From 19df2e030a538d797826cbd781b619583cd5bb5c Mon Sep 17 00:00:00 2001
From: Daniel Winzen <d@winzen4.de>
Date: Sat, 17 Dec 2016 13:06:33 +0100
Subject: [PATCH] Let everyone ignore anyone + bugfixes

Mods not seeing ignored peoples posts has been fixed before
---
 README    |  2 +-
 README.md |  2 +-
 chat.php  | 12 ++++++------
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/README b/README
index a038e03..b18608f 100644
--- a/README
+++ b/README
@@ -77,6 +77,6 @@ If you never used regex before, check out this starting guide to begin with regu
 
 LIVE DEMO:
 
-If you want to see the script in action, you can visit my TOR hidden service http://tt3j2x4k5ycaa5zt.onion/chat.php or via a tor2web proxy like https://danwin1210.tk/chat.php if you don't have TOR installed.
+If you want to see the script in action, you can visit my TOR hidden service http://tt3j2x4k5ycaa5zt.onion/chat.php or via a tor2web proxy like https://danwin1210.me/chat.php if you don't have TOR installed.
 Considering this is a hidden service, you should be prepared for the worst case, as people tend to do illegal activities in the TOR network. I'm not online 24/7 so it might not be possible to remove such content right away.
 If you should see illegal content, don't panic. Use the contact form on my site to notify me and clean your browser cache afterwards.
diff --git a/README.md b/README.md
index 5ee1df8..bef3815 100644
--- a/README.md
+++ b/README.md
@@ -83,6 +83,6 @@ If you never used regex before, check out [this starting guide](http://docs.acti
 Live demo:
 ----------
 
-If you want to see the script in action, you can visit my [TOR hidden service](http://tt3j2x4k5ycaa5zt.onion/chat.php) or via a tor2web proxy like [this one](https://danwin1210.tk/chat.php) if you don't have TOR installed.
+If you want to see the script in action, you can visit my [TOR hidden service](http://tt3j2x4k5ycaa5zt.onion/chat.php) or via a tor2web proxy like [this one](https://danwin1210.me/chat.php) if you don't have TOR installed.
 Considering this is a hidden service, you should be prepared for the worst case, as people tend to do illegal activities in the TOR network. I'm not online 24/7 so it might not be possible to remove such content right away.
 If you should see illegal content, don't panic. Use the contact form on my site to notify me and clean your browser cache afterwards. I will remove the content as soon as possible.
diff --git a/chat.php b/chat.php
index d454497..048ec3a 100644
--- a/chat.php
+++ b/chat.php
@@ -709,7 +709,7 @@ function send_setup($C){
 		}
 		echo submit($I['destroy'], 'class="delbutton"').'</form></td></tr></table><br>';
 	}
-	echo form_target('parent', 'logout');
+	echo form_target('_parent', 'logout');
 	if(!isset($_REQUEST['session'])){
 		echo hidden('session', $U['session']);
 	}
@@ -1856,8 +1856,8 @@ function send_profile($arg=''){
 	}
 	echo "<tr><td><table id=\"ignore\"><tr><th>$I[ignore]</th><td>";
 	echo "<select name=\"ignore\" size=\"1\"><option value=\"\">$I[choose]</option>";
-	$stmt=$db->prepare('SELECT poster, style FROM ' . PREFIX . 'messages INNER JOIN ' . PREFIX . 'sessions ON (' .  PREFIX . 'messages.poster=' . PREFIX . 'sessions.nickname) WHERE poster!=? AND (status<=? OR status<=3) AND poster NOT IN (SELECT ign FROM ' . PREFIX . 'ignored WHERE ignby=?) GROUP BY poster;');
-	$stmt->execute([$U['nickname'], $U['status'], $U['nickname']]);
+	$stmt=$db->prepare('SELECT poster, style FROM ' . PREFIX . 'messages INNER JOIN ' . PREFIX . 'sessions ON (' .  PREFIX . 'messages.poster=' . PREFIX . 'sessions.nickname) WHERE poster!=? AND poster NOT IN (SELECT ign FROM ' . PREFIX . 'ignored WHERE ignby=?) GROUP BY poster;');
+	$stmt->execute([$U['nickname'], $U['nickname']]);
 	while($nick=$stmt->fetch(PDO::FETCH_NUM)){
 		echo '<option value="'.htmlspecialchars($nick[0])."\" style=\"$nick[1]\">".htmlspecialchars($nick[0]).'</option>';
 	}
@@ -2774,8 +2774,8 @@ function save_profile(){
 		$stmt->execute([$_REQUEST['unignore'], $U['nickname']]);
 	}
 	if(!empty($_REQUEST['ignore'])){
-		$stmt=$db->prepare('SELECT * FROM ' . PREFIX . 'sessions WHERE nickname=? AND (status<=? OR status<=3) AND nickname NOT IN (SELECT ign FROM ' . PREFIX . 'ignored WHERE ignby=?);');
-		$stmt->execute([$_REQUEST['ignore'], $U['status'], $U['nickname']]);
+		$stmt=$db->prepare('SELECT * FROM ' . PREFIX . 'sessions WHERE nickname=? AND nickname NOT IN (SELECT ign FROM ' . PREFIX . 'ignored WHERE ignby=?);');
+		$stmt->execute([$_REQUEST['ignore'], $U['nickname']]);
 		if($U['nickname']!==$_REQUEST['ignore'] && $stmt->fetch(PDO::FETCH_NUM)){
 			$stmt=$db->prepare('INSERT INTO ' . PREFIX . 'ignored (ign, ignby) VALUES (?, ?);');
 			$stmt->execute([$_REQUEST['ignore'], $U['nickname']]);
@@ -2972,7 +2972,7 @@ function validate_input(){
 			$stmt->execute([$newmessage['postdate'], $id[0], $newmessage['poster'], $newmessage['recipient'], $newmessage['text']]);
 		}
 		if(isset($hash) && $id){
-			if(!empty($_FILES['file']['type'])){
+			if(!empty($_FILES['file']['type']) && preg_match('~^[a-z0-9/\-\.]*$~i', $_FILES['file']['type'])){
 				$type=$_FILES['file']['type'];
 			}else{
 				$type='application/octet-stream';