* First set of patches from SMF 2.0.7. As this one is quite large, I'…

…m slower to update. Some stuff is outdated and doesn't need to be applied. Some is for Postgresql compatibility, but it doesn't hurt MySQL so whatever, I'm applying it. Finally, many things are fixes taken by Mr. A from Wedge, applied to SMF, and that are trying to make their way back into Wedge. It gets kinda confusing. (index.php, SSI.php, Profile-Modify.php, Register.php, ScheduledTasks.php, Search2.php)

! A security fix from SMF 2.0.3 wasn't applied by said Mr. A back when he was in charge of back-porting SMF patches, so... Did I tell you it was getting confused? Because I'm confused. (SSI.php)

SSI.php

@@ -284,11 +284,11 @@ function ssi_fetchPosts($post_ids, $override_permissions = false, $output_method
 	);
 
 	// Then make the query and dump the data.
-	return ssi_queryPosts($query_where, $query_where_params, '', 'm.id_msg DESC', $output_method);
+	return ssi_queryPosts($query_where, $query_where_params, '', 'm.id_msg DESC', $output_method, false, $override_permissions);
 }
 
 // This removes code duplication in other queries - don't call it direct unless you really know what you're up to.
-function ssi_queryPosts($query_where = '', $query_where_params = array(), $query_limit = '', $query_order = 'm.id_msg DESC', $output_method = 'echo', $limit_body = false)
+function ssi_queryPosts($query_where = '', $query_where_params = array(), $query_limit = 10, $query_order = 'm.id_msg DESC', $output_method = 'echo', $limit_body = false, $override_permissions = false)
 {
 	global $txt;
 
@@ -304,11 +304,15 @@ function ssi_queryPosts($query_where = '', $query_where_params = array(), $query
 			LEFT JOIN {db_prefix}members AS mem ON (mem.id_member = m.id_member)' . (we::$is_member ? '
 			LEFT JOIN {db_prefix}log_topics AS lt ON (lt.id_topic = m.id_topic AND lt.id_member = {int:current_member})
 			LEFT JOIN {db_prefix}log_mark_read AS lmr ON (lmr.id_board = m.id_board AND lmr.id_member = {int:current_member})' : '') . '
-		' . (empty($query_where) ? 'WHERE {query_wanna_see_board}' : 'WHERE ' . $query_where) . '
+		WHERE 1=1 ' . ($override_permissions ? '' : '
+			AND {query_wanna_see_board}') . ($settings['postmod_active'] ? '
+			AND m.approved = {int:is_approved}' : '') . '
+			' . (empty($query_where) ? '' : 'AND ' . $query_where) . '
 		ORDER BY ' . $query_order . '
 		' . ($query_limit == '' ? '' : 'LIMIT ' . $query_limit),
 		array_merge($query_where_params, array(
 			'current_member' => MID,
+			'is_approved' => 1,
 		))
 	);
 	$posts = array();
@@ -812,7 +816,7 @@ function ssi_fetchGroupMembers($group_id, $output_method = 'echo')
 	$query_where = '
 		id_group = {int:id_group}
 		OR id_post_group = {int:id_group}
-		OR FIND_IN_SET({int:id_group}, additional_groups)';
+		OR FIND_IN_SET({int:id_group}, additional_groups) != 0';
 
 	$query_where_params = array(
 		'id_group' => $group_id,
@@ -1505,7 +1509,7 @@ function ssi_boardNews($id_board = null, $limit = null, $start = null, $length =
 		SELECT id_board
 		FROM {db_prefix}boards
 		WHERE ' . ($id_board === null ? '' : 'id_board = {int:current_board}
-			AND ') . 'FIND_IN_SET(-1, member_groups)
+			AND ') . 'FIND_IN_SET(-1, member_groups) != 0
 		LIMIT 1',
 		array(
 			'current_board' => $id_board,

core/app/Profile-Modify.php

@@ -1155,7 +1155,7 @@ function makeCustomFieldChanges($memID, $area, $sanitize = true)
 				{
 					$value = (int) $value;
 				}
-				elseif (substr($row['mask'], 0, 5) == 'regex' && preg_match(substr($row['mask'], 5), $value) === 0)
+				elseif (substr($row['mask'], 0, 5) == 'regex' && trim($value) != '' && preg_match(substr($row['mask'], 5), $value) === 0)
 					$value = '';
 			}
 		}

core/app/Register.php

@@ -423,7 +423,7 @@ function Register2()
 					$custom_field_errors[] = array('custom_field_invalid_email', array($row['field_name']));
 				elseif ($row['mask'] == 'number' && preg_match('~[^\d]~', $value))
 					$custom_field_errors[] = array('custom_field_not_number', array($row['field_name']));
-				elseif (substr($row['mask'], 0, 5) == 'regex' && preg_match(substr($row['mask'], 5), $value) === 0)
+				elseif (substr($row['mask'], 0, 5) == 'regex' && trim($value) != '' && preg_match(substr($row['mask'], 5), $value) === 0)
 					$custom_field_errors[] = array('custom_field_inproper_format', array($row['field_name']));
 			}
 		}

core/app/ScheduledTasks.php

@@ -1311,9 +1311,13 @@ function scheduled_weekly_maintenance()
 			$result = wesql::query('
 				SELECT id_report
 				FROM {db_prefix}log_reported
-				WHERE time_started < {int:time_started}',
+				WHERE time_started < {int:time_started}
+					AND closed = {int:not_closed}
+					AND ignore_all = {int:not_ignored}',
 				array(
 					'time_started' => $t,
+					'not_closed' => 0,
+					'not_ignored' => 0,
 				)
 			);
 

core/app/Search2.php

@@ -968,7 +968,7 @@ function Search2()
 						CREATE TEMPORARY TABLE {db_prefix}tmp_log_search_topics (
 							id_topic mediumint(8) unsigned NOT NULL default {string:string_zero},
 							PRIMARY KEY (id_topic)
-						) TYPE=HEAP',
+						) ENGINE=MEMORY',
 						array(
 							'string_zero' => '0',
 							'db_error_skip' => true,
@@ -1128,7 +1128,7 @@ function Search2()
 						CREATE TEMPORARY TABLE {db_prefix}tmp_log_search_messages (
 							id_msg int(10) unsigned NOT NULL default {string:string_zero},
 							PRIMARY KEY (id_msg)
-						) TYPE=HEAP',
+						) ENGINE=MEMORY',
 						array(
 							'string_zero' => '0',
 							'db_error_skip' => true,

index.php

@@ -206,8 +206,8 @@
 	}
 
 	// Basic protection against XSS.
+	header('X-XSS-Protection: 1');
 	header('X-Frame-Options: SAMEORIGIN');
-	header('X-XSS-Protection: 1; mode=block');
 	header('X-Content-Type-Options: nosniff');
 }