@@ -11,133 +11,133 @@ |
||
| 11 | 11 | } |
| 12 | 12 | |
| 13 | 13 | function validateCSS($validate) { |
| 14 | - $DISALLOWED = array("<?php", "?>", "behavior: url", ".php", "@import", "@\import", "@/import"); |
|
| 14 | + $DISALLOWED = array("<?php", "?>", "behavior: url", ".php", "@import", "@\import", "@/import"); |
|
| 15 | 15 | |
| 16 | - $validated = str_replace($DISALLOWED, "", $validate); |
|
| 16 | + $validated = str_replace($DISALLOWED, "", $validate); |
|
| 17 | 17 | return $validated; |
| 18 | 18 | } |
| 19 | 19 | function validateMarkdown($comment) { |
| 20 | - $markdown = new Michelf\Markdown; |
|
| 21 | - $markdown->no_markup = true; |
|
| 22 | - $transformed = $markdown->transform($comment); |
|
| 23 | - return preg_replace( |
|
| 24 | - "/<a href=(?:'|\")javascript:(.*?)(?:'|\")>(.*?)<\/a>/i", |
|
| 25 | - "Attempted XSS: $2 ($1)", |
|
| 26 | - $transformed |
|
| 27 | - ); |
|
| 20 | + $markdown = new Michelf\Markdown; |
|
| 21 | + $markdown->no_markup = true; |
|
| 22 | + $transformed = $markdown->transform($comment); |
|
| 23 | + return preg_replace( |
|
| 24 | + "/<a href=(?:'|\")javascript:(.*?)(?:'|\")>(.*?)<\/a>/i", |
|
| 25 | + "Attempted XSS: $2 ($1)", |
|
| 26 | + $transformed |
|
| 27 | + ); |
|
| 28 | 28 | } |
| 29 | 29 | |
| 30 | 30 | function validateCaptcha($privatekey, $response) { |
| 31 | - $responseData = json_decode(file_get_contents('https://www.google.com/recaptcha/api/siteverify?secret='.$privatekey.'&response='.$response)); |
|
| 32 | - return $responseData->success; |
|
| 31 | + $responseData = json_decode(file_get_contents('https://www.google.com/recaptcha/api/siteverify?secret='.$privatekey.'&response='.$response)); |
|
| 32 | + return $responseData->success; |
|
| 33 | 33 | } |
| 34 | 34 | |
| 35 | 35 | function requireLogin() { |
| 36 | - if (!isset($_SESSION['user'])) { |
|
| 37 | - header("Location: /login.php?r_login"); die(); |
|
| 38 | - } |
|
| 36 | + if (!isset($_SESSION['user'])) { |
|
| 37 | + header("Location: /login.php?r_login"); die(); |
|
| 38 | + } |
|
| 39 | 39 | } |
| 40 | 40 | |
| 41 | 41 | function getID($user, $connection) { |
| 42 | - $stmt = $connection->prepare("SELECT * FROM users WHERE username = ?"); |
|
| 43 | - $stmt->bind_param("s", $user); |
|
| 44 | - $stmt->execute(); |
|
| 45 | - $result = $stmt->get_result(); |
|
| 46 | - if($result->num_rows === 0) return 'error'; |
|
| 47 | - while($row = $result->fetch_assoc()) { |
|
| 48 | - $id = $row['id']; |
|
| 49 | - } |
|
| 50 | - $stmt->close(); |
|
| 51 | - return $id; |
|
| 42 | + $stmt = $connection->prepare("SELECT * FROM users WHERE username = ?"); |
|
| 43 | + $stmt->bind_param("s", $user); |
|
| 44 | + $stmt->execute(); |
|
| 45 | + $result = $stmt->get_result(); |
|
| 46 | + if($result->num_rows === 0) return 'error'; |
|
| 47 | + while($row = $result->fetch_assoc()) { |
|
| 48 | + $id = $row['id']; |
|
| 49 | + } |
|
| 50 | + $stmt->close(); |
|
| 51 | + return $id; |
|
| 52 | 52 | } |
| 53 | 53 | |
| 54 | 54 | function getName($id, $connection) { |
| 55 | - $stmt = $connection->prepare("SELECT * FROM users WHERE id = ?"); |
|
| 56 | - $stmt->bind_param("s", $id); |
|
| 57 | - $stmt->execute(); |
|
| 58 | - $result = $stmt->get_result(); |
|
| 59 | - if($result->num_rows === 0) return('error'); |
