[Phpgroupware-cvs] CVS: news_admin/website export.php,1.1.4.1,1.1.4.1.2.1 news.inc.php,1.4.4.2,1.4.4.2.2.1

[Dave Hall <address@hidden>]

Update of /cvsroot/phpgroupware/news_admin/website
In directory subversions:/tmp/cvs-serv9749/website

Modified Files:
      Tag: Version-0_9_16-branch
        export.php news.inc.php 
Log Message:
fixes bugs #3349, #3380 security and other issues

Index: export.php
===================================================================
RCS file: /cvsroot/phpgroupware/news_admin/website/export.php,v
retrieving revision 1.1.4.1
retrieving revision 1.1.4.1.2.1
diff -C2 -r1.1.4.1 -r1.1.4.1.2.1
*** export.php  20 Jan 2002 22:42:59 -0000      1.1.4.1
--- export.php  4 May 2003 06:12:13 -0000       1.1.4.1.2.1
***************
*** 26,31 ****
                         "row"  => $format . "_row.tpl"));
  
!   $db->query("select * from phpgw_news,accounts where news_status='Active' 
order by news_date "
!            . "desc limit 5");
  
    $tpl->set_var("site_title",$site_title);
--- 26,31 ----
                         "row"  => $format . "_row.tpl"));
  
!   $db->query('select * from phpgw_news WHERE news_status='Active' ORDER BY 
news_date ' 
!            . 'DESC LIMIT 5');
  
    $tpl->set_var("site_title",$site_title);

Index: news.inc.php
===================================================================
RCS file: /cvsroot/phpgroupware/news_admin/website/news.inc.php,v
retrieving revision 1.4.4.2
retrieving revision 1.4.4.2.2.1
diff -C2 -r1.4.4.2 -r1.4.4.2.2.1
*** news.inc.php        7 Mar 2002 03:02:13 -0000       1.4.4.2
--- news.inc.php        4 May 2003 06:12:13 -0000       1.4.4.2.2.1
***************
*** 17,23 ****
  
        $tpl->set_file(array('news' => 'news.tpl',
!                                                       'row' => 
'news_row.tpl'));
  
!       $db->query("select count(*) from phpgw_news where 
news_status='Active'");
        $db->next_record();
        $total = $db->f(0);
--- 17,24 ----
  
        $tpl->set_file(array('news' => 'news.tpl',
!                       'row' => 'news_row.tpl')
!       );
  
!       $db->query("SELECT COUNT(*) FROM phpgw_news WHERE 
news_status='Active'");
        $db->next_record();
        $total = $db->f(0);
***************
*** 25,35 ****
        if (! $oldnews)
        {
!               $db->query("select *,account_lid as submittedby from 
phpgw_news,phpgw_accounts where news_status='Active' "
!                                       . "and 
news_submittedby=phpgw_accounts.account_id order by news_date desc limit 5");
        }
        else
        {
!               $db->query("select *,account_lid as submittedby from 
phpgw_news,phpgw_accounts where news_status='Active' and "
!                                       . 
"news_submittedby=phpgw_accounts.account_id order by news_date desc limit 
5,$total");
        }
  
--- 26,36 ----
        if (! $oldnews)
        {
!               $db->query("SELECT *,account_lid AS submittedby FROM 
phpgw_news,phpgw_accounts WHERE news_status='Active' "
!                                       . "AND 
news_submittedby=phpgw_accounts.account_id ORDER BY news_date DESC LIMIT 5");
        }
        else
        {
!               $db->query("SELECT *,account_lid AS submittedby FROM 
phpgw_news,phpgw_accounts WHERE news_status='Active' AND "
!                                       . 
"news_submittedby=phpgw_accounts.account_id ORDER BY news_date DESC LIMIT 
5,$total");
        }