kashire/lainchan
4
0
Fork 0
Code Issues 9 Pull Requests Releases Wiki Activity

Partial merge of 736e982945 [SECURITY] Lessen security impact

Browse Source
This commit is contained in:
Benjamin Southall 2017-06-08 08:13:57 +09:00
parent da6eb9e2cb
commit d7e1b30b0e
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
post.php
View File

@ -222,7 +222,7 @@ if (isset($_POST['delete'])) {
error($config['error']['nodelete']); error($config['error']['nodelete']);
foreach ($delete as &$id) { foreach ($delete as &$id) {
$query = prepare(sprintf("SELECT `thread`, `time`,`password` FROM ``posts_%s`` WHERE `id` = :id", $board['uri'])); $query = prepare(sprintf("SELECT `id`,`thread`, `time`,`password` FROM ``posts_%s`` WHERE `id` = :id", $board['uri']));
$query->bindValue(':id', $id, PDO::PARAM_INT); $query->bindValue(':id', $id, PDO::PARAM_INT);
$query->execute() or error(db_error($query)); $query->execute() or error(db_error($query));
@ -330,6 +330,12 @@ if (isset($_POST['delete'])) {
$thread = $query->fetch(PDO::FETCH_ASSOC); $thread = $query->fetch(PDO::FETCH_ASSOC);
$error = event('report', array('ip' => $_SERVER['REMOTE_ADDR'], 'board' => $board['uri'], 'post' => $post, 'reason' => $reason,'link' => link_for($post)));
if ($error) {
error($error);
}
if ($config['syslog']) if ($config['syslog'])
_syslog(LOG_INFO, 'Reported post: ' . _syslog(LOG_INFO, 'Reported post: ' .
'/' . $board['dir'] . $config['dir']['res'] . link_for($post) . ($thread['thread'] ? '#' . $id : '') . '/' . $board['dir'] . $config['dir']['res'] . link_for($post) . ($thread['thread'] ? '#' . $id : '') .