From 348e1e8fe009779913f2a842346d968525b4c06a Mon Sep 17 00:00:00 2001 From: AntonyAntonio Date: Mon, 18 Jan 2016 20:58:26 -0300 Subject: [PATCH 01/84] Test - Add Users Tests --- run_tests.sh | 3 +-- tests/cases/AdminPanelTest.php | 25 ++++++++++----------- tests/cases/UserTest.php | 41 ++++++++++++++++++++++++++++++++++ tests/cases/_Scripts.php | 24 ++++++++++++++++++++ 4 files changed, 78 insertions(+), 15 deletions(-) diff --git a/run_tests.sh b/run_tests.sh index 472c427e..4a9c9c25 100755 --- a/run_tests.sh +++ b/run_tests.sh @@ -19,5 +19,4 @@ gnome-terminal -e 'java -jar /usr/local/bin/selenium-server-standalone-2.48.2.ja # RUN TESTS phpunit --colors tests/cases/InstallTest.php phpunit --colors tests/cases/AdminPanelTest.php -#phpunit --colors tests/cases/UserTest.php -#phpunit --colors tests/cases/PostingTest.php +phpunit --colors tests/cases/UserTest.php diff --git a/tests/cases/AdminPanelTest.php b/tests/cases/AdminPanelTest.php index 92599912..09fb0b30 100644 --- a/tests/cases/AdminPanelTest.php +++ b/tests/cases/AdminPanelTest.php @@ -21,17 +21,9 @@ public function testLoginAdmin() { } public function testCategoryCreation() { - Scripts::LoginAdmin(); - $this->byLinkText('System Settings')->click(); - $this->byLinkText('Categories')->click(); - - $this->fillFields(array( - 'name' => 'Value Name', - 'description' => 'Value Category Description' - )); - $this->byName('add-category')->click(); + Scripts::CreateCategory(); $category=RedBean::load('categories',1); - $this->assertEquals($category->name, 'Value Name'); + $this->assertEquals($category->name, 'Amsterdam'); $this->assertEquals($category->description, 'Value Category Description'); } public function testCategoryChangeName() { @@ -47,13 +39,13 @@ public function testCategoryChangeName() { } public function testCategoryDeletion() { - Scripts::LoginAdmin(); + Scripts::CreateCategory('Berlin'); $this->byLinkText('System Settings')->click(); $this->byLinkText('Categories')->click(); $this->byName('delete-ideas')->click(); $this->byName('delete-category')->click(); $numberOfCategories=RedBean::count('categories'); - $this->assertEquals($numberOfCategories,0); + $this->assertEquals($numberOfCategories,1); } public function testGeneralSettings() { @@ -111,7 +103,6 @@ public function testCreateAdmin(){ $userCreated = RedBean::load('users',2); $this->assertEquals($userCreated->isadmin,'2'); } - public function testBanUser() { Scripts::CreateUser('turing@phpback.org','Alan turing','turing123'); Scripts::LoginAdmin(); @@ -127,4 +118,12 @@ public function testBanUser() { date_default_timezone_set('America/Los_Angeles'); $this->assertEquals($userbanned->banned,date('Ymd', strtotime('+10 days'))); } + public function testDisableBanUser() { + Scripts::LoginAdmin(); + $this->byLinkText('Users Management')->click(); + $this->byLinkText('Banned List ')->click(); + $this->byLinkText('Disable ban')->click(); + $passdisbann= RedBean::load('users',3); + $this->assertEquals('0',$passdisbann->banned); + } } diff --git a/tests/cases/UserTest.php b/tests/cases/UserTest.php index 37f005cb..e12e5bdb 100644 --- a/tests/cases/UserTest.php +++ b/tests/cases/UserTest.php @@ -4,4 +4,45 @@ use RedBeanPHP\Facade as RedBean; class UserTest extends TestCase { + + public function testCreateUser() { + Scripts::CreateUser('newemail2@phpback.org','Bill Gates','Gates123'); + $newuser= RedBean::load('users',4); + $this->assertEquals($newuser->id,'4'); + $this->assertEquals($newuser->name,'Bill Gates'); + $this->assertEquals($newuser->email,'newemail2@phpback.org'); + } + + public function testLoginUser() { + Scripts::LoginUser('newemail2@phpback.org','Gates123'); + $this->assertEquals($this->url(),'http://localhost:8080/home/'); + $this->assertContains('Logged as Bill Gates',$this->byTag('body')->text()); + + //Test log out user + $this->byLinkText('Log out')->click(); + $this->assertContains('Log in',$this->byTag('body')->text()); + $this->assertNotContains('Logged as Bill Gates',$this->byTag('body')->text()); + } + + public function testCreateIdea() { + Scripts::LoginUser('newemail2@phpback.org','Gates123'); + $this->byLinkText('Post a new idea')->click(); + $this->fillFields(array( + 'description' => 'The theory of relativity, or simply relativity in physics, usually encompasses two theories by Albert Einstein: special relativity and general relativity', + 'title' => 'Relativity Theory' + )); + $this->select($this->byName('category'))->selectOptionByValue('2'); + $this->byName('post-idea-form')->submit(); + $newidea = RedBean::load('ideas',1); + $this->assertEquals($newidea->title,'Relativity Theory'); + $this->assertEquals($newidea->authorid,'4'); + $this->assertEquals($newidea->votes,'0'); + $this->assertEquals($newidea->content,'The theory of relativity, or simply relativity in physics, usually encompasses two theories by Albert Einstein: special relativity and general relativity'); + $this->assertEquals($newidea->comments,'0'); + $this->assertEquals($newidea->status,'new'); + $this->assertEquals($newidea->categoryid,'2'); + + } + + } diff --git a/tests/cases/_Scripts.php b/tests/cases/_Scripts.php index ef9a74d1..c7edcc47 100644 --- a/tests/cases/_Scripts.php +++ b/tests/cases/_Scripts.php @@ -31,4 +31,28 @@ public static function CreateUser($email = 'newemail@phpback.org', $name = 'Stev )); $test->byName('registration-form')->submit(); } + + public static function LoginUser($email = 'newemail@phpback.org', $password = 'Jobs123') { + $test = self::$instance; + + $test->url('/home/login'); + + $test->fillFields(array( + 'email' => $email, + 'password' => $password + )); + $test->byName('login-form')->submit(); + } + public static function CreateCategory($name = 'Amsterdam') { + $test = self::$instance; + self::LoginAdmin(); + $test->byLinkText('System Settings')->click(); + $test->byLinkText('Categories')->click(); + + $test->fillFields(array( + 'name' => $name, + 'description' => 'Value Category Description' + )); + $test->byName('add-category')->click(); + } } From 0c370bd884ff7c892235cdcd8651fca02ee241e1 Mon Sep 17 00:00:00 2001 From: AntonyAntonio Date: Tue, 26 Jan 2016 20:29:55 -0300 Subject: [PATCH 02/84] Test user - add more some tests --- application/views/admin/dashboard/ideas.php | 10 ++-- application/views/home/view_idea.php | 14 ++--- tests/cases/AdminPanelTest.php | 2 +- tests/cases/UserTest.php | 61 ++++++++++++++++++++- 4 files changed, 72 insertions(+), 15 deletions(-) diff --git a/application/views/admin/dashboard/ideas.php b/application/views/admin/dashboard/ideas.php index cdebb135..f2e4b7d4 100755 --- a/application/views/admin/dashboard/ideas.php +++ b/application/views/admin/dashboard/ideas.php @@ -7,7 +7,7 @@
