From d50e13974902ba1adc176df351028baba84cbb44 Mon Sep 17 00:00:00 2001
From: Oliver <github@raduner.ch>
Date: Tue, 16 Jan 2024 22:31:48 +0100
Subject: [PATCH 01/10] Resolves Bug 690

---
 www/includes/forum.inc.php | 68 +++++++++++++++++++-------------------
 1 file changed, 34 insertions(+), 34 deletions(-)

diff --git a/www/includes/forum.inc.php b/www/includes/forum.inc.php
index 75ee2e8..b51b779 100644
--- a/www/includes/forum.inc.php
+++ b/www/includes/forum.inc.php
@@ -1075,27 +1075,33 @@ static function getBoardTitle($board)
 	/**
 	 * Form for editing posts
 	 *
-	 * @return String
+	 * // TODO merge Forum::getFormEdit() into /templates/layout/partials/commentform.tpl
+	 *
+	 * @version 2.1
+	 * @since 1.0 Method added
+	 * @since 2.0 `IneX` Code adjustements
+	 * @since 2.1 `16.01.2024` `IneX` Bug #690 : Delete & Update Buttons Seite wechseln
+	 *
 	 * @param int $comment_id
+	 * @return string
 	 *
-	 * @TODO merge Forum::getFormEdit() into /templates/layout/partials/commentform.tpl
 	 */
 	static function getFormEdit($comment_id) {
-	  global $db, $user;
+	  global $user;
 
-	  if(!is_numeric($comment_id)) user_error( t('invalid-comment_id', 'commenting'), E_USER_WARNING);
+	  if(!is_numeric($comment_id) || $comment_id<=0) user_error( t('invalid-comment_id', 'commenting'), E_USER_WARNING);
+	  $passedBase64encodedUrl = filter_input(INPUT_GET, 'url', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR) ?? '/forum.php'.$comment_id;
 
 	  $rs = Comment::getRecordset($comment_id);
 
-	  $html = '
-	  	<br>
+	  $html = '<br>
 	    <a name="edit"></a><h2>Comment #'.$comment_id.' bearbeiten</h2>
 	    <form name="commentform" action="/actions/comment_edit.php" method="post">
 	    <input type="hidden" name="action" value="update">
-	  	<input type="hidden" name="url" value="'.$_GET['url'].'">
-	  	<input name="thread_id" type="hidden" value="'.$rs['thread_id'].'">
+	  	<input type="hidden" name="url" value="'.$passedBase64encodedUrl.'">
+	  	<input name="thread_id" type="hidden" value="'.intval($rs['thread_id']).'">
 	    <input type="hidden" name="id" value="'.$comment_id.'">
-	  	<input class="text" name="board" type="hidden" value="'.$rs['board'].'">
+	  	<input class="text" name="board" type="hidden" value="'.strval($rs['board']).'">
 	    <table width="'.FORUMWIDTH.'" class="border" align="center">
 	    <tr><td align="left" colspan="6">
 	    <textarea name="text" cols="80" rows="20" class="text">'
@@ -1104,36 +1110,30 @@ static function getFormEdit($comment_id) {
 	    .'</td>'
 	    .'<td align="left" valign="top">Benachrichtigen:<br>'
 	    .$user->getFormFieldUserlist('msg_users[]', 20).'</td>'
-	  	.'</tr>
-	  	<tr><td align="left" valign="top">
-	    <input type="submit" name="submit" value="Update" class="button">
-
+	  	.'</tr>';
+	if(Comment::getNumchildposts($rs['board'], $comment_id) < 1)
+	{
+		$html .= '<table cellpadding="0" cellspacing="0">
+					<form action="/actions/comment_delete.php" method="post">
+						<input type="hidden" name="url" value="'.$passedBase64encodedUrl.'">
+						<input type="hidden" name="id" value="'.$comment_id.'">
+					<tr><td>
+						<input type="submit" value="Delete" class="button">
+					</td></tr>
+					</form>
+				</table>';
+	}
+	$html .= '<tr><td align="left" valign="top">
 	  	<td align="left">
-	    Parent
-	    </td><td>
-	  	<input class="text" name="parent_id" type="text" value="'.$rs['parent_id'].'">
+			Parent
+			</td><td>
+			<input class="text" name="parent_id" type="text" value="'.intval($rs['parent_id']).'">
 	  	</td>
 	  	</form>
 	    </td><td align="right">
-		';
-		if(Comment::getNumchildposts($rs['board'], $comment_id) < 1)
-		{
-			$html .= '
-				<table cellpadding="0" cellspacing="0">
-				<form action="/actions/comment_delete.php" method="post">
-				<input type="hidden" name="url" value="'.$_GET['url'].'">
-		    <input type="hidden" name="id" value="'.$comment_id.'">
-				<tr><td>
-				<input type="submit" value="Delete" class="button">
-				</td></tr>
-				</form>
-				</table>
-			';
-		}
-		$html .= '
+			<input type="submit" name="submit" value="Update" class="button">
 	    </td></tr></table>
-	    <br>
-	  ';
+	    <br>';
 
 	  return $html;
 	}

From a05728f34e80f80c7484a7c8a29090d6a265c9ba Mon Sep 17 00:00:00 2001
From: Oliver <github@raduner.ch>
Date: Tue, 16 Jan 2024 23:05:35 +0100
Subject: [PATCH 02/10] Resolves Bug 632

---
 www/includes/forum.inc.php   |  7 ++++---
 www/includes/gallery.inc.php | 19 +++++++++++++++++--
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/www/includes/forum.inc.php b/www/includes/forum.inc.php
index b51b779..6d7b191 100644
--- a/www/includes/forum.inc.php
+++ b/www/includes/forum.inc.php
@@ -672,7 +672,8 @@ static function post($parent_id, $board, $user_id, $text, $msg_users=NULL)
 		global $db, $user, $notification;
 
 		/** Parent-Id = 1 wenn man ein ForumThread postet */
-		$parent_id = ($parent_id <= 0 ? 1 : $parent_id);
+		$parent_id = ($parent_id <= 0 ? 1 : intval($parent_id));
+		if(!is_numeric($user_id)) $user_id = intval($user_id);
 		if(!is_numeric($parent_id) || $parent_id <= 0) user_error(t('invalid-parent_id', 'commenting'), E_USER_ERROR);
 
 		/**
@@ -738,10 +739,10 @@ static function post($parent_id, $board, $user_id, $text, $msg_users=NULL)
 			}
 
 			/** Mark comment as unread for all users */
-			$markedAsUnread = self::markasunread($rs['id']);
+			$markedAsUnread = self::markasunread(intval($rs['id']));
 
 			/** Mark comment as read for poster (current user) */
-			$markedReadForPoster = self::markasread($rs['id'], $user_id);
+			$markedReadForPoster = self::markasread(intval($rs['id']), $user_id);
 
 			/**
 			 * Comment Notifications
diff --git a/www/includes/gallery.inc.php b/www/includes/gallery.inc.php
index d80e9fe..d45a743 100644
--- a/www/includes/gallery.inc.php
+++ b/www/includes/gallery.inc.php
@@ -29,9 +29,8 @@
  * @include util.inc.php DISABLED is part of config.inc.php
  * @include usersystem.inc.php
  */
-require_once dirname(__FILE__).'/config.inc.php';
+require_once __DIR__.'/config.inc.php';
 include_once INCLUDES_DIR.'forum.inc.php';
-//require_once INCLUDES_DIR.'util.inc.php';
 require_once INCLUDES_DIR.'usersystem.inc.php';
 
 /**
@@ -789,6 +788,11 @@ function doDelAlbum ($id, $del)
 
 /**
  * Ein Bild zensieren / unzensieren.
+ *
+ * @version 2.0
+ * @since 1.0 Function added
+ * @since 2.0 Bug #632 : Mark all Pic comments as READ for regular Users
+ *
  * @param int $picID
  * @return boolean
  */
@@ -800,6 +804,7 @@ function doZensur ($picID)
 	$sql_zensur = 'SELECT zensur FROM gallery_pics WHERE id=?';
 	$e = $db->query($sql_zensur, __FILE__, __LINE__, __FUNCTION__, [$picID]);
 	$d = $db->fetch($e);
+
 	/** Bild ist zensiert: unzensieren */
 	if ($d['zensur']) {
 		$sql_unzensieren = 'UPDATE gallery_pics SET zensur="0" WHERE id=?';
@@ -812,6 +817,16 @@ function doZensur ($picID)
 		$sql_zensieren = 'UPDATE gallery_pics SET zensur="1" WHERE id=?';
 		$db->query($sql_zensieren, __FILE__, __LINE__, __FUNCTION__, [$picID]);
 		Thread::setRights('i', $picID, USER_MEMBER);
+
+		/** Mark all Pic comments as READ for regular Users */
+		$sql_user_unreads = $db->query('SELECT cu.comment_id comment, cu.user_id user FROM comments_unread cu
+										INNER JOIN comments c ON cu.comment_id=c.id INNER JOIN user u ON cu.user_id=u.id
+										WHERE c.thread_id=? AND u.usertype<?',
+										__FILE__, __LINE__, __FUNCTION__, [$picID, USER_MEMBER]);
+		while ($user_unreads = $db->fetch($sql_user_unreads))
+		{
+			Comment::markasread(intval($user_unreads['comment']), intval($user_unreads['user']));
+		}
 		return true;
 	}
 	return false;

From 2ffe9f6574639a6011f20bc164648cf1a6d7757d Mon Sep 17 00:00:00 2001
From: Oliver <github@raduner.ch>
Date: Tue, 16 Jan 2024 23:17:48 +0100
Subject: [PATCH 03/10] Hides User's Pics for Non-Vereinsmitglieder

---
 www/profil.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/www/profil.php b/www/profil.php
index ac93437..1a1d960 100644
--- a/www/profil.php
+++ b/www/profil.php
@@ -214,7 +214,7 @@
 		}
 
 		/** User markierte Gallery-Pics */
-		if ($user->is_loggedin()) $htmlOutput .= getUserPics($user_id, 0);
+		if (!empty($user->vereinsmitglied)) $htmlOutput .= getUserPics($user_id, 0);
 	}
 
 	/** User Events */

From ea37abab44b99df3970729f5131beaa7ee1d873f Mon Sep 17 00:00:00 2001
From: Oliver <github@raduner.ch>
Date: Thu, 18 Jan 2024 19:22:47 +0100
Subject: [PATCH 04/10] Fixes /data/ directory access in Docker service

---
 Docker/apache2/000-default.conf | 24 ++++++++++++------------
 Docker/apache2/ssl-default.conf | 12 ++++++------
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/Docker/apache2/000-default.conf b/Docker/apache2/000-default.conf
index a1fa99d..2b66dd3 100644
--- a/Docker/apache2/000-default.conf
+++ b/Docker/apache2/000-default.conf
@@ -44,16 +44,16 @@
 	ErrorDocument 500 /error/error_static.html
 
