From 1437a121f759731db35ea8c35c7f2ebbb2a42f5d Mon Sep 17 00:00:00 2001 From: Michael Save Date: Sat, 14 Apr 2012 03:43:04 +1000 Subject: typo --- post.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'post.php') diff --git a/post.php b/post.php index 1f13d27a..7deb5c71 100644 --- a/post.php +++ b/post.php @@ -572,7 +572,7 @@ if (isset($_POST['delete'])) { if ($config['syslog']) _syslog(LOG_INFO, 'New post: /' . $board['dir'] . $config['dir']['res'] . - sprintf($config['file_page'], $post['op'] ? $id : $post['thread']) . (!$$post['op'] ? '#' . $id : '')); + sprintf($config['file_page'], $post['op'] ? $id : $post['thread']) . (!$post['op'] ? '#' . $id : '')); rebuildThemes('post'); header('Location: ' . $redirect, true, $config['redirect_http']); -- cgit v1.3 From df97c559bd0cd046448f4b9489ab915bff646a53 Mon Sep 17 00:00:00 2001 From: Michael Save Date: Fri, 20 Apr 2012 19:04:37 +1000 Subject: Bugfix: non-image file uploading --- post.php | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'post.php') diff --git a/post.php b/post.php index 7deb5c71..e4eadffb 100644 --- a/post.php +++ b/post.php @@ -469,13 +469,11 @@ if (isset($_POST['delete'])) { if ($config['redraw_image']) { $image->to($post['file']); } else { - if (!@move_uploaded_file($_FILES['file']['tmp_name'], $post['file'])) - error($config['error']['nomove']); + $dont_copy_file = true; } $image->destroy(); } else { // not an image - //copy($config['file_thumb'], $post['thumb']); $post['thumb'] = 'file'; @@ -483,6 +481,11 @@ if (isset($_POST['delete'])) { $post['thumbwidth'] = $size[0]; $post['thumbheight'] = $size[1]; } + + if (!isset($dont_copy_file) || !$dont_copy_file) { + if (!@move_uploaded_file($_FILES['file']['tmp_name'], $post['file'])) + error($config['error']['nomove']); + } } if ($post['has_file'] && $config['image_reject_repost'] && $p = getPostByHash($post['filehash'])) { -- cgit v1.3 From 9286ec4928e26097031eb98c34a172ece68c273b Mon Sep 17 00:00:00 2001 From: Michael Save Date: Fri, 20 Apr 2012 19:47:25 +1000 Subject: Bugfix: with file uploading (introduced with last commit) --- post.php | 1 - 1 file changed, 1 deletion(-) (limited to 'post.php') diff --git a/post.php b/post.php index e4eadffb..b4a256a5 100644 --- a/post.php +++ b/post.php @@ -468,7 +468,6 @@ if (isset($_POST['delete'])) { if ($config['redraw_image']) { $image->to($post['file']); - } else { $dont_copy_file = true; } $image->destroy(); -- cgit v1.3 From b5c7e3060908efd822f696286f8c35d415fa59ec Mon Sep 17 00:00:00 2001 From: Michael Save Date: Fri, 20 Apr 2012 19:04:37 +1000 Subject: Bugfix: non-image file uploading --- post.php | 1 + 1 file changed, 1 insertion(+) (limited to 'post.php') diff --git a/post.php b/post.php index b4a256a5..e4eadffb 100644 --- a/post.php +++ b/post.php @@ -468,6 +468,7 @@ if (isset($_POST['delete'])) { if ($config['redraw_image']) { $image->to($post['file']); + } else { $dont_copy_file = true; } $image->destroy(); -- cgit v1.3 From 2082fcde2485e36f650515370740db2741fe5c7b Mon Sep 17 00:00:00 2001 From: Michael Save Date: Fri, 20 Apr 2012 19:47:25 +1000 Subject: Bugfix: with file uploading (introduced with last commit) --- post.php | 1 - 1 file changed, 1 deletion(-) (limited to 'post.php') diff --git a/post.php b/post.php index e4eadffb..b4a256a5 100644 --- a/post.php +++ b/post.php @@ -468,7 +468,6 @@ if (isset($_POST['delete'])) { if ($config['redraw_image']) { $image->to($post['file']); - } else { $dont_copy_file = true; } $image->destroy(); -- cgit v1.3 From 890b541191286a7ce0d62df86fef37cf86abb1a8 Mon Sep 17 00:00:00 2001 From: Michael Save Date: Mon, 7 May 2012 18:22:20 +1000 Subject: custom capcode permissions --- inc/config.php | 15 ++++++++++++++- post.php | 22 ++++++++++++++++------ 2 files changed, 30 insertions(+), 7 deletions(-) (limited to 'post.php') diff --git a/inc/config.php b/inc/config.php index baa1d022..9efc4b02 100644 --- a/inc/config.php +++ b/inc/config.php @@ -870,7 +870,20 @@ * Mod permissions * ==================== */ - + + // Capcode permissions + $config['mod']['capcode'] = array( + // JANITOR => array('Janitor'), + MOD => array('Mod'), + ADMIN => true + ); + + // Example: Allow mods to post with "## Moderator" as well + // $config['mod']['capcode'][MOD][] = 'Moderator'; + + // Example: Allow janitors to post with any capcode + // $config['mod']['capcode'][JANITOR] = true; + // Set any of the below to "DISABLED" to make them unavailable for everyone. // Don't worry about per-board moderators. Let all mods moderate any board. diff --git a/post.php b/post.php index b4a256a5..11465a6e 100644 --- a/post.php +++ b/post.php @@ -310,13 +310,23 @@ if (isset($_POST['delete'])) { ))); } - if ($mod && $mod['type'] >= MOD && preg_match('/^((.+) )?## (.