return true; - $query = prepare(sprintf("UPDATE `posts_%s` SET `bump` = :time WHERE `id` = :id AND `thread` IS NULL", $board['uri'])); + $query = prepare(sprintf("UPDATE ``posts_%s`` SET `bump` = :time WHERE `id` = :id AND `thread` IS NULL", $board['uri'])); $query->bindValue(':time', time(), PDO::PARAM_INT); $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -839,7 +839,7 @@ function bumpThread($id) { function deleteFile($id, $remove_entirely_if_already=true) { global $board, $config; - $query = prepare(sprintf("SELECT `thread`,`thumb`,`file` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri'])); + $query = prepare(sprintf("SELECT `thread`,`thumb`,`file` FROM ``posts_%s`` WHERE `id` = :id LIMIT 1", $board['uri'])); $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); if (!$post = $query->fetch(PDO::FETCH_ASSOC)) @@ -848,7 +848,7 @@ function deleteFile($id, $remove_entirely_if_already=true) { if ($post['file'] == 'deleted' && !$post['thread']) return; // Can't delete OP's image completely. - $query = prepare(sprintf("UPDATE `posts_%s` SET `thumb` = NULL, `thumbwidth` = NULL, `thumbheight` = NULL, `filewidth` = NULL, `fileheight` = NULL, `filesize` = NULL, `filename` = NULL, `filehash` = NULL, `file` = :file WHERE `id` = :id", $board['uri'])); + $query = prepare(sprintf("UPDATE ``posts_%s`` SET `thumb` = NULL, `thumbwidth` = NULL, `thumbheight` = NULL, `filewidth` = NULL, `fileheight` = NULL, `filesize` = NULL, `filename` = NULL, `filehash` = NULL, `file` = :file WHERE `id` = :id", $board['uri'])); if ($post['file'] == 'deleted' && $remove_entirely_if_already) { // Already deleted; remove file fully $query->bindValue(':file', null, PDO::PARAM_NULL); @@ -876,7 +876,7 @@ function deleteFile($id, $remove_entirely_if_already=true) { function rebuildPost($id) { global $board; - $query = prepare(sprintf("SELECT `body_nomarkup`, `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); + $query = prepare(sprintf("SELECT `body_nomarkup`, `thread` FROM ``posts_%s`` WHERE `id` = :id", $board['uri'])); $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -885,7 +885,7 @@ function rebuildPost($id) { markup($body = &$post['body_nomarkup']); - $query = prepare(sprintf("UPDATE `posts_%s` SET `body` = :body WHERE `id` = :id", $board['uri'])); + $query = prepare(sprintf("UPDATE ``posts_%s`` SET `body` = :body WHERE `id` = :id", $board['uri'])); $query->bindValue(':body', $body); $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -900,7 +900,7 @@ function deletePost($id, $error_if_doesnt_exist=true, $rebuild_after=true) { global $board, $config; // Select post and replies (if thread) in one query - $query = prepare(sprintf("SELECT `id`,`thread`,`thumb`,`file` FROM `posts_%s` WHERE `id` = :id OR `thread` = :id", $board['uri'])); + $query = prepare(sprintf("SELECT `id`,`thread`,`thumb`,`file` FROM ``posts_%s`` WHERE `id` = :id OR `thread` = :id", $board['uri'])); $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -918,7 +918,7 @@ function deletePost($id, $error_if_doesnt_exist=true, $rebuild_after=true) { // Delete thread HTML page file_unlink($board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], $post['id'])); - $antispam_query = prepare('DELETE FROM `antispam` WHERE `board` = :board AND `thread` = :thread'); + $antispam_query = prepare('DELETE FROM ``antispam`` WHERE `board` = :board AND `thread` = :thread'); $antispam_query->bindValue(':board', $board['uri']); $antispam_query->bindValue(':thread', $post['id']); $antispam_query->execute() or error(db_error($antispam_query)); @@ -939,11 +939,11 @@ function deletePost($id, $error_if_doesnt_exist=true, $rebuild_after=true) { } - $query = prepare(sprintf("DELETE FROM `posts_%s` WHERE `id` = :id OR `thread` = :id", $board['uri'])); + $query = prepare(sprintf("DELETE FROM ``posts_%s`` WHERE `id` = :id OR `thread` = :id", $board['uri'])); $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); - $query = prepare("SELECT `board`, `post` FROM `cites` WHERE `target_board` = :board AND (`target` = " . implode(' OR `target` = ', $ids) . ")"); + $query = prepare("SELECT `board`, `post` FROM ``cites`` WHERE `target_board` = :board AND (`target` = " . implode(' OR `target` = ', $ids) . ")"); $query->bindValue(':board', $board['uri']); $query->execute() or error(db_error($query)); while ($cite = $query->fetch(PDO::FETCH_ASSOC)) { @@ -958,7 +958,7 @@ function deletePost($id, $error_if_doesnt_exist=true, $rebuild_after=true) { if (isset($tmp_board)) openBoard($tmp_board); - $query = prepare("DELETE FROM `cites` WHERE (`target_board` = :board AND `target` = :id) OR (`board` = :board AND `post` = :id)"); + $query = prepare("DELETE FROM ``cites`` WHERE (`target_board` = :board AND `target` = :id) OR (`board` = :board AND `post` = :id)"); $query->bindValue(':board', $board['uri']); $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -975,7 +975,7 @@ function clean() { $offset = round($config['max_pages']*$config['threads_per_page']); // I too wish there was an easier way of doing this... - $query = prepare(sprintf("SELECT `id` FROM `posts_%s` WHERE `thread` IS NULL ORDER BY `sticky` DESC, `bump` DESC LIMIT :offset, 9001", $board['uri'])); + $query = prepare(sprintf("SELECT `id` FROM ``posts_%s`` WHERE `thread` IS NULL ORDER BY `sticky` DESC, `bump` DESC LIMIT :offset, 9001", $board['uri'])); $query->bindValue(':offset', $offset, PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -990,7 +990,7 @@ function index($page, $mod=false) { $body = ''; $offset = round($page*$config['threads_per_page']-$config['threads_per_page']); - $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` IS NULL ORDER BY `sticky` DESC, `bump` DESC LIMIT :offset,:threads_per_page", $board['uri'])); + $query = prepare(sprintf("SELECT * FROM ``posts_%s`` WHERE `thread` IS NULL ORDER BY `sticky` DESC, `bump` DESC LIMIT :offset,:threads_per_page", $board['uri'])); $query->bindValue(':offset', $offset, PDO::PARAM_INT); $query->bindValue(':threads_per_page', $config['threads_per_page'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -1011,7 +1011,7 @@ function index($page, $mod=false) { $replies = $cached['replies']; $omitted = $cached['omitted']; } else { - $posts = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` = :id ORDER BY `id` DESC LIMIT :limit", $board['uri'])); + $posts = prepare(sprintf("SELECT * FROM ``posts_%s`` WHERE `thread` = :id ORDER BY `id` DESC LIMIT :limit", $board['uri'])); $posts->bindValue(':id', $th['id']); $posts->bindValue(':limit', ($th['sticky'] ? $config['threads_preview_sticky'] : $config['threads_preview']), PDO::PARAM_INT); $posts->execute() or error(db_error($posts)); @@ -1115,7 +1115,7 @@ function getPages($mod=false) { $count = $board['thread_count']; } else { // Count threads - $query = query(sprintf("SELECT COUNT(*) FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error()); + $query = query(sprintf("SELECT COUNT(*) FROM ``posts_%s`` WHERE `thread` IS NULL", $board['uri'])) or error(db_error()); $count = $query->fetchColumn(); } $count = floor(($config['threads_per_page'] + $count - 1) / $config['threads_per_page']); @@ -1151,7 +1151,7 @@ function checkRobot($body) { return true; $body = makerobot($body); - $query = prepare("SELECT 1 FROM `robot` WHERE `hash` = :hash LIMIT 1"); + $query = prepare("SELECT 1 FROM ``robot`` WHERE `hash` = :hash LIMIT 1"); $query->bindValue(':hash', $body); $query->execute() or error(db_error($query)); @@ -1160,7 +1160,7 @@ function checkRobot($body) { } // Insert new hash - $query = prepare("INSERT INTO `robot` VALUES (:hash)"); + $query = prepare("INSERT INTO ``robot`` VALUES (:hash)"); $query->bindValue(':hash', $body); $query->execute() or error(db_error($query)); @@ -1170,7 +1170,7 @@ function checkRobot($body) { // Returns an associative array with 'replies' and 'images' keys function numPosts($id) { global $board; - $query = prepare(sprintf("SELECT COUNT(*) FROM `posts_%s` WHERE `thread` = :thread UNION ALL SELECT COUNT(*) FROM `posts_%s` WHERE `file` IS NOT NULL AND `thread` = :thread", $board['uri'], $board['uri'])); + $query = prepare(sprintf("SELECT COUNT(*) FROM ``posts_%s`` WHERE `thread` = :thread UNION ALL SELECT COUNT(*) FROM ``posts_%s`` WHERE `file` IS NOT NULL AND `thread` = :thread", $board['uri'], $board['uri'])); $query->bindValue(':thread', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -1187,7 +1187,7 @@ function muteTime() { return $time; // Find number of mutes in the past X hours - $query = prepare("SELECT COUNT(*) FROM `mutes` WHERE `time` >= :time AND `ip` = :ip"); + $query = prepare("SELECT COUNT(*) FROM ``mutes`` WHERE `time` >= :time AND `ip` = :ip"); $query->bindValue(':time', time()-($config['robot_mute_hour']*3600), PDO::PARAM_INT); $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']); $query->execute() or error(db_error($query)); @@ -1199,7 +1199,7 @@ function muteTime() { function mute() { // Insert mute - $query = prepare("INSERT INTO `mutes` VALUES (:ip, :time)"); + $query = prepare("INSERT INTO ``mutes`` VALUES (:ip, :time)"); $query->bindValue(':time', time(), PDO::PARAM_INT); $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']); $query->execute() or error(db_error($query)); @@ -1220,7 +1220,7 @@ function checkMute() { $mutetime = muteTime(); if ($mutetime > 0) { // Find last mute time - $query = prepare("SELECT `time` FROM `mutes` WHERE `ip` = :ip ORDER BY `time` DESC LIMIT 1"); + $query = prepare("SELECT `time` FROM ``mutes`` WHERE `ip` = :ip ORDER BY `time` DESC LIMIT 1"); $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']); $query->execute() or error(db_error($query)); @@ -1514,7 +1514,7 @@ function markup(&$body, $track_cites = false) { foreach ($cites as $matches) { $cite = $matches[2][0]; - $query = prepare(sprintf("SELECT `thread`,`id` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri'])); + $query = prepare(sprintf("SELECT `thread`,`id` FROM ``posts_%s`` WHERE `id` = :id LIMIT 1", $board['uri'])); $query->bindValue(':id', $cite); $query->execute() or error(db_error($query)); @@ -1562,7 +1562,7 @@ function markup(&$body, $track_cites = false) { // Check if the board exists, and load settings if (openBoard($_board)) { if ($cite) { - $query = prepare(sprintf("SELECT `thread`,`id` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri'])); + $query = prepare(sprintf("SELECT `thread`,`id` FROM ``posts_%s`` WHERE `id` = :id LIMIT 1", $board['uri'])); $query->bindValue(':id', $cite); $query->execute() or error(db_error($query)); @@ -1671,7 +1671,7 @@ function buildThread($id, $return = false, $mod = false) { cache::delete("thread_{$board['uri']}_{$id}"); } - $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE (`thread` IS NULL AND `id` = :id) OR `thread` = :id ORDER BY `thread`,`id`", $board['uri'])); + $query = prepare(sprintf("SELECT * FROM ``posts_%s`` WHERE (`thread` IS NULL AND `id` = :id) OR `thread` = :id ORDER BY `thread`,`id`", $board['uri'])); $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -1806,7 +1806,7 @@ function fraction($numerator, $denominator, $sep) { function