OSDN -- Develop and Download Open Source Software
  • R/O
  • HTTP
  • SSH
  • HTTPS
Fork

nucleus-plugins: Commit

Nucleus CMS日本語版用プラグインのうち、日本語版開発者がサポートしているもの


Commit MetaInfo

Revision0fc5988748083128a86cbf36afafba564075f9ad (tree)
Time2006-11-26 02:27:12
Authorsatona <satona@1ca2...>
Commitersatona

Log Message

再チェック

git-svn-id: https://svn.sourceforge.jp/svnroot/nucleus-jp/plugin@491 1ca29b6e-896d-4ea0-84a5-967f57386b96

Change Summary

Incremental Difference

--- a/trunk/NP_MultipleCategories/NP_MultipleCategories.php
+++ b/trunk/NP_MultipleCategories/NP_MultipleCategories.php
@@ -95,7 +95,7 @@ ADD `ordid` INT( 11 ) DEFAULT '100' NOT NULL AFTER `parentid` ;
9595 }
9696 if (!in_array("subcategories",$names)) {
9797 sql_query ('ALTER TABLE '.sql_table('plug_multiple_categories').' ADD subcategories varchar(255) not null');
98- sql_query('ALTER TABLE ' . sql_table('plug_multiple_categories'). ' MODIFY categories varchar(255) not null');
98+ sql_query('ALTER TABLE ' .sql_table('plug_multiple_categories').' MODIFY categories varchar(255) not null');
9999 }
100100 $query = 'CREATE TABLE IF NOT EXISTS '. sql_table('plug_multiple_categories_sub'). '('
101101 . 'scatid int(11) not null auto_increment,'
@@ -172,13 +172,13 @@ ADD `ordid` INT( 11 ) DEFAULT '100' NOT NULL AFTER `parentid` ;
172172 $subcatid = intRequestVar($this->getRequestName());
173173 }
174174 if ($subcatid && !$catid) {
175- $catid = intval($this->_getParentCatID($subcatid));
175+ $catid = intval($this->_getParentCatID($subcatid));//Intval is not needed. ($subcatid) <sato(na)0.5j />
176176 if (!$catid) {
177177 $subcatid = null;
178178 $catid = null;
179179 }
180180 } elseif ($subcatid) {
181- $pcatid = intval($this->_getParentCatID($subcatid));
181+ $pcatid = intval($this->_getParentCatID($subcatid));//Intval is not needed. ($subcatid) <sato(na)0.5j />
182182 if ($pcatid != $catid) $subcatid = null;
183183 }
184184
@@ -223,7 +223,7 @@ ADD `ordid` INT( 11 ) DEFAULT '100' NOT NULL AFTER `parentid` ;
223223 $query = 'SELECT scatid FROM '.sql_table('plug_multiple_categories_sub').' WHERE catid=' . intval($id);
224224 $res = sql_query($query);
225225 while ($row = mysql_fetch_row($res)){
226- $aResult[] = $row[0];
226+ $aResult[] = intval($row[0]); //<sato(na)0.5j />ultrarich
227227 }
228228 return $aResult;
229229 }
@@ -286,11 +286,11 @@ ADD `ordid` INT( 11 ) DEFAULT '100' NOT NULL AFTER `parentid` ;
286286 return explode(",", $subOrderString);
287287 }
288288 function _getSubOrder($pid){
289- $sql_str = 'SELECT scatid FROM '.sql_table('plug_multiple_categories_sub').' WHERE parentid='.$pid.' ORDER BY ordid';
289+ $sql_str = 'SELECT scatid FROM '.sql_table('plug_multiple_categories_sub').' WHERE parentid='.intval($pid).' ORDER BY ordid'; //<sato(na)0.5j />
290290 $qid_scat = mysql_query($sql_str);
291291 if ($qid_scat === FALSE) return ''; //<sato(na)0.403j />
292292 $scat_str = '';
293- while ($row_scat = mysql_fetch_object($qid_scat)) $scat_str .= ',' . $row_scat->scatid . $this->_getSubOrder($row_scat->scatid);
293+ while ($row_scat = mysql_fetch_object($qid_scat)) $scat_str .= ',' . intval($row_scat->scatid) . $this->_getSubOrder($row_scat->scatid); //<sato(na)0.5j />
294294 return $scat_str;
295295 }
296296 function permuteSubcategories($subcategories){
@@ -313,11 +313,11 @@ function orderKey(key, sequence) {
313313 while($row = mysql_fetch_array($res)) {
314314 //<sato(na)0.5j>
315315 echo 'scatDat['.($i++).'] = new setScatDat('.