@@ -218,7 +218,7 @@ Comment: # -
User: +
User: #
Idea: # @@ -229,9 +229,9 @@ - Flagged times + Flagged times
- + 1): ?>
diff --git a/application/views/home/view_idea.php b/application/views/home/view_idea.php index 014d0119..433532c1 100755 --- a/application/views/home/view_idea.php +++ b/application/views/home/view_idea.php @@ -11,10 +11,10 @@ votes <= 99999) { if($idea->votes < 1000) echo $idea->votes; else echo number_format($idea->votes); - } elseif($idea->votes < 1000000){ + } elseif($idea->votes < 1000000){ echo (int) ($idea->votes / 1000); echo "k"; - } else { - echo (int) ($idea->votes / 1000000); + } else { + echo (int) ($idea->votes / 1000000); $t = (int) ($idea->votes / 1000000); if((int) ($idea->votes / 100000) - $t*10 > 0) echo "," . (((int) ($idea->votes / 100000)) - $t*10); @@ -24,7 +24,7 @@
- +
  • id;?>">1
    • @@ -36,7 +36,7 @@
    title; ?>
    content; ?> -
    +
    • authorid; ?>" target="_blank">
      • - +
    @@ -129,7 +129,7 @@
    title); ?>"> - +
diff --git a/tests/cases/AdminPanelTest.php b/tests/cases/AdminPanelTest.php index 09fb0b30..428c191c 100644 --- a/tests/cases/AdminPanelTest.php +++ b/tests/cases/AdminPanelTest.php @@ -124,6 +124,6 @@ public function testDisableBanUser() { $this->byLinkText('Banned List ')->click(); $this->byLinkText('Disable ban')->click(); $passdisbann= RedBean::load('users',3); - $this->assertEquals('0',$passdisbann->banned); + $this->assertEquals($passdisbann->banned,'0'); } } diff --git a/tests/cases/UserTest.php b/tests/cases/UserTest.php index e12e5bdb..9729b7eb 100644 --- a/tests/cases/UserTest.php +++ b/tests/cases/UserTest.php @@ -28,7 +28,7 @@ public function testCreateIdea() { Scripts::LoginUser('newemail2@phpback.org','Gates123'); $this->byLinkText('Post a new idea')->click(); $this->fillFields(array( - 'description' => 'The theory of relativity, or simply relativity in physics, usually encompasses two theories by Albert Einstein: special relativity and general relativity', + 'description' => 'The theory of relativity is strange', 'title' => 'Relativity Theory' )); $this->select($this->byName('category'))->selectOptionByValue('2'); @@ -37,12 +37,69 @@ public function testCreateIdea() { $this->assertEquals($newidea->title,'Relativity Theory'); $this->assertEquals($newidea->authorid,'4'); $this->assertEquals($newidea->votes,'0'); - $this->assertEquals($newidea->content,'The theory of relativity, or simply relativity in physics, usually encompasses two theories by Albert Einstein: special relativity and general relativity'); + $this->assertEquals($newidea->content,'The theory of relativity is strange'); $this->assertEquals($newidea->comments,'0'); $this->assertEquals($newidea->status,'new'); $this->assertEquals($newidea->categoryid,'2'); } + public function testCreateComentary() { + Scripts::LoginUser('newemail2@phpback.org','Gates123'); + $this->url('home/idea/1/Relativity-Theory'); + $this->fillFields(array( + 'content' => 'the theory of relativity is fake.' + )); + $this->byName('commentbutton')->click(); + $newcomment = RedBean::load('comments',1); + $this->assertEquals($newcomment->content,'the theory of relativity is fake.'); + $this->assertEquals($newcomment->ideaid,'1'); + $this->assertEquals($newcomment->userid ,'4'); + } + public function testFlagComment() { + Scripts::LoginUser('newemail2@phpback.org','Gates123'); + $this->url('home/idea/1/Relativity-Theory'); + $this->byLinkText('flag comment')->click(); + $newflag = RedBean::load('flags',1); + $this->assertEquals($newflag->toflagid,'1'); + $this->assertEquals($newflag->userid,'4'); + } + public function testVoteIdea() { + Scripts::LoginUser('newemail2@phpback.org','Gates123'); + $this->url('home/idea/1/Relativity-Theory'); + $this->byName('Vote')->click(); + $this->byLinkText('2 Votes')->click(); + $newvote = RedBean::load('votes',1); + $voteidea = RedBean::load('ideas',1); + $user = RedBean::load('users',4); + $this->assertEquals($newvote->number,'2'); + $this->assertEquals($newvote->userid,'4'); + $this->assertEquals($newvote->ideaid,'1'); + $this->assertEquals($user->votes,'48');//error + $this->assertEquals($voteidea->votes,'2'); + } + public function testDisableVoteIdea() { + Scripts::LoginUser('newemail2@phpback.org','Gates123'); + $this->url('home/profile/4'); + $this->byLinkText('Delete votes')->click(); + $voteidea = RedBean::load('ideas',1); + $this->assertEquals($voteidea->votes,'0'); + } + public function testChangePass() { + Scripts::LoginUser('newemail2@phpback.org','Gates123'); + $this->url('/home/profile/4'); + $this->byLinkText('Change Password')->click(); + $this->fillFields(array( + 'old' => 'Gates123', + 'new' => 'Microsoft123', + 'rnew' => 'Microsoft123' + )); + $this->byLinkText('Change Password')->click(); + $this->byLinkText('Log out')->click(); + Scripts::LoginUser('newemail2@phpback.org','Microsoft123'); + $this->assertEquals($this->url(),'http://localhost:8080/home/'); + $this->assertContains('Logged as Bill Gates',$this->byTag('body')->text()); + } + } From 364b63241635d9533280416264e72dae4e109fff Mon Sep 17 00:00:00 2001 From: Ivan Diaz Date: Mon, 15 Feb 2016 12:28:34 -0300 Subject: [PATCH 03/84] Remove comments --- application/controllers/adminaction.