
Originally Posted by
Damien Jolly
Why didn't you code it securely in the first place? Just shows you're unreliable if you can't even get the job done right the first time.
I didn't bother adding a check the first time mainly because it wasn't supposed to be released. Someone just asked me to release so I did(just forgot to add a check before releasing).
- - - Updated - - -
Fixed bug report page.
Code:
<?php
if($_POST['add_ban']){
$text = mysql_real_escape_string($_POST['text']);
$type = mysql_real_escape_string($_POST['type']);
$username = mysql_real_escape_string($_POST['username']);
$resolved = mysql_real_escape_string($_POST['resolved']);
$bugcheck = mysql_query("SELECT id, resolved FROM hk_issues WHERE username = '{$_SESSION['user']['username']}' AND resolvedc = '0'");
if(empty($text)){
echo '<div class = "alert">You have not entered a bug/feature request?</div><br>';
}
if(mysql_num_rows($bugcheck) >= 2){
echo 'You must wait until your current bug reports are resolved.';
}
else{
$query = "INSERT INTO hk_issues SET type='{$type}', text='{$text}', username='" . $_SESSION['user']['username'] ."'";
mysql_query($query) or die ("Error in query: {$logtest}. ".mysql_error());
mysql_query($banlog);
echo '<div class = "alert">Bug/Feature request added successfully.<meta http-equiv="refresh" content="3;url={url}/bugs"/></div><br>';
}
}
?>
<form method = "post">
<select name = "type">
<option value="bug">Bug</option>
<option value="request">Feature Request</option>
</select><br>
<b>Bug/Feature?: </b><br><input type = "text" value = "<?php echo $_POST['text']; ?>" name = "text"><br><br>
<input type = "sub
SQL
Code:
DROP TABLE IF EXISTS `hk_issues`;
CREATE TABLE `hk_issues` (
`id` int(11) unsigned NOT NULL AUTO_INCREMENT,
`type` enum('bug','request','') NOT NULL,
`text` varchar(255) NOT NULL,
`username` varchar(255) NOT NULL,
`resolved` text,
`resolvedc` enum('0','1') NOT NULL,
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=7 DEFAULT CHARSET=utf8;
-- ----------------------------
-- Records of hk_issues
-- ----------------------------
INSERT INTO `hk_issues` VALUES ('1', 'bug', 'l', 'Test', 'Content', '0');
INSERT INTO `hk_issues` VALUES ('2', 'bug', 'l', 'Test', 'Content', '1');
INSERT INTO `hk_issues` VALUES ('3', 'bug', 'l', 'Test', 'Content', '1');
INSERT INTO `hk_issues` VALUES ('4', 'bug', 'te', 'Test', 'Content', '1');
INSERT INTO `hk_issues` VALUES ('5', 'bug', '.', 'Test', null, '1');
INSERT INTO `hk_issues` VALUES ('6', 'bug', 'l', 'Test', null, '0');
Added a column 'resolvedc' that needs to be set for 1 in order for the user to make more than three requests.
Also add case "bugs": to class.core near cases so it can't be viewed if someone does not have a active session( near case "me": )