in the create gang function:
function gang_create() {
global $gvars;
if ($gvars->ir['gang']) {
echo "<h3>You are in a $gvars->name_sl!</h3>";
_gang_auto_clear_user($gvars->ir['userid'], $gvars->ir['gang']);
return;
}
$cost_f = $gvars->new_gang_money_prefix . number_format($gvars->new_gang_price);
if (strlen($gvars->gang_name_allowable_special_characters) > 0) {
$sp_chars = '
It may also contain these special characters: ' . $gvars->gang_name_allowable_special_characters;
} else {
$sp_chars = '';
}
echo <<<EOT
<h3>Creating a New $gvars->name_su</h3>
<p class="center">It costs $cost_f to start a new $gvars->name_sl.</p>
<p class="center">
The $gvars->name_sl name must start with a letter, can contain letters, numbers. $sp_chars
</p>
<form method="post" action="gangs.php?action=gang_create2">
<ul class="right bold" style="width: 300px; margin: 0 auto; border: 1px solid #d2ae04; background-color: #727843; padding: 4px">
[*]$gvars->name_su Name: <input type="text" name="name" style="width: 150px">
[*]$gvars->name_su Tag: <input type="text" name="prefix" style="width: 150px">
<li class="center">
Description:</p>
<textarea name="description" style="width: 95%; height: 100px"></textarea></p>
<li class="center">
<input type="submit" value="Create">
[/list]
</form>
EOT;
}
function gang_create2() {
global $gvars, $ir;
if ($gvars->ir['gang']) {
echo "<h3>You are in a $gvars->name_sl!</h3>";
_gang_auto_clear_user($gvars->ir['userid'], $gvars->ir['gang']);
return;
}
$cost_f = $gvars->new_gang_money_prefix . number_format($gvars->new_gang_price);
if ($ir[$gvars->new_gang_db_field] < $gvars->new_gang_price) {
echo "<h3>You can't afford the price of $cost_f to create a new $gvars->name_sl.</h3>";
return;
}
if (!isset($_REQUEST['name']) or strlen($_REQUEST['name']) < 1 or !$gvars->check_gang_name_allowable_special_characters($_REQUEST['name']) or !ctype_alpha(substr($_REQUEST['name'], 0, 1))) {
$name = $ir['username'] . "'s " . $gvars->name_su;
} else {
$name = $_REQUEST['name'];
}
if (!isset($_REQUEST['prefix']) or strlen($_REQUEST['prefix']) > $gvars->gang_prefix_max_length) {
$prefix = '';
} else {
$prefix = $_REQUEST['prefix'];
}
if (!isset($_REQUEST['description'])) {
$description = '';
} else {
$description = $_REQUEST['description'];
}
if (!gang_take_money($ir['userid'], $gvars->new_gang_price, $gvars->new_gang_db_field)) {
echo "<h3>You don't have enough money create a $gvars->name_sl.</h3>";
return;
}
$q_set = sprintf('insert into gangs (gangNAME, gangDESC, gangPREF, gangSUFF, gangMONEY, gangCRYSTALS,
gangRESPECT, gangPRESIDENT, gangVICEPRES, gangCAPACITY, gangCRIME, gangCHOURS, gangAMENT)
values ("%s", "%s", "%s", "", 0, 0, 100, %d, %d, 5, 0, 0, "")',
$gvars->escape($name), $gvars->escape($description), $gvars->escape($prefix), $ir['userid'], $ir['userid']);
mysql_query($q_set);
if (mysql_affected_rows() < 1) {
echo "<h3>The $gvars->name_sl could not be created.</h3>";
gang_go_back('gangs.php?action=gang_create');
return;
}
$q_set = sprintf('update users set gang = %d where userid = %d', mysql_insert_id(), $ir['userid']);
mysql_query($q_set);
echo "<h3>Your $gvars->name_sl, $name, has been created!</h3>";
gang_go_back('yourgang.php');
}
it says (line 54-57):
if (!isset($_REQUEST['name']) or strlen($_REQUEST['name']) < 1 or !$gvars->check_gang_name_allowable_special_characters($_REQUEST['name']) or !ctype_alpha(substr($_REQUEST['name'], 0, 1))) { $name = $ir['username'] . "'s " . $gvars->name_su; } else { $name = $_REQUEST['name']; }
this first picks [username]'s gang and checks if its allowable
if not it picks the requested name
should that not be:
if (!isset($_REQUEST['name']) or strlen($_REQUEST['name']) < 1 or !$gvars->check_gang_name_allowable_special_characters($_REQUEST['name']) or !ctype_alpha(substr($_REQUEST['name'], 0, 1))) { $name = $_REQUEST['name']; } else { $name = $ir['username'] . "'s " . $gvars->name_su; }
that way it first checks the requested name and if that is not allowed it picks [username]'s gang