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/application/controllers/adminaction.php b/application/controllers/adminaction.php index 838ae32a..2ee71311 100755 --- a/application/controllers/adminaction.php +++ b/application/controllers/adminaction.php @@ -168,8 +168,8 @@ public function upgrade() { $this->start(3); $update = new AutoUpdate(__DIR__ . '/temp', __DIR__ . '/../../', 60); - $update->setCurrentVersion($this->version); // Current version of your application. This value should be from a database or another file which will be updated with the installation of a new version - $update->setUpdateUrl('http://www.phpback.org/upgrade/'); //Replace the url with your server update url + $update->setCurrentVersion($this->version); + $update->setUpdateUrl('http://www.phpback.org/upgrade/'); $update->checkUpdate(); From 79090f5248b9fa760e436ac9fc2f84df92f8d341 Mon Sep 17 00:00:00 2001 From: pbrun Date: Fri, 26 Feb 2016 13:29:27 +0100 Subject: [PATCH 04/84] [B] Fix encoding error in url with slugify or remove if not necessary --- .gitignore | 1 + application/controllers/action.php | 21 ++++++++++++++++++++- application/libraries/Display.php | 21 ++++++++++++++++++++- application/views/_templates/header.php | 2 +- application/views/admin/dashboard/ideas.php | 6 ++---- application/views/admin/dashboard/users.php | 4 ++-- 6 files changed, 46 insertions(+), 9 deletions(-) diff --git a/.gitignore b/.gitignore index 8fa0d0b9..053e1221 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ application/config/database.php sftp-config.json +.idea \ No newline at end of file diff --git a/application/controllers/action.php b/application/controllers/action.php index 9be61146..cf3ca560 100755 --- a/application/controllers/action.php +++ b/application/controllers/action.php @@ -120,7 +120,26 @@ public function vote($votes, $ideaid){ exit; } $idea = $this->get->getIdea($ideaid); - header("Location: " . base_url() . 'home/idea/' . $ideaid . '/' . str_replace(' ', '-', $idea->title)); + header("Location: " . base_url() . 'home/idea/' . $ideaid . '/' . $this->slugify($idea->title)); + } + + public function slugify($text) + { + // replace non letter or digits by - + $text = preg_replace('~[^\\pL\d]+~u', '-', $text); + // trim + $text = trim($text, '-'); + // transliterate + $text = iconv('utf-8', 'us-ascii//TRANSLIT', $text); + // lowercase + $text = strtolower($text); + // remove unwanted characters + $text = preg_replace('~[^-\w]+~', '', $text); + + if (empty($text)) { + return 'n-a'; + } + return $text; } public function unvote($id){ diff --git a/application/libraries/Display.php b/application/libraries/Display.php index 51f523b0..9f577239 100644 --- a/application/libraries/Display.php +++ b/application/libraries/Display.php @@ -3,6 +3,25 @@ class Display { public function getParsedString($string) { - return str_replace(' ', '-', $string); + return $this->slugify($string); + } + + public function slugify($text) + { + // replace non letter or digits by - + $text = preg_replace('~[^\\pL\d]+~u', '-', $text); + // trim + $text = trim($text, '-'); + // transliterate + $text = iconv('utf-8', 'us-ascii//TRANSLIT', $text); + // lowercase + $text = strtolower($text); + // remove unwanted characters + $text = preg_replace('~[^-\w]+~', '', $text); + + if (empty($text)) { + return 'n-a'; + } + return $text; } } \ No newline at end of file diff --git a/application/views/_templates/header.php b/application/views/_templates/header.php index b7c7f5b5..cbf3503c 100644 --- a/application/views/_templates/header.php +++ b/application/views/_templates/header.php @@ -59,7 +59,7 @@ function popup_sure(text, url) {
- "> +
diff --git a/application/views/admin/dashboard/ideas.php b/application/views/admin/dashboard/ideas.php index f2e4b7d4..6c471ed7 100755 --- a/application/views/admin/dashboard/ideas.php +++ b/application/views/admin/dashboard/ideas.php @@ -40,7 +40,6 @@ - title); ?> - " target="_blank">title; ?> + title; ?> categoryid]->name; ?> @@ -167,7 +166,6 @@ - title); ?> - " target="_blank">title; ?> + title; ?> categoryid]->name; ?> diff --git a/application/views/admin/dashboard/users.php b/application/views/admin/dashboard/users.php index e67628fb..fa4dcfb5 100755 --- a/application/views/admin/dashboard/users.php +++ b/application/views/admin/dashboard/users.php @@ -41,7 +41,7 @@ name); ?> - #id;?> + #id;?> name; ?> @@ -76,7 +76,7 @@ name); ?> - #id;?> + #id;?> name; ?> From f0ee94b6ec9752e8aacf9ba3addd430ea4d8efb1 Mon Sep 17 00:00:00 2001 From: pbrun Date: Fri, 4 Mar 2016 15:22:48 +0100 Subject: [PATCH 05/84] [U] Change to have only one slugify function, and slugify all url --- application/controllers/action.php | 21 +-------------------- application/controllers/admin.php | 1 + application/libraries/Display.php | 7 ++++++- application/views/_templates/header.php | 2 +- application/views/admin/dashboard/ideas.php | 6 ++++-- application/views/admin/dashboard/users.php | 6 +++--- 6 files changed, 16 insertions(+), 27 deletions(-) diff --git a/application/controllers/action.php b/application/controllers/action.php index cf3ca560..54e1ffb4 100755 --- a/application/controllers/action.php +++ b/application/controllers/action.php @@ -120,26 +120,7 @@ public function vote($votes, $ideaid){ exit; } $idea = $this->get->getIdea($ideaid); - header("Location: " . base_url() . 'home/idea/' . $ideaid . '/' . $this->slugify($idea->title)); - } - - public function slugify($text) - { - // replace non letter or digits by - - $text = preg_replace('~[^\\pL\d]+~u', '-', $text); - // trim - $text = trim($text, '-'); - // transliterate - $text = iconv('utf-8', 'us-ascii//TRANSLIT', $text); - // lowercase - $text = strtolower($text); - // remove unwanted characters - $text = preg_replace('~[^-\w]+~', '', $text); - - if (empty($text)) { - return 'n-a'; - } - return $text; + header("Location: " . base_url() . 