Vergleich xmlhttp.php - 1.8.0 - 1.8.4

  Keine Änderungen   Hinzugefügt   Modifiziert   Entfernt
Zeile 28Zeile 28
// Load MyBB core files
require_once dirname(__FILE__)."/inc/init.php";


 
// Load MyBB core files
require_once dirname(__FILE__)."/inc/init.php";


$shutdown_queries = array();

$shutdown_queries = $shutdown_functions = array();


// Load some of the stock caches we'll be using.
$groupscache = $cache->read("usergroups");


// Load some of the stock caches we'll be using.
$groupscache = $cache->read("usergroups");

Zeile 70Zeile 70
// 1. Check cookies
if(!$mybb->user['uid'] && !empty($mybb->cookies['mybbtheme']))
{

 
// 1. Check cookies
if(!$mybb->user['uid'] && !empty($mybb->cookies['mybbtheme']))
{

	$mybb->user['style'] = $mybb->cookies['mybbtheme'];

	$mybb->user['style'] = (int)$mybb->cookies['mybbtheme'];

}

// 2. Load style

}

// 2. Load style

Zeile 170Zeile 170
	$theme['imglangdir'] = $mybb->get_asset_url($theme['imglangdir']);
}


 
	$theme['imglangdir'] = $mybb->get_asset_url($theme['imglangdir']);
}


$templatelist = "postbit_editedby,xmlhttp_inline_post_editor,xmlhttp_buddyselect_online,xmlhttp_buddyselect_offline,xmlhttp_buddyselect";

$templatelist = "postbit_editedby,xmlhttp_buddyselect_online,xmlhttp_buddyselect_offline,xmlhttp_buddyselect";

$templates->cache($db->escape_string($templatelist));

if($lang->settings['charset'])

$templates->cache($db->escape_string($templatelist));

if($lang->settings['charset'])

Zeile 201Zeile 201
		exit;
	}


 
		exit;
	}


	if($mybb->get_input('getone', 1) == 1)

	if($mybb->get_input('getone', MyBB::INPUT_INT) == 1)

	{
		$limit = 1;
	}

	{
		$limit = 1;
	}

Zeile 254Zeile 254
		xmlhttp_error($lang->invalid_post_code);
	}


 
		xmlhttp_error($lang->invalid_post_code);
	}


	// Editing a post subject.
	if($mybb->get_input('pid', 1))
	{
		// Fetch the post from the database.
		$post = get_post($mybb->get_input('pid', 1));

		// No result, die.
		if(!$post)
		{
			xmlhttp_error($lang->post_doesnt_exist);
		}

		// Fetch the thread associated with this post.
		$thread = get_thread($post['tid']);
		if(!$thread)
		{
			xmlhttp_error($lang->thread_doesnt_exist);
		}
	}

 
	// We're editing a thread subject.

 
	// We're editing a thread subject.

	else if($mybb->get_input('tid', 1))

	if($mybb->get_input('tid', MyBB::INPUT_INT))

	{
		// Fetch the thread.

 
	{
		// Fetch the thread.

		$thread = get_thread($mybb->get_input('tid', 1));

		$thread = get_thread($mybb->get_input('tid', MyBB::INPUT_INT));

		if(!$thread)
		{
			xmlhttp_error($lang->thread_doesnt_exist);

		if(!$thread)
		{
			xmlhttp_error($lang->thread_doesnt_exist);

Zeile 398Zeile 379

	// Spit the subject back to the browser.
	$subject = substr($mybb->input['value'], 0, 120); // 120 is the varchar length for the subject column

 

	// Spit the subject back to the browser.
	$subject = substr($mybb->input['value'], 0, 120); // 120 is the varchar length for the subject column

	echo json_encode(array("subject" => htmlspecialchars_uni($subject)));

	echo json_encode(array("subject" => '<a href="'.get_thread_link($thread['tid']).'">'.htmlspecialchars_uni($subject).'</a>'));


	// Close the connection.
	exit;


	// Close the connection.
	exit;

Zeile 406Zeile 387
else if($mybb->input['action'] == "edit_post")
{
	// Fetch the post from the database.

 
else if($mybb->input['action'] == "edit_post")
{
	// Fetch the post from the database.