|
| 60 | - while($row = $result->fetch_assoc()) { |
|
| 61 | - $name = htmlspecialchars($row['username']); |
|
| 62 | - } |
|
| 63 | - $stmt->close(); |
|
| 64 | - return $name; |
|
| 55 | + $stmt = $connection->prepare("SELECT * FROM users WHERE id = ?"); |
|
| 56 | + $stmt->bind_param("s", $id); |
|
| 57 | + $stmt->execute(); |
|
| 58 | + $result = $stmt->get_result(); |
|
| 59 | + if($result->num_rows === 0) return('error'); |
|
| 60 | + while($row = $result->fetch_assoc()) { |
|
| 61 | + $name = htmlspecialchars($row['username']); |
|
| 62 | + } |
|
| 63 | + $stmt->close(); |
|
| 64 | + return $name; |
|
| 65 | 65 | } |
| 66 | 66 | |
| 67 | 67 | function getPFP($user, $connection) { |
| 68 | - $stmt = $connection->prepare("SELECT * FROM users WHERE username = ?"); |
|
| 69 | - $stmt->bind_param("s", $user); |
|
| 70 | - $stmt->execute(); |
|
| 71 | - $result = $stmt->get_result(); |
|
| 72 | - if($result->num_rows === 0) return('error'); |
|
| 73 | - while($row = $result->fetch_assoc()) { |
|
| 74 | - $pfp = htmlspecialchars($row['pfp']); |
|
| 75 | - } |
|
| 76 | - $stmt->close(); |
|
| 77 | - return $pfp; |
|
| 68 | + $stmt = $connection->prepare("SELECT * FROM users WHERE username = ?"); |
|
| 69 | + $stmt->bind_param("s", $user); |
|
| 70 | + $stmt->execute(); |
|
| 71 | + $result = $stmt->get_result(); |
|
| 72 | + if($result->num_rows === 0) return('error'); |
|
| 73 | + while($row = $result->fetch_assoc()) { |
|
| 74 | + $pfp = htmlspecialchars($row['pfp']); |
|
| 75 | + } |
|
| 76 | + $stmt->close(); |
|
| 77 | + return $pfp; |
|
| 78 | 78 | } |
| 79 | 79 | |
| 80 | 80 | function checkIfFriended($friend1, $friend2, $connection) |
| 81 | 81 | { |
| 82 | - $stmt = $connection->prepare("SELECT * FROM `friends` WHERE reciever = ? AND sender = ? OR reciever = ? AND sender = ?"); |
|
| 83 | - $stmt->bind_param("ssss", $friend1, $friend2, $friend2, $friend1); |
|
| 84 | - $stmt->execute(); |
|
| 85 | - $result = $stmt->get_result(); |
|
| 86 | - if($result->num_rows === 1){ return true; } |
|
| 87 | - return false; |
|
| 82 | + $stmt = $connection->prepare("SELECT * FROM `friends` WHERE reciever = ? AND sender = ? OR reciever = ? AND sender = ?"); |
|
| 83 | + $stmt->bind_param("ssss", $friend1, $friend2, $friend2, $friend1); |
|
| 84 | + $stmt->execute(); |
|
| 85 | + $result = $stmt->get_result(); |
|
| 86 | + if($result->num_rows === 1){ return true; } |
|
| 87 | + return false; |
|
| 88 | 88 | } |
| 89 | 89 | |
| 90 | 90 | function getUser($id, $connection) { |
| 91 | - $userResult = array(); |
|
| 92 | - $stmt = $connection->prepare("SELECT * FROM users WHERE id = ?"); |
|
| 93 | - $stmt->bind_param("i", $id); |
|
| 94 | - $stmt->execute(); |
|
| 95 | - $result = $stmt->get_result(); |
|
| 96 | - if($result->num_rows === 0) echo('That user does not exist.'); |
|
| 97 | - while($row = $result->fetch_assoc()) { |
|
| 98 | - $userResult['username'] = $row['username']; |
|
| 99 | - $userResult['id'] = $row['id']; |
|
| 100 | - $userResult['date'] = $row['date']; |
|
| 101 | - $userResult['bio'] = $row['bio']; |
|
| 102 | - $userResult['css'] = $row['css']; |
|
| 103 | - $userResult['pfp'] = $row['pfp']; |
|
| 104 | - $userResult['badges'] = explode(';', $row['badges']); |
|