316- $row['scatid'].
316+ intval($row['scatid']).
317317 ' , "'.
318- addslashes($row['sname']).
318+ htmlspecialchars($row['sname'], ENT_QUOTES).
319319 '", "'.
320- addslashes($row['sdesc']).
320+ htmlspecialchars($row['sdesc'], ENT_QUOTES).
321321 '");'."\n";
322322 //</sato(na)0.5j>
323323 }
@@ -335,7 +335,7 @@ function orderKey(key, sequence) {
335335 }
336336 }
337337
338- function event_AddItemFormExtras($data) {
338+ function event_AddItemFormExtras($data) {
339339 $aCategories = $this->_getCategories($data['blog']->blogid);
340340 if(count($aCategories) > 1) {
341341 $this->showForm($aCategories,$data['itemid']);
@@ -358,20 +358,20 @@ function orderKey(key, sequence) {
358358 if (!count($aDefinedScats)) return;
359359
360360 $itemScats = array();
361- if($subcatlist = $this->_getSubCategories($itemid))
361+ if($subcatlist = $this->_getSubCategories($itemid))//Intval is not needed. ($itemid) <sato(na)0.5j />
362362 $itemScats = explode(",",$subcatlist);
363363
364364 //<sato(na)>$snum = 0;</sato(na)>
365365 echo '<h3>Multiple Categories</h3>';
366366 echo "<fieldset><legend>Sub Categories</legend>";
367367 //<sato(na)>
368- $sql_str = 'SELECT * FROM '.sql_table('plug_multiple_categories_sub').' WHERE catid='.$aCategories[0]['catid'].' AND parentid=0';
368+ $sql_str = 'SELECT * FROM '.sql_table('plug_multiple_categories_sub').' WHERE catid='.intval($aCategories[0]['catid']).' AND parentid=0'; //<sato(na)0.5j />
369369 $qid = sql_query($sql_str);
370370 while ($aSub = mysql_fetch_assoc($qid)) {
371371 $schecked = (in_array($aSub['scatid'], $itemScats)) ? " checked=checked" : "";
372372 echo '<input type="checkbox" id="npmc_scat'.$aSub['scatid'].'" name="npmc_scat['.$aSub['scatid'].']"'.$schecked.' value="'.$aSub['scatid'].'" />';
373- echo '<label for="npmc_scat'.$aSub['scatid'].'">'.htmlspecialchars($aSub['sname']).'</label><br />';
374- echo $this->showFormHierarchical($aSub['scatid'], $itemScats);
373+ echo '<label for="npmc_scat'.$aSub['scatid'].'">'.htmlspecialchars($aSub['sname'], ENT_QUOTES).'</label><br />'; //<sato(na)0.5j />
374+ $this->showFormHierarchical($aSub['scatid'], $itemScats); //<sato(na)0.5j />
375375 }
376376 //</sato(na)>
377377 echo "</fieldset>";
@@ -380,9 +380,9 @@ function orderKey(key, sequence) {
380380 function showForm($aCategories,$itemid) {
381381 $itemcats = array();
382382 $itemScats = array();
383- if($multicatlist = $this->_getMultiCategories($itemid))
383+ if($multicatlist = $this->_getMultiCategories($itemid))//Intval is not needed. ($itemid) <sato(na)0.5j />
384384 $itemcats = explode(",",$multicatlist);
385- if($subcatlist = $this->_getSubCategories($itemid))
385+ if($subcatlist = $this->_getSubCategories($itemid))//Intval is not needed. ($itemid) <sato(na)0.5j />
386386 $itemScats = explode(",",$subcatlist);
387387
388388 echo '<h3 style="margin-bottom:0px;">Multiple Categories</h3>';
@@ -396,20 +396,20 @@ function orderKey(key, sequence) {
396396 if(in_array($aCategory['catid'],$itemcats)) $checked = " checked=checked";
397397 echo '<tr><td>';