'home/idea/' . $ideaid . '/' . Display::slugify($idea->title)); } public function unvote($id){ diff --git a/application/controllers/admin.php b/application/controllers/admin.php index 5843199a..768ca61b 100755 --- a/application/controllers/admin.php +++ b/application/controllers/admin.php @@ -112,6 +112,7 @@ public function ideas(){ $data['toall'] = 1; } $data['ideas'] = $this->get->getIdeas($data['form']['orderby'], $data['form']['isdesc'], 0, 150, $st, $cat); + $this->load->view('admin/dashboard/header', $data); $this->load->view('admin/dashboard/ideas', $data); } diff --git a/application/libraries/Display.php b/application/libraries/Display.php index 9f577239..93b4b72d 100644 --- a/application/libraries/Display.php +++ b/application/libraries/Display.php @@ -2,11 +2,16 @@ class Display { + /** + * @param $string + * @return mixed|string + * @deprecated use slugify static instead keep for retrocompatibility + */ public function getParsedString($string) { return $this->slugify($string); } - public function slugify($text) + public static function slugify($text) { // replace non letter or digits by - $text = preg_replace('~[^\\pL\d]+~u', '-', $text); diff --git a/application/views/_templates/header.php b/application/views/_templates/header.php index cbf3503c..b9a606a2 100644 --- a/application/views/_templates/header.php +++ b/application/views/_templates/header.php @@ -59,7 +59,7 @@ function popup_sure(text, url) {
- +
diff --git a/application/views/admin/dashboard/ideas.php b/application/views/admin/dashboard/ideas.php index 6c471ed7..d0a1daad 100755 --- a/application/views/admin/dashboard/ideas.php +++ b/application/views/admin/dashboard/ideas.php @@ -40,6 +40,7 @@ + title); ?> - title; ?> + " target="_blank">title; ?> categoryid]->name; ?> @@ -166,6 +167,7 @@ + title); ?> - title; ?> + " target="_blank">title; ?> categoryid]->name; ?> diff --git a/application/views/admin/dashboard/users.php b/application/views/admin/dashboard/users.php index fa4dcfb5..09e4817e 100755 --- a/application/views/admin/dashboard/users.php +++ b/application/views/admin/dashboard/users.php @@ -38,10 +38,10 @@ - name); ?> + name); ?> - #id;?> + #id;?> name; ?> @@ -76,7 +76,7 @@ name); ?> - #id;?> + #id;?> name; ?> From 350e5aca9a78a0ad1fcdf134422ad3c9ab2a6116 Mon Sep 17 00:00:00 2001 From: Steven Slopek Date: Wed, 16 Mar 2016 02:30:55 -0400 Subject: [PATCH 06/84] omit id column from install inserts --- install/install1.php | 2 +- install/install2.php | 24 ++++++++++++------------ 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/install/install1.php b/install/install1.php index f58bcfeb..e8de4635 100644 --- a/install/install1.php +++ b/install/install1.php @@ -157,7 +157,7 @@ function createDbConfigFile($hostname, $username, $password, $database) { header('Location: ../admin'); exit; } else { - $server->query("INSERT INTO users(id,name,email,pass,votes,isadmin,banned) VALUES('','" . $_POST['adminname'] . "','" . $_POST['adminemail'] . "','" . $hashing->hash($_POST['adminpass']) . "', 20, 3,0)"); + $server->query("INSERT INTO users(name,email,pass,votes,isadmin,banned) VALUES('" . $_POST['adminname'] . "','" . $_POST['adminemail'] . "','" . $hashing->hash($_POST['adminpass']) . "', 20, 3,0)"); if (!@chmod('../install', 0777)) { $url = getBaseUrl(); diff --git a/install/install2.php b/install/install2.php index 879c3a5c..8e3a59b2 100644 --- a/install/install2.php +++ b/install/install2.php @@ -24,18 +24,18 @@ exit(2); } -$mysql->multi_query("INSERT INTO `settings` (`id`, `name`, `value`) VALUES -('', 'recaptchapublic', '". $_POST['rpublic'] ."'), -('', 'recaptchaprivate', '". $_POST['rprivate'] ."'), -('', 'maxvotes', '". ((isset($_POST['maxvotes']) && $_POST['maxvotes'] != '')? $_POST['maxvotes'] : 20)."'), -('', 'mainmail', '". $_POST['mainmail'] ."'), -('', 'title', '". $_POST['title'] ."'), -('', 'max_results', '".((isset($_POST['max_results']) && $_POST['max_results'] != '')? $_POST['max_results'] : 10)."'), -('', 'language', '".(isset($_POST['language'])? $_POST['language'] : 'english')."'), -('', 'smtp-host', '". $_POST['smtp-host'] ."'), -('', 'smtp-port', '". $_POST['smtp-port'] ."'), -('', 'smtp-user', '". $_POST['smtp-user'] ."'), -('', 'smtp-pass', '". $_POST['smtp-password'] ."');"); +$mysql->multi_query("INSERT INTO `settings` (`name`, `value`) VALUES +('recaptchapublic', '". $_POST['rpublic'] ."'), +('recaptchaprivate', '". $_POST['rprivate'] ."'), +('maxvotes', '". ((isset($_POST['maxvotes']) && $_POST['maxvotes'] != '')? $_POST['maxvotes'] : 20)."'), +('mainmail', '". $_POST['mainmail'] ."'), +('title', '". $_POST['title'] ."'), +('max_results', '".((isset($_POST['max_results']) && $_POST['max_results'] != '')? $_POST['max_results'] : 10)."'), +('language', '".(isset($_POST['language'])? $_POST['language'] : 'english')."'), +('smtp-host', '". $_POST['smtp-host'] ."'), +('smtp-port', '". $_POST['smtp-port'] ."'), +('smtp-user', '". $_POST['smtp-user'] ."'), +('smtp-pass', '". $_POST['smtp-password'] ."');"); if(unlink('index2.php') && unlink('install2.php')) { header('Location: ../admin'); From fad2a53254c8be6ba3d9e2876a735b7a6f4c7a2f Mon Sep 17 00:00:00 2001 From: Steven Slopek Date: Wed, 16 Mar 2016 02:41:21 -0400 Subject: [PATCH 07/84] omit empty string set to id --- application/models/post.php | 7 ------- 1 file changed, 7 deletions(-) diff --git a/application/models/post.php b/application/models/post.php index da397ff8..9f9c6067 100755 --- a/application/models/post.php +++ b/application/models/post.php @@ -34,7 +34,6 @@ public function add_user($name, $email, $pass, $votes, $isadmin){ if($isadmin){ $data = array( - 'id' => '', 'name' => $name, 'email' => $email, 'pass' => $pass, @@ -44,7 +43,6 @@ public function add_user($name, $email, $pass, $votes, $isadmin){ } else{ $data = array( - 'id' => '', 'name' => $name, 'email' => $email, 'pass' => $pass, @@ -65,7 +63,6 @@ public function add_idea($title, $content, $author_id, $category_id){ $category_id = (int) $category_id; if($author_id < 1 || $category_id < 1) return false; $data = array( - 'id' => '', 'title' => $title, 'content' => $content, 'authorid' => $author_id, @@ -90,7 +87,6 @@ public function add_comment($idea_id, $comment, $user_id){ if($idea_id < 1 || $user_id < 1) return false; $data = array( - 'id' => '', 'content' => $comment, 'ideaid' => $idea_id, 'userid' => $user_id, @@ -125,7 +121,6 @@ public function vote($idea_id, $user_id, $votes){ if(!