getPostByHash($hash) { global $board; - $query = prepare(sprintf("SELECT `id`,`thread` FROM `posts_%s` WHERE `filehash` = :hash", $board['uri'])); + $query = prepare(sprintf("SELECT `id`,`thread` FROM ``posts_%s`` WHERE `filehash` = :hash", $board['uri'])); $query->bindValue(':hash', $hash, PDO::PARAM_STR); $query->execute() or error(db_error($query)); @@ -1819,7 +1819,7 @@ function getPostByHash($hash) { function getPostByHashInThread($hash, $thread) { global $board; - $query = prepare(sprintf("SELECT `id`,`thread` FROM `posts_%s` WHERE `filehash` = :hash AND ( `thread` = :thread OR `id` = :thread )", $board['uri'])); + $query = prepare(sprintf("SELECT `id`,`thread` FROM ``posts_%s`` WHERE `filehash` = :hash AND ( `thread` = :thread OR `id` = :thread )", $board['uri'])); $query->bindValue(':hash', $hash, PDO::PARAM_STR); $query->bindValue(':thread', $thread, PDO::PARAM_INT); $query->execute() or error(db_error($query)); diff --git a/inc/mod/auth.php b/inc/mod/auth.php index a0986a1f..bfab0f7e 100644 --- a/inc/mod/auth.php +++ b/inc/mod/auth.php @@ -42,7 +42,7 @@ function login($username, $password, $makehash=true) { $password = sha1($password); } - $query = prepare("SELECT `id`, `type`, `boards`, `password`, `salt` FROM `mods` WHERE `username` = :username"); + $query = prepare("SELECT `id`, `type`, `boards`, `password`, `salt` FROM ``mods`` WHERE `username` = :username"); $query->bindValue(':username', $username); $query->execute() or error(db_error($query)); @@ -83,7 +83,7 @@ function destroyCookies() { function modLog($action, $_board=null) { global $mod, $board, $config; - $query = prepare("INSERT INTO `modlogs` VALUES (:id, :ip, :board, :time, :text)"); + $query = prepare("INSERT INTO ``modlogs`` VALUES (:id, :ip, :board, :time, :text)"); $query->bindValue(':id', $mod['id'], PDO::PARAM_INT); $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']); $query->bindValue(':time', time(), PDO::PARAM_INT); @@ -112,7 +112,7 @@ if (isset($_COOKIE[$config['cookies']['mod']])) { exit; } - $query = prepare("SELECT `id`, `type`, `boards`, `password` FROM `mods` WHERE `username` = :username"); + $query = prepare("SELECT `id`, `type`, `boards`, `password` FROM ``mods`` WHERE `username` = :username"); $query->bindValue(':username', $cookie[0]); $query->execute() or error(db_error($query)); $user = $query->fetch(PDO::FETCH_ASSOC); @@ -143,7 +143,7 @@ function create_pm_header() { return $header; } - $query = prepare("SELECT `id` FROM `pms` WHERE `to` = :id AND `unread` = 1"); + $query = prepare("SELECT `id` FROM ``pms`` WHERE `to` = :id AND `unread` = 1"); $query->bindValue(':id', $mod['id'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); diff --git a/inc/mod/ban.php b/inc/mod/ban.php index cfc2636f..9166223f 100644 --- a/inc/mod/ban.php +++ b/inc/mod/ban.php @@ -56,7 +56,7 @@ function parse_time($str) { function ban($mask, $reason, $length, $board) { global $mod, $pdo; - $query = prepare("INSERT INTO `bans` VALUES (NULL, :ip, :mod, :time, :expires, :reason, :board, 0)"); + $query = prepare("INSERT INTO ``bans`` VALUES (NULL, :ip, :mod, :time, :expires, :reason, :board, 0)"); $query->bindValue(':ip', $mask); $query->bindValue(':mod', $mod['id']); $query->bindValue(':time', time()); @@ -89,12 +89,12 @@ function ban($mask, $reason, $length, $board) { } function unban($id) { - $query = prepare("SELECT `ip` FROM `bans` WHERE `id` = :id"); + $query = prepare("SELECT `ip` FROM ``bans`` WHERE `id` = :id"); $query->bindValue(':id', $id); $query->execute() or error(db_error($query)); $mask = $query->fetchColumn(); - $query = prepare("DELETE FROM `bans` WHERE `id` = :id"); + $query = prepare("DELETE FROM ``bans`` WHERE `id` = :id"); $query->bindValue(':id', $id); $query->execute() or error(db_error($query)); diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 3ff6a9b1..1e0dc7c9 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -82,7 +82,7 @@ function mod_dashboard() { if (hasPermission($config['mod']['noticeboard'])) { if (!$config['cache']['enabled'] || !$args['noticeboard'] = cache::get('noticeboard_preview')) { - $query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit"); + $query = prepare("SELECT ``noticeboard``.*, `username` FROM ``noticeboard`` LEFT JOIN ``mods`` ON ``mods``.`id` = `mod` ORDER BY `id` DESC LIMIT :limit"); $query->bindValue(':limit', $config['mod']['noticeboard_dashboard'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); $args['noticeboard'] = $query->fetchAll(PDO::FETCH_ASSOC); @@ -93,7 +93,7 @@ function mod_dashboard() { } if (!$config['cache']['enabled'] || ($args['unread_pms'] = cache::get('pm_unreadcount_' . $mod['id'])) == false) { - $query = prepare('SELECT COUNT(*) FROM `pms` WHERE `to` = :id AND `unread` = 1'); + $query = prepare('SELECT COUNT(*) FROM ``pms`` WHERE `to` = :id AND `unread` = 1'); $query->bindValue(':id', $mod['id']); $query->execute() or error(db_error($query)); $args['unread_pms'] = $query->fetchColumn(); @@ -102,7 +102,7 @@ function mod_dashboard() { cache::set('pm_unreadcount_' . $mod['id'], $args['unread_pms']); } - $query = query('SELECT COUNT(*) FROM `reports`') or error(db_error($query)); + $query = query('SELECT COUNT(*) FROM ``reports``') or error(db_error($query)); $args['reports'] = $query->fetchColumn(); if ($mod['type'] >= ADMIN && $config['check_updates']) { @@ -208,6 +208,8 @@ function mod_search($type, $search_query_escaped, $page_no = 1) { // Use asterisk as wildcard instead $query = str_replace('*', '%', $query); + $query = str_replace('`', '!`', $query); + // Array of phrases to match $match = array(); @@ -271,7 +273,7 @@ function mod_search($type, $search_query_escaped, $page_no = 1) { if (!empty($query)) $query .= ' UNION ALL '; - $query .= sprintf("SELECT *, '%s' AS `board` FROM `posts_%s` WHERE %s", $board['uri'], $board['uri'], $sql_like); + $query .= sprintf("SELECT *, '%s' AS `board` FROM ``posts_%s`` WHERE %s", $board['uri'], $board['uri'], $sql_like); } // You weren't allowed to search any boards @@ -282,21 +284,21 @@ function mod_search($type, $search_query_escaped, $page_no = 1) { } if ($type == 'IP_notes') { - $query = 'SELECT * FROM `ip_notes` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE ' . $sql_like . ' ORDER BY `time` DESC'; + $query = 'SELECT * FROM ``ip_notes`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE ' . $sql_like . ' ORDER BY `time` DESC'; $sql_table = 'ip_notes'; if (!hasPermission($config['mod']['view_notes']) || !hasPermission($config['mod']['show_ip'])) error($config['error']['noaccess']); } if ($type == 'bans') { - $query = 'SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE ' . $sql_like . ' ORDER BY (`expires` IS NOT NULL AND `expires` < UNIX_TIMESTAMP()), `set` DESC'; + $query = 'SELECT ``bans``.*, `username` FROM ``bans`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE ' . $sql_like . ' ORDER BY (`expires` IS NOT NULL AND `expires` < UNIX_TIMESTAMP()), `set` DESC'; $sql_table = 'bans'; if (!hasPermission($config['mod']['view_banlist'])) error($config['error']['noaccess']); } if ($type == 'log') { - $query = 'SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE ' . $sql_like . ' ORDER BY `time` DESC'; + $query = 'SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM ``modlogs`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE ' . $sql_like . ' ORDER BY `time` DESC'; $sql_table = 'modlogs'; if (!hasPermission($config['mod']['modlog'])) error($config['error']['noaccess']); @@ -353,7 +355,7 @@ function mod_edit_board($boardName) { if (!hasPermission($config['mod']['manageboards'], $board['uri'])) error($config['error']['deleteboard']); - $query = prepare('DELETE FROM `boards` WHERE `uri` = :uri'); + $query = prepare('DELETE FROM ``boards`` WHERE `uri` = :uri'); $query->bindValue(':uri', $board['uri']); $query->execute() or error(db_error($query)); @@ -363,19 +365,19 @@ function mod_edit_board($boardName) { rrmdir($board['uri'] . '/'); // Delete posting table - $query = query(sprintf('DROP TABLE IF EXISTS `posts_%s`', $board['uri'])) or error(db_error()); + $query = query(sprintf('DROP TABLE IF EXISTS ``posts_%s``', $board['uri'])) or error(db_error()); // Clear reports - $query = prepare('DELETE FROM `reports` WHERE `board` = :id'); + $query = prepare('DELETE FROM ``reports`` WHERE `board` = :id'); $query->bindValue(':id', $board['uri'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); // Delete from table - $query = prepare('DELETE FROM `boards` WHERE `uri` = :uri'); + $query = prepare('DELETE FROM ``boards`` WHERE `uri` = :uri'); $query->bindValue(':uri', $board['uri'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); - $query = prepare("SELECT `board`, `post` FROM `cites` WHERE `target_board` = :board"); + $query = prepare("SELECT `board`, `post` FROM ``cites`` WHERE `target_board` = :board"); $query->bindValue(':board', $board['uri']); $query->execute() or error(db_error($query)); while ($cite = $query->fetch(PDO::FETCH_ASSOC)) { @@ -387,28 +389,28 @@ function mod_edit_board($boardName) { } } - $query = prepare('DELETE FROM `cites` WHERE `board` = :board OR `target_board` = :board'); + $query = prepare('DELETE FROM ``cites`` WHERE `board` = :board OR `target_board` = :board'); $query->bindValue(':board', $board['uri']); $query->execute() or error(db_error($query)); - $query = prepare('DELETE FROM `antispam` WHERE `board` = :board'); + $query = prepare('DELETE FROM ``antispam`` WHERE `board` = :board'); $query->bindValue(':board', $board['uri']); $query->execute() or error(db_error($query)); // Remove board from users/permissions table - $query = query('SELECT `id`,`boards` FROM `mods`') or error(db_error()); + $query = query('SELECT `id`,`boards` FROM ``mods``') or error(db_error()); while ($user = $query->fetch(PDO::FETCH_ASSOC)) { $user_boards = explode(',', $user['boards']); if (in_array($board['uri'], $user_boards)) { unset($user_boards[array_search($board['uri'], $user_boards)]); - $_query = prepare('UPDATE `mods` SET `boards` = :boards WHERE `id` = :id'); + $_query = prepare('UPDATE ``mods`` SET `boards` = :boards WHERE `id` = :id'); $_query->bindValue(':boards', implode(',', $user_boards)); $_query->bindValue(':id', $user['id']); $_query->execute() or error(db_error($_query)); } } } else { - $query = prepare('UPDATE `boards` SET `title` = :title, `subtitle` = :subtitle WHERE `uri` = :uri'); + $query = prepare('UPDATE ``boards`` SET `title` = :title, `subtitle` = :subtitle WHERE `uri` = :uri'); $query->bindValue(':uri', $board['uri']); $query->bindValue(':title', $_POST['title']); $query->bindValue(':subtitle', $_POST['subtitle']); @@ -467,7 +469,7 @@ function mod_new_board() { error(sprintf($config['error']['boardexists'], $board['url'])); } - $query = prepare('INSERT INTO `boards` VALUES (:uri, :title, :subtitle)'); + $query = prepare('INSERT INTO ``boards`` VALUES (:uri, :title, :subtitle)'); $query->bindValue(':uri', $_POST['uri']); $query->bindValue(':title', $_POST['title']); $query->bindValue(':subtitle', $_POST['subtitle']); @@ -510,7 +512,7 @@ function mod_noticeboard($page_no = 1) { $_POST['body'] = escape_markup_modifiers($_POST['body']); markup($_POST['body']); - $query = prepare('INSERT INTO `noticeboard` VALUES (NULL, :mod, :time, :subject, :body)'); + $query = prepare('INSERT INTO ``noticeboard`` VALUES (NULL, :mod, :time, :subject, :body)'); $query->bindValue(':mod', $mod['id']); $query->bindvalue(':time', time()); $query->bindValue(':subject', $_POST['subject']); @@ -525,7 +527,7 @@ function mod_noticeboard($page_no = 1) { header('Location: ?