398398 echo '<input type="checkbox" id="npmc_cat'.$num.'" name="npmc_cat['.$num.']"'.$checked.' value="'.$aCategory['catid'].'" />';
399- echo '<label for="npmc_cat'.$num.'">'.htmlspecialchars($aCategory['name']);
400- if ($aCategory['cdesc']) echo "(".$aCategory['cdesc'].")";
399+ echo '<label for="npmc_cat'.$num.'">'.htmlspecialchars($aCategory['name'], ENT_QUOTES); //<sato(na)0.5j />
400+ if ($aCategory['cdesc']) echo "(".htmlspecialchars($aCategory['cdesc'], ENT_QUOTES).")"; //<sato(na)0.5j />
401401 echo '</label>';
402402 $num ++;
403403 //<sato(na)>
404- $sql_str = 'SELECT * FROM '.sql_table('plug_multiple_categories_sub').' WHERE catid='.$aCategory['catid'].' AND parentid=0';
404+ $sql_str = 'SELECT * FROM '.sql_table('plug_multiple_categories_sub').' WHERE catid='.intval($aCategory['catid']).' AND parentid=0'; //<sato(na)0.5j />
405405 $qid = sql_query($sql_str);
406406 if (mysql_num_rows($qid)) {
407407 echo "<fieldset style=\"margin-left:1.5em;border:none\">";
408408 while ($aSub = mysql_fetch_assoc($qid)) {
409409 $schecked = (in_array($aSub['scatid'], $itemScats)) ? " checked=checked" : "";
410410 echo '<input type="checkbox" id="npmc_scat'.$aSub['scatid'].'" name="npmc_scat['.$aSub['scatid'].']"'.$schecked.' value="'.$aSub['scatid'].'" />';
411- echo '<label for="npmc_scat'.$aSub['scatid'].'">'.htmlspecialchars($aSub['sname']).'</label><br />';
412- echo $this->showFormHierarchical($aSub['scatid'], $itemScats);
411+ echo '<label for="npmc_scat'.$aSub['scatid'].'">'.htmlspecialchars($aSub['sname'], ENT_QUOTES).'</label><br />'; //<sato(na)0.5j />
412+ $this->showFormHierarchical($aSub['scatid'], $itemScats); //<sato(na)0.5j />
413413 }
414414 echo "</fieldset>";
415415 }
@@ -426,8 +426,8 @@ function orderKey(key, sequence) {
426426 while ($aSub = mysql_fetch_assoc($qid)) {
427427 $schecked = (in_array($aSub['scatid'], $itemScats)) ? " checked=checked" : "";
428428 echo '<input type="checkbox" id="npmc_scat'.$aSub['scatid'].'" name="npmc_scat['.$aSub['scatid'].']"'.$schecked.' value="'.$aSub['scatid'].'" />';
429- echo '<label for="npmc_scat'.$aSub['scatid'].'">'.htmlspecialchars($aSub['sname']).'</label><br />';
430- echo $this->showFormHierarchical($aSub['scatid'], $itemScats);
429+ echo '<label for="npmc_scat'.$aSub['scatid'].'">'.htmlspecialchars($aSub['sname'], ENT_QUOTES).'</label><br />'; //<sato(na)0.5j />
430+ $this->showFormHierarchical($aSub['scatid'], $itemScats); //<sato(na)0.5j />
431431 }
432432 echo "</div>";
433433 }
@@ -494,7 +494,7 @@ function orderKey(key, sequence) {
494494 $value .= ', ""';
495495 }
496496
497- $query = 'REPLACE INTO '.sql_table('plug_multiple_categories').' (item_id,categories,subcategories) VALUES('.intval($itemid).$value.');';
497+ $query = 'REPLACE INTO '.sql_table('plug_multiple_categories').' (item_id,categories,subcategories) VALUES('.intval($itemid).$value.');'; //$value : addslashes
498498 sql_query($query);
499499 }
500500
@@ -522,11 +522,12 @@ function orderKey(key, sequence) {
522522 $o->categories = preg_replace("/^(?:(.*),)?$catid(?:,(.*))?$/","$1,$2",$o->categories);