 	# User Files aus /data/files/*
-	Alias "/files" "/var/data/files"
-	<Directory "/var/data/files">
+	Alias "/files" "/var/www/data/files"
+	<Directory "/var/www/data/files">
 		Options -Indexes +MultiViews
 		Require all granted
 	</Directory>
 	AliasMatch "^/files/([0-9]+)/(.*)$" "/getfile.php?user=$1&file=$2"
 
 	# Userpics aus /data/userimages/*
-	Alias "/data/userimages" "/var/data/userimages"
-	<Directory "/var/data/userimages">
+	Alias "/data/userimages" "/var/www/data/userimages"
+	<Directory "/var/www/data/userimages">
 		Options -Indexes +MultiViews
 		Require all granted
 	</Directory>
@@ -66,8 +66,8 @@
 	</IfModule>
 
 	# Tauschbörse Artikelbilder aus /data/tauschboerse/*
-	Alias "/images/tauschboerse" "/var/data/tauschboerse"
-	<Directory "/var/data/tauschboerse">
+	Alias "/images/tauschboerse" "/var/www/data/tauschboerse"
+	<Directory "/var/www/data/tauschboerse">
 		Options -Indexes +MultiViews
 		Require all granted
 	</Directory>
@@ -97,16 +97,16 @@
 		ErrorDocument 500 /error/error_static.html
 
 		# User Files aus /data/files/*
-		Alias "/files" "/var/data/files"
-		<Directory "/var/data/files">
+		Alias "/files" "/var/www/data/files"
+		<Directory "/var/www/data/files">
 			Options -Indexes +MultiViews
 			Require all granted
 		</Directory>
 		AliasMatch "^/files/([0-9]+)/(.*)$" "/getfile.php?user=$1&file=$2"
 
 		# Userpics aus /data/userimages/*
-		Alias "/data/userimages" "/var/data/userimages"
-		<Directory "/var/data/userimages">
+		Alias "/data/userimages" "/var/www/data/userimages"
+		<Directory "/var/www/data/userimages">
 			Options -Indexes +MultiViews
 			Require all granted
 		</Directory>
@@ -119,8 +119,8 @@
 		</IfModule>
 
 		# Tauschbörse Artikelbilder aus /data/tauschboerse/*
-		Alias "/images/tauschboerse" "/var/data/tauschboerse"
-		<Directory "/var/data/tauschboerse">
+		Alias "/images/tauschboerse" "/var/www/data/tauschboerse"
+		<Directory "/var/www/data/tauschboerse">
 			Options -Indexes +MultiViews
 			Require all granted
 		</Directory>
diff --git a/Docker/apache2/ssl-default.conf b/Docker/apache2/ssl-default.conf
index e4d9752..bd00abf 100644
--- a/Docker/apache2/ssl-default.conf
+++ b/Docker/apache2/ssl-default.conf
@@ -147,16 +147,16 @@
 		ErrorDocument 500 /error/error_static.html
 
 		# User Files aus /data/files/*
-		Alias "/files" "/var/data/files"
-		<Directory "/var/data/files">
+		Alias "/files" "/var/www/data/files"
+		<Directory "/var/www/data/files">
 			Options -Indexes +MultiViews
 			Require all granted
 		</Directory>
 		AliasMatch "^/files/([0-9]+)/(.*)$" "/getfile.php?user=$1&file=$2"
 
 		# Userpics aus /data/userimages/*
-		Alias "/data/userimages" "/var/data/userimages"
-		<Directory "/var/data/userimages">
+		Alias "/data/userimages" "/var/www/data/userimages"
+		<Directory "/var/www/data/userimages">
 			Options -Indexes +MultiViews
 			Require all granted
 		</Directory>
@@ -169,8 +169,8 @@
 		</IfModule>
 
 		# Tauschbörse Artikelbilder aus /data/tauschboerse/*
-		Alias "/images/tauschboerse" "/var/data/tauschboerse"
-		<Directory "/var/data/tauschboerse">
+		Alias "/images/tauschboerse" "/var/www/data/tauschboerse"
+		<Directory "/var/www/data/tauschboerse">
 			Options -Indexes +MultiViews
 			Require all granted
 		</Directory>

From ad3b499ac594622dd77c06334e662f8d598460d0 Mon Sep 17 00:00:00 2001
From: Oliver <github@raduner.ch>
Date: Thu, 18 Jan 2024 19:23:43 +0100
Subject: [PATCH 05/10] Fixes Templateeditor on close or parse error

---
 www/actions/tpleditor.php | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/www/actions/tpleditor.php b/www/actions/tpleditor.php
index 124f95c..00b0315 100644
--- a/www/actions/tpleditor.php
+++ b/www/actions/tpleditor.php
@@ -43,11 +43,8 @@
 	}
 }
 $enable_tpleditor = filter_input(INPUT_GET, 'tpleditor', FILTER_VALIDATE_BOOL) ?? false; // $_GET['tpleditor']
-unset($_GET['tpleditor']);
 $updated_tplid = ($_GET['tplupd'] === 'new' ? 'new' : (filter_input(INPUT_GET, 'tplupd', FILTER_VALIDATE_INT) ?? null)); // $_GET['tplupd']
-unset($_GET['tplupd']);
 $return_url = base64url_decode(filter_input(INPUT_GET, 'location', FILTER_SANITIZE_FULL_SPECIAL_CHARS)) ?? '/index.php?tpl='.$updated_tplid; // $_GET['location']
-unset($_GET['location']);
 
 /**
  * Save Template
@@ -268,26 +265,29 @@
 			zorgDebugger::log()->debug('$_TPLROOT[owner] Notification: %s', [$notification_status ? 'true' : 'false']);
 		}
 
-		if (DEVELOPMENT === true) error_log(sprintf('[DEBUG] <%s:%d> header(Location): %s', __FILE__, __LINE__, $return_url));
+		unset($_GET['tpleditor']);
+		unset($_GET['tplupd']);
+		unset($_GET['location']);
+		zorgDebugger::log()->debug('Location: %s', [$return_url]);
 		header('Location: '.$return_url);
 		exit();
 	}
 
 	/** Otherweise go back to TPL-Editor & display Errors */
 	else {
-		$frm['tpl'] = stripslashes(stripslashes($frm['tpl']));
-		$frm['title'] = stripslashes(stripslashes($frm['title']));
-		$frm['packages'] = stripslashes(stripslashes($frm['packages']));
+		$frm['tpl'] = (is_string($frm['tpl']) ? stripslashes(stripslashes($frm['tpl'])) : strval($frm['tpl']));
+		$frm['title'] = (is_string($frm['title']) ? stripslashes(stripslashes($frm['title'])) : strval($frm['title']));
+		$frm['packages'] = (is_string($frm['packages']) ? stripslashes(stripslashes($frm['packages'])) : strval($frm['packages']));
 		// FIXME aus irgend einem grund ist stripslashes() 2x nötig. sonst wird nur ein teil der slashes entfernt. wüsste gern wieso. ([z]biko)
 
 		/** Pass $error to error-log */
-		error_log($error);
+		zorgDebugger::log()->warn('Smarty Template Error: %s', [strval($error)]);
 
 		/** Pass $error to Smarty and display template */
 		$smarty->assign('tpleditor_error', $error);
 		$frm['tpl'] = htmlentities($frm['tpl']);
-		$smarty->assign('tpleditor_frm', $frm);
 		$smarty->assign('tpleditor_state', $state);
+		$smarty->assign('tpleditor_frm', $frm);
 
 		$smarty->display('file:layout/layout.tpl');
 	}

From 4f526a3ce787c53ebc2aaee6840fc93f177cd20f Mon Sep 17 00:00:00 2001
From: Oliver <github@raduner.ch>
Date: Thu, 18 Jan 2024 19:25:52 +0100
Subject: [PATCH 06/10] Moar code hardening

---
 www/fretsonzorg.php                | 30 ++++++++++---------
 www/includes/mysql.inc.php         | 28 +++++++++++-------
 www/includes/notifications.inc.php | 47 +++++++++++++++---------------
 www/includes/smarty.inc.php        |  9 ++++--
 www/includes/util.inc.php          |  5 ++--
 www/models/core.model.php          |  4 +--
 www/scripts/stockbroker.php        |  2 +-
 www/smartylib/Smarty.class.php     |  2 +-
 8 files changed, 70 insertions(+), 57 deletions(-)

diff --git a/www/fretsonzorg.php b/www/fretsonzorg.php
index b69c71f..d414d00 100644
--- a/www/fretsonzorg.php
+++ b/www/fretsonzorg.php
@@ -12,7 +12,8 @@
 /**
  * File includes
  */
-require_once dirname(__FILE__).'/includes/main.inc.php';
+require_once __DIR__.'/includes/config.inc.php';
+require_once INCLUDES_DIR.'main.model.php';
 require_once MODELS_DIR.'core.model.php';
 
 /**
@@ -56,25 +57,28 @@
 //echo foot();
 $smarty->display('file:layout/footer.tpl');
 
-function print_stars($stars) {
-
+function print_stars($stars)
+{
 	// imagesource
     $star1 = '<img src="/images/star1.png">';
     $star2 = '<img src="/images/star2.png">';
-    
+    $star = ''; // Initialize $star HTML as an empty string
+
+	/** Add filled stars based on rating */
     for ($i=0;$i<$stars;$i++){
-    	$star=$star.$star2;
+    	$star.=$star2;
     }
+	/** Fill HTML string with remaining unfilled stars */
     for ($i=0;$i<(5-$stars);$i++){
-    	$star=$star.$star1;
+    	$star.=$star1;
     }
 	return $star;
 }
 
 function print_score_table($song,$difficulty){
-	
+
 	global $db;
-	
+
 	switch ($difficulty) {
     case 0:
 		$difficulty_name = "Amazing";
@@ -86,21 +90,21 @@ function print_score_table($song,$difficulty){
        $difficulty_name = "Easy";
        break;
     }
-    
+
 	echo "<td style='width: 33%; vertical-align: top; border-left: solid thin #200; padding-left: 1em'><h3>$difficulty_name</h3>";
 	echo "<table>";
-	
+
 	$sql = "SELECT * FROM fretsonzorg WHERE song = '$song' AND difficulty = '$difficulty' ORDER BY score DESC LIMIT 0,10";
   	$result = $db->query($sql, __FILE__, __LINE__);
 
 	$i=1;
 	while($rs = $db->fetch($result, __FILE__, __LINE__)) {
-	
-		$starpic = print_stars($rs[stars]);
+
+		$starpic = print_stars($rs['stars']);
 		echo "<tr><td style='width: 2em' valign='top'>$i.</td><td style='width: 5em' valign='top'>$rs[score]</td><td style='width: 10em' valign='top'>$starpic</td><td valign='top'>$rs[name]</td></tr></tr>";
 		$i++;
 	}
-	
+
 	echo "</table></td>";
 