| 105 | - $userResult['music'] = $row['music']; |
|
| 106 | - } |
|
| 107 | - $stmt->close(); |
|
| 108 | - |
|
| 109 | - $stmt = $connection->prepare("SELECT * FROM gamecomments WHERE author = ?"); |
|
| 110 | - $stmt->bind_param("s", $userResult['username']); |
|
| 111 | - $stmt->execute(); |
|
| 112 | - $result = $stmt->get_result(); |
|
| 113 | - |
|
| 114 | - $userResult['comments'] = 0; |
|
| 115 | - while($row = $result->fetch_assoc()) { |
|
| 116 | - $userResult['comments']++; |
|
| 117 | - } |
|
| 118 | - $stmt->close(); |
|
| 119 | - |
|
| 120 | - $stmt = $connection->prepare("SELECT * FROM comments WHERE author = ?"); |
|
| 121 | - $stmt->bind_param("s", $userResult['username']); |
|
| 122 | - $stmt->execute(); |
|
| 123 | - $result = $stmt->get_result(); |
|
| 124 | - |
|
| 125 | - $userResult['profilecomments'] = 0; |
|
| 126 | - while($row = $result->fetch_assoc()) { |
|
| 127 | - $userResult['profilecomments']++; |
|
| 128 | - } |
|
| 129 | - $stmt->close(); |
|
| 130 | - |
|
| 131 | - $stmt = $connection->prepare("SELECT * FROM files WHERE author = ? AND status='y'"); |
|
| 132 | - $stmt->bind_param("s", $userResult['username']); |
|
| 133 | - $stmt->execute(); |
|
| 134 | - $result = $stmt->get_result(); |
|
| 135 | - |
|
| 136 | - $userResult['filesuploaded'] = 0; |
|
| 137 | - while($row = $result->fetch_assoc()) { |
|
| 138 | - $userResult['filesuploaded']++; |
|
| 139 | - } |
|
| 140 | - $stmt->close(); |
|
| 141 | - return $userResult; |
|
| 91 | + $userResult = array(); |
|
| 92 | + $stmt = $connection->prepare("SELECT * FROM users WHERE id = ?"); |
|
| 93 | + $stmt->bind_param("i", $id); |
|
| 94 | + $stmt->execute(); |
|
| 95 | + $result = $stmt->get_result(); |
|
| 96 | + if($result->num_rows === 0) echo('That user does not exist.'); |
|
| 97 | + while($row = $result->fetch_assoc()) { |
|
| 98 | + $userResult['username'] = $row['username']; |
|
| 99 | + $userResult['id'] = $row['id']; |
|
| 100 | + $userResult['date'] = $row['date']; |
|
| 101 | + $userResult['bio'] = $row['bio']; |
|
| 102 | + $userResult['css'] = $row['css']; |
|
| 103 | + $userResult['pfp'] = $row['pfp']; |
|
| 104 | + $userResult['badges'] = explode(';', $row['badges']); |
|
| 105 | + $userResult['music'] = $row['music']; |
|
| 106 | + } |
|
| 107 | + $stmt->close(); |
|
| 108 | + |
|
| 109 | + $stmt = $connection->prepare("SELECT * FROM gamecomments WHERE author = ?"); |
|
| 110 | + $stmt->bind_param("s", $userResult['username']); |
|
| 111 | + $stmt->execute(); |
|
| 112 | + $result = $stmt->get_result(); |
|
| 113 | + |
|
| 114 | + $userResult['comments'] = 0; |
|
| 115 | + while($row = $result->fetch_assoc()) { |
|
| 116 | + $userResult['comments']++; |
|
| 117 | + } |
|
| 118 | + $stmt->close(); |
|
| 119 | + |
|
| 120 | + $stmt = $connection->prepare("SELECT * FROM comments WHERE author = ?"); |
|
| 121 | + $stmt->bind_param("s", $userResult['username']); |
|
| 122 | + $stmt->execute(); |
|
| 123 | + $result = $stmt->get_result(); |
|
| 124 | + |
|
| 125 | + $userResult['profilecomments'] = 0; |
|
| 126 | + while($row = $result->fetch_assoc()) { |
|
| 127 | + $userResult['profilecomments']++; |
|
| 128 | + } |
|
| 129 | + $stmt->close(); |
|
| 130 | + |
|
| 131 | + $stmt = $connection->prepare("SELECT * FROM files WHERE author = ? AND status='y'"); |