523523 $o->subcategories = preg_replace("/^(?:(.*),)?$catid(?:,(.*))?$/","$1,$2",$o->subcategories);
524524 if ((!$o->categories || $o->categories == ',') && (!$o->subcategories || $o->subcategories == ',')) {
525- $del[] = $o->item_id;
525+ $del[] = intval($o->item_id); //<sato(na)0.5j />ultrarich
526526 } else {
527527 $o->categories = preg_replace("/(^,+|(?<=,),+|,+$)/","",$o->categories);
528528 $o->subcategories = preg_replace("/(^,+|(?<=,),+|,+$)/","",$o->subcategories);
529- $up[] = "UPDATE ". sql_table("plug_multiple_categories") ." SET categories='".addslashes($o->categories)."', subcategories='".addslashes($o->subcategories)."' WHERE item_id=".$o->item_id;
529+ $up[] = "UPDATE ". sql_table("plug_multiple_categories") ." SET categories='".addslashes($o->categories).
530+ "', subcategories='".addslashes($o->subcategories)."' WHERE item_id=".intval($o->item_id); //<sato(na)0.5j />ultrarich
530531 }
531532 }
532533
@@ -546,7 +547,7 @@ function orderKey(key, sequence) {
546547 $params = func_get_args();
547548 // item skin
548549 if ($params[0] == 'item' && $params[1] != "1") {
549- if ($itemid) $this->_parseItem($params[1], $itemid);
550+ if ($itemid) $this->_parseItem($params[1], intval($itemid));//<sato(na)0.5j />
550551 return;
551552 }
552553
@@ -554,17 +555,17 @@ function orderKey(key, sequence) {
554555 switch ($params[2]) {
555556 case 'id':
556557 if (!$subcatid || !$catid) return;
557- echo $subcatid;
558+ echo intval($subcatid);//<sato(na)0.5j />
558559 return;
559560 break;
560561 case 'desc':
561562 if (!$subcatid || !$catid) return;
562- echo htmlspecialchars($this->_getScatDescFromID($subcatid));
563+ echo htmlspecialchars($this->_getScatDescFromID($subcatid), ENT_QUOTES);//Intval is not needed. ($subcatid) <sato(na)0.5j />
563564 return;
564565 break;
565566 case 'name':
566567 if (!$subcatid || !$catid) return;
567- echo htmlspecialchars($this->_getScatNameFromID($subcatid));
568+ echo htmlspecialchars($this->_getScatNameFromID($subcatid), ENT_QUOTES);//Intval is not needed. ($subcatid) <sato(na)0.5j />
568569 return;
569570 break;
570571 case 'url':
@@ -575,18 +576,19 @@ function orderKey(key, sequence) {
575576 $b =& $manager->getBlog($CONF['DefaultBlog']);
576577 }
577578 $this->_setCommonData($b->getID());
578- $sparams = array_merge($this->param,array($this->getRequestName() => $subcatid));
579- $url = createCategoryLink($catid, $sparams);
579+ $sparams = array_merge($this->param, array($this->getRequestName() => intval($subcatid)));//<sato(na)0.5j />
580+ $url = createCategoryLink(intval($catid), $sparams);//<sato(na)0.5j />
580581 if ($CONF['URLMode'] != 'pathinfo') {
581582 list(,$temp_param) = explode("?",$url);
582583 $url = $this->url. "?" . $temp_param;
583584 }
584- echo $url;
585+ $url = preg_replace(array("/</", "/>/"), array("&lt;", "&gt;"), $url); //<sato(na)0.5j />
586+ echo $url; //$sparams escape OK <sato(na)0.5j />
585587 return;
586588 break;
587589 case 'link':
588590 if ($params[0] != 'item') return;
589- $item = $this->_getItemObject($itemid);
591+ $item = $this->_getItemObject(intval($itemid));//<sato(na)0.5j />
