Mirror/Gazelle
1
0
Fork 0
mirror of https://github.com/WhatCD/Gazelle.git synced 2025-02-21 20:59:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Empty commit

Browse Source
This commit is contained in:
Git 2013-06-11 08:01:24 +00:00
parent b4c8ebb041
commit 1da89b3c82
23 changed files with 143 additions and 98 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
classes/forums.class.php
View File

@ -29,7 +29,7 @@ public static function quote_notify($Body, $PostID, $Page, $PageID) {
$Level = 0; $Level = 0;
foreach ($Matches as $M) { foreach ($Matches as $M) {
if ($M[0] != '[/quote]') { if ($M[0] != '[/quote]') {
if ($Level == 0 && isset($M[1]) && strlen($M[1]) > 0 && preg_match('/^[a-z0-9_?]{1,20}$/iD', $M[1])) { if ($Level == 0 && isset($M[1]) && strlen($M[1]) > 0 && preg_match(USERNAME_REGEX, $M[1])) {
$Usernames[] = preg_replace('/(^[.,]*)|([.,]*$)/', '', $M[1]); // wut? $Usernames[] = preg_replace('/(^[.,]*)|([.,]*$)/', '', $M[1]); // wut?
} }
++$Level; ++$Level;

11
classes/regex.php
View File

@ -2,12 +2,13 @@
//resource_type://username:password@domain:port/path?query_string#anchor //resource_type://username:password@domain:port/path?query_string#anchor
define('RESOURCE_REGEX','(https?|ftps?):\/\/'); define('RESOURCE_REGEX','(https?|ftps?):\/\/');
define('IP_REGEX','(\d{1,3}\.){3}\d{1,3}'); define('IP_REGEX','(\d{1,3}\.){3}\d{1,3}');
define('DOMAIN_REGEX','(ssl.)?(www.)?[a-z0-9-\.]{1,255}\.[a-zA-Z]{2,6}'); define('DOMAIN_REGEX','([a-z0-9\-\_]+\.)+[a-z]{2,6}');
define('PORT_REGEX', '\d{1,5}'); define('PORT_REGEX', '\d{1,5}');
define('URL_REGEX','('.RESOURCE_REGEX.')('.IP_REGEX.'|'.DOMAIN_REGEX.')(:'.PORT_REGEX.')?(\/\S*)*'); define('URL_REGEX','('.RESOURCE_REGEX.')('.IP_REGEX.'|'.DOMAIN_REGEX.')(:'.PORT_REGEX.')?(\/\S*)*');
define('USERNAME_REGEX', '/^[a-z0-9_?]{1,20}$/iD');
define('EMAIL_REGEX','[_a-z0-9-]+([.+][_a-z0-9-]+)*@'.DOMAIN_REGEX); define('EMAIL_REGEX','[_a-z0-9-]+([.+][_a-z0-9-]+)*@'.DOMAIN_REGEX);
define('IMAGE_REGEX', URL_REGEX.'\/\S+\.(jpg|jpeg|tif|tiff|png|gif|bmp)(\?\S*)?'); define('IMAGE_REGEX', URL_REGEX.'\/\S+\.(jpg|jpeg|tif|tiff|png|gif|bmp)(\?\S*)?');
define('SITELINK_REGEX', RESOURCE_REGEX.'(ssl.)?'.preg_quote(NONSSL_SITE_URL, '/').''); define('SITELINK_REGEX', RESOURCE_REGEX.'(ssl.)?'.preg_quote(NONSSL_SITE_URL, '/'));
define('TORRENT_REGEX', SITELINK_REGEX.'\/torrents.php\?(id=\d{1,10}\&)?torrentid=\d{1,10}'); define('TORRENT_REGEX', SITELINK_REGEX.'\/torrents\.php\?(.*&)?torrentid=(\d+)'); // torrentid = group 4
define('TORRENT_GROUP_REGEX', SITELINK_REGEX.'\/torrents.php\?id=\d{1,10}\&(torrentid=\d{1,10})?'); define('TORRENT_GROUP_REGEX', SITELINK_REGEX.'\/torrents\.php\?(.*&)?id=(\d+)'); // id = group 4
?> define('ARTIST_REGEX', SITELINK_REGEX.'\/artist\.php\?(.*&)?id=(\d+)'); // id = group 4

4
classes/validate.class.php
View File

@ -119,7 +119,7 @@ function ValidateForm($ValidateArray) {
$MinLength = 10; $MinLength = 10;
} }
if (!preg_match('/^(https?):\/\/([a-z0-9\-\_]+\.)+([a-z]{1,5}[^\.])(\/[^<>]+)*$/i', $ValidateVar)) { if (!preg_match('/^'.URL_REGEX.'$/i', $ValidateVar)) {
return $Field['ErrorMessage']; return $Field['ErrorMessage'];
} elseif (strlen($ValidateVar) > $MaxLength) { } elseif (strlen($ValidateVar) > $MaxLength) {
return $Field['ErrorMessage']; return $Field['ErrorMessage'];
@ -139,7 +139,7 @@ function ValidateForm($ValidateArray) {
$MinLength = 1; $MinLength = 1;
} }
if (preg_match('/[^a-z0-9_\-?]/i', $ValidateVar)) { if (!preg_match('/^'.USERNAME_REGEX.'$/i', $ValidateVar)) {
return $Field['ErrorMessage']; return $Field['ErrorMessage'];
} elseif (strlen($ValidateVar) > $MaxLength) { } elseif (strlen($ValidateVar) > $MaxLength) {
return $Field['ErrorMessage']; return $Field['ErrorMessage'];

