From 74c5b16a3dc10496f34ec5b43affb63891d4da67 Mon Sep 17 00:00:00 2001 From: "Paul S. Owen" Date: Fri, 10 Jan 2003 21:28:10 +0000 Subject: [PATCH] pooh bum crap ... how did I miss these, they were even listed in the private forum ... doh ... all afternoon I spent correcting patch errors ... git-svn-id: file:///svn/phpbb/branches/phpBB-2_0_0@3308 89ea8834-ac86-4346-8a33-228a782c2dd0 --- phpBB/includes/usercp_register.php | 22 ++++++++----------- .../subSilver/admin/board_config_body.tpl | 2 +- 2 files changed, 10 insertions(+), 14 deletions(-) diff --git a/phpBB/includes/usercp_register.php b/phpBB/includes/usercp_register.php index 3ca5479133..c5adb86445 100644 --- a/phpBB/includes/usercp_register.php +++ b/phpBB/includes/usercp_register.php @@ -93,22 +93,19 @@ if ( if ( $mode == 'editprofile' ) { $user_id = intval($HTTP_POST_VARS['user_id']); - $current_email = trim(strip_tags($HTTP_POST_VARS['current_email'])); + $current_email = trim(htmlspecialchars($HTTP_POST_VARS['current_email'])); } $strip_var_list = array('username' => 'username', 'email' => 'email', 'icq' => 'icq', 'aim' => 'aim', 'msn' => 'msn', 'yim' => 'yim', 'website' => 'website', 'location' => 'location', 'occupation' => 'occupation', 'interests' => 'interests'); - // Strip all tags from data ... may p**s some people off, could use - // htmlspecialchars but given the fields are limited in length we'd end - // up with (possibly) losing some data. Of course we could store the data - // "as is" and specialchar it as it's output but then we run into potential - // performance issues ... whichever way we go we'll end up being moaned at - // "hum ho, ho hum" (TM) + // Strip all tags from data ... may p**s some people off, bah, strip_tags is + // doing the job but can still break HTML output ... have no choice, have + // to use htmlspecialchars ... be prepared to be moaned at. while( list($var, $param) = @each($strip_var_list) ) { if ( !empty($HTTP_POST_VARS[$param]) ) { - $$var = trim(strip_tags($HTTP_POST_VARS[$param])); + $$var = trim(htmlspecialchars($HTTP_POST_VARS[$param])); } } @@ -157,7 +154,7 @@ if ( { if ( preg_match('/^[a-z_]+$/i', $HTTP_POST_VARS['language']) ) { - $user_lang = strip_tags($HTTP_POST_VARS['language']); + $user_lang = htmlspecialchars($HTTP_POST_VARS['language']); } else { @@ -171,11 +168,11 @@ if ( } $user_timezone = ( isset($HTTP_POST_VARS['timezone']) ) ? doubleval($HTTP_POST_VARS['timezone']) : $board_config['board_timezone']; - $user_dateformat = ( !empty($HTTP_POST_VARS['dateformat']) ) ? trim(strip_tags($HTTP_POST_VARS['dateformat'])) : $board_config['default_dateformat']; + $user_dateformat = ( !empty($HTTP_POST_VARS['dateformat']) ) ? trim(htmlspecialchars($HTTP_POST_VARS['dateformat'])) : $board_config['default_dateformat']; - $user_avatar_local = ( isset($HTTP_POST_VARS['avatarselect']) && !empty($HTTP_POST_VARS['submitavatar']) && $board_config['allow_avatar_local'] ) ? $HTTP_POST_VARS['avatarselect'] : ( ( isset($HTTP_POST_VARS['avatarlocal']) ) ? strip_tags($HTTP_POST_VARS['avatarlocal']) : '' ); + $user_avatar_local = ( isset($HTTP_POST_VARS['avatarselect']) && !empty($HTTP_POST_VARS['submitavatar']) && $board_config['allow_avatar_local'] ) ? $HTTP_POST_VARS['avatarselect'] : ( ( isset($HTTP_POST_VARS['avatarlocal']) ) ? htmlspecialchars($HTTP_POST_VARS['avatarlocal']) : '' ); - $user_avatar_remoteurl = ( !empty($HTTP_POST_VARS['avatarremoteurl']) ) ? trim(strip_tags($HTTP_POST_VARS['avatarremoteurl'])) : ''; + $user_avatar_remoteurl = ( !empty($HTTP_POST_VARS['avatarremoteurl']) ) ? trim(htmlspecialchars($HTTP_POST_VARS['avatarremoteurl'])) : ''; $user_avatar_upload = ( !empty($HTTP_POST_VARS['avatarurl']) ) ? trim($HTTP_POST_VARS['avatarurl']) : ( ( $HTTP_POST_FILES['avatar']['tmp_name'] != "none") ? $HTTP_POST_FILES['avatar']['tmp_name'] : '' ); $user_avatar_name = ( !empty($HTTP_POST_FILES['avatar']['name']) ) ? $HTTP_POST_FILES['avatar']['name'] : ''; $user_avatar_size = ( !empty($HTTP_POST_FILES['avatar']['size']) ) ? $HTTP_POST_FILES['avatar']['size'] : 0; @@ -223,7 +220,6 @@ if ( $userdata['session_logged_in'] && $mode =="register" && $username == $userd message_die(GENERAL_MESSAGE, $lang['Username_taken'], '', __LINE__, __FILE__); } - // // Did the user submit? In this case build a query to update the users profile in the DB // diff --git a/phpBB/templates/subSilver/admin/board_config_body.tpl b/phpBB/templates/subSilver/admin/board_config_body.tpl index 18892e07d1..26515ed09d 100644 --- a/phpBB/templates/subSilver/admin/board_config_body.tpl +++ b/phpBB/templates/subSilver/admin/board_config_body.tpl @@ -237,7 +237,7 @@ {L_SMTP_PASSWORD}
{L_SMTP_PASSWORD_EXPLAIN} - + {S_HIDDEN_FIELDS}