590592 if ($item) {
591593 $this->doTemplateVar(&$item);
592594 }
@@ -601,17 +603,18 @@ function orderKey(key, sequence) {
601603 $bid = $b->getID();
602604 $this->_setCommonData($bid);
603605 $cur_params = array();
604- if ($catid) $cur_params['catid'] = $catid;
606+ if ($catid) $cur_params['catid'] = intval($catid);//<sato(na)0.5j />
605607 if ($subcatid) {
606608 $rname = $this->getRequestName();
607- $cur_params[$rname] = $subcatid;
609+ $cur_params[$rname] = intval($subcatid);//<sato(na)0.5j />
608610 }
609611 $url = createArchiveListLink($bid, $cur_params);
610612 if ($CONF['URLMode'] != 'pathinfo') {
611613 list(,$temp_param) = explode("?",$url);
612614 $url = $this->url. "?" . $temp_param;
613615 }
614- echo $url;
616+ $url = preg_replace(array("/</", "/>/"), array("&lt;", "&gt;"), $url); //<sato(na)0.5j />
617+ echo $url; //$cur_params escape OK <sato(na)0.5j />
615618 return;
616619 break;
617620 case 'categorylist':
@@ -639,13 +642,12 @@ function orderKey(key, sequence) {
639642 $b =& $manager->getBlog($CONF['DefaultBlog']);
640643 }
641644
642- $mycatid = 0;
643- if ($catid) $mycatid = $catid;
644- $mysubcatid = 0;
645- if ($subcatid) $mysubcatid = $subcatid;
645+ $mycatid = ($catid) ? intval($catid) : 0;//<sato(na)0.5j />
646+ $mysubcatid = ($subcatid) ? intval($subcatid) : 0;//<sato(na)0.5j />
646647 $templateName = $params[1];
647648 $amountEntries = 0;
648649 $offset = 0;
650+ $startpos = intval($startpos);//<sato(na)0.5j />
649651 if (isset($params[2])) {
650652 list($amountEntries, $offset) = sscanf($params[2], '%d(%d)');
651653 if ($offset) {
@@ -675,7 +677,7 @@ function orderKey(key, sequence) {
675677 }
676678
677679 $query .= ' WHERE i.iauthor=m.mnumber'
678- . ' and i.iblog='.$b->getID()
680+ . ' and i.iblog='.intval($b->getID()) //<sato(na)0.5j />
679681 . ' and i.icat=c.catid'
680682 . ' and i.idraft=0';
681683 if ($params[0] == 'archive' && $archive) {
@@ -726,9 +728,9 @@ function orderKey(key, sequence) {
726728 if ($what == 'itemlink') {
727729 $sparams = array();
728730 if ($catid) {
729- $sparams['catid'] = $catid;
731+ $sparams['catid'] = intval($catid);//<sato(na)0.5j />
730732 if ($subcatid) {
731- $sparams[$this->getRequestName()] = $subcatid;
733+ $sparams[$this->getRequestName()] = intval($subcatid);//<sato(na)0.5j />
732734 }
733735 }
734736 $url = createItemLink($item->itemid, $sparams);
@@ -736,7 +738,8 @@ function orderKey(key, sequence) {
736738 list(,$temp_param) = explode("?",$url);
737739 $url = $this->url. "?" . $temp_param;
738740 }
739- echo $url;
741+ $url = preg_replace(array("/</", "/>/"), array("&lt;", "&gt;"), $url); //<sato(na)0.5j />
742+ echo $url; //$cur_params escape OK <sato(na)0.5j />
740743 return;
741744 }
742745
@@ -745,7 +748,7 @@ function orderKey(key, sequence) {
745748 list(,$temp_param) = explode("?",$url);
746749 $url = $this->url. "?" . $temp_param;
747750 }
748- $mcat_string = '<a href="'.$url.'">'.htmlspecialchars($this->_getCatNameFromID($item->catid)).'</a>';
751+ $mcat_string = '<a href="'.$this->cnvHtmlUrlAttribute($url).'">'.htmlspecialchars($this->_getCatNameFromID($item->catid), ENT_QUOTES).'</a>'; //<sato(na)0.5j />
