From 920b3b44f855c2dfbd2417d6effc38110c378a9d Mon Sep 17 00:00:00 2001 From: root Date: Tue, 3 Jul 2007 20:00:18 +0000 Subject: [PATCH] Fixed XSS --- pages/wot/7-old.php | 86 ++++++++++++++++++++++++--------------------- 1 file changed, 45 insertions(+), 41 deletions(-) diff --git a/pages/wot/7-old.php b/pages/wot/7-old.php index 11b4371..ca66088 100644 --- a/pages/wot/7-old.php +++ b/pages/wot/7-old.php @@ -27,43 +27,47 @@ if($_GET['action'] != "update") echo ""._("Home")." ("._("Listed").": $total1)\n"; $display = ""; - if(intval($_GET['locid']) > 0) + $ccid=intval($_GET['ccid']); + $locid=intval($_GET['locid']); + $regid=intval($_GET['regid']); + + if($locid > 0) { - $total4 = mysql_num_rows(mysql_query("select * from `users`,`notary` where `listme`='1' and `locid`='".$_GET['locid']."' and + $total4 = mysql_num_rows(mysql_query("select * from `users`,`notary` where `listme`='1' and `locid`='".$locid."' and `users`.`id`=`notary`.`to` group by `notary`.`to` HAVING SUM(`points`) >= 100")); - $loc = mysql_fetch_assoc(mysql_query("select * from `locations` where `id`='".$_GET['locid']."'")); + $loc = mysql_fetch_assoc(mysql_query("select * from `locations` where `id`='".$locid."'")); $display = "\n
\n"; - } elseif(intval($_GET['locid']) <= 0) { + } elseif($locid <= 0) { echo "\n\n\n\n\n
\n"; - $rc = mysql_num_rows(mysql_query("select * from `locations` where `regid`='".$_GET['regid']."'")); + $rc = mysql_num_rows(mysql_query("select * from `locations` where `regid`='".$regid."'")); if($start > 0) { $prev = $start - $limit; if($prev < 0) $prev = 0; - $st = "[ << Start ] "; - $prev = "[ < Previous $limit ] "; + $st = "[ << Start ] "; + $prev = "[ < Previous $limit ] "; } if($start < $rc - $limit) { $next = $start + $limit; $last = $rc - $limit; - $next = "[ Next $limit > ] "; - $end = "[ End >> ]"; + $next = "[ Next $limit > ] "; + $end = "[ End >> ]"; } echo "
$st
$end
\n"; echo "
$prev
$next
\n"; @@ -122,20 +126,20 @@ if($_GET['action'] != "update") : - + "> - + \n\n\n\n\n\n\n
\n"; - echo "

"; + echo "

"; echo _("Make my location here"); echo "

\n"; echo "

"._("If you are happy with this location, click 'Make my location here' to update your location details.")."


\n"; @@ -144,31 +148,31 @@ if($_GET['action'] != "update") $total1 = mysql_num_rows(mysql_query("select * from `users`,`notary` where `listme`='1' and `users`.`id`=`notary`.`to` group by `notary`.`to` HAVING SUM(`points`) >= 100")); - if(intval($_GET['locid']) > 0) + if($locid > 0) { - $total4 = mysql_num_rows(mysql_query("select * from `users`,`notary` where `listme`='1' and `locid`='".$_GET['locid']."' and + $total4 = mysql_num_rows(mysql_query("select * from `users`,`notary` where `listme`='1' and `locid`='".$locid."' and `users`.`id`=`notary`.`to` group by `notary`.`to` HAVING SUM(`points`) >= 100")); - $loc = mysql_fetch_assoc(mysql_query("select * from `locations` where `id`='".$_GET['locid']."'")); - $_GET['regid'] = $loc['regid']; + $loc = mysql_fetch_assoc(mysql_query("select * from `locations` where `id`='".$locid."'")); + $regid = $loc['regid']; } - if(intval($_GET['regid']) > 0) + if($regid) > 0) { - $total3 = mysql_num_rows(mysql_query("select * from `users`,`notary` where `listme`='1' and `regid`='".$_GET['regid']."' and + $total3 = mysql_num_rows(mysql_query("select * from `users`,`notary` where `listme`='1' and `regid`='".$regid."' and `users`.`id`=`notary`.`to` group by `notary`.`to` HAVING SUM(`points`) >= 100")); - $reg = mysql_fetch_assoc(mysql_query("select * from `regions` where `id`='".$_GET['regid']."'")); - $_GET['ccid'] = $reg['ccid']; + $reg = mysql_fetch_assoc(mysql_query("select * from `regions` where `id`='".$regid."'")); + $ccid = $reg['ccid']; } $total2 = mysql_num_rows(mysql_query("select * from `users`,`notary` where `listme`='1' and - `ccid`='".$_GET['ccid']."' and `users`.`id`=`notary`.`to` + `ccid`='".$ccid."' and `users`.`id`=`notary`.`to` group by `notary`.`to` HAVING SUM(`points`) >= 100")); - $_SESSION['profile']['ccid'] = $_GET['ccid']; - $_SESSION['profile']['regid'] = $_GET['regid']; - $_SESSION['profile']['locid'] = $_GET['locid']; + $_SESSION['profile']['ccid'] = $ccid; + $_SESSION['profile']['regid'] = $regid; + $_SESSION['profile']['locid'] = $locid; - mysql_query("update `users` set `ccid`='".$_GET['ccid']."',`regid`='".$_GET['regid']."',`locid`='".$_GET['locid']."' + mysql_query("update `users` set `ccid`='".$ccid."',`regid`='".$regid."',`locid`='".$locid."' where `id`='".$_SESSION['profile']['id']."'"); echo _("Your details have been updated.");