makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-28 22:28:51 +00:00
Code Issues Projects Releases Packages Wiki Activity

check for permission when quoting post in pm (found by kellanved)

Browse source 
git-svn-id: file:///svn/phpbb/trunk@7205 89ea8834-ac86-4346-8a33-228a782c2dd0
This commit is contained in:
Meik Sievertsen 2007-03-17 19:52:39 +00:00
parent c149162962
commit 09e2b89917
1 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
phpBB/includes/ucp/ucp_pm_compose.php
View file

@ -125,7 +125,7 @@ function compose_pm($id, $mode, $action)
if ($action == 'quotepost') if ($action == 'quotepost')
{ {
$sql = 'SELECT p.post_id as msg_id, p.post_text as message_text, p.poster_id as author_id, p.post_time as message_time, p.bbcode_bitfield, p.bbcode_uid, p.enable_sig, p.enable_smilies, p.enable_magic_url, t.topic_title as message_subject, u.username as quote_username $sql = 'SELECT p.post_id as msg_id, p.forum_id, p.post_text as message_text, p.poster_id as author_id, p.post_time as message_time, p.bbcode_bitfield, p.bbcode_uid, p.enable_sig, p.enable_smilies, p.enable_magic_url, t.topic_title as message_subject, u.username as quote_username
FROM ' . POSTS_TABLE . ' p, ' . TOPICS_TABLE . ' t, ' . USERS_TABLE . " u FROM ' . POSTS_TABLE . ' p, ' . TOPICS_TABLE . ' t, ' . USERS_TABLE . " u
WHERE p.post_id = $msg_id WHERE p.post_id = $msg_id
AND t.topic_id = p.topic_id AND t.topic_id = p.topic_id
@ -203,6 +203,14 @@ function compose_pm($id, $mode, $action)
trigger_error('NO_MESSAGE'); trigger_error('NO_MESSAGE');
} }
if ($action == 'quotepost')
{
if (($post['forum_id'] && !$auth->acl_get('f_read', $post['forum_id'])) || (!$post['forum_id'] && !$auth->acl_getf_global('f_read')))
{
trigger_error('NOT_AUTHORIZED');
}
}
$msg_id = (int) $post['msg_id']; $msg_id = (int) $post['msg_id'];
$folder_id = (isset($post['folder_id'])) ? $post['folder_id'] : 0; $folder_id = (isset($post['folder_id'])) ? $post['folder_id'] : 0;
$message_text = (isset($post['message_text'])) ? $post['message_text'] : ''; $message_text = (isset($post['message_text'])) ? $post['message_text'] : '';