749752
750753 $itemScats = array();
751754 if ($itemscatstr = $this->_getSubCategories($item->itemid)) {
@@ -761,7 +764,7 @@ function orderKey(key, sequence) {
761764 } else {
762765 $surl = addLinkParams($url,array($this->getRequestName() => $id));
763766 }
764- $extra_scat_string[] = '<a href="'.$surl.'">'.htmlspecialchars($name).'</a>';
767+ $extra_scat_string[] = '<a href="'.$this->cnvHtmlUrlAttribute($surl).'">'.htmlspecialchars($name, ENT_QUOTES).'</a>'; //<sato(na)0.5j />
765768 }
766769 $scat_string = implode($this->ssep,$extra_scat_string);
767770 $cat_string = str_replace(array("<%category%>","<%subcategory%>"), array($mcat_string,$scat_string), $this->sform);
@@ -779,7 +782,7 @@ function orderKey(key, sequence) {
779782 list(,$temp_param) = explode("?",$url);
780783 $url = $this->url. "?" . $temp_param;
781784 }
782- $mcat_string = '<a href="'.$url.'">'.htmlspecialchars($this->_getCatNameFromID($icat)).'</a>';
785+ $mcat_string = '<a href="'.$this->cnvHtmlUrlAttribute($url).'">'.htmlspecialchars($this->_getCatNameFromID($icat), ENT_QUOTES).'</a>'; //<sato(na)0.5j />
783786
784787 if (count($itemScats) > 0 && array_key_exists($icat,$scatMaps)) {
785788 $extra_scat_string = array();
@@ -790,7 +793,7 @@ function orderKey(key, sequence) {
790793 } else {
791794 $surl = addLinkParams($url,array($this->getRequestName() => $id));
792795 }
793- $extra_scat_string[] = '<a href="'.$surl.'">'.htmlspecialchars($name).'</a>';
796+ $extra_scat_string[] = '<a href="'.$this->cnvHtmlUrlAttribute($surl).'">'.htmlspecialchars($name, ENT_QUOTES).'</a>'; //<sato(na)0.5j />
794797 }
795798 $scat_string = implode($this->ssep,$extra_scat_string);
796799 $extra_cat_string[] = str_replace(array("<%category%>","<%subcategory%>"), array($mcat_string,$scat_string), $this->sform);
@@ -800,11 +803,23 @@ function orderKey(key, sequence) {
800803 }
801804 }
802805 if (count($extra_cat_string) > 0) {
803- $cat_string .= $this->msep . join($this->ssep,$extra_cat_string);
806+ $cat_string .= $this->msep . implode($this->ssep,$extra_cat_string);
804807 }
805808 }
806- echo $cat_string;
809+ echo $cat_string;//$mcat_string, $scat_string escape OK <sato(na)0.5j />
807810 }
811+ //<sato(na)0.5j>
812+ function cnvHtmlUrlAttribute($forHtmlAtt__str)
813+ {
814+ //onEvent
815+ $forHtmlAtt__str = preg_replace('/[\'"]/', '', $forHtmlAtt__str);
816+
817+ //href="javascript:"
818+ $forHtmlAtt__str = preg_replace('/javascript/i', '', preg_replace('/[\x00-\x20\x22\x27]/', '', $forHtmlAtt__str));
819+
820+ return $forHtmlAtt__str;
821+ }
822+ //</sato(na)0.5j>
808823
809824 function _setCommonData($bid) {
810825 global $CONF;
@@ -814,7 +829,7 @@ function orderKey(key, sequence) {
814829 $this->addindex = ($this->getOption('addindex') == 'yes');
815830 $this->addbiddef = ($this->getOption('addblogid_def') == 'yes');
816831 $this->addbid = ($this->getOption('addblogid') == 'yes');
817- $this->defurl = quickQuery("SELECT burl as result from ".sql_table('blog')." WHERE bnumber=".$CONF['DefaultBlog']);