33
sections/artist/change_artistid.php
View File

@ -19,20 +19,32 @@
error('Please enter a valid artist ID number or a valid artist name.'); error('Please enter a valid artist ID number or a valid artist name.');
} }
$DB->query("SELECT Name FROM artists_group WHERE ArtistID = $ArtistID LIMIT 1"); $DB->query("
SELECT Name
FROM artists_group
WHERE ArtistID = $ArtistID
LIMIT 1");
if (!(list($ArtistName) = $DB->next_record(MYSQLI_NUM, false))) { if (!(list($ArtistName) = $DB->next_record(MYSQLI_NUM, false))) {
error('An error has occured.'); error('An error has occured.');
} }
if ($NewArtistID > 0) { if ($NewArtistID > 0) {
// Make sure that's a real artist ID number, and grab the name // Make sure that's a real artist ID number, and grab the name
$DB->query("SELECT Name FROM artists_group WHERE ArtistID = $NewArtistID LIMIT 1"); $DB->query("
SELECT Name
FROM artists_group
WHERE ArtistID = $NewArtistID
LIMIT 1");
if (!(list($NewArtistName) = $DB->next_record())) { if (!(list($NewArtistName) = $DB->next_record())) {
error('Please enter a valid artist ID number.'); error('Please enter a valid artist ID number.');
} }
} else { } else {
// Didn't give an ID, so try to grab based on the name // Didn't give an ID, so try to grab based on the name
$DB->query("SELECT ArtistID FROM artists_alias WHERE Name = '".db_string($NewArtistName)."' LIMIT 1"); $DB->query("
SELECT ArtistID
FROM artists_alias
WHERE Name = '".db_string($NewArtistName)."'
LIMIT 1");
if (!(list($NewArtistID) = $DB->next_record())) { if (!(list($NewArtistID) = $DB->next_record())) {
error('No artist by that name was found.'); error('No artist by that name was found.');
} }
@ -57,17 +69,26 @@
$Collages = $DB->collect('CollageID'); $Collages = $DB->collect('CollageID');
// And the info to avoid double-listing an artist if it and the target are on the same group // And the info to avoid double-listing an artist if it and the target are on the same group
$DB->query("SELECT DISTINCT GroupID FROM torrents_artists WHERE ArtistID = $NewArtistID"); $DB->query("
SELECT DISTINCT GroupID
FROM torrents_artists
WHERE ArtistID = $NewArtistID");
$NewArtistGroups = $DB->collect('GroupID'); $NewArtistGroups = $DB->collect('GroupID');
$NewArtistGroups[] = '0'; $NewArtistGroups[] = '0';
$NewArtistGroups = implode(',',$NewArtistGroups); $NewArtistGroups = implode(',',$NewArtistGroups);
$DB->query("SELECT DISTINCT RequestID FROM requests_artists WHERE ArtistID = $NewArtistID"); $DB->query("
SELECT DISTINCT RequestID
FROM requests_artists
WHERE ArtistID = $NewArtistID");
$NewArtistRequests = $DB->collect('RequestID'); $NewArtistRequests = $DB->collect('RequestID');
$NewArtistRequests[] = '0'; $NewArtistRequests[] = '0';
$NewArtistRequests = implode(',',$NewArtistRequests); $NewArtistRequests = implode(',',$NewArtistRequests);
$DB->query("SELECT DISTINCT UserID from bookmarks_artists WHERE ArtistID = $NewArtistID"); $DB->query("
SELECT DISTINCT UserID
FROM bookmarks_artists
WHERE ArtistID = $NewArtistID");
$NewArtistBookmarks = $DB->collect('UserID'); $NewArtistBookmarks = $DB->collect('UserID');
$NewArtistBookmarks[] = '0'; $NewArtistBookmarks[] = '0';
$NewArtistBookmarks = implode(',',$NewArtistBookmarks); $NewArtistBookmarks = implode(',',$NewArtistBookmarks);

