Be more paranoid with param in list context

[ndwebbie.git] / lib / NDWeb / Controller / Members.pm

diff --git a/lib/NDWeb/Controller/Members.pm b/lib/NDWeb/Controller/Members.pm
index 19f7a2d128d784baefc8697a24310df0ff0d450d..6afbb6511d058b02ad5511d087b890515388ea9e 100644 (file)
--- a/lib/NDWeb/Controller/Members.pm
+++ b/lib/NDWeb/Controller/Members.pm
@@ -78,7 +78,7 @@ ORDER BY landing_tick DESC
                        LEFT OUTER JOIN (SELECT * FROM forum_thread_visits WHERE uid = $1) ftv ON ftv.ftid = ft.ftid
                WHERE ft.fbid = 1
                GROUP BY ft.ftid, ft.subject,ft.sticky,u.username
-               HAVING count(NULLIF(COALESCE(ft.sticky OR fp.time > ftv.time,TRUE),FALSE)) >= 1
+               HAVING count(NULLIF(COALESCE(fp.time > ftv.time,TRUE),FALSE)) >= 1
                ORDER BY sticky DESC,last_post DESC
                });
        $announcements->execute($c->user->id);
@@ -95,8 +95,9 @@ sub posthostupdate : Local {
        my ( $self, $c ) = @_;
        my $dbh = $c->model;
 
+       my $hostname = html_escape $c->req->param('hostname');
        $dbh->do(q{UPDATE users SET hostmask = ? WHERE uid = ?
-               },undef, html_escape $c->req->param('hostname'), $c->user->id);
+               },undef, $hostname, $c->user->id);
 
        $c->res->redirect($c->uri_for(''));
 }
@@ -123,10 +124,11 @@ sub postsmsupdate : Local {
        my $dbh = $c->model;
 
        my $callme = $c->req->param('callme') || 0;
+       my $sms = html_escape $c->req->param('sms');
+       my $smsnote = $c->req->param('smsnote');
        $dbh->do(q{
 UPDATE users SET sms = $1, call_if_needed =  $2, sms_note = $3 WHERE uid = $4
-               },undef, html_escape $c->req->param('sms'),$callme
-               ,$c->req->param('smsnote'), $c->user->id);
+               },undef, $sms, $callme, $smsnote, $c->user->id);
 
        $c->res->redirect($c->uri_for(''));
 }
@@ -160,10 +162,11 @@ sub postowncoords : Local {
                        $c->flash(error => "No planet at coords: $x:$y:$z");
                }
        }else{
-               $c->flash(error => $c->req->param('planet') . " are not valid coords.");
+               my $error = $c->req->param('planet') . " are not valid coords.";
+               $c->flash(error => $error);
        }
 
-       $c->res->redirect($c->uri_for(''));
+       $c->res->redirect($c->uri_for('/'.$c->session->{referrer}));
 }
 
 sub postfleetsupdates : Local {
@@ -215,17 +218,19 @@ sub postircrequest : Local {
        my ( $self, $c ) = @_;
        my $dbh = $c->model;
 
+       my $message = $c->req->param('message');
        if ($c->req->param('channel')){
                my $query = $dbh->prepare(q{
 INSERT INTO irc_requests (uid,channel,message) VALUES($1,$2,$3)
                });
-               $query->execute($c->user->id,$c->req->param('channel'),$c->req->param('message'));
+               my $channel = $c->user->id,$c->req->param('channel');
+               $query->execute($channel, $message);
                $c->signal_bots;
 
-               $c->flash(reply => "Msg sent to: ".$c->req->param('channel'));
+               $c->flash(reply => "Msg sent to: ".$channel);
                $c->res->redirect($c->uri_for('ircrequest'));
        }else{
-               $c->stash(ircmessage => $c->req->param('message'));
+               $c->stash(ircmessage => $message);
                $c->go('ircrequest');
        }
 }
@@ -327,7 +332,8 @@ sub postintelmessage : Local {
 SELECT coords(x,y,z), tick() FROM current_planet_stats WHERE pid = $1
                }, undef, $c->user->planet);
 