	$post = get_post($mybb->get_input('pid', 1));

	$post = get_post($mybb->get_input('pid', MyBB::INPUT_INT));


	// No result, die.
	if(!$post)


	// No result, die.
	if(!$post)

Zeile 445Zeile 426
			xmlhttp_error($lang->no_permission_edit_post);
		}
		// If we're past the edit time limit - don't allow editing.

 
			xmlhttp_error($lang->no_permission_edit_post);
		}
		// If we're past the edit time limit - don't allow editing.

		else if($mybb->settings['edittimelimit'] != 0 && $post['dateline'] < (TIME_NOW-($mybb->settings['edittimelimit']*60)))

		else if($mybb->usergroup['edittimelimit'] != 0 && $post['dateline'] < (TIME_NOW-($mybb->usergroup['edittimelimit']*60)))

		{

 
		{

			$lang->edit_time_limit = $lang->sprintf($lang->edit_time_limit, $mybb->settings['edittimelimit']);

			$lang->edit_time_limit = $lang->sprintf($lang->edit_time_limit, $mybb->usergroup['edittimelimit']);

			xmlhttp_error($lang->edit_time_limit);
		}
		// User can't edit unapproved post
		if($post['visible'] == 0)
		{
			xmlhttp_error($lang->post_moderation);

 
			xmlhttp_error($lang->edit_time_limit);
		}
		// User can't edit unapproved post
		if($post['visible'] == 0)
		{
			xmlhttp_error($lang->post_moderation);

		}

		}


		// Forum is closed - no editing allowed
		if($forum['open'] == 0)
		{
			xmlhttp_error($lang->no_permission_edit_post);
		}

 

		// Forum is closed - no editing allowed
		if($forum['open'] == 0)
		{
			xmlhttp_error($lang->no_permission_edit_post);
		}

	}


	}


	$plugins->run_hooks("xmlhttp_edit_post_end");

	if($mybb->get_input('do') == "get_post")

 
	$plugins->run_hooks("xmlhttp_edit_post_end");

	if($mybb->get_input('do') == "get_post")

	{

	{

		// Send our headers.
		//header("Content-type: text/xml; charset={$charset}");
		header("Content-type: text/html; charset={$charset}");

 
		// Send our headers.
		//header("Content-type: text/xml; charset={$charset}");
		header("Content-type: text/html; charset={$charset}");





		//$post['message'] = htmlspecialchars_uni($post['message']);

		// Send the contents of the post.

 
		//$post['message'] = htmlspecialchars_uni($post['message']);

		// Send the contents of the post.

		/*eval("\$inline_editor = \"".$templates->get("xmlhttp_inline_post_editor")."\";");
		echo "<?xml version=\"1.0\" encoding=\"{$charset}\"?".">";
		echo "<form>".$inline_editor."</form>";*/

 
		echo $post['message'];
		exit;
	}
	else if($mybb->get_input('do') == "update_post")

 
		echo $post['message'];
		exit;
	}
	else if($mybb->get_input('do') == "update_post")

	{

	{

		// Verify POST request
		if(!verify_post_check($mybb->get_input('my_post_key'), true))
		{

		// Verify POST request
		if(!verify_post_check($mybb->get_input('my_post_key'), true))
		{

Zeile 513Zeile 491
		require_once MYBB_ROOT."inc/datahandlers/post.php";
		$posthandler = new PostDataHandler("update");
		$posthandler->action = "post";

 
		require_once MYBB_ROOT."inc/datahandlers/post.php";
		$posthandler = new PostDataHandler("update");
		$posthandler->action = "post";





		// Set the post data that came from the input to the $post array.
		$updatepost = array(
			"pid" => $post['pid'],

		// Set the post data that came from the input to the $post array.
		$updatepost = array(
			"pid" => $post['pid'],

Zeile 538Zeile 516
			{
				// Is it the first post?
				if($thread['firstpost'] == $post['pid'])

 
			{
				// Is it the first post?
				if($thread['firstpost'] == $post['pid'])

				{

				{

					echo json_encode(array("moderation_thread" => $lang->thread_moderation, 'url' => $mybb->settings['bburl'].'/'.get_forum_link($thread['fid']), "message" => $post['message']));

 
					echo json_encode(array("moderation_thread" => $lang->thread_moderation, 'url' => $mybb->settings['bburl'].'/'.get_forum_link($thread['fid']), "message" => $post['message']));

					exit;
				}

					exit;
				}

				else
				{
					echo json_encode(array("moderation_post" => $lang->post_moderation, 'url' => $mybb->settings['bburl'].'/'.get_thread_link($thread['tid']), "message" => $post['message']));
					exit;
				}

 
				else
				{
					echo json_encode(array("moderation_post" => $lang->post_moderation, 'url' => $mybb->settings['bburl'].'/'.get_thread_link($thread['tid']), "message" => $post['message']));
					exit;
				}