 }
diff --git a/www/includes/mysql.inc.php b/www/includes/mysql.inc.php
index 35c04b3..ebd5489 100644
--- a/www/includes/mysql.inc.php
+++ b/www/includes/mysql.inc.php
@@ -25,7 +25,7 @@ class dbconn
 	var $conn;
 	var $noquerys = 0;
 	var $noquerytracks = 0;
-	var $nolog = 0;
+	var $nolog = false;
 	var $display_error = (DEVELOPMENT === true ? 1 : 0);
 	var $query_track = [];
 
@@ -219,8 +219,8 @@ function msg($sql='',$file='',$line='',$funktion='')
 		</td></tr><tr><td align='left' valign='top'><b>Line:</b> </td><td align='left'>".$line."
 		</td></tr><tr><td align='left' valign='top'><b>Function:</b> </td><td align='left'>".$funktion."
 		</td></tr></table>";
-		if($this->nolog == 0) {
-			$this->saveerror($msg,$sql,$file,$line,$funktion);
+		if(!$this->nolog && !empty($msg) && !empty($sql)) {
+			$this->saveerror($msg, $sql, $file, $line, $funktion);
 		}
 		return $ausg;
 	}
@@ -241,16 +241,22 @@ function msg($sql='',$file='',$line='',$funktion='')
 	 */
 	function saveerror($msg, $sql, $file='', $line=0, $funktion='')
 	{
-		$msg = addslashes($msg);
-		$sql = addslashes($sql);
-		$user_id = (isset($_SESSION['user_id']) ? $_SESSION['user_id'] : 0);
-		$ip = (isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '');
-		$page = (isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '');
-		$referer = (isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '');
-		// FIXME crasht wenn von Line 193 -> Line 222 aufgerufen, prepared statement scheint falsch zu sein *shrug*
+		/** Validate parameters */
+		$msg = strval($msg);
+		$sql = strval($sql);
+		$file = strval($file);
+		$line = intval($line);
+		$funktion = strval($funktion);
+		$user_id = (isset($_SESSION['user_id']) && !empty($_SESSION['user_id']) ? intval($_SESSION['user_id']) : 0);
+		$ip = (isset($_SERVER['REMOTE_ADDR']) && !empty($_SERVER['REMOTE_ADDR']) ? strval($_SERVER['REMOTE_ADDR']) : '');
+		$page = (isset($_SERVER['REQUEST_URI']) && !empty($_SERVER['REQUEST_URI']) ? strval($_SERVER['REQUEST_URI']) : '');
+		$referer = (isset($_SERVER['HTTP_REFERER']) && !empty($_SERVER['HTTP_REFERER']) ? strval($_SERVER['HTTP_REFERER']) : '');
+		$datetime = strval(timestamp(true));
+
+		/** Insert SQL-Error to DB */
 		$insertSql = 'INSERT INTO sql_error (user_id, ip, page, query, msg, date, file, line, referer, status, function) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?)';
 		$stmt = mysqli_prepare($this->conn, $insertSql);
-		mysqli_stmt_bind_param($stmt, 'isssssiss', $user_id, $ip, $page, $sql, $msg, timestamp(true), $file, $line, $referer, $funktion);
+		mysqli_stmt_bind_param($stmt, 'issssssiss', $user_id, $ip, $page, $sql, $msg, $datetime, $file, $line, $referer, $funktion);
 		mysqli_stmt_execute($stmt);
 	}
 
diff --git a/www/includes/notifications.inc.php b/www/includes/notifications.inc.php
index 7f3390f..1830034 100644
--- a/www/includes/notifications.inc.php
+++ b/www/includes/notifications.inc.php
@@ -37,10 +37,10 @@ class Notification
 	 * Send a Notification to a User
 	 * Schickt eine Notification an einen User über die aktivierten Kanäle
 	 *
-	 * @author	IneX
-	 * @version	1.1
+	 * @version	1.2
 	 * @since	1.0 `21.10.2018` `IneX` method added
 	 * @since	1.1 `13.08.2021` `IneX` fixed Undefined index: games & Invalid argument supplied for foreach()
+	 * @since	1.2 `13.08.2021` `IneX` harmonise $text & $message when sending Telegram Notification (with more context)
 	 *
 	 * @param integer $user_id Valid User-ID integer
 	 * @param string $notification_source String representing the source of Notification to send $content for. E.g. 'messagesystem', 'mentions', 'games', etc...
@@ -54,21 +54,20 @@ public function send($user_id, $notification_source, $content)
 		global $user, $telegram;
 
 		/** Validate passed parameters */
-		if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> passed parameters: %d | %s | %s', __METHOD__, __LINE__, $user_id, $notification_source, (is_array($content) ? print_r($content,true) : strval($content))));
+		zorgDebugger::log()->debug('Values: %d | %s | %s', [$user_id, $notification_source, (is_array($content) ? print_r($content,true) : strval($content))]);
 		if (!is_numeric($user_id) || $user_id <= 0) return false;
 		if (is_numeric($notification_source) || is_array($notification_source)) return false;
 		if (!is_array($content)) return false;
 
 		/** Get the Notifications for $user_id */
-		$userNotifications = $this->get($user_id);
+		$userNotifications = self::get($user_id);
 
 		/**
 		 * Check and send User Notifications
-		 * @TODO harmonise $text & $message...
 		 */
 		if (is_array($userNotifications) && count($userNotifications)>0) // @FIXME what if the user has NO (0) Notifications activated?
 		{
-			if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> $userNotifications: %s', __METHOD__, __LINE__, print_r($userNotifications,true)));
+			zorgDebugger::log()->debug('$userNotifications: %s', [print_r($userNotifications,true)]);
 			/** Make sure $notification_source = eixsts in $userNotifications */
 			if (false === array_key_exists($notification_source, $userNotifications))
 			{
@@ -78,16 +77,17 @@ public function send($user_id, $notification_source, $content)
 			}
 			foreach($userNotifications[$notification_source] as $notification_type => $notification_value)
 			{
-				if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> %s => %s', __METHOD__, __LINE__, $notification_type, $notification_value));
+				zorgDebugger::log()->debug('%s => %s', [$notification_type, $notification_value]);
 
 				/**
 				 * zorg Message
 				 */
 				if ($notification_type === 'message' && $notification_value == 'true')
 				{
-					/** Validate $content for $notification_type 'message'
-						$from_user_id, $owner, $subject, $text='', $to_users='', $isread='0'
-					*/
+					/**
+					 * Validate $content for $notification_type 'message'
+					 * $from_user_id, $owner, $subject, $text='', $to_users='', $isread='0'
+					 */
 					if (!empty($content['from_user_id']) && !empty($content['from_user_id']) && !empty($content['subject']) && !empty($content['text']))
 					{
 						/** Send notification */
@@ -103,13 +103,14 @@ public function send($user_id, $notification_source, $content)
 				 */
 				elseif ($notification_type === 'email' && $notification_value == 'true')
 				{
-					/** Validate $content for $notification_type 'message'
-						$from_user_id, $owner, $subject, $text
-					*/
+					/**
+					 * Validate $content for $notification_type 'message'
+					 * $from_user_id, $owner, $subject, $text
+					 */
 					if (!empty($content['from_user_id']) && !empty($content['subject']) && !empty($content['text']))
 					{
 						/** Send notification */
-						$this->sendEmailNotification($content['from_user_id'], $user_id, $content['subject'], $content['text']);
+						self::sendEmailNotification($content['from_user_id'], $user_id, $content['subject'], $content['text']);
 					} else {
 						error_log(sprintf('[WARN] <%s:%d> $notification_type "email": invalid or incomplete $content! %s', __METHOD__, __LINE__, print_r($content,true)));
 					}
@@ -124,8 +125,8 @@ public function send($user_id, $notification_source, $content)
 					if (!empty($content['message']) && !is_numeric($content['message']) && !is_array($content['message']))
 					{
 						/** Send notification */
-						$content['parameters'] = ['disable_web_page_preview' => 'true']; // TEMP - REMOVE LATER!
-						//$message = t('telegram-newmessage-notification', 'messagesystem', [ SITE_URL, $user_id, $user->id2user($content['from_user_id'], TRUE), SITE_HOSTNAME, text_width($text, 140, '...', true) ] );
+						$content['parameters'] = ['disable_web_page_preview' => 'false']; // TODO TEMP - REMOVE LATER! / Re-enabled because don't know why disabled... [17.01.2024/IneX]
+						if (isset($content['subject']) && !empty($content['subject'])) $content['message'] = $content['subject'].': '.$content['message']; // Merge Subject + Message
 						$telegram->send->message($user_id, $content['message'], $content['parameters']);
 					} else {
 						error_log(sprintf('[WARN] <%s:%d> $notification_type "telegram": invalid or incomplete $content! %s', __METHOD__, __LINE__, print_r($content,true)));
@@ -137,7 +138,7 @@ public function send($user_id, $notification_source, $content)
 			return true;
 
 		} else {
-			if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> $userNotifications INVALID: %d', __METHOD__, __LINE__, print_r($userNotifications,true)));
+			zorgDebugger::log()->debug('$userNotifications INVALID: %d', [print_r($userNotifications,true)]);
 			return false;
 		}
 	}
@@ -163,12 +164,11 @@ private function get($user_id)
 		global $db, $user;
 
 		/** Validate passed parameters */
-		if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> passed parameters: %d', __METHOD__, __LINE__, $user_id));
 		if (!is_numeric($user_id) || $user_id <= 0 || true === is_array($user_id) || false === $user->id2user($user_id)) {
-			if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> $user_id INVALID: %d', __METHOD__, __LINE__, $user_id));
+			zorgDebugger::log()->debug('$user_id INVALID: %d', [$user_id]);
 			return false;
 		} else {
-			if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> $user_id VALID', __METHOD__, __LINE__));
+			zorgDebugger::log()->debug('$user_id VALID: %d', [$user_id]);
 		}
 
 		$query = $db->query('SELECT notifications FROM user WHERE id=? LIMIT 1', __FILE__, __LINE__, __METHOD__, [$user_id]);
@@ -176,10 +176,10 @@ private function get($user_id)
 		if (!$result || empty($result))
 		{
 			/** Use fallback usersystem::$default_notifications if No query result / empty "notifications"-field */
-			if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> Use fallback usersystem::$default_notifications for $user_id %d: %s', __METHOD__, __LINE__, $user_id, $user->default_notifications));
+			zorgDebugger::log()->debug('Use fallback usersystem::$default_notifications for $user_id %d: %s', [$user_id, $user->default_notifications]);
 			$userEnabledNotifications = json_decode( $user->default_notifications, true ); // JSON-DECODE to Array
 		} else {
-			if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> Use $userEnabledNotifications for $user_id %d: %s', __METHOD__, __LINE__, $user_id, $result['notifications']));
+			zorgDebugger::log()->debug('Use $userEnabledNotifications for $user_id %d: %s', [$user_id, $result['notifications']]);
 			$userEnabledNotifications = json_decode( stripslashes($result['notifications']), true); // JSON-Decode to Array
 		}
 