16
sections/collages/add_artist.php
View File

@ -65,8 +65,7 @@ function add_artist($CollageID, $ArtistID) {
} }
if ($_REQUEST['action'] == 'add_artist') { if ($_REQUEST['action'] == 'add_artist') {
$URLRegex = '/^https?:\/\/(www\.|ssl\.)?'.preg_quote(NONSSL_SITE_URL, '/').'\/artist\.php\?(page=[0-9]+&)?id=([0-9]+)/i'; $Val->SetFields('url', '1','regex','The URL must be a link to a artist on the site.',array('regex' => '/^'.ARTIST_REGEX.'/i'));
$Val->SetFields('url', '1','regex','The URL must be a link to a artist on the site.',array('regex'=>$URLRegex));
$Err = $Val->ValidateForm($_POST); $Err = $Val->ValidateForm($_POST);
if ($Err) { if ($Err) {
@ -76,9 +75,8 @@ function add_artist($CollageID, $ArtistID) {
$URL = $_POST['url']; $URL = $_POST['url'];
// Get artist ID // Get artist ID
$URLRegex = '/artist\.php\?(page=[0-9]+&)?id=([0-9]+)/i'; preg_match('/^'.ARTIST_REGEX.'/i', $URL, $Matches);
preg_match($URLRegex, $URL, $Matches); $ArtistID = $Matches[4];
$ArtistID = $Matches[2];
if (!$ArtistID || (int) $ArtistID == 0) { if (!$ArtistID || (int) $ArtistID == 0) {
error(404); error(404);
} }
@ -91,8 +89,6 @@ function add_artist($CollageID, $ArtistID) {
add_artist($CollageID, $ArtistID); add_artist($CollageID, $ArtistID);
} else { } else {
$URLRegex = '/^https?:\/\/(www\.|ssl\.)?'.NONSSL_SITE_URL.'\/artist\.php\?(page=[0-9]+&)?id=([0-9]+)/i';
$URLs = explode("\n",$_REQUEST['urls']); $URLs = explode("\n",$_REQUEST['urls']);
$ArtistIDs = array(); $ArtistIDs = array();
$Err = ''; $Err = '';
@ -115,9 +111,9 @@ function add_artist($CollageID, $ArtistID) {
foreach ($URLs as $URL) { foreach ($URLs as $URL) {
$Matches = array(); $Matches = array();
if (preg_match($URLRegex, $URL, $Matches)) { if (preg_match('/^'.ARTIST_REGEX.'/i', $URL, $Matches)) {
$ArtistIDs[] = $Matches[3]; $ArtistIDs[] = $Matches[4];
$ArtistID = $Matches[3]; $ArtistID = $Matches[4];
} else { } else {
$Err = "One of the entered URLs ($URL) does not correspond to an artist on the site."; $Err = "One of the entered URLs ($URL) does not correspond to an artist on the site.";
break; break;

16
sections/collages/add_torrent.php
View File

@ -65,8 +65,7 @@ function add_torrent($CollageID, $GroupID) {
} }
if ($_REQUEST['action'] == 'add_torrent') { if ($_REQUEST['action'] == 'add_torrent') {
$URLRegex = '/^https?:\/\/(www\.|ssl\.)?'.NONSSL_SITE_URL.'\/torrents\.php\?(page=[0-9]+&)?id=([0-9]+)/i'; $Val->SetFields('url', '1','regex','The URL must be a link to a torrent on the site.',array('regex' => '/^'.TORRENT_GROUP_REGEX.'/i'));
$Val->SetFields('url', '1','regex','The URL must be a link to a torrent on the site.',array('regex'=>$URLRegex));
$Err = $Val->ValidateForm($_POST); $Err = $Val->ValidateForm($_POST);
if ($Err) { if ($Err) {
@ -76,9 +75,8 @@ function add_torrent($CollageID, $GroupID) {
$URL = $_POST['url']; $URL = $_POST['url'];
// Get torrent ID // Get torrent ID
$URLRegex = '/torrents\.php\?(page=[0-9]+&)?id=([0-9]+)/i'; preg_match('/^'.TORRENT_GROUP_REGEX.'/i', $URL, $Matches);
preg_match($URLRegex, $URL, $Matches); $TorrentID = $Matches[4];
$TorrentID = $Matches[2];
if (!$TorrentID || (int)$TorrentID == 0) { if (!$TorrentID || (int)$TorrentID == 0) {
error(404); error(404);
} }
@ -91,8 +89,6 @@ function add_torrent($CollageID, $GroupID) {
add_torrent($CollageID, $GroupID); add_torrent($CollageID, $GroupID);
} else { } else {
$URLRegex = '/^https?:\/\/(www\.|ssl\.)?'.NONSSL_SITE_URL.'\/torrents\.php\?(page=[0-9]+&)?id=([0-9]+)/i';
$URLs = explode("\n",$_REQUEST['urls']); $URLs = explode("\n",$_REQUEST['urls']);
$GroupIDs = array(); $GroupIDs = array();
$Err = ''; $Err = '';
@ -115,9 +111,9 @@ function add_torrent($CollageID, $GroupID) {
foreach ($URLs as $URL) { foreach ($URLs as $URL) {
$Matches = array(); $Matches = array();
if (preg_match($URLRegex, $URL, $Matches)) { if (preg_match('/^'.TORRENT_GROUP_REGEX.'/i', $URL, $Matches)) {
$GroupIDs[] = $Matches[3]; $GroupIDs[] = $Matches[4];
$GroupID = $Matches[3]; $GroupID = $Matches[4];
} else { } else {
$Err = "One of the entered URLs ($URL) does not correspond to a torrent on the site."; $Err = "One of the entered URLs ($URL) does not correspond to a torrent on the site.";
break; break;

11
sections/friends/add.php
View File

@ -1,10 +1,19 @@
<? <?
authorize(); authorize();
if (!is_number($_GET['friendid'])) {
error(404);
}
$FriendID = db_string($_GET['friendid']); $FriendID = db_string($_GET['friendid']);
// Check if the user $FriendID exists
$DB->query("SELECT 1 FROM users_main WHERE ID = '$FriendID'");
if ($DB->record_count() == 0) {
error(404);
}
$DB->query(" $DB->query("
INSERT IGNORE INTO friends INSERT IGNORE INTO friends
(UserID, FriendID) (UserID, FriendID)
VALUES ('$LoggedUser[ID]', '$FriendID')"); VALUES ('$LoggedUser[ID]', '$FriendID')");
header('Location: friends.php'); header('Location: friends.php');
?>

