diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php index 496e327e87..ea251c47a8 100644 --- a/phpBB/includes/functions.php +++ b/phpBB/includes/functions.php @@ -19,16 +19,6 @@ * ***************************************************************************/ -function sql_escape($msg) -{ - return str_replace("'", "''", str_replace('\\', '\\\\', $msg)); -} - -function sql_quote($msg) -{ - return str_replace("\'", "''", $msg); -} - function set_config($config_name, $config_value) { global $db, $cache, $config; @@ -36,16 +26,17 @@ function set_config($config_name, $config_value) if (isset($config[$config_name])) { $sql = 'UPDATE ' . CONFIG_TABLE . " - SET config_value = '" . sql_escape($config_value) . "' - WHERE config_name = '$config_name'"; + SET config_value = '" . $db->sql_escape($config_value) . "' + WHERE config_name = '$config_name'"; $db->sql_query($sql); } else { - $db->sql_query('DELETE FROM ' . CONFIG_TABLE . ' WHERE config_name = "' . $config_name . '"'); + $db->sql_query('DELETE FROM ' . CONFIG_TABLE . ' + WHERE config_name = "' . $config_name . '"'); $sql = 'INSERT INTO ' . CONFIG_TABLE . " (config_name, config_value) - VALUES ('$config_name', '" . sql_escape($config_value) . "'"; + VALUES ('$config_name', '" . $db->sql_escape($config_value) . "'"; $db->sql_query($sql); } @@ -61,7 +52,7 @@ function get_userdata($user) $sql = "SELECT * FROM " . USERS_TABLE . " WHERE "; - $sql .= ((is_int($user)) ? "user_id = $user" : "username = '" . sql_quote($user) . "'") . " AND user_id <> " . ANONYMOUS; + $sql .= ((is_int($user)) ? "user_id = $user" : "username = '" . $db->sql_escape($user) . "'") . " AND user_id <> " . ANONYMOUS; $result = $db->sql_query($sql); return ($row = $db->sql_fetchrow($result)) ? $row : false; @@ -130,7 +121,7 @@ function generate_forum_nav(&$forum_data) } $sql = 'UPDATE ' . FORUMS_TABLE . " - SET forum_parents = '" . sql_escape(serialize($forum_parents)) . "' + SET forum_parents = '" . $db->sql_escape(serialize($forum_parents)) . "' WHERE parent_id = " . $forum_data['parent_id']; $db->sql_query($sql); } @@ -669,14 +660,13 @@ function on_page($num_items, $per_page, $start) // Obtain list of naughty words and build preg style replacement arrays for use by the // calling script, note that the vars are passed as references this just makes it easier // to return both sets of arrays -function obtain_word_list(&$orig_word, &$replacement_word) +function obtain_word_list(&$censors) { global $db, $cache; + if ($cache->exists('word_censors')) { - $words = $cache->get('word_censors'); - $orig_word = $words['orig']; - $replacement_word = $words['replacement']; + $censors = $cache->get('word_censors'); // transfer to just if (!(...)) ? works fine for me } else { @@ -684,19 +674,52 @@ function obtain_word_list(&$orig_word, &$replacement_word) FROM " . WORDS_TABLE; $result = $db->sql_query($sql); - while ($row = $db->sql_fetchrow($result)) + $censors = array(); + if ($row = $db->sql_fetchrow($result)) { - $orig_word[] = '#\b(' . str_replace('\*', '\w*?', preg_quote($row['word'], '#')) . ')\b#i'; - $replacement_word[] = $row['replacement']; - } + do + { + $censors['match'][] = '#\b(' . str_replace('\*', '\w*?', preg_quote($row['word'], '#')) . ')\b#i'; + $censors['replace'][] = $row['replacement']; + } + while ($row = $db->sql_fetchrow($result)); - $words = array('orig' => $orig_word, 'replacement' => $replacement_word); - $cache->put('word_censors', $words); + $cache->put('word_censors', $censors); + } + $db->sql_freeresult($result); } return true; } +// Obtain currently listed icons, re-caching if necessary +function obtain_icons(&$icons) +{ + global $db, $cache; + + if (!