@@ -254,13 +254,12 @@ private function check($notification_source, $notification_type, $user_id)
 	 * @param	integer	$to_user_id		User-ID des Empfängers
 	 * @param	string	$titel			Titel der ursprünglichen Nachricht
 	 * @param	string	$text			Ursprünglicher Text
-	 * @global	object	$db				Globales Class-Object mit allen MySQL-Methoden
 	 * @global	object	$user			Globales Class-Object mit den User-Methoden & Variablen
 	 * @return	boolean					Returns 'true' or 'false', depending if mail() was successful or not
 	 */
 	private function sendEmailNotification($from_user_id, $to_user_id, $titel, $text)
 	{
-		global $db, $user;
+		global $user;
 
 		/** Validate passed parameters */
 		if (!empty($to_user_id) && is_numeric($to_user_id))
diff --git a/www/includes/smarty.inc.php b/www/includes/smarty.inc.php
index e827346..3db998c 100644
--- a/www/includes/smarty.inc.php
+++ b/www/includes/smarty.inc.php
@@ -131,9 +131,12 @@ function _tpl_assigns ($params, $content, &$smarty, &$repeat) {
 	} else {  // schliessendes tag
 		array_pop($_tpl_stack);
 
-		$smarty->assign('tpl', $_tpl_stack[sizeof($_tpl_stack)-1]);
-		$smarty->assign('tpl_parent', $_tpl_stack[sizeof($_tpl_stack)-2]);
-		$smarty->assign('tpl_level', sizeof($_tpl_stack));
+		if (is_array($_tpl_stack) && count($_tpl_stack)>1)
+		{
+			$smarty->assign('tpl', $_tpl_stack[sizeof($_tpl_stack)-1]);
+			$smarty->assign('tpl_parent', $_tpl_stack[sizeof($_tpl_stack)-2]);
+			$smarty->assign('tpl_level', sizeof($_tpl_stack));
+		}
 
 		return $content;
 	}
diff --git a/www/includes/util.inc.php b/www/includes/util.inc.php
index 9fde472..06383c2 100644
--- a/www/includes/util.inc.php
+++ b/www/includes/util.inc.php
@@ -330,9 +330,10 @@ function url_params()
 {
 	$ret = '';
 	foreach ($_GET as $key => $val) {
-		$ret .= htmlspecialchars($key, ENT_QUOTES, 'UTF-8') . '=' . htmlspecialchars($val, ENT_QUOTES, 'UTF-8') . '&';
+		$ret .= htmlspecialchars(strval($key), ENT_QUOTES, 'UTF-8') . '=' . htmlspecialchars(strval($val), ENT_QUOTES, 'UTF-8');
+		if ($key !== array_key_last($_GET)) $ret .= '&';
 	}
-	return substr($ret, 0, -1);
+	return $ret;
 }
 
 /**
diff --git a/www/models/core.model.php b/www/models/core.model.php
index d3fb8bc..db15f58 100644
--- a/www/models/core.model.php
+++ b/www/models/core.model.php
@@ -94,10 +94,10 @@ public function assign_model_to_smarty(&$smarty)
 
 		/** Assign Model to Smarty variables */
 		$smarty->assign('tplroot', [
-									 'page_title' => $this->page_title
+									 'page_title' => html_entity_decode($this->page_title, ENT_COMPAT, 'UTF-8')
 									,'page_link' => $this->page_link
 									,'page_image' => $this->page_image
-									,'meta_description' => $this->meta_description
+									,'meta_description' => html_entity_decode($this->meta_description, ENT_COMPAT, 'UTF-8')
 									,'menus' => $this->menus
 									,'sidebar' => $this->sidebar
 									,'additional_scripts' => $this->scripts
diff --git a/www/scripts/stockbroker.php b/www/scripts/stockbroker.php
index 19118b3..001c567 100644
--- a/www/scripts/stockbroker.php
+++ b/www/scripts/stockbroker.php
@@ -8,7 +8,7 @@
 require_once __DIR__.'/../includes/stockbroker.inc.php';
 require_once INCLUDES_DIR.'usersystem.inc.php';
 
-global $smarty, $user;
+global $stockbroker, $smarty, $user;
 
 //$smarty->assign("kurse_aktuell", Stockbroker::getKurseNeuste(10));
 $smarty->assign("kurse_tagesgewinner", $stockbroker->getTodaysWinners());
diff --git a/www/smartylib/Smarty.class.php b/www/smartylib/Smarty.class.php
index 4a5b9ef..b17efbe 100755
--- a/www/smartylib/Smarty.class.php
+++ b/www/smartylib/Smarty.class.php
@@ -235,7 +235,7 @@ class Smarty
                                                                'true', 'false', 'null'),
                                     'INCLUDE_ANY'     => false,
                                     'PHP_TAGS'        => false,
-                                    'MODIFIER_FUNCS'  => array('count','round','ceil','explode','microtime'),
+                                    'MODIFIER_FUNCS'  => array('count','round','ceil','explode','microtime','number_format','html_entity_decode'),
                                     'ALLOW_CONSTANTS'  => true,
                                     'ALLOW_SUPER_GLOBALS' => true
                                    );

From b91bde123c99ae677698aa7beac81b749ef475fb Mon Sep 17 00:00:00 2001
From: Oliver <github@raduner.ch>
Date: Thu, 18 Jan 2024 19:26:46 +0100
Subject: [PATCH 07/10] Resolves Bug 607
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[Tauschbörse] Wenns kein Bild hat, den img-Tag weglassen
---
 www/includes/config.inc.php |  2 ++
 www/includes/smarty.fnc.php | 31 ++++++++++++++++++++++++++-----
 2 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/www/includes/config.inc.php b/www/includes/config.inc.php
index e4af839..8787adf 100644
--- a/www/includes/config.inc.php
+++ b/www/includes/config.inc.php
@@ -187,6 +187,7 @@
  * @const SCRIPTS_DIR Scripts directory for Frontend-Resources
  * @const UTIL_DIR Utilities directory for Frontend-Resources
  * @const USER_IMGPATH_PUBLIC	Externer Pfad zu den Userpics
+ * @const TAUSCHBOERSE_IMGPATH_PUBLIC Externer Pfad zu den Tauschbörse Artikel-Bilder
  */
 if (!defined('ACTIONS_DIR')) define('ACTIONS_DIR', (isset($_ENV['URLPATH_ACTIONS']) ? $_ENV['URLPATH_ACTIONS'] : null));
 if (!defined('CSS_DIR')) define('CSS_DIR', (isset($_ENV['URLPATH_CSS']) ? $_ENV['URLPATH_CSS'] : null));
@@ -195,6 +196,7 @@
 if (!defined('SCRIPTS_DIR')) define('SCRIPTS_DIR', (isset($_ENV['URLPATH_SCRIPTS']) ? $_ENV['URLPATH_SCRIPTS'] : null));
 if (!defined('UTIL_DIR')) define('UTIL_DIR', (isset($_ENV['URLPATH_UTILS']) ? $_ENV['URLPATH_UTILS'] : null));
 if (!defined('USER_IMGPATH_PUBLIC')) define('USER_IMGPATH_PUBLIC', (isset($_ENV['URLPATH_USERIMAGES']) ? $_ENV['URLPATH_USERIMAGES'] : null));
+if (!defined('TAUSCHBOERSE_IMGPATH_PUBLIC')) define('TAUSCHBOERSE_IMGPATH_PUBLIC', (defined('IMAGES_DIR') ? IMAGES_DIR.'tauschboerse/' : null));
 
 /**
  * Define User & Usersystem constants
diff --git a/www/includes/smarty.fnc.php b/www/includes/smarty.fnc.php
index c5134e4..4a98842 100644
--- a/www/includes/smarty.fnc.php
+++ b/www/includes/smarty.fnc.php
@@ -662,8 +662,8 @@ function smarty_num_new_tauschangebote ($params, &$smarty) {
 		global $db, $user;
 		if (isset($user->lastlogin)) {
 			$result = $db->query(
-				'SELECT COUNT(*) AS num FROM tauschboerse
-				 WHERE UNIX_TIMESTAMP(datum)>?', __FILE__, __LINE__, __FUNCTION__, [$user->lastlogin]
+				'SELECT COUNT(*) AS num FROM tauschboerse WHERE UNIX_TIMESTAMP(datum)>?',
+				__FILE__, __LINE__, __FUNCTION__, [$user->lastlogin]
 			);
 			$rs = $db->fetch($result);
 			//$smarty->assign("artikel", $rs);
@@ -673,13 +673,33 @@ function smarty_num_new_tauschangebote ($params, &$smarty) {
 	function smarty_assign_artikel ($params, &$smarty) {
 		global $db;
 		$result = $db->query(
-			'SELECT *, CONVERT(kommentar USING latin1) kommentar, UNIX_TIMESTAMP(datum) AS datum
-			FROM tauschboerse WHERE id=?',
+			'SELECT *, CONVERT(kommentar USING latin1) kommentar, UNIX_TIMESTAMP(datum) AS datum FROM tauschboerse WHERE id=?',
 			__FILE__, __LINE__, __FUNCTION__, [$params['id']]
 		);
 		$rs = $db->fetch($result);
 		$smarty->assign("artikel", $rs);
 	}
+	/**
+	 * Smarty Block: Prüft ob ein Tauschbörse Artikelbild existiert.
+	 * @example {check_artikel_image id=$angebot.id}<img src="...">{/check_artikel_image}
+	 * @uses fileExists()
+	 *
+	 * @version 1.0
+	 * @since 1.0 `17.01.2024` `IneX` Bug #607 : Wenns kein Bild hat, den img-Tag weglassen.
+	 */
+	function smarty_check_tauschartikel_image($params, $content, &$smarty, &$repeat)
+	{
+		$artikelimgurl = null;
+		if (isset($params['id']) && is_numeric($params['id']))
+		{
+			$artikelid = strval($params['id']);
+			$artikelimgpath = TAUSCHARTIKEL_IMGPATH.$artikelid.USER_IMGEXTENSION;
+			if (fileExists($artikelimgpath) !== false) {
+				$artikelimgurl = TAUSCHBOERSE_IMGPATH_PUBLIC.$artikelid.USER_IMGEXTENSION;
+			}
+		}
+		return (!empty($artikelimgurl) ? $content : '&nbsp;');
+	}
 