/noticeboard#' . $pdo->lastInsertId(), true, $config['redirect_http']); } - $query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :offset, :limit"); + $query = prepare("SELECT ``noticeboard``.*, `username` FROM ``noticeboard`` LEFT JOIN ``mods`` ON ``mods``.`id` = `mod` ORDER BY `id` DESC LIMIT :offset, :limit"); $query->bindValue(':limit', $config['mod']['noticeboard_page'], PDO::PARAM_INT); $query->bindValue(':offset', ($page_no - 1) * $config['mod']['noticeboard_page'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -534,7 +536,7 @@ function mod_noticeboard($page_no = 1) { if (empty($noticeboard) && $page_no > 1) error($config['error']['404']); - $query = prepare("SELECT COUNT(*) FROM `noticeboard`"); + $query = prepare("SELECT COUNT(*) FROM ``noticeboard``"); $query->execute() or error(db_error($query)); $count = $query->fetchColumn(); @@ -547,7 +549,7 @@ function mod_noticeboard_delete($id) { if (!hasPermission($config['mod']['noticeboard_delete'])) error($config['error']['noaccess']); - $query = prepare('DELETE FROM `noticeboard` WHERE `id` = :id'); + $query = prepare('DELETE FROM ``noticeboard`` WHERE `id` = :id'); $query->bindValue(':id', $id); $query->execute() or error(db_error($query)); @@ -572,7 +574,7 @@ function mod_news($page_no = 1) { $_POST['body'] = escape_markup_modifiers($_POST['body']); markup($_POST['body']); - $query = prepare('INSERT INTO `news` VALUES (NULL, :name, :time, :subject, :body)'); + $query = prepare('INSERT INTO ``news`` VALUES (NULL, :name, :time, :subject, :body)'); $query->bindValue(':name', isset($_POST['name']) && hasPermission($config['mod']['news_custom']) ? $_POST['name'] : $mod['username']); $query->bindvalue(':time', time()); $query->bindValue(':subject', $_POST['subject']); @@ -586,7 +588,7 @@ function mod_news($page_no = 1) { header('Location: ?/news#' . $pdo->lastInsertId(), true, $config['redirect_http']); } - $query = prepare("SELECT * FROM `news` ORDER BY `id` DESC LIMIT :offset, :limit"); + $query = prepare("SELECT * FROM ``news`` ORDER BY `id` DESC LIMIT :offset, :limit"); $query->bindValue(':limit', $config['mod']['news_page'], PDO::PARAM_INT); $query->bindValue(':offset', ($page_no - 1) * $config['mod']['news_page'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -595,7 +597,7 @@ function mod_news($page_no = 1) { if (empty($news) && $page_no > 1) error($config['error']['404']); - $query = prepare("SELECT COUNT(*) FROM `news`"); + $query = prepare("SELECT COUNT(*) FROM ``news``"); $query->execute() or error(db_error($query)); $count = $query->fetchColumn(); @@ -608,7 +610,7 @@ function mod_news_delete($id) { if (!hasPermission($config['mod']['news_delete'])) error($config['error']['noaccess']); - $query = prepare('DELETE FROM `news` WHERE `id` = :id'); + $query = prepare('DELETE FROM ``news`` WHERE `id` = :id'); $query->bindValue(':id', $id); $query->execute() or error(db_error($query)); @@ -626,7 +628,7 @@ function mod_log($page_no = 1) { if (!hasPermission($config['mod']['modlog'])) error($config['error']['noaccess']); - $query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY `time` DESC LIMIT :offset, :limit"); + $query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM ``modlogs`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` ORDER BY `time` DESC LIMIT :offset, :limit"); $query->bindValue(':limit', $config['mod']['modlog_page'], PDO::PARAM_INT); $query->bindValue(':offset', ($page_no - 1) * $config['mod']['modlog_page'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -635,7 +637,7 @@ function mod_log($page_no = 1) { if (empty($logs) && $page_no > 1) error($config['error']['404']); - $query = prepare("SELECT COUNT(*) FROM `modlogs`"); + $query = prepare("SELECT COUNT(*) FROM ``modlogs``"); $query->execute() or error(db_error($query)); $count = $query->fetchColumn(); @@ -651,7 +653,7 @@ function mod_user_log($username, $page_no = 1) { if (!hasPermission($config['mod']['modlog'])) error($config['error']['noaccess']); - $query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `username` = :username ORDER BY `time` DESC LIMIT :offset, :limit"); + $query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM ``modlogs`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `username` = :username ORDER BY `time` DESC LIMIT :offset, :limit"); $query->bindValue(':username', $username); $query->bindValue(':limit', $config['mod']['modlog_page'], PDO::PARAM_INT); $query->bindValue(':offset', ($page_no - 1) * $config['mod']['modlog_page'], PDO::PARAM_INT); @@ -661,7 +663,7 @@ function mod_user_log($username, $page_no = 1) { if (empty($logs) && $page_no > 1) error($config['error']['404']); - $query = prepare("SELECT COUNT(*) FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `username` = :username"); + $query = prepare("SELECT COUNT(*) FROM ``modlogs`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `username` = :username"); $query->bindValue(':username', $username); $query->execute() or error(db_error($query)); $count = $query->fetchColumn(); @@ -707,7 +709,7 @@ function mod_ip_remove_note($ip, $id) { if (filter_var($ip, FILTER_VALIDATE_IP) === false) error("Invalid IP address."); - $query = prepare('DELETE FROM `ip_notes` WHERE `ip` = :ip AND `id` = :id'); + $query = prepare('DELETE FROM ``ip_notes`` WHERE `ip` = :ip AND `id` = :id'); $query->bindValue(':ip', $ip); $query->bindValue(':id', $id); $query->execute() or error(db_error($query)); @@ -741,7 +743,7 @@ function mod_page_ip($ip) { $_POST['note'] = escape_markup_modifiers($_POST['note']); markup($_POST['note']); - $query = prepare('INSERT INTO `ip_notes` VALUES (NULL, :ip, :mod, :time, :body)'); + $query = prepare('INSERT INTO ``ip_notes`` VALUES (NULL, :ip, :mod, :time, :body)'); $query->bindValue(':ip', $ip); $query->bindValue(':mod', $mod['id']); $query->bindValue(':time', time()); @@ -766,7 +768,7 @@ function mod_page_ip($ip) { openBoard($board['uri']); if (!hasPermission($config['mod']['show_ip'], $board['uri'])) continue; - $query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `ip` = :ip ORDER BY `sticky` DESC, `id` DESC LIMIT :limit', $board['uri'])); + $query = prepare(sprintf('SELECT * FROM ``posts_%s`` WHERE `ip` = :ip ORDER BY `sticky` DESC, `id` DESC LIMIT :limit', $board['uri'])); $query->bindValue(':ip', $ip); $query->bindValue(':limit', $config['mod']['ip_recentposts'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -798,21 +800,21 @@ function mod_page_ip($ip) { $args['token'] = make_secure_link_token('ban'); if (hasPermission($config['mod']['view_ban'])) { - $query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `ip` = :ip"); + $query = prepare("SELECT ``bans``.*, `username` FROM ``bans`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `ip` = :ip"); $query->bindValue(':ip', $ip); $query->execute() or error(db_error($query)); $args['bans'] = $query->fetchAll(PDO::FETCH_ASSOC); } if (hasPermission($config['mod']['view_notes'])) { - $query = prepare("SELECT `ip_notes`.*, `username` FROM `ip_notes` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `ip` = :ip"); + $query = prepare("SELECT ``ip_notes``.*, `username` FROM ``ip_notes`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `ip` = :ip"); $query->bindValue(':ip', $ip); $query->execute() or error(db_error($query)); $args['notes'] = $query->fetchAll(PDO::FETCH_ASSOC); } if (hasPermission($config['mod']['modlog_ip'])) { - $query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `text` LIKE :search ORDER BY `time` DESC LIMIT 20"); + $query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM ``modlogs`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `text` LIKE :search ORDER BY `time` DESC LIMIT 20"); $query->bindValue(':search', '%' . $ip . '%'); $query->execute() or error(db_error($query)); $args['logs'] = $query->fetchAll(PDO::FETCH_ASSOC); @@ -865,7 +867,7 @@ function mod_bans($page_no = 1) { if (isset($config['mod']['unban_limit'])){ if (count($unban) <= $config['mod']['unban_limit'] || $config['mod']['unban_limit'] == -1){ if (!empty($unban)) { - query('DELETE FROM `bans` WHERE `id` = ' . implode(' OR `id` = ', $unban)) or error(db_error()); + query('DELETE FROM ``bans`` WHERE `id` = ' . implode(' OR `id` = ', $unban)) or error(db_error()); foreach ($unban as $id) { modLog("Removed ban #{$id}"); @@ -878,7 +880,7 @@ function mod_bans($page_no = 1) { } else { if (!empty($unban)) { - query('DELETE FROM `bans` WHERE `id` = ' . implode(' OR `id` = ', $unban)) or error(db_error()); + query('DELETE FROM ``bans`` WHERE `id` = ' . implode(' OR `id` = ', $unban)) or error(db_error()); foreach ($unban as $id) { modLog("Removed ban #{$id}"); @@ -890,10 +892,10 @@ function mod_bans($page_no = 1) { } if ($config['mod']['view_banexpired']) { - $query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY (`expires` IS NOT NULL AND `expires` < :time), `set` DESC LIMIT :offset, :limit"); + $query = prepare("SELECT ``bans``.*, `username` FROM ``bans`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` ORDER BY (`expires` IS NOT NULL AND `expires` < :time), `set` DESC LIMIT :offset, :limit"); } else { // Filter out expired bans - $query = prepare("SELECT `bans`.*, `username` FROM `bans` INNER JOIN `mods` ON `mod` = `mods`.`id` WHERE `expires` = 0 OR `expires` > :time ORDER BY `set` DESC LIMIT :offset, :limit"); + $query = prepare("SELECT ``bans``.*, `username` FROM ``bans`` INNER JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `expires` = 0 OR `expires` > :time ORDER BY `set` DESC LIMIT :offset, :limit"); } $query->bindValue(':time', time(), PDO::PARAM_INT); $query->bindValue(':limit', $config['mod']['banlist_page'], PDO::PARAM_INT); @@ -904,7 +906,7 @@ function mod_bans($page_no = 1) { if (empty($bans) && $page_no > 1) error($config['error']['404']); - $query = prepare("SELECT COUNT(*) FROM `bans`"); + $query = prepare("SELECT COUNT(*) FROM ``bans``"); $query->execute() or error(db_error($query)); $count = $query->fetchColumn(); @@ -926,7 +928,7 @@ function mod_lock($board, $unlock, $post) { if (!hasPermission($config['mod']['lock'], $board)) error($config['error']['noaccess']); - $query = prepare(sprintf('UPDATE `posts_%s` SET `locked` = :locked WHERE `id` = :id AND `thread` IS NULL', $board)); + $query = prepare(sprintf('UPDATE ``posts_%s`` SET `locked` = :locked WHERE `id` = :id AND `thread` IS NULL', $board)); $query->bindValue(':id', $post); $query->bindValue(':locked', $unlock ? 