|
| 132 | + $stmt->bind_param("s", $userResult['username']); |
|
| 133 | + $stmt->execute(); |
|
| 134 | + $result = $stmt->get_result(); |
|
| 135 | + |
|
| 136 | + $userResult['filesuploaded'] = 0; |
|
| 137 | + while($row = $result->fetch_assoc()) { |
|
| 138 | + $userResult['filesuploaded']++; |
|
| 139 | + } |
|
| 140 | + $stmt->close(); |
|
| 141 | + return $userResult; |
|
| 142 | 142 | } |
| 143 | 143 | ?> |
| 144 | 144 | \ No newline at end of file |
@@ -4,7 +4,7 @@ discard block |
||
| 4 | 4 | |
| 5 | 5 | define("DEBUG_MODE", true); |
| 6 | 6 | session_start(); |
| 7 | -if(defined("DEBUG_MODE") && DEBUG_MODE) { |
|
| 7 | +if (defined("DEBUG_MODE") && DEBUG_MODE) { |
|
| 8 | 8 | ini_set('display_errors', 1); |
| 9 | 9 | ini_set('display_startup_errors', 1); |
| 10 | 10 | error_reporting(E_ALL); |
@@ -28,7 +28,7 @@ discard block |
||
| 28 | 28 | } |
| 29 | 29 | |
| 30 | 30 | function validateCaptcha($privatekey, $response) { |
| 31 | - $responseData = json_decode(file_get_contents('https://www.google.com/recaptcha/api/siteverify?secret='.$privatekey.'&response='.$response)); |
|
| 31 | + $responseData = json_decode(file_get_contents('https://www.google.com/recaptcha/api/siteverify?secret=' . $privatekey . '&response=' . $response)); |
|
| 32 | 32 | return $responseData->success; |
| 33 | 33 | } |
| 34 | 34 | |
@@ -43,8 +43,8 @@ discard block |
||
| 43 | 43 | $stmt->bind_param("s", $user); |
| 44 | 44 | $stmt->execute(); |
| 45 | 45 | $result = $stmt->get_result(); |
| 46 | - if($result->num_rows === 0) return 'error'; |
|
| 47 | - while($row = $result->fetch_assoc()) { |
|
| 46 | + if ($result->num_rows === 0) return 'error'; |
|
| 47 | + while ($row = $result->fetch_assoc()) { |
|
| 48 | 48 | $id = $row['id']; |
| 49 | 49 | } |
| 50 | 50 | $stmt->close(); |
@@ -56,8 +56,8 @@ discard block |
||
| 56 | 56 | $stmt->bind_param("s", $id); |
| 57 | 57 | $stmt->execute(); |
| 58 | 58 | $result = $stmt->get_result(); |
| 59 | - if($result->num_rows === 0) return('error'); |
|
| 60 | - while($row = $result->fetch_assoc()) { |
|
| 59 | + if ($result->num_rows === 0) return('error'); |
|
| 60 | + while ($row = $result->fetch_assoc()) { |
|
| 61 | 61 | $name = htmlspecialchars($row['username']); |
| 62 | 62 | } |
| 63 | 63 | $stmt->close(); |
@@ -69,8 +69,8 @@ discard block |
||
| 69 | 69 | $stmt->bind_param("s", $user); |
| 70 | 70 | $stmt->execute(); |
| 71 | 71 | $result = $stmt->get_result(); |
| 72 | - if($result->num_rows === 0) return('error'); |
|
| 73 | - while($row = $result->fetch_assoc()) { |
|
| 72 | + if ($result->num_rows === 0) return('error'); |
|
| 73 | + while ($row = $result->fetch_assoc()) { |
|
| 74 | 74 | $pfp = htmlspecialchars($row['pfp']); |
| 75 | 75 | } |
| 76 | 76 | $stmt->close(); |
@@ -83,7 +83,7 @@ discard block |
||
| 83 | 83 | $stmt->bind_param("ssss", $friend1, $friend2, $friend2, $friend1); |
| 84 | 84 | $stmt->execute(); |
| 85 | 85 | $result = $stmt->get_result(); |
| 86 | - if($result->num_rows === 1){ return true; } |
|
| 86 | + if ($result->num_rows === 1) { return true; } |
|
| 87 | 87 | return false; |
| 88 | 88 | } |
| 89 | 89 | |
@@ -93,8 +93,8 @@ discard block |
||
| 93 | 93 | $stmt->bind_param("i", $id); |
| 94 | 94 | $stmt->execute(); |
