From 8401d620295d27ad2c7804da2a593bba1ac6ff47 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Roland=20H=C3=A4der?= Date: Wed, 3 Dec 2008 21:16:53 +0000 Subject: [PATCH] More fixes, thanks to Piter01 --- inc/modules/admin/admin-inc.php | 2 +- inc/modules/member/what-order.php | 310 ++++++++++++------------------ 2 files changed, 120 insertions(+), 192 deletions(-) diff --git a/inc/modules/admin/admin-inc.php b/inc/modules/admin/admin-inc.php index d6b6c0b65e..9b745c7f3a 100644 --- a/inc/modules/admin/admin-inc.php +++ b/inc/modules/admin/admin-inc.php @@ -656,7 +656,7 @@ function ADMIN_SAVE_SETTINGS (&$POST, $tableName="_config", $whereStatement="con $test = (float)$val; if ("".$val."" == "".$test."") { // Add numbers - $DATA[] = sprintf("`%s`=%s%s", $id, $test); + $DATA[] = sprintf("`%s`=%s", $id, $test); } else { // Add strings $DATA[] = sprintf("`%s`='%s'", $id, trim($val)); diff --git a/inc/modules/member/what-order.php b/inc/modules/member/what-order.php index 51c11ef419..5a45378a5b 100644 --- a/inc/modules/member/what-order.php +++ b/inc/modules/member/what-order.php @@ -66,11 +66,10 @@ SQL_FREERESULT($result_links); // Does the user has more than 0 mails per day set? $HOLIDAY="userid"; -if (GET_EXT_VERSION("holiday") >= "0.1.3") -{ +if (GET_EXT_VERSION("holiday") >= "0.1.3") { // Fetch also holiday activation data $HOLIDAY = "holiday_active"; -} +} // END - if $result_mmails = SQL_QUERY_ESC("SELECT userid, receive_mails, mail_orders, ".$HOLIDAY." FROM "._MYSQL_PREFIX."_user_data @@ -97,7 +96,7 @@ if ($TOTAL > 0) { // Add (maybe) missing three zeros if (!ereg(".", $TOTAL)) $TOTAL .= ".00000"; -} +} // END - if if (($HOLIDAY == "Y") && (GET_EXT_VERSION("holiday") >= "0.1.3")) { // Holiday is active! @@ -113,95 +112,91 @@ WHERE sender=%s AND url='%s' AND timestamp > (UNIX_TIMESTAMP() - %s) LIMIT 1", array($GLOBALS['userid'], $_POST['url'], $_CONFIG['url_tlock']), __FILE__, __LINE__); $type = "TEMP"; $id = 0; - if (SQL_NUMROWS($result) == 1) - { + if (SQL_NUMROWS($result) == 1) { list($id, $type) = SQL_FETCHROW($result); - SQL_FREERESULT($result); } - if ($type == "TEMP") - { + + // Free result + SQL_FREERESULT($result); + + if ($type == "TEMP") { // No entry found, so we need to check out the stats table as well... :) // We have to add that suff here, now we continue WITHOUT checking and check the text and subject against some filters $URL = ""; - if ($_CONFIG['test_text'] == "Y") - { + if ($_CONFIG['test_text'] == "Y") { // Test submitted text against some filters (length, URLs in text etc.) - if ((strpos(strtolower($_POST['text']), "https://") > -1) || (strpos(strtolower($_POST['text']), "http://") > -1) || (strpos(strtolower($_POST['text']), "www") > -1)) - { + if ((strpos(strtolower($_POST['text']), "https://") > -1) || (strpos(strtolower($_POST['text']), "http://") > -1) || (strpos(strtolower($_POST['text']), "www") > -1)) { // URL found! $URL = URL."/modules.php?module=login&what=order&msg=".CODE_URL_FOUND; - } + } // END - if + + // Remove new-line and carriage-return characters $TEST = str_replace("\n", "", str_replace("\r", "", $_POST['text'])); - if (strlen($TEST) > $_CONFIG['max_tlength']) - { + + // Text length within allowed length? + if (strlen($TEST) > $_CONFIG['max_tlength']) { // Text is too long! $URL = URL."