diff --git a/checkin_notes b/checkin_notes index da40723399..1097f100f9 100755 --- a/checkin_notes +++ b/checkin_notes @@ -22434,6 +22434,8 @@ David 9 Jan 2005 David 9 Jan 2005 - user profile fixes + - disallow thread titles consisting only of HTML tags html/inc/ + forum.inc profile.inc diff --git a/html/inc/forum.inc b/html/inc/forum.inc index 8f48342d27..16b3260224 100644 --- a/html/inc/forum.inc +++ b/html/inc/forum.inc @@ -332,7 +332,7 @@ function createThread($forumID, $ownerID, $title, $content, $add_signature=false $content = addslashes(sanitize_html(stripslashes($content))); $title = trim($title); - if (strlen($title) == 0) { + if (strlen(strip_tags($title)) == 0) { return 0; } @@ -341,7 +341,7 @@ function createThread($forumID, $ownerID, $title, $content, $add_signature=false if (!$result) return false; $threadID = mysql_insert_id(); - $postID = addPost($threadID, $ownerID, NULL, $content, $add_signature); + addPost($threadID, $ownerID, NULL, $content, $add_signature); $sql = "UPDATE forum_preferences SET posts = posts + 1 WHERE userid = " . $ownerID . " LIMIT 1"; mysql_query($sql); @@ -378,8 +378,6 @@ function addPost($threadID, $userID, $parentID, $content, $add_signature=false) } $result = mysql_query($sql); if (!$result) return false; - //return ($post->id = mysql_insert_id()); - mysql_insert_id(); return true; } diff --git a/html/user/forum_thread.php b/html/user/forum_thread.php index f4c5dd5de4..08751b239f 100644 --- a/html/user/forum_thread.php +++ b/html/user/forum_thread.php @@ -6,9 +6,9 @@ require_once('../inc/util.inc'); db_init(); if (empty($_GET['id'])) { - // TODO: Standard error page - echo "No thread was specified.
"; - exit(); + // TODO: Standard error page + echo "No thread was specified.
"; + exit(); } $_GET['id'] = stripslashes(strip_tags($_GET['id'])); @@ -32,23 +32,23 @@ $logged_in_user = get_logged_in_user(false); $logged_in_user = getForumPreferences($logged_in_user); if ($category->is_helpdesk) { - if (!$sort_style) { - $sort_style = getSortStyle($logged_in_user,"answer"); - } else { - setSortStyle($logged_in_user,"answer", $sort_style); - } - page_head(PROJECT.': Questions and problems : '.$thread->title); + if (!$sort_style) { + $sort_style = getSortStyle($logged_in_user,"answer"); + } else { + setSortStyle($logged_in_user,"answer", $sort_style); + } + page_head(PROJECT.': Questions and problems : '.$thread->title); } else { - if (!$sort_style) { - $sort_style = getSortStyle($logged_in_user,"thread"); - } else { - setSortStyle($logged_in_user,"thread", $sort_style); - } - if ($logged_in_user->jump_to_unread){ - page_head(PROJECT.': Message boards : '.$thread->title, 'jumpToUnread();'); - } else { - page_head(PROJECT.': Message boards : '.$thread->title); - } + if (!$sort_style) { + $sort_style = getSortStyle($logged_in_user,"thread"); + } else { + setSortStyle($logged_in_user,"thread", $sort_style); + } + if ($logged_in_user->jump_to_unread){ + page_head(PROJECT.': Message boards : '.$thread->title, 'jumpToUnread();'); + } else { + page_head(PROJECT.': Message boards : '.$thread->title); + } } // TODO: Constant for default sort style and filter values. @@ -69,34 +69,34 @@ show_forum_title($forum, $thread, $category->is_helpdesk); echo "
- id, "\"> - + id, "\"> +
"; @@ -114,9 +114,9 @@ echo "\n"; echo "\n
"; $link = "id; if ($category->is_helpdesk) { - $link = $link . "&helpdesk=1#input\">Answer this question"; + $link = $link . "&helpdesk=1#input\">Answer this question"; } else { - $link = $link . "#input\">Reply to this thread"; + $link = $link . "#input\">Reply to this thread"; } echo $link, "
"; if ($is_subscribed) { - if ($category->is_helpdesk) { - echo "You are subscribed to this question. "; - } else { - echo "You are subscribed to this thread. "; - } - echo "id\">Click here to unsubscribe."; + if ($category->is_helpdesk) { + echo "You are subscribed to this question. "; + } else { + echo "You are subscribed to this thread. "; + } + echo "id\">Click here to unsubscribe."; } else { - if ($category->is_helpdesk) { - echo "id\">Subscribe to this question"; - } else { - echo "id\">Subscribe to this thread"; - } + if ($category->is_helpdesk) { + echo "id\">Subscribe to this question"; + } else { + echo "id\">Subscribe to this thread"; + } } echo "
\n
\n"; if ($category->is_helpdesk) { - $headings = array("Author", "Question"); + $headings = array("Author", "Question"); } else { - $headings = array("Author", "Message"); + $headings = array("Author", "Message"); } start_forum_table($headings); @@ -127,9 +127,9 @@ echo "

"; $link = "id; if ($category->is_helpdesk) { - $link = $link . "&helpdesk=1#input\">Answer this question"; + $link = $link . "&helpdesk=1#input\">Answer this question"; } else { - $link = $link . "#input\">Reply to this thread"; + $link = $link . "#input\">Reply to this thread"; } echo $link, "
\n

";