diff --git a/gazelle.sql b/gazelle.sql index 97bfd924..27b91bb4 100644 --- a/gazelle.sql +++ b/gazelle.sql @@ -1161,7 +1161,7 @@ CREATE TABLE `users_main` ( `Class` tinyint(2) NOT NULL DEFAULT '5', `Uploaded` bigint(20) unsigned NOT NULL DEFAULT '0', `Downloaded` bigint(20) unsigned NOT NULL DEFAULT '0', - `Title` varchar(255) NOT NULL DEFAULT '', + `Title` text NOT NULL, `Enabled` enum('0','1','2') NOT NULL DEFAULT '0', `Paranoia` text, `Visible` enum('1','0') NOT NULL DEFAULT '1', diff --git a/sections/user/takemoderate.php b/sections/user/takemoderate.php index df7d2b83..23edb731 100644 --- a/sections/user/takemoderate.php +++ b/sections/user/takemoderate.php @@ -266,9 +266,16 @@ } if ($Title!=db_string($Cur['Title']) && check_perms('users_edit_titles')) { - $UpdateSet[]="Title='$Title'"; - $EditSummary[]="title changed to $Title"; - $LightUpdates['Title']=$_POST['Title']; + // Using the unescaped value for the test to avoid confusion + if (strlen($_POST['Title']) > 1024) { + error("Custom titles can be at most 1024 characters."); + header("Location: user.php?id=".$UserID); + die(); + } else { + $UpdateSet[]="Title='$Title'"; + $EditSummary[]="title changed to $Title"; + $LightUpdates['Title']=$_POST['Title']; + } } if ($Donor!=$Cur['Donor'] && check_perms('users_give_donor')) {