r61634 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:< r61633‎ | r61634 | r61635 >
Date:14:23, 28 January 2010
Author:raymond
Status:ok (Comments)
Tags:
Comment:
Add desc and right messages to i18n
Update extension credits
Run stylize.php
Modified paths:
  • /trunk/extensions/LastUserLogin/LastUserLogin.i18n.php (modified) (history)
  • /trunk/extensions/LastUserLogin/LastUserLogin.php (modified) (history)
  • /trunk/extensions/LastUserLogin/LastUserLogin_body.php (modified) (history)

Diff [purge]

Index: trunk/extensions/LastUserLogin/LastUserLogin.i18n.php
——@@ -15,11 +15,13 @@
1616 */
1717 $messages['en'] = array(
1818 'lastuserlogin' => 'Last user login',
 19+ 'lastuserlogin-desc' => 'Displays the last time a user logged in',
1920 'lastuserlogin_userid' => 'Username',
2021 'lastuserlogin_username' => 'Real name',
2122 'lastuserlogin_useremail' => 'User email',
2223 'lastuserlogin_lastlogin' => 'Last login',
2324 'lastuserlogin_daysago' => 'Days ago',
 25+ 'right-lastlogin' => 'View the last time a user logged in',
2426 );
2527
2628 /** German (Deutsch) */
Index: trunk/extensions/LastUserLogin/LastUserLogin.php
——@@ -4,7 +4,7 @@
55 *
66 * @file
77 * @ingroup Extensions
8 - * @version 1.2.0
 8+ * @version 1.2.1
99 * @author Justin G. Cramer
1010 * @author Danila Ulyanov
1111 * @author Thomas Klein
——@@ -26,24 +26,26 @@
2727 * http://www.gnu.org/copyleft/gpl.html
2828 */
2929
30 -if( !defined( 'MEDIAWIKI' ) ) {
 30+if ( !defined( 'MEDIAWIKI' ) ) {
3131 die();
3232 }
3333
3434 // Extension credits that will show up on Special:Version
3535 $wgExtensionCredits['specialpage'][] = array(
 36+ 'path' => __FILE__,
3637 'name' => 'LastUserLogin',
37 - 'version' => '1.2.0',
38 - 'author' => array('Justin G. Cramer', 'Danila Ulyanov', 'Thomas Klein'),
 38+ 'version' => '1.2.1',
 39+ 'author' => array( 'Justin G. Cramer', 'Danila Ulyanov', 'Thomas Klein' ),
 40+ 'url' => 'http://www.mediawiki.org/wiki/Extension:SpecialLastUserLoginEx',
3941 'description' => 'Displays the last time a user logged in',
40 - 'url' => 'http://www.mediawiki.org/wiki/Extension:SpecialLastUserLoginEx',
 42+ 'descriptionmsg' => 'lastuserlogin-desc',
4143 );
4244
4345 // New user right
4446 $wgAvailableRights[] = 'lastlogin';
4547
4648 // Set up the new special page
47 -$dir = dirname(__FILE__) . '/';
 49+$dir = dirname( __FILE__ ) . '/';
4850 $wgAutoloadClasses['LastUserLogin'] = $dir . 'LastUserLogin_body.php';
4951 $wgExtensionMessagesFiles['LastUserLogin'] = $dir . 'LastUserLogin.i18n.php';
5052 $wgSpecialPages['LastUserLogin'] = 'LastUserLogin';
——@@ -52,12 +54,12 @@
5355 $wgExtensionFunctions[] = 'wfUpdateUserTouched';
5456
5557 function wfUpdateUserTouched() {
56 - global $wgOut, $wgCookiePrefix;
 58+ global $wgOut, $wgCookiePrefix;
5759
58 - if( isset( $_COOKIE ) && isset( $_COOKIE["{$wgCookiePrefix}UserID"] ) ) {
 60+ if ( isset( $_COOKIE ) && isset( $_COOKIE["{$wgCookiePrefix}UserID"] ) ) {
5961 $dbw = wfGetDB( DB_MASTER );
60 - $query = "UPDATE ".$dbw->tableName('user')." SET user_touched = '".$dbw->timestamp()."' WHERE user_id = ".intval($_COOKIE["{$wgCookiePrefix}UserID"]);
61 - $dbw->doQuery($query);
 62+ $query = "UPDATE " . $dbw->tableName( 'user' ) . " SET user_touched = '" . $dbw->timestamp() . "' WHERE user_id = " . intval( $_COOKIE["{$wgCookiePrefix}UserID"] );
 63+ $dbw->doQuery( $query );
6264 }
6365 }
6466
Index: trunk/extensions/LastUserLogin/LastUserLogin_body.php
——@@ -1,5 +1,5 @@
22 <?php
3 -
 3+
44 class LastUserLogin extends SpecialPage {
55
66 /**
——@@ -31,7 +31,7 @@
3232 }
3333
3434 # If the user doesn't have the required 'lastlogin' permission, display an error
35 - if( !$wgUser->isAllowed( 'lastlogin' ) ) {