0 : 1); $query->execute() or error(db_error($query)); @@ -937,7 +939,7 @@ function mod_lock($board, $unlock, $post) { } if ($config['mod']['dismiss_reports_on_lock']) { - $query = prepare('DELETE FROM `reports` WHERE `board` = :board AND `post` = :id'); + $query = prepare('DELETE FROM ``reports`` WHERE `board` = :board AND `post` = :id'); $query->bindValue(':board', $board); $query->bindValue(':id', $post); $query->execute() or error(db_error($query)); @@ -960,7 +962,7 @@ function mod_sticky($board, $unsticky, $post) { if (!hasPermission($config['mod']['sticky'], $board)) error($config['error']['noaccess']); - $query = prepare(sprintf('UPDATE `posts_%s` SET `sticky` = :sticky WHERE `id` = :id AND `thread` IS NULL', $board)); + $query = prepare(sprintf('UPDATE ``posts_%s`` SET `sticky` = :sticky WHERE `id` = :id AND `thread` IS NULL', $board)); $query->bindValue(':id', $post); $query->bindValue(':sticky', $unsticky ? 0 : 1); $query->execute() or error(db_error($query)); @@ -982,7 +984,7 @@ function mod_bumplock($board, $unbumplock, $post) { if (!hasPermission($config['mod']['bumplock'], $board)) error($config['error']['noaccess']); - $query = prepare(sprintf('UPDATE `posts_%s` SET `sage` = :bumplock WHERE `id` = :id AND `thread` IS NULL', $board)); + $query = prepare(sprintf('UPDATE ``posts_%s`` SET `sage` = :bumplock WHERE `id` = :id AND `thread` IS NULL', $board)); $query->bindValue(':id', $post); $query->bindValue(':bumplock', $unbumplock ? 0 : 1); $query->execute() or error(db_error($query)); @@ -1004,7 +1006,7 @@ function mod_move($originBoard, $postID) { if (!hasPermission($config['mod']['move'], $originBoard)) error($config['error']['noaccess']); - $query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `id` = :id AND `thread` IS NULL', $originBoard)); + $query = prepare(sprintf('SELECT * FROM ``posts_%s`` WHERE `id` = :id AND `thread` IS NULL', $originBoard)); $query->bindValue(':id', $postID); $query->execute() or error(db_error($query)); if (!$post = $query->fetch(PDO::FETCH_ASSOC)) @@ -1052,7 +1054,7 @@ function mod_move($originBoard, $postID) { // go back to the original board to fetch replies openBoard($originBoard); - $query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `thread` = :id ORDER BY `id`', $originBoard)); + $query = prepare(sprintf('SELECT * FROM ``posts_%s`` WHERE `thread` = :id ORDER BY `id`', $originBoard)); $query->bindValue(':id', $postID, PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -1081,7 +1083,7 @@ function mod_move($originBoard, $postID) { openBoard($targetBoard); foreach ($replies as &$post) { - $query = prepare('SELECT `target` FROM `cites` WHERE `target_board` = :board AND `board` = :board AND `post` = :post'); + $query = prepare('SELECT `target` FROM ``cites`` WHERE `target_board` = :board AND `board` = :board AND `post` = :post'); $query->bindValue(':board', $originBoard); $query->bindValue(':post', $post['id'], PDO::PARAM_INT); $query->execute() or error(db_error($qurey)); @@ -1113,7 +1115,7 @@ function mod_move($originBoard, $postID) { } foreach ($post['tracked_cites'] as $cite) { - $query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)'); + $query = prepare('INSERT INTO ``cites`` VALUES (:board, :post, :target_board, :target)'); $query->bindValue(':board', $board['uri']); $query->bindValue(':post', $newPostID, PDO::PARAM_INT); $query->bindValue(':target_board',$cite[0]); @@ -1138,7 +1140,7 @@ function mod_move($originBoard, $postID) { if ($shadow) { // lock old thread - $query = prepare(sprintf('UPDATE `posts_%s` SET `locked` = 1 WHERE `id` = :id', $originBoard)); + $query = prepare(sprintf('UPDATE ``posts_%s`` SET `locked` = 1 WHERE `id` = :id', $originBoard)); $query->bindValue(':id', $postID, PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -1197,7 +1199,7 @@ function mod_ban_post($board, $delete, $post, $token = false) { $security_token = make_secure_link_token($board . '/ban/' . $post); - $query = prepare(sprintf('SELECT `ip`, `thread` FROM `posts_%s` WHERE `id` = :id', $board)); + $query = prepare(sprintf('SELECT `ip`, `thread` FROM ``posts_%s`` WHERE `id` = :id', $board)); $query->bindValue(':id', $post); $query->execute() or error(db_error($query)); if (!$_post = $query->fetch(PDO::FETCH_ASSOC)) @@ -1220,7 +1222,7 @@ function mod_ban_post($board, $delete, $post, $token = false) { $_POST['message'] = preg_replace('/[\r\n]/', '', $_POST['message']); $_POST['message'] = str_replace('%length%', $length_english, $_POST['message']); $_POST['message'] = str_replace('%LENGTH%', strtoupper($length_english), $_POST['message']); - $query = prepare(sprintf('UPDATE `posts_%s` SET `body_nomarkup` = CONCAT(`body_nomarkup`, :body_nomarkup) WHERE `id` = :id', $board)); + $query = prepare(sprintf('UPDATE ``posts_%s`` SET `body_nomarkup` = CONCAT(`body_nomarkup`, :body_nomarkup) WHERE `id` = :id', $board)); $query->bindValue(':id', $post); $query->bindValue(':body_nomarkup', sprintf("\n%s", utf8tohtml($_POST['message']))); $query->execute() or error(db_error($query)); @@ -1267,7 +1269,7 @@ function mod_edit_post($board, $edit_raw_html, $postID) { $security_token = make_secure_link_token($board . '/edit' . ($edit_raw_html ? '_raw' : '') . '/' . $postID); - $query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `id` = :id', $board)); + $query = prepare(sprintf('SELECT * FROM ``posts_%s`` WHERE `id` = :id', $board)); $query->bindValue(':id', $postID); $query->execute() or error(db_error($query)); @@ -1276,9 +1278,9 @@ function mod_edit_post($board, $edit_raw_html, $postID) { if (isset($_POST['name'], $_POST['email'], $_POST['subject'], $_POST['body'])) { if ($edit_raw_html) - $query = prepare(sprintf('UPDATE `posts_%s` SET `name` = :name, `email` = :email, `subject` = :subject, `body` = :body, `body_nomarkup` = :body_nomarkup WHERE `id` = :id', $board)); + $query = prepare(sprintf('UPDATE ``posts_%s`` SET `name` = :name, `email` = :email, `subject` = :subject, `body` = :body, `body_nomarkup` = :body_nomarkup WHERE `id` = :id', $board)); else - $query = prepare(sprintf('UPDATE `posts_%s` SET `name` = :name, `email` = :email, `subject` = :subject, `body_nomarkup` = :body WHERE `id` = :id', $board)); + $query = prepare(sprintf('UPDATE ``posts_%s`` SET `name` = :name, `email` = :email, `subject` = :subject, `body_nomarkup` = :body WHERE `id` = :id', $board)); $query->bindValue(':id', $postID); $query->bindValue('name', $_POST['name']); $query->bindValue(':email', $_POST['email']); @@ -1369,7 +1371,7 @@ function mod_deletebyip($boardName, $post, $global = false) { error($config['error']['noaccess']); // Find IP address - $query = prepare(sprintf('SELECT `ip` FROM `posts_%s` WHERE `id` = :id', $boardName)); + $query = prepare(sprintf('SELECT `ip` FROM ``posts_%s`` WHERE `id` = :id', $boardName)); $query->bindValue(':id', $post); $query->execute() or error(db_error($query)); if (!$ip = $query->fetchColumn()) @@ -1379,7 +1381,7 @@ function mod_deletebyip($boardName, $post, $global = false) { $query = ''; foreach ($boards as $_board) { - $query .= sprintf("SELECT `thread`, `id`, '%s' AS `board` FROM `posts_%s` WHERE `ip` = :ip UNION ALL ", $_board['uri'], $_board['uri']); + $query .= sprintf("SELECT `thread`, `id`, '%s' AS `board` FROM ``posts_%s`` WHERE `ip` = :ip UNION ALL ", $_board['uri'], $_board['uri']); } $query = preg_replace('/UNION ALL $/', '', $query); @@ -1431,7 +1433,7 @@ function mod_user($uid) { if (!hasPermission($config['mod']['editusers']) && !(hasPermission($config['mod']['change_password']) && $uid == $mod['id'])) error($config['error']['noaccess']); - $query = prepare('SELECT * FROM `mods` WHERE `id` = :id'); + $query = prepare('SELECT * FROM ``mods`` WHERE `id` = :id'); $query->bindValue(':id', $uid); $query->execute() or error(db_error($query)); if (!$user = $query->fetch(PDO::FETCH_ASSOC)) @@ -1457,7 +1459,7 @@ function mod_user($uid) { if (!hasPermission($config['mod']['deleteusers'])) error($config['error']['noaccess']); - $query = prepare('DELETE FROM `mods` WHERE `id` = :id'); + $query = prepare('DELETE FROM ``mods`` WHERE `id` = :id'); $query->bindValue(':id', $uid); $query->execute() or error(db_error($query)); @@ -1471,7 +1473,7 @@ function mod_user($uid) { if ($_POST['username'] == '') error(sprintf($config['error']['required'], 'username')); - $query = prepare('UPDATE `mods` SET `username` = :username, `boards` = :boards WHERE `id` = :id'); + $query = prepare('UPDATE ``mods`` SET `username` = :username, `boards` = :boards WHERE `id` = :id'); $query->bindValue(':id', $uid); $query->bindValue(':username', $_POST['username']); $query->bindValue(':boards', implode(',', $boards)); @@ -1486,7 +1488,7 @@ function mod_user($uid) { $salt = generate_salt(); $password = hash('sha256', $salt . sha1($_POST['password'])); - $query = prepare('UPDATE `mods` SET `password` = :password, `salt` = :salt WHERE `id` = :id'); + $query = prepare('UPDATE ``mods`` SET `password` = :password, `salt` = :salt WHERE `id` = :id'); $query->bindValue(':id', $uid); $query->bindValue(':password', $password); $query->bindValue(':salt', $salt); @@ -1513,7 +1515,7 @@ function mod_user($uid) { $salt = generate_salt(); $password = hash('sha256', $salt . sha1($_POST['password'])); - $query = prepare('UPDATE `mods` SET `password` = :password, `salt` = :salt WHERE `id` = :id'); + $query = prepare('UPDATE ``mods`` SET `password` = :password, `salt` = :salt WHERE `id` = :id'); $query->bindValue(':id', $uid); $query->bindValue(':password', $password); $query->bindValue(':salt', $salt); @@ -1534,7 +1536,7 @@ function mod_user($uid) { } if (hasPermission($config['mod']['modlog'])) { - $query = prepare('SELECT * FROM `modlogs` WHERE `mod` = :id ORDER BY `time` DESC LIMIT 5'); + $query = prepare('SELECT * FROM ``modlogs`` WHERE `mod` = :id ORDER BY `time` DESC LIMIT 5'); $query->bindValue(':id', $uid); $query->execute() or error(db_error($query)); $log = $query->fetchAll(PDO::FETCH_ASSOC); @@ -1581,7 +1583,7 @@ function mod_user_new() { $salt = generate_salt(); $password = hash('sha256', $salt . sha1($_POST['password'])); - $query = prepare('INSERT INTO `mods` VALUES (NULL, :username, :password, :salt, :type, :boards)'); + $query = prepare('INSERT INTO ``mods`` VALUES (NULL, :username, :password, :salt, :type, :boards)'); $query->bindValue(':username', $_POST['username']); $query->bindValue(':password', $password); $query->bindValue(':salt', $salt); @@ -1607,7 +1609,7 @@ function mod_users() { if (!hasPermission($config['mod']['manageusers'])) error($config['error']['noaccess']); - $query = query("SELECT *, (SELECT `time` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `last`, (SELECT `text` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `action` FROM `mods` ORDER BY `type` DESC,`id`") or error(db_error()); + $query = query("SELECT *, (SELECT `time` FROM ``modlogs`` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `last`, (SELECT `text` FROM ``modlogs`` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `action` FROM ``mods`` ORDER BY `type` DESC,`id`") or error(db_error()); $users = $query->fetchAll(PDO::FETCH_ASSOC); mod_page(sprintf('%s (%d)', _('Manage users'), count($users)), 'mod/users.html', array('users' => $users)); @@ -1619,7 +1621,7 @@ function mod_user_promote($uid, $action) { if (!hasPermission($config['mod']['promoteusers'])) error($config['error']['noaccess']); - $query = prepare("UPDATE `mods` SET `type` = `type` " . ($action == 'promote' ? "+1 WHERE `type` < " . (int)ADMIN : "-1 WHERE `type` > " . (int)JANITOR) . " AND `id` = :id"); + $query = prepare("UPDATE ``mods`` SET `type` = `type` " . ($action == 'promote' ? "+1 WHERE `type` < " . (int)ADMIN : "-1 WHERE `type` > " . (int)JANITOR) . " AND `id` = :id"); $query->bindValue(':id', $uid); $query->execute() or error(db_error($query)); @@ -1634,7 +1636,7 @@ function mod_pm($id, $reply = false) { if ($reply && !hasPermission($config['mod']['create_pm'])) error($config['error']['noaccess']); - $query = prepare("SELECT `mods`.