			}
		}

			}
		}


		require_once MYBB_ROOT."inc/class_parser.php";
		$parser = new postParser;


		require_once MYBB_ROOT."inc/class_parser.php";
		$parser = new postParser;

Zeile 574Zeile 552
		}

		if($mybb->user['showvideos'] != 1 && $mybb->user['uid'] != 0 || $mybb->settings['guestvideos'] != 1 && $mybb->user['uid'] == 0)

 
		}

		if($mybb->user['showvideos'] != 1 && $mybb->user['uid'] != 0 || $mybb->settings['guestvideos'] != 1 && $mybb->user['uid'] == 0)

		{

		{

			$parser_options['allow_videocode'] = 0;
		}

 
			$parser_options['allow_videocode'] = 0;
		}





		$post['message'] = $parser->parse_message($message, $parser_options);

		// Now lets fetch all of the attachments for these posts.
		if($mybb->settings['enableattachments'] != 0)

 
		$post['message'] = $parser->parse_message($message, $parser_options);

		// Now lets fetch all of the attachments for these posts.
		if($mybb->settings['enableattachments'] != 0)

		{

		{

			$query = $db->simple_select("attachments", "*", "pid='{$post['pid']}'");
			while($attachment = $db->fetch_array($query))
			{

			$query = $db->simple_select("attachments", "*", "pid='{$post['pid']}'");
			while($attachment = $db->fetch_array($query))
			{

Zeile 601Zeile 579
			$post['editdate'] = my_date('relative', TIME_NOW);
			$post['editnote'] = $lang->sprintf($lang->postbit_edited, $post['editdate']);
			$post['editedprofilelink'] = build_profile_link($mybb->user['username'], $mybb->user['uid']);

 
			$post['editdate'] = my_date('relative', TIME_NOW);
			$post['editnote'] = $lang->sprintf($lang->postbit_edited, $post['editdate']);
			$post['editedprofilelink'] = build_profile_link($mybb->user['username'], $mybb->user['uid']);

			$post['editreason'] = $editreason;

			$post['editreason'] = trim($editreason);

			$editreason = "";
			if($post['editreason'] != "")
			{

			$editreason = "";
			if($post['editreason'] != "")
			{

Zeile 617Zeile 595

		$editedmsg_response = null;
		if($editedmsg)

 

		$editedmsg_response = null;
		if($editedmsg)

		{

		{

			$editedmsg_response = str_replace(array("\r", "\n"), "", $editedmsg);
		}


			$editedmsg_response = str_replace(array("\r", "\n"), "", $editedmsg);
		}


Zeile 671Zeile 649
	// Are we loading all quoted posts or only those not in the current thread?
	if(empty($mybb->input['load_all']))
	{

 
	// Are we loading all quoted posts or only those not in the current thread?
	if(empty($mybb->input['load_all']))
	{

		$from_tid = "p.tid != '".$mybb->get_input('tid', 1)."' AND ";

		$from_tid = "p.tid != '".$mybb->get_input('tid', MyBB::INPUT_INT)."' AND ";

	}
	else
	{

	}
	else
	{

Zeile 747Zeile 725
	$query = $db->simple_select("captcha", "imagestring", "imagehash='$imagehash'");
	if($db->num_rows($query) == 0)
	{

 
	$query = $db->simple_select("captcha", "imagestring", "imagehash='$imagehash'");
	if($db->num_rows($query) == 0)
	{

		echo $lang->captcha_valid_not_exists;

		echo json_encode($lang->captcha_valid_not_exists);

		exit;
	}
	$imagestring = $db->fetch_field($query, 'imagestring');

		exit;
	}
	$imagestring = $db->fetch_field($query, 'imagestring');

Zeile 772Zeile 750
	
	$sid = $db->escape_string($mybb->get_input('question_id'));
	$query = $db->query("

 
	
	$sid = $db->escape_string($mybb->get_input('question_id'));
	$query = $db->query("

		SELECT q.*, s.sid

		SELECT q.qid, s.sid

		FROM ".TABLE_PREFIX."questionsessions s
		LEFT JOIN ".TABLE_PREFIX."questions q ON (q.qid=s.qid)
		WHERE q.active='1' AND s.sid='{$sid}'
	");

 
		FROM ".TABLE_PREFIX."questionsessions s
		LEFT JOIN ".TABLE_PREFIX."questions q ON (q.qid=s.qid)
		WHERE q.active='1' AND s.sid='{$sid}'
	");

 
	

	if($db->num_rows($query) == 0)

 
	if($db->num_rows($query) == 0)

	{
		xmlhttp_error($lang->answer_valid_not_exists);
	}
	
	$qsession = $db->fetch_array($query);

