X-Git-Url: http://git.harvie.cz/?a=blobdiff_plain;f=wwwroot%2Finc%2Feventz%2Fbanlist.inc;h=3f08d4d01cf9e0bd5bc26413e8ca025fb47ba620;hb=d068d94b5e62de2f80164fd8062adce6e0ad93ae;hp=9d4633266150e43ba9a6ddc5faec31e777994473;hpb=2fb33507204ed8c25b7fb90238c9cc5b7af60fa2;p=mirrors%2FKyberia-bloodline.git

diff --git a/wwwroot/inc/eventz/banlist.inc b/wwwroot/inc/eventz/banlist.inc
index 9d46332..3f08d4d 100644
--- a/wwwroot/inc/eventz/banlist.inc
+++ b/wwwroot/inc/eventz/banlist.inc
@@ -1,14 +1,15 @@
 <?php
 
 	function banlist() {
-		global $db,$error,$node,$logger;
+		global $db,$error,$node;
 		$node_id=$node['node_id'];
 
 if ($node['node_permission']!=('owner' || 'master' || 'op')) {
 $error=$error_messages['EVENT_PERMISSION_ERROR'];
 return false;
 }
-		$bans=explode(";",$_POST['bans']);
+		$bans = explode(";",$_POST['bans']); // XXX sqli?
+		$bans = array_map('mysql_real_escape_string', $bans); 
 
 		$db->query("update node_access set node_permission='' where node_id=$node_id and node_permission='ban'");
 		foreach ($bans as $ban) {
@@ -22,7 +23,7 @@ return false;
 					$q="insert into node_access set node_permission='ban',node_id=$node_id,user_id=".$set->getString('user_id');
 					$db->query($q);
 				}
-				$logger->log('add ban',$node_id,'ok',$ban);
+				logger::log('add ban',$node_id,'ok',$ban);
 			}
 			else { $error .= "$ban does not exist..."; }
 		}