From 06217c66c8f9b114726b21633eabcd88ac9034aa Mon Sep 17 00:00:00 2001 From: Aaron Junker Date: Mon, 3 Jan 2022 17:02:38 +0100 Subject: [PATCH 1/2] Update usersearch.php --- admin/pages/usersearch.php | 195 +++++++++++++++++++++---------------- 1 file changed, 112 insertions(+), 83 deletions(-) diff --git a/admin/pages/usersearch.php b/admin/pages/usersearch.php index ca20cec77..0fb22a928 100644 --- a/admin/pages/usersearch.php +++ b/admin/pages/usersearch.php @@ -1,89 +1,118 @@ - -" dir="ltr"> - - - - <?php echo $U->getLang("admin") ?> - <?php echo $U->getLang("admin.user.search"); ?> - - - getLang("admin.exit"); ?> -

getLang("admin.user.search.intro"); ?>

-
-
-
-
-
- - " /> -
- db_link, $sql); +userHasPermission("Backend", "User","Search")){ +?> + + " dir="ltr"> + + + + <?php echo $U->getLang("admin") ?> - <?php echo $U->getLang("admin.user.search"); ?> + + + getLang("admin.exit"); ?> +

getLang("admin.user.search.intro"); ?>

+
+
+
+
+
+ + " /> +
+ db_link, $sql); + } } - } - if(isset($_GET["Mail"]) || isset($_GET["Name"])){ - $userhere = False; - while($row = mysqli_fetch_array($db_erg, MYSQLI_ASSOC)){ - $userhere = True; - ?> -

getLang("admin.user.search.title")); ?>

- - - - - - - - - - - - - - - - - - - -
- Id: - - -
- getLang("admin.user.field.mail"); ?>: - - -
- getLang("admin.user.field.admin"); ?> - - -
- getLang("admin.user.field.blocked"); ?> - - -
- db_link, $sql); + } } - if(!$userhere&&$_GET["Mail"] !== ""){ - echo str_replace("%a", $U->getLang("admin.user.field.mail"), str_replace("%b", $_GET["Mail"], $U->getLang("admin.user.notFound.property"))); + if(isset($_GET["Id"])){ + if($_GET["Id"] !== ""){ + $sql = "SELECT * FROM User WHERE Id='".mysqli::real_escape_string($_GET["Id"])."';"; + $dbRes = mysqli_query($U->db_link, $sql); + } } - if(!$userhere&&$_GET["Name"] !== ""){ - echo str_replace("%a", $U->getLang("admin.user.field.username"), str_replace("%b", $_GET["Name"], $U->getLang("admin.user.notFound.property"))); + if(isset($_GET["Mail"]) || isset($_GET["Name"]) || isset($_GET["Id"])){ + $userhere = False; + while($row = mysqli_fetch_array($dbRes, MYSQLI_ASSOC)){ + $userhere = True; + ?> +

getLang("admin.user.search.title")); ?>

+ + + + + + + + + + + + + + + + + + + +
+ Id: + + +
+ getLang("admin.user.field.mail"); ?>: + + +
+ getLang("admin.user.field.permissionlevel"); ?> + + getPermissionName($row["Type"]); ?> +
+ getLang("admin.user.field.blocked"); ?> + + getLang("admin.no"):$U->getLang("admin.yes"); ?> +
+ getLang("admin.user.field.mail"), str_replace("%b", $_GET["Mail"], $U->getLang("admin.user.notFound.property"))); + } + if(!$userhere&&isset($_GET["Name"])&&$_GET["Name"]!==""){ + echo str_replace("%a", $U->getLang("admin.user.field.username"), str_replace("%b", $_GET["Name"], $U->getLang("admin.user.notFound.property"))); + } + if(!$userhere&&isset($_GET["Id"])){ + echo str_replace("%a", $U->getLang("admin.user.field.id"), str_replace("%b", $_GET["Id"], $U->getLang("admin.user.notFound.property"))); + } } - } - ?> + ?> + + + + + " dir="ltr"> + + + <?php echo $U->getLang("admin") ?> - <?php echo $U->getLang("admin.settings"); ?> + + + getLang("admin.exit"); ?> +

getLang("rights.error"); ?>

- \ No newline at end of file + + From 21e8bfd7a9ab0b7f9344a7a3a7c32a7cdd5a0b69 Mon Sep 17 00:00:00 2001 From: Aaron Junker Date: Mon, 3 Jan 2022 17:04:46 +0100 Subject: [PATCH 2/2] Update register.php --- login/register.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/login/register.php b/login/register.php index 69852d09a..d409331a6 100644 --- a/login/register.php +++ b/login/register.php @@ -25,8 +25,8 @@ if(preg_match('/^[a-z0-9A-Z.:,;]{8,25}$/',$_POST["P"])){ $register = True; $sql = "SELECT * FROM User"; - $db_erg = mysqli_query($U->db_link, $sql); - while ($row = mysqli_fetch_array($db_erg, MYSQLI_ASSOC)) + $dbRes = mysqli_query($U->db_link, $sql); + while ($row = mysqli_fetch_array($dbRes, MYSQLI_ASSOC)) { //Checks if username or mail are in use if(strtolower($row["Username"]) == strtolower($_POST["U"])||strtolower($row["Mail"])==strtolower($_POST["M"])){ @@ -57,8 +57,8 @@ if($register){ //Register succeeded: //Register user - $sql = 'INSERT INTO User (Username, Mail, Password, Type) VALUES ('."'".$_POST["U"]."'".','."'".$_POST["M"]."'".','."'".password_hash($_POST["P"],PASSWORD_DEFAULT)."'".',0);'; - if($db_erg = mysqli_query($U->db_link, $sql)){ + $sql = 'INSERT INTO User (Username, Mail, Password, Type) VALUES ('."'".mysqli::real_escape_string($_POST["U"])."'".','."'".mysqli::real_escape_string($_POST["M"])."'".','."'".password_hash(mysqli::real_escape_string($_POST["P"]),PASSWORD_DEFAULT)."'".','.$USOC["userRights"]["AfterRegistration"].');'; + if($dbRes = mysqli_query($U->db_link, $sql)){ //Database register is succeeded echo $U->getLang("register.succeed"); header("Location: ".$USOC["DOMAIN"]);