+)$/', $post['name'], $match)) { - if (($mod['type'] == MOD && $match[3] == 'Mod') || $mod['type'] >= ADMIN) { - $post['capcode'] = utf8tohtml($match[3]); - $post['name'] = $match[2] != '' ? $match[2] : $config['anonymous']; + + $post['capcode'] = false; + + if ($mod && preg_match('/^((.+) )?## (.+)$/', $post['name'], $matches)) { + $name = $matches[2] != '' ? $matches[2] : $config['anonymous']; + $cap = $matches[3]; + + if (isset($config['mod']['capcode'][$mod['type']])) { + if ( $config['mod']['capcode'][$mod['type']] === true || + (is_array($config['mod']['capcode'][$mod['type']]) && + in_array($cap, $config['mod']['capcode'][$mod['type']]) + )) { + + $post['capcode'] = utf8tohtml($cap); + $post['name'] = $name; + } } - } else { - $post['capcode'] = false; } $trip = generate_tripcode($post['name']); -- cgit v1.3 From 9058d202ed15133d40936a1e43bf34e4049c1be1 Mon Sep 17 00:00:00 2001 From: Michael Save Date: Mon, 7 May 2012 23:51:15 +1000 Subject: Bugfix: the number of successful passes for an anti-spam "hash" was often incorrectly incremented --- inc/anti-bot.php | 18 ++++++++++-------- post.php | 11 +++++++++-- 2 files changed, 19 insertions(+), 10 deletions(-) (limited to 'post.php') diff --git a/inc/anti-bot.php b/inc/anti-bot.php index 9e3ffeb2..81afca1b 100644 --- a/inc/anti-bot.php +++ b/inc/anti-bot.php @@ -243,22 +243,24 @@ function checkSpam(array $extra_salt = array()) { if ($hash != $_hash) return true; - $query = prepare('UPDATE `antispam` SET `passed` = `passed` + 1 WHERE `hash` = :hash'); + $query = prepare('SELECT `passed` FROM `antispam` WHERE `hash` = :hash'); $query->bindValue(':hash', $hash); $query->execute() or error(db_error($query)); - if ($query->rowCount() == 0) { + if (($passed = $query->fetchColumn(0)) === false) { // there was no database entry for this hash. most likely expired. return true; } - $query = prepare('SELECT `passed` FROM `antispam` WHERE `hash` = :hash'); - $query->bindValue(':hash', $hash); - $query->execute() or error(db_error($query)); - $passed = $query->fetchColumn(0); - if ($passed > $config['spam']['hidden_inputs_max_pass']) return true; - return false; + return $hash; } +function incrementSpamHash($hash) { + $query = prepare('UPDATE `antispam` SET `passed` = `passed` + 1 WHERE `hash` = :hash'); + $query->bindValue(':hash', $hash); + $query->execute() or error(db_error($query)); +} + + diff --git a/post.php b/post.php index 11465a6e..2cbe5235 100644 --- a/post.php +++ b/post.php @@ -212,8 +212,11 @@ if (isset($_POST['delete'])) { error($config['error']['noaccess']); } - if (!$post['mod'] && checkSpam(array($board['uri'], isset($post['thread']) && !($config['quick_reply'] && isset($_POST['quick-reply'])) ? $post['thread'] : null))) - error($config['error']['spam']); + if (!$post['mod']) { + $post['antispam_hash'] = checkSpam(array($board['uri'], isset($post['thread']) && !($config['quick_reply'] && isset($_POST['quick-reply'])) ? $post['thread'] : null)); + if ($post['antispam_hash'] === true) + error($config['error']['spam']); + } if ($config['robot_enable'] && $config['robot_mute']) { checkMute(); @@ -536,6 +539,10 @@ if (isset($_POST['delete'])) { $id = post($post); + if (isset($post['antispam_hash'])) { + incrementSpamHash($post['antispam_hash']); + } + if (isset($post['tracked_cites'])) { foreach ($post['tracked_cites'] as $cite) { $query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)'); -- cgit v1.3 From 6775eebcfa36118dc3a2f131d00a84a8ff3c84ba Mon Sep 17 00:00:00 2001 From: Michael Save Date: Sun, 27 May 2012 20:55:56 +1000 Subject: $post['id'] --- post.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'post.php') diff --git a/post.php b/post.php index 2cbe5235..2449cf02 100644 --- a/post.php +++ b/post.php @@ -537,7 +537,7 @@ if (isset($_POST['delete'])) { } $post = (array)$post; - $id = post($post); + $post['id'] = $id = post($post); if (isset($post['antispam_hash'])) { incrementSpamHash($post['antispam_hash']); -- cgit v1.3 From c919e7362542117f613c2800017ae89c269a07b5 Mon Sep 17 00:00:00 2001 From: Michael Save Date: Mon, 27 Aug 2012 02:18:31 +1000 Subject: Temporary bugfix for incorrectly escaped email field --- post.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'post.php') diff --git a/post.php b/post.php index 2449cf02..11bb5390 100644 --- a/post.php +++ b/post.php @@ -281,7 +281,7 @@ if (isset($_POST['delete'])) { $post['name'] = $_POST['name'] != '' ? $_POST['name'] : $config['anonymous']; $post['subject'] = $_POST['subject']; - $post['email'] = utf8tohtml($_POST['email']); + $post['email'] = str_replace(' ', '%20', htmlspecialchars($_POST['email'])); $post['body'] = $_POST['body']; $post['password'] = $_POST['password']; $post['has_file'] = !isset($post['embed']) && (($post['op'] && !isset($post['no_longer_require_an_image_for_op']) && $config['force_image_op']) || (isset($_FILES['file']) && $_FILES['file']['tmp_name'] != '')); -- cgit v1.3