Changeset 1295 for trunk/rss/admin/folders.php

Timestamp:

02/19/06 16:37:59 (3 years ago)

Author:

mbonetti

Message:

Sanitizing folder names

Files:

• trunk/rss/admin/folders.php (modified) (6 diffs)

trunk/rss/admin/folders.php

@@ -189 +189 @@
             $sql = "update " . getTable("channels") ." set parent=" . getRootFolder() . " where parent=$fid";
             rss_query($sql);
+            rss_invalidate_cache();
         }
         elseif (array_key_exists(CST_ADMIN_CONFIRMED,$_REQUEST) && $_REQUEST[CST_ADMIN_CONFIRMED] == LBL_ADMIN_NO) {
@@ -212 +213 @@
     case CST_ADMIN_SUBMIT_EDIT:
         // TBD
-        $new_label = rss_real_escape_string($_REQUEST['f_name']);
+        $new_label = sanitize($_REQUEST['f_name'], RSS_SANITIZER_CHARACTERS_EXT);
         if (is_numeric($fid) && strlen($new_label) > 0) {
 
@@ -222 +223 @@
             }
             rss_query("update " .getTable("folders") ." set name='$new_label' where id=$fid");
+            rss_invalidate_cache();
         }
         break;
@@ -227 +229 @@
     case LBL_ADMIN_ADD:
     case 'LBL_ADMIN_ADD':
-        $label=sanitize($_REQUEST['new_folder'],RSS_SANITIZER_SIMPLE_SQL);
+        $label=sanitize($_REQUEST['new_folder'],RSS_SANITIZER_CHARACTERS_EXT);
         assert(strlen($label) > 0);
         create_folder($label);
@@ -271 +273 @@
             rss_query( "update " . getTable("folders") ." set position = $switch_with_position where id=$fid" );
             rss_query( "update " . getTable("folders") ." set position = $position where id=$switch_with_id" );
+            rss_invalidate_cache();
         }
         break;
@@ -303 +306 @@
         }
         rss_query("insert into " .getTable("folders") ." (name,position) values ('" . rss_real_escape_string($label) ."', $np)");
+        rss_invalidate_cache();
     }