($icons = $cache->get('icons'))) + { + // Topic icons + $sql = "SELECT * + FROM " . ICONS_TABLE . " + WHERE icons_id > 1"; + $result = $db->sql_query($sql); + + $icons = array(); + while ($row = $db->sql_fetchrow($result)) + { + $icons[$row['icons_id']]['img'] = $row['icons_url']; + $icons[$row['icons_id']]['width'] = $row['icons_width']; + $icons[$row['icons_id']]['height'] = $row['icons_height']; + } + $db->sql_freeresult($result); + + $cache->put('icons', $icons); + } + + return; +} + // Redirects the user to another page then exits the script nicely function redirect($url) { @@ -815,7 +838,7 @@ function validate_email($email) $sql = "SELECT user_email FROM " . USERS_TABLE . " - WHERE user_email = '" . sql_quote($email) . "'"; + WHERE user_email = '" . $db->sql_escape($email) . "'"; $result = $db->sql_query($sql); if ($row = $db->sql_fetchrow($result)) diff --git a/phpBB/install/schemas/mysql_schema.sql b/phpBB/install/schemas/mysql_schema.sql index 01220befe1..499c6b490b 100644 --- a/phpBB/install/schemas/mysql_schema.sql +++ b/phpBB/install/schemas/mysql_schema.sql @@ -20,6 +20,7 @@ CREATE TABLE phpbb_attach_desc ( PRIMARY KEY (attach_id) ); + # -------------------------------------------------------- # # Table structure for table `phpbb_auth_groups` diff --git a/phpBB/viewforum.php b/phpBB/viewforum.php index 2a208ce320..af94d2b692 100644 --- a/phpBB/viewforum.php +++ b/phpBB/viewforum.php @@ -203,9 +203,9 @@ if ($forum_data['forum_postable']) $s_forum_rules = ''; get_forum_rules('forum', $s_forum_rules, $forum_id); - $orig_word = array(); - $replacement_word = array(); - obtain_word_list($orig_word, $replacement_word); + // Grab censored words + $censors = array(); + obtain_word_list($censors); // Topic ordering options $previous_days = array(0 => $user->lang['All_Topics'], 1 => $user->lang['1_Day'], 7 => $user->lang['7_Days'], 14 => $user->lang['2_Weeks'], 30 => $user->lang['1_Month'], 90 => $user->lang['3_Months'], 180 => $user->lang['6_Months'], 364 => $user->lang['1_Year']); @@ -271,7 +271,7 @@ if ($forum_data['forum_postable']) 'POST_IMG' => (intval($forum_data['forum_status']) == ITEM_LOCKED) ? $user->img('post_locked', $post_alt) : $user->img('post_new', $post_alt), 'PAGINATION' => generate_pagination("viewforum.$phpEx$SID&f=$forum_id&topicdays=$topic_days", $topics_count, $config['topics_per_page'], $start), 'PAGE_NUMBER' => sprintf($user->lang['Page_of'], (floor( $start / $config['topics_per_page'] ) + 1), ceil( $topics_count / $config['topics_per_page'] )), - 'MOD_CP' => ($auth->acl_gets('m_', 'a_', $forum_id)) ? sprintf($user->lang['MCP'], '', '') : '', + 'MOD_CP' => ($auth->acl_gets('m_', 'a_', $forum_id)) ? sprintf($user->lang['MCP'], '', '') : '', 'MODERATORS' => (sizeof($forum_moderators[$forum_id])) ? implode(', ', $forum_moderators[$forum_id]) : $user->lang['None'], 'FOLDER_IMG' => $user->img('folder', 'No_new_posts'), @@ -306,19 +306,9 @@ if ($forum_data['forum_postable']) 'U_MARK_READ' => 'viewforum.' . $phpEx . $SID . '&f=' . $forum_id . '&mark=topics') ); - // Topic icons - $sql = "SELECT * - FROM " . ICONS_TABLE . " - WHERE icons_id > 1"; - $result = $db->sql_query($sql); - - $topic_icons = array(); - while ($row = $db->sql_fetchrow($result)) - { - $topic_icons[$row['icons_id']]['img'] = $row['icons_url']; - $topic_icons[$row['icons_id']]['width'] = $row['icons_width']; - $topic_icons[$row['icons_id']]['height'] = $row['icons_height']; - } + // Grab icons + $icons = array(); + obtain_icons($icons); // Grab all the basic data. If we're not on page 1 we also grab any // announcements that may exist. @@ -328,22 +318,12 @@ if ($forum_data['forum_postable']) if (empty($forum_data['topics_list'])) { - $sql = " - SELECT - t.*, - u.username, - u.user_id, - u2.username as user2, - u2.user_id as id2, - lr.lastread_time, - lr.lastread_type - FROM " . - TOPICS_TABLE . " t - LEFT JOIN " . LASTREAD_TABLE . " lr ON ( - lr.user_id = " . $user->data['user_id'] . " - AND t.topic_id=lr.topic_id), " . - USERS_TABLE . " u, " . - USERS_TABLE . " u2 + $sql = "SELECT t.*, u.username, u.user_id, u2.username as user2, u2.user_id as id2, lr.lastread_time, lr.lastread_type + FROM " . TOPICS_TABLE . " t + LEFT JOIN " . LASTREAD_TABLE . " lr ON ( + lr.user_id = " . $user->data['user_id'] . " + AND t.topic_id=lr.topic_id) + , " . USERS_TABLE . " u, " . USERS_TABLE . " u2 WHERE t.forum_id = $forum_id AND t.topic_type = " . POST_ANNOUNCE . " AND u.user_id = t.topic_poster @@ -360,22 +340,12 @@ if ($forum_data['forum_postable']) } $db->sql_freeresult($result); - $sql = " - SELECT - t.*, - u.username, - u.user_id, - u2.username as user2, - u2.user_id as id2, - lr.lastread_time, - lr.lastread_type - FROM " . - TOPICS_TABLE . " t - LEFT JOIN " . LASTREAD_TABLE . " lr ON ( - lr.user_id = " . $user->data['user_id'] . " - AND t.topic_id=lr.topic_id), " . - USERS_TABLE . " u, " . - USERS_TABLE . " u2 + $sql = "SELECT t.*, u.username, u.user_id, u2.username as user2, u2.user_id as id2, lr.lastread_time, lr.lastread_type + FROM " . TOPICS_TABLE . " t + LEFT JOIN " . LASTREAD_TABLE . " lr ON ( + lr.user_id = " . $user->data['user_id'] . " + AND t.topic_id=lr.topic_id) + , " . USERS_TABLE . " u, " . USERS_TABLE . " u2 WHERE t.forum_id = $forum_id AND t.topic_approved = 1 AND u.user_id = t.topic_poster @@ -415,7 +385,7 @@ if ($forum_data['forum_postable']) if (empty($forum_data['topics_list']) && !empty($topics_list)) { $sql = 'INSERT INTO ' . TOPICS_PREFETCH_TABLE . " (forum_id, start, sort_key, sort_dir, topics_list) - VALUES ($forum_id, $start, '$sort_key', '$sort_dir', '$topics_list')"; + VALUES ($forum_id, $start, '$sort_key', '$sort_dir', '$topics_list')"; // $db->sql_query($sql); } @@ -426,7 +396,7 @@ if ($forum_data['forum_postable']) { $topic_id = $topic_rowset[$i]['topic_id']; - $topic_title = (count($orig_word)) ? preg_replace($orig_word, $replacement_word, $topic_rowset[$i]['topic_title']) : $topic_rowset[$i]['topic_title']; + $topic_title = (!empty($censors)) ? preg_replace($censors['match'], $censors['replace'], $topic_rowset[$i]['topic_title']) : $topic_rowset[$i]['topic_title']; // See if the user has posted in this topic. if($topic_rowset[$i]['lastread_type'] == LASTREAD_POSTED) @@ -490,7 +460,7 @@ if ($forum_data['forum_postable']) $unread_topic = false; } - $newest_post_img = ($unread_topic) ? '' . $user->img('goto_post_newest', 'View_newest_post') . ' ' : ''; + $newest_post_img = ($unread_topic) ? '' . $user->img('goto_post_newest', 'View_newest_post') . ' ' : ''; $folder_img = ($unread_topic) ? $folder_new : $folder; $folder_alt = ($unread_topic) ? 