X-Git-Url: https://git.harvie.cz/?a=blobdiff_plain;f=wwwroot%2Fnodes.php;h=a1e6456c3c5f89eaf78542503faaf1a26ce0ae34;hb=5586f4ec30ee38861b0a9135cdd88cf2b07e03c4;hp=d220c4c5295c810731004e294f410f5a9e22d400;hpb=e909f81b8c7e4413f5788b36d8fbf2409ac11f46;p=mirrors%2FKyberia-bloodline.git

diff --git a/wwwroot/nodes.php b/wwwroot/nodes.php
index d220c4c..a1e6456 100644
--- a/wwwroot/nodes.php
+++ b/wwwroot/nodes.php
@@ -6,6 +6,7 @@ if (!empty($_POST['FORCE_OB']) && $_POST['FORCE_OB'] == 'true') ob_start();
 //echo "je to uz uplne v pici. vsetky data su stratene, prajem pekny den :)";
 //exit;
 error_reporting(1);
+$_SESSION['debugging']=1;
 //exit;
 
 //starting timer for benchmarking purposes
@@ -40,7 +41,8 @@ require(INCLUDE_DIR.'nodes.inc');
 require(INCLUDE_DIR.'error_messages.inc');
 require(INCLUDE_DIR.'database.inc');
 
-$db=new CLASS_DATABASE();
+$db = new CLASS_DATABASE();
+//$logger = new logger; //XXX
 
 if (!empty($_GET['template_id'])) {
 	$template_id=$_GET['template_id'];
@@ -55,22 +57,25 @@ elseif (!empty($_GET['node_id'])) {
 	$node = nodes::getNodeById($_GET['node_id'],$_SESSION['user_id']);
 }
 
+//XXX Paths are wrong (!)
 //loading smarty template engine and setting main parameters
 require(SMARTY_DIR.'Smarty.class.php');
 $smarty = new Smarty;
 
-$smarty->template_dir = TEMPLATE_DIR.TEMPLATE_SET;
+//$smarty->php_handling = SMARTY_PHP_REMOVE; //XXX
+$smarty->template_dir = TEMPLATE_DIR;
 //echo TEMPLATE_DIR.TEMPLATE_SET;
 //echo $smarty->template_dir;
-$smarty->compile_dir = SYSTEM_ROOT."data/templates_c/".TEMPLATE_SET;
-$smarty->config_dir = SMARTY_DIR.'configs/';
+$smarty->compile_dir = SYSTEM_DATA."templates_c/";
+$smarty->config_dir = SMARTY_DIR.'configs/'; //XXX neexistuje
 $smarty->cache_dir = SMARTY_DIR.'cache/';
 $smarty->plugins_dir = SMARTY_PLUGIN_DIR ;
 if ($_SESSION['debugging']) $smarty->debugging=true;
 
-//initializing variables
+// initializing variables
+// preg_replace prevents LFI
 if (empty($_POST['event'])) $event=false;
-else $event=$_POST['event'];
+else $event= preg_replace( "![^a-zA-Z0-9_]+!", "", $_POST['event']);
 
 
 if ($_SESSION['debugging']) {
@@ -156,10 +161,10 @@ if ($template_id=='rss')
 	{
 	   require_once(INCLUDE_DIR.'/feedcreator.class.php');
 
-	   $rss =& new UniversalFeedCreator();
+	   $rss = new UniversalFeedCreator();
 	   $rss->title = "Kyberia mail";
 	   $rss->description = "";
-	   $rss->link = "https://kyberia.sk/id/24";
+	   $rss->link = "https://". SYSTEM_URL . "/id/24";
 
 	   $query = "select date_format(mail.mail_timestamp,\"%e.%c. %k:%i:%s\") as cas,
    userfrom.user_action as locationfrom_action,
@@ -177,9 +182,9 @@ if ($template_id=='rss')
 		   $m = $set->getRecord();
 		   if ($m['mail_to'] != $_SESSION['user_id'])
 			   continue;
-		   $item =& new FeedItem();
+		   $item = new FeedItem();
 		   $item->title = $m['mail_from_name'];
-		   $item->link = "https://kyberia.sk/id/24";
+		   $item->link = "https://".SYSTEM_URL."/id/24";
 		   $item->description = $m['mail_text'];
 		   $rss->addItem($item);
 	   }
@@ -189,9 +194,9 @@ if ($template_id=='rss')
 	{
 		require_once(INCLUDE_DIR.'/feedcreator.class.php');
 