$sql->num_rows()){ if($votes <= $USER->votes){ $data = array( - 'id' => '', 'ideaid' => $idea_id, 'userid' => $user_id, 'number' => $votes, @@ -259,7 +254,6 @@ public function approveidea($id){ public function log($string, $to, $toid){ $toid = (int) $toid; $data = array( - 'id' => '', 'content' => $string, 'date' => date("d/m/y H:i"), 'type' => $to, @@ -270,7 +264,6 @@ public function log($string, $to, $toid){ public function add_category($name, $description){ $data = array( - 'id' => '', 'name' => $name, 'description' => $description, 'ideas' => 0, From 003da2ccec9bad914bfd680ec4a6d2252e7c3374 Mon Sep 17 00:00:00 2001 From: Steven Slopek Date: Wed, 16 Mar 2016 02:43:47 -0400 Subject: [PATCH 08/84] fix delete comment on idea --- application/views/home/view_idea.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/application/views/home/view_idea.php b/application/views/home/view_idea.php index 433532c1..4aefcc8e 100755 --- a/application/views/home/view_idea.php +++ b/application/views/home/view_idea.php @@ -143,7 +143,7 @@ id; ?> - + title);?>"> From 84d61a444c5242aac8a9fa9b221c1e9231d3bc70 Mon Sep 17 00:00:00 2001 From: Steven Slopek Date: Wed, 16 Mar 2016 03:12:46 -0400 Subject: [PATCH 09/84] spelling in README --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 20a339d5..4a4185ff 100644 --- a/README.md +++ b/README.md @@ -2,10 +2,10 @@ ##About -PHPBack is an open source feedback system you can use for your website. It gives your customers a way to communicate their ideas to improve your products. User feedback has proved to be really efective even if you have a community project or a commercial project. +PHPBack is an open source feedback system you can use for your website. It gives your customers a way to communicate their ideas to improve your products. User feedback has proved to be really effective even if you have a community project or a commercial project. Please, vist our website for more information: [http://www.phpback.org/](http://www.phpback.org/) -##Requeriments +##Requirements * PHP 5.3+ * MySQL 4.1+ From c4e7829a35ddf823328076c079868487bc5f6269 Mon Sep 17 00:00:00 2001 From: Ivan Diaz Date: Fri, 25 Mar 2016 15:53:53 -0300 Subject: [PATCH 10/84] Add editable welcome text --- application/controllers/home.php | 66 +++++++++++++++----------------- application/views/home/index.php | 4 +- install/install2.php | 7 +++- 3 files changed, 37 insertions(+), 40 deletions(-) diff --git a/application/controllers/home.php b/application/controllers/home.php index 7223facd..9bdf97f7 100755 --- a/application/controllers/home.php +++ b/application/controllers/home.php @@ -27,9 +27,10 @@ public function index() { $this->autoLoginByCookie(); //Use this function to parse $freename variables getDisplayHelpers(); - $data['categories'] = $this->get->getCategories(); - $data['title'] = $this->get->getSetting('title'); - $data['lang'] = $this->lang->language; + $data = $this->getDefaultData(); + $data['welcomeTitle'] = $this->get->getSetting('welcometext-title'); + $data['welcomeDescription'] = $this->get->getSetting('welcometext-description'); + $data['ideas'] = array( 'completed' => $this->get->getIdeas('id', 1, 0, 10, array('completed')), 'started' => $this->get->getIdeas('id', 1, 0, 10, array('started')), @@ -44,16 +45,15 @@ public function index() { } - public function category($id, $name = "", $order = "votes", $type = "desc", $page = '1') - { - if(!$this->get->categoryExists($id)){ + public function category($id, $name = "", $order = "votes", $type = "desc", $page = '1') { + if (!$this->get->categoryExists($id)){ header('Location: ' . base_url() . 'home'); return; } + + $data = $this->getDefaultData(); $data['ideas'] = $this->get->getIdeasByCategory($id, $order, $type, $page); - $data['categories'] = $this->get->getCategories(); $data['category'] = $data['categories'][$id]; - $data['title'] = $this->get->getSetting('title'); $total = $this->get->getQuantityOfApprovedIdeas($id); $data['max_results'] = (int) $this->get->getSetting('max_results'); $data['page'] = (int) $page; @@ -62,8 +62,6 @@ public function category($id, $name = "", $order = "votes", $type = "desc", $pag $data['type'] = $type; $data['order'] = $order; - $data['lang'] = $this->lang->language; - $this->load->view('_templates/header', $data); $this->load->view('home/category_ideas', $data); $this->load->view('_templates/menu', $data); @@ -71,12 +69,10 @@ public function category($id, $name = "", $order = "votes", $type = "desc", $pag } public function search() { + $data = $this->getDefaultData(); + $query = $this->input->post('query'); $data['ideas'] = $this->get->getIdeasBySearchQuery($query); - $data['categories'] = $this->get->getCategories(); - $data['title'] = $this->get->getSetting('title'); - - $data['lang'] = $this->lang->language; $this->load->view('_templates/header', $data); $this->load->view('home/search_results', $data); @@ -95,17 +91,16 @@ public function idea($id) { $ideaUserName = $this->get->getUser($idea->authorid)->name; $idea->user = $ideaUserName; $comments = $this->get->getCommentsByIdea($id); + foreach($comments as $comment){ $userName = $this->get->getUser($comment->userid)->name; $comment->user = $userName; } - $data['title'] = $this->get->getSetting('title'); + + $data = $this->getDefaultData(); $data['comments'] = $comments; - $data['categories'] = $this->get->getCategories(); $data['idea'] = $idea; - $data['lang'] = $this->lang->language; - $this->load->view('_templates/header', $data); $this->load->view('home/view_idea', $data); $this->load->view('_templates/menu', $data); @@ -114,24 +109,25 @@ public function idea($id) { public function profile($id, $error=0) { + $data = $this->getDefaultData(); + $data['user'] = $this->get->getUser($id); - if($data['user'] === false){ + + if ($data['user'] === false) { header('Location: ' . base_url() . 