Wernis extension more secured

[mailer.git] / mailid.php

diff --git a/mailid.php b/mailid.php
index b268fa82d82ba528a29ef86f66bc88333f7977cf..42280ee7afc3f17781790664262f2a341e269d97 100644 (file)
--- a/mailid.php
+++ b/mailid.php
@@ -37,8 +37,6 @@ require_once("inc/libs/security_functions.php");
 // Init "action" and "what"
 global $what, $action;
 $GLOBALS['what'] = ""; $GLOBALS['action'] = "";
-if (!empty($_GET['action'])) $GLOBALS['action'] = secureString($_GET['action']);
-if (!empty($_GET['what'])) $GLOBALS['what'] = secureString($_GET['what']);
 
 // Tell everyone we are in this module
 $GLOBALS['module'] = "mailid"; $CSS = -1;
@@ -46,7 +44,7 @@ $GLOBALS['module'] = "mailid"; $CSS = -1;
 // Load the required file(s)
 require ("inc/config.php");
 
-if (defined('mxchange_installed') && (mxchange_installed))
+if (defined('mxchange_installed') && (isBooleanConstantAndTrue('mxchange_installed')))
 {
        // Is the extension active
        if (!EXT_IS_ACTIVE("mailid", true)) {
@@ -68,31 +66,28 @@ if (defined('mxchange_installed') && (mxchange_installed))
        //* DEBUG: */ die("*".$url_uid."/".$url_bid."/".$url_mid."*<pre>".print_r($FATAL, true)."</pre>");
 
        // 01        1        12            3    32           21    1     2      2     10
-       if (($url_uid) > 0 && (($url_mid > 0) || ($url_bid > 0)) && (count($FATAL) == 0))
-       {
+       if (($url_uid) > 0 && (($url_mid > 0) || ($url_bid > 0)) && (count($FATAL) == 0)) {
                // Maybe he wants to confirm an email?
-               if ($url_mid > 0)
-               {
+               if ($url_mid > 0) {
                        // Normal-Mails
                        $result = SQL_QUERY_ESC("SELECT link_type FROM "._MYSQL_PREFIX."_user_links WHERE stats_id=%d AND userid=%d LIMIT 1",
                         array($url_mid, $url_uid), __FILE__, __LINE__);
-                       $TYPE = "mailid"; $DATA = $url_mid;
-               }
-                elseif ($url_bid > 0)
-               {
+                       $type = "mailid"; $DATA = $url_mid;
+               } elseif ($url_bid > 0) {
                        // Bonus-Mail
                        $result = SQL_QUERY_ESC("SELECT link_type FROM "._MYSQL_PREFIX."_user_links WHERE bonus_id=%d AND userid=%d LIMIT 1",
                         array($url_bid, $url_uid), __FILE__, __LINE__);
-                       $TYPE = "bonusid"; $DATA = $url_bid;
-               }
-                else
-               {
+                       $type = "bonusid"; $DATA = $url_bid;
+               } else {
                        // Problem: No ID entered
                        LOAD_URL("index.php");
                }
-               if (SQL_NUMROWS($result) == 1)
-               {
+
+               if (SQL_NUMROWS($result) == 1) {
+                       // Load the entry
                        list($ltype) = SQL_FETCHROW($result);
+
+                       // Clean result
                        SQL_FREERESULT($result);
                        switch ($ltype)
                        {
@@ -109,8 +104,7 @@ if (defined('mxchange_installed') && (mxchange_installed))
                                break;
                        }
 
-                       if (SQL_NUMROWS($result) == 1)
-                       {
+                       if (SQL_NUMROWS($result) == 1) {
                                // Load data
                                list($pool, $URL) = SQL_FETCHROW($result);
                                SQL_FREERESULT($result);
@@ -118,12 +112,10 @@ if (defined('mxchange_installed') && (mxchange_installed))
                                // Is the user's ID unlocked?
                                $result = SQL_QUERY_ESC("SELECT status, sex, surname, family FROM "._MYSQL_PREFIX."_user_data WHERE userid=%d LIMIT 1",
                                 array($url_uid), __FILE__, __LINE__);
-                               if (SQL_NUMROWS($result) == 1)
-                               {
+                               if (SQL_NUMROWS($result) == 1) {
                                        list($status, $sex, $sname, $fname) = SQL_FETCHROW($result);
                                        SQL_FREERESULT($result);
-                                       if ($status == "CONFIRMED")
-                                       {
+                                       if ($status == "CONFIRMED") {
                                                // User has confirmed his account so we can procede...
                                                switch ($ltype)
                                                {
@@ -157,15 +149,15 @@ if (defined('mxchange_installed') && (mxchange_installed))
                                                        break;
                                                }
 
-                                               if ($VALID)
-                                               {
+                                               // Was that mail a valid one?
+                                               if ($VALID) {
                                                        // If time is zero seconds we have a sponsor mail. 1 Second shall be set to avoid problems
                                                        if (($time == "0") && ($payment > 0)) { $URL = URL; $time = "1"; }
                                                        if (($time > 0) && (($payment > 0) || ($points > 0))) {
                                                                // He can confirm this mail!
                                                                // Export data into constants for the template
                                                                define('_UID_VALUE' , $url_uid);
-                                                               define('_TYPE_VALUE', $TYPE);
+                                                               define('_TYPE_VALUE', $type);
                                                                define('_DATA_VALUE', $DATA);
                                                                define('_URL_VALUE' , DEREFERER($URL));
 
@@ -199,18 +191,28 @@ if (defined('mxchange_installed') && (mxchange_installed))
 
        // Error code is set?
        if (!empty($msg)) {
-               LOAD_URL(URL."/modules.php?module=index&msg=".$msg);
-       }
+               switch ($_CONFIG['mailid_error_redirect']) {
+                       case "index": // Redirect to index page
+                               LOAD_URL("modules.php?module=index&msg=".$msg);
+                               break;
 
-       require_once(PATH."inc/footer.php");
-}
- else
-{
+                       case "reject": // Redirect to rejection page
+                               LOAD_URL($_CONFIG['reject_url']);
+                               break;
+               }
+       } else {
+               // Include footer
+               require_once(PATH."inc/footer.php");
+       }
+} else {
        // You have to configure first!
        LOAD_URL("install.php");
 }
-// Really all done here... ;-)
-die();
+
+// Shutdown database link
+if (is_resource($link)) {
+       SQL_CLOSE($link, __FILE__, __LINE__);
+}
 
 //
 ?>