[geeklog-devel] public_html/index.php

[Mark R. Evans]

Joe,

Look around line 176, $U is being set from a DB_fetchArray() call.  It 
couldn't hurt to initialize $U['aids'] and $U['tids'] to '' if it is an 
anonymous user.  $U['maxstories'] is already being initialized to 0 if 
anonymous.

Thanks!
Mark

Joe Mucchiello wrote:

> How long has this been broken? It's in 1.4.1 and 1.5:

>

> if (!empty($U['aids'])) {

>     $sql .= " AND s.uid NOT IN (" . str_replace( ' ', ",", $U['aids'] 

> ) . ") ";

> }

>

> if (!empty($U['tids'])) {

>     $sql .= " AND s.tid NOT IN ('" . str_replace( ' ', "','", 

> $U['tids'] ) . "') ";

> }

>

> $U has no global value that I'm aware up. It's even a register_globals 

> hole that could show hidden stories.

>

> I assume $U should be $_USER.

>

> ----

> Joe Mucchiello

> Throwing Dice Games

> http://www.throwingdice.com

> _______________________________________________

> geeklog-devel mailing list

> geeklog-devel at lists.geeklog.net

> http://eight.pairlist.net/mailman/listinfo/geeklog-devel