From 5ecf035cb3dcaa4fa76f513fc838284b0cb9d14a Mon Sep 17 00:00:00 2001 From: iopietro Date: Sat, 19 May 2018 00:01:50 +0200 Subject: [PATCH] Alliance fixes part 2 +Public forums are now displayed for every player on the server +Fixed some security bugs that permitted to create thread and posts to private forums +Fixed some general bugs --- GameEngine/Alliance.php | 6 +- GameEngine/Database.php | 10 +- GameEngine/Lang/en.php | 1 - Templates/Alliance/Forum/forum_2.tpl | 15 +-- Templates/Alliance/Forum/forum_3.tpl | 2 +- Templates/Alliance/Forum/forum_4.tpl | 2 +- Templates/Alliance/forum.tpl | 146 +++++++++++++-------------- allianz.php | 40 ++------ 8 files changed, 93 insertions(+), 129 deletions(-) diff --git a/GameEngine/Alliance.php b/GameEngine/Alliance.php index d83b601d..a58ef511 100755 --- a/GameEngine/Alliance.php +++ b/GameEngine/Alliance.php @@ -87,7 +87,7 @@ class Alliance { public static function canAct($datas, $mode = 0){ global $database, $session; - return ($database->CheckEditRes($datas['aid']) == 1 && ((($database->isAllianceOwner($session->uid) == $datas['alliance'] || + return (/*$database->CheckEditRes($datas['aid']) == 1 && */((($database->isAllianceOwner($session->uid) == $datas['alliance'] || ($datas['forum_perm'] == 1 && $session->alliance == $datas['alliance'])) && ($mode || (isset($datas['admin']) && !empty($datas['admin']) && $datas['admin'] == "switch_admin"))) || $datas['owner'] == $session->uid)); @@ -99,9 +99,9 @@ class Alliance { * @param array $get Contains the values of a GET request */ - public function redirect($get) + public function redirect($get = null) { - header("Location: allianz.php?s=2".(isset($get['fid']) && !empty($get['fid']) ? "&fid=".$get['fid']."" : ""). + header("Location: allianz.php?s=2".(isset($get['fid']) && !empty($get['fid']) && $get['admin'] != 'pos' ? "&fid=".$get['fid']."" : ""). (isset($get['admin']) && !empty($get['admin']) ? "&admin=switch_admin" : "")); exit; } diff --git a/GameEngine/Database.php b/GameEngine/Database.php index f064b404..7d0de786 100755 --- a/GameEngine/Database.php +++ b/GameEngine/Database.php @@ -2256,11 +2256,7 @@ class MYSQLi_DB implements IDbConnection { $q = "SELECT Count(*) as Total FROM " . TB_PREFIX . "forum_cat where alliance = $id"; $result = mysqli_fetch_array(mysqli_query($this->dblink,$q), MYSQLI_ASSOC); - if ($result['Total']) { - return true; - } else { - return false; - } + return $result['Total'] > 0; } // no need to refactor this method @@ -2373,7 +2369,7 @@ class MYSQLi_DB implements IDbConnection { function ForumCat($id) { list($id) = $this->escape_input($id); - $q = "SELECT * from " . TB_PREFIX . "forum_cat where alliance = '$id' ORDER BY sorting DESC, id"; + $q = "SELECT * from " . TB_PREFIX . "forum_cat where alliance = '$id' OR forum_area = 1 ORDER BY sorting DESC, id"; $result = mysqli_query($this->dblink,$q); return $this->mysqli_fetch_all($result); } @@ -2508,7 +2504,7 @@ class MYSQLi_DB implements IDbConnection { $q = "UPDATE ".TB_PREFIX."forum_cat SET - sorting = (SELECT * FROM(SELECT ".(!$mode ? "MIN" : "MAX")."(sorting) FROM ".TB_PREFIX."forum_cat WHERE forum_area = $area AND alliance = $ally AND id != $id) f) ".(!$mode ? "-" : "+")." 