Changeset 13809

Timestamp:

03/20/10 02:08:41 (2 years ago)

Author:

Alexander Ermashev

Message:

minor changes into simple messenger (remove all possible mysql injections)

Location:

trunk/modules/boonex/simple_messenger/classes

Files:

• BxSimpleMessengerDb.php (modified) (3 diffs)
• BxSimpleMessengerModule.php (modified) (11 diffs)

trunk/modules/boonex/simple_messenger/classes/BxSimpleMessengerDb.php

@@ -53 +53 @@
             $iSenderId = (int) $iSenderId;
             $iRecipientId = (int) $iRecipientId;
-            $sMessage = $this -> escape( $sMessage );
+            $sMessage = process_db_input($sMessage, BX_TAGS_STRIP);
 
             $sQuery = 
@@ -373 +373 @@
         function getHistoryList(&$aCoreSettings, $iRecipient, $iSender, $iLastMessageId = 0, $iMessageLimit = 0)
         {
-            $iRecipient = (int) $iRecipient;
-            $iSender = (int) $iSender;
+            $iRecipient     = (int) $iRecipient;
+            $iSender        = (int) $iSender;
             $iLastMessageId = (int) $iLastMessageId;
-            $iMessageLimit = (int) $iMessageLimit;
+            $iMessageLimit  = (int) $iMessageLimit;
 
             // define the rows limit ;
@@ -433 +433 @@
         {
             $iRecipientId = (int) $iRecipientId;
-            if( !is_array($aRegBoxes) ) {
-                return;
-            }
 
             // define registered chat boxes;
-            $sFilter = null;
-            if ( $aRegBoxes ) {
+            $sFilter = '';
+            if ( $aRegBoxes && is_array($aRegBoxes) ) {
                 foreach( $aRegBoxes  as $iKey => $aItem )
                 {

trunk/modules/boonex/simple_messenger/classes/BxSimpleMessengerModule.php

@@ -28 +28 @@
     require_once('BxSimpleMessengerPrivacy.php');
 
-    check_logged();
-
     /*
      * Simple messenger module by BoonEx
@@ -159 +157 @@
             $this -> sMemberMenuPosition = ( isset($_COOKIE['menu_position']) ) 
                 ? $_COOKIE['menu_position']
-                : getParam( 'ext_nav_menu_top_position' );
+                : getParam('ext_nav_menu_top_position');
 
             $this -> aSmiles = array(
@@ -282 +280 @@
 
                     $sMessage = ( isset($_POST['message']) ) 
-                        ? strip_tags( urldecode($_POST['message']) ) 
-                        : null;
+                        ? urldecode($_POST['message']) 
+                        : '';
 
                     if( $this -> oPrivacy -> check('contact', $iRecipientId, $this -> iLoggedMemberId) ) {
@@ -388 +386 @@
 
                     // defines all registered messages box and last message's id in it ;
-                    $sRegisteredBoxes = ( isset($_POST['registered_chat_boxes']) ) ? $_POST['registered_chat_boxes'] : null;
-
-                    if ( $sRegisteredBoxes ) {
-
-                        $aAllBoxes = explode(',', $sRegisteredBoxes);
+                    $sRegisteredBoxes = ( isset($_POST['registered_chat_boxes']) ) 
+                        ? $_POST['registered_chat_boxes'] 
+                        : '';
+
+                    $aAllBoxes = $sRegisteredBoxes ? explode(',', $sRegisteredBoxes) : '';
+
+                    if ( $aAllBoxes && is_array($aAllBoxes) ) {
                         $aRegBoxes = array();
 
@@ -423 +423 @@
                     $aNewSenders = $this -> _oDb -> getNewChatBoxes($this -> iLoggedMemberId, $aRegBoxes);
 
-                    if ( $aNewSenders ) {
+                    if ($aNewSenders) {
                         // procces new messages array ;
                         foreach( $aNewSenders as $iKey => $iSenderId)
                         {
+                            $iSenderId = (int) $iSenderId;
+
                             // get some sender's info;
                             $aSenderInfo = getProfileInfo($iSenderId);
@@ -448 +450 @@
                         foreach($aRegBoxes as $iSenderId => $aItems)
                         {
+                            $iSenderId = (int) $iSenderId;
+
                             $iLastMessagesId = 0;
                             $iCountMessages  = 0;
@@ -587 +591 @@
             global $oFunctions;
 
+            $iSender          = (int) $iSender;
+            
             $oModuleDb        = new BxDolModuleDb();
             $oUserStatus      = new BxDolUserStatusView();
@@ -717 +723 @@
             $iCountMessages = 0;
 
-            if ( $aMessages ) {
+            if ( $aMessages && is_array($aMessages) ) {
                 foreach( $aMessages as $iKey => $aItems )
                 {
+                    $iKey = (int) $iKey;
+
                     $iCountMessages++;
                     $iLastMessageId   = $aMessages[$iKey]['ID'];
@@ -733 +741 @@
                     );
 
-                    $sOutputMessages .=  $this -> _oTemplate -> parseHtmlByName( 'message.html', $aTemplateKeys );
+                    $sOutputMessages .=  $this -> _oTemplate 
+                            -> parseHtmlByName( 'message.html', $aTemplateKeys );
                 }
             }
@@ -844 +853 @@
             }
 
-            $sOutputCode = null;
+            $sOutputCode = '';
             if( $this -> isMessengerAlowed($iViewedMemberId) 
                 && $this -> isMessengerAlowed($this -> iLoggedMemberId) ) {
@@ -866 +875 @@
         function serviceGetMessengerCore()
         {
-            $sOutputCode = null;
+            $sOutputCode = '';
             if( $this -> isMessengerAlowed($this -> iLoggedMemberId, true) ) {
                 $sOutputCode = $this -> getSimpleMessengerCore();