./inc/modules/admin/what-config_admins.php:108: // @TODO Rewrite this to a filter
./inc/modules/admin/what-config_admins.php:136: // @TODO Rewrite this to filter 'run_sqls'
./inc/modules/admin/what-config_mods.php:55: // @TODO This can be moved into mysql-function.php, see checkModulePermissions() function
-./inc/modules/admin/what-config_points.php:111: // @TODO Rewrite this to a filter
+./inc/modules/admin/what-config_points.php:110: // @TODO Rewrite this to a filter
./inc/modules/admin/what-config_rallye_prices.php:195: // @TODO Rewrite these two constants
./inc/modules/admin/what-config_register.php:75: // @TODO Move this HTML code into a template
./inc/modules/admin/what-del_email.php:61: // @TODO Unused: cat_id, payment_id
./inc/modules/guest/what-sponsor_reg.php:287: // @TODO Maybe a default referal id?
./inc/modules/guest/what-stats.php:100: // @TODO This can be somehow rewritten
./inc/modules/guest/what-stats.php:74:// @TODO This can be rewritten in a dynamic include
-./inc/modules/member/what-beg2.php:87: // @TODO points->beg_points
./inc/modules/member/what-beg.php:54:// @TODO Can't this be moved into EL?
./inc/modules/member/what-beg.php:63:// @TODO No more needed? define('__BEG_UID_TIMEOUT', createFancyTime(getBegUseridTimeout()));
./inc/modules/member/what-bonus.php:55: // @TODO Rewrite this to a filter
./inc/modules/member/what-refback.php:124: // @TODO UNUSED: $refRow['status'] = translateUserStatus($refRow['status']);
./inc/modules/member/what-reflinks.php:52:// @TODO Move this into a filter
./inc/modules/member/what-transfer.php:134: // @TODO Rewrite this to a filter
-./inc/modules/member/what-transfer.php:224: // @TODO Try to rewrite his to $content = SQL_FETCHARRAY(), see some lines above for two different queries
+./inc/modules/member/what-transfer.php:223: // @TODO Try to rewrite his to $content = SQL_FETCHARRAY(), see some lines above for two different queries
./inc/modules/member/what-transfer.php:96: // @TODO Rewrite this to a filter
./inc/modules/member/what-unconfirmed.php:142: // @TODO Try to rewrite this to $content = SQL_FETCHARRAY()
./inc/modules/member/what-unconfirmed.php:207: // @TODO This 'userid' cannot be saved because of encapsulated EL code
} // END - foreach
} // END - if
+// Secure also $_POST data (only simple, no replace)
+if (is_array($_POST)) {
+ // Secure only simple data
+ foreach ($_POST as $seckey => $secvalue) {
+ // Is it an array?
+ if (!is_array($secvalue)) {
+ // Strip all other out
+ $_POST[$seckey] = secureString($_POST[$seckey]);
+ } // END - if
+ } // END - foreach
+} // END - if
+
// Detect PHP caching
detectPhpCaching();
// Prepare data for the email template
$content['id'] = $id;
$content['hash'] = $hash;
- $content['email'] = secureString(postRequestParameter('email'));
- $content['surname'] = secureString(postRequestParameter('surname'));
- $content['family'] = secureString(postRequestParameter('family'));
+ $content['email'] = postRequestParameter('email');
+ $content['surname'] = postRequestParameter('surname');
+ $content['family'] = postRequestParameter('family');
$content['timestamp'] = generateDateTime(time(), 0);
- $content['password'] = secureString(postRequestParameter('pass1'));
+ $content['password'] = postRequestParameter('pass1');
// Generate email and send it to the new sponsor
