diff --git a/phpBB/admin/admin_words.php b/phpBB/admin/admin_words.php
index cf7d31c235..172c6ee14b 100644
--- a/phpBB/admin/admin_words.php
+++ b/phpBB/admin/admin_words.php
@@ -20,8 +20,6 @@
*
***************************************************************************/
-define('IN_PHPBB', 1);
-
if( !empty($setmodules) )
{
$file = basename(__FILE__);
@@ -29,6 +27,8 @@ if( !empty($setmodules) )
return;
}
+define('IN_PHPBB', 1);
+
//
// Load default header
//
@@ -38,7 +38,7 @@ require('./pagestart.' . $phpEx);
if( isset($HTTP_GET_VARS['mode']) || isset($HTTP_POST_VARS['mode']) )
{
- $mode = ($HTTP_GET_VARS['mode']) ? $HTTP_GET_VARS['mode'] : $HTTP_POST_VARS['mode'];
+ $mode = (isset($HTTP_GET_VARS['mode'])) ? $HTTP_GET_VARS['mode'] : $HTTP_POST_VARS['mode'];
$mode = htmlspecialchars($mode);
}
else
@@ -60,6 +60,9 @@ else
}
}
+// Restrict mode input to valid options
+$mode = ( in_array($mode, array('add', 'edit', 'save', 'delete')) ) ? $mode : '';
+
if( $mode != "" )
{
if( $mode == "edit" || $mode == "add" )
@@ -70,6 +73,7 @@ if( $mode != "" )
"body" => "admin/words_edit_body.tpl")
);
+ $word_info = array('word' => '', 'replacement' => '');
$s_hidden_fields = '';
if( $mode == "edit" )
@@ -158,7 +162,9 @@ if( $mode != "" )
$word_id = 0;
}
- if( $word_id )
+ $confirm = isset($HTTP_POST_VARS['confirm']);
+
+ if( $word_id && $confirm )
{
$sql = "DELETE FROM " . WORDS_TABLE . "
WHERE word_id = $word_id";
@@ -172,6 +178,26 @@ if( $mode != "" )
message_die(GENERAL_MESSAGE, $message);
}
+ elseif( $word_id && !$confirm)
+ {
+ // Present the confirmation screen to the user
+ $template->set_filenames(array(
+ 'body' => 'admin/confirm_body.tpl')
+ );
+
+ $hidden_fields = '';
+
+ $template->assign_vars(array(
+ 'MESSAGE_TITLE' => $lang['Confirm'],
+ 'MESSAGE_TEXT' => $lang['Confirm_delete_word'],
+
+ 'L_YES' => $lang['Yes'],
+ 'L_NO' => $lang['No'],
+
+ 'S_CONFIRM_ACTION' => append_sid("admin_words.$phpEx"),
+ 'S_HIDDEN_FIELDS' => $hidden_fields)
+ );
+ }
else
{
message_die(GENERAL_MESSAGE, $lang['No_word_selected']);
@@ -193,6 +219,7 @@ else
}
$word_rows = $db->sql_fetchrowset($result);
+ $db->sql_freeresult($result);
$word_count = count($word_rows);
$template->assign_vars(array(
diff --git a/phpBB/language/lang_english/lang_admin.php b/phpBB/language/lang_english/lang_admin.php
index 962aad5b4c..294113deb3 100644
--- a/phpBB/language/lang_english/lang_admin.php
+++ b/phpBB/language/lang_english/lang_admin.php
@@ -518,6 +518,8 @@ $lang['Word_removed'] = 'The selected word censor has been successfully removed'
$lang['Click_return_wordadmin'] = 'Click %sHere%s to return to Word Censor Administration';
+$lang['Confirm_delete_word'] = 'Are you sure you want to delete this word censor?';
+
//
// Mass Email