All database names are now 'back-ticked' and constant _MYSQL_PREFIX is wrapped. Partl...

[mailer.git] / modules.php

diff --git a/modules.php b/modules.php
index 72cd6943e0f2197d24ebd203a41ac0a52eebf8f9..913b66e169e4638c212fcad7ed3ccca62c397ea7 100644 (file)
--- a/modules.php
+++ b/modules.php
@@ -35,7 +35,7 @@
 //xdebug_start_trace();
 
 // Load security stuff here (Oh, I hope this is not unsecure? Am I paranoia??? ;-) )
-require_once ("inc/libs/security_functions.php");
+require_once("inc/libs/security_functions.php");
 
 // Init "action" and "what"
 global $what, $action, $startTime;
@@ -55,12 +55,12 @@ if (!empty($_GET['what'])) $GLOBALS['what'] = secureString($_GET['what']);
 $GLOBALS['module'] = secureString($_GET['module']);
 
 // Needed include files
-require ("inc/config.php");
+require("inc/config.php");
 
 // Check if logged in
 if (IS_MEMBER()) {
        // Is still logged in so we welcome him with his name
-       $result = SQL_QUERY_ESC("SELECT surname, family FROM "._MYSQL_PREFIX."_user_data WHERE userid=%s LIMIT 1",
+       $result = SQL_QUERY_ESC("SELECT surname, family FROM `{!MYSQL_PREFIX!}_user_data` WHERE userid=%s LIMIT 1",
         array($GLOBALS['userid']), __FILE__, __LINE__);
        if (SQL_NUMROWS($result) == 1) {
                // Load surname and family's name and build the username
@@ -73,13 +73,20 @@ if (IS_MEMBER()) {
                        $username .= " ("._ADMIN_SHORT.")";
                } // END - if
        } else {
-               // Hmmm, logged in and no valid cookies???
-               $username = "<I>"._UNKNOWN."</I>";
+               // Hmmm, logged in and no valid userid?
+               $username = "<em>"._UNKNOWN."</em>";
+
+               // Destroy session
+               destroy_user_session();
+
+               // Kill userid
+               $GLOBALS['userid'] = 0;
        }
 
        // Free memory
        SQL_FREERESULT($result);
 } elseif (IS_ADMIN()) {
+       // Admin is there
        $username = _ADMIN;
 } else {
        // He's a guest, hello there... ;-)
@@ -91,10 +98,10 @@ include (PATH."inc/header.php");
 
 // Modules are by default not valid!
 $MOD_VALID = false; $check = "failed";
-if ((!empty($_CONFIG['maintenance'])) && ($_CONFIG['maintenance'] == "Y") && (!IS_ADMIN()) && ($GLOBALS['module'] != "admin")) {
+if ((getConfig('maintenance') == "Y") && (!IS_ADMIN()) && ($GLOBALS['module'] != "admin")) {
        // Maintain mode is active and you are no admin
-       ADD_FATAL(LANG_DOWN_MAINTAINCE);
-} elseif (($link) && ($db) && (sizeof($FATAL) == 0)) {
+       addFatalMessage(LANG_DOWN_MAINTAINCE);
+} elseif (($link) && ($db) && (getTotalFatalErrors() == 0)) {
        // Did we found the module listed in allowed modules and are we successfully connected?
        $check = CHECK_MODULE($GLOBALS['module']);
        switch ($check)
@@ -103,52 +110,52 @@ if ((!empty($_CONFIG['maintenance'])) && ($_CONFIG['maintenance'] == "Y") && (!I
        case "mem_only":
        case "done":
                // Construct module name
-               define('__MODULE', sprintf("%sinc/modules/%s.php", PATH, $GLOBALS['module']));
+               define('__MODULE', sprintf("%sinc/modules/%s.php", PATH, SQL_ESCAPE($GLOBALS['module'])));
 
                // Does the module exists on local file system?
-               if ((FILE_READABLE(__MODULE)) && (sizeof($FATAL) == 0)) {
+               if ((FILE_READABLE(__MODULE)) && (getTotalFatalErrors() == 0)) {
                        // Module is valid, active and located on the local disc...
                        $MOD_VALID = true;
                } elseif (!empty($URL)) {
                        // An URL was specified so we load the de-referrer module
                        LOAD_URL(DEREFERER($URL));
-               } elseif (sizeof($FATAL) == 0) {
-                       ADD_FATAL(LANG_MOD_REG_404_1.$GLOBALS['module'].LANG_MOD_REG_404_2);
+               } elseif (getTotalFatalErrors() == 0) {
+                       addFatalMessage(LANG_MOD_REG_404_1.$GLOBALS['module'].LANG_MOD_REG_404_2);
                }
                break;
 
        case "404":
-               ADD_FATAL(LANG_MOD_REG_404_1.$GLOBALS['module'].LANG_MOD_REG_404_2);
+               addFatalMessage(LANG_MOD_REG_404_1.$GLOBALS['module'].LANG_MOD_REG_404_2);
                break;
 
        case "locked":
-               if (!FILE_READABLE(PATH."inc/modules/".$GLOBALS['module'].".php"))
-               {
+               if (!FILE_READABLE(PATH."inc/modules/".$GLOBALS['module'].".php")) {
                        // Module does addionally not exists
-                       ADD_FATAL(LANG_MOD_REG_404_1.$GLOBALS['module'].LANG_MOD_REG_404_2);
-               }
-               ADD_FATAL(LANG_MOD_LOCKED_1.$GLOBALS['module'].LANG_MOD_LOCKED_2);
+                       addFatalMessage(LANG_MOD_REG_404_1.$GLOBALS['module'].LANG_MOD_REG_404_2);
+               } // END - if
+
+               // Add fatal message
+               addFatalMessage(LANG_MOD_LOCKED_1.$GLOBALS['module'].LANG_MOD_LOCKED_2);
                break;
 
        default:
-               ADD_FATAL(LANG_MOD_UNKNOWN_1.$check.LANG_MOD_UNKNOWN_2);
+               DEBUG_LOG(__FILE__, __LINE__, sprintf("Unknown status %s return from module check. Module=%s", $check, $GLOBALS['module']));
+               addFatalMessage(LANG_MOD_UNKNOWN_1.$check.LANG_MOD_UNKNOWN_2);
                break;
        }
-}
- elseif (sizeof($FATAL) == 0)
-{
+} elseif (getTotalFatalErrors() == 0) {
        // MySQL problems!
-       ADD_FATAL(MYSQL_ERRORS);
+       addFatalMessage(MYSQL_ERRORS);
 }
 
-if ($MOD_VALID) {
+if (($MOD_VALID) && (defined('__MODULE'))) {
        /////////////////////////////////////////////
        // Main including line DO NOT REMOVE/EDIT! //
        /////////////////////////////////////////////
        //
        // Everything is okay so we can load the module
        include (__MODULE);
-}
+} // END - if
 
 // Next-to-end add the footer
 include (PATH."inc/footer.php");