 /** Usersystem */
 	function var_online_users ()
@@ -1597,7 +1617,7 @@ function smarty_modifier_rendertime($mode='begin')
 	 *
 	 * @var array
 	 */
-	$zorg_php_blocks 	= array( //Format: [Block] => array ([PHP-Funktion] | [Kategorie] | [Beschreibung] | [Members only true/false])
+	$zorg_php_blocks 	= array( //Format: [PHP-Funktion] => array ([Block] | [Kategorie] | [Beschreibung] | [Members only true/false])
 								 'smarty_zorg' => array('zorg', 'Layout', '{zorg title="Titel"}...{/zorg}	displays the zorg layout (including header, menu and footer)', false)
 								,'smarty_html_link' => array('link', 'HTML', '{link tpl=x param="urlparams"}text{/a}	default tpl = das aktuelle', false)
 								,'smarty_new_tpl_link' => array('new_link', 'Smarty Template', 'shows a link to the editor with new tpl.', false)
@@ -1616,6 +1636,7 @@ function smarty_modifier_rendertime($mode='begin')
 								,'smarty_mailctabutton' => array('mail_button', 'Verein Mailer - Call-to-Action-Button', '{mail_button style="NULL|secondary" position="left|center|right" action="mail|link" href="url"}button-text{/mail_button}', false)
 								,'smarty_mailtelegrambutton' => array('telegram_button', 'Verein Mailer - Telegram Messenger Button', '{telegram_button}button-text{/telegram}', false)
 								,'smarty_swissqrbillimage' => ['swissqrbillcode', 'zorg Swiss QR Bill - QR-Code', '{swissqrbillcode size="s|m|l" user=23 betrag=23.00}zorg Verein Mitgliederbeitrag{/swissqrbillcode}', true]
+								,'smarty_check_tauschartikel_image' => [ 'check_artikel_image', 'Tauschbörse', 'Renders content only if Tauschbörse Artikel-Image exists. Usage: {check_artikel_image id=$angebot.id}<img src="...">{/check_artikel_image}', false ]
 
 								);
 

From a4e2f893665cc25abafe573c8734e4a720d12c90 Mon Sep 17 00:00:00 2001
From: Oliver <github@raduner.ch>
Date: Thu, 18 Jan 2024 19:27:25 +0100
Subject: [PATCH 08/10] Fixes Bugtracker Notifications

---
 www/includes/bugtracker.inc.php | 74 ++++++++++++++-------------------
 www/includes/strings.array.php  |  3 +-
 2 files changed, 34 insertions(+), 43 deletions(-)

diff --git a/www/includes/bugtracker.inc.php b/www/includes/bugtracker.inc.php
index 014b1d8..0361c3e 100644
--- a/www/includes/bugtracker.inc.php
+++ b/www/includes/bugtracker.inc.php
@@ -35,14 +35,13 @@ class Bugtracker
 	 * - deny a Bug
 	 * - adding new Bug Category
 	 *
-	 * @author [z]milamber
-	 * @author IneX
-	 * @version 3.2
+	 * @version 3.3
 	 * @since 1.0 `[z]milamber` function added
 	 * @since 2.0 `IneX` various code optimizations, I don't remember all of them
 	 * @since 3.0 `26.11.2018` `IneX` updated to use new $notifcation Class & some code and query optimizations
 	 * @since 3.1 `04.12.2019` `IneX` [GitHub-Issue #22] updated SQL-queries
 	 * @since 3.2 `02.06.2023` `IneX` Fixes SQL Injection Risks (CWE-89), Open Redirect Risks (CWE-601)
+	 * @since 3.3 `17.01.2024` `IneX` Fixes empty Notification Text, better Input Validation
 	 *
 	 * @global object $db Globales Class-Object mit allen MySQL-Methoden
 	 * @global object $user Globales Class-Object mit den User-Methoden & Variablen
@@ -53,10 +52,12 @@ static function execActions()
 	{
 		global $db, $user, $notification;
 
-		$sanitizedReturnURL = parse_url(base64url_decode($_GET['url']), PHP_URL_PATH);
+		$returnUrl = (isset($_GET['url']) ? filter_input(INPUT_GET, 'url', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR) : (filter_input(INPUT_POST, 'url', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR) ?? '/bugtracker.php'));
+		$sanitizedReturnURL = parse_url(base64url_decode($returnUrl), PHP_URL_PATH);
+		$doAction = filter_input(INPUT_GET, 'action', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR) ?? null;
 
 		/** Add new Bug */
-		if (isset($_GET['action']) && $_GET['action'] === 'new')
+		if ($doAction === 'new')
 		{
 			/** Validate & escape fields */
 			$bugCategory = ( isset($_GET['category_id']) && is_numeric($_GET['category_id']) && $_GET['category_id'] >= 0 ? $_GET['category_id'] : user_error('Bugtracker: invalid Category-ID "' . $_GET['category_id'] . '"', E_USER_WARNING) );
@@ -83,7 +84,7 @@ static function execActions()
 				for ($i=0; $i < count($_GET['msg_users']); $i++)
 				{
 					$notification_subject = t('message-subject-newbug', 'bugtracker', [ $user->id2user($user->id, true), $newBugId ]);
-					$notification_text = t('message-newbug', 'bugtracker', [ remove_html($bugDescription, '<a><br><i><b><code><pre>'), SITE_URL, $newBugId, $bugTitle]);
+					$notification_text = t('message-newbug', 'bugtracker', [ remove_html($bugDescription, '<a><br><i><b><code><pre>'), $newBugId, $bugTitle]);
 					$notification_status = $notification->send($_GET['msg_users'][$i], 'bugtracker', ['from_user_id'=>$user->id, 'subject'=>$notification_subject, 'text'=>$notification_text, 'message'=>$notification_text, 'to_users' => $_GET['msg_users']]);
 					if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> $notification_status "%s" from user=%s to user=%s', __METHOD__, __LINE__, ($notification_status===true?'true':'false'), $user->id, $_GET['msg_users'][$i]));
 				}
@@ -94,7 +95,7 @@ static function execActions()
 		}
 
 		/** Assign Bug */
-		elseif (isset($_GET['action']) && $_GET['action'] === 'assign')
+		elseif ($doAction === 'assign')
 		{
 			$bugId = ( isset($_GET['bug_id']) && is_numeric($_GET['bug_id']) && $_GET['bug_id'] >= 0 ? (int)$_GET['bug_id'] : user_error('Bugtracker: invalid Bug-ID "' . $_GET['bug_id'] . '"', E_USER_WARNING) );
 
@@ -102,12 +103,12 @@ static function execActions()
 			if($rs['assignedto_id'] == 0) {
 				$result = $db->update('bugtracker_bugs', $bugId, ['assignedto_id' => $user->id, 'assigned_date' => timestamp(true)], __FILE__, __LINE__, __METHOD__);
 			}
-			header('Location: '.(!empty($sanitizedReturnURL) ? $sanitizedReturnURL : '/bugtracker.php'));
+			header('Location: '.$sanitizedReturnURL);
 			exit;
 		}
 
 		/** Bug klauen */
-		elseif (isset($_GET['action']) &&  $_GET['action'] === 'klauen')
+		elseif ($doAction === 'klauen')
 		{
 			$bugId = ( isset($_GET['bug_id']) && is_numeric($_GET['bug_id']) && $_GET['bug_id'] >= 0 ? (int)$_GET['bug_id'] : user_error('Bugtracker: invalid Bug-ID "' . $_GET['bug_id'] . '"', E_USER_WARNING) );
 
@@ -115,12 +116,12 @@ static function execActions()
 			if($rs['assignedto_id'] == 0 OR $rs['assignedto_id'] > 0) {
 				$result = $db->update('bugtracker_bugs', $bugId, ['assignedto_id' => $user->id, 'assigned_date' => timestamp(true)], __FILE__, __LINE__, __METHOD__);
 			}
-			header('Location: '.(!empty($sanitizedReturnURL) ? $sanitizedReturnURL : '/bugtracker.php'));
+			header('Location: '.$sanitizedReturnURL);
 			exit;
 		}
 
 		/** Bug erneut öffnen */
-		elseif (isset($_GET['action']) && $_GET['action'] === 'reopen')
+		elseif ($doAction === 'reopen')
 		{
 			$bugId = ( isset($_GET['bug_id']) && is_numeric($_GET['bug_id']) && $_GET['bug_id'] >= 0 ? (int)$_GET['bug_id'] : user_error('Bugtracker: invalid Bug-ID "' . $_GET['bug_id'] . '"', E_USER_WARNING) );
 			$result = $db->update('bugtracker_bugs', $bugId, ['resolved_date' => 'NULL', 'denied_date' => 'NULL'], __FILE__, __LINE__, __METHOD__);
@@ -129,27 +130,27 @@ static function execActions()
 			if($user->id != $rs['reporter_id'])
 			{
 				$notification_subject = t('message-subject-reopenbug', 'bugtracker', [ $user->id2user($user->id, true), $bugId ]);
-				$notification_text = sprintf('<a href="%">Bug %d anschauen</a>', SITE_URL.'/bug/'.$bugId, $bugId);
+				$notification_text = t('message-buglink', 'bugtracker', [$bugId]);
 				$notification_status = $notification->send($rs['reporter_id'], 'bugtracker', ['from_user_id'=>$user->id, 'subject'=>$notification_subject, 'text'=>$notification_text, 'message'=>$notification_text]);
 				if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> $notification_status "%s" from user=%s to user=%s', __METHOD__, __LINE__, ($notification_status===true?'true':'false'), $user->id, $rs['reporter_id']));
 			}
 
-			header('Location: '.(!empty($sanitizedReturnURL) ? $sanitizedReturnURL : '/bugtracker.php'));
+			header('Location: '.$sanitizedReturnURL);
 			exit;
 		}
 
 		/** Bug wieder freigeben (unassign) */
-		elseif (isset($_GET['action']) && $_GET['action'] === 'resign')
+		elseif ($doAction === 'resign')
 		{
 			$bugId = ( isset($_GET['bug_id']) && is_numeric($_GET['bug_id']) && $_GET['bug_id'] >= 0 ? (int)$_GET['bug_id'] : user_error('Bugtracker: invalid Bug-ID "' . $_GET['bug_id'] . '"', E_USER_WARNING) );
 			$result = $db->update('bugtracker_bugs', $bugId, ['assignedto_id' => 'NULL', 'assigned_date' => 'NULL'], __FILE__, __LINE__, __METHOD__);
 
-			header('Location: '.(!empty($sanitizedReturnURL) ? $sanitizedReturnURL : '/bugtracker.php'));
+			header('Location: '.$sanitizedReturnURL);
 			exit;
 		}
 