/modules.php?module=login&what=order&msg=".CODE_OVERLENGTH; - } - } + } // END - if + } // END - if + // Shall I test the subject line against URLs? - if ($_CONFIG['test_subj'] == "Y") - { + if ($_CONFIG['test_subj'] == "Y") { // Check the subject line for issues $_POST['subject'] = str_replace("\\", "[nl]", substr($_POST['subject'], 0, 200)); - if ((strpos(strtolower($_POST['subject']), "http://") > -1) || (strpos(strtolower($_POST['subject']), "www") > -1)) - { + if ((strpos(strtolower($_POST['subject']), "http://") > -1) || (strpos(strtolower($_POST['subject']), "www") > -1)) { // URL in subject found $URL = URL."/modules.php?module=login&what=order&msg=".CODE_SUBJ_URL; - } - } + } // END - if + } // END - if + // And shall I check that his URL is not in the black list? - if ($_CONFIG['url_blacklist'] == "Y") - { + if ($_CONFIG['url_blacklist'] == "Y") { // Ok, I do that for you know... $result = SQL_QUERY_ESC("SELECT timestamp FROM "._MYSQL_PREFIX."_url_blist WHERE url='%s' LIMIT 1", - array($_POST['url']), __FILE__, __LINE__); + array($_POST['url']), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) - { + if (SQL_NUMROWS($result) == 1) { // Jupp, we got one listed list($blist) = SQL_FETCHROW($result); SQL_FREERESULT($result); $URL = URL."/modules.php?module=login&what=order&msg=".CODE_BLIST_URL."&blist=".$blist; - } - } - if (($_POST['receiver'] < $_CONFIG['order_min']) && (!IS_ADMIN())) - { + } // END - if + } // END - if + + // Enougth receivers entered? + if (($_POST['receiver'] < $_CONFIG['order_min']) && (!IS_ADMIN())) { // Less than allowed receivers entered! $URL = URL."/modules.php?module=login&what=order&msg=".CODE_MORE_RECEIVERS3; - } + } // END - if // Validate URL - if (!VALIDATE_URL($_POST['url'])) - { + if (!VALIDATE_URL($_POST['url'])) { // URL is invalid! $URL = URL."/modules.php?module=login&what=order&msg=".CODE_INVALID_URL; - } + } // END - if // Probe for HTML extension - if ($HTML_EXT) - { - if ($_POST['html'] == "Y") - { + if ($HTML_EXT) { + // HTML or regular text mail? + if ($_POST['html'] == "Y") { // Chek for valid HTML tags $_POST['text'] = HTML_CHECK_TAGS($_POST['text']); // Maybe invalid tags found? if (empty($_POST['text'])) $URL = URL."/modules.php?module=login&what=order&msg=".CODE_INVALID_TAGS."&id=".$id; - } - else - { + } else { // Remove any HTML code $_POST['text'] = str_replace("<", "{OPEN_HTML}", str_replace(">", "{CLOSE_HTML}", $_POST['text'])); } } - } - elseif (!IS_ADMIN()) - { + } elseif (!IS_ADMIN()) { // He has already sent a mail within a specific time $URL = URL."/modules.php?module=login&what=order&msg=".CODE_URL_TLOCK."&id=".$id; } - if (empty($URL)) - { + + // Still no error? + if (empty($URL)) { // Check if category and number of receivers is okay $ADD = ""; if (($_CONFIG['order_multi_page'] == "Y") && (!empty($_POST['zip']))) { @@ -223,22 +218,18 @@ ORDER BY d.