diff --git a/mozilla/webtools/update/core/inc_global.php b/mozilla/webtools/update/core/inc_global.php index e0676a82a8b..b9831aff274 100644 --- a/mozilla/webtools/update/core/inc_global.php +++ b/mozilla/webtools/update/core/inc_global.php @@ -113,4 +113,26 @@ echo"\n"; include"$page_footer"; exit; } + +function writeFormKey() +{ + $sql = "SELECT UserPass FROM t_userprofiles WHERE UserID = '".$_SESSION["uid"]."'"; + $res = mysql_query($sql) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + $row = mysql_fetch_array($res); + echo "\n"; +} + +function checkFormKey() +{ + $key = $_POST["formkey"]; + $sql = "SELECT UserPass FROM t_userprofiles WHERE UserID = '".$_SESSION["uid"]."'"; + $res = mysql_query($sql) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + $row = mysql_fetch_array($res); + if ($key != md5($row["UserPass"])) + { + echo "
WARNING: FORMKEY MISMATCH!
\n"; + return false; + } + return true; +} ?> \ No newline at end of file diff --git a/mozilla/webtools/update/developers/itemoverview.php b/mozilla/webtools/update/developers/itemoverview.php index f098bd115dc..f1f18b34d13 100755 --- a/mozilla/webtools/update/developers/itemoverview.php +++ b/mozilla/webtools/update/developers/itemoverview.php @@ -109,11 +109,13 @@ $sql2 = "SELECT TV.Version, AppName, MinAppVer, MaxAppVer FROM `t_version` TV

Developer Comments

\n"; } + $id = $_POST["id"]; + $comments = $_POST["comments"]; + if (checkFormKey()) { + $sql = "UPDATE `t_main` SET `devcomments`='$comments' WHERE `id`='$id'"; + $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + if ($sql_result) { echo"Developer Comments Updated...
\n"; } + } } $sql = "SELECT `devcomments` FROM `t_main` WHERE `id`='$id' LIMIT 1"; @@ -123,6 +125,7 @@ $sql = "SELECT `devcomments` FROM `t_main` WHERE `id`='$id' LIMIT 1"; ?>
"> + ">
  diff --git a/mozilla/webtools/update/developers/listmanager.php b/mozilla/webtools/update/developers/listmanager.php index 079b0004a34..13413198176 100755 --- a/mozilla/webtools/update/developers/listmanager.php +++ b/mozilla/webtools/update/developers/listmanager.php @@ -66,6 +66,7 @@ $sql .=" ORDER BY `Type` , `Name` ASC ";
+ New Input File: "> @@ -84,12 +85,14 @@ if ($_POST["name"] && $_POST["authors"] && $_POST["categories"] && $_POST["descr //Everything We *must* have is present... Begin.... //Phase One, update t_main values... +if (checkFormKey()) { $sql = "UPDATE `t_main` SET `Name`= '$_POST[name]', `Homepage`='$_POST[homepage]', `Description`='$_POST[description]', `DateUpdated`=NOW(NULL) WHERE `ID`='$_POST[id]' LIMIT 1"; //echo"$sql
\n"; //Debug $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); if ($sql_result) { echo"Your update to $_POST[name] has been submitted successfully...
\n"; } +} echo""; //Phase Two, Author List -- Autocomplete and Verify @@ -122,14 +125,18 @@ unset($a,$r); //Commit Updates to AuthorXref tables.. with the ID and UserID. if ($updateauthors != "false") { //Remove Current Authors - $sql = "DELETE FROM `t_authorxref` WHERE `ID` = '$_POST[id]'"; - $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + if (checkFormKey()) { + $sql = "DELETE FROM `t_authorxref` WHERE `ID` = '$_POST[id]'"; + $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + } //Add New Authors based on $authorids sort($authorids); foreach ($authorids as $authorid) { - $sql = "INSERT INTO `t_authorxref` (`ID`, `UserID`) VALUES ('$_POST[id]', '$authorid');"; - $result = mysql_query($sql) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + if (checkFormKey()) { + $sql = "INSERT INTO `t_authorxref` (`ID`, `UserID`) VALUES ('$_POST[id]', '$authorid');"; + $result = mysql_query($sql) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + } } echo"Authors for $_POST[name]'s updated...
\n"; } else { @@ -141,17 +148,19 @@ unset($authors); //Clear from Post.. //Phase Three, Category List, update linkages. //print_r($_POST["categories"]); //Delete Current Category Linkages... + if (checkFormKey()) { $sql = "DELETE FROM `t_categoryxref` WHERE `ID` = '$_POST[id]'"; //echo"$sql
\n"; //Debug $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + //Add New Categories from $_POST["categories"] foreach ($_POST["categories"] as $categoryid) { $sql = "INSERT INTO `t_categoryxref` (`ID`, `CategoryID`) VALUES ('$_POST[id]', '$categoryid');"; //echo"$sql
\n"; //Debug $result = mysql_query($sql) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); - } + } echo"Categories for $_POST[name]'s updated...
\n"; - + } //End _POST if. } else { @@ -211,7 +220,8 @@ echo"

Deleting $name, please wait...

