MODS.DB9.DK

[The Grinch]

Code: Select all

FIND - Line 1135

$to_username = $HTTP_POST_VARS['username'];


REPLACE WITH

$to_username = phpbb_clean_username($HTTP_POST_VARS['username']);

The problem is the PM mod changed that line pretty drastically. So I have no clue how to do the update. From what I understand the bugs are very serious, and I've already had someone hack me. So I really need to get this going asap. I'd prefer to not have to uninstall the PM mod.

Here's what the original change was:

Code: Select all

#-----[ FIND ]------------------------------------------------
#
$to_username = $HTTP_POST_VARS['username'];

#
#-----[ REPLACE WITH ]----------------------------------------
#

// Start replacement - Custom mass PM MOD
$to_username_array = explode (",", $HTTP_POST_VARS['username']);

foreach ($to_username_array as $name) $temp_array[] = trim($name);
$to_username_array=$temp_array;

sort ($to_username_array);

$n=0;
while ( !empty($to_username_array[$n]) )
{
   $to_username_array[$n] = trim ($to_username_array[$n]);
   $to_usernames .=  (($to_usernames) ? "," : "" ) . "'" . $to_username_array[$n++]."'";
}
// End replacement - Custom mass PM MOD

If someone could tell me how to incorporate the 2.0.11 changes to work, that would be extremely helpful.

[MR]

I have the same problem !

Help

[ITHAKB]

Me three!

[Ex0dus]

Please post up the part of the 2.0.11 changes that deal with this part of the code. I did it but i dont remember exactly how. Seeing all of the code in one spot again should refresh my memory.

-Ex0dus

[corny]

Hi,

I've checked my code (I suppose it is privmsg.php what this is about ) and this is what I have there:

Code: Select all

   if ( $submit )
   {
      if ( !empty($HTTP_POST_VARS['username']) )
      {

// Start replacement - Custom mass PM MOD
         $to_username_array = explode (";", $HTTP_POST_VARS['username']);
         usort($to_username_array, create_function('$a,$b','return strcasecmp($a,$b);'));
         foreach ($to_username_array as $name)
            $to_usernames .= "'".phpbb_clean_username(trim($name))."',";
         $to_usernames[strlen($to_usernames)-1]=" ";
// End replacement - Custom mass PM MOD

         $sql = "SELECT user_id, username, user_notify_pm, user_email, user_lang, user_active
            FROM " . USERS_TABLE . "
            WHERE username IN ($to_usernames)
               AND user_id <> " . ANONYMOUS . " ORDER BY username ASC";

// Start replacement - Custom mass PM MOD
         if( !($result2 = $db->sql_query($sql)) )
         {
            message_die(GENERAL_ERROR, 'Could not obtain users PM information', '', __LINE__, __FILE__, $sql);
         }
         $to_users = $db->sql_fetchrowset($result2);
         $n=0;
         while ($to_username_array[$n] && !$error)
         {
            if (strcasecmp($to_users[$n]['username'], str_replace("\'", "'",$to_username_array[$n])))
            {
               $error = TRUE;
               $error_msg .= $lang['No_such_user']." '".str_replace("\'", "'", $to_username_array[$n]);
            }
            $n++;
         }
      }
      else
      {
// End replacement - Custom mass PM MOD

         $error = TRUE;
         $error_msg .= ( ( !empty($error_msg) ) ? '<br />' : '' ) . $lang['No_to_user'];
      }

      $privmsg_subject = trim(strip_tags($HTTP_POST_VARS['subject']));
      if ( empty($privmsg_subject) )
      {
         $error = TRUE;
         $error_msg .= ( ( !empty($error_msg) ) ? '<br />' : '' ) . $lang['Empty_subject'];
      }

      if ( !empty($HTTP_POST_VARS['message']) )
      {
         if ( !$error )
         {
            if ( $bbcode_on )
            {
               $bbcode_uid = make_bbcode_uid();
            }

            $privmsg_message = prepare_message($HTTP_POST_VARS['message'], $html_on, $bbcode_on, $smilies_on, $bbcode_uid);

         }
      }
      else
      {
         $error = TRUE;
         $error_msg .= ( ( !empty($error_msg) ) ? '<br />' : '' ) . $lang['Empty_message'];
      }
   }


Maybe this helps for you. My board is running 2.0.11.

[Anon Indie]

Does anyone have a solution for this yet?

For that matter, since no one should be running old 2.0.6 due to security issues anyway, does the author plan to ever upgrade these mods to be more compatible with 2.0.11???

[MJ]

Code: Select all

// Start replacement - Custom mass PM MOD
$to_username_array = explode (",", $HTTP_POST_VARS['username']);

CHANGE TO:

Code: Select all

// Start replacement - Custom mass PM MOD
$to_username_array = explode (",", phpbb_clean_username($HTTP_POST_VARS['username']));

[ChristianR]

Code: Select all

// Start replacement - Custom mass PM MOD
$to_username_array = explode (",", $HTTP_POST_VARS['username']);

CHANGE TO:

Code: Select all

// Start replacement - Custom mass PM MOD
$to_username_array = explode (",", phpbb_clean_username($HTTP_POST_VARS['username']));

if you do that, you will not be able to to the multi send.. i.e. send a pm to more than one user at a time.... e.g. "Webmaster;Joe;Matt"