%s %s", ), __FILE__, __LINE__); // Do we enougth receivers left? - if (SQL_NUMROWS($result) >= $_POST['receiver']) - { + if (SQL_NUMROWS($result) >= $_POST['receiver']) { // Check for holiday extensions $HOLIDAY = false; - if (GET_EXT_VERSION("holiday") >= "0.1.3") - { + if (GET_EXT_VERSION("holiday") >= "0.1.3") { // Include checking for users in holiday $HOLIDAY = true; - } + } // END - if // Load receivers from database $TEST = array(); $cnt = 0; - while (list($REC) = SQL_FETCHROW($result)) - { - if ($HOLIDAY) - { + while (list($REC) = SQL_FETCHROW($result)) { + if ($HOLIDAY) { // Check for his holiday status $result_holiday = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_user_holidays WHERE userid=%s AND holiday_start < UNIX_TIMESTAMP() AND holiday_end > UNIX_TIMESTAMP() LIMIT 1", @@ -247,15 +238,14 @@ WHERE userid=%s AND holiday_start < UNIX_TIMESTAMP() AND holiday_end > UNIX_TIME // Free memory SQL_FREERESULT($result_holiday); - } + } // END - if - if ($REC > 0) - { + if ($REC > 0) { // Add receiver $TEST[] = $REC; $cnt++; - } - } + } // END - if + } // END - while // Free memory SQL_FREERESULT($result); @@ -268,7 +258,7 @@ WHERE userid=%s AND holiday_start < UNIX_TIMESTAMP() AND holiday_end > UNIX_TIME // Update receiver list $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_user_data SET receive_mails=receive_mails-1 WHERE userid IN (%s) LIMIT %s", - array(str_replace(";", ", ", $RECEIVER), $MAX_SEND), __FILE__, __LINE__); + array(str_replace(";", ", ", $RECEIVER), $MAX_SEND), __FILE__, __LINE__); // Is calculated max receivers larger than wanted receivers then reset it if ($MAX_SEND > $_POST['receiver']) $MAX_SEND = $_POST['receiver']; @@ -276,17 +266,17 @@ WHERE userid=%s AND holiday_start < UNIX_TIMESTAMP() AND holiday_end > UNIX_TIME // Calculate used points $USED = $MAX_SEND * GET_PAY_POINTS(bigintval($_POST['type'])); + // Fix empty zip code + if (empty($_POST['zip'])) $_POST['zip'] = "0"; + // Check if he has enougth points for this order and selected more than 0 receivers - if (($USED > 0) && ($USED <= $TOTAL) && ($MAX_SEND > 0)) - { + if (($USED > 0) && ($USED <= $TOTAL) && ($MAX_SEND > 0)) { // Gettings points is okay, so we can add $USED later from $TIME = time(); - if (($id == "0") || ($type != "TEMP")) - { + if (($id == "0") || ($type != "TEMP")) { // New order $id = 0; - if ($HTML_EXT) - { + if ($HTML_EXT) { // HTML extension is active $result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_pool (sender, subject, text, receivers, payment_id, data_type, timestamp, url, cat_id, target_send, zip, html_msg) VALUES ('%s','%s','%s','%s','%s','TEMP','%s','%s','%s','%s','%s','%s')", @@ -303,9 +293,7 @@ array( bigintval($_POST['zip']), $_POST['html'] ), __FILE__, __LINE__); - } - else - { + } else { // No HTML extension is active $result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_pool (sender, subject, text, receivers, payment_id, data_type, timestamp, url, cat_id, target_send, zip) VALUES ('%s','%s','%s','%s','%s','TEMP','%s','%s','%s','%s','%s')", @@ -322,12 +310,9 @@ array( bigintval($_POST['zip']), ), __FILE__, __LINE__); } - } - else - { + } else { // Change current order - if ($HTML_EXT) - { + if ($HTML_EXT) { // HTML extension is active $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_pool SET subject='%s', @@ -353,9 +338,7 @@ array( $_POST['html'], bigintval($id) ), __FILE__, __LINE__); - } - else - { + } else { // No HTML extension is active $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_pool SET subject='%s', @@ -399,43 +382,29 @@ array( // ID is received so we can redirect the user, used points will be added when he send's out the mail $URL = URL."