View Single Post
  #3  
Old 2nd November 2009, 17:30
irfan's Avatar
irfan irfan is offline
Senior Member
 
Join Date: Jun 2009
United Kingdom
Posts: 67
Default
Edit: This is the new version with 2 fixed XSS vunerabilities.

1. in browse.php find


PHP Code:
if (empty($cleansearchstr))
    unset(
$cleansearchstr);

// sorting by MarkoStamcar

if ($_GET['sort'] && $_GET['type']) {

$column '';
$ascdesc '';

    switch(
$_GET['sort']) {
        case 
'1'$column "name"; break;
        case 
'2'$column "numfiles"; break;
        case 
'3'$column "comments"; break;
        case 
'4'$column "added"; break;
        case 
'5'$column "size"; break;
        case 
'6'$column "times_completed"; break;
        case 
'7'$column "seeders"; break;
        case 
'8'$column "leechers"; break;
        case 
'9'$column "owner"; break;
  default: 
$column "id"; break;
    }

    switch(
$_GET['type']) {
  case 
'asc'$ascdesc "ASC"$linkascdesc "asc"; break;
  case 
'desc'$ascdesc "DESC"$linkascdesc "desc"; break;
  default: 
$ascdesc "DESC"$linkascdesc "desc"; break;
    }


$orderby "ORDER BY torrents." $column " " $ascdesc;
$pagerlink "sort=" intval($_GET['sort']) . "&type=" $linkascdesc "&";

} else {

$orderby "ORDER BY torrents.id DESC";
$pagerlink "";


2. (still in browse.php) find:

PHP Code:
$torrentsperpage $CURUSER["torrentsperpage"];
if (!
$torrentsperpage)
    
$torrentsperpage 15;

if (
$count)

and add after it:

PHP Code:
<td class="colhead" align="center">Type</td>
<td class="colhead" align=left>Name</td>
<!--<td class="heading" align=left>DL</td>-->
<?
    
if ($wait)
    {
        print(
"<td class=\"colhead\" align=\"center\">Wait</td>\n");
    }

    if (
$variant == "mytorrents")
  {
      print(
"<td class=\"colhead\" align=\"center\">Edit</td>\n");
    print(
"<td class=\"colhead\" align=\"center\">Visible</td>\n");
    }

?>
<td class="colhead" align=right>Files</td>
<td class="colhead" align=right>Comm.</td>
<!--<td class="colhead" align="center">Rating</td>-->
<td class="colhead" align="center">Added</td>
<td class="colhead" align="center">TTL</td>
<td class="colhead" align="center">Size</td>
<!--
<td class="colhead" align=right>Views</td>
<td class="colhead" align=right>Hits</td>
-->
<td class="colhead" align="center">Snatched</td>
<td class="colhead" align=right>Seeders</td>
<td class="colhead" align=right>Leechers</td>
<?

    
if ($variant == "index")
        print(
"<td class=\"colhead\" align=center>Upped&nbsp;by</td>\n");

    print(
"</tr>\n");
and replace it by:

PHP Code:
<?

// sorting by MarkoStamcar

$count_get 0;

foreach (
$_GET as $get_name => $get_value) {

    
$get_name mysql_escape_string(strip_tags(str_replace(array("\"","'"),array("",""),$get_name)));

    
$get_value mysql_escape_string(strip_tags(str_replace(array("\"","'"),array("",""),$get_value)));
    
