From 61f52e29ab71a591f5e9ee566127a6c9d0dab9d4 Mon Sep 17 00:00:00 2001
From: pecesama <pecesama@gmail.com>
Date: Sat, 28 Apr 2007 00:06:12 +0000
Subject: [PATCH] Solved Issue #9

---
 admin/add.php | 11 +++++++++++
 index.php     |  9 +++++----
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/admin/add.php b/admin/add.php
index 54b03bb..babc10d 100644
--- a/admin/add.php
+++ b/admin/add.php
@@ -54,6 +54,17 @@ if ($user->isAdmin()) {
 			$_POST["url"] = $conf->urlGelato."/uploads/".$mp3Name;
 		}
 		
+		if (get_magic_quotes_gpc()) {
+			$_POST["title"] = htmlspecialchars(stripslashes($_POST["title"]));
+			$_POST["description"] = htmlspecialchars(stripslashes($_POST["description"]));
+		} else {
+			$_POST["title"] = htmlspecialchars($_POST["title"]);
+			$_POST["description"] = htmlspecialchars($_POST["description"]);
+		}
+		
+		$_POST["title"] = strip_tags($_POST["title"]);
+		$_POST["description"] = strip_tags($_POST["description"]);
+		
 		
 		if (isset($_POST["id_post"])) {
 			//$tumble->modifyPost($_POST, $_POST["id_post"]);
diff --git a/index.php b/index.php
index 836e79c..eb4ce10 100644
--- a/index.php
+++ b/index.php
@@ -79,6 +79,7 @@
 			while($register = mysql_fetch_array($rs)) {			
 				$formatedDate = date("M d", strtotime($register["date"]));
 				$permalink = $conf->urlGelato."/index.php/post/".$register["id_post"]."/";
+				
 				switch ($tumble->getType($register["id_post"])) {
 					case "1":
 						$input = array("{Date_Added}", "{Permalink}", "{Title}", "{Body}", "{URL_Tumble}");
@@ -97,10 +98,10 @@
 							$photoPath = $register["url"];
 						}
 						
-						$effect = " onclick=\"Lightbox.show('".$register["url"]."', '".strip_tags(htmlentities($register["description"]))."');\" ";
+						$effect = " onclick=\"Lightbox.show('".$register["url"]."', '".strip_tags($register["description"])."');\" ";
 						
 						$input = array("{Date_Added}", "{Permalink}", "{PhotoURL}", "{PhotoAlt}", "{Caption}", "{Effect}", "{URL_Tumble}");
-						$output = array($formatedDate, $permalink, $photoPath, strip_tags(htmlentities($register["description"])), $register["description"], $effect, $conf->urlGelato);
+						$output = array($formatedDate, $permalink, $photoPath, strip_tags($register["description"]), $register["description"], $effect, $conf->urlGelato);
 						
 						$template->cargarPlantilla($input, $output, "template_photo");
 						$template->mostrarPlantilla();							   
@@ -172,10 +173,10 @@
 					$photoPath = $register["url"];
 				}
 				
-				$effect = " onclick=\"Lightbox.show('".$register["url"]."', '".strip_tags(htmlentities($register["description"]))."');\" ";
+				$effect = " onclick=\"Lightbox.show('".$register["url"]."', '".strip_tags($register["description"])."');\" ";
 						
 				$input = array("{Date_Added}", "{Permalink}", "{PhotoURL}", "{PhotoAlt}", "{Caption}", "{Effect}", "{URL_Tumble}");
-				$output = array($formatedDate, $permalink, $photoPath, strip_tags(htmlentities($register["description"])), $register["description"], $effect, $conf->urlGelato);
+				$output = array($formatedDate, $permalink, $photoPath, strip_tags($register["description"]), $register["description"], $effect, $conf->urlGelato);
 				
 				$template->cargarPlantilla($input, $output, "template_photo");
 				$template->mostrarPlantilla();