`username`, `mods_to`.`username` AS `to_username`, `pms`.* FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` LEFT JOIN `mods` AS `mods_to` ON `mods_to`.`id` = `to` WHERE `pms`.`id` = :id"); + $query = prepare("SELECT ``mods``.`username`, `mods_to`.`username` AS `to_username`, ``pms``.* FROM ``pms`` LEFT JOIN ``mods`` ON ``mods``.`id` = `sender` LEFT JOIN ``mods`` AS `mods_to` ON `mods_to`.`id` = `to` WHERE ``pms``.`id` = :id"); $query->bindValue(':id', $id); $query->execute() or error(db_error($query)); @@ -1642,7 +1644,7 @@ function mod_pm($id, $reply = false) { error($config['error']['404']); if (isset($_POST['delete'])) { - $query = prepare("DELETE FROM `pms` WHERE `id` = :id"); + $query = prepare("DELETE FROM ``pms`` WHERE `id` = :id"); $query->bindValue(':id', $id); $query->execute() or error(db_error($query)); @@ -1656,7 +1658,7 @@ function mod_pm($id, $reply = false) { } if ($pm['unread'] && $pm['to'] == $mod['id']) { - $query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `id` = :id"); + $query = prepare("UPDATE ``pms`` SET `unread` = 0 WHERE `id` = :id"); $query->bindValue(':id', $id); $query->execute() or error(db_error($query)); @@ -1683,12 +1685,12 @@ function mod_pm($id, $reply = false) { function mod_inbox() { global $config, $mod; - $query = prepare('SELECT `unread`,`pms`.`id`, `time`, `sender`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `to` = :mod ORDER BY `unread` DESC, `time` DESC'); + $query = prepare('SELECT `unread`,``pms``.`id`, `time`, `sender`, `to`, `message`, `username` FROM ``pms`` LEFT JOIN ``mods`` ON ``mods``.`id` = `sender` WHERE `to` = :mod ORDER BY `unread` DESC, `time` DESC'); $query->bindValue(':mod', $mod['id']); $query->execute() or error(db_error($query)); $messages = $query->fetchAll(PDO::FETCH_ASSOC); - $query = prepare('SELECT COUNT(*) FROM `pms` WHERE `to` = :mod AND `unread` = 1'); + $query = prepare('SELECT COUNT(*) FROM ``pms`` WHERE `to` = :mod AND `unread` = 1'); $query->bindValue(':mod', $mod['id']); $query->execute() or error(db_error($query)); $unread = $query->fetchColumn(); @@ -1710,12 +1712,12 @@ function mod_new_pm($username) { if (!hasPermission($config['mod']['create_pm'])) error($config['error']['noaccess']); - $query = prepare("SELECT `id` FROM `mods` WHERE `username` = :username"); + $query = prepare("SELECT `id` FROM ``mods`` WHERE `username` = :username"); $query->bindValue(':username', $username); $query->execute() or error(db_error($query)); if (!$id = $query->fetchColumn()) { // Old style ?/PM: by user ID - $query = prepare("SELECT `username` FROM `mods` WHERE `id` = :username"); + $query = prepare("SELECT `username` FROM ``mods`` WHERE `id` = :username"); $query->bindValue(':username', $username); $query->execute() or error(db_error($query)); if ($username = $query->fetchColumn()) @@ -1728,7 +1730,7 @@ function mod_new_pm($username) { $_POST['message'] = escape_markup_modifiers($_POST['message']); markup($_POST['message']); - $query = prepare("INSERT INTO `pms` VALUES (NULL, :me, :id, :message, :time, 1)"); + $query = prepare("INSERT INTO ``pms`` VALUES (NULL, :me, :id, :message, :time, 1)"); $query->bindValue(':me', $mod['id']); $query->bindValue(':id', $id); $query->bindValue(':message', $_POST['message']); @@ -1801,7 +1803,7 @@ function mod_rebuild() { } if (isset($_POST['rebuild_thread'])) { - $query = query(sprintf("SELECT `id` FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error()); + $query = query(sprintf("SELECT `id` FROM ``posts_%s`` WHERE `thread` IS NULL", $board['uri'])) or error(db_error()); while ($post = $query->fetch(PDO::FETCH_ASSOC)) { $log[] = '' . sprintf($config['board_abbreviation'], $board['uri']) . ': Rebuilding thread #' . $post['id']; buildThread($post['id']); @@ -1822,7 +1824,7 @@ function mod_reports() { if (!hasPermission($config['mod']['reports'])) error($config['error']['noaccess']); - $query = prepare("SELECT * FROM `reports` ORDER BY `time` DESC LIMIT :limit"); + $query = prepare("SELECT * FROM ``reports`` ORDER BY `time` DESC LIMIT :limit"); $query->bindValue(':limit', $config['mod']['recent_reports'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); $reports = $query->fetchAll(PDO::FETCH_ASSOC); @@ -1838,7 +1840,7 @@ function mod_reports() { foreach ($report_queries as $board => $posts) { $report_posts[$board] = array(); - $query = query(sprintf('SELECT * FROM `posts_%s` WHERE `id` = ' . implode(' OR `id` = ', $posts), $board)) or error(db_error()); + $query = query(sprintf('SELECT * FROM ``posts_%s`` WHERE `id` = ' . implode(' OR `id` = ', $posts), $board)) or error(db_error()); while ($post = $query->fetch(PDO::FETCH_ASSOC)) { $report_posts[$board][$post['id']] = $post; } @@ -1849,7 +1851,7 @@ function mod_reports() { foreach ($reports as $report) { if (!isset($report_posts[$report['board']][$report['post']])) { // // Invalid report (post has since been deleted) - $query = prepare("DELETE FROM `reports` WHERE `post` = :id AND `board` = :board"); + $query = prepare("DELETE FROM ``reports`` WHERE `post` = :id AND `board` = :board"); $query->bindValue(':id', $report['post'], PDO::PARAM_INT); $query->bindValue(':board', $report['board']); $query->execute() or error(db_error($query)); @@ -1905,7 +1907,7 @@ function mod_reports() { function mod_report_dismiss($id, $all = false) { global $config; - $query = prepare("SELECT `post`, `board`, `ip` FROM `reports` WHERE `id` = :id"); + $query = prepare("SELECT `post`, `board`, `ip` FROM ``reports`` WHERE `id` = :id"); $query->bindValue(':id', $id); $query->execute() or error(db_error($query)); if ($report = $query->fetch(PDO::FETCH_ASSOC)) { @@ -1922,10 +1924,10 @@ function mod_report_dismiss($id, $all = false) { error($config['error']['noaccess']); if ($all) { - $query = prepare("DELETE FROM `reports` WHERE `ip` = :ip"); + $query = prepare("DELETE FROM ``reports`` WHERE `ip` = :ip"); $query->bindValue(':ip', $ip); } else { - $query = prepare("DELETE FROM `reports` WHERE `id` = :id"); + $query = prepare("DELETE FROM ``reports`` WHERE `id` = :id"); $query->bindValue(':id', $id); } $query->execute() or error(db_error($query)); @@ -2035,7 +2037,7 @@ function mod_themes_list() { if (!$dir = opendir($config['dir']['themes'])) error(_('Cannot open themes directory; check permissions.')); - $query = query('SELECT `theme` FROM `theme_settings` WHERE `name` IS NULL AND `value` IS NULL') or error(db_error()); + $query = query('SELECT `theme` FROM ``theme_settings`` WHERE `name` IS NULL AND `value` IS NULL') or error(db_error()); $themes_in_use = $query->fetchAll(PDO::FETCH_COLUMN); // Scan directory for themes @@ -2071,19 +2073,19 @@ function mod_theme_configure($theme_name) { } // Clear previous settings - $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); + $query = prepare("DELETE FROM ``theme_settings`` WHERE `theme` = :theme"); $query->bindValue(':theme', $theme_name); $query->execute() or error(db_error($query)); foreach ($theme['config'] as &$conf) { - $query = prepare("INSERT INTO `theme_settings` VALUES(:theme, :name, :value)"); + $query = prepare("INSERT INTO ``theme_settings`` VALUES(:theme, :name, :value)"); $query->bindValue(':theme', $theme_name); $query->bindValue(':name', $conf['name']); $query->bindValue(':value', $_POST[$conf['name']]); $query->execute() or error(db_error($query)); } - $query = prepare("INSERT INTO `theme_settings` VALUES(:theme, NULL, NULL)"); + $query = prepare("INSERT INTO ``theme_settings`` VALUES(:theme, NULL, NULL)"); $query->bindValue(':theme', $theme_name); $query->execute() or error(db_error($query)); @@ -2101,7 +2103,7 @@ function mod_theme_configure($theme_name) { if (!$result) { // Install failed - $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); + $query = prepare("DELETE FROM ``theme_settings`` WHERE `theme` = :theme"); $query->bindValue(':theme', $theme_name); $query->execute() or error(db_error($query)); } @@ -2133,7 +2135,7 @@ function mod_theme_uninstall($theme_name) { if (!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); - $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); + $query = prepare("DELETE FROM ``theme_settings`` WHERE `theme` = :theme"); $query->bindValue(':theme', $theme_name); $query->execute() or error(db_error($query)); @@ -2164,7 +2166,7 @@ function mod_debug_antispam() { $where .= ' AND `thread` = ' . $pdo->quote($_POST['thread']); if (isset($_POST['purge'])) { - $query = prepare(', DATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE' . $where); + $query = prepare(', DATE ``antispam`` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE' . $where); $query->bindValue(':expires', $config['spam']['hidden_inputs_expire']); $query->execute() or error(db_error()); } @@ -2175,16 +2177,16 @@ function mod_debug_antispam() { $where = ''; } - $query = query('SELECT COUNT(*) FROM `antispam`' . ($where ? " WHERE $where" : '')) or error(db_error()); + $query = query('SELECT COUNT(*) FROM ``antispam``' . ($where ? " WHERE $where" : '')) or error(db_error()); $args['total'] = number_format($query->fetchColumn()); - $query = query('SELECT COUNT(*) FROM `antispam` WHERE `expires` IS NOT NULL' . ($where ? " AND $where" : '')) or error(db_error()); + $query = query('SELECT COUNT(*) FROM ``antispam`` WHERE `expires` IS NOT NULL' . ($where ? " AND $where" : '')) or error(db_error()); $args['expiring'] = number_format($query->fetchColumn()); - $query = query('SELECT * FROM `antispam` ' . ($where ? "WHERE $where" : '') . ' ORDER BY `passed` DESC LIMIT 40') or error(db_error()); + $query = query('SELECT * FROM ``antispam`` ' . ($where ? "WHERE $where" : '') . ' ORDER BY `passed` DESC LIMIT 40') or error(db_error()); $args['top'] = $query->fetchAll(PDO::FETCH_ASSOC); - $query = query('SELECT * FROM `antispam` ' . ($where ? "WHERE $where" : '') . ' ORDER BY `created` DESC LIMIT 20') or error(db_error()); + $query = query('SELECT * FROM ``antispam`` ' . ($where ? "WHERE $where" : '') . ' ORDER BY `created` DESC LIMIT 20') or error(db_error()); $args['recent'] = $query->fetchAll(PDO::FETCH_ASSOC); mod_page(_('Debug: Anti-spam'), 'mod/debug/antispam.html', $args); @@ -2200,7 +2202,7 @@ function mod_debug_recent_posts() { // Manually build an SQL query $query = 'SELECT * FROM ('; foreach ($boards as $board) { - $query .= sprintf('SELECT *, %s AS `board` FROM `posts_%s` UNION ALL ', $pdo->quote($board['uri']), $board['uri']); + $query .= sprintf('SELECT *, %s AS `board` FROM ``posts_%s`` UNION ALL ', $pdo->quote($board['uri']), $board['uri']); } // Remove the last "UNION ALL" seperator and complete the query $query = preg_replace('/UNION ALL $/', ') AS `all_posts` ORDER BY `time` DESC LIMIT ' . $limit, $query); diff --git a/install.php b/install.php index 847876ab..2f51b22f 100644 --- a/install.php +++ b/install.php @@ -501,6 +501,9 @@ if ($step == 0) { + + + @@ -668,7 +671,8 @@ if ($step == 0) { $queries[] = Element('posts.sql', array('board' => 'b')); $sql_errors = ''; - foreach ($queries as &$query) { + foreach ($queries as $query) { + $query = preg_replace('/^([\w\s]*)`([0-9a-zA-Z$_\x{0080}-\x{FFFF}]+)`/u', '$1``$2``', $query); if (!query($query)) $sql_errors .= '

