From 68032702c3b6acf41d3fe66371940c50b4684eee Mon Sep 17 00:00:00 2001
From: Martin Ambrus <martin@martinambrus.com>
Date: Wed, 22 Nov 2017 15:55:17 +0100
Subject: [PATCH] fix: users can't see sent messages

#367
---
 GameEngine/Message.php     | 7 ++++---
 Templates/Message/sent.tpl | 8 ++++----
 nachrichten.php            | 4 ++--
 3 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/GameEngine/Message.php b/GameEngine/Message.php
index 6c34592e..6b9e20f5 100755
--- a/GameEngine/Message.php
+++ b/GameEngine/Message.php
@@ -25,8 +25,9 @@ class Message {
         if ($req_file == 'nachrichten.php') {
             if ( isset( $_GET['t'] ) ) {
                 switch ( $_GET['t'] ) {
-                    // send messages page
+                    // send messages page or a single sent message
                     case 2:
+                    case '2a':
                         $this->getMessages( 2 );
                         break;
 
@@ -402,7 +403,7 @@ class Message {
 
 	private function sendAMessage($topic,$text) {
 		global $session,$database;
-		
+
 		// Vulnerability closed by Shadow
 
 		$q = "SELECT Count(*) as Total FROM ".TB_PREFIX."mdata WHERE owner='".$session->uid."' AND time > ".(time() - 60);
@@ -412,7 +413,7 @@ class Message {
 		return; //flood
 
 		// Vulnerability closed by Shadow
-			
+
 		$allmembersQ = mysqli_query($GLOBALS['link'],"SELECT id FROM ".TB_PREFIX."users WHERE alliance='".$session->alliance."'");
 		$userally = $database->getUserField($session->uid,"alliance",0);
 		$permission=mysqli_fetch_array(mysqli_query($GLOBALS['link'],"SELECT opt7 FROM ".TB_PREFIX."ali_permission WHERE uid='".$session->uid."'"));
diff --git a/Templates/Message/sent.tpl b/Templates/Message/sent.tpl
index 08dcd8e9..f0b0df7e 100644
--- a/Templates/Message/sent.tpl
+++ b/Templates/Message/sent.tpl
@@ -29,7 +29,7 @@
 		<?php } else { ?>
 		<input class="check" type="checkbox" id="s10" name="s10" onclick="Allmsg(this.form);" />
 		<?php } ?></th>
-	<th colspan="2" class="buttons"><input name="delmsg" value="delete" type="image" id="btn_delete" class="dynamic_img" src="img/x.gif" alt="delete" /></th><th class="navi"><?php 
+	<th colspan="2" class="buttons"><input name="delmsg" value="delete" type="image" id="btn_delete" class="dynamic_img" src="img/x.gif" alt="delete" /></th><th class="navi"><?php
      if(!isset($_GET['s']) && count($message->sent1) < 10) {
     echo "&laquo;&raquo;";
     }
@@ -49,7 +49,7 @@
     }
     ?></th></tr></tfoot>
 <tbody>
-   <?php 
+   <?php
     if(isset($_GET['s'])) {
     $s = $_GET['s'];
     }
@@ -58,7 +58,7 @@
     }
     $name = 1;
     $support_messages = (($session->access == MULTIHUNTER || $session->access == ADMIN) && ADMIN_RECEIVE_SUPPORT_MESSAGES);
-    
+
     for($i=(1+$s);$i<=(10+$s);$i++) {
     if(count($message->sent1) >= $i) {
     if($message->sent1[$i-1]['target'] == 0) {
@@ -68,7 +68,7 @@
     echo "<tr>";
     }
     echo "<td class=\"sel\">".((!$support_messages || ($support_messages && $message->inbox1[$i-1]['target'] != 1)) ? "<input class=\"check\" type=\"checkbox\" name=\"n".$name."\" value=\"".$message->sent1[$i-1]['id']."\" />" : '<u><b title="Sent as Support"><i>S</i></b></u>')."</td>
-		<td class=\"top\"><a href=\"nachrichten.php?id=".$message->sent1[$i-1]['id']."\">".$message->sent1[$i-1]['topic']."</a> ";
+		<td class=\"top\"><a href=\"nachrichten.php?t=2a&amp;id=".$message->sent1[$i-1]['id']."\">".$message->sent1[$i-1]['topic']."</a> ";
     if($message->sent1[$i-1]['viewed'] == 0) {
     echo "(unread)";
     }
diff --git a/nachrichten.php b/nachrichten.php
index 9ea0a66a..49c51ba2 100644
--- a/nachrichten.php
+++ b/nachrichten.php
@@ -120,7 +120,7 @@ if ( isset( $_GET['confirm'] ) && is_numeric( $_GET['confirm'] ) ) {
 
 <div id="mid">
 <?php include("Templates/menu.tpl");
-if(isset($_GET['id']) && !isset($_GET['t'])) {
+if(isset($_GET['id']) && (!isset($_GET['t']) || $_GET['t'] == '2a')) {
 	$message->loadMessage($_GET['id']);
 	include("Templates/Message/read.tpl");
 }
@@ -128,7 +128,7 @@ else if(isset($_GET['t'])) {
 	switch($_GET['t']) {
 		case 1:
 		if(isset($_GET['id'])) {
-		$id = preg_replace("/[^a-zA-Z0-9_-]/","",$_GET['id']);
+		    $id = preg_replace("/[^a-zA-Z0-9_-]/","",$_GET['id']);
 		}
 		include("Templates/Message/write.tpl");
 		break;