 		/** Bug als gelöst markieren */
-		elseif (isset($_GET['action']) && $_GET['action'] === 'resolve')
+		elseif ($doAction === 'resolve')
 		{
 			$bugId = ( isset($_GET['bug_id']) && is_numeric($_GET['bug_id']) && $_GET['bug_id'] >= 0 ? (int)$_GET['bug_id'] : user_error('Bugtracker: invalid Bug-ID "' . $_GET['bug_id'] . '"', E_USER_WARNING) );
 			$result = $db->update('bugtracker_bugs', $bugId, ['resolved_date' => timestamp(true)], __FILE__, __LINE__, __METHOD__);
@@ -161,17 +162,17 @@ static function execActions()
 			if($user->id != $rs['reporter_id'])
 			{
 				$notification_subject = t('message-subject-resolvedbug', 'bugtracker', [ $user->id2user($user->id, true), $bugId ]);
-				$notification_text = sprintf('<a href="%">Bug %d anschauen</a>', SITE_URL.'/bug/'.$bugId, $bugId);
+				$notification_text = t('message-buglink', 'bugtracker', [$bugId]);
 				$notification_status = $notification->send($rs['reporter_id'], 'bugtracker', ['from_user_id'=>$user->id, 'subject'=>$notification_subject, 'text'=>$notification_text, 'message'=>$notification_text]);
 				if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> $notification_status "%s" from user=%s to user=%s', __METHOD__, __LINE__, ($notification_status===true?'true':'false'), $user->id, $rs['reporter_id']));
 			}
 
-			header('Location: '.(!empty($sanitizedReturnURL) ? $sanitizedReturnURL : '/bugtracker.php'));
+			header('Location: '.$sanitizedReturnURL);
 			exit;
 		}
 
 		/** Bug bearbeiten */
-		elseif (isset($_GET['action']) && $_GET['action'] == 'edit')
+		elseif ($doAction === 'edit')
 		{
 			/** Validate & escape fields */
 			$bugId = ( isset($_GET['bug_id']) && is_numeric($_GET['bug_id']) && $_GET['bug_id'] >= 0 ? (int)$_GET['bug_id'] : user_error('Bugtracker: invalid Bug-ID "' . $_GET['bug_id'] . '"', E_USER_WARNING) );
@@ -190,12 +191,12 @@ static function execActions()
 																,'code_commit' => $bugCommit
 															], __FILE__, __LINE__, __METHOD__);
 
-			header('Location: '.(!empty($sanitizedReturnURL) ? $sanitizedReturnURL : '/bugtracker.php'));
+			header('Location: '.$sanitizedReturnURL);
 			exit;
 		}
 
 		/** Bug ablehnen */
-		elseif (isset($_GET['action']) && $_GET['action'] == 'deny')
+		elseif ($doAction === 'deny')
 		{
 			$bugId = ( isset($_GET['bug_id']) && is_numeric($_GET['bug_id']) && $_GET['bug_id'] >= 0 ? (int)$_GET['bug_id'] : user_error('Bugtracker: invalid Bug-ID "' . $_GET['bug_id'] . '"', E_USER_WARNING) );
 			$result = $db->update('bugtracker_bugs', $bugId, ['denied_date' => timestamp(true)], __FILE__, __LINE__, __METHOD__);
@@ -207,17 +208,17 @@ static function execActions()
 			if($user->id != $rs['reporter_id'])
 			{
 				$notification_subject = t('message-subject-deniedbug', 'bugtracker', [ $user->id2user($user->id, true), $bugId ]);
-				$notification_text = sprintf('<a href="%">Bug %d anschauen</a>', SITE_URL.'/bug/'.$bugId, $bugId);
+				$notification_text = t('message-buglink', 'bugtracker', [$bugId]);
 				$notification_status = $notification->send($rs['reporter_id'], 'bugtracker', ['from_user_id'=>$user->id, 'subject'=>$notification_subject, 'text'=>$notification_text, 'message'=>$notification_text]);
 				if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> $notification_status "%s" from user=%s to user=%s', __METHOD__, __LINE__, ($notification_status===true?'true':'false'), $user->id, $rs['reporter_id']));
 			}
 
-			header('Location: '.(!empty($sanitizedReturnURL) ? $sanitizedReturnURL : '/bugtracker.php'));
+			header('Location: '.$sanitizedReturnURL);
 			exit;
 		}
 
 		/** Add new Category */
-		elseif (isset($_GET['action']) && $_GET['action'] == 'newcategory')
+		elseif ($doAction === 'newcategory')
 		{
 			$title_sanitized = sanitize_userinput($_GET['title']);
 			$categoryTitle = ( isset($title_sanitized) && !empty($title_sanitized) ? $title_sanitized : user_error('Bugtracker: invalid Category Title "' . $_GET['title'] . '"', E_USER_WARNING) );
@@ -225,7 +226,7 @@ static function execActions()
 			/** Add new Category to DB */
 			$newBugId = $db->insert('bugtracker_categories', [ 'title' => $categoryTitle ], __FILE__, __LINE__, __METHOD__);
 
-			header('Location: '.(!empty($sanitizedReturnURL) ? $sanitizedReturnURL : '/bugtracker.php'));
+			header('Location: '.$sanitizedReturnURL);
 			exit;
 		}
 	}
@@ -249,17 +250,8 @@ static function getBugHTML($bug_id, $edit=FALSE)
 
 		$html = null;
 
-		$sql = 'SELECT
-					 bugtracker_bugs.*
-					,categories.title as category
-					,UNIX_TIMESTAMP(assigned_date) as assigned_date
-					,UNIX_TIMESTAMP(denied_date) as denied_date
-					,UNIX_TIMESTAMP(resolved_date) as resolved_date
-					,UNIX_TIMESTAMP(reported_date) as reported_date
-				 FROM bugtracker_bugs
-					 LEFT JOIN bugtracker_categories as categories ON (bugtracker_bugs.category_id = categories.id)
-				 WHERE bugtracker_bugs.id ='.$bug_id;
-		$result = $db->query($sql, __FILE__, __LINE__, __METHOD__);
+		$sql = 'SELECT bugtracker_bugs.*, categories.title as category, UNIX_TIMESTAMP(assigned_date) as assigned_date, UNIX_TIMESTAMP(denied_date) as denied_date, UNIX_TIMESTAMP(resolved_date) as resolved_date, UNIX_TIMESTAMP(reported_date) as reported_date FROM bugtracker_bugs LEFT JOIN bugtracker_categories as categories ON (bugtracker_bugs.category_id = categories.id) WHERE bugtracker_bugs.id=?';
+		$result = $db->query($sql, __FILE__, __LINE__, __METHOD__, [$bug_id]);
 		$rs = $db->fetch($result);
 
 		$reportedDate_iso8601 = date('c', $rs['reported_date']);
@@ -268,12 +260,10 @@ static function getBugHTML($bug_id, $edit=FALSE)
 
 		if($edit == TRUE)
 		{
-			$html .=
-				'<form action="/bug/'.$rs['id'].'" method="get">'
-				.'<input name="action" type="hidden" value="edit">'
-				.'<input name="bug_id" type="hidden" value="'.$rs['id'].'">'
-				.'<input name="url" type="hidden" value="'.base64url_encode(getChangedURL('action=')).'">'
-			;
+			$html .= '<form action="/bug/'.$rs['id'].'" method="get">'
+					.'<input name="action" type="hidden" value="edit">'
+					.'<input name="bug_id" type="hidden" value="'.$rs['id'].'">'
+					.'<input name="url" type="hidden" value="'.base64url_encode(getChangedURL('action=')).'">';
 		}
 
 		/** schema.org QAPage/Question "itemprop=answerCount" berechnen */
diff --git a/www/includes/strings.array.php b/www/includes/strings.array.php
index 2c840b1..e8c42d1 100644
--- a/www/includes/strings.array.php
+++ b/www/includes/strings.array.php
@@ -196,8 +196,9 @@
 			,'message-subject-newbug' => '%s hat den Bug #%d neu erstellt'
 			,'message-subject-reopenbug' => '%s hat den Bug #%d reopened'
 			,'message-subject-resolvedbug' => '%s hat den Bug #%d gelöst'
+			,'message-buglink' => '<a href="'.SITE_URL.'/bug/%1$d">Bug %1$d anschauen</a>'
 			,'message-subject-deniedbug' => '%s hat den Bug #%d denied'
-			,'message-newbug' => 'Bug Details:<br><blockquote><i>%s</i></blockquote><br><a href="%s/bug/%d">&raquo; %s</a>'
+			,'message-newbug' => 'Bug Details:<br><blockquote><i>%s</i></blockquote><br><a href="'.SITE_URL.'/bug/%d">&raquo; %s</a>'
 		]
 	,'addle' =>
 		[

From 793f3f77c5cf81ac2c89ac5fb9bbd4f63f00aa7d Mon Sep 17 00:00:00 2001
From: Oliver <github@raduner.ch>
Date: Thu, 18 Jan 2024 19:28:15 +0100
Subject: [PATCH 09/10] Resolves Bug 535

[Addle] Barbara Harris spielt nicht mit mir!
---
 www/addle.php              | 106 ++++++++++++++++++++-----------------
 www/includes/addle.inc.php |  86 +++++++++++++-----------------
 2 files changed, 93 insertions(+), 99 deletions(-)

diff --git a/www/addle.php b/www/addle.php
index 95d6f91..15a77da 100644
--- a/www/addle.php
+++ b/www/addle.php
@@ -45,10 +45,10 @@
 function use_ki($game_id) {
 	global $db;
 	$ki = false;
-	$sql = 'SELECT player1 FROM addle WHERE id = '.$game_id;
-	$result = $db->query($sql, __FILE__, __LINE__, __FUNCTION__);
+	$sql = 'SELECT player1 FROM addle WHERE id=?';
+	$result = $db->query($sql, __FILE__, __LINE__, __FUNCTION__, $game_id);
 	$rs = $db->fetch($result);
-	if($rs['player1'] == BARBARA_HARRIS) {
+	if(intval($rs['player1']) === BARBARA_HARRIS) {
 		$ki = true;
 	}
 }
@@ -97,22 +97,19 @@ function selectoption($inputname, $size, $valuearray, $array2="",$selected="", $
  *
  * Erzeugt ein neues Addle Spiel
  *
- * @author [z]bert
- * @author [z]keep3r
  * @version 3.0
- * @since 1.0 function added
- * @since 2.0 KI added
- * @since 3.0 `07.11.2018` code and sql-query optimizations, moved Constants to config.inc.php
+ * @since 1.0 `[z]keep3r` function added
+ * @since 2.0 `[z]bert` `[z]cylander` KI added
+ * @since 3.0 `07.11.2018` `IneX` code and sql-query optimizations, moved Constants to config.inc.php
  *
  * @uses MAX_ADDLE_GAMES
  * @param integer $player ID des Gegners
  * @global object $db Globales Class-Object mit allen MySQL-Methoden
  * @global object $user Globales Class-Object mit den User-Methoden & Variablen
- * @global object $smarty Globales Class-Object mit allen Smarty-Methoden
  * @global object $notification Globales Class-Object mit allen Notification-Methoden
  */
 function newgame($player) {
-	global $db, $user, $smarty, $notification;
+	global $db, $user, $notification;
 