832+ $this->defurl = quickQuery("SELECT burl as result from ".sql_table('blog')." WHERE bnumber=".addslashes($CONF['DefaultBlog'])); //<sato(na)0.5j />
818833 if (!$this->defurl) $this->defurl = $CONF['Self'];
819834 $this->_setBlogData($bid);
820835 }
@@ -833,16 +848,16 @@ function orderKey(key, sequence) {
833848 $this->url .= "index.php";
834849 }
835850 if ($this->bid == $CONF['DefaultBlog'] && $this->addbiddef) {
836- $this->param['blogid'] = $this->bid;
851+ $this->param['blogid'] = $this->bid; //$this->bid intval OK
837852 } elseif ($this->bid != $CONF['DefaultBlog'] && ($this->url == $this->defurl || $this->addbid)){
838- $this->param['blogid'] = $this->bid;
853+ $this->param['blogid'] = $this->bid; //$this->bid intval OK
839854 }
840855 }
841856
842857 function _parseItem($template, $itemid) {
843858 global $manager;
844859
845- $b =& $manager->getBlog(getBlogIDFromItemID($itemid));
860+ $b =& $manager->getBlog(getBlogIDFromItemID($itemid));//Intval is not needed. ($itemid) <sato(na)0.5j />
846861
847862 $query = 'SELECT i.inumber as itemid, i.ititle as title, i.ibody as body, m.mname as author, m.mrealname as authorname, i.itime, i.imore as more, m.mnumber as authorid, m.memail as authormail, m.murl as authorurl, c.cname as category, i.icat as catid, i.iclosed as closed';
848863
@@ -850,7 +865,7 @@ function orderKey(key, sequence) {
850865 //$query .= ' FROM '.sql_table('item').' as i, '.sql_table('member').' as m, '.sql_table('category').' as c'
851866 $query .= ' FROM '.sql_table('category').' as c, '.sql_table('member').' as m, '.sql_table('item').' as i'
852867 //</sato(na)0.5j>
853- . ' WHERE i.iblog='.$b->getID()
868+ . ' WHERE i.iblog='.intval($b->getID()) //<sato(na)0.5j />
854869 . ' and i.iauthor=m.mnumber'
855870 . ' and i.icat=c.catid'
856871 . ' and i.idraft=0' // exclude drafts
@@ -867,12 +882,26 @@ function orderKey(key, sequence) {
867882 global $CONF, $manager, $blog, $catid, $subcatid;
868883 global $archive, $archivelist;
869884
885+ //<sato(na)0.5j>
886+ if ($archive) {
887+ sscanf ($archive,'%d-%d-%d', $y, $m, $d);
888+ if ($d) {
889+ $archive = sprintf ('%04d-%02d-%02d', $y, $m, $d);
890+ } else {
891+ $archive = sprintf ('%4d-%2d', $y, $m);
892+ }
893+ }
894+ // check archivelist
895+ if (! is_numeric($archivelist)) $archivelist = getBlogIDFromName($archivelist);
896+ //</sato(na)0.5j>
897+
870898 if ($blog) {
871899 $b =& $blog;
872900 } else {
873901 $b =& $manager->getBlog($CONF['DefaultBlog']);
874902 }
875903 $blogid = $b->getID();
904+ $blogid = (is_numeric($blogid)) ? intval($blogid) : getBlogIDFromName($blogid); //<sato(na)0.5j />
876905
877906 if (!isset($this->defurl)) $this->_setCommonData($blogid);
878907
@@ -905,7 +934,8 @@ function orderKey(key, sequence) {
905934 'self' => $CONF['Self']
906935 ));
907936
908- $query = 'SELECT c.catid, c.cdesc as catdesc, c.cname as catname FROM '.sql_table('category').' as c WHERE c.cblog=' . $blogid . ' GROUP BY c.cname ORDER BY c.cname ASC';
937+ $query = 'SELECT c.catid, c.cdesc as catdesc, c.cname as catname FROM '.sql_table('category').
