Solved Issue #9

admin/add.php

@@ -54,6 +54,17 @@ if ($user->isAdmin()) {
 			$_POST["url"] = $conf->urlGelato."/uploads/".$mp3Name;
 		}
 		
+		if (get_magic_quotes_gpc()) {
+			$_POST["title"] = htmlspecialchars(stripslashes($_POST["title"]));
+			$_POST["description"] = htmlspecialchars(stripslashes($_POST["description"]));
+		} else {
+			$_POST["title"] = htmlspecialchars($_POST["title"]);
+			$_POST["description"] = htmlspecialchars($_POST["description"]);
+		}
+		
+		$_POST["title"] = strip_tags($_POST["title"]);
+		$_POST["description"] = strip_tags($_POST["description"]);
+		
 		
 		if (isset($_POST["id_post"])) {
 			//$tumble->modifyPost($_POST, $_POST["id_post"]);

index.php

@@ -79,6 +79,7 @@
 			while($register = mysql_fetch_array($rs)) {			
 				$formatedDate = date("M d", strtotime($register["date"]));
 				$permalink = $conf->urlGelato."/index.php/post/".$register["id_post"]."/";
+				
 				switch ($tumble->getType($register["id_post"])) {
 					case "1":
 						$input = array("{Date_Added}", "{Permalink}", "{Title}", "{Body}", "{URL_Tumble}");
@@ -97,10 +98,10 @@
 							$photoPath = $register["url"];
 						}
 						
-						$effect = " onclick=\"Lightbox.show('".$register["url"]."', '".strip_tags(htmlentities($register["description"]))."');\" ";
+						$effect = " onclick=\"Lightbox.show('".$register["url"]."', '".strip_tags($register["description"])."');\" ";
 						
 						$input = array("{Date_Added}", "{Permalink}", "{PhotoURL}", "{PhotoAlt}", "{Caption}", "{Effect}", "{URL_Tumble}");
-						$output = array($formatedDate, $permalink, $photoPath, strip_tags(htmlentities($register["description"])), $register["description"], $effect, $conf->urlGelato);
+						$output = array($formatedDate, $permalink, $photoPath, strip_tags($register["description"]), $register["description"], $effect, $conf->urlGelato);
 						
 						$template->cargarPlantilla($input, $output, "template_photo");
 						$template->mostrarPlantilla();							   
@@ -172,10 +173,10 @@
 					$photoPath = $register["url"];
 				}
 				
-				$effect = " onclick=\"Lightbox.show('".$register["url"]."', '".strip_tags(htmlentities($register["description"]))."');\" ";
+				$effect = " onclick=\"Lightbox.show('".$register["url"]."', '".strip_tags($register["description"])."');\" ";
 						
 				$input = array("{Date_Added}", "{Permalink}", "{PhotoURL}", "{PhotoAlt}", "{Caption}", "{Effect}", "{URL_Tumble}");
-				$output = array($formatedDate, $permalink, $photoPath, strip_tags(htmlentities($register["description"])), $register["description"], $effect, $conf->urlGelato);
+				$output = array($formatedDate, $permalink, $photoPath, strip_tags($register["description"]), $register["description"], $effect, $conf->urlGelato);
 				
 				$template->cargarPlantilla($input, $output, "template_photo");
 				$template->mostrarPlantilla();