15
sections/inbox/inbox.php
View File

@ -67,7 +67,7 @@
} }
} }
$sql .= (($Section == 'sentbox') ? ' cu.InSentbox' : ' cu.InInbox'); $sql .= (($Section == 'sentbox') ? ' cu.InSentbox' : ' cu.InInbox');
$sql .="='1'"; $sql .= "='1'";
$sql .=" $sql .="
GROUP BY c.ID GROUP BY c.ID
@ -80,7 +80,7 @@
$Count = $DB->record_count(); $Count = $DB->record_count();
$Pages = Format::get_pages($Page, $NumResults, MESSAGES_PER_PAGE, 9); $Pages = Format::get_pages($Page, $NumResults, MESSAGES_PER_PAGE, 9);
echo $Pages; echo "\t\t$Pages\n";
?> ?>
</div> </div>
@ -136,17 +136,20 @@
<tr class="<?=$RowClass?>"> <tr class="<?=$RowClass?>">
<td class="center"><input type="checkbox" name="messages[]=" value="<?=$ConvID?>" /></td> <td class="center"><input type="checkbox" name="messages[]=" value="<?=$ConvID?>" /></td>
<td> <td>
<? if ($Unread) { <? echo "\t\t\t\t\t\t"; // for proper indentation of HTML
if ($Unread) {
echo '<strong>'; echo '<strong>';
} }
if ($Sticky) { if ($Sticky) {
echo 'Sticky: '; echo 'Sticky: ';
} }
echo "\n";
?> ?>
<a href="inbox.php?action=viewconv&amp;id=<?=$ConvID?>"><?=$Subject?></a> <a href="inbox.php?action=viewconv&amp;id=<?=$ConvID?>"><?=$Subject?></a>
<? <?
echo "\t\t\t\t\t\t"; // for proper indentation of HTML
if ($Unread) { if ($Unread) {
echo '</strong>'; echo "</strong>\n";
} ?> } ?>
</td> </td>
<td><?=Users::format_username($SenderID, true, true, true, true)?></td> <td><?=Users::format_username($SenderID, true, true, true, true)?></td>
@ -164,7 +167,9 @@
</form> </form>
<? } ?> <? } ?>
</div> </div>
<div class="linkbox"><?=$Pages?></div> <div class="linkbox">
<? echo "\t\t$Pages\n"; ?>
</div>
</div> </div>
<? <?
View::show_footer(); View::show_footer();

4
sections/inbox/takecompose.php
View File

@ -1,7 +1,6 @@
<? <?php
authorize(); authorize();
if (empty($_POST['toid'])) { if (empty($_POST['toid'])) {
error(404); error(404);
} }
@ -10,7 +9,6 @@
error(403); error(403);
} }
if (isset($_POST['convid']) && is_number($_POST['convid'])) { if (isset($_POST['convid']) && is_number($_POST['convid'])) {
$ConvID = $_POST['convid']; $ConvID = $_POST['convid'];
$Subject = ''; $Subject = '';

2
sections/login/index.php
View File

@ -168,7 +168,7 @@
// Normal login // Normal login
else { else {
$Validate->SetFields('username',true,'regex','You did not enter a valid username.',array('regex'=>'/^[a-z0-9_?]{1,20}$/i')); $Validate->SetFields('username',true,'regex','You did not enter a valid username.',array('regex' => USERNAME_REGEX));
$Validate->SetFields('password','1','string','You entered an invalid password.',array('minlength'=>'6','maxlength'=>'150')); $Validate->SetFields('password','1','string','You entered an invalid password.',array('minlength'=>'6','maxlength'=>'150'));
$DB->query("SELECT ID, Attempts, Bans, BannedUntil FROM login_attempts WHERE IP='".db_string($_SERVER['REMOTE_ADDR'])."'"); $DB->query("SELECT ID, Attempts, Bans, BannedUntil FROM login_attempts WHERE IP='".db_string($_SERVER['REMOTE_ADDR'])."'");

2
sections/register/index.php
View File

@ -32,7 +32,7 @@
} }
} elseif (OPEN_REGISTRATION || !empty($_REQUEST['invite'])) { } elseif (OPEN_REGISTRATION || !empty($_REQUEST['invite'])) {
$Val->SetFields('username', true, 'regex', 'You did not enter a valid username.', array('regex'=>'/^[a-z0-9_?]{1,20}$/iD')); $Val->SetFields('username', true, 'regex', 'You did not enter a valid username.', array('regex' => USERNAME_REGEX));
$Val->SetFields('email', true, 'email', 'You did not enter a valid email address.'); $Val->SetFields('email', true, 'email', 'You did not enter a valid email address.');
$Val->SetFields('password', true, 'regex', 'A strong password is between 8 and 40 characters long, contains at least 1 lowercase and uppercase letter, and contains at least a number or symbol', array('regex'=>'/(?=^.{8,}$)(?=.*[^a-zA-Z])(?=.*[A-Z])(?=.*[a-z]).*$/')); $Val->SetFields('password', true, 'regex', 'A strong password is between 8 and 40 characters long, contains at least 1 lowercase and uppercase letter, and contains at least a number or symbol', array('regex'=>'/(?=^.{8,}$)(?=.*[^a-zA-Z])(?=.*[A-Z])(?=.*[a-z]).*$/'));
$Val->SetFields('confirm_password', true, 'compare', 'Your passwords do not match.', array('comparefield'=>'password')); $Val->SetFields('confirm_password', true, 'compare', 'Your passwords do not match.', array('comparefield'=>'password'));

