Security line in all includes changed

[mailer.git] / inc / modules / admin / what-config_cats.php

diff --git a/inc/modules/admin/what-config_cats.php b/inc/modules/admin/what-config_cats.php
index df24b85e898c153305e6d0fe534dc3899bed04a7..d42c6bd2e8acd682a9f81db7ee0f70d83a10d441 100644 (file)
--- a/inc/modules/admin/what-config_cats.php
+++ b/inc/modules/admin/what-config_cats.php
@@ -33,7 +33,7 @@
  ************************************************************************/
 
 // Some security stuff...
  ************************************************************************/
 
 // Some security stuff...

-if ((ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) || (!IS_ADMIN())) {
+if ((!defined('__SECURITY')) || (!IS_ADMIN())) {

        $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4) . "/security.php";
        require($INC);
 }
        $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4) . "/security.php";
        require($INC);
 }


@@ -44,7 +44,6 @@ ADD_DESCR("admin", basename(__FILE__));
 // Init variable to avoid a notice
 $CATS = "";
 
 // Init variable to avoid a notice
 $CATS = "";
 

-OPEN_TABLE("100%", "admin_content admin_content_align", "");

 if (isset($_POST['add'])) {
        // Add a new category
        $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_cats WHERE cat='%s' LIMIT 1",
 if (isset($_POST['add'])) {
        // Add a new category
        $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_cats WHERE cat='%s' LIMIT 1",


@@ -67,7 +66,7 @@ if (isset($_POST['add'])) {
 } elseif ((isset($_POST['ok'])) && (isset($_POST['id'])) && (is_array($_POST['id']))) {
        // Change or delete categories...
        $TEXT = "";
 } elseif ((isset($_POST['ok'])) && (isset($_POST['id'])) && (is_array($_POST['id']))) {
        // Change or delete categories...
        $TEXT = "";

-       foreach ($_POST['id'] as $id=>$cat) {
+       foreach ($_POST['id'] as $id => $cat) {

                // Secure ID
                $id = bigintval($id);
 
                // Secure ID
                $id = bigintval($id);
 


@@ -76,15 +75,15 @@ if (isset($_POST['add'])) {
                        switch ($_GET['do'])
                        {
                        case "edit": // Change categories
                        switch ($_GET['do'])
                        {
                        case "edit": // Change categories

-                               $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_cats SET cat='%s', visible='%s', sort=%d WHERE id=%d LIMIT 1",
+                               $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_cats SET cat='%s', visible='%s', sort=%s WHERE id=%s LIMIT 1",

                                 array($cat, $_POST['vis'][$id], $_POST['sort'][$id], $id), __FILE__, __LINE__);
                                $TEXT = CATEGORIES_SAVED;
                                break;
 
                        case "del": // Delete categories
                                 array($cat, $_POST['vis'][$id], $_POST['sort'][$id], $id), __FILE__, __LINE__);
                                $TEXT = CATEGORIES_SAVED;
                                break;
 
                        case "del": // Delete categories

-                               $result = SQL_QUERY_ESC("DELETE LOW_PRIORITY FROM "._MYSQL_PREFIX."_cats WHERE id=%d LIMIT 1",
+                               $result = SQL_QUERY_ESC("DELETE LOW_PRIORITY FROM "._MYSQL_PREFIX."_cats WHERE id=%s LIMIT 1",

                                 array($id), __FILE__, __LINE__);
                                 array($id), __FILE__, __LINE__);

-                               $result = SQL_QUERY_ESC("DELETE LOW_PRIORITY FROM "._MYSQL_PREFIX."_user_cats WHERE cat_id=%d",
+                               $result = SQL_QUERY_ESC("DELETE LOW_PRIORITY FROM "._MYSQL_PREFIX."_user_cats WHERE cat_id=%s",

                                 array($id), __FILE__, __LINE__);
                                $TEXT = CATEGORIES_DELETED;
                                break;
                                 array($id), __FILE__, __LINE__);
                                $TEXT = CATEGORIES_DELETED;
                                break;


@@ -104,10 +103,10 @@ if (isset($_POST['add'])) {
 {
        // Delete categories
        $SW = 2; $OUT = "";
 {
        // Delete categories
        $SW = 2; $OUT = "";

-       foreach ($_POST['sel'] as $id=>$value)
+       foreach ($_POST['sel'] as $id => $value)

        {
                // Load data of category
        {
                // Load data of category

-               $result = SQL_QUERY_ESC("SELECT cat FROM "._MYSQL_PREFIX."_cats WHERE id=%d LIMIT 1",
+               $result = SQL_QUERY_ESC("SELECT cat FROM "._MYSQL_PREFIX."_cats WHERE id=%s LIMIT 1",

                 array(bigintval($id)), __FILE__, __LINE__);
                list($cat) = SQL_FETCHROW($result);
                SQL_FREERESULT($result);
                 array(bigintval($id)), __FILE__, __LINE__);
                list($cat) = SQL_FETCHROW($result);
                SQL_FREERESULT($result);


@@ -130,10 +129,10 @@ if (isset($_POST['add'])) {
 } elseif ((isset($_POST['edit'])) && ((SELECTION_COUNT($_POST['sel']) > 0) || (isset($_POST['sel'][0])))) {
        // Edit categories
        $SW = 2; $OUT = "";
 } elseif ((isset($_POST['edit'])) && ((SELECTION_COUNT($_POST['sel']) > 0) || (isset($_POST['sel'][0])))) {
        // Edit categories
        $SW = 2; $OUT = "";

-       foreach ($_POST['sel'] as $id=>$value)
+       foreach ($_POST['sel'] as $id => $value)

        {
                // Load data from the category
        {
                // Load data from the category

-               $result = SQL_QUERY_ESC("SELECT cat, visible, sort FROM "._MYSQL_PREFIX."_cats WHERE id=%d LIMIT 1",
+               $result = SQL_QUERY_ESC("SELECT cat, visible, sort FROM "._MYSQL_PREFIX."_cats WHERE id=%s LIMIT 1",

                 array(bigintval($id)), __FILE__, __LINE__);
                list($cat, $vis, $sort) = SQL_FETCHROW($result);
                SQL_FREERESULT($result);
                 array(bigintval($id)), __FILE__, __LINE__);
                list($cat, $vis, $sort) = SQL_FETCHROW($result);
                SQL_FREERESULT($result);


@@ -197,6 +196,6 @@ if (isset($_POST['add'])) {
        // Form to add a new category
        LOAD_TEMPLATE("admin_add_cat");
 }
        // Form to add a new category
        LOAD_TEMPLATE("admin_add_cat");
 }

-CLOSE_TABLE();
+

 //
 ?>
 //
 ?>