tim
c85f54116c
The queue image query took $id without quotes or a check, which allowed SQL injection.
99 lines
3.5 KiB
PHP
99 lines
3.5 KiB
PHP
<?php
|
|
require_once('open_db.lib.php');
|
|
require_once("get_data.lib.php");
|
|
if (stream_resolve_include_path("Numbers/Words.php"))
|
|
include_once("Numbers/Words.php");
|
|
|
|
function sort_options($link) {
|
|
$queue = get_queue();
|
|
$search = get_search_args();
|
|
$sort = get_sort_arg();
|
|
$order = get_order();
|
|
$start = get_start_num();
|
|
$show = get_show_num();
|
|
$which_sort = array(
|
|
'date' => 'date',
|
|
'author' => 'author',
|
|
'title' => 'title',
|
|
);
|
|
$which_order = array(
|
|
'asc' => '',
|
|
'desc' => 'z-a',
|
|
);
|
|
$options = array();
|
|
foreach ($which_sort as $sort_key=>$sort_value) {
|
|
foreach ($which_order as $order_key=>$order_value) {
|
|
if ($sort_key == 'date')
|
|
$order_value = ($order_key == 'asc') ? '' : 'descending' ;
|
|
$display = '<span>' . $sort_value;
|
|
$display .= $order_value ? " " . $order_value : "";
|
|
$display .= '</span>';
|
|
if ($sort == $sort_key && $order == $order_key) {
|
|
array_push($options, $display);
|
|
} else {
|
|
$href = '<a href="'.$link.'?sort='.$sort_key.'&order='.$order_key;
|
|
if (isset($_GET['queue'])) $href .= '&queue='.$_GET['queue'];
|
|
if (isset($_GET['search'])) $href .= '&search='.urlencode((string)$search);
|
|
if (isset($_GET['start'])) $href .= '&start='.$start;
|
|
if (isset($_GET['show'])) $href .= '&show='.$show;
|
|
$href .= '">'.$display.'</a>';
|
|
|
|
array_push($options, $href);
|
|
}
|
|
}
|
|
}
|
|
$string = '<div class="options">Sort by: ' . implode(' <span class="bar">|</span> ', $options) . '</div>'."\n";
|
|
return $string;
|
|
}
|
|
|
|
function get_pager() {
|
|
global $editable;
|
|
$queue = get_queue();
|
|
$search = get_search_args();
|
|
$sort = get_sort_arg();
|
|
$order = get_order();
|
|
$start = get_start_num();
|
|
$show = get_show_num();
|
|
|
|
$prev = $start+$show;
|
|
$next = $start-$show;
|
|
|
|
// If next is less than 0, make sure we can see the next stories
|
|
if ($next < 0) $next = 0;
|
|
|
|
$link = $editable ? "" : "/article";
|
|
$queue_url = $queue ? 1 : 0;
|
|
|
|
$string = '<div class="pager">';
|
|
$nw = class_exists('Numbers_Words') ? new Numbers_Words() : NULL;
|
|
// Are there later stories? Go backwards to them
|
|
$string .= '<span class="next">';
|
|
if ($start > 0) {
|
|
$string .= "\n".'<a href="'.$link.'?start='.$next;
|
|
if (isset($_GET['queue'])) $string .= '&queue='.$queue_url;
|
|
if (isset($_GET['search'])) $string .= '&search='.urlencode((string)$search);
|
|
if (isset($_GET['show'])) $string .= '&show='.$show;
|
|
if (isset($_GET['sort'])) $string .= '&sort='.$sort;
|
|
if (isset($_GET['order'])) $string .= '&order='.$order;
|
|
$articles = ($show == 1) ? "article" : ($nw ? $nw->toWords($show) : $show)." articles";
|
|
$string .= '">« Next '.$articles.'</a>';
|
|
}
|
|
$string .= "</span>\n";
|
|
|
|
// Are there earlier stories? Go forwards to them
|
|
$string .= "\n".'<span class="prev">';
|
|
if ($prev < get_count()) {
|
|
$string .= "\n".'<a href="'.$link.'?start='.$prev;
|
|
if (isset($_GET['queue'])) $string .= '&queue='.$queue_url;
|
|
if (isset($_GET['search'])) $string .= '&search='.urlencode((string)$search);
|
|
if (isset($_GET['show'])) $string .= '&show='.$show;
|
|
if (isset($_GET['sort'])) $string .= '&sort='.$sort;
|
|
if (isset($_GET['order'])) $string .= '&order='.$order;
|
|
$articles = ($show == 1) ? "article" : ($nw ? $nw->toWords($show) : $show)." articles";
|
|
$string .= '">Previous '.$articles.' »</a>';
|
|
}
|
|
$string .= "</span>\n";
|
|
$string .= "</div>\n";
|
|
return $string;
|
|
}
|