8
sections/reportsv2/takereport.php
View File

@ -48,9 +48,9 @@
} }
if (!empty($_POST['sitelink'])) { if (!empty($_POST['sitelink'])) {
if (preg_match_all('/((https?:\/\/)?([a-zA-Z0-9\-]+(\.[a-zA-Z0-9\-]+)*\.)?'.SSL_SITE_URL.'\/torrents.php\?(id=[0-9]+\&)?torrentid=([0-9]+))/is', $_POST['sitelink'], $Matches)) { if (preg_match_all('/'.TORRENT_REGEX.'/i', $_POST['sitelink'], $Matches)) {
$ExtraIDs = implode(' ', $Matches[6]); $ExtraIDs = implode(' ', $Matches[4]);
if (in_array($TorrentID, $Matches[6])) { if (in_array($TorrentID, $Matches[4])) {
$Err = "The extra permalinks you gave included the link to the torrent you're reporting!"; $Err = "The extra permalinks you gave included the link to the torrent you're reporting!";
} }
} else { } else {
@ -63,7 +63,7 @@
if (!empty($_POST['link'])) { if (!empty($_POST['link'])) {
//resource_type://domain:port/filepathname?query_string#anchor //resource_type://domain:port/filepathname?query_string#anchor
// http:// www .foo.com /bar // http:// www .foo.com /bar
if (preg_match_all('/(https?:\/\/)?[a-zA-Z0-9\-]+(\.[a-zA-Z0-9\-]+)*(:[0-9]{2,5})?(\/(\S)+)?/is', $_POST['link'], $Matches)) { if (preg_match_all('/'.URL_REGEX.'/is', $_POST['link'], $Matches)) {
$Links = implode(' ', $Matches[0]); $Links = implode(' ', $Matches[0]);
} else { } else {
$Err = "The extra links you provided weren't links..."; $Err = "The extra links you provided weren't links...";

2
sections/reportsv2/views.php
View File

@ -215,7 +215,7 @@
SELECT SELECT
r.ResolverID, r.ResolverID,
um.Username, um.Username,
COUNT(r.ID) AS Count, COUNT(r.ID) AS Count
FROM reportsv2 AS r FROM reportsv2 AS r
LEFT JOIN users_main AS um ON r.ResolverID=um.ID LEFT JOIN users_main AS um ON r.ResolverID=um.ID
WHERE r.Status = 'InProgress' WHERE r.Status = 'InProgress'

15
sections/requests/takefill.php
View File

@ -14,22 +14,15 @@
$TorrentID = $_GET['torrentid']; $TorrentID = $_GET['torrentid'];
} else { } else {
if (empty($_POST['link'])) { if (empty($_POST['link'])) {
$Err = 'You forgot to supply a link to the filling torrent'; error('You forgot to supply a link to the filling torrent');
} else { } else {
$Link = $_POST['link']; $Link = $_POST['link'];
if (preg_match('/'.TORRENT_REGEX.'/i', $Link, $Matches) < 1) { if (!preg_match('/'.TORRENT_REGEX.'/i', $Link, $Matches)) {
$Err = 'Your link didn\'t seem to be a valid torrent link'; error('Your link didn\'t seem to be a valid torrent link');
} else { } else {
$TorrentID = $Matches[0]; $TorrentID = $Matches[4];
} }
} }
if (!empty($Err)) {
error($Err);
}
preg_match("/torrentid=([0-9]+)/i", $Link, $Matches);
$TorrentID = $Matches[1];
if (!$TorrentID || !is_number($TorrentID)) { if (!$TorrentID || !is_number($TorrentID)) {
error(404); error(404);
} }

5
sections/requests/takenew_edit.php
View File

@ -177,9 +177,8 @@
// GroupID // GroupID
if (!empty($_POST['groupid'])) { if (!empty($_POST['groupid'])) {
$GroupID = trim($_POST['groupid']); $GroupID = trim($_POST['groupid']);
$URLRegex = '/^https?:\/\/(www\.|ssl\.)?'.SSL_SITE_URL.'\/torrents\.php\?(page=[0-9]+&)?id=([0-9]+)/i'; if (preg_match('/^'.TORRENT_GROUP_REGEX.'/i', $GroupID, $Matches)) {
if (preg_match($URLRegex, $GroupID, $Matches)) { $GroupID = $Matches[4];
$GroupID = $Matches[3];
} }
if (is_number($GroupID)) { if (is_number($GroupID)) {
$DB->query("SELECT 1 FROM torrents_group WHERE ID = '$GroupID' AND CategoryID = 1"); $DB->query("SELECT 1 FROM torrents_group WHERE ID = '$GroupID' AND CategoryID = 1");

2
sections/tools/managers/bans.php
View File

@ -64,7 +64,7 @@
$sql .= "WHERE Reason LIKE '%".db_string($_REQUEST['notes'])."%' "; $sql .= "WHERE Reason LIKE '%".db_string($_REQUEST['notes'])."%' ";
} }
if (!empty($_REQUEST['ip']) && preg_match('/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/', $_REQUEST['ip'])) { if (!empty($_REQUEST['ip']) && preg_match('/'.IP_REGEX.'/', $_REQUEST['ip'])) {
if (!empty($_REQUEST['notes'])) { if (!empty($_REQUEST['notes'])) {
$sql .= "AND '".Tools::ip_to_unsigned($_REQUEST['ip'])."' BETWEEN FromIP AND ToIP "; $sql .= "AND '".Tools::ip_to_unsigned($_REQUEST['ip'])."' BETWEEN FromIP AND ToIP ";
} else { } else {

