aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--include/common.inc.php61
-rw-r--r--include/functions_category.inc.php5
-rw-r--r--include/ws_functions.inc.php10
-rw-r--r--index.php2
-rw-r--r--template/yoga/index.tpl12
5 files changed, 25 insertions, 65 deletions
diff --git a/include/common.inc.php b/include/common.inc.php
index cbe1d6d89..0b1a2b581 100644
--- a/include/common.inc.php
+++ b/include/common.inc.php
@@ -36,64 +36,21 @@ set_magic_quotes_runtime(0); // Disable magic_quotes_runtime
//
if( !get_magic_quotes_gpc() )
{
+ function sanitize_mysql_kv(&$v, $k)
+ {
+ $v = addslashes($v);
+ }
if( is_array( $_GET ) )
{
- while( list($k, $v) = each($_GET) )
- {
- if( is_array($_GET[$k]) )
- {
- while( list($k2, $v2) = each($_GET[$k]) )
- {
- $_GET[$k][$k2] = addslashes($v2);
- }
- @reset($_GET[$k]);
- }
- else
- {
- $_GET[$k] = addslashes($v);
- }
- }
- @reset($_GET);
+ array_walk_recursive( $_GET, 'sanitize_mysql_kv' );
}
-
- if( is_array($_POST) )
+ if( is_array( $_POST ) )
{
- while( list($k, $v) = each($_POST) )
- {
- if( is_array($_POST[$k]) )
- {
- while( list($k2, $v2) = each($_POST[$k]) )
- {
- $_POST[$k][$k2] = addslashes($v2);
- }
- @reset($_POST[$k]);
- }
- else
- {
- $_POST[$k] = addslashes($v);
- }
- }
- @reset($_POST);
+ array_walk_recursive( $_POST, 'sanitize_mysql_kv' );
}
-
- if( is_array($_COOKIE) )
+ if( is_array( $_COOKIE ) )
{
- while( list($k, $v) = each($_COOKIE) )
- {
- if( is_array($_COOKIE[$k]) )
- {
- while( list($k2, $v2) = each($_COOKIE[$k]) )
- {
- $_COOKIE[$k][$k2] = addslashes($v2);
- }
- @reset($_COOKIE[$k]);
- }
- else
- {
- $_COOKIE[$k] = addslashes($v);
- }
- }
- @reset($_COOKIE);
+ array_walk_recursive( $_COOKIE, 'sanitize_mysql_kv' );
}
}
if ( !empty($_SERVER["PATH_INFO"]) )
diff --git a/include/functions_category.inc.php b/include/functions_category.inc.php
index 26c9478ef..0705b852b 100644
--- a/include/functions_category.inc.php
+++ b/include/functions_category.inc.php
@@ -273,7 +273,8 @@ function get_category_preferred_image_orders()
l10n('Rank'),
'rank ASC',
('categories' == @$page['section'] and !isset($page['flat']) and !isset($page['chronology_field']) )
- )
+ ),
+ array( l10n('permissions'), 'level DESC', is_admin() )
));
}
@@ -522,4 +523,4 @@ LIMIT 1';
}
}
-?>
+?> \ No newline at end of file
diff --git a/include/ws_functions.inc.php b/include/ws_functions.inc.php
index a41212f5f..e61a4b2d6 100644
--- a/include/ws_functions.inc.php
+++ b/include/ws_functions.inc.php
@@ -187,6 +187,7 @@ function ws_caddie_add($params, &$service)
{
return new PwgError(401, 'Access denied');
}
+ $params['image_id'] = array_map( 'intval',$params['image_id'] );
if ( empty($params['image_id']) )
{
return new PwgError(WS_ERR_INVALID_PARAM, "Invalid image_id");
@@ -291,7 +292,7 @@ SELECT i.*, GROUP_CONCAT(category_id) cat_ids
AND ', $where_clauses).'
GROUP BY i.id
'.$order_by.'
-LIMIT '.$params['per_page']*$params['page'].','.$params['per_page'];
+LIMIT '.(int)($params['per_page']*$params['page']).','.(int)$params['per_page'];
$result = pwg_query($query);
while ($row = mysql_fetch_assoc($result))
@@ -683,8 +684,8 @@ SELECT id, date, author, content
FROM '.COMMENTS_TABLE.'
WHERE '.$where_comments.'
ORDER BY date
- LIMIT '.$params['comments_per_page']*(int)$params['comments_page'].
- ','.$params['comments_per_page'];
+ LIMIT '.(int)($params['comments_per_page']*$params['comments_page']).
+ ','.(int)$params['comments_per_page'];
$result = pwg_query($query);
while ($row = mysql_fetch_assoc($result))
@@ -857,6 +858,7 @@ function ws_images_setPrivacyLevel($params, &$service)
{
return new PwgError(401, 'Access denied');
}
+ $params['image_id'] = array_map( 'intval',$params['image_id'] );
if ( empty($params['image_id']) )
{
return new PwgError(WS_ERR_INVALID_PARAM, "Invalid image_id");
@@ -1342,7 +1344,7 @@ SELECT DISTINCT i.* FROM '.IMAGES_TABLE.' i
WHERE '. implode('
AND ', $where_clauses).'