\n"; } } - $sql = "DELETE FROM `t_main` WHERE `ID`='$id'"; + if (checkFormKey()) { + $sql = "DELETE FROM `t_main` WHERE `ID`='$id'"; $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); if ($sql_result) { echo"$name has been deleted...
\n"; @@ -220,6 +230,7 @@ echo"

Deleting $name, please wait...

\n"; echo"\n\n"; exit; } + } } @@ -266,6 +277,7 @@ unset($v);

"> +"> @@ -366,11 +378,12 @@ $notes = $_POST["notes"]; $id = $_POST["id"]; $uri = $_POST["uri"]; $osid = $_POST["osid"]; + if (checkFormKey()) { $sql = "UPDATE `t_version` SET `OSID`='$osid', `Notes`='$notes', `DateUpdated`=NOW(NULL) WHERE `ID`='$id' AND `URI`='$uri'"; //echo"$sql
\n"; $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); echo"Version Notes and OS for $_POST[name] $_POST[version] updated...
\n"; - + } //Phase Two -- Update Min/Max Versions //Construct Internal App_Version Arrays @@ -400,10 +413,12 @@ if (!$minappver_int) {$minappver_int = $minappver;} if (!$maxappver_int) {$maxappver_int = $maxappver;} if ($minappver && $maxappver) { + if (checkFormKey()) { $sql = "UPDATE `t_version` SET `MinAppVer`='$minappver', `MinAppVer_int`='$minappver_int', `MaxAppVer`='$maxappver', `MaxAppVer_int`='$maxappver_int' WHERE `vID`='$vid'"; //echo"$sql
\n"; $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); echo"Updated Target Application Values for Application $i...
\n"; + } } else { if (!$minappver) { echo"Error: Minimum Version is not specified or invalid
\n"; } if (!$maxappver) { echo"Error: Maximum Version is not specified or invalid
\n"; } @@ -424,8 +439,11 @@ $sql = "SELECT `Name` FROM `t_main` WHERE `ID` = '$id'"; $row = mysql_fetch_array($sql_result); $name = $row["Name"]; - $sql = "DELETE FROM `t_version` WHERE `ID`='$id' AND `URI`='$uri'"; + $sql_result = false; + if (checkFormKey()) { + $sql = "DELETE FROM `t_version` WHERE `ID`='$id' AND `URI`='$uri'"; $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + } if ($sql_result) { //Delete File from server if (strpos("$uri","approvalfile.php/")) { @@ -492,6 +510,7 @@ if (!$vid) {$vid = $_POST["vid"]; }

GUID:
"> +\n"; echo"\n"; diff --git a/mozilla/webtools/update/developers/previews.php b/mozilla/webtools/update/developers/previews.php index 387d9e310c5..0964fe7d072 100755 --- a/mozilla/webtools/update/developers/previews.php +++ b/mozilla/webtools/update/developers/previews.php @@ -60,7 +60,9 @@ $sql = "DELETE FROM `t_previews` WHERE `PreviewID`='$previewid'"; } else { $sql = "UPDATE `t_previews` SET `caption`='$caption', `preview`='$preview' WHERE `PreviewID`='$previewid'"; } - $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + if (checkFormKey()) { + $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + } } echo"Previews successfully updated. The new values for the preview records should be shown below.
\n"; @@ -76,6 +78,7 @@ $sql = "SELECT * FROM `t_previews` TP WHERE `ID`='$id' ORDER BY `PreviewID`"; if ($num_results>"0") { ?> &function=updatepreviews"> +Click here to refresh this page to show the added entry for editing.

"; + if ($sql_result=="1") { + echo"Your File $filename ($filesize bytes) has been successfully uploaded and added to the database. Click here to refresh this page to show the added entry for editing.