-		$rss =& new UniversalFeedCreator();
+		$rss = new UniversalFeedCreator();
 		$rss->title = "Kyberia bookmarks";
-		$rss->link = "http://kyberia.sk/id/19";
+		$rss->link = "http://".SYSTEM_URL."/id/19";
 
 		require_once(SMARTY_PLUGIN_DIR.'/function.get_bookmarks.php');
 		smarty_function_get_bookmarks(array(), $smarty);
@@ -201,9 +206,9 @@ if ($template_id=='rss')
 			if (is_array($_item['children']))
 				foreach ($_item['children'] as $_b)
 				{
-					$item =& new FeedItem();
+					$item = new FeedItem();
 					$item->title = $_b['node_name'];
-					$item->link = "http://kyberia.sk/id/".$_b['node_id']."/rss";
+					$item->link = "http://".SYSTEM_URL."/id/".$_b['node_id']."/rss";
 					$rss->addItem($item);
 				}
 		}
@@ -213,10 +218,10 @@ if ($template_id=='rss')
 	{
 		require_once(INCLUDE_DIR.'/feedcreator.class.php');
 
-		$rss =& new UniversalFeedCreator();
+		$rss = new UniversalFeedCreator();
 		$rss->title = $node['node_name'];
 		$rss->description = "";
-		$rss->link = "http://kyberia.sk/id/".$node['node_id'];
+		$rss->link = "http://".SYSTEM_URL."/id/".$node['node_id'];
 
 		// K list
 		if ($_GET['node_id']=='15')
@@ -235,9 +240,9 @@ if ($template_id=='rss')
 
 		foreach ($_items as $_item)
 		{
-			$item =& new FeedItem();
+			$item = new FeedItem();
 			$item->title = $_item['node_name'];
-			$item->link = "http://kyberia.sk/id/".$_item['node_id'];
+			$item->link = "http://".SYSTEM_URL."/id/".$_item['node_id'];
 			$item->description = $_item['node_content'];
 			$rss->addItem($item);
 		}
@@ -279,7 +284,7 @@ if ($_SESSION['user_id']) {
 //if node is css
 if ($node['template_id']!='2019721'){
 
-	log::log('enter',$node['node_id'],'ok',$node['node_user_subchild_count']);
+	logger::log('enter',$node['node_id'],'ok',$node['node_user_subchild_count']);
 	if (!empty($_SESSION['user_id']) && is_numeric($node['node_id'])) {
 		$q="update node_access set visits=visits+1,node_user_subchild_count='0',last_visit=NOW() where node_id='".$node['node_id']."' and user_id='".$_SESSION['user_id']."'";
 //		echo $q;
@@ -326,7 +331,7 @@ elseif (!$permissions['r'] && $_GET['magic_word']) {
 
 
 else {
-	log::log('enter',$node['node_id'],'failed');
+	logger::log('enter',$node['node_id'],'failed');
 }
 
 
@@ -339,17 +344,32 @@ if ($user_id=$_SESSION['user_id']) {
 	$smarty->assign('bookstyl',$_SESSION['bookstyl']);
 	$smarty->assign('fook',$_SESSION['fook']);
 	$smarty->assign('user_id',$_SESSION['user_id']);
-	if (!empty($_SESSION['cube_vector'])) $smarty->assign('cube_vector',$_SESSION['cube_vector']);
+	if (!empty($_SESSION['cube_vector'])) 
+		$smarty->assign('cube_vector',$_SESSION['cube_vector']);
         $smarty->assign('friends',$_SESSION['friends']); //req by freezy, done by darkaural
 	$smarty->assign('user_quota',$_SESSION['user_quota']);
-	$newmailset=$db->query("select user_mail,user_mail_name,user_k,k_wallet from users where user_id='$user_id'");
+
+	$newmail_q = sprintf('select u.user_mail_id
+				, u.user_k
+				, u.k_wallet
+				, u.user_mail
+				, ms.user_id as mail_sender_id
+				, ms.login as mail_sender
+				from users u
+				left join users ms on ms.user_id = u.user_mail_id
+				where u.user_id = %d',
+				$user_id);
+	$newmailset = $db->query($newmail_q);
+
+//$newmailset=$db->query("select user_mail,user_mail_name,user_k,k_wallet from users where user_id='$user_id'");
+
 	$newmailset->next();
 	$new_mail=$newmailset->getString('user_mail');
 	$newmailset2 = $db->query("select users.user_mail_id,mailsender.login
  from users left join users as mailsender on users.user_mail_id = mailsender.user_id where users.user_id = '$user_id'");
 	$newmailset2->next();
 	$smarty->assign('new_mail',$new_mail);
-	$smarty->assign('new_mail_name',$newmailset->getString('user_mail_name'));
+	$smarty->assign('new_mail_name',$newmailset->getString('mail_sender'));
 	$smarty->assign('new_mail_name2',$newmailset2->getString('login'));
 	$user_k=$newmailset->getString('user_k');
 	$smarty->assign('user_k',$user_k);
@@ -387,11 +407,6 @@ if ($node['node_system_access']=='crypto') {
 	$smarty->assign('crypto_pass',$_SESSION['crypto'][$node['node_id']]);
 }
 
-//hlaska
-//$error .= "ocakavajte planovany vypadok okolo 6 hodiny <br>
-//s pozdravom br .)";
-//$error .= "dnes od 22:00 zurka v subclube! ucast povinna!";
-
 $smarty->assign('error',$error);
 $smarty->assign('permissions',$permissions);
 $smarty->assign('current_vector',$node['node_vector']);