	{
		xmlhttp_error($lang->answer_valid_not_exists);
	}
	
	$qsession = $db->fetch_array($query);

	
	// Delete previous question session
	$db->delete_query("questionsessions", "sid='$sid'");

 
	
	// Delete previous question session
	$db->delete_query("questionsessions", "sid='$sid'");

	
	require_once MYBB_ROOT."inc/functions_user.php";
	
	$sid = generate_question();

	
	require_once MYBB_ROOT."inc/functions_user.php";
	
	$sid = generate_question($qsession['qid']);

	$query = $db->query("
		SELECT q.question, s.sid
		FROM ".TABLE_PREFIX."questionsessions s
		LEFT JOIN ".TABLE_PREFIX."questions q ON (q.qid=s.qid)
		WHERE q.active='1' AND s.sid='{$sid}' AND q.qid!='{$qsession['qid']}'
	");

 
	$query = $db->query("
		SELECT q.question, s.sid
		FROM ".TABLE_PREFIX."questionsessions s
		LEFT JOIN ".TABLE_PREFIX."questions q ON (q.qid=s.qid)
		WHERE q.active='1' AND s.sid='{$sid}' AND q.qid!='{$qsession['qid']}'
	");

 
	
	$plugins->run_hooks("xmlhttp_refresh_question");
	

	if($db->num_rows($query) > 0)

 
	if($db->num_rows($query) > 0)

	{

	{

		$question = $db->fetch_array($query);

 
		$question = $db->fetch_array($query);

 
		
		echo json_encode(array("question" => htmlspecialchars_uni($question['question']), 'sid' => htmlspecialchars_uni($question['sid'])));
		exit;
	}
	else 
	{
		xmlhttp_error($lang->answer_valid_not_exists);

	}

 
	}

	
	$plugins->run_hooks("xmlhttp_refresh_question");

	echo json_encode(array("question" => htmlspecialchars_uni($question['question']), 'sid' => htmlspecialchars_uni($question['sid'])));
	exit;

 
}
elseif($mybb->input['action'] == "validate_question" && $mybb->settings['securityquestion'])
{

}
elseif($mybb->input['action'] == "validate_question" && $mybb->settings['securityquestion'])
{

Zeile 818Zeile 802
		LEFT JOIN ".TABLE_PREFIX."questions q ON (q.qid=s.qid)
		WHERE q.active='1' AND s.sid='{$sid}'
	");

 
		LEFT JOIN ".TABLE_PREFIX."questions q ON (q.qid=s.qid)
		WHERE q.active='1' AND s.sid='{$sid}'
	");

 
	

	if($db->num_rows($query) == 0)
	{

 
	if($db->num_rows($query) == 0)
	{

		echo $lang->answer_valid_not_exists;

		echo json_encode($lang->answer_valid_not_exists);

		exit;
	}
	else

		exit;
	}
	else

Zeile 895Zeile 880

	if(empty($username))
	{

 

	if(empty($username))
	{

		echo $lang->banned_characters_username;

		echo json_encode($lang->banned_characters_username);

		exit;
	}


		exit;
	}


Zeile 903Zeile 888
	$banned_username = is_banned_username($username, true);
	if($banned_username)
	{

 
	$banned_username = is_banned_username($username, true);
	if($banned_username)
	{

		echo $lang->banned_username;

		echo json_encode($lang->banned_username);

		exit;
	}

	// Check for certain characters in username (<, >, &, and slashes)
	if(strpos($username, "<") !== false || strpos($username, ">") !== false || strpos($username, "&") !== false || my_strpos($username, "\\") !== false || strpos($username, ";") !== false || !validate_utf8_string($username, false, false))
	{

 
		exit;
	}

	// Check for certain characters in username (<, >, &, and slashes)
	if(strpos($username, "<") !== false || strpos($username, ">") !== false || strpos($username, "&") !== false || my_strpos($username, "\\") !== false || strpos($username, ";") !== false || !validate_utf8_string($username, false, false))
	{

		echo $lang->banned_characters_username;

		echo json_encode($lang->banned_characters_username);

		exit;
	}


		exit;
	}


Zeile 963Zeile 948
	}
	else
	{

 
	}
	else
	{

		$lang->invalid_username = htmlspecialchars_uni($lang->sprintf($lang->invalid_username, htmlspecialchars_uni($username)));
		echo $lang->invalid_username;

		$lang->invalid_username = $lang->sprintf($lang->invalid_username, htmlspecialchars_uni($username));
		echo json_encode($lang->invalid_username);

		exit;
	}
}

		exit;
	}
}