7
sections/tools/managers/recommend_add.php
View File

@ -12,7 +12,7 @@
// Make sure the URL they entered is on our site, and is a link to a torrent // Make sure the URL they entered is on our site, and is a link to a torrent
$URLRegex = '/^https?:\/\/(www\.|ssl\.)?'.NONSSL_SITE_URL.'\/torrents\.php\?id=([0-9]+)$/i'; $URLRegex = '/^https?:\/\/(www\.|ssl\.)?'.NONSSL_SITE_URL.'\/torrents\.php\?id=([0-9]+)$/i';
$Val->SetFields('url', $Val->SetFields('url',
'1','regex','The URL must be a link to a torrent on the site.',array('regex'=>$URLRegex)); '1','regex','The URL must be a link to a torrent on the site.',array('regex' => '/^'.TORRENT_GROUP_REGEX.'/i'));
$Err = $Val->ValidateForm($_POST); // Validate the form $Err = $Val->ValidateForm($_POST); // Validate the form
if ($Err) { // if something didn't validate if ($Err) { // if something didn't validate
@ -22,9 +22,8 @@
} }
// Get torrent ID // Get torrent ID
$URLRegex = '/torrents\.php\?id=([0-9]+)$/i'; preg_match('/^'.TORRENT_GROUP_REGEX.'/i', $URL, $Matches);
preg_match($URLRegex, $URL, $Matches); $GroupID = $Matches[4];
$GroupID = $Matches[1];
if (empty($GroupID) || !is_number($GroupID)) { if (empty($GroupID) || !is_number($GroupID)) {
error(404); error(404);

20
sections/tools/managers/tokens.php
View File

@ -10,12 +10,18 @@
if (!is_number($Tokens) || ($Tokens < 0)) { if (!is_number($Tokens) || ($Tokens < 0)) {
error('Please enter a valid number of tokens.'); error('Please enter a valid number of tokens.');
} }
$sql = "UPDATE users_main SET FLTokens = FLTokens + $Tokens WHERE Enabled = '1'"; $sql = "
UPDATE users_main
SET FLTokens = FLTokens + $Tokens
WHERE Enabled = '1'";
if (!isset($_REQUEST['leechdisabled'])) { if (!isset($_REQUEST['leechdisabled'])) {
$sql .= " AND can_leech = 1"; $sql .= " AND can_leech = 1";
} }
$DB->query($sql); $DB->query($sql);
$sql = "SELECT ID FROM users_main WHERE Enabled = '1'"; $sql = "
SELECT ID
FROM users_main
WHERE Enabled = '1'";
if (!isset($_REQUEST['leechdisabled'])) { if (!isset($_REQUEST['leechdisabled'])) {
$sql .= " AND can_leech = 1"; $sql .= " AND can_leech = 1";
} }
@ -39,9 +45,15 @@
} else { } else {
$Where = "WHERE Enabled = '1' OR FLTokens > $Tokens"; $Where = "WHERE Enabled = '1' OR FLTokens > $Tokens";
} }
$DB->query("SELECT ID FROM users_main $Where"); $DB->query("
SELECT ID
FROM users_main
$Where");
$Users = $DB->to_array(); $Users = $DB->to_array();
$DB->query("UPDATE users_main SET FLTokens = $Tokens $Where"); $DB->query("
UPDATE users_main
SET FLTokens = $Tokens
$Where");
foreach ($Users as $UserID) { foreach ($Users as $UserID) {
list($UserID) = $UserID; list($UserID) = $UserID;

2
sections/tools/services/get_host.php
View File

@ -14,7 +14,7 @@
$Octets = explode('.', $_GET['ip']); $Octets = explode('.', $_GET['ip']);
if ( if (
empty($_GET['ip']) || empty($_GET['ip']) ||
!preg_match('/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/', $_GET['ip']) || !preg_match('/'.IP_REGEX.'/', $_GET['ip']) ||
$Octets[0] < 0 || $Octets[0] < 0 ||
$Octets[0] > 255 || $Octets[0] > 255 ||
$Octets[1] < 0 || $Octets[1] < 0 ||