$message = loadEmailTemplate('sponsor_confirm', $content, $id);
if ((isGetRequestParameterSet('theme')) && (isIncludeReadable($theme))) {
// Set cookie from URL data
setTheme(getRequestParameter('theme'));
- } elseif (isIncludeReadable(sprintf("theme/%s/theme.php", secureString(postRequestParameter('theme'))))) {
+ } elseif (isIncludeReadable(sprintf("theme/%s/theme.php", postRequestParameter('theme')))) {
// Set cookie from posted data
- setTheme(secureString(postRequestParameter('theme')));
+ setTheme(postRequestParameter('theme'));
}
// Set return value
if ($valid === true) {
// Prepare content first
$content = array(
- 'hash' => secureString(postRequestParameter('hash')),
- 'login' => secureString(postRequestParameter('login'))
+ 'hash' => postRequestParameter('hash'),
+ 'login' => postRequestParameter('login')
);
// Validation okay so display form for final password change
break;
case 'ref':
- switch (getRequestParameter('do'))
- {
+ switch (getRequestParameter('do')) {
case 'add':
- addSql("INSERT INTO `{?_MYSQL_PREFIX?}_refdepths` (`level`, `percents`) VALUES ('".postRequestParameter('level')."','".postRequestParameter('percents')."')");
+ addSql("INSERT INTO `{?_MYSQL_PREFIX?}_refdepths` (`level`, `percents`) VALUES ('".bigintval(postRequestParameter('level'))."','".bigintval(postRequestParameter('percents'))."')");
break;
case 'edit': // Change entries
// Update entry
SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_refdepths` SET `level`=%s, `percents`=%s WHERE `id`=%s LIMIT 1",
array(bigintval($value), convertCommaToDot(postRequestParameter('percents', $id)), $id), __FILE__, __LINE__);
- }
+ } // END - foreach
$message = '{--ADMIN_REFERAL_DEPTHS_SAVED--}';
break;
foreach (postRequestParameter('id') as $id => $value) {
SQL_QUERY_ESC("DELETE LOW_PRIORITY FROM `{?_MYSQL_PREFIX?}_refdepths` WHERE `id`=%s LIMIT 1",
array(bigintval($id)), __FILE__, __LINE__);
- }
+ } // END - foreach
$message = '{--ADMIN_REFERAL_DEPTHS_DELETED--}';
break;
- }
+ } // END - switch
// Update cache file
// @TODO Rewrite this to a filter
$content = SQL_FETCHARRAY($result);
// Prepare data for the template
- $content['reason'] = secureString(postRequestParameter('reason'));
+ $content['reason'] = postRequestParameter('reason');
// Prepare message and send it away
$message = loadEmailTemplate('del_sponsor', $content, bigintval(getRequestParameter('id')));
// Remember points /reason for the template
$content['points'] = $points;
- $content['reason'] = secureString(postRequestParameter('reason'));
+ $content['reason'] = postRequestParameter('reason');
// Send email
$message = loadEmailTemplate('sponsor_add_points', $content);
// Remember points /reason for the template
$content['points'] = $points;
- $content['reason'] = secureString(postRequestParameter('reason'));
+ $content['reason'] = postRequestParameter('reason');
// Send email
$message = loadEmailTemplate('sponsor_sub_points', $content);
if (($content['status'] == 'CONFIRMED') || ($content['status'] == 'LOCKED')) {
// Transfer data to constants
$content['id'] = bigintval(getRequestParameter('id'));
- $content['reason'] = secureString(postRequestParameter('reason'));
+ $content['reason'] = postRequestParameter('reason');
if (isFormSent()) {
// Create messages
// Shall we send the email?