  • ' . db_error() . '
    • '; } diff --git a/post.php b/post.php index f4499845..22782ca7 100644 --- a/post.php +++ b/post.php @@ -48,7 +48,7 @@ if (isset($_POST['delete'])) { error($config['error']['nodelete']); foreach ($delete as &$id) { - $query = prepare(sprintf("SELECT `thread`, `time`,`password` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); + $query = prepare(sprintf("SELECT `thread`, `time`,`password` FROM ``posts_%s`` WHERE `id` = :id", $board['uri'])); $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -111,7 +111,7 @@ if (isset($_POST['delete'])) { markup($reason); foreach ($report as &$id) { - $query = prepare(sprintf("SELECT `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); + $query = prepare(sprintf("SELECT `thread` FROM ``posts_%s`` WHERE `id` = :id", $board['uri'])); $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -123,7 +123,7 @@ if (isset($_POST['delete'])) { '/' . $board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], $thread ? $thread : $id) . ($thread ? '#' . $id : '') . ' for "' . $reason . '"' ); - $query = prepare("INSERT INTO `reports` VALUES (NULL, :time, :ip, :board, :post, :reason)"); + $query = prepare("INSERT INTO ``reports`` VALUES (NULL, :time, :ip, :board, :post, :reason)"); $query->bindValue(':time', time(), PDO::PARAM_INT); $query->bindValue(':ip', $_SERVER['REMOTE_ADDR'], PDO::PARAM_STR); $query->bindValue(':board', $board['uri'], PDO::PARAM_INT); @@ -227,7 +227,7 @@ if (isset($_POST['delete'])) { //Check if thread exists if (!$post['op']) { - $query = prepare(sprintf("SELECT `sticky`,`locked`,`sage` FROM `posts_%s` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri'])); + $query = prepare(sprintf("SELECT `sticky`,`locked`,`sage` FROM ``posts_%s`` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri'])); $query->bindValue(':id', $post['thread'], PDO::PARAM_INT); $query->execute() or error(db_error()); @@ -583,7 +583,7 @@ if (isset($_POST['delete'])) { if (isset($post['tracked_cites'])) { foreach ($post['tracked_cites'] as $cite) { - $query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)'); + $query = prepare('INSERT INTO ``cites`` VALUES (:board, :post, :target_board, :target)'); $query->bindValue(':board', $board['uri']); $query->bindValue(':post', $id, PDO::PARAM_INT); $query->bindValue(':target_board',$cite[0]); diff --git a/templates/posts.sql b/templates/posts.sql index 698fad77..ca2ec304 100644 --- a/templates/posts.sql +++ b/templates/posts.sql @@ -1,4 +1,4 @@ -CREATE TABLE IF NOT EXISTS `posts_{{ board }}` ( +CREATE TABLE IF NOT EXISTS ``posts_{{ board }}`` ( `id` int(11) unsigned NOT NULL AUTO_INCREMENT, `thread` int(11) DEFAULT NULL, `subject` varchar(100) DEFAULT NULL, diff --git a/templates/themes/basic/theme.php b/templates/themes/basic/theme.php index 7ba0d1e7..6ba09ce6 100644 --- a/templates/themes/basic/theme.php +++ b/templates/themes/basic/theme.php @@ -25,7 +25,7 @@ $settings['no_recent'] = (int) $settings['no_recent']; - $query = query("SELECT * FROM `news` ORDER BY `time` DESC" . ($settings['no_recent'] ? ' LIMIT ' . $settings['no_recent'] : '')) or error(db_error()); + $query = query("SELECT * FROM ``news`` ORDER BY `time` DESC" . ($settings['no_recent'] ? ' LIMIT ' . $settings['no_recent'] : '')) or error(db_error()); $news = $query->fetchAll(PDO::FETCH_ASSOC); return Element('themes/basic/index.html', Array( diff --git a/templates/themes/catalog/theme.php b/templates/themes/catalog/theme.php index 5c9f6769..4e2d40db 100644 --- a/templates/themes/catalog/theme.php +++ b/templates/themes/catalog/theme.php @@ -37,7 +37,7 @@ $recent_posts = array(); $stats = array(); - $query = query(sprintf("SELECT *, `id` AS `thread_id`, (SELECT COUNT(*) FROM `posts_%s` WHERE `thread` = `thread_id`) AS `reply_count`, '%s' AS `board` FROM `posts_%s` WHERE `thread` IS NULL ORDER BY `bump` DESC", $board_name, $board_name, $board_name)) or error(db_error()); + $query = query(sprintf("SELECT *, `id` AS `thread_id`, (SELECT COUNT(*) FROM ``posts_%s`` WHERE `thread` = `thread_id`) AS `reply_count`, '%s' AS `board` FROM ``posts_%s`` WHERE `thread` IS NULL ORDER BY `bump` DESC", $board_name, $board_name, $board_name)) or error(db_error()); while ($post = $query->fetch(PDO::FETCH_ASSOC)) { $post['link'] = $config['root'] . $board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], ($post['thread'] ? $post['thread'] : $post['id'])); diff --git a/templates/themes/categories/theme.php b/templates/themes/categories/theme.php index 7d468d0d..74ed61ed 100644 --- a/templates/themes/categories/theme.php +++ b/templates/themes/categories/theme.php @@ -36,7 +36,7 @@ public static function news($settings) { global $config; - $query = query("SELECT * FROM `news` ORDER BY `time` DESC") or error(db_error()); + $query = query("SELECT * FROM ``news`` ORDER BY `time` DESC") or error(db_error()); $news = $query->fetchAll(PDO::FETCH_ASSOC); return Element('themes/categories/news.html', Array( diff --git a/templates/themes/frameset/theme.php b/templates/themes/frameset/theme.php index 5fd9d29e..ffab0538 100644 --- a/templates/themes/frameset/theme.php +++ b/templates/themes/frameset/theme.php @@ -36,7 +36,7 @@ public static function news($settings) { global $config; - $query = query("SELECT * FROM `news` ORDER BY `time` DESC") or error(db_error()); + $query = query("SELECT * FROM ``news`` ORDER BY `time` DESC") or error(db_error()); $news = $query->fetchAll(PDO::FETCH_ASSOC); return Element('themes/frameset/news.html', Array( diff --git a/templates/themes/recent/theme.php b/templates/themes/recent/theme.php index 98fabfa1..08d910f8 100644 --- a/templates/themes/recent/theme.php +++ b/templates/themes/recent/theme.php @@ -42,7 +42,7 @@ foreach ($boards as &$_board) { if (in_array($_board['uri'], $this->excluded)) continue; - $query .= sprintf("SELECT *, '%s' AS `board` FROM `posts_%s` WHERE `file` IS NOT NULL AND `file` != 'deleted' AND `thumb` != 'spoiler' UNION ALL ", $_board['uri'], $_board['uri']); + $query .= sprintf("SELECT *, '%s' AS `board` FROM ``posts_%s`` WHERE `file` IS NOT NULL AND `file` != 'deleted' AND `thumb` != 'spoiler' UNION ALL ", $_board['uri'], $_board['uri']); } $query = preg_replace('/UNION ALL $/', 'ORDER BY `time` DESC LIMIT ' . (int)$settings['limit_images'], $query); $query = query($query) or error(db_error()); @@ -62,7 +62,7 @@ foreach ($boards as &$_board) { if (in_array($_board['uri'], $this->excluded)) continue; - $query .= sprintf("SELECT *, '%s' AS `board` FROM `posts_%s` UNION ALL ", $_board['uri'], $_board['uri']); + $query .= sprintf("SELECT *, '%s' AS `board` FROM ``posts_%s`` UNION ALL ", $_board['uri'], $_board['uri']); } $query = preg_replace('/UNION ALL $/', 'ORDER BY `time` DESC LIMIT ' . (int)$settings['limit_posts'], $query); $query = query($query) or error(db_error()); @@ -82,7 +82,7 @@ foreach ($boards as &$_board) { if (in_array($_board['uri'], $this->excluded)) continue; - $query .= sprintf("SELECT MAX(`id`) AS `top` FROM `posts_%s` UNION ALL ", $_board['uri']); + $query .= sprintf("SELECT MAX(`id`) AS `top` FROM ``posts_%s`` UNION ALL ", $_board['uri']); } $query = preg_replace('/UNION ALL $/', ') AS `posts_all`', $query); $query = query($query) or error(db_error()); @@ -93,7 +93,7 @@ foreach ($boards as &$_board) { if (in_array($_board['uri'], $this->excluded)) continue; - $query .= sprintf("SELECT `ip` FROM `posts_%s` UNION ALL ", $_board['uri']); + $query .= sprintf("SELECT `ip` FROM ``posts_%s`` UNION ALL ", $_board['uri']); } $query = preg_replace('/UNION ALL $/', ') AS `posts_all`', $query); $query = query($query) or error(db_error()); @@ -104,7 +104,7 @@ foreach ($boards as &$_board) { if (in_array($_board['uri'], $this->excluded)) continue; - $query .= sprintf("SELECT `filesize` FROM `posts_%s` UNION ALL ", $_board['uri']); + $query .= sprintf("SELECT `filesize` FROM ``posts_%s`` UNION ALL ", $_board['uri']); } $query = preg_replace('/UNION ALL $/', ') AS `posts_all`', $query); $query = query($query) or error(db_error()); diff --git a/templates/themes/rrdtool/theme.php b/templates/themes/rrdtool/theme.php index 0e0a2f15..a14169a3 100644 --- a/templates/themes/rrdtool/theme.php +++ b/templates/themes/rrdtool/theme.php @@ -61,7 +61,7 @@ // debug just the graphing (not updating) with the --debug switch if (!isset($argv[1]) || $argv[1] != '--debug') { // Update graph - $query = query(sprintf("SELECT MAX(`id`) FROM `posts_%s`", $board)); + $query = query(sprintf("SELECT MAX(`id`) FROM ``posts_%s``", $board)); $count = $query->fetchColumn(); if (!rrd_update($file, Array( diff --git a/templates/themes/sitemap/theme.php b/templates/themes/sitemap/theme.php index e210316b..226f8357 100644 --- a/templates/themes/sitemap/theme.php +++ b/templates/themes/sitemap/theme.php @@ -19,7 +19,7 @@ $threads = array(); foreach ($boards as $board) { - $query = query(sprintf("SELECT `id` AS `thread_id`, (SELECT `time` FROM `posts_%s` WHERE `thread` = `thread_id` OR `id` = `thread_id` ORDER BY `time` DESC LIMIT 1) AS `lastmod` FROM `posts_%s` WHERE `thread` IS NULL", $board, $board)) or error(db_error()); + $query = query(sprintf("SELECT `id` AS `thread_id`, (SELECT `time` FROM ``posts_%s`` WHERE `thread` = `thread_id` OR `id` = `thread_id` ORDER BY `time` DESC LIMIT 1) AS `lastmod` FROM ``posts_%s`` WHERE `thread` IS NULL", $board, $board)) or error(db_error()); $threads[$board] = $query->fetchAll(PDO::FETCH_ASSOC); } -- cgit v1.3 From 05fb4cbca4f93ea55d55da3b2e3a7f2f5a174b21 Mon Sep 17 00:00:00 2001 From: czaks Date: Wed, 31 Jul 2013 20:33:27 -0400 Subject: markup modifiers: there was a plan for adding markup to ban reasons, but assignment was missing; escape markup there too --- inc/mod/ban.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'inc/mod') diff --git a/inc/mod/ban.php b/inc/mod/ban.php index 9166223f..45973ae6 100644 --- a/inc/mod/ban.php +++ b/inc/mod/ban.php @@ -61,7 +61,8 @@ function ban($mask, $reason, $length, $board) { $query->bindValue(':mod', $mod['id']); $query->bindValue(':time', time()); if ($reason !