Be more paranoid with param in list context

[ndwebbie.git] / lib / NDWeb / Controller / Forum.pm

diff --git a/lib/NDWeb/Controller/Forum.pm b/lib/NDWeb/Controller/Forum.pm
index caeeb1cf99ca03e6f24a51ebac2d5fe26e5c82dc..a0cb01ac4369b824446d8f8883d4527c9408396b 100644 (file)
--- a/lib/NDWeb/Controller/Forum.pm
+++ b/lib/NDWeb/Controller/Forum.pm
@@ -73,7 +73,8 @@ FROM forum_categories fc
        JOIN users u ON u.uid = ft.uid
        LEFT OUTER JOIN (SELECT * FROM forum_thread_visits WHERE uid = $1)
                ftv ON ftv.ftid = ft.ftid
-WHERE COALESCE(ft.mtime > ftv.time,TRUE)
+WHERE ft.mtime > NOW() - '50 days'::interval
+       AND COALESCE(ft.mtime > ftv.time,TRUE)
        AND ft.ftid IN (SELECT ftid FROM forum_posts WHERE ftid = ft.ftid)
        AND ((fbid > 0 AND
                        fb.fbid IN (SELECT fbid FROM forum_access WHERE gid IN (SELECT groups($1))))
@@ -232,7 +233,7 @@ sub findPosts :Private {
        my $dbh = $c->model;
 
        my $posts = $dbh->prepare(q{
-               SELECT u.uid,u.username,date_trunc('seconds',fp.time::timestamp) AS time
+               SELECT fpid,u.uid,u.username,date_trunc('seconds',fp.time::timestamp) AS time
                        ,fp.message,COALESCE(fp.time > ftv.time,TRUE) AS unread
                FROM forum_threads ft
                        JOIN forum_posts fp USING (ftid)
@@ -294,11 +295,42 @@ sub markThreadAsRead : Private {
        }
 }
 
+sub markThreadAsUnread : Local {
+       my ( $self, $c, $thread ) = @_;
+       my $dbh = $c->model;
+
+       my ($fbid) = $dbh->selectrow_array(q{
+SELECT fbid FROM forum_threads WHERE ftid = $1
+               },undef, $thread);
+
+       $dbh->do(q{
+DELETE FROM forum_thread_visits WHERE uid = $1 AND ftid = $2
+               }, undef, $c->user->id, $thread);
+       $c->res->redirect($c->uri_for('board',$fbid));
+}
+
+sub markPostAsUnread : Local {
+       my ( $self, $c, $post ) = @_;
+       my $dbh = $c->model;
+
+       my ($fbid) = $dbh->selectrow_array(q{
+SELECT fbid FROM forum_threads JOIN forum_posts USING (ftid) WHERE fpid = $1
+               },undef, $post);
+
+       $dbh->do(q{
+UPDATE forum_thread_visits ftv SET time = (fp.time - interval '1 second')
+FROM forum_posts fp
+WHERE ftv.uid = $1 AND fp.fpid = $2 AND fp.ftid = ftv.ftid
+               }, undef, $c->user->id, $post);
+       $c->res->redirect($c->uri_for('board',$fbid));
+}
+
 sub moveThreads : Local {
        my ( $self, $c, $board ) = @_;
        my $dbh = $c->model;
 
-       $c->forward('findBoard',[$c->req->param('board')]);
+       my $b = $c->req->param('board');
+       $c->forward('findBoard',[$b]);
        my $toboard = $c->stash->{board};
        unless ($toboard->{moderate}){
                $c->acl_access_denied('test',$c->action,'No moderator access for target board.')
@@ -350,10 +382,11 @@ sub insertThread : Private {
        my ( $self, $c, $board ) = @_;
        my $dbh = $c->model;
 
+       my $subject = html_escape($c->req->param('subject'));
        my $insert = $dbh->prepare(q{INSERT INTO forum_threads (ftid,fbid,subject,uid)
                VALUES(DEFAULT,$1,$2,$3) RETURNING (ftid);
                });
-       $insert->execute($board,html_escape($c->req->param('subject')),$c->stash->{UID});
+       $insert->execute($board,$subject,$c->stash->{UID});
        $c->stash(thread => $insert->fetchrow);
        $insert->finish;
 }
@@ -487,8 +520,8 @@ sub findThread : Private {
                FROM forum_boards fb
                        NATURAL JOIN forum_threads ft
                        NATURAL JOIN forum_categories fc
-                       LEFT OUTER JOIN (SELECT * FROM forum_access
-                               WHERE gid IN (SELECT groups($2))
+                       LEFT OUTER JOIN (SELECT fa.* FROM forum_access fa
+                               JOIN (SELECT groups($2) AS gid) g USING (gid)
                        ) fa USING (fbid)
                WHERE ft.ftid = $1 AND (fa.post IS NOT NULL
                        OR ft.ftid IN (SELECT ftid FROM forum_priv_access WHERE uid = $2))
@@ -518,21 +551,23 @@ sub findBoard : Private {
 
 sub previewPost : Private {
        my ( $self, $c) = @_;
+       my $message = html_escape $c->req->param('message');
        push @{$c->stash->{posts}}, {
                unread => 1,
                username => 'PREVIEW',
-               message => parseMarkup(html_escape $c->req->param('message')),
+               message => parseMarkup($message),
        };
-       $c->stash(previewMessage => html_escape $c->req->param('message'));
+       $c->stash(previewMessage => $message);
 }
 
 sub insertPost : Private {
        my ( $self, $c, $thread ) = @_;
        my $dbh = $c->model;
 
+       my $message = html_escape($c->req->param('message'));
        my $insert = $dbh->prepare(q{INSERT INTO forum_posts (ftid,message,uid)
                VALUES($1,$2,$3)});
-       $insert->execute($thread,html_escape($c->req->param('message')),$c->stash->{UID});
+       $insert->execute($thread,$message,$c->stash->{UID});
 }
 
 sub listModeratorBoards : Private {