kashire/lainchan
4
0
Fork 0
Code Issues 18 Pull Requests Releases Wiki Activity

XSS in "manage users" page (mod log)

Browse Source 
Mod log permissions fix
Tiny display change in "manage users" page
This commit is contained in:
Michael Save 2012-01-07 15:38:18 +11:00
parent 20f9dbab47
commit 3f05a9282b
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
mod.php
View File

@ -1023,6 +1023,13 @@
$query = query("SELECT *, (SELECT `time` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `last`, (SELECT `text` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `action` FROM `mods` ORDER BY `type` DESC,`id`") or error(db_error()); $query = query("SELECT *, (SELECT `time` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `last`, (SELECT `text` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `action` FROM `mods` ORDER BY `type` DESC,`id`") or error(db_error());
while($_mod = $query->fetch()) { while($_mod = $query->fetch()) {
$type = $_mod['type'] == JANITOR ? 'Janitor' : ($_mod['type'] == MOD ? 'Mod' : 'Admin'); $type = $_mod['type'] == JANITOR ? 'Janitor' : ($_mod['type'] == MOD ? 'Mod' : 'Admin');
$_mod['boards'] = explode(',', $_mod['boards']);
foreach($_mod['boards'] as &$_board) {
if($_board != '*')
$_board = '/' . $_board . '/';
}
$body .= '<tr>' . $body .= '<tr>' .
'<td>' . '<td>' .
$_mod['id'] . $_mod['id'] .
@ -1037,13 +1044,15 @@
'</td>' . '</td>' .
'<td>' . '<td>' .
str_replace(',', ', ', $_mod['boards']) . implode(', ', $_mod['boards']) .
'</td>' . '</td>' .
'<td>' . '<td>' .
($_mod['last'] ? (hasPermission($config['mod']['modlog']) ?
'<span title="' . utf8tohtml($_mod['action']) . '">' . ago($_mod['last']) . '</span>' ($_mod['last'] ?
: '<em>never</em>') . '<span title="' . str_replace('"', '&quot;', utf8tohtml($_mod['action'])) . '">' . ago($_mod['last']) . '</span>'
: '<em>never</em>')
: '-') .
'</td>' . '</td>' .
'<td style="white-space:nowrap">' . '<td style="white-space:nowrap">' .