 35+ if ( !$wgUser->isAllowed( 'lastlogin' ) ) {
3636 $wgOut->permissionRequired( 'lastlogin' );
3737 return;
3838 }
——@@ -51,56 +51,56 @@
5252 );
5353
5454 // Get order by and check it
55 - if( isset( $_REQUEST['order_by'] ) ){
56 - if( isset( $fields[$_REQUEST['order_by']] ) ){
 55+ if ( isset( $_REQUEST['order_by'] ) ) {
 56+ if ( isset( $fields[$_REQUEST['order_by']] ) ) {
5757 $orderby = $_REQUEST['order_by'];
5858 } else {
5959 $orderby = 'user_name';
6060 }
6161 } else {
6262 $orderby = 'user_name';
63 - }
 63+ }
6464
6565 // Get order type and check it
66 - if( isset( $_REQUEST['order_type'] ) ){
67 - if( $_REQUEST['order_type'] == 'DESC' ){
 66+ if ( isset( $_REQUEST['order_type'] ) ) {
 67+ if ( $_REQUEST['order_type'] == 'DESC' ) {
6868 $ordertype = $_REQUEST['order_type'];
6969 } else {
7070 $ordertype = 'ASC';
7171 }
7272 } else {
7373 $ordertype = 'ASC';
74 - }
 74+ }
7575
76 - $query = "SELECT user_name, user_real_name, user_email, user_touched FROM ".$dbr->tableName('user')." ORDER BY ".$orderby." ".$ordertype;
 76+ $query = "SELECT user_name, user_real_name, user_email, user_touched FROM " . $dbr->tableName( 'user' ) . " ORDER BY " . $orderby . " " . $ordertype;
7777 $ordertype = $ordertype == 'ASC' ? 'DESC' : 'ASC';
7878
79 - if( $result = $dbr->doQuery($query) ) {
80 - $out = '<table width="100%" cellpadding="3" '.$style.'><tr>';
 79+ if ( $result = $dbr->doQuery( $query ) ) {
 80+ $out = '<table width="100%" cellpadding="3" ' . $style . '><tr>';
8181
82 - foreach( $fields as $key => $value ){
83 - $out .= '<th '.$style.'><a href="?order_by='.$key.'&order_type='.$ordertype.'">'.wfMsg( $value ).'</a></th>';
 82+ foreach ( $fields as $key => $value ) {
 83+ $out .= '<th ' . $style . '><a href="?order_by=' . $key . '&order_type=' . $ordertype . '">' . wfMsg( $value ) . '</a></th>';
8484 }
8585
86 - $out .= "<th $style>".wfMsg( 'lastuserlogin_daysago' )."</th>";
 86+ $out .= "<th $style>" . wfMsg( 'lastuserlogin_daysago' ) . "</th>";
8787 $out .= '</tr>';
8888
89 - while( $row = $dbr->fetchRow($result) ) {
 89+ while ( $row = $dbr->fetchRow( $result ) ) {
9090 $out .= '<tr>';
91 - foreach( $fields as $key => $value ){
 91+ foreach ( $fields as $key => $value ) {
9292
93 - if( $key == 'user_touched' ) {
 93+ if ( $key == 'user_touched' ) {
9494 $style = 'style="border:1px solid #000"';
95 - $out .= "<td $style>".$wgLang->timeanddate( wfTimestamp( TS_MW, $row[$key] ), true ).
96 - '</td><td style="border: 1px solid #000; text-align:right;">'.
97 - $wgLang->formatNum( round( ( mktime() - wfTimestamp( TS_UNIX, $row[$key] ) ) /3600/24, 2 ), 2 )."</td>";
 95+ $out .= "<td $style>" . $wgLang->timeanddate( wfTimestamp( TS_MW, $row[$key] ), true ) .
 96+ '</td><td style="border: 1px solid #000; text-align:right;">' .
 97+ $wgLang->formatNum( round( ( mktime() - wfTimestamp( TS_UNIX, $row[$key] ) ) / 3600 / 24, 2 ), 2 ) . "</td>";
9898 } else {
99 - if( $key == 'user_name' ) {
 99+ if ( $key == 'user_name' ) {
100100 $userPage = Title::makeTitle( NS_USER, htmlspecialchars( $row[$key] ) );
101101 $name = $skin->makeLinkObj( $userPage, htmlspecialchars( $userPage->getText() ) );
102 - $out .= '<td '.$style.'>'.$name.'</a></td>';
103 - } else {
104 - $out .= '<td '.$style.'>'.htmlspecialchars($row[$key]).'&nbsp;</td>';
 102+ $out .= '<td ' . $style . '>' . $name . '</a></td>';
 103+ } else {
 104+ $out .= '<td ' . $style . '>' . htmlspecialchars( $row[$key] ) . '&nbsp;</td>';
105105 }
106106 }
107107 }

Comments

#Comment by Platonides (talk | contribs)   15:05, 28 January 2010

SQL injection on $_REQUEST['order_by']

#Comment by Platonides (talk | contribs)   15:45, 28 January 2010

Not really. It check that it belong to $fields.

Status & tagging log