/modules.php?module=frametester&order=".$id.""; - } - elseif ($MAX_SEND == 0) - { + } elseif ($MAX_SEND == 0) { // Not enougth receivers found which can receive mails $URL = URL."/modules.php?module=login&what=order&msg=".CODE_MORE_RECEIVERS2; - } - else - { + } else { // No enougth points left! $URL = URL."/modules.php?module=login&what=order&msg=".CODE_MORE_POINTS; } - } - else - { + } else { // Ordered more mails than he can send in this category $URL = URL."/modules.php?module=login&what=order&msg=".CODE_NO_RECS_LEFT; } } -} - elseif ($_POST['receiver'] == "0") -{ +} elseif ($_POST['receiver'] == "0") { // Not enougth receivers selected $URL = URL."/modules.php?module=login&what=order&msg=".CODE_MORE_RECEIVERS1; -} - elseif (($ALLOWED == 0) && ($_CONFIG['order_max_full'] == "ORDER")) -{ +} elseif (($ALLOWED == 0) && ($_CONFIG['order_max_full'] == "ORDER")) { // No more mail orders allowed LOAD_TEMPLATE("admin_settings_saved", false, MEMBER_ORDER_ALLOWED_EXHAUSTED); -} - elseif (($links < $_CONFIG['unconfirmed']) && ($mmails == "1")) -{ +} elseif (($links < $_CONFIG['unconfirmed']) && ($mmails == "1")) { // Display order form $result_cats = SQL_QUERY("SELECT id, cat FROM "._MYSQL_PREFIX."_cats".$whereStatement." ORDER BY sort", __FILE__, __LINE__); - if (SQL_NUMROWS($result_cats) > 0) - { - if ($TOTAL > 0) - { + if (SQL_NUMROWS($result_cats) > 0) { + if ($TOTAL > 0) { // Initialize array... $CATS = array( 'id' => array(), @@ -446,15 +415,13 @@ array( // Enable HTML checking $HTML = ""; $HOLIDAY = false; $HOL_STRING = ""; if (($HTML_EXT) && ($_POST['html'] == "Y")) $HTML = " AND html='Y'"; - if (GET_EXT_VERSION("holiday") >= "0.1.3") - { + if (GET_EXT_VERSION("holiday") >= "0.1.3") { // Extension's version is fine $HOLIDAY = true; $HOL_STRING = " AND holiday_active='N'"; - } + } // END - if // ... and begin loading stuff - while (list($id, $cat) = SQL_FETCHROW($result_cats)) - { + while (list($id, $cat) = SQL_FETCHROW($result_cats)) { $CATS['id'][] = bigintval($id); $CATS['name'][] = $cat; @@ -463,12 +430,10 @@ array( array(bigintval($id), $GLOBALS['userid']), __FILE__, __LINE__); $uid_cnt = 0; - while (list($ucat) = SQL_FETCHROW($result_uids)) - { + while (list($ucat) = SQL_FETCHROW($result_uids)) { // Check for holiday system $HOL_ACTIVE = false; - if ($HOLIDAY) - { + if ($HOLIDAY) { // Check user's holiday status $result_holiday = SQL_QUERY_ESC("SELECT DISTINCT d.userid FROM "._MYSQL_PREFIX."_user_data AS d LEFT JOIN "._MYSQL_PREFIX."