X-Git-Url: https://git.pterodactylus.net/?a=blobdiff_plain;f=src%2Fhttp%2Fpages%2Fboardspage.cpp;h=e9cc2a3549ef7426542bcd082edf19d992cb06d1;hb=fcb124f8d6d3f5678e82049fb8e5e23c8cfaec6d;hp=4adab89bd6fe0f3f4f14e1b8bbd005188aeeda94;hpb=107bd97018964d48425306026d06afd038e84db0;p=fms.git

diff --git a/src/http/pages/boardspage.cpp b/src/http/pages/boardspage.cpp
index 4adab89..e9cc2a3 100644
--- a/src/http/pages/boardspage.cpp
+++ b/src/http/pages/boardspage.cpp
@@ -1,6 +1,8 @@
 #include "../../../include/http/pages/boardspage.h"
 #include "../../../include/stringfunctions.h"
-#include "../../../include/datetime.h"
+
+#include <Poco/DateTime.h>
+#include <Poco/DateTimeFormatter.h>
 
 #ifdef XMEM
 	#include <xmem.h>
@@ -41,12 +43,11 @@ const std::string BoardsPage::GeneratePage(const std::string &method, const std:
 	std::string startrowstr="0";
 	std::string boardsearch="";
 	std::string sql="";
-	DateTime now;
-	now.SetToGMTime();
+	Poco::DateTime now;
 
 	if(queryvars.find("formaction")!=queryvars.end())
 	{
-		if((*queryvars.find("formaction")).second=="addboard" && queryvars.find("boardname")!=queryvars.end() && queryvars.find("boarddescription")!=queryvars.end())
+		if((*queryvars.find("formaction")).second=="addboard" && queryvars.find("boardname")!=queryvars.end() && queryvars.find("boarddescription")!=queryvars.end() && ValidateFormPassword(queryvars))
 		{
 			std::string boardname="";
 			std::string boarddescription="";
@@ -58,15 +59,15 @@ const std::string BoardsPage::GeneratePage(const std::string &method, const std:
 			SQLite3DB::Statement addst=m_db->Prepare("INSERT INTO tblBoard(BoardName,BoardDescription,DateAdded,AddedMethod) VALUES(?,?,?,?);");
 			addst.Bind(0,boardname);
 			addst.Bind(1,boarddescription);
-			addst.Bind(2,now.Format("%Y-%m-%d %H:%M:%S"));
+			addst.Bind(2,Poco::DateTimeFormatter::format(now,"%Y-%m-%d %H:%M:%S"));
 			addst.Bind(3,"Added manually");
 			addst.Step();
 		}
-		if((*queryvars.find("formaction")).second=="remove0messages")
+		if((*queryvars.find("formaction")).second=="remove0messages" && ValidateFormPassword(queryvars))
 		{
 			m_db->Execute("DELETE FROM tblBoard WHERE BoardID IN (SELECT BoardID FROM vwBoardStats WHERE MessageCount=0 AND BoardID NOT IN (SELECT BoardID FROM tblAdministrationBoard));");
 		}
-		if((*queryvars.find("formaction")).second=="update")
+		if((*queryvars.find("formaction")).second=="update" && ValidateFormPassword(queryvars))
 		{
 			int boardid;
 			std::vector<std::string> boardids;
@@ -173,21 +174,21 @@ const std::string BoardsPage::GeneratePage(const std::string &method, const std:
 
 	content+="<tr>";
 	content+="<td colspan=\"3\"><center>";
-	content+="<form name=\"frmboardsearch\" action=\"boards.htm\" method=\"POST\"><input type=\"text\" name=\"boardsearch\" value=\""+SanitizeOutput(boardsearch)+"\"><input type=\"submit\" value=\"Search\"></form>";
+	content+="<form name=\"frmboardsearch\" action=\"boards.htm\" method=\"POST\"><input type=\"text\" name=\"boardsearch\" value=\""+SanitizeOutput(boardsearch)+"\">"+CreateFormPassword()+"<input type=\"submit\" value=\"Search\"></form>";
 	content+="</center></td>";
 	content+="</tr>";
 
 	content+="<tr>";
 	content+="<td colspan=\"3\"><center>";
-	content+="<form name=\"frmremoveboard\" action=\"boards.htm\" method=\"POST\"><input type=\"hidden\" name=\"formaction\" value=\"remove0messages\">Remove boards with 0 messages<input type=\"submit\" value=\"Remove\"></form>";
+	content+="<form name=\"frmremoveboard\" action=\"boards.htm\" method=\"POST\">"+CreateFormPassword()+"<input type=\"hidden\" name=\"formaction\" value=\"remove0messages\">Remove boards with 0 messages<input type=\"submit\" value=\"Remove\"></form>";
 	content+="</center></td>";
 	content+="</tr>";
 
 	content+="<tr>";
-	content+="<td><form name=\"frmaddboard\" method=\"POST\"><input type=\"hidden\" name=\"formaction\" value=\"addboard\"><input type=\"text\" name=\"boardname\"></td><td><input type=\"text\" name=\"boarddescription\" size=\"40\" maxlength=\"50\"></td><td><input type=\"submit\" value=\"Add Board\"></form></td>";
+	content+="<td><form name=\"frmaddboard\" method=\"POST\">"+CreateFormPassword()+"<input type=\"hidden\" name=\"formaction\" value=\"addboard\"><input type=\"text\" name=\"boardname\"></td><td><input type=\"text\" name=\"boarddescription\" size=\"40\" maxlength=\"50\"></td><td><input type=\"submit\" value=\"Add Board\"></form></td>";
 	content+="</tr>";
 
-	content+="<tr><td colspan=\"4\"><hr><form name=\"frmboards\" method=\"POST\"><input type=\"hidden\" name=\"formaction\" value=\"update\"></td></tr>";
+	content+="<tr><td colspan=\"4\"><hr><form name=\"frmboards\" method=\"POST\"><input type=\"hidden\" name=\"formaction\" value=\"update\">"+CreateFormPassword()+"</td></tr>";
 	content+="<tr>";
 	content+="<th>Name</th><th>Description</th><th>Save Received Messages *</th><th>Added Method</th>";
 	content+="</tr>";	
@@ -257,10 +258,10 @@ const std::string BoardsPage::GeneratePage(const std::string &method, const std:
 	content+="</tr>";
 	content+="</table>";
 	content+="<p class=\"paragraph\">";
-	content+="* If you uncheck this box, any new messages you download that are posted to this board will be discarded.";
+	content+="* If you uncheck this box, any new messages you download that are posted to this board will be discarded.  When multiple local identities are used, it is best not to discard messages from any boards, as identifying which identities are the same person is much easier when their message lists are missing messages from the same boards.";
 	content+="</p>";
 
-	return "HTTP/1.1 200 OK\r\nContent-Type: text/html\r\n\r\n"+StringFunctions::Replace(m_template,"[CONTENT]",content);
+	return StringFunctions::Replace(m_template,"[CONTENT]",content);
 }
 
 const bool BoardsPage::WillHandleURI(const std::string &uri)