938+ ' as c WHERE c.cblog=' . intval($blogid) . ' GROUP BY c.cname ORDER BY c.cname ASC'; //<sato(na)0.5j />
909939 $res = sql_query($query);
910940
911941 $tp = array();
@@ -919,6 +949,7 @@ function orderKey(key, sequence) {
919949 }
920950
921951 while ($data = mysql_fetch_assoc($res)) {
952+ $data['catid'] = intval($data['catid']); //<sato(na)0.5j />ultrarich
922953 $data['blogid'] = $blogid;
923954 $data['blogurl'] = $blogurl;
924955 $data['catlink'] = createCategoryLink($data['catid'], $linkparams);
@@ -927,7 +958,7 @@ function orderKey(key, sequence) {
927958 $data['catlink'] = $this->url. "?" . $temp_param;
928959 }
929960 $data['self'] = $CONF['Self'];
930- if ($data['catid'] == $catid) {
961+ if ($data['catid'] == intval($catid)) { //<sato(na)0.5j />
931962 $data['catflag'] = $this->getOption('catflag');
932963 }
933964 $cq = 'SELECT count(*) as result FROM '.sql_table('item').' as i';
@@ -946,6 +977,7 @@ function orderKey(key, sequence) {
946977 $subliststr = "";
947978
948979 while ($sdata = mysql_fetch_assoc($sres)) {
980+ $sdata['subcatid'] = intval($sdata['subcatid']); //<sato(na)0.5j />ultrarich
949981 $ares = sql_query(
950982 'SELECT count(i.inumber) FROM '
951983 . sql_table('item').' as i, '
@@ -1004,8 +1036,8 @@ function orderKey(key, sequence) {
10041036 $b =& $manager->getBlog($CONF['DefaultBlog']);
10051037 }
10061038
1007- if ($catid) $linkparams = array('catid' => $catid);
1008- if ($subcatid) $linkparams['subcatid'] = $subcatid;
1039+ if ($catid) $linkparams = array('catid' => intval($catid)); //<sato(na)0.5j />
1040+ if ($subcatid) $linkparams['subcatid'] = intval($subcatid); //<sato(na)0.5j />
10091041 if ($lc = $this->getOption('locale')) {
10101042 setlocale(LC_TIME,$lc);
10111043 }
@@ -1020,7 +1052,7 @@ function orderKey(key, sequence) {
10201052 if ($catid) {
10211053 $query .= ' LEFT JOIN '.sql_table('plug_multiple_categories').' as p ON i.inumber=p.item_id';
10221054 }
1023- $query .= ' WHERE i.iblog=' . $b->getID()
1055+ $query .= ' WHERE i.iblog=' . intval($b->getID()) //<sato(na)0.5j />
10241056 . ' and i.itime <=' . mysqldate($b->getCorrectTime()) // don't show future items!
10251057 . ' and i.idraft=0'; // don't show draft items
10261058
Show on old repository browser