'.$order_by.'
-LIMIT '.$params['per_page']*$params['page'].','.$params['per_page'];
+LIMIT '.(int)($params['per_page']*$params['page']).','.(int)$params['per_page'];
$result = pwg_query($query);
while ($row = mysql_fetch_assoc($result))
diff --git a/index.php b/index.php
index 9c1556ba8..57c9d627e 100644
--- a/index.php
+++ b/index.php
@@ -197,7 +197,7 @@ if ( $page['section']=='search' and $page['start']==0 and
$hints = array();
foreach ( $cats as $cat )
{
- $hints[] = get_cat_display_name( array($cat) );
+ $hints[] = get_cat_display_name( array($cat), '', false );
}
$template->assign( 'category_search_results', $hints);
}
diff --git a/template/yoga/index.tpl b/template/yoga/index.tpl
index dc60daff5..2da9d04b5 100644
--- a/template/yoga/index.tpl
+++ b/template/yoga/index.tpl
@@ -32,19 +32,19 @@
{/if}
{if isset($U_MODE_FLAT) }
- <li><a href="{$U_MODE_FLAT}" title="{'mode_flat_hint'|@translate}" rel="nofollow"><img src="{$ROOT_URL}{$themeconf.icon_dir}/flat.png" class="button" alt="{'mode_flat_hint'|@translate}"></a></li>
+ <li><a href="{$U_MODE_FLAT}" title="{'mode_flat_hint'|@translate}" rel="nofollow"><img src="{$ROOT_URL}{$themeconf.icon_dir}/flat.png" class="button" alt="{'mode_flat_hint'|@translate}" /></a></li>
{/if}
{if isset($U_MODE_NORMAL) }
- <li><a href="{$U_MODE_NORMAL}" title="{'mode_normal_hint'|@translate}"><img src="{$ROOT_URL}{$themeconf.icon_dir}/normal_mode.png" class="button" alt="{'mode_normal_hint'|@translate}"></a></li>
+ <li><a href="{$U_MODE_NORMAL}" title="{'mode_normal_hint'|@translate}"><img src="{$ROOT_URL}{$themeconf.icon_dir}/normal_mode.png" class="button" alt="{'mode_normal_hint'|@translate}" /></a></li>
{/if}
{if isset($U_MODE_POSTED) }
- <li><a href="{$U_MODE_POSTED}" title="{'mode_posted_hint'|@translate}" rel="nofollow"><img src="{$ROOT_URL}{$themeconf.icon_dir}/calendar.png" class="button" alt="{'mode_posted_hint'|@translate}"></a></li>
+ <li><a href="{$U_MODE_POSTED}" title="{'mode_posted_hint'|@translate}" rel="nofollow"><img src="{$ROOT_URL}{$themeconf.icon_dir}/calendar.png" class="button" alt="{'mode_posted_hint'|@translate}" /></a></li>
{/if}
{if isset($U_MODE_CREATED) }
- <li><a href="{$U_MODE_CREATED}" title="{'mode_created_hint'|@translate}" rel="nofollow"><img src="{$ROOT_URL}{$themeconf.icon_dir}/calendar_created.png" class="button" alt="{'mode_created_hint'|@translate}"></a></li>
+ <li><a href="{$U_MODE_CREATED}" title="{'mode_created_hint'|@translate}" rel="nofollow"><img src="{$ROOT_URL}{$themeconf.icon_dir}/calendar_created.png" class="button" alt="{'mode_created_hint'|@translate}" /></a></li>
{/if}
{if !empty($PLUGIN_INDEX_ACTIONS)}{$PLUGIN_INDEX_ACTIONS}{/if}
@@ -71,7 +71,7 @@
{if !empty($PLUGIN_INDEX_CONTENT_BEGIN)}{$PLUGIN_INDEX_CONTENT_BEGIN}{/if}
{if !empty($category_search_results) }
-<div style="font-size:16px;text-align:left;margin:10px">{'Category results for'|@translate} <strong>{$QUERY_SEARCH}</strong> :
+<div style="font-size:16px;margin:10px 16px">{'Category results for'|@translate} <strong>{$QUERY_SEARCH}</strong> :
<em><strong>
{foreach from=$category_search_results item=res name=res_loop}
{if !$smarty.foreach.res_loop.first} &mdash; {/if}
@@ -82,7 +82,7 @@
{/if}
{if !empty($tag_search_results) }
-<div style="font-size:16px;text-align:left;margin:10px">{'Tag results for'|@translate} <strong>{$QUERY_SEARCH}</strong> :
+<div style="font-size:16px;margin:10px 16px">{'Tag results for'|@translate} <strong>{$QUERY_SEARCH}</strong> :
<em><strong>
{foreach from=$tag_search_results item=res name=res_loop}
{if !$smarty.foreach.res_loop.first} &mdash; {/if}