Changeset 189

Timestamp:

06/09/06 11:13:19 (2 years ago)

Author:

rollercow

Message:

Users should no longer be able to delete comments that don't belong to them.

Files:

• admin.lib.php (modified) (9 diffs)

admin.lib.php

@@ -438 +438 @@
-                }
-                // checkbox for comment moderation, either is or isnt
- 
+
-                        $moderate = "true";
-                }
@@ -445 +445 @@
-                }       
-                // checkbox for editor, either is or isnt
- 
+
-                        $editor = "true";
-                } 
@@ -603 +603 @@
-                        }
-                        //how display each of the comments
-
+{ 
-                                echo "\t<tr class=\"errorinfo\">\n";
-else
+} else {
-                                echo "\t<tr>\n";
+                        }
-                        echo "\t\t<td><a href=\"mailto:{$r['email']}\" title=\"IP: {$r['host']}\">{$r['name']}</a></td>\n";
-                        echo "\t\t<td>{$r['body']}</td>\n";
-                        echo "\t\t<td><input type=\"radio\" name=\"group[$count]\" value=\"a:{$r['id']}\" /></td>\n";
-
+{ 
-                                echo "\t\t<td><input type=\"radio\" name=\"group[".$count++."]\" value=\"d:{$r['id']}\" checked=\"checked\"/></td>\n";
-else
+} else {
-                                echo "\t\t<td><input type=\"radio\" name=\"group[".$count++."]\" value=\"d:{$r['id']}\" /></td>\n";
+                        }
-                        echo "\t</tr>\n";
-                }
@@ -621 +623 @@
-                echo "</div>\n";
-        }
-//got here
-        // approve or delete comments
-        function updateComments() {
@@ -628 +629 @@
-                        return;
-                }
+                $check = "";
-                $approved = "";
-                $acount = 0;
-                $deleted = "";
-                $dcount = 0;
+                //get the comment numbers and requested actions.
-                foreach($_POST['group'] as $comment) {
-                        $c = explode(":", $comment);
-                        if ($c[0] == "a") {
-
+(int)
-                                $acount++;
-                        } elseif ($c[0] == "d") {
-
+(int)
-                                $dcount++;
-                        } else {
@@ -647 +650 @@
-                $approved = substr($approved, 0, -2);
-                $deleted = substr($deleted, 0, -2);
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-                if($deleted!="") {
-                        db_query("DELETE FROM comments WHERE id IN ($deleted);");
-                }
+                //set moderated flag on comments
-                if($approved!="") {
-                        db_query("UPDATE comments SET moderated=true WHERE id IN ($approved);");
-                }
+                //reprint the form
-                echo "<div class=\"updateinfo\">$acount "._("comments approved").", $dcount "._("comments deleted").".</div>\n";
-                $this->printComments();
-                $this->printAuthorisedUsers();
-        }
-
+
-        function deleteComments($entry) {
-                if(isset($_POST['submit'])) {
@@ -669 +684 @@
-                                $del = "(";
-                                foreach($_POST['comment'] as $c) {
-id = $c
+comments.id = ".(int)$c."
-                                }
-                                $del = substr($del, 0, -4).")";
+                                //check the comments exist and blong to the user
+                                $result = db_getrow(db_query("SELECT count(comments.id) from comments join entries on comments.post = entries.id where entries.user_id = ".$this->id." and $del;"));
+                                if($result[count] != count($_POST['comment'])) {
+                                        error(1,_("Cant find the requested comments, maybe they have already been deleted."));
+                                        return;
+                                }
+                                //delete the comments
-                                $sql = "DELETE FROM comments WHERE $del";
-                                if(!db_query($sql)) {
@@ -701 +723 @@
-                $result = db_query("SELECT name,email FROM authorised_emails WHERE user_id=".$this->id." ORDER BY email ASC");
-                while($r = db_getrow($result)) {
- 
+
-                }
-                echo "</select><br />\n";
@@ -844 +866 @@
-                if (isset($_POST['username']) && trim($_POST['username']) != "" && (int)$_POST['username'] == 0) {
-                        if (safeuname($_POST['username'])) {
-       
-       
-       
-       
-       
+
+
+
+
+
-                } else {
-                        $this->inputError = _("No Username Provided");