"; + } } } @@ -236,6 +241,7 @@ echo"The image you uploaded has errors and could not be proces ?> &function=addpreview" enctype="multipart/form-data"> + Only PNG or JPG images are supported for addition to the preview screenshots page for your item. Check the "List Page Preview" box if you'd like the image to be featured on the list and the top of the item details pages. To just have it added to your screenshots page, leave the box unchecked
diff --git a/mozilla/webtools/update/developers/usermanager.php b/mozilla/webtools/update/developers/usermanager.php index d286ce8eb5b..83f5d5022b3 100755 --- a/mozilla/webtools/update/developers/usermanager.php +++ b/mozilla/webtools/update/developers/usermanager.php @@ -60,96 +60,101 @@ if ($_POST["submit"] && $_GET["action"]=="update") {

Updating User List...

\n"; + //Process Post Data, Make Changes to User Table. + //Begin General Updating + for ($i=1; $i<=$_POST[maxuserid]; $i++) { + $admin = $_POST["admin$i"]; + $editor = $_POST["editor$i"]; + $trusted = $_POST["trusted$i"]; + $disabled = $_POST["disabled$i"]; + $selected = $_POST["selected$i"]; + //echo "$i - $admin - $editor - $trusted - $selected
\n"; -if ($admin=="TRUE") { $mode="A"; -} else if ($editor=="TRUE") { $mode="E"; -} else if ($disabled=="TRUE") {$mode="D"; -} else { $mode="U"; } + if ($admin=="TRUE") { $mode="A"; + } else if ($editor=="TRUE") { $mode="E"; + } else if ($disabled=="TRUE") {$mode="D"; + } else { $mode="U"; } -if ($trusted !=="TRUE") {$trusted="FALSE"; } + if ($trusted !=="TRUE") {$trusted="FALSE"; } -$sql = "UPDATE `t_userprofiles` SET `UserMode`= '$mode', `UserTrusted`= '$trusted' WHERE `UserID`='$i'"; - $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); - -} -unset($i); - -echo"Your changes to the User List have been succesfully completed
\n"; - -//Do Special Disable, Delete, Enable Account Operations -if ($_POST["selected"] AND $_POST["submit"] !=="Update") { -$selecteduser = $_POST["selected"]; - -if ($_POST["submit"]=="Disable Selected") { -$sql = "UPDATE `t_userprofiles` SET `UserMode`= 'D' WHERE `UserID`='$selecteduser'"; - $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); - if ($sql_result) { - echo"User Account for User Number $selecteduser Disabled
\n"; - } - - //Disabling an author, check their extension list and disable any item they're the solo author of. - $sql = "SELECT TM.ID, TM.Name from `t_main` TM INNER JOIN `t_authorxref` TAX ON TM.ID=TAX.ID WHERE TAX.UserID = '$selecteduser'"; - $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); - while ($row = mysql_fetch_array($sql_result)) { - $id = $row["ID"]; - $name = $row["Name"]; - $sql2 = "SELECT `ID` from `t_authorxref` WHERE `ID` = '$id'"; - $sql_result2 = mysql_query($sql2, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); - if (mysql_num_rows($sql_result2)<="1") { - $sql3 = "UPDATE `t_version` SET `approved`='DISABLED' WHERE `ID`='$id' and `approved` !='NO' "; - $sql_result3 = mysql_query($sql3, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); - if ($sql_result3) { - echo"$name disabled from public viewing...
\n"; - } - } + if (checkFormKey()) { + $sql = "UPDATE `t_userprofiles` SET `UserMode`= '$mode', `UserTrusted`= '$trusted' WHERE `UserID`='$i'"; + $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); } -} else if ($_POST["submit"]=="Delete Selected") { -$sql = "DELETE FROM `t_userprofiles` WHERE `UserID`='$selecteduser' LIMIT 1"; - $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); - if ($sql_result) { - echo"User Account for User Number $selecteduser Deleted
\n"; - } + //Do Special Disable, Delete, Enable Account Operations + if ($_POST["selected$i"] AND $_POST["submit"] !=="Update") { + $selecteduser = $_POST["selected$i"]; -} else if ($_POST["submit"]=="Enable Selected") { -$sql = "UPDATE `t_userprofiles` SET `UserMode`= 'U' WHERE `UserID`='$selecteduser'"; - $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); - if ($sql_result) { - echo"User Account for User Number $selecteduser Enabled, User Mode set to User
\n"; - } + if ($_POST["submit"]=="Disable Selected") { + if (checkFormKey()) { + $sql = "UPDATE `t_userprofiles` SET `UserMode`= 'D' WHERE `UserID`='$selecteduser'"; + $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + if ($sql_result) { + echo"User Account for User Number $selecteduser Disabled
\n"; + } - //Disabling an author, check their extension list and disable any item they're the solo author of. - $sql = "SELECT TM.ID, TM.Name from `t_main` TM INNER JOIN `t_authorxref` TAX ON TM.ID=TAX.ID WHERE TAX.UserID = '$selecteduser'"; - $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); - while ($row = mysql_fetch_array($sql_result)) { - $id = $row["ID"]; - $name = $row["Name"]; - $sql2 = "SELECT `ID` from `t_authorxref` WHERE `ID` = '$id'"; - $sql_result2 = mysql_query($sql2, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); - if (mysql_num_rows($sql_result2)<="1") { - $sql3 = "UPDATE `t_version` SET `approved`='?' WHERE `ID`='$id' and `approved` !='NO'"; - $sql_result3 = mysql_query($sql3, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); - if ($sql_result3) { - echo"$name restored to public view pending approval...
\n"; - } + //Disabling an author, check their extension list and disable any item they're the solo author of. + $sql = "SELECT TM.ID, TM.Name from `t_main` TM INNER JOIN `t_authorxref` TAX ON TM.ID=TAX.ID WHERE TAX.UserID = '$selecteduser'"; + $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + while ($row = mysql_fetch_array($sql_result)) { + $id = $row["ID"]; + $name = $row["Name"]; + $sql2 = "SELECT `ID` from `t_authorxref` WHERE `ID` = '$id'"; + $sql_result2 = mysql_query($sql2, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + if (mysql_num_rows($sql_result2)<="1") { + $sql3 = "UPDATE `t_version` SET `approved`='DISABLED' WHERE `ID`='$id' and `approved` !='NO' "; + $sql_result3 = mysql_query($sql3, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + if ($sql_result3) { + echo"$name disabled from public viewing...
\n"; + } + } + } + } + + } else if ($_POST["submit"]=="Delete Selected") { + if (checkFormKey()) { + $sql = "DELETE FROM `t_userprofiles` WHERE `UserID`='$selecteduser' LIMIT 1"; + $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + if ($sql_result) { + echo"User Account for User Number $selecteduser Deleted
\n"; + } } + + } else if ($_POST["submit"]=="Enable Selected") { + if (checkFormKey()) { + $sql = "UPDATE `t_userprofiles` SET `UserMode`= 'U' WHERE `UserID`='$selecteduser'"; + $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + if ($sql_result) { + echo"User Account for User Number $selecteduser Enabled, User Mode set to User
\n"; + } + //Disabling an author, check their extension list and disable any item they're the solo author of. + $sql = "SELECT TM.ID, TM.Name from `t_main` TM INNER JOIN `t_authorxref` TAX ON TM.ID=TAX.ID WHERE TAX.UserID = '$selecteduser'"; + $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + while ($row = mysql_fetch_array($sql_result)) { + $id = $row["ID"]; + $name = $row["Name"]; + $sql2 = "SELECT `ID` from `t_authorxref` WHERE `ID` = '$id'"; + $sql_result2 = mysql_query($sql2, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + if (mysql_num_rows($sql_result2)<="1") { + $sql3 = "UPDATE `t_version` SET `approved`='?' WHERE `ID`='$id' and `approved` !='NO'"; + $sql_result3 = mysql_query($sql3, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); + if ($sql_result3) { + echo"$name restored to public view pending approval...
\n"; + } + } + } + } + } } + } + unset($i); -} + echo"Your changes to the User List have been succesfully completed
\n"; -} - -} + } ?>