'New_posts' : (($topic_rowset[$i]['topic_status'] == ITEM_LOCKED) ? 'Topic_locked' : 'No_new_posts'); @@ -565,10 +535,7 @@ if ($forum_data['forum_postable']) 'VIEWS' => $topic_rowset[$i]['topic_views'], 'TOPIC_TITLE' => $topic_title, 'TOPIC_TYPE' => $topic_type, - 'TOPIC_ICON' => (!empty($topic_rowset[$i]['topic_icon']) ) ? '' : '', - - - 'TOPIC_RATING' => (!empty($topic_rowset[$i]['topic_rating'])) ? '' . $topic_rowset[$i]['topic_rating'] . '' : '', + 'TOPIC_ICON' => (!empty($topic_rowset[$i]['topic_icon']) ) ? '' : '', 'S_ROW_COUNT' => $i, @@ -594,10 +561,10 @@ $nav_links['up'] = array( include($phpbb_root_path . 'includes/page_header.'.$phpEx); $template->set_filenames(array( - 'body' => 'viewforum_body.html' -)); + 'body' => 'viewforum_body.html') +); make_jumpbox("viewforum.$phpEx$SID", $forum_id); include($phpbb_root_path . 'includes/page_tail.'.$phpEx); -?> +?> \ No newline at end of file diff --git a/phpBB/viewtopic.php b/phpBB/viewtopic.php index 9f278a47b0..9b52490d1f 100644 --- a/phpBB/viewtopic.php +++ b/phpBB/viewtopic.php @@ -315,17 +315,21 @@ if ($user->data['user_id'] != ANONYMOUS) setcookie($config['cookie_name'] . '_t', serialize($mark_topics), 0, $config['cookie_path'], $config['cookie_domain'], $config['cookie_secure']); } -// Define censored word matches -$orig_word = array(); -$replacement_word = array(); -obtain_word_list($orig_word, $replacement_word); + + + +// Grab censored words +$censors = array(); +obtain_word_list($censors); // Replace naughty words in title -if (count($orig_word)) +if (sizeof($censors)) { - $topic_title = preg_replace($orig_word, $replacement_word, $topic_title); + $topic_title = preg_replace($censors['match'], $censors['replace'], $topic_title); } + + // Navigation links ... common to several scripts so we need // to look at centralising this ... major issue is variable naming // complicated particularly by viewtopic ... @@ -346,7 +350,7 @@ if ($parent_id > 0) } $sql = 'UPDATE ' . FORUMS_TABLE . " - SET forum_parents = '" . sql_escape(serialize($forum_parents)) . "' + SET forum_parents = '" . $db->sql_escape(serialize($forum_parents)) . "' WHERE parent_id = " . $parent_id; $db->sql_query($sql); } @@ -375,9 +379,11 @@ get_moderators($forum_moderators, $forum_id); - +// This is only used for print view so ... $server_path = (($config['cookie_secure']) ? 'https://' : 'http://' ) . trim($config['server_name']) . (($config['server_port'] <> 80) ? ':' . trim($config['server_port']) . '/' : '/') . trim($config['script_path']) . '/'; + + // Send vars to template $template->assign_vars(array( 'FORUM_ID' => $forum_id, @@ -404,9 +410,10 @@ $template->assign_vars(array( 'S_MOD_ACTION' => "mcp.$phpEx?sid=" . $user->session_id . "&t=$topic_id", 'S_WATCH_TOPIC' => $s_watching_topic, - 'U_VIEW_TOPIC' => "viewtopic.$phpEx$SID&t=$topic_id&start=$start&postdays=$post_days&postorder=$post_order&highlight=$highlight", 'U_TOPIC' => $server_path . 