'home'); return; } + $data['logs'] = $this->get->get_logs('user', $id); $data['comments'] = $this->get->getUserComments($id, 20); - $data['categories'] = $this->get->getCategories(); $data['ideas'] = $this->get->getUserIdeas($id); - $data['title'] = $this->get->getSetting('title'); + $data['error'] = $this->input->post('error', true); if(@isset($_SESSION['phpback_userid']) && $data['user']->id == $_SESSION['phpback_userid']){ $data['votes'] = $this->get->getUserVotes($_SESSION['phpback_userid']); } - $data['lang'] = $this->lang->language; - $this->load->view('_templates/header', $data); $this->load->view('home/user', $data); $this->load->view('_templates/menu', $data); @@ -156,13 +152,10 @@ public function login($error = "NULL", $ban=0) { return; } - $data['categories'] = $this->get->getCategories(); - $data['title'] = $this->get->getSetting('title'); + $data = $this->getDefaultData(); $data['error'] = $error; $data['ban'] = $ban; - $data['lang'] = $this->lang->language; - $this->load->view('_templates/header', $data); $this->load->view('home/login', $data); $this->load->view('_templates/menu', $data); @@ -170,8 +163,7 @@ public function login($error = "NULL", $ban=0) { } public function postidea($error = "none") { - $data['categories'] = $this->get->getCategories(); - $data['title'] = $this->get->getSetting('title'); + $data = $this->getDefaultData(); $data['error'] = $error; $data['POST'] = array( 'title' => $this->input->post('title'), @@ -179,8 +171,6 @@ public function postidea($error = "none") { 'desc' => $this->input->post('desc') ); - $data['lang'] = $this->lang->language; - $this->load->view('_templates/header', $data); $this->load->view('home/post_idea', $data); $this->load->view('_templates/menu', $data); @@ -188,20 +178,24 @@ public function postidea($error = "none") { } public function register($error = "NULL") { - + $data = $this->getDefaultData(); $data['recaptchapublic'] = $this->get->getSetting('recaptchapublic'); - $data['categories'] = $this->get->getCategories(); - $data['title'] = $this->get->getSetting('title'); $data['error'] = $error; - $data['lang'] = $this->lang->language; - $this->load->view('_templates/header', $data); $this->load->view('home/register', $data); $this->load->view('_templates/menu', $data); $this->load->view('_templates/footer', $data); } + private function getDefaultData() { + return array( + 'title' => $this->get->getSetting('title'), + 'categories' => $this->get->getCategories(), + 'lang' => $this->lang->language, + ); + } + private function verifyBanning() { if (@isset($_SESSION['phpback_userid']) && ($ban = $this->get->getBanValue($_SESSION['phpback_userid'])) != 0) { date_default_timezone_set('America/Los_Angeles'); diff --git a/application/views/home/index.php b/application/views/home/index.php index a914fab5..6055ad06 100755 --- a/application/views/home/index.php +++ b/application/views/home/index.php @@ -6,8 +6,8 @@
-

Welcome to our FeedBack

-
Here you can suggest ideas to improve our services or vote on ideas from other people.
+

+

diff --git a/install/install2.php b/install/install2.php index 8e3a59b2..82ae481c 100644 --- a/install/install2.php +++ b/install/install2.php @@ -25,13 +25,16 @@ } $mysql->multi_query("INSERT INTO `settings` (`name`, `value`) VALUES +('title', '". $_POST['title'] ."'), +('welcometext-title', 'Welcome to our feedback'), +('welcometext-description', 'Here you can suggest ideas to improve our services or vote on ideas from other people'), +('recaptchapublic', '". $_POST['rpublic'] ."'), ('recaptchapublic', '". $_POST['rpublic'] ."'), ('recaptchaprivate', '". $_POST['rprivate'] ."'), +('language', '".(isset($_POST['language'])? $_POST['language'] : 'english')."'), ('maxvotes', '". ((isset($_POST['maxvotes']) && $_POST['maxvotes'] != '')? $_POST['maxvotes'] : 20)."'), ('mainmail', '". $_POST['mainmail'] ."'), -('title', '". $_POST['title'] ."'), ('max_results', '".((isset($_POST['max_results']) && $_POST['max_results'] != '')? $_POST['max_results'] : 10)."'), -('language', '".(isset($_POST['language'])? $_POST['language'] : 'english')."'), ('smtp-host', '". $_POST['smtp-host'] ."'), ('smtp-port', '". $_POST['smtp-port'] ."'), ('smtp-user', '". $_POST['smtp-user'] ."'), From 53273e4ae3447375c3759403da450fc59f51f063 Mon Sep 17 00:00:00 2001 From: Ivan Diaz Date: Fri, 25 Mar 2016 18:43:31 -0300 Subject: [PATCH 11/84] [Fix] Unvote an idea should return votes --- application/controllers/action.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/application/controllers/action.php b/application/controllers/action.php index 54e1ffb4..5a6a7a96 100755 --- a/application/controllers/action.php +++ b/application/controllers/action.php @@ -126,11 +126,16 @@ public function vote($votes, $ideaid){ public function unvote($id){ session_start(); $vote = $this->get->get_row_by_id('votes', $id); - if(isset($_SESSION['phpback_userid']) && $_SESSION['phpback_userid'] == $vote->userid){ + + if ($vote && isset($_SESSION['phpback_userid']) && $_SESSION['phpback_userid'] == $vote->userid) { $idea = $this->get->getIdea($vote->ideaid); + $user = $this->get->getUser($vote->userid); + $this->post->update_by_id('ideas', 'votes', $idea->votes - $vote->number, $idea->id); + $this->post->update_by_id('users', 'votes', $user->votes + $vote->number, $user->id); $this->post->delete_row_by_id('votes', $id); } + header('Location:' . base_url() . 'home/profile/' . $vote->userid); } From 37e6dab442c510a86ca6056cc514a2d7f2398c47 Mon Sep 17 00:00:00 2001 From: Ivan Diaz Date: Fri, 25 Mar 2016 19:08:15 -0300 Subject: [PATCH 12/84] [Release] v1.3.0 --- application/controllers/admin.php | 2 +- application/controllers/adminaction.