== '') { - markup($reason); + $reason = escape_markup_modifiers($reason); + $reason = markup($reason); $query->bindValue(':reason', $reason); } else $query->bindValue(':reason', null, PDO::PARAM_NULL); -- cgit v1.3 From bc76d934fe30c9a6fcea27678dc155e903eb88c3 Mon Sep 17 00:00:00 2001 From: czaks Date: Wed, 31 Jul 2013 20:41:56 -0400 Subject: fix previous commit; markup is called via reference --- inc/mod/ban.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'inc/mod') diff --git a/inc/mod/ban.php b/inc/mod/ban.php index 45973ae6..71173326 100644 --- a/inc/mod/ban.php +++ b/inc/mod/ban.php @@ -62,7 +62,7 @@ function ban($mask, $reason, $length, $board) { $query->bindValue(':time', time()); if ($reason !== '') { $reason = escape_markup_modifiers($reason); - $reason = markup($reason); + markup($reason); $query->bindValue(':reason', $reason); } else $query->bindValue(':reason', null, PDO::PARAM_NULL); -- cgit v1.3 From 5a44c50811ba9a927add4d54604307692492df8a Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Thu, 1 Aug 2013 17:18:10 -0400 Subject: Simple file editor replacement for ?/config (optional). Issue #127 --- inc/config.php | 7 +++--- inc/mod/pages.php | 29 ++++++++++++++++++----- templates/mod/config-editor-php.html | 45 ++++++++++++++++++++++++++++++++++++ templates/mod/dashboard.html | 2 +- templates/mod/edit_post_form.html | 2 +- 5 files changed, 74 insertions(+), 11 deletions(-) create mode 100644 templates/mod/config-editor-php.html (limited to 'inc/mod') diff --git a/inc/config.php b/inc/config.php index d82ebfc6..bddb9e4c 100644 --- a/inc/config.php +++ b/inc/config.php @@ -929,6 +929,9 @@ // Automatically dismiss all reports regarding a thread when it is locked $config['mod']['dismiss_reports_on_lock'] = true; + // Replace ?/config with a simple text editor for editing inc/instance-config.php + $config['mod']['config_editor_php'] = false; + // Probably best not to change these: if (!defined('JANITOR')) { define('JANITOR', 0, true); @@ -999,7 +1002,7 @@ // Bypass flood check $config['mod']['flood'] = ADMIN; // Raw HTML posting - $config['mod']['rawhtml'] = DISABLED; + $config['mod']['rawhtml'] = ADMIN; /* Administration */ // View the report queue @@ -1077,8 +1080,6 @@ // Delete news entries $config['mod']['news_delete'] = ADMIN; - // View the current configuration - $config['mod']['show_config'] = ADMIN; // Edit the current configuration (via web interface) $config['mod']['edit_config'] = ADMIN; diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 1e0dc7c9..615e85c7 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -1304,13 +1304,12 @@ function mod_edit_post($board, $edit_raw_html, $postID) { header('Location: ?/' . sprintf($config['board_path'], $board) . $config['dir']['res'] . sprintf($config['file_page'], $post['thread'] ? $post['thread'] : $postID) . '#' . $postID, true, $config['redirect_http']); } else { if ($config['minify_html']) { - // $post['body_nomarkup'] = str_replace("\n", ' ', $post['body_nomarkup']); - // $post['body'] = str_replace("\n", ' ', $post['body']); + $post['body_nomarkup'] = str_replace("\n", ' ', utf8tohtml($post['body_nomarkup'])); + $post['body'] = str_replace("\n", ' ', utf8tohtml($post['body'])); + $post['body_nomarkup'] = str_replace("\r", '', $post['body_nomarkup']); + $post['body'] = str_replace("\r", '', $post['body']); } - - // Minifying this page causes an issue with newlines in the textarea. This is a temporary solution. - $config['minify_html'] = false; - + mod_page(_('Edit post'), 'mod/edit_post_form.html', array('token' => $security_token, 'board' => $board, 'raw' => $edit_raw_html, 'post' => $post)); } } @@ -1948,6 +1947,24 @@ function mod_config() { if (!hasPermission($config['mod']['edit_config'])) error($config['error']['noaccess']); + if ($config['mod']['config_editor_php']) { + $readonly = !is_writable('inc/instance-config.php'); + + if (!$readonly && isset($_POST['code'])) { + $code = $_POST['code']; + file_put_contents('inc/instance-config.php', $code); + header('Location: ?/config', true, $config['redirect_http']); + return; + } + + $instance_config = file_get_contents('inc/instance-config.php'); + $instance_config = str_replace("\n", ' ', utf8tohtml($instance_config)); + + mod_page(_('Config editor'), 'mod/config-editor-php.html', array('php' => $instance_config, 'readonly' => $readonly)); + return; + } + + require_once 'inc/mod/config-editor.php'; $conf = config_vars(); diff --git a/templates/mod/config-editor-php.html b/templates/mod/config-editor-php.html new file mode 100644 index 00000000..54c398e4 --- /dev/null +++ b/templates/mod/config-editor-php.html @@ -0,0 +1,45 @@ +{% if readonly %} +

    Tinyboard does not have the required permissions to edit inc/instance-config.php. To make changes, you will need to change the file's permissions first or manually edit the code.

    +{% endif %} + + +{% if not readonly %}
    {% endif %} + + +
      +
      • +
    +{% if not readonly %}
    {% endif %} + + \ No newline at end of file diff --git a/templates/mod/dashboard.html b/templates/mod/dashboard.html index 5f6585fc..e9fb7c9c 100644 --- a/templates/mod/dashboard.html +++ b/templates/mod/dashboard.html @@ -94,7 +94,7 @@ {% if mod|hasPermission(config.mod.rebuild) %}
  • {% trans 'Rebuild' %}
    • {% endif %} - {% if mod|hasPermission(config.mod.show_config) %} + {% if mod|hasPermission(config.mod.edit_config) %}
  • {% trans 'Configuration' %}
    • {% endif %} diff --git a/templates/mod/edit_post_form.html b/templates/mod/edit_post_form.html index b9359c68..a2980d35 100644 --- a/templates/mod/edit_post_form.html +++ b/templates/mod/edit_post_form.html @@ -32,7 +32,7 @@ {% trans %}Comment{% endtrans %} - + -- cgit v1.3 From ea1fe528a44d066e82d1bbb07f6ecefc52ec4e18 Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Sat, 3 Aug 2013 02:06:58 -0400 Subject: Fix ordering of notes and bans --- inc/mod/pages.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'inc/mod') diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 615e85c7..5b74cc1c 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -800,21 +800,21 @@ function mod_page_ip($ip) { $args['token'] = make_secure_link_token('ban'); if (hasPermission($config['mod']['view_ban'])) { - $query = prepare("SELECT ``bans``.*, `username` FROM ``bans`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `ip` = :ip"); + $query = prepare("SELECT ``bans``.*, `username` FROM ``bans`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `ip` = :ip ORDER BY `set` DESC"); $query->bindValue(':ip', $ip); $query->execute() or error(db_error($query)); $args['bans'] = $query->fetchAll(PDO::FETCH_ASSOC); } if (hasPermission($config['mod']['view_notes'])) { - $query = prepare("SELECT ``ip_notes``.*, `username` FROM ``ip_notes`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `ip` = :ip"); + $query = prepare("SELECT ``ip_notes``.*, `username` FROM ``ip_notes`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `ip` = :ip ORDER BY `time` DESC"); $query->bindValue(':ip', $ip); $query->execute() or error(db_error($query)); $args['notes'] = $query->fetchAll(PDO::FETCH_ASSOC); } if (hasPermission($config['mod']['modlog_ip'])) { - $query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM ``modlogs`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `text` LIKE :search ORDER BY `time` DESC LIMIT 20"); + $query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM ``modlogs`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `text` LIKE :search ORDER BY `time` DESC LIMIT 50"); $query->bindValue(':search', '%' . $ip . '%'); $query->execute() or error(db_error($query)); $args['logs'] = $query->fetchAll(PDO::FETCH_ASSOC); -- cgit v1.3 From c9684fc0001ceaa521e80a50d353ecbfe3fafe9b Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Sat, 3 Aug 2013 05:21:02 -0400 Subject: Better/working web config editor --- inc/config.php | 9 ++++++--- inc/functions.php | 2 +- inc/mod/config-editor.php | 47 ++++++++++++++++++++++++++++++++++------------- inc/mod/pages.php | 2 +- 4 files changed, 42 insertions(+), 18 deletions(-) (limited to 'inc/mod') diff --git a/inc/config.php b/inc/config.php index 8d1c05d7..2c164ef5 100644 --- a/inc/config.php +++ b/inc/config.php @@ -355,8 +355,9 @@ // Always act as if the user had typed "noko" into the email field. $config['always_noko'] = false; - // Custom tripcodes. The below example makes a tripcode of "#test123" evaluate to "!HelloWorld". + // Example: Custom tripcodes. The below example makes a tripcode of "#test123" evaluate to "!HelloWorld". // $config['custom_tripcode']['#test123'] = '!HelloWorld'; + // Example: Custom secure tripcode. // $config['custom_tripcode']['##securetrip'] = '!!somethingelse'; // Allow users to mark their image as a "spoiler" when posting. The thumbnail will be replaced with a @@ -523,6 +524,7 @@ // Thumbnail to use for the non-image file uploads. $config['file_icons']['default'] = 'file.png'; $config['file_icons']['zip'] = 'zip.png'; + // Example: Custom thumbnail for certain file extension. // $config['file_icons']['extension'] = 'some_file.png'; // Location of above images. @@ -1199,7 +1201,8 @@ // array('127.0.0.1', 80) // array('127.0.0.1', 80, 'example.org') // ); - // Connection timeout, in seconds. + + // Connection timeout for $config['purge'], in seconds. $config['purge_timeout'] = 3; // Additional mod.php?/ pages. Look in inc/mod/pages.php for help. @@ -1210,7 +1213,7 @@ // // ... // }; - // Add links to dashboard (will all be in a new "Other" category). + // Example: Add links to dashboard (will all be in a new "Other" category). // $config['mod']['dashboard_links']['Something'] = '?/something'; // Remote servers. I'm not even sure if this code works anymore. It might. Haven't tried it in a while. diff --git a/inc/functions.php b/inc/functions.php index 4ca98dd6..dc814a2f 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -157,7 +157,7 @@ function loadConfig() { if ($config['verbose_errors']) { set_error_handler('verbose_error_handler'); error_reporting(E_ALL); - ini_set('display_errors', false); + ini_set('display_errors', true); ini_set('html_errors', false); } diff --git a/inc/mod/config-editor.php b/inc/mod/config-editor.php index 484bd908..d6cad8f0 100644 --- a/inc/mod/config-editor.php +++ b/inc/mod/config-editor.php @@ -13,13 +13,14 @@ function config_vars() { 'default_temp' => false ); $temp_comment = false; + $line_no = 0; foreach ($config_file as $line) { if ($temp_comment) { $var['comment'][] = $temp_comment; $temp_comment = false; } - if (preg_match('!^\s*// (.*)$!', $line, $matches)) { + if (preg_match('!^\s*// ([^$].*)$!', $line, $matches)) { if ($var['default'] !== false) { $line = ''; $temp_comment = $matches[1]; @@ -28,7 +29,10 @@ function config_vars() { } } else if ($var['default_temp'] !== false) { $var['default_temp'] .= "\n" . $line; - } elseif (preg_match('!^\s*\$config\[(.+?)\] = (.+?)(;( //.+)?)?$!', $line, $matches)) { + } elseif (preg_match('!^[\s/]*\$config\[(.+?)\] = (.+?)(;( //.+)?)?$!', $line, $matches)) { + if (preg_match('!^\s*//\s*!', $line)) { + $var['commented'] = true; + } $var['name'] = explode('][', $matches[1]); if (count($var['name']) == 1) { $var['name'] = preg_replace('/^\'(.