    if (
$get_name != "sort" && $get_name != "type") {
        if (
$count_get 0) {
            
$oldlink $oldlink "&" $get_name "=" $get_value;
        } else {
            
$oldlink $oldlink $get_name "=" $get_value;
        }
        
$count_get++;
    }

}

if (
$count_get 0) {
    
$oldlink $oldlink "&";
}


if (
$_GET['sort'] == "1") {
    if (
$_GET['type'] == "desc") {
        
$link1 "asc";
    } else {
        
$link1 "desc";
    }
}

if (
$_GET['sort'] == "2") {
    if (
$_GET['type'] == "desc") {
        
$link2 "asc";
    } else {
        
$link2 "desc";
    }
}

if (
$_GET['sort'] == "3") {
    if (
$_GET['type'] == "desc") {
        
$link3 "asc";
    } else {
        
$link3 "desc";
    }
}

if (
$_GET['sort'] == "4") {
    if (
$_GET['type'] == "desc") {
        
$link4 "asc";
    } else {
        
$link4 "desc";
    }
}

if (
$_GET['sort'] == "5") {
    if (
$_GET['type'] == "desc") {
        
$link5 "asc";
    } else {
        
$link5 "desc";
    }
}

if (
$_GET['sort'] == "6") {
    if (
$_GET['type'] == "desc") {
        
$link6 "asc";
    } else {
        
$link6 "desc";
    }
}

if (
$_GET['sort'] == "7") {
    if (
$_GET['type'] == "desc") {
        
$link7 "asc";
    } else {
        
$link7 "desc";
    }
}

if (
$_GET['sort'] == "8") {
    if (
$_GET['type'] == "desc") {
        
$link8 "asc";
    } else {
        
$link8 "desc";
    }
}

if (
$_GET['sort'] == "9") {
    if (
$_GET['type'] == "desc") {
        
$link9 "asc";
    } else {
        
$link9 "desc";
    }
}

if (
$link1 == "") { $link1 "asc"; } // for torrent name
if ($link2 == "") { $link2 "desc"; }
if (
$link3 == "") { $link3 "desc"; }
if (
$link4 == "") { $link4 "desc"; }
if (
$link5 == "") { $link5 "desc"; }
if (
$link6 == "") { $link6 "desc"; }
if (
$link7 == "") { $link7 "desc"; }
if (
$link8 == "") { $link8 "desc"; }
if (
$link9 == "") { $link9 "desc"; }

?>
<td class="colhead" align="center">Type</td>
<td class="colhead" align=left><a href="browse.php?<? print $oldlink?>sort=1&type=<? print $link1?>">Name</a></td>
<!--<td class="heading" align=left>DL</td>-->
<?
    
if ($wait)
    {
        print(
"<td class=\"colhead\" align=\"center\">Wait</td>\n");
    }

    if (
$variant == "mytorrents")
  {
      print(
"<td class=\"colhead\" align=\"center\">Edit</td>\n");
    print(
"<td class=\"colhead\" align=\"center\">Visible</td>\n");
    }

?>
<td class="colhead" align="right"><a href="browse.php?<? print $oldlink?>sort=2&type=<? print $link2?>">Files</a></td>
<td class="colhead" align="right"><a href="browse.php?<? print $oldlink?>sort=3&type=<? print $link3?>">Comm.</a></td>
<!--<td class="colhead" align="center">Rating</td>-->
<td class="colhead" align="center"><a href="browse.php?<? print $oldlink?>sort=4&type=<? print $link4?>">Added</a></td>
<td class="colhead" align="center">TTL</td>
<td class="colhead" align="center"><a href="browse.php?<? print $oldlink?>sort=5&type=<? print $link5?>">Size</a></td>
<!--
<td class="colhead" align=right>Views</td>
<td class="colhead" align=right>Hits</td>
-->
<td class="colhead" align="center"><a href="browse.php?<? print $oldlink?>sort=6&type=<? print $link6?>">Snatched</a></td>
<td class="colhead" align="right"><a href="browse.php?<? print $oldlink?>sort=7&type=<? print $link7?>">Seeders</a></td>
<td class="colhead" align="right"><a href="browse.php?<? print $oldlink?>sort=8&type=<? print $link8?>">Leechers</a></td>
<?

    
if ($variant == "index")
        print(
"<td class=\"colhead\" align=center><a href=\"browse.php?{$oldlink}sort=9&type={$link9}\">Upped&nbsp;by</a></td>\n");

    print(
"</tr>\n");
please do this for me with the attached browse.php in post 1. thanks

Please help

Last edited by irfan; 2nd November 2009 at 22:32.
Reply With Quote