'viewtopic.' . $phpEx . '?t=' . $topic_id, 'U_FORUM' => $server_path, + + 'U_VIEW_TOPIC' => "viewtopic.$phpEx$SID&t=$topic_id&start=$start&postdays=$post_days&postorder=$post_order&highlight=$highlight", 'U_VIEW_FORUM' => $view_forum_url, 'U_VIEW_OLDER_TOPIC' => $view_prev_topic_url, 'U_VIEW_NEWER_TOPIC' => $view_next_topic_url, @@ -415,6 +422,8 @@ $template->assign_vars(array( 'U_POST_REPLY_TOPIC' => $reply_topic_url) ); + + // Mozilla navigation bar $nav_links['prev'] = array( 'url' => $view_prev_topic_url, @@ -467,7 +476,7 @@ if (!empty($poll_start)) foreach ($poll_info as $poll_option) { - $poll_option['poll_option_text'] = (sizeof($orig_word)) ? preg_replace($orig_word, $replacement_word, $poll_option['poll_option_text']) : $poll_option['poll_option_text']; + $poll_option['poll_option_text'] = (sizeof($censors)) ? preg_replace($censors['match'], $censors['replace'], $poll_option['poll_option_text']) : $poll_option['poll_option_text']; $option_pct = ($poll_total > 0) ? $poll_option['poll_option_total'] / $poll_total : 0; $option_pct_txt = sprintf("%.1d%%", ($option_pct * 100)); @@ -480,7 +489,7 @@ if (!empty($poll_start)) ); } - $poll_title = (sizeof($orig_word)) ? preg_replace($orig_word, $replacement_word, $poll_title) : $poll_title; + $poll_title = (sizeof($censors)) ? preg_replace($censors['match'], $censors['replace'], $poll_title) : $poll_title; $template->assign_vars(array( 'POLL_QUESTION' => $poll_title, @@ -490,7 +499,7 @@ if (!empty($poll_start)) 'S_HAS_POLL_OPTIONS'=> !$display_results, 'S_HAS_POLL_DISPLAY'=> $display_results, - 'S_POLL_ACTION' => "viewtopic.$phpEx$SID&t=$topic_id&postdays=$post_dats&postorder=$poster_order", + 'S_POLL_ACTION' => "viewtopic.$phpEx$SID&t=$topic_id&postdays=$post_days&postorder=$poster_order", 'L_SUBMIT_VOTE' => $user->lang['Submit_vote'], 'L_VIEW_RESULTS'=> $user->lang['View_results'], @@ -502,13 +511,22 @@ if (!empty($poll_start)) +// TEMP TEMP TEMP TEMP +$rating = ''; +for ($i = 0; $i < 6; $i++) +{ + $rating .= (($rating != '') ? ' ' : '') . '' . $i . ''; +} +// TEMP TEMP TEMP TEMP + + // Container for user details, only process once $user_cache = $attach_list = array(); $i = 0; // Go ahead and pull all data for this topic -$sql = "SELECT u.username, u.user_id, u.user_posts, u.user_from, u.user_karma, u.user_website, u.user_email, u.user_icq, u.user_aim, u.user_yim, u.user_regdate, u.user_msnm, u.user_viewemail, u.user_rank, u.user_sig, u.user_sig_bbcode_uid, u.user_avatar, u.user_avatar_type, p.*, pt.post_text, pt.post_subject, pt.bbcode_uid +$sql = "SELECT u.username, u.user_id, u.user_posts, u.user_from, u.user_karma, u.user_website, u.user_email, u.user_icq, u.user_aim, u.user_yim, u.user_regdate, u.user_msnm, u.user_viewemail, u.user_rank, u.user_sig, u.user_avatar, u.user_avatar_type, p.*, pt.post_text, pt.post_subject, pt.bbcode_uid FROM " . POSTS_TABLE . " p, " . USERS_TABLE . " u, " . POSTS_TEXT_TABLE . " pt WHERE p.topic_id = $topic_id AND p.post_approved = " . TRUE . " @@ -574,6 +592,8 @@ if ($row = $db->sql_fetchrow($result)) } } + + // Generate ranks, set them to empty string initially. if (!isset($user_cache[$poster_id]['rank_title'])) { @@ -601,6 +621,8 @@ if ($row = $db->sql_fetchrow($result)) } } + + // Handle anon users posting with usernames if (!