fixed problems with usernames using html special chars, added GMT + 13 to english lang_main (yes, again. ;)), paul will slap me again... i see the trout coming, but this var has to be added.

acydburn · acydburn · commit 72fc5decbe8b · 2003-03-09T02:03:15.000Z
git-svn-id: file:///svn/phpbb/branches/phpBB-2_0_0@3616 89ea8834-ac86-4346-8a33-228a782c2dd0
diff --git a/phpBB/admin/admin_users.php b/phpBB/admin/admin_users.php
@@ -216,7 +216,7 @@
 			message_die(GENERAL_MESSAGE, $message);
 		}
 
-		$username = ( !empty($HTTP_POST_VARS['username']) ) ? trim(strip_tags( $HTTP_POST_VARS['username'] ) ) : '';
+		$username = ( !empty($HTTP_POST_VARS['username']) ) ? trim(strip_tags(htmlspecialchars($HTTP_POST_VARS['username']))) : '';
 		$email = ( !empty($HTTP_POST_VARS['email']) ) ? trim(strip_tags(htmlspecialchars( $HTTP_POST_VARS['email'] ) )) : '';
 
 		$password = ( !empty($HTTP_POST_VARS['password']) ) ? trim(strip_tags(htmlspecialchars( $HTTP_POST_VARS['password'] ) )) : '';
@@ -736,7 +736,7 @@
 		// Now parse and display it as a template
 		//
 		$user_id = $this_userdata['user_id'];
-		$username = htmlspecialchars($this_userdata['username']);
+		$username = $this_userdata['username'];
 		$email = $this_userdata['user_email'];
 		$password = '';
 		$password_confirm = '';
diff --git a/phpBB/groupcp.php b/phpBB/groupcp.php
@@ -471,7 +471,7 @@ function generate_user_info(&$row, $date_format, $group_mod, &$from, &$posts, &$
 
 			if ( isset($HTTP_POST_VARS['add']) )
 			{
-				$username = ( isset($HTTP_POST_VARS['username']) ) ? $HTTP_POST_VARS['username'] : "";
+				$username = ( isset($HTTP_POST_VARS['username']) ) ? htmlspecialchars($HTTP_POST_VARS['username']) : '';
 				
 				$sql = "SELECT user_id, user_email, user_lang, user_level  
 					FROM " . USERS_TABLE . " 
diff --git a/phpBB/language/lang_english/lang_main.php b/phpBB/language/lang_english/lang_main.php
@@ -923,6 +923,7 @@
 $lang['10'] = 'GMT + 10 Hours';
 $lang['11'] = 'GMT + 11 Hours';
 $lang['12'] = 'GMT + 12 Hours';
+$lang['13'] = 'GMT + 13 Hours';
 
 // These are displayed in the timezone select box
 $lang['tz']['-12'] = 'GMT - 12 Hours';
diff --git a/phpBB/login.php b/phpBB/login.php
@@ -54,7 +54,7 @@
 {
 	if( ( isset($HTTP_POST_VARS['login']) || isset($HTTP_GET_VARS['login']) ) && !$userdata['session_logged_in'] )
 	{
-		$username = isset($HTTP_POST_VARS['username']) ? $HTTP_POST_VARS['username'] : '';
+		$username = isset($HTTP_POST_VARS['username']) ? trim(htmlspecialchars($HTTP_POST_VARS['username'])) : '';
 		$password = isset($HTTP_POST_VARS['password']) ? $HTTP_POST_VARS['password'] : '';
 
 		$sql = "SELECT user_id, username, user_password, user_active, user_level

Original file line number	Diff line number	Diff line change
`@@ -471,7 +471,7 @@ function generate_user_info(&$row, $date_format, $group_mod, &$from, &$posts, &$`
`471`	`471`
`472`	`472`	`if ( isset($HTTP_POST_VARS['add']) )`
`473`	`473`	`{`
`474`		`- $username = ( isset($HTTP_POST_VARS['username']) ) ? $HTTP_POST_VARS['username'] : "";`
	`474`	`+ $username = ( isset($HTTP_POST_VARS['username']) ) ? htmlspecialchars($HTTP_POST_VARS['username']) : '';`
`475`	`475`
`476`	`476`	`$sql = "SELECT user_id, user_email, user_lang, user_level`
`477`	`477`	`FROM " . USERS_TABLE . "`
Original file line number	Diff line number	Diff line change
`@@ -54,7 +54,7 @@`
`54`	`54`	`{`
`55`	`55`	`if( ( isset($HTTP_POST_VARS['login']) \|\| isset($HTTP_GET_VARS['login']) ) && !$userdata['session_logged_in'] )`
`56`	`56`	`{`
`57`		`- $username = isset($HTTP_POST_VARS['username']) ? $HTTP_POST_VARS['username'] : '';`
	`57`	`+ $username = isset($HTTP_POST_VARS['username']) ? trim(htmlspecialchars($HTTP_POST_VARS['username'])) : '';`
`58`	`58`	`$password = isset($HTTP_POST_VARS['password']) ? $HTTP_POST_VARS['password'] : '';`
`59`	`59`
`60`	`60`	`$sql = "SELECT user_id, username, user_password, user_active, user_level`