From 3d15b591e3f4196846fff005cc800feb383073c7 Mon Sep 17 00:00:00 2001 From: Philip Häusler Date: Mon, 13 Jun 2011 19:34:01 +0200 Subject: cleanup, security sql fixes --- includes/pages/user_messages.php | 150 +++------------------------------------ 1 file changed, 9 insertions(+), 141 deletions(-) (limited to 'includes/pages/user_messages.php') diff --git a/includes/pages/user_messages.php b/includes/pages/user_messages.php index a13b28f0..29b41cae 100644 --- a/includes/pages/user_messages.php +++ b/includes/pages/user_messages.php @@ -6,13 +6,7 @@ function user_unread_messages() { $new_messages = sql_num_query("SELECT * FROM `Messages` WHERE isRead='N' AND `RUID`=" . sql_escape($user['UID'])); if ($new_messages > 0) - return sprintf( - '

%s %s %s

', - page_link_to("user_messages"), - Get_Text("pub_messages_new1"), - $new_messages, - Get_Text("pub_messages_new2") - ); + return sprintf('

%s %s %s

', page_link_to("user_messages"), Get_Text("pub_messages_new1"), $new_messages, Get_Text("pub_messages_new2")); } return ""; @@ -22,8 +16,7 @@ function user_messages() { global $user; if (!isset ($_REQUEST['action'])) { - $users = sql_select("SELECT * FROM `User` WHERE NOT `UID`=" - . sql_escape($user['UID']) . " ORDER BY `Nick`"); + $users = sql_select("SELECT * FROM `User` WHERE NOT `UID`=" . sql_escape($user['UID']) . " ORDER BY `Nick`"); $to_select_data = array ( "" => "Select receiver..." @@ -35,23 +28,11 @@ function user_messages() { $to_select = html_select_key('to', $to_select_data, ''); $messages_html = ""; - $messages = sql_select("SELECT * FROM `Messages` WHERE `SUID`=" - . sql_escape($user['UID']) - . " OR `RUID`=" . sql_escape($user['UID']) - . " ORDER BY `isRead`,`Datum` DESC" - ); + $messages = sql_select("SELECT * FROM `Messages` WHERE `SUID`=" . sql_escape($user['UID']) . " OR `RUID`=" . sql_escape($user['UID']) . " ORDER BY `isRead`,`Datum` DESC"); foreach ($messages as $message) { - $messages_html .= sprintf( - ' %s %s %s %s' - .'%s', - ($message['isRead'] == 'N' ? ' class="new_message"' : ''), - ($message['isRead'] == 'N' ? '•' : ''), - date("Y-m-d H:i", $message['Datum']), - UID2Nick($message['SUID']), - UID2Nick($message['RUID']), - str_replace("\n", '
', $message['Text']) - ); + $messages_html .= sprintf(' %s %s %s %s' . + '%s', ($message['isRead'] == 'N' ? ' class="new_message"' : ''), ($message['isRead'] == 'N' ? '•' : ''), date("Y-m-d H:i", $message['Datum']), UID2Nick($message['SUID']), UID2Nick($message['RUID']), str_replace("\n", '
', $message['Text'])); $messages_html .= ''; if ($message['RUID'] == $user['UID']) { @@ -65,8 +46,7 @@ function user_messages() { return template_render('../templates/user_messages.html', array ( 'link' => page_link_to("user_messages"), - 'greeting' => Get_Text("Hello") . $user['Nick'] . ",
\n" - . Get_Text("pub_messages_text1") . "

\n", + 'greeting' => Get_Text("Hello") . $user['Nick'] . ",
\n" . Get_Text("pub_messages_text1") . "

\n", 'messages' => $messages_html, 'new_label' => Get_Text("pub_messages_Neu"), 'date_label' => Get_Text("pub_messages_Datum"), @@ -118,122 +98,10 @@ function user_messages() { return error(Get_Text("pub_messages_Send_Error")); } break; - } - return ""; - } - - if (!isset ($_GET["action"])) - $_GET["action"] = "start"; - - switch ($_GET["action"]) { - case "start" : - echo Get_Text("Hello") . $_SESSION['Nick'] . ",
\n"; - echo Get_Text("pub_messages_text1") . "

\n"; - - //show exist Messages - $SQL = "SELECT * FROM `Messages` WHERE `SUID`='" . $_SESSION["UID"] . "' OR `RUID`='" . $_SESSION["UID"] . "'"; - $erg = mysql_query($SQL, $con); - - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - - for ($i = 0; $i < mysql_num_rows($erg); $i++) { - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - } - - // send Messeges - echo ""; - echo "\n"; - echo "\n"; - echo "\n"; - - // Listet alle Nicks auf - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo ""; - - echo "
" . Get_Text("pub_messages_Datum") . "" . Get_Text("pub_messages_Von") . "" . Get_Text("pub_messages_An") . "" . Get_Text("pub_messages_Text") . "
" . mysql_result($erg, $i, "Datum") . "" . UID2Nick(mysql_result($erg, $i, "SUID")) . "" . UID2Nick(mysql_result($erg, $i, "RUID")) . "" . mysql_result($erg, $i, "Text") . ""; - - if (mysql_result($erg, $i, "RUID") == $_SESSION["UID"]) { - echo "" . Get_Text("pub_messages_DelMsg") . ""; - - if (mysql_result($erg, $i, "isRead") == "N") - echo "" . Get_Text("pub_messages_MarkRead") . ""; - } else { - if (mysql_result($erg, $i, "isRead") == "N") - echo Get_Text("pub_messages_NotRead"); - } - - echo "
\n"; - break; - - case "SendMsg" : - echo Get_Text("pub_messages_Send1") . "...
\n"; - - $SQL = "INSERT INTO `Messages` ( `Datum` , `SUID` , `RUID` , `Text` ) VALUES (" . - "'" . gmdate("Y-m-j H:i:s", time()) . "', " . - "'" . $_SESSION["UID"] . "', " . - "'" . $_POST["RUID"] . "', " . - "'" . $_POST["Text"] . "');"; - - $Erg = mysql_query($SQL, $con); - - if ($Erg == 1) - echo Get_Text("pub_messages_Send_OK") . "\n"; - else - echo Get_Text("pub_messages_Send_Error") . "...\n(" . mysql_error($con) . ")"; - break; - - case "MarkRead" : - $SQL = "UPDATE `Messages` SET `isRead` = 'Y' " . - "WHERE `Datum` = '" . $_GET["Datum"] . "' AND `RUID`='" . $_SESSION["UID"] . "' " . - "LIMIT 1 ;"; - $Erg = mysql_query($SQL, $con); - - if ($Erg == 1) - echo Get_Text("pub_messages_MarkRead_OK") . "\n"; - else - echo Get_Text("pub_messages_MarkRead_KO") . "...\n(" . mysql_error($con) . ")"; - break; - - case "DelMsg" : - $SQL = "DELETE FROM `Messages` " . - "WHERE `Datum` = '" . $_GET["Datum"] . "' AND `RUID` ='" . $_SESSION["UID"] . "' " . - "LIMIT 1;"; - $Erg = mysql_query($SQL, $con); - - if ($Erg == 1) - echo Get_Text("pub_messages_DelMsg_OK") . "\n"; - else - echo Get_Text("pub_messages_DelMsg_KO") . "...\n(" . mysql_error($con) . ")"; - break; - - default : - echo Get_Text("pub_messages_NoCommand"); + default : + return error("Wrong action."); + } } } ?> -- cgit v1.2.3-54-g00ecf