*)\'$/', '$1', end($var['name'])); @@ -43,20 +47,30 @@ function config_vars() { $var['default_temp'] = $matches[2]; } - if (trim($line) === '') { - if ($var['name'] !== false) { - if ($var['default_temp']) - $var['default'] = $var['default_temp']; - - $temp = eval('return ' . $var['default'] . ';'); - if (!isset($temp)) + if ($var['name'] !== false) { + if ($var['default_temp']) + $var['default'] = $var['default_temp']; + if ($var['default'][0] == '&') + continue; // This is just an alias. + if (!preg_match('/^array|\[\]|function/', $var['default']) && !preg_match('/^Example: /', trim(implode(' ', $var['comment'])))) { + $syntax_error = true; + $temp = eval('$syntax_error = false;return ' . $var['default'] . ';'); + if ($syntax_error && $temp === false) { + error('Error parsing config.php (line ' . $line_no . ')!', null, $var); + } elseif (!isset($temp)) { $var['type'] = 'unknown'; - else + } else { $var['type'] = gettype($temp); - + } unset($var['default_temp']); - if (!is_array($var['name']) || (end($var['name']) != '' && !in_array(reset($var['name']), array('stylesheets')))) { + $already_exists = false; + foreach ($conf as $_var) { + if ($var['name'] == $_var['name']) + $already_exists = true; + + } + if (!$already_exists) $conf[] = $var; } } @@ -65,9 +79,16 @@ function config_vars() { 'name' => false, 'comment' => array(), 'default' => false, - 'default_temp' => false + 'default_temp' => false, + 'commented' => false ); } + + if (trim($line) === '') { + $var['comment'] = array(); + } + + $line_no++; } return $conf; diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 5b74cc1c..6c46a84f 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -1975,7 +1975,7 @@ function mod_config() { foreach ($var['name'] as $n) $c = &$c[$n]; } else { - $c = $config[$var['name']]; + $c = @$config[$var['name']]; } $var['value'] = $c; -- cgit v1.3 From 0d1bfa47f1f459b4893426e752ce2d3e9b2de030 Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Sat, 3 Aug 2013 05:41:01 -0400 Subject: Web config editor: Write "MOD", "JANITOR", etc. to instance-config instead of just int representations --- inc/mod/config-editor.php | 10 +++++++++- inc/mod/pages.php | 15 ++++++++++++++- templates/mod/config-editor.html | 2 +- 3 files changed, 24 insertions(+), 3 deletions(-) (limited to 'inc/mod') diff --git a/inc/mod/config-editor.php b/inc/mod/config-editor.php index d6cad8f0..caca5a0e 100644 --- a/inc/mod/config-editor.php +++ b/inc/mod/config-editor.php @@ -62,6 +62,13 @@ function config_vars() { } else { $var['type'] = gettype($temp); } + + if ($var['type'] == 'integer' && $var['name'][0] == 'mod' && + (in_array($var['default'], array('JANITOR', 'MOD', 'ADMIN', 'DISABLED')) || mb_strpos($var['default'], "\$config['mod']") === 0)) { + // Permissions variable + $var['permissions'] = true; + } + unset($var['default_temp']); if (!is_array($var['name']) || (end($var['name']) != '' && !in_array(reset($var['name']), array('stylesheets')))) { $already_exists = false; @@ -80,7 +87,8 @@ function config_vars() { 'comment' => array(), 'default' => false, 'default_temp' => false, - 'commented' => false + 'commented' => false, + 'permissions' => false, ); } diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 6c46a84f..13520871 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -2010,7 +2010,20 @@ function mod_config() { $config_append .= '[' . var_export($var['name'], true) . ']'; } - $config_append .= ' = ' . var_export($value, true) . ";\n"; + + $config_append .= ' = '; + if ($var['permissions'] && in_array($value, array(JANITOR, MOD, ADMIN, DISABLED))) { + $perm_array = array( + JANITOR => 'JANITOR', + MOD => 'MOD', + ADMIN => 'ADMIN', + DISABLED => 'DISABLED' + ); + $config_append .= $perm_array[$value]; + } else { + $config_append .= var_export($value, true); + } + $config_append .= ";\n"; } } diff --git a/templates/mod/config-editor.html b/templates/mod/config-editor.html index 41e01dad..d333e9a2 100644 --- a/templates/mod/config-editor.html +++ b/templates/mod/config-editor.html @@ -25,7 +25,7 @@ {% if var.type == 'string' %} - {% elseif var.type == 'integer' and var.name.0 == 'mod' and (var.default in ['JANITOR', 'MOD', 'ADMIN', 'DISABLED'] or var.default|slice(0, 14) == "$config['mod']") and var.value <= constant('DISABLED') %} + {% elseif var.permissions %} '; echo Element('page.html', $page); @@ -2048,12 +2062,18 @@ function mod_config() { } } - header('Location: ?/', true, $config['redirect_http']); + header('Location: ?/config', true, $config['redirect_http']); exit; } - mod_page(_('Config editor'), 'mod/config-editor.html', array('conf' => $conf)); + mod_page(_('Config editor') . ($board_config ? ': ' . sprintf($config['board_abbreviation'], $board_config) : ''), + 'mod/config-editor.html', array( + 'boards' => listBoards(), + 'board' => $board_config, + 'conf' => $conf, + 'file' => $config_file + )); } function mod_themes_list() { diff --git a/mod.php b/mod.php index ee05c349..742eeefb 100644 --- a/mod.php +++ b/mod.php @@ -21,64 +21,65 @@ if (get_magic_quotes_gpc()) { $query = isset($_SERVER['QUERY_STRING']) ? urldecode($_SERVER['QUERY_STRING']) : ''; $pages = array( - '' => ':?/', // redirect to dashboard - '/' => 'dashboard', // dashboard + '' => ':?/', // redirect to dashboard + '/' => 'dashboard', // dashboard '/confirm/(.+)' => 'confirm', // confirm action (if javascript didn't work) - '/logout' => 'logout', // logout + '/logout' => 'logout', // logout - '/users' => 'users', // manage users - '/users/(\d+)' => 'user', // edit user - '/users/(\d+)/(promote|demote)' => 'user_promote', // prmote/demote user + '/users' => 'users', // manage users + '/users/(\d+)' => 'user', // edit user + '/users/(\d+)/(promote|demote)' => 'user_promote', // prmote/demote user '/users/new' => 'user_new', // create a new user '/new_PM/([^/]+)' => 'new_pm', // create a new pm - '/PM/(\d+)(/reply)?' => 'pm', // read a pm - '/inbox' => 'inbox', // pm inbox + '/PM/(\d+)(/reply)?' => 'pm', // read a pm + '/inbox' => 'inbox', // pm inbox '/noticeboard' => 'noticeboard', // view noticeboard - '/noticeboard/(\d+)' => 'noticeboard', // view noticeboard - '/noticeboard/delete/(\d+)' => 'noticeboard_delete',// delete from noticeboard - '/log' => 'log', // modlog - '/log/(\d+)' => 'log', // modlog + '/noticeboard/(\d+)' => 'noticeboard', // view noticeboard + '/noticeboard/delete/(\d+)' => 'noticeboard_delete', // delete from noticeboard + '/log' => 'log', // modlog + '/log/(\d+)' => 'log', // modlog '/log:([^/]+)' => 'user_log', // modlog - '/log:([^/]+)/(\d+)' => 'user_log', // modlog - '/news' => 'news', // view news - '/news/(\d+)' => 'news', // view news - '/news/delete/(\d+)' => 'news_delete', // delete from news + '/log:([^/]+)/(\d+)' => 'user_log', // modlog + '/news' => 'news', // view news + '/news/(\d+)' => 'news', // view news + '/news/delete/(\d+)' => 'news_delete', // delete from news '/edit/(\%b)' => 'edit_board', // edit board details '/new-board' => 'new_board', // create a new board - '/rebuild' => 'rebuild', // rebuild static files - '/reports' => 'reports', // report queue - '/reports/(\d+)/dismiss(all)?' => 'report_dismiss', // dismiss a report + '/rebuild' => 'rebuild', // rebuild static files + '/reports' => 'reports', // report queue + '/reports/(\d+)/dismiss(all)?' => 'report_dismiss', // dismiss a report - '/IP/([\w.:]+)' => 'ip', // view ip address + '/IP/([\w.:]+)' => 'ip', // view ip address '/IP/([\w.:]+)/remove_note/(\d+)' => 'ip_remove_note', // remove note from ip address - '/bans' => 'bans', // ban list - '/bans/(\d+)' => 'bans', // ban list + '/bans' => 'bans', // ban list + '/bans/(\d+)' => 'bans', // ban list - '/search' => 'search_redirect', // search + '/search' => 'search_redirect', // search '/search/(posts|IP_notes|bans|log)/(.+)/(\d+)' => 'search', // search - '/search/(posts|IP_notes|bans|log)/(.+)' => 'search', // search + '/search/(posts|IP_notes|bans|log)/(.+)' => 'search', // search // CSRF-protected moderator actions - '/ban' => 'secure_POST ban', // new ban - '/(\%b)/ban(&delete)?/(\d+)' => 'secure_POST ban_post', // ban poster - '/(\%b)/move/(\d+)' => 'secure_POST move', // move thread + '/ban' => 'secure_POST ban', // new ban + '/(\%b)/ban(&delete)?/(\d+)' => 'secure_POST ban_post', // ban poster + '/(\%b)/move/(\d+)' => 'secure_POST move', // move thread '/(\%b)/edit(_raw)?/(\d+)' => 'secure_POST edit_post', // edit post - '/(\%b)/delete/(\d+)' => 'secure delete', // delete post - '/(\%b)/deletefile/(\d+)' => 'secure deletefile', // delete file from post + '/(\%b)/delete/(\d+)' => 'secure delete', // delete post + '/(\%b)/deletefile/(\d+)' => 'secure deletefile', // delete file from post '/(\%b)/deletebyip/(\d+)(/global)?' => 'secure deletebyip', // delete all posts by IP address - '/(\%b)/(un)?lock/(\d+)' => 'secure lock', // lock thread - '/(\%b)/(un)?sticky/(\d+)' => 'secure sticky', // sticky thread - '/(\%b)/bump(un)?lock/(\d+)' => 'secure bumplock', // "bumplock" thread + '/(\%b)/(un)?lock/(\d+)' => 'secure lock', // lock thread + '/(\%b)/(un)?sticky/(\d+)' => 'secure sticky', // sticky thread + '/(\%b)/bump(un)?lock/(\d+)' => 'secure bumplock', // "bumplock" thread - '/themes' => 'themes_list', // manage themes + '/themes' => 'themes_list', // manage themes '/themes/(\w+)' => 'theme_configure', // configure/reconfigure theme - '/themes/(\w+)/rebuild' => 'theme_rebuild', // rebuild theme - '/themes/(\w+)/uninstall' => 'theme_uninstall', // uninstall theme + '/themes/(\w+)/rebuild' => 'theme_rebuild', // rebuild theme + '/themes/(\w+)/uninstall' => 'theme_uninstall', // uninstall theme - '/config' => 'config', // config editor + '/config' => 'config', // config editor + '/config/(\%b)' => 'config', // config editor // these pages aren't listed in the dashboard without $config['debug'] '/debug/antispam' => 'debug_antispam', diff --git a/templates/mod/config-editor-php.html b/templates/mod/config-editor-php.html index 54c398e4..4f76b5dd 100644 --- a/templates/mod/config-editor-php.html +++ b/templates/mod/config-editor-php.html @@ -1,17 +1,35 @@ -{% if readonly %} -

    Tinyboard does not have the required permissions to edit inc/instance-config.php. To make changes, you will need to change the file's permissions first or manually edit the code.

    -{% endif %} - - -{% if not readonly %}
    {% endif %} - +
    +

    + Any changes you make here will simply be appended to {{ file }}. If you wish to make the most of Tinyboard's customizability, you can instead edit the file directly. This page is intended for making quick changes and for those who don't have a basic understanding of PHP code. +

    + {% if boards|count %} + + {% endif %} + + {% if readonly %} +

    Tinyboard does not have the required permissions to edit {{ file }}. To make changes, you will need to change the file's permissions first or manually edit the code.

    + {% endif %} + -
      -
      • -
    -{% if not readonly %}{% endif %} + {% if not readonly %}
    {% endif %} + + +
      +
      • +
    + {% if not readonly %}
    {% endif %} +