52
sections/torrents/browse2.php
View File

@ -56,29 +56,41 @@ function header_link($SortKey,$DefaultWay="desc") {
// Setting default search options // Setting default search options
if (!empty($_GET['setdefault'])) { if (!empty($_GET['setdefault'])) {
$UnsetList = array('page','setdefault'); $UnsetList = array('page', 'setdefault');
$UnsetRegexp = '/(&|^)('.implode('|',$UnsetList).')=.*?(&|$)/i'; $UnsetRegexp = '/(&|^)('.implode('|', $UnsetList).')=.*?(&|$)/i';
$DB->query("SELECT SiteOptions FROM users_info WHERE UserID='".db_string($LoggedUser['ID'])."'"); $DB->query("
list($SiteOptions)=$DB->next_record(MYSQLI_NUM, false); SELECT SiteOptions
FROM users_info
WHERE UserID='".db_string($LoggedUser['ID'])."'");
list($SiteOptions) = $DB->next_record(MYSQLI_NUM, false);
if (!empty($SiteOptions)) { if (!empty($SiteOptions)) {
$SiteOptions = unserialize($SiteOptions); $SiteOptions = unserialize($SiteOptions);
} else { } else {
$SiteOptions = array(); $SiteOptions = array();
} }
$SiteOptions['DefaultSearch'] = preg_replace($UnsetRegexp,'',$_SERVER['QUERY_STRING']); $SiteOptions['DefaultSearch'] = preg_replace($UnsetRegexp, '', $_SERVER['QUERY_STRING']);
$DB->query("UPDATE users_info SET SiteOptions='".db_string(serialize($SiteOptions))."' WHERE UserID='".db_string($LoggedUser['ID'])."'"); $DB->query("
UPDATE users_info
SET SiteOptions='".db_string(serialize($SiteOptions))."'
WHERE UserID='".db_string($LoggedUser['ID'])."'");
$Cache->begin_transaction('user_info_heavy_'.$UserID); $Cache->begin_transaction('user_info_heavy_'.$UserID);
$Cache->update_row(false, array('DefaultSearch'=>$SiteOptions['DefaultSearch'])); $Cache->update_row(false, array('DefaultSearch'=>$SiteOptions['DefaultSearch']));
$Cache->commit_transaction(0); $Cache->commit_transaction(0);
// Clearing default search options // Clearing default search options
} elseif (!empty($_GET['cleardefault'])) { } elseif (!empty($_GET['cleardefault'])) {
$DB->query("SELECT SiteOptions FROM users_info WHERE UserID='".db_string($LoggedUser['ID'])."'"); $DB->query("
list($SiteOptions)=$DB->next_record(MYSQLI_NUM, false); SELECT SiteOptions
$SiteOptions=unserialize($SiteOptions); FROM users_info
$SiteOptions['DefaultSearch']=''; WHERE UserID='".db_string($LoggedUser['ID'])."'");
$DB->query("UPDATE users_info SET SiteOptions='".db_string(serialize($SiteOptions))."' WHERE UserID='".db_string($LoggedUser['ID'])."'"); list($SiteOptions) = $DB->next_record(MYSQLI_NUM, false);
$SiteOptions = unserialize($SiteOptions);
$SiteOptions['DefaultSearch'] = '';
$DB->query("
UPDATE users_info
SET SiteOptions='".db_string(serialize($SiteOptions))."'
WHERE UserID='".db_string($LoggedUser['ID'])."'");
$Cache->begin_transaction('user_info_heavy_'.$UserID); $Cache->begin_transaction('user_info_heavy_'.$UserID);
$Cache->update_row(false, array('DefaultSearch'=>'')); $Cache->update_row(false, array('DefaultSearch'=>''));
$Cache->commit_transaction(0); $Cache->commit_transaction(0);
@ -146,7 +158,7 @@ function header_link($SortKey,$DefaultWay="desc") {
/** Start preparation of property arrays **/ /** Start preparation of property arrays **/
array_pop($Bitrates); // remove 'other' array_pop($Bitrates); // remove 'other'
$SearchBitrates = array_merge($Bitrates, array('v0','v1','v2','24bit')); $SearchBitrates = array_merge($Bitrates, array('v0', 'v1', 'v2', '24bit'));
foreach ($SearchBitrates as $ID=>$Val) { foreach ($SearchBitrates as $ID=>$Val) {
$SearchBitrates[$ID] = strtolower($Val); $SearchBitrates[$ID] = strtolower($Val);
@ -237,7 +249,7 @@ function header_link($SortKey,$DefaultWay="desc") {
//Simple search //Simple search
if (!empty($_GET['searchstr'])) { if (!empty($_GET['searchstr'])) {
$SearchString = trim($_GET['searchstr']); $SearchString = trim($_GET['searchstr']);
$Words = explode(' ',strtolower($SearchString)); $Words = explode(' ', strtolower($SearchString));
if (!empty($Words)) { if (!empty($Words)) {
$FilterBitrates = $FilterFormats = array(); $FilterBitrates = $FilterFormats = array();
$BasicSearch = array('include' => array(), 'exclude' => array()); $BasicSearch = array('include' => array(), 'exclude' => array());
@ -250,7 +262,7 @@ function header_link($SortKey,$DefaultWay="desc") {
if ($Word[0] == '!' && strlen($Word) >= 2) { if ($Word[0] == '!' && strlen($Word) >= 2) {
if ($Word == '!100%') { if ($Word == '!100%') {
$_GET['haslog'] = '-1'; $_GET['haslog'] = '-1';
} elseif (strpos($Word,'!',1) === false) { } elseif (strpos($Word, '!', 1) === false) {
$BasicSearch['exclude'][] = $Word; $BasicSearch['exclude'][] = $Word;
} else { } else {
$BasicSearch['include'][] = $Word; $BasicSearch['include'][] = $Word;
@ -279,7 +291,7 @@ function header_link($SortKey,$DefaultWay="desc") {
} }
if (!empty($BasicSearch['exclude'])) { if (!empty($BasicSearch['exclude'])) {
foreach ($BasicSearch['exclude'] as $Word) { foreach ($BasicSearch['exclude'] as $Word) {
$QueryParts[] = '!'.Sphinxql::escape_string(substr($Word,1)); $QueryParts[] = '!'.Sphinxql::escape_string(substr($Word, 1));
} }
} }
if (!empty($FilterBitrates)) { if (!empty($FilterBitrates)) {
@ -309,7 +321,10 @@ function header_link($SortKey,$DefaultWay="desc") {
//Get tag aliases. //Get tag aliases.
$TagAliases = $Cache->get_value('tag_aliases_search'); $TagAliases = $Cache->get_value('tag_aliases_search');
if (!$TagAliases) { if (!$TagAliases) {
$DB->query("SELECT ID,BadTag,AliasTag FROM tag_aliases ORDER BY BadTag"); $DB->query("
SELECT ID, BadTag, AliasTag
FROM tag_aliases
ORDER BY BadTag");
$TagAliases = $DB->to_array(); $TagAliases = $DB->to_array();
//Unify tag aliases to be in_this_format as tags not in.this.format //Unify tag aliases to be in_this_format as tags not in.this.format
array_walk_recursive($TagAliases, create_function('&$val', '$val = preg_replace("/\./","_", $val);')); array_walk_recursive($TagAliases, create_function('&$val', '$val = preg_replace("/\./","_", $val);'));
@ -400,7 +415,7 @@ function header_link($SortKey,$DefaultWay="desc") {
} }
if (!empty($Words['exclude'])) { if (!empty($Words['exclude'])) {
foreach ($Words['exclude'] as $Word) { foreach ($Words['exclude'] as $Word) {
$QueryParts[] = '!'.Sphinxql::escape_string(substr($Word,1)); $QueryParts[] = '!'.Sphinxql::escape_string(substr($Word, 1));
} }
} }
if (!empty($QueryParts)) { if (!empty($QueryParts)) {
@ -451,7 +466,7 @@ function header_link($SortKey,$DefaultWay="desc") {
$Filtered = true; $Filtered = true;
} }
} }
foreach (array('hascue','scene','vanityhouse','releasetype') as $Search) { foreach (array('hascue', 'scene', 'vanityhouse', 'releasetype') as $Search) {
if (isset($_GET[$Search]) && $_GET[$Search] !== '') { if (isset($_GET[$Search]) && $_GET[$Search] !== '') {
$SphQL->where($Search, $_GET[$Search]); $SphQL->where($Search, $_GET[$Search]);
// Release type is group specific // Release type is group specific
@ -459,6 +474,7 @@ function header_link($SortKey,$DefaultWay="desc") {
$SphQLTor->where($Search, $_GET[$Search]); $SphQLTor->where($Search, $_GET[$Search]);
} }
if ($_GET[$Search] !== 0) { if ($_GET[$Search] !== 0) {
//TODO: Clean up this hack
// Hack! Deleted torrents may show up if we set to true unconditionally. Hope no one notices // Hack! Deleted torrents may show up if we set to true unconditionally. Hope no one notices
$Filtered = true; $Filtered = true;
} }