if (isFormSent()) {
// Insert text
- $content['text'] = trim(secureString(postRequestParameter('text')));
+ $content['text'] = postRequestParameter('text');
// Load email template
$message = loadEmailTemplate('member_contct', $content, getRequestParameter('userid'));
if (count($formErrors) > 0) {
// Some found... :-(
foreach (array('company','position','tax_ident','surname','family','street_nr1','street_nr2','country','zip','city','phone','fax','cell','email','url') as $entry) {
- $content[$entry] = secureString(postRequestParameter($entry));
+ $content[$entry] = postRequestParameter($entry);
} // END - foreach
// Init receive selection
$count = 1;
while ($content = SQL_FETCHARRAY($result)) {
// Prepare data for the template
- // @TODO points->beg_points
- $content = array(
- 'cnt' => $count,
- 'userid' => $content['userid'],
- 'points' => $content['beg_points'],
- 'last_online' => generateDateTime($content['last_online'], 2),
- );
+ $content['cnt'] = $count;
+ $content['last_online'] = generateDateTime($content['last_online'], 2);
// Load row template
$OUT .= loadTemplate('member_list_beg_row', true, $content);
$count++;
} // END - while
} else {
- // No one is interested in our "active rallye" ! :-(
+ // No one is interested in our "begging rallye" ! :-(
$OUT = loadTemplate('member_beg_404', true);
}
$content['end_day'] = bigintval(postRequestParameter('end_day'));
$content['end_month'] = $GLOBALS['month_descr'][postRequestParameter('end_month')];
$content['end_year'] = bigintval(postRequestParameter('end_year'));
- $content['comments'] = secureString(postRequestParameter('comments'));
+ $content['comments'] = postRequestParameter('comments');
// Send mail to member
$message = loadEmailTemplate('member_holiday_request', $content, getMemberId());
} // END - if
} // END - if
- // Remember transfer reason and fancy date/time in constants
- $content['reason'] = secureString(postRequestParameter('reason'));
- $content['expires'] = '{%config,createFancyTime=transfer_age%}';
+ // Remember transfer reason
+ $content['reason'] = postRequestParameter('reason');
// Generate tranafer id
$content['trans_id'] = bigintval(generateRandomCode('10', mt_rand(0, 99999), getMemberId(), postRequestParameter('reason')));
// SQL string to check for accounts
$result_main = SQL_QUERY("SELECT
- `userid`, `email`, `gender`, `surname`, `family`, `beg_points` AS `points`
+ `userid`, `email`, `gender`, `surname`, `family`, `beg_points`
FROM
`{?_MYSQL_PREFIX?}_user_data`
WHERE
// Load our winners...
while ($content = SQL_FETCHARRAY($result_main)) {
// Add points to user's account directly
- addPointsDirectly('monthly_beg', $content['userid'], $content['points']);
+ addPointsDirectly('monthly_beg', $content['userid'], $content['beg_points']);
// Load email template and email it away
$message = loadEmailTemplate('member_beg', $content, bigintval($content['userid']));
$value = null;
// Is the element cached or there?
- if (isset($GLOBALS['cache_request']['request_get'][$element])) {
+ if (isset($GLOBALS['cache_request']['get'][$element])) {
// Then use the cache
- $value = $GLOBALS['cache_request']['request_get'][$element];
+ $value = $GLOBALS['cache_request']['get'][$element];
} elseif (isGetRequestParameterSet($element)) {
// Then get it directly
$value = SQL_ESCAPE($GLOBALS['raw_request']['get'][$element]);
// Store it in cache
- $GLOBALS['cache_request']['request_get'][$element] = $value;
+ $GLOBALS['cache_request']['get'][$element] = $value;
} // END - if
// Return value
$GLOBALS['raw_request']['get'][$element] = $value;
// Update cache
- $GLOBALS['cache_request']['request_get'][$element] = $value;
+ $GLOBALS['cache_request']['get'][$element] = $value;
}
// Wrapper for elements in $_POST
$value = null;
// Is the element in cache?