_user_holidays AS h @@ -476,44 +441,38 @@ ON d.userid=h.userid WHERE d.userid=%s AND d.receive_mails > 0 AND d.status='CONFIRMED' AND d.holiday_active='Y' AND h.holiday_start < UNIX_TIMESTAMP() AND h.holiday_end > UNIX_TIMESTAMP() LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); - if (SQL_NUMROWS($result_holiday) == 1) - { + if (SQL_NUMROWS($result_holiday) == 1) { // Holiday is active! $HOL_ACTIVE = true; - } + } // END - if // Free memory SQL_FREERESULT($result_holiday); - } + } // END - if - if (!$HOL_ACTIVE) - { + if (!$HOL_ACTIVE) { // Check if the user want's to receive mails? $result_ver = SQL_QUERY_ESC("SELECT zip FROM "._MYSQL_PREFIX."_user_data WHERE userid=%s".$HTML." AND receive_mails > 0 AND status='CONFIRMED' LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); - if ((SQL_NUMROWS($result_ver) == 1) && (!empty($_POST['zip'])) && ($_CONFIG['order_multi_page'] == "Y")) - { + if ((SQL_NUMROWS($result_ver) == 1) && (!empty($_POST['zip'])) && ($_CONFIG['order_multi_page'] == "Y")) { list($zip) = SQL_FETCHROW($result_ver); SQL_FREERESULT($result_ver); - if (substr($zip, 0, strlen($_POST['zip'])) == $_POST['zip']) - { + if (substr($zip, 0, strlen($_POST['zip'])) == $_POST['zip']) { // Ok, ZIP part is found $uid_cnt++; - } - } - else - { + } // END - if + } else { // Count numbers up! $uid_cnt += SQL_NUMROWS($result_ver); } - } - } + } // END - if + } // END - while // Free memory SQL_FREERESULT($result_uids); $CATS['uids'][] = $uid_cnt; - } + } // END - while // Free memory SQL_FREERESULT($result_cats); @@ -522,8 +481,7 @@ LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); $result = SQL_QUERY("SELECT id, price, payment, mail_title FROM "._MYSQL_PREFIX."_payments ORDER BY payment", __FILE__, __LINE__); $typeS = array(); - if (SQL_NUMROWS($result) > 0) - { + if (SQL_NUMROWS($result) > 0) { // Check for message ID in URL $MSG = ""; switch ($_GET['msg']) @@ -567,8 +525,7 @@ LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); break; case CODE_BLIST_URL: - $MSG = MEMBER_URL_BLACK_LISTED."
-".MEMBER_BLIST_TIME.": ".MAKE_DATETIME($_GET['blist'], "0"); + $MSG = MEMBER_URL_BLACK_LISTED."
\n".MEMBER_BLIST_TIME.": ".MAKE_DATETIME($_GET['blist'], "0"); break; case CODE_NO_RECS_LEFT: @@ -651,8 +608,7 @@ LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); $result = SQL_QUERY_ESC("SELECT subject, text, payment_id, timestamp, url, target_send, cat_id, zip FROM "._MYSQL_PREFIX."_pool WHERE sender=%s AND data_type='TEMP' LIMIT 1", array($GLOBALS['userid']), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) - { + if (SQL_NUMROWS($result) == 1) { // Old order found list($subject, $text, $payment, $tstamp, $url, $target, $cat, $zip) = SQL_FETCHROW($result); SQL_FREERESULT($result); @@ -662,37 +618,32 @@ LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); // Old order is grabbed $OLD_ORDER = true; - } - else - { + } else { // Default output for that your members don't forget it... $url = "http://"; } - // 01 2 21 12 2 23 443 3 3210 - if ((!empty($_POST['data'])) || (($_CONFIG['order_multi_page'] == "N") && ((!IS_ADMIN()) && (!$HTML_EXT)))) - { + // 01 2 21 12 2 23 443 3 3210 + if ((!empty($_POST['data'])) || (($_CONFIG['order_multi_page'] == "N") && ((!IS_ADMIN()) && (!$HTML_EXT)))) { // Pre-output categories $CAT = ""; - foreach ($CATS['id'] as $key => $value) - { + foreach ($CATS['id'] as $key => $value) { $CAT .= "