 	$anz = $db->fetch($db->query('SELECT count(*) anz FROM addle WHERE finish=0 AND ((player1='.$user->id.' AND player2='.$player.') OR (player1='.$player.' AND player2='.$user->id.'))',
 		__FILE__, __LINE__, 'SELECT FROM addle'));
@@ -177,15 +174,13 @@ function newgame($player) {
 	$row = mt_rand(0,7);
 
 	// db-entry
-	$gameid = $db->query('INSERT INTO addle (date, player1, player2, data, nextrow) VALUES (UNIX_TIMESTAMP(?), ?, ?, ?, ?)',
-						__FILE__, __LINE__, __FUNCTION__, [timestamp(true), $player, $user->id, $board, $row]);
+	$gameid = $db->query('INSERT INTO addle (date, player1, player2, data, nextrow) VALUES (?, ?, ?, ?, ?)',
+						__FILE__, __LINE__, __FUNCTION__, [timestamp(), $player, $user->id, $board, $row]);
 	$db->query('UPDATE user SET addle="1" WHERE id=?', __FILE__, __LINE__, __FUNCTION__, [$user->id]);
 	/*========================================
 		Addle KI - start
 	========================================*/
-	if($player == 59) {
-		//include_once $_SERVER['DOCUMENT_ROOT']."/addle_ki.php";
-	}
+	use_ki($gameid);
 	/*========================================
 		Addle KI - end
 	========================================*/
@@ -208,11 +203,11 @@ function newgame($player) {
  *
  * Listet alle offenen Addle Spiele auf
  *
- * @author [z]bert
- * @version 2.1
- * @since 1.0 `bert` function added
+ * @version 2.2
+ * @since 1.0 `[z]bert` function added
  * @since 2.0 `07.11.2018` `IneX` code and sql-query optimizations
  * @since 2.1 `25.12.2022` `IneX` fixes Undefined property & Undefined variable notices
+ * @since 2.2 `17.01.2024` `IneX` switch overview order and fixes listings
  *
  * @global object $db Globales Class-Object mit allen MySQL-Methoden
  * @global object $user Globales Class-Object mit den User-Methoden & Variablen
@@ -221,63 +216,76 @@ function games()
 {
 	global $db, $user;
 
-	$i = 1;
 	$out = null;
-	echo '<h2>Laufende Spiele</h2>';
+	$out .= '<h2>Laufende Spiele</h2>';
 	/** Eingeloggte User */
 	if ($user->is_loggedin())
 	{
+		/** Meine Laufenden Spiele */
 		$e = $db->query('SELECT * FROM addle WHERE ((player1=? AND nextturn=1) OR (player2=? AND nextturn=2)) AND finish=0',
 						__FILE__, __LINE__, __FUNCTION__, [$user->id, $user->id]);
-		$num = $db->num($e);
-		if (!empty($num) && $num !== false && $num > 0)
+		$nume = $db->num($e);
+		if ($nume !== false && $nume>0)
 		{
+			$i = 1;
 			while ($d = $db->fetch($e))
 			{
-				if ($d['player1'] == $user->id || $d['player2'] == $user->id) printf('<b><a style="color:red;" href="?show=play&id=%1$d">Game #%1$d - vs. %2$s</a></b>', $d['id'], $user->id2user($d['player'.($d['player1'] == $user->id ? 2 : 1)]));
-				else printf('<b><a href="?show=play&id=%d">%s vs. %s</a></b>', $d['id'], $user->id2user($d['player1']), $user->id2user($d['player2']));
-				if ($i < $num) echo ', ';
+				$gameid = $d['id'];
+				$playerids = [ intval($d['player1']), intval($d['player2']) ];
+				if (in_array($user->id, $playerids)) {
+					$otherpl = ($playerids[0] === $user->id ? 1 : 0);
+					$out .= sprintf('<b><a style="color:red;" href="?show=play&id=%1$d">Game #%1$d vs. %2$s</a></b>', $gameid, $user->id2user($playerids[$otherpl]));
+				} else {
+					$out .= sprintf('<b><a href="?show=play&id=%d">%s vs. %s</a></b>', $gameid, $user->id2user($playerids[0]), $user->id2user($playerids[1]));
+				}
+				if ($i < $nume) $out .= '<br>';
 				$i++;
 			}
 		} else {
 			echo '<b>Keine laufenden Addle Spiele</b>';
 		}
 
-		/** Meine Laufenden Spiele */
+		/** Warten auf den Gegner */
 		$s = $db->query('SELECT * FROM addle WHERE ((player1=? AND nextturn=2) OR (player2=? AND nextturn=1)) AND finish=0',
 						__FILE__, __LINE__, __FUNCTION__, [$user->id, $user->id]);
-		$num = $db->num($s);
-		if (!empty($num) || $num > 0)
+		$nums = $db->num($s);
+		if ($nums !== false && $nums>0)
 		{
-			echo '<h2>Warten auf deinen Gegner</h2>';
+			$out .= '<h3>Warten auf deinen Gegner</h3>';
 			$i = 1;
-			while ($m = $db->fetch($s)) {
-				if ($m['player1'] != $user->id) {
-						$otherpl = $m['player1'];
-				} else {
-						$otherpl = $m['player2'];
-				}
-				printf('<a href="?show=play&id=%1$d">Game #%1$d - <b>%2$s</b></a>', $m['id'], $user->id2user($otherpl, true));
-				if ($i < $num) $out .= ', ';
+			while ($m = $db->fetch($s))
+			{
+				$gameid = intval($m['id']);
+				$player1id = intval($m['player1']);
+				$player2id = intval($m['player2']);
+				$otherpl = ($player1id !== $user->id ? $player1id : $player2id);
+				$out .= sprintf('<a href="?show=play&id=%1$d">Game #%1$d - <b>%2$s</b></a>', $gameid, $user->id2user($otherpl, true));
+				if ($i < $nums) $out .= ', ';
 				$i++;
 			}
 		}
 	}
 	/** Nicht eingeloggte User */
 	else {
-		$e = $db->query('SELECT * FROM addle WHERE finish=0', __FILE__, __LINE__, __FUNCTION__);
-		$num = $db->num($e);
-		if (!empty($num) && $num !== false && $num > 0)
+		$t = $db->query('SELECT * FROM addle WHERE finish=0', __FILE__, __LINE__, __FUNCTION__);
+		$numt = $db->num($t);
+		if ($numt !== false && $numt>0)
 		{
-			while ($d = $db->fetch($e)) {
-				printf('<b><a href="?show=play&id=%d">%s vs. %s</a></b>', $d['id'], $user->id2user($d['player1']), $user->id2user($d['player2']));
-				if ($i < $num) echo ', ';
+			$i = 1;
+			while ($n = $db->fetch($t))
+			{
+				$gameid = intval($n['id']);
+				$player1id = intval($n['player1']);
+				$player2id = intval($n['player2']);
+				$out .= sprintf('<b><a href="?show=play&id=%d">%s vs. %s (#%1$d)</a></b>', $gameid, $user->id2user($player1id), $user->id2user($player2id));
+				if ($i < $numt) $out .= ' | ';
 				$i++;
 			}
 		} else {
-			echo '<b>Keine laufenden Addle Spiele</b>';
+			$out .= '<b>Keine laufenden Addle Spiele</b>';
 		}
 	}
+	echo $out;
 }
 
 
@@ -298,6 +306,9 @@ function games()
 function overview() {
 	global $db, $user, $smarty;
 
+	/** Laufende Addle Games auflisten */
+	games();
+
 	/** New Addle Game-Formular anzeigen */
 	if ($user->is_loggedin())
 	{ ?>
@@ -324,9 +335,6 @@ function overview() {
 	<?php
 	}
 
-	/** Laufende Addle Games auflisten */
-	games();
-
 	echo '<h2>Anleitung</h2>';
 	echo t('howto', 'addle');
 }
@@ -399,8 +407,8 @@ function doplay($id, $choose) {
 						}
 					}
 					/** db entry zug */
-					$sql = 'UPDATE addle SET date=UNIX_TIMESTAMP(?), score'.$d['nextturn'].'=?, data=?, nextturn=?, nextrow=?, finish=?, last_pick_data=?, last_pick_row=? WHERE id=?';
-					$result = $db->query($sql, __FILE__, __LINE__, __FUNCTION__, [timestamp(true), $score, $data, $nextturn, $choose, $finish, ord($act)-96, $d['nextrow'], $id]);
+					$sql = 'UPDATE addle SET date=?, score'.$d['nextturn'].'=?, data=?, nextturn=?, nextrow=?, finish=?, last_pick_data=?, last_pick_row=? WHERE id=?';
+					$result = $db->query($sql, __FILE__, __LINE__, __FUNCTION__, [timestamp(), $score, $data, $nextturn, $choose, $finish, ord($act)-96, $d['nextrow'], $id]);
 					if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> db entry zug $sql: %s => %s', __METHOD__, __LINE__, ($result?'SUCCESS':'ERROR'),$sql));
 
 					/** Notification */
diff --git a/www/includes/addle.inc.php b/www/includes/addle.inc.php
index 6800e1e..d8f305d 100644
--- a/www/includes/addle.inc.php
+++ b/www/includes/addle.inc.php
@@ -4,16 +4,15 @@
  *
  * Beinhaltet diverse Zusatzfunktionen für Addle
  *
- * @author [z]biko
- * @version 1.0
  * @package zorg\Games\Addle
  */
+
 /**
  * File includes
  * @include config.inc.php required
  * @include mysql.inc.php required
  */
-require_once dirname(__FILE__).'/config.inc.php';
+require_once __DIR__.'/config.inc.php';
 require_once INCLUDES_DIR.'mysql.inc.php';
 
 /**
@@ -21,10 +20,9 @@
  *
  * Liefert den Text für die Startseite, wieviele Addle Games eines Benutzers noch offen sind.
  *
- * @author [z]biko
  * @version 2.0
- * @since 1.0 function added
- * @since 2.0 `07.11.2018` code and sql-query optimizations, moved Constants to config.inc.php
+ * @since 1.0 `[z]biko` function added
+ * @since 2.0 `07.11.2018` `IneX` code and sql-query optimizations, moved Constants to config.inc.php
  *
  * @param integer $user_id ID des Users
  * @global object $db Globales Class-Object mit allen MySQL-Methoden
@@ -48,11 +46,11 @@ function getOpenAddleGames($user_id)
  *
  * Entfernt ganz alte Addle spiele (> 3 Monate [15 Wochen])
  *
- * @author [z]biko
- * @version 1.0
- * @since 1.0 function added
- * @since 2.0 `15.11.2018` updated to use new $notifcation Class & some code and query optimizations
+ * @version 2.0
+ * @since 1.0 `[z]biko` function added
+ * @since 2.0 `15.11.2018` `IneX` updated to use new $notifcation Class & some code and query optimizations
  *
+ * @uses Notification()
  * @global object $db Globales Class-Object mit allen MySQL-Methoden
  * @global object $notification Globales Class-Object mit allen Notification-Methoden
  * @return boolean Returns true or false depending on successful execution
@@ -60,7 +58,7 @@ function getOpenAddleGames($user_id)
 function addle_remove_old_games() {
 	global $db, $notification;
 