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/application/controllers/admin.php b/application/controllers/admin.php index 768ca61b..afb178d5 100755 --- a/application/controllers/admin.php +++ b/application/controllers/admin.php @@ -19,7 +19,7 @@ public function __construct(){ $this->load->helper('url'); $this->load->model('get'); - $this->version = '1.2.0'; + $this->version = '1.3.0'; } public function index($error = 'no'){ diff --git a/application/controllers/adminaction.php b/application/controllers/adminaction.php index 2ee71311..a3776197 100755 --- a/application/controllers/adminaction.php +++ b/application/controllers/adminaction.php @@ -23,7 +23,7 @@ public function __construct(){ $this->lang->load('log', $this->get->getSetting('language')); - $this->version = '1.2.0'; + $this->version = '1.3.0'; } public function login(){ From 448ac492db89b6ebd01e05700aefdf6364e43c51 Mon Sep 17 00:00:00 2001 From: Ivan Diaz Date: Wed, 6 Apr 2016 14:09:09 -0300 Subject: [PATCH 13/84] Fix #52 - Idea should be considered to count in category --- application/models/post.php | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/application/models/post.php b/application/models/post.php index f978cf2f..962abd47 100755 --- a/application/models/post.php +++ b/application/models/post.php @@ -222,7 +222,10 @@ public function deleteidea($id){ } $cat = $this->get_row_by_id('categories', $idea->categoryid); - $this->update_by_id('categories', 'ideas', $cat->ideas - 1, $cat->id); + + if ($cat->status !== 'considered') { + $this->update_by_id('categories', 'ideas', $cat->ideas - 1, $cat->id); + } $this->db->query("DELETE FROM ideas WHERE id='$id'"); } @@ -297,4 +300,4 @@ private function getSetting($name){ } } -?> \ No newline at end of file +?> From b8f48802cfab0b7352d54239d5246e06587917f4 Mon Sep 17 00:00:00 2001 From: Ivan Diaz Date: Wed, 6 Apr 2016 14:11:20 -0300 Subject: [PATCH 14/84] Fix #52 - Idea should not be new to be counted --- application/models/post.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/application/models/post.php b/application/models/post.php index 962abd47..92aa9616 100755 --- a/application/models/post.php +++ b/application/models/post.php @@ -223,7 +223,7 @@ public function deleteidea($id){ $cat = $this->get_row_by_id('categories', $idea->categoryid); - if ($cat->status !== 'considered') { + if ($cat->status !== 'new') { $this->update_by_id('categories', 'ideas', $cat->ideas - 1, $cat->id); } From 1543e1873efee9a4aa5aceeed96c01f8cc8190de Mon Sep 17 00:00:00 2001 From: Daniel Mota Date: Wed, 6 Apr 2016 20:50:43 +0100 Subject: [PATCH 15/84] Add portuguese (European) language Creating translations for portuguese (European) language --- .../portuguese-european/default_lang.php | 77 +++++++++++++++++++ 1 file changed, 77 insertions(+) create mode 100644 application/language/portuguese-european/default_lang.php diff --git a/application/language/portuguese-european/default_lang.php b/application/language/portuguese-european/default_lang.php new file mode 100644 index 00000000..2554459b --- /dev/null +++ b/application/language/portuguese-european/default_lang.php @@ -0,0 +1,77 @@ + Date: Wed, 6 Apr 2016 20:53:24 +0100 Subject: [PATCH 16/84] Add portuguese (European) language Creating translations for portuguese (European) language --- application/language/portuguese-european/index.html | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 application/language/portuguese-european/index.html diff --git a/application/language/portuguese-european/index.html b/application/language/portuguese-european/index.html new file mode 100644 index 00000000..2cbfe340 --- /dev/null +++ b/application/language/portuguese-european/index.html @@ -0,0 +1,10 @@ + + + 403 Proibido + + + +

O acesso a este directório foi-lhe negado.

+ + + From 5a9849dc7c391fd65a0cb85f39460bcec959d8c0 Mon Sep 17 00:00:00 2001 From: Daniel Mota Date: Wed, 6 Apr 2016 20:55:54 +0100 Subject: [PATCH 17/84] Add portuguese (European) language Creating translations for portuguese (European) language --- .../language/portuguese-european/log_lang.php | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 application/language/portuguese-european/log_lang.php diff --git a/application/language/portuguese-european/log_lang.php b/application/language/portuguese-european/log_lang.php new file mode 100644 index 00000000..97543cd5 --- /dev/null +++ b/application/language/portuguese-european/log_lang.php @@ -0,0 +1,18 @@ + Date: Wed, 6 Apr 2016 20:15:47 -0300 Subject: [PATCH 18/84] Fix #52 - Change category to idea --- application/models/post.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/application/models/post.php b/application/models/post.php index 92aa9616..e4288a85 100755 --- a/application/models/post.php +++ b/application/models/post.php @@ -223,7 +223,7 @@ public function deleteidea($id){ $cat = $this->get_row_by_id('categories', $idea->categoryid); - if ($cat->status !== 'new') { + if ($idea->status !== 'new') { $this->update_by_id('categories', 'ideas', $cat->ideas - 1, $cat->id); } From c2a79bc4f1dee2c744308603dad5cb9ab7d73e83 Mon Sep 17 00:00:00 2001 From: Ivan Diaz Date: Mon, 18 Apr 2016 16:04:30 -0300 Subject: [PATCH 19/84] Fix possible SQL vulnerabilities --- application/controllers/admin.php | 24 +++++++++++++++++++- application/models/get.php | 25 ++++++++++++++++----- application/models/post.php | 9 +++++++- application/views/admin/dashboard/ideas.php | 4 ++-- 4 files changed, 52 insertions(+), 10 deletions(-) diff --git a/application/controllers/admin.php b/application/controllers/admin.php index afb178d5..24a94423 100755 --- a/application/controllers/admin.php +++ b/application/controllers/admin.php @@ -45,6 +45,7 @@ public function index($error = 'no'){ exit; } } + public function dashboard(){ $this->start(); $data = array(); @@ -55,6 +56,7 @@ public function dashboard(){ $this->load->view('admin/dashboard/header'); $this->load->view('admin/dashboard/index', $data); } + public function ideas(){ $this->start(); $data = array(); @@ -111,6 +113,11 @@ public function ideas(){ } $data['toall'] = 1; } + + $this->redirectIfNotAlphaNumeric(array( + $data['form']['orderby'] + )); + $data['ideas'] = $this->get->getIdeas($data['form']['orderby'], $data['form']['isdesc'], 0, 150, $st, $cat); $this->load->view('admin/dashboard/header', $data); @@ -119,12 +126,15 @@ public function ideas(){ public function users($idban=0){ $this->start(2); $data = array(); + $data['users'] = $this->get->get_users(); $data['banned'] = $this->get->get_users('banned', 100); + if($idban) $data['idban'] = $idban; $this->load->view('admin/dashboard/header', $data); $this->load->view('admin/dashboard/users', $data); } + public function system(){ $this->start(3); $data = array(); @@ -153,5 +163,17 @@ private function start($level = 1){ exit; } } + + private function redirectIfNotAlphaNumeric($textList) { + foreach ($textList as $text) { + if (!