$poster_id && $row['post_username'] != '') { @@ -608,6 +630,8 @@ if ($row = $db->sql_fetchrow($result)) $poster_rank = $user->lang['GUEST']; } + + if (!isset($user_cache[$poster_id]['profile']) && $poster_id) { $temp_url = "ucp.$phpEx$SID&mode=viewprofile&u=$poster_id"; @@ -691,6 +715,8 @@ if ($row = $db->sql_fetchrow($result)) $user_cache[$poster_id]['search'] = ''; } + + // Non-user specific images/text $temp_url = 'posting.' . $phpEx . $SID . '&mode=quote&p=' . $row['post_id']; $quote_img = '' . $user->img('icon_quote', $user->lang['REPLY_WITH_QUOTE']) . ''; @@ -732,17 +758,23 @@ if ($row = $db->sql_fetchrow($result)) $delpost = ''; } + + // Does post have an attachment? If so, add it to the list if ($row['post_attach']) { $attach_list[] = $post_id; } + + // Parse the message and subject $post_subject = ($row['post_subject'] != '') ? $row['post_subject'] : ''; $message = $row['post_text']; $bbcode_uid = $row['bbcode_uid']; + + // If the board has HTML off but the post has HTML // on then we process it, else leave it alone if (!$auth->acl_get('f_html', $forum_id)) @@ -753,18 +785,13 @@ if ($row = $db->sql_fetchrow($result)) } } - // Parse message for admin-defined/templated BBCode if reqd - if ($bbcode_uid != '') - { -// $message = ($auth->acl_get('f_bbcode', $forum_id)) ? bbencode_second_pass($message, $bbcode_uid, $auth->acl_get('f_img', $forum_id)) : preg_replace('/\:[0-9a-z\:]+\]/si', ']', $message); - } + + // Second parse bbcode here + // If we allow users to disable display of emoticons // we'll need an appropriate check and preg_replace here - if ($row['enable_smilies']) - { - $message = str_replace('(((?>([^><]+|(?R)))*)\<))#se', "preg_replace(\$orig_word, \$replacement_word, '\\0')", '>' . $message . '<'), 1, -1)); + $post_subject = preg_replace($censors['match'], $censors['replace'], $post_subject); + $message = str_replace('\"', '"', substr(preg_replace('#(\>(((?>([^><]+|(?R)))*)\<))#se', "preg_replace(\$censors['match'], \$censors['replace'], '\\0')", '>' . $message . '<'), 1, -1)); } $message = nl2br($message); @@ -799,21 +826,17 @@ if ($row = $db->sql_fetchrow($result)) if (!isset($user_cache[$poster_id]['sig'])) { $user_sig = ($row['enable_sig'] && $row['user_sig'] != '' && $config['allow_sig']) ? $row['user_sig'] : ''; - $user_sig_bbcode_uid = $row['user_sig_bbcode_uid']; - if ($user_sig != '' && $user_sig_bbcode_uid != '' && $auth->acl_get('f_sigs', $forum_id)) + if ($user_sig != '' && $auth->acl_gets('f_sigs', 'm_', 'a_', $forum_id)) { if (!$auth->acl_get('f_html', $forum_id) && $user->data['user_allowhtml']) { $user_sig = preg_replace('#(<)([\/]?.*?)(>)#is', "<\\2>", $user_sig); } - if ($row['user_allowsmile']) - { - $user_cache[$poster_id]['sig'] = str_replace('(((?>([^><]+|(?R)))*)\<))#se', "preg_replace(\$orig_word, \$replacement_word, '\\0')", '>' . $user_sig . '<'), 1, -1)); } @@ -849,6 +872,8 @@ if ($row = $db->sql_fetchrow($result)) 'SIGNATURE' => $user_cache[$poster_id]['sig'], 'EDITED_MESSAGE'=> $l_edited_by, + 'RATING' => $rating, + 'MINI_POST_IMG' => $mini_post_img, 'EDIT_IMG' => $edit_img, 'EDIT' => $edit, @@ -888,6 +913,8 @@ if ($row = $db->sql_fetchrow($result)) )); } while ($row = $db->sql_fetchrow($result)); + + unset($user_cache); } else {