| 95 | 95 | $result = $stmt->get_result(); |
| 96 | - if($result->num_rows === 0) echo('That user does not exist.'); |
|
| 97 | - while($row = $result->fetch_assoc()) { |
|
| 96 | + if ($result->num_rows === 0) echo('That user does not exist.'); |
|
| 97 | + while ($row = $result->fetch_assoc()) { |
|
| 98 | 98 | $userResult['username'] = $row['username']; |
| 99 | 99 | $userResult['id'] = $row['id']; |
| 100 | 100 | $userResult['date'] = $row['date']; |
@@ -112,7 +112,7 @@ discard block |
||
| 112 | 112 | $result = $stmt->get_result(); |
| 113 | 113 | |
| 114 | 114 | $userResult['comments'] = 0; |
| 115 | - while($row = $result->fetch_assoc()) { |
|
| 115 | + while ($row = $result->fetch_assoc()) { |
|
| 116 | 116 | $userResult['comments']++; |
| 117 | 117 | } |
| 118 | 118 | $stmt->close(); |
@@ -123,7 +123,7 @@ discard block |
||
| 123 | 123 | $result = $stmt->get_result(); |
| 124 | 124 | |
| 125 | 125 | $userResult['profilecomments'] = 0; |
| 126 | - while($row = $result->fetch_assoc()) { |
|
| 126 | + while ($row = $result->fetch_assoc()) { |
|
| 127 | 127 | $userResult['profilecomments']++; |
| 128 | 128 | } |
| 129 | 129 | $stmt->close(); |
@@ -134,7 +134,7 @@ discard block |
||
| 134 | 134 | $result = $stmt->get_result(); |
| 135 | 135 | |
| 136 | 136 | $userResult['filesuploaded'] = 0; |
| 137 | - while($row = $result->fetch_assoc()) { |
|
| 137 | + while ($row = $result->fetch_assoc()) { |
|
| 138 | 138 | $userResult['filesuploaded']++; |
| 139 | 139 | } |
| 140 | 140 | $stmt->close(); |
@@ -43,7 +43,9 @@ discard block |
||
| 43 | 43 | $stmt->bind_param("s", $user); |
| 44 | 44 | $stmt->execute(); |
| 45 | 45 | $result = $stmt->get_result(); |
| 46 | - if($result->num_rows === 0) return 'error'; |
|
| 46 | + if($result->num_rows === 0) { |
|
| 47 | + return 'error'; |
|
| 48 | + } |
|
| 47 | 49 | while($row = $result->fetch_assoc()) { |
| 48 | 50 | $id = $row['id']; |
| 49 | 51 | } |
@@ -56,7 +58,9 @@ discard block |
||
| 56 | 58 | $stmt->bind_param("s", $id); |
| 57 | 59 | $stmt->execute(); |
| 58 | 60 | $result = $stmt->get_result(); |
| 59 | - if($result->num_rows === 0) return('error'); |
|
| 61 | + if($result->num_rows === 0) { |
|
| 62 | + return('error'); |
|
| 63 | + } |
|
| 60 | 64 | while($row = $result->fetch_assoc()) { |
| 61 | 65 | $name = htmlspecialchars($row['username']); |
| 62 | 66 | } |
@@ -69,7 +73,9 @@ discard block |
||
| 69 | 73 | $stmt->bind_param("s", $user); |
| 70 | 74 | $stmt->execute(); |
| 71 | 75 | $result = $stmt->get_result(); |
| 72 | - if($result->num_rows === 0) return('error'); |
|
| 76 | + if($result->num_rows === 0) { |
|
| 77 | + return('error'); |
|
| 78 | + } |
|
| 73 | 79 | while($row = $result->fetch_assoc()) { |
| 74 | 80 | $pfp = htmlspecialchars($row['pfp']); |
| 75 | 81 | } |
@@ -93,7 +99,9 @@ discard block |
||
| 93 | 99 | $stmt->bind_param("i", $id); |
| 94 | 100 | $stmt->execute(); |
| 95 | 101 | $result = $stmt->get_result(); |
| 96 | - if($result->num_rows === 0) echo('That user does not exist.'); |
|
| 102 | + if($result->num_rows === 0) { |
|
| 103 | + echo('That user does not exist.'); |
|
| 104 | + } |
|
| 97 | 105 | while($row = $result->fetch_assoc()) { |
| 98 | 106 | $userResult['username'] = $row['username']; |
| 99 | 107 | $userResult['id'] = $row['id']; |