$this->isAlphaNumeric($text)) { + header('Location: ' . base_url() . 'admin/'); + exit; + } + } + } + + private function isAlphaNumeric($text) { + return ctype_alnum($text); + } } -?> diff --git a/application/models/get.php b/application/models/get.php index ba165155..41ff522d 100755 --- a/application/models/get.php +++ b/application/models/get.php @@ -57,7 +57,8 @@ public function getIdeas($orderby, $isdesc, $from, $limit, $status = array(), $c if (count($categories)) { $query .= "WHERE ( "; foreach ($categories as $catid) { - $query .= "categoryid='$catid' OR "; + $sanitizedCategoryId = (int) $catid; + $query .= "categoryid='$sanitizedCategoryId' OR "; } $query = substr($query, 0, -3); $query .= ") "; @@ -66,11 +67,14 @@ public function getIdeas($orderby, $isdesc, $from, $limit, $status = array(), $c if (count($categories)) $query .= "AND ("; else $query .= "WHERE ( "; foreach ($status as $s) { + $s = $this->db->escape($s); + $query .= "status='$s' OR "; } $query = substr($query, 0, -3); $query .= ") "; } + $orderby = $this->db->escape($orderby); $query .= "ORDER BY $orderby "; if ($isdesc) $query .= "DESC"; @@ -122,18 +126,20 @@ public function getIdeasByCategory($category, $order, $type, $page){ public function getIdeasBySearchQuery($query){ $keywords = explode(" ", $query); - $temp = array_shift($keywords); + $temp = $this->db->escape(array_shift($keywords)); $query = "SELECT * FROM ideas WHERE ( title LIKE '%$temp%'"; - foreach($keywords as $key){ - $query .= " OR title LIKE '%$key%'"; + foreach($keywords as $key) { + $escapedKey = $this->db->escape($key); + $query .= " OR title LIKE '%$escapedKey%'"; } $query .= ") ORDER BY CASE "; $query .= " WHEN title LIKE '$temp%' THEN 0 "; $query .= " WHEN title LIKE '%$temp%' THEN 2 "; foreach($keywords as $id => $key){ - $query .= " WHEN title LIKE '$key%' THEN ". ($id+1) ." "; - $query .= " WHEN title LIKE '%$key%' THEN ". ($id + 3) . " "; + $escapedKey = $this->db->escape($key); + $query .= " WHEN title LIKE '$escapedKey%' THEN ". ($id+1) ." "; + $query .= " WHEN title LIKE '%$escapedKey%' THEN ". ($id + 3) . " "; } $query .= "END"; @@ -179,6 +185,9 @@ public function get_all_settings(){ public function get_row_by_id($table, $id){ $id = (int) $id; + + if (!$this->isValidTable($table)) return false; + $sql = $this->db->query("SELECT * FROM $table WHERE id='$id'"); if($sql->num_rows() == 0) return false; return $sql->row(); @@ -383,4 +392,8 @@ private function decorateCategories(&$categories) { $category->url .= $this->display->getParsedString($category->name); } } + + private function isValidTable($table) { + return ctype_alnum($table) || $table === '_session'; + } } \ No newline at end of file diff --git a/application/models/post.php b/application/models/post.php index e4288a85..779b312a 100755 --- a/application/models/post.php +++ b/application/models/post.php @@ -28,7 +28,7 @@ public function add_user($name, $email, $pass, $votes, $isadmin){ $isadmin = (int) $isadmin; if($votes < 1) return false; - $sql = $this->db->query("SELECT id FROM users WHERE email='" . $email . "'"); + $sql = $this->db->query("SELECT id FROM users WHERE email='" . $this->db->escape($email) . "'"); if($sql->num_rows()) return false; @@ -155,12 +155,18 @@ public function updateadmin($id, $level){ public function update_by_id($table, $field, $value, $id){ $id = (int) $id; + $table = $this->db->escape($table); + $field = $this->db->escape($field); + $value = $this->db->escape($value); + $query = "UPDATE $table SET $field='$value' WHERE id='$id'"; $this->db->query($query); } public function delete_row_by_id($table, $id){ $id = (int) $id; + $table = $this->db->escape($table); + $this->db->query("DELETE FROM $table WHERE id='$id'"); } @@ -254,6 +260,7 @@ public function change_status($ideaid, $status){ } public function approveidea($id){ + $id = (int) $id; $idea = $this->db->query("SELECT * FROM ideas WHERE id='$id'")->row(); $category = $this->get_row_by_id('categories', $idea->categoryid); diff --git a/application/views/admin/dashboard/ideas.php b/application/views/admin/dashboard/ideas.php index d0a1daad..4295935c 100755 --- a/application/views/admin/dashboard/ideas.php +++ b/application/views/admin/dashboard/ideas.php @@ -80,7 +80,7 @@
- +
diff --git a/application/views/home/user.php b/application/views/home/user.php index 8c3b1d6d..68286007 100755 --- a/application/views/home/user.php +++ b/application/views/home/user.php @@ -43,20 +43,18 @@ - - \ No newline at end of file + \ No newline at end of file diff --git a/install/index.php b/install/index.php index 0992a6bb..ed922df5 100644 --- a/install/index.php +++ b/install/index.php @@ -46,7 +46,7 @@ - - - From 5c1d31b6212e0641d88e611b8b853fd5758cd466 Mon Sep 17 00:00:00 2001 From: Petras98 Date: Sat, 10 Dec 2016 11:32:23 -0700 Subject: [PATCH 55/84] Revert "Revert "Made forms more error-friendly"" This reverts commit 0fb6fbd7c60c4fd14de9eff0e890f8ead9e90008. --- application/views/home/login.php | 4 +-- application/views/home/post_idea.php | 8 +++--- application/views/home/register.php | 35 ++++++++++++++++++++----- application/views/home/user.php | 29 +++++++++++++++++---- install/index.php | 39 +++++++++++++++++++++------- 5 files changed, 87 insertions(+), 28 deletions(-) diff --git a/application/views/home/login.php b/application/views/home/login.php index ee067aa9..552c819a 100755 --- a/application/views/home/login.php +++ b/application/views/home/login.php @@ -13,11 +13,11 @@
- +
- +