Manage User list

@@ -163,6 +168,7 @@ $sql = "UPDATE `t_userprofiles` SET `UserMode`= 'U' WHERE `UserID`='$selecteduse +$i\n"; echo"\n"; echo"\n"; - echo""; + echo""; echo""; echo""; echo""; @@ -204,7 +210,7 @@ echo""; - +
T
  $username  $useremail
@@ -212,6 +218,7 @@ echo"";
+ E-Mail:
@@ -248,17 +255,20 @@ $useremail = $_POST["useremail"]; $userwebsite = $_POST["userwebsite"]; $useremailhide = $_POST["useremailhide"]; - $sql = "UPDATE `t_userprofiles` SET `UserName`= '$username', `UserEmail`='$useremail', `UserWebsite`='$userwebsite', `UserMode`='$mode', `UserTrusted`='$trusted', `UserEmailHide`='$useremailhide' WHERE `UserID`='$userid'"; + if (checkFormKey()) { + $sql = "UPDATE `t_userprofiles` SET `UserName`= '$username', `UserEmail`='$useremail', `UserWebsite`='$userwebsite', `UserMode`='$mode', `UserTrusted`='$trusted', `UserEmailHide`='$useremailhide' WHERE `UserID`='$userid'"; $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); if ($sql_result) { echo"

Updating User Profile...

