Fixes regarding csrf + refactor some parts of AAC (guilds + forum)

Replace $account_logged->getPlayers() with getPlayersList()
$_REQUEST['todo'] -> $_REQUEST['post']
$guild_errors -> $errors
This commit is contained in:
slawkens
2025-05-24 11:42:42 +02:00
parent e776bd52be
commit 84d502bf10
42 changed files with 301 additions and 272 deletions

View File

@@ -26,10 +26,10 @@ if(!$logged) {
csrfProtect();
if(Forum::isModerator()) {
$id = (int) $_REQUEST['id'];
$id = (int) ($_POST['id'] ?? 0);
$post = $db->query("SELECT `id`, `first_post`, `section` FROM `" . FORUM_TABLE_PREFIX . "forum` WHERE `id` = ".$id." LIMIT 1")->fetch();
if($post['id'] == $id && Forum::hasAccess($post['section'])) {
if($post && $post['id'] == $id && Forum::hasAccess($post['section'])) {
if($post['id'] == $post['first_post']) {
$db->query("DELETE FROM `" . FORUM_TABLE_PREFIX . "forum` WHERE `first_post` = ".$post['id']);
header('Location: ' . getForumBoardLink($post['section']));
@@ -38,7 +38,7 @@ if(Forum::isModerator()) {
$post_page = $db->query("SELECT COUNT(`" . FORUM_TABLE_PREFIX . "forum`.`id`) AS posts_count FROM `players`, `" . FORUM_TABLE_PREFIX . "forum` WHERE `players`.`id` = `" . FORUM_TABLE_PREFIX . "forum`.`author_guid` AND `" . FORUM_TABLE_PREFIX . "forum`.`id` < ".$id." AND `" . FORUM_TABLE_PREFIX . "forum`.`first_post` = ".(int) $post['first_post'])->fetch();
$_page = (int) ceil($post_page['posts_count'] / setting('core.forum_threads_per_page')) - 1;
$db->query("DELETE FROM `" . FORUM_TABLE_PREFIX . "forum` WHERE `id` = ".$post['id']);
header('Location: ' . getForumThreadLink($post['first_post'], (int) $_page));
header('Location: ' . getForumThreadLink($post['first_post'], $_page));
}
}
else {