6
sections/user/advancedsearch.php
View File

@ -4,11 +4,11 @@
* Best viewed with a wide screen monitor * * Best viewed with a wide screen monitor *
**********************************************************************/ **********************************************************************/
if (!empty($_GET['search'])) { if (!empty($_GET['search'])) {
if (preg_match("/^".IP_REGEX."$/", $_GET['search'])) { if (preg_match('/^'.IP_REGEX.'$/', $_GET['search'])) {
$_GET['ip'] = $_GET['search']; $_GET['ip'] = $_GET['search'];
} elseif (preg_match("/^".EMAIL_REGEX."$/i", $_GET['search'])) { } elseif (preg_match('/^'.EMAIL_REGEX.'$/i', $_GET['search'])) {
$_GET['email'] = $_GET['search']; $_GET['email'] = $_GET['search'];
} elseif (preg_match('/^[a-z0-9_?]{1,20}$/iD',$_GET['search'])) { } elseif (preg_match(USERNAME_REGEX,$_GET['search'])) {
$DB->query(" $DB->query("
SELECT ID SELECT ID
FROM users_main FROM users_main

2
sections/user/connchecker.php
View File

@ -5,7 +5,7 @@
$Octets = explode(".", $_GET['ip']); $Octets = explode(".", $_GET['ip']);
if ( if (
empty($_GET['ip']) || empty($_GET['ip']) ||
!preg_match('/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/', $_GET['ip']) || !preg_match('/'.IP_REGEX.'/', $_GET['ip']) ||
$Octets[0] < 0 || $Octets[0] < 0 ||
$Octets[0] > 255 || $Octets[0] > 255 ||
$Octets[1] < 0 || $Octets[1] < 0 ||

4
sections/wiki/takelink.php
View File

@ -1,10 +1,10 @@
<? <?
authorize(); authorize();
if (preg_match('/^https?:\/\/(www\.|ssl\.)?'.NONSSL_SITE_URL.'\/wiki\.php\?action=article\&id=([0-9]+)/i',$_POST['url'],$Match)) { if (preg_match('/^'.SITELINK_REGEX.'\/wiki\.php\?action=article\&id=([0-9]+)/i',$_POST['url'],$Match)) {
$ArticleID = $Match[2]; $ArticleID = $Match[2];
} }
if (preg_match('/^https?:\/\/(www\.|ssl\.)?'.NONSSL_SITE_URL.'\/wiki\.php\?action=article\&name=(.+)/i',$_POST['url'],$Match)) { if (preg_match('/^'.SITELINK_REGEX.'\/wiki\.php\?action=article\&name=(.+)/i',$_POST['url'],$Match)) {
$ArticleID = $Alias->to_id($Match[2]); $ArticleID = $Alias->to_id($Match[2]);
} }
if (!$ArticleID) { if (!$ArticleID) {