\n"; echo"The User Profile for $username, has been successfully updated...
\n"; } + } } else if ($_POST["submit"] == "Delete User") { if ($_SESSION["level"] !=="admin" && $_SESSION["uid"] !== $_POST["userid"]) {$_POST["userid"]=$_SESSION["uid"];} $userid = $_POST["userid"]; $username = $_POST["username"]; - $sql = "DELETE FROM `t_userprofiles` WHERE `UserID`='$userid'"; + if (checkFormKey()) { + $sql = "DELETE FROM `t_userprofiles` WHERE `UserID`='$userid'"; $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); if ($sql_result) { echo"

Deleting User... Please wait...

\n"; @@ -267,6 +277,7 @@ $username = $_POST["username"]; echo"\n\n"; exit; } + } } if (!$userid) {$userid=$_POST["userid"];} @@ -290,6 +301,7 @@ if (!$userid) {$userid=$_POST["userid"];} +\n"; echo"\n"; @@ -375,13 +387,15 @@ $useremail = $_POST[useremail]; $userwebsite = $_POST[userwebsite]; $userpass = $_POST[userpass]; $useremailhide = $_POST[useremailhide]; - $sql = "INSERT INTO `t_userprofiles` (`UserName`, `UserEmail`, `UserWebsite`, `UserPass`, `UserMode`, `UserTrusted`, `UserEmailHide`) VALUES ('$username', '$useremail', '$userwebsite', '$userpass', '$mode', '$trusted', '$useremailhide');"; + if (checkFormKey()) { + $sql = "INSERT INTO `t_userprofiles` (`UserName`, `UserEmail`, `UserWebsite`, `UserPass`, `UserMode`, `UserTrusted`, `UserEmailHide`) VALUES ('$username', '$useremail', '$userwebsite', '$userpass', '$mode', '$trusted', '$useremailhide');"; $sql_result = mysql_query($sql) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); if ($sql_result) { include"mail_newaccount.php"; echo"The user $username has been added successfully...
\n"; echo"An E-Mail has been sent to the e-mail address specified with the login info they need to log in to their new account.
\n"; } + } } } @@ -390,6 +404,7 @@ $useremailhide = $_POST[useremailhide];

Add New User

Last login:
Name:
+ @@ -424,12 +439,15 @@ if ($_POST["submit"]=="Change Password") { $password_plain = $newpassword; $userpass = md5($newpassword); - $sql = "UPDATE `t_userprofiles` SET `UserPass`='$userpass' WHERE `UserID`='$userid'"; + $sql_result = false; + if (checkFormKey()) { + $sql = "UPDATE `t_userprofiles` SET `UserPass`='$userpass' WHERE `UserID`='$userid'"; $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); - if ($sql_result) { + } + if ($sql_result) { include"mail_newpassword.php"; echo"The password has been successfully changed, an e-mail has been sent confirming this action.
\n"; - } + } } else { echo"The two passwords did not match, please go back and try again.
\n"; } @@ -452,13 +470,14 @@ if ($_POST["submit"]=="Change Password") { $row = mysql_fetch_array($sql_result); $email = $row["UserEmail"]; - $sql = "UPDATE `t_userprofiles` SET `UserPass`='$userpass' WHERE `UserID`='$userid'"; + if (checkFormKey()) { + $sql = "UPDATE `t_userprofiles` SET `UserPass`='$userpass' WHERE `UserID`='$userid'"; $sql_result = mysql_query($sql, $connection) or trigger_error("MySQL Error ".mysql_errno().": ".mysql_error()."", E_USER_NOTICE); if ($sql_result) { include"mail_newpassword.php"; echo"The password has been successfully reset. The user has been sent an e-mail notifying them of their new password.
\n"; } - + } } if (!$userid) { $userid = $_POST["userid"]; } @@ -471,6 +490,7 @@ if (!$userid) { $userid = $_POST["userid"]; }

Change password for

E-Mail:" SIZE=30 MAXLENGTH=100>
Show E-Mail:Hidden: Visible:
Name:
"> +">