- if (isset($GLOBALS['cache_request']['request_post'][$element][$subElement])) {
+ if (isset($GLOBALS['cache_request']['post'][$element][$subElement])) {
// Then use it
- $value = $GLOBALS['cache_request']['request_post'][$element][$subElement];
+ $value = $GLOBALS['cache_request']['post'][$element][$subElement];
} elseif (isPostRequestParameterSet($element)) {
// Then use it
$value = $GLOBALS['raw_request']['post'][$element];
}
// Set it in cache
- $GLOBALS['cache_request']['request_post'][$element][$subElement] = $value;
+ $GLOBALS['cache_request']['post'][$element][$subElement] = $value;
} // END - if
// Return value
}
// Update cache
- $GLOBALS['cache_request']['request_post'][$element][null] = $value;
+ $GLOBALS['cache_request']['post'][$element][null] = $value;
}
// Checks wether a form was sent. If so, the $_POST['ok'] element must be set
if (isCssOutputMode()) return true;
// Trim value and session variable
- $var = trim(secureString($var)); $value = trim($value);
+ $var = trim(secureString($var));
+ $value = trim($value);
// Is the session variable set?
if (('' . $value . '' == '') && (isSessionVariableSet($var))) {
if ((isInstallationPhase())) {
// Default theme first
$newTheme = 'default';
- if (isGetRequestParameterSet('theme')) $newTheme = getRequestParameter('theme');
- if (isPostRequestParameterSet('theme')) $newTheme = secureString(postRequestParameter('theme'));
+ if (isPostRequestParameterSet('theme')) {
+ $newTheme = postRequestParameter('theme');
+ } elseif (isGetRequestParameterSet('theme')) {
+ $newTheme = getRequestParameter('theme');
+ }
$OUT .= '?theme=' . $newTheme . '&installing=1';
} else {
// Add SVN revision to bypass caching problems
Transaktionsnummer: $content[trans_id]
------------------------------
-Diese beiden Mitglieder können sich die Überweisung noch $content[expires] in ihrem Mitgliedsbereich ansehen. Danach wird der Eintrag bei installierter autopurge-Erweiterung automatisch entfernt.
+Diese beiden Mitglieder können sich die Überweisung noch {%config,createFancyTime=transfer_age%} in ihrem Mitgliedsbereich ansehen. Danach wird der Eintrag bei installierter autopurge-Erweiterung automatisch entfernt.
Mit freundlichen Grüßen,
Ihr {?MAIN_TITLE?} Script
Hallo {%user,gender,translateGender=$userid%} {%user,surname=$userid%} {%user,family=$userid%},
-Bei der monatlichen Bettel-Rallye haben Sie soeben Ihre {%pipe,translateComma=$content[points]%} {?POINTS?} gewonnen!
+Bei der monatlichen Bettel-Rallye haben Sie soeben Ihre {%pipe,translateComma=$content[beg_points]%} {?POINTS?} gewonnen!
Herzlichen Glückwunsch!
Transaktionsnummer: $content[trans_id]
------------------------------
-Sie können diese Transaktion $content[expires] noch im Mitgliedsbereich unter "{?POINTS?}-Transfer" nachvollziehen.
+Sie können diese Transaktion {%config,createFancyTime=transfer_age%} noch im Mitgliedsbereich unter "{?POINTS?}-Transfer" nachvollziehen.
Mit freundlichen Grüßen,
Ihr {?MAIN_TITLE?} Team
Transaktionsnummer: $content[trans_id]
------------------------------
-Sie können diese Transaktion $content[expires] noch im Mitgliedsbereich unter "{?POINTS?}-Transfer" nachvollziehen.
+Sie können diese Transaktion {%config,createFancyTime=transfer_age%} noch im Mitgliedsbereich unter "{?POINTS?}-Transfer" nachvollziehen.
Mit freundlichen Grüßen,
Ihr {?MAIN_TITLE?} Team
<tr>
<td align="center" class="{%template,ColorSwitch%} bottom">$content[cnt]</td>
<td align="center" class="{%template,ColorSwitch%} bottom">$content[userid]</td>
- <td align="center" class="{%template,ColorSwitch%} bottom">{%pipe,translateComma=$content[points]%}</td>
+ <td align="center" class="{%template,ColorSwitch%} bottom">{%pipe,translateComma=$content[beg_points]%}</td>
<td align="center" class="{%template,ColorSwitch%} bottom">$content[last_online]</td>
</tr>
projects / mailer.git / commitdiff