Nuke7.6, patched3.3, Web_Links and admin link bug

NoFantasy · Worker Joined: Apr 26, 2005 Posts: 114

Just in the middle of upgrading from 3.1 to 3.3 patched i discovered some really odd stuff happening with the Web_Links module. I'm done patching all core files and the BBtoNuke, so basically the site now runs on patched3.3 and BBtoNuke.21, just some modules still remains to be upgraded.

The problem seems to be this particular code found four places in the WebLinks index-file:

Code:

if ($row2a['radminsuper'] == 1 || $auth_user == 1) {
echo "<a href=\"".$admin_file.".php?op=LinksModLink&lid=$lid\">"._EDIT."</a> | ";
}

If i don't comment out the second line, the edit link will show to all users. What did i miss? Is it a bug or me forgot something during patching?

It looks like the code doesn't work at all...

evaders99 · Moderator Joined: Apr 30, 2004 Posts: 2749

It looks like a typo.. but it isn't.
It's reading from the admin query here

Code:

$row2a = $db->sql_fetchrow($db->sql_query("SELECT name, radminsuper FROM ".$prefix."_authors WHERE aid='$aid'"));

That looks correct

NoFantasy · Worker Joined: Apr 26, 2005 Posts: 114

...seems like using $row2a is the one...

Code:

$admin = base64_decode($admin);
$admin = addslashes($admin);
$admin = explode(":", $admin);
$aid = "$admin[0]";
$row = $db->sql_fetchrow($db->sql_query("SELECT title, admins FROM ".$prefix."_modules WHERE title='Web_Links'"));
$row2a = $db->sql_fetchrow($db->sql_query("SELECT name, radminsuper FROM ".$prefix."_authors WHERE aid='$aid'"));
$admins = explode(",", $row['admins']);
$auth_user = 0;
for ($i=0; $i < sizeof($admins); $i++) {
if ($row2a['name'] == "$admins[$i]" AND !empty($row['admins'])) {
$auth_user = 1;
}

This code is from the function viewlink in the 3.3patched index file

evaders99 · Moderator Joined: Apr 30, 2004 Posts: 2749

Sorry I looked at the code again and edited my post. It seems correct