1 + sorting = (SELECT * FROM(SELECT ".(!$mode ? "MIN" : "MAX")."(sorting) FROM ".TB_PREFIX."forum_cat WHERE forum_area = $area ".($area != 1 ? "AND alliance = $ally" : "")." AND id != $id) f) ".(!$mode ? "-" : "+")." 1 WHERE id = $id"; return mysqli_query($this->dblink, $q); diff --git a/GameEngine/Lang/en.php b/GameEngine/Lang/en.php index f28aa055..e4ea08d6 100755 --- a/GameEngine/Lang/en.php +++ b/GameEngine/Lang/en.php @@ -1113,7 +1113,6 @@ define("WORLD_WONDER_NOTCHANGE_NAME","You can not change the name of the World W define("WORLD_WONDER_NAME_CHANGED","Name changed"); define("HORSEDRINKING","Horse Drinking Trough"); -define("EXTRA_BONUS","Extra bonus"); define("HORSEDRINKING_DESC","The horse drinking trough of the Romans decreases the training time of cavalry and the upkeep of these troops as well."); define("GREATWORKSHOP","Great Workshop"); diff --git a/Templates/Alliance/Forum/forum_2.tpl b/Templates/Alliance/Forum/forum_2.tpl index 978f0dc9..499db6f5 100644 --- a/Templates/Alliance/Forum/forum_2.tpl +++ b/Templates/Alliance/Forum/forum_2.tpl @@ -14,7 +14,7 @@ $opt = $database->getAlliPermissions($session->uid, $aid); $displayarray = $database->getUserArray($session->uid, 1); $forumcat = $database->ForumCat(htmlspecialchars($displayarray['alliance'])); $ally = $session->alliance; -$public = mysqli_fetch_array(mysqli_query($database->dblink, "SELECT Count(*) as Total FROM ".TB_PREFIX."forum_cat WHERE alliance = $ally AND forum_area = 1"), MYSQLI_ASSOC); +$public = mysqli_fetch_array(mysqli_query($database->dblink, "SELECT Count(*) as Total FROM ".TB_PREFIX."forum_cat WHERE forum_area = 1"), MYSQLI_ASSOC); $confederation = mysqli_fetch_array(mysqli_query($database->dblink, "SELECT Count(*) as Total FROM ".TB_PREFIX."forum_cat WHERE alliance = $ally AND forum_area = 2"), MYSQLI_ASSOC); $alliance = mysqli_fetch_array(mysqli_query($database->dblink, "SELECT Count(*) as Total FROM ".TB_PREFIX."forum_cat WHERE alliance = $ally AND forum_area = 0"), MYSQLI_ASSOC); $closed = mysqli_fetch_array(mysqli_query($database->dblink, "SELECT Count(*) as Total FROM ".TB_PREFIX."forum_cat WHERE alliance = $ally AND forum_area = 3"), MYSQLI_ASSOC); @@ -43,6 +43,9 @@ if($count == 0) echo "".NO_FO foreach($forumcat as $arr){ if($arr['forum_area'] != $index) continue; + $checkArray = ['aid' => $aid, 'alliance' => $arr['alliance'], 'forum_perm' => $opt['opt5'], + 'owner' => 0, 'admin' => $_GET['admin']]; + $countop = $database->CountCat($arr['id']); $lpost = $owner = ""; if($countop > 0){ @@ -65,13 +68,11 @@ foreach($forumcat as $arr){ } echo ''; - if($database->CheckEditRes($aid) == 1 && ($database->isAllianceOwner($session->uid) == $arr['alliance'] || $opt['opt5'] == 1) && isset($_GET['admin']) && !empty($_GET['admin']) && $_GET['admin'] == "switch_admin"){ - echo ' + if(Alliance::canAct($checkArray)){ + echo ' To top - edit
- - To bottom - + edit
+ To bottom delete'; } else echo 'Thread without new posts'; diff --git a/Templates/Alliance/Forum/forum_3.tpl b/Templates/Alliance/Forum/forum_3.tpl index bd3649c9..19c238f2 100644 --- a/Templates/Alliance/Forum/forum_3.tpl +++ b/Templates/Alliance/Forum/forum_3.tpl @@ -32,7 +32,7 @@ $title = stripslashes($showTopic['title']); Move topic