-       $c->req->param(message => "[i]Posted by $coords at tick $tick [/i]\n\n" . $c->req->param('message'));
+       my $message = "[i]Posted by $coords at tick $tick [/i]\n\n" . $c->req->param('message');
+       $c->req->param(message => $message);
        $c->forward('/forum/insertThread',[12]);
        $c->forward('/forum/insertPost',[$c->stash->{thread}]);
        $c->flash(intelmessage => 1);
@@ -353,7 +359,7 @@ sub insertintel : Private {
                });
        my @scans;
        my $intel = $c->req->param('message');
-       while ($intel =~ m{http://[\w.]+/.+?scan(_id|_grp)?=(\w+)}g){
+       while ($intel =~ m{https?://[\w.]+/.+?scan(_id|_grp)?=(\w+)}g){
                my $groupscan = (defined $1 && $1 eq '_grp') || 0;
                my %scan;
                $scan{id} = $2;
@@ -507,7 +513,8 @@ WHERE uid = $1 AND num = $2 AND back > tick()
                my $fullfleet = $dbh->prepare(q{INSERT INTO full_fleets
                                        (fid,uid) VALUES (?,?)});
                $dbh->begin_work;
-               my @missions = parseconfirmations($c->req->param('mission'), $c->stash->{TICK});
+               my $mission = $c->req->param('mission');
+               my @missions = parseconfirmations($mission, $c->stash->{TICK});
                for my $m (@missions){
                        if ($m->{mission} eq 'Return'){
                                $c->forward("addReturnFleet", [$m]);
@@ -595,7 +602,7 @@ sub parseconfirmations {
                |$returnetare)\s*/x;
        my $missre = qr/((?:Alliance\ Standby)|(?:(?:Fake\ )?\w+))\s*/x;
        if ($missions =~ m/
-               Ships \s+ Cla \s+ T\s?1 \s+ T\s?2 \s+ T\s?3 \s+ Base \s+ \(i\) \s (?<name>.+?) \s+ \(i\) \s+ (?<name>.+?) \s+ \(i\) \s+ (?<name>.+?) \s+ \(i\) \s+ TOTAL \s+
+               Ships \s+ Cla \s+ T\s?1 \s+ T\s?2 \s+ T\s?3 \s+ ETA \s+ Base \s+ \(i\) \s (?<name>.+?) \s+ \(i\) \s+ (?<name>.+?) \s+ \(i\) \s+ (?<name>.+?) \s+ \(i\) \s+ TOTAL \s+
                (?<ships>.+?)
                \QTotal Ships in Fleet\E \s+ (\d+) \s+ (?<amount>\d+) \s+ (?<amount>\d+) \s+ (?<amount>\d+) \s+
                Mission: \s* (?<missions>(?:$missre)*)  \s*
@@ -607,7 +614,7 @@ sub parseconfirmations {
                my @targets = split /\s+/, $+{targets};
                my @lts = split /\s+/, $+{lts};
                my @etas;
-               my $_ = $+{etas};
+               local $_ = $+{etas};
                while(/$etare/sxg){
                        push @etas, $1;
                }
@@ -664,7 +671,7 @@ sub parseconfirmations {
                        amount => 0,
                        ships => []
                };
-               while ($match{ships}->[0] =~ m/(\w[ \w]+?)\s+(FI|CO|FR|DE|CR|BS)[^\d]+((?:\d+\s*){5})/g){
+               while ($match{ships}->[0] =~ m/(\w[ \w]+?)\s+(FI|CO|FR|DE|CR|BS|--)[^\d]+\d+\s+((?:\d+\s*){5})/g){
                        my $ship = $1;
                        my @amounts = split /\D+/, $3;
                        my $base = shift @amounts;