-	$e = $db->query('SELECT * FROM addle WHERE finish=0 and UNIX_TIMESTAMP(NOW()) - date > (60*60*24*7*15)', __FILE__, __LINE__, __FUNCTION__);
+	$e = $db->query('SELECT * FROM addle WHERE finish=0 and UNIX_TIMESTAMP(?)-date > (60*60*24*7*15)', __FILE__, __LINE__, __FUNCTION__, [timestamp(true)]);
 	while ($d = $db->fetch($e)) {
 		if ($d['nextturn'] == 1) {
 			$winner = $d['player2'];
@@ -97,8 +95,8 @@ function addle_remove_old_games() {
  *
  * Zeigt die Highscore Liste der Addle DWZ an
  *
- * @author [z]biko
  * @version 1.0
+ * @since `[z]biko` function added
  *
  * @param integer $anzahl Anzahl Zeilen, welche ausgegeben werden sollen
  * @global object $db Globales Class-Object mit allen MySQL-Methoden
@@ -116,8 +114,8 @@ function highscore_dwz($anzahl)
 	  . '   WHERE u.id = dwz.user && a.finish=1'
 	  . '   GROUP BY u.id'
 	  . '   ORDER BY dwz.rank ASC '
-	  . '   LIMIT 0, '.$anzahl;
-	$e = $db->query($sql, __FILE__, __LINE__, __FUNCTION__);
+	  . '   LIMIT 0,?';
+	$e = $db->query($sql, __FILE__, __LINE__, __FUNCTION__, [$anzahl]);
 
 	$html = '<h1>Addle Highscores</h1>
 			<table>
@@ -167,13 +165,11 @@ function highscore_dwz($anzahl)
  *
  * Aktualisiert die DWZ Punkte eines Benutzers
  *
- * @author [z]biko
  * @version 2.0
- * @since 1.0 function added
- * @since 2.0 `07.11.2018` code and sql-query optimizations, moved Constants to config.inc.php
+ * @since 1.0 `[z]biko` function added
+ * @since 2.0 `07.11.2018` `IneX` code and sql-query optimizations, moved Constants to config.inc.php
  *
- * @uses ADDLE_BASE_POINTS
- * @uses ADDLE_MAX_POINTS_TRANSFERABLE
+ * @uses ADDLE_BASE_POINTS, ADDLE_MAX_POINTS_TRANSFERABLE
  * @param integer $user_id ID des Users
  * @global object $db Globales Class-Object mit allen MySQL-Methoden
  */
@@ -262,11 +258,11 @@ function _update_dwz($user_id) {
  * um möglichst viele Punkte zu machen aber dem
  * Gegner nur kleine Punkte zur Wahl zu lassen
  *
- * @author [z]stamp
- * @author [z]cylander
  * @version 1.0
+ * @since 1.0 `[z]stamp` `[z]cylander` KI zum Leben erweckt
+ * @since 1.1 `17.01.2024` `IneX` Bug #535 : Barbara Harris spielt nicht mit mir!
  *
- * @param integer $game_data_array
+ * @param array $game_data_array
  * @param integer $row
  * @param integer $score_self
  * @param integer $score_chind
@@ -336,7 +332,7 @@ function evil_max($game_data_array, $row, $score_self, $score_chind, $depth, $mo
 			$game_data_array[$row*8 + $to_select] = ".";
 			}
 			else $game_data_array[$row + $to_select*8] = ".";
-			$new_data['game_data'] = join($game_data_array, null);
+			$new_data['game_data'] = implode('', $game_data_array);
 			$new_data['row'] = $to_select;
 			$new_data['score'] = ($score_self + ord($row_data[$to_select])) - 96;
 
@@ -355,11 +351,11 @@ function evil_max($game_data_array, $row, $score_self, $score_chind, $depth, $mo
  * Ermittelt, welches das kleinste Feld für die KI ist,
  * um dem Gegner möglichst wenig Punkte zur Wahl zu lassen
  *
- * @author [z]stamp
- * @author [z]cylander
- * @version 1.0
+ * @version 1.1
+ * @since 1.0 `[z]stamp` `[z]cylander` KI zum Leben erweckt
+ * @since 1.1 `17.01.2024` `IneX` Bug #535 : Barbara Harris spielt nicht mit mir!
  *
- * @param integer $game_data_array
+ * @param array $game_data_array
  * @param integer $row
  * @param integer $score_self
  * @param integer $score_chind
@@ -413,19 +409,19 @@ function evil_min($game_data_array, $row, $score_self, $score_chind, $depth, $mo
 	return $score_self - $score_chind + 2000;
 }
 
-$sql = 'SELECT * FROM addle WHERE ((player1 = '.BARBARA_HARRIS.' OR player2 = '.BARBARA_HARRIS.') AND (player1 = 1 OR player2 = 1) AND finish = 0)';
-$result = $db->query($sql,__LINE__,__FILE__);
+$sql = 'SELECT * FROM addle WHERE ((player1=? AND nextturn=1) OR (player2=? AND nextturn=2)) AND finish=0';
+$result = $db->query($sql, __LINE__, __FILE__, __FUNCTION__, [BARBARA_HARRIS, BARBARA_HARRIS]);
 while($rs = $db->fetch($result)) {
 	$data = $rs['data'];
-	$nextturn = $rs['nextturn'];
-	$nextrow = $rs['nextrow'];
-	$game_id = $rs['id'];
+	$nextturn = intval($rs['nextturn']);
+	$nextrow = intval($rs['nextrow']);
+	$game_id = intval($rs['id']);
 	$new_nextturn = $nextturn;
 	$checker = 0;
 
 	$data = preg_split("[]", $data, 0, PREG_SPLIT_NO_EMPTY);
 
-	if($rs['player1'] == BARBARA_HARRIS && $nextturn == 1) {
+	if(intval($rs['player1']) === BARBARA_HARRIS && $nextturn === 1) {
 		$mode = 1;
 		$score_self = $rs['score1'];
 	    $score_chind = $rs['score2'];
@@ -433,7 +429,7 @@ function evil_min($game_data_array, $row, $score_self, $score_chind, $depth, $mo
 		$new_data = evil_max($data , $nextrow , $score_self, $score_chind,$max_depth, $mode);
 		$checker = 1;
 		$my_score = "score1";
-	} elseif($rs['player2'] == BARBARA_HARRIS && $nextturn == 2) {
+	} elseif(intval($rs['player2']) === BARBARA_HARRIS && $nextturn === 2) {
 		$mode = 2;
 		$score_self = $rs['score2'];
 		$score_chind = $rs['score1'];
@@ -443,21 +439,11 @@ function evil_min($game_data_array, $row, $score_self, $score_chind, $depth, $mo
 		$my_score = "score2";
 	}
 
-	if ($checker == 1) {
-		$sql = 'UPDATE addle
-				SET
-					data = "'.$new_data['game_data'].'",
-					nextturn = '.$new_nextturn.',
-					nextrow = "'.$new_data['row'].'",
-					'.$my_score.' = '.$new_data['score'].',
-					date = '.timestamp(true);
-		if($new_data['row'] != 23) {
-			$sql_add = '';
-		} else {
-			$sql_add = ', finish = 1 ';
-		}
-		$sql = $sql.$sql_add.' WHERE id = '.$game_id;
-		echo $sql;
-		$db->query($sql,__LINE__,__FILE__,'UPDATE addle');
+	if ($checker === 1) {
+		$sql_add = '';
+		$sql = 'UPDATE addle SET data=?, nextturn=?, nextrow=?, '.$my_score.'=?, date=?';
+		if(intval($new_data['row']) === 23) $sql_add = ', finish=1';
+		$sql = $sql.$sql_add.' WHERE id=?';
+		$db->query($sql, __LINE__, __FILE__, 'UPDATE addle KI Zug', [$new_data['game_data'], $new_nextturn, $new_data['row'], $new_data['score'], timestamp(), $game_id]);
 	}
 }

From ac7c8157cf1b07cdb47d7eacb0fb16f4b2de29c5 Mon Sep 17 00:00:00 2001
From: Oliver <github@raduner.ch>
Date: Thu, 18 Jan 2024 19:48:31 +0100
Subject: [PATCH 10/10] Mitigates SQL injects through Prepared Statements

---
 www/addle.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/www/addle.php b/www/addle.php
index 15a77da..0a6fc4a 100644
--- a/www/addle.php
+++ b/www/addle.php
@@ -111,11 +111,11 @@ function selectoption($inputname, $size, $valuearray, $array2="",$selected="", $
 function newgame($player) {
 	global $db, $user, $notification;
 
-	$anz = $db->fetch($db->query('SELECT count(*) anz FROM addle WHERE finish=0 AND ((player1='.$user->id.' AND player2='.$player.') OR (player1='.$player.' AND player2='.$user->id.'))',
-		__FILE__, __LINE__, 'SELECT FROM addle'));
+	$sql = 'SELECT COUNT(*) anz FROM addle WHERE finish=0 AND ((player1=? AND player2=?) OR (player1=? AND player2=?))';
+	$anz = $db->fetch($db->query($sql, __FILE__, __LINE__, 'SELECT FROM addle', [$user->id, $player, $player, $user->id]));
 	if ($anz['anz'] > MAX_ADDLE_GAMES) user_error(t('error-game-max-limit-reached'), E_USER_NOTICE);
 
-	$e = $db->query('SELECT addle FROM user WHERE id='.$player, __FILE__, __LINE__, 'SELECT FROM user');
+	$e = $db->query('SELECT addle FROM user WHERE id=?', __FILE__, __LINE__, 'SELECT FROM user', [$player]);
 	$d = $db->fetch($e);
 
 	if (!$player || $player == $user->id || $d['addle'] !=1) {
@@ -800,7 +800,7 @@ function archiv() {
 				<td>&nbsp;</td>
 		</tr>	<?php
 
-		$e = $db->query('SELECT * FROM addle WHERE (player1='.$uid.' OR player2='.$uid.') ORDER BY date DESC', __FILE__, __LINE__, __FUNCTION__);
+		$e = $db->query('SELECT * FROM addle WHERE (player1=? OR player2=?) ORDER BY date DESC', __FILE__, __LINE__, __FUNCTION__, [$uid, $uid]);
 		$i = 0;
 		while ($d = $db->fetch($e))
 		{