From fb48518bc6a1232c1127b7d52e3c53413496a4dd Mon Sep 17 00:00:00 2001
From: speedie <speedie@speedie.site>
Date: Tue, 27 Feb 2024 17:37:09 +0100
Subject: [PATCH] Fix a serious bug

---
 account.php   |  6 +++---
 admin.php     |  2 +-
 core.php      |  2 +-
 edit-page.php |  2 +-
 edit.php      | 10 +++++-----
 login.php     |  2 +-
 register.php  |  2 +-
 setup.php     |  2 +-
 8 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/account.php b/account.php
index a3fe736..b6b0df1 100755
--- a/account.php
+++ b/account.php
@@ -81,7 +81,7 @@ $html .= "\t\t\t\t<p>This is where you can change account options.</p>\n";
 if ($allowPasswordChange || $IsCurrentUser) {
     $html .= "\t\t\t\t<h2>Change password</h2>\n";
     $html .= "\t\t\t\t\t<p>If you need to change your password, you can do so here:</p>\n";
-    $html .= "\t\t\t\t\t<form action=\"change.php\" method=\"post\" class=\"changePass\">\n";
+    $html .= "\t\t\t\t\t<<form method=\"POST\" action=\"change.php\" method=\"post\" class=\"changePass\">\n";
 
     if ($IsCurrentUser) {
         $html .= "\t\t\t\t\t\t<label for=\"curpass\">Current password</label>\n";
@@ -112,7 +112,7 @@ if ($allowPasswordChange || $IsCurrentUser) {
 if ($allowUsernameChange || !$IsCurrentUser) {
     $html .= "\t\t\t\t<h2>Change username</h2>\n";
     $html .= "\t\t\t\t\t<p>If you need to change your username, you can do so here:</p>\n";
-    $html .= "\t\t\t\t\t<form action=\"change.php\" method=\"post\" class=\"changeUser\">\n";
+    $html .= "\t\t\t\t\t<<form method=\"POST\" action=\"change.php\" method=\"post\" class=\"changeUser\">\n";
 
     if ($IsCurrentUser) {
         $html .= "\t\t\t\t\t\t<label for=\"curusername\">Current username</label>\n";
@@ -143,7 +143,7 @@ if (!$IsCurrentUser) {
     $html .= "\t\t\t\t<h2>Administrator: Change type</h2>\n";
     $html .= "\t\t\t\t\t<p>If you need to change the type, you can do so here:</p>\n";
 
-    $html .= "\t\t\t\t\t<form action=\"change.php\" method=\"post\" class=\"changeType\">\n";
+    $html .= "\t\t\t\t\t<<form method=\"POST\" action=\"change.php\" method=\"post\" class=\"changeType\">\n";
     $html .= "\t\t\t\t\t\t<label for=\"type\">New type</label>\n";
     $html .= "\t\t\t\t\t\t<select name=\"type\" required>\n";
     if ($Primary == 1) $html .= "\t\t\t\t\t\t\t<option value=\"2\">Administrator</option>\n";
diff --git a/admin.php b/admin.php
index 3e42289..d243378 100755
--- a/admin.php
+++ b/admin.php
@@ -119,7 +119,7 @@ if ($Action == "comments") {
 
     $html .= "\t\t\t\t</table>\n";
 } else if ($Action == "create") {
-    $html .= "\t\t\t\t<form class=\"adminCreateForm\" action=\"create-user.php?redir=admin\" method=\"post\">\n";
+    $html .= "\t\t\t\t<<form method=\"POST\" class=\"adminCreateForm\" action=\"create-user.php?redir=admin\" method=\"post\">\n";
     $html .= "\t\t\t\t\t<label for=\"type\">User type</label>\n";
     $html .= "\t\t\t\t\t<select name=\"type\" required>\n";
 
diff --git a/core.php b/core.php
index b669584..3b6ea94 100755
--- a/core.php
+++ b/core.php
@@ -92,7 +92,7 @@ function printCommentField($html, $id, $pageID) {
 
     if (isset($_SESSION['username'])) {
         $html .= "\t\t\t\t\t<p id=\"comment_p\" class=\"comment_p\">Have anything to say? Feel free to comment it below:</p>\n";
-        $html .= "\t\t\t\t\t<form class=\"commentWriteForm\" action=\"/comment.php?id=$id&retid=$pageID\" method=\"post\">\n";
+        $html .= "\t\t\t\t\t<<form method=\"POST\" class=\"commentWriteForm\" action=\"/comment.php?id=$id&retid=$pageID\" method=\"post\">\n";
         $html .= "\t\t\t\t\t\t<br><textarea id=\"commentWriteArea\" class=\"commentWriteArea\" name=\"body\" rows=\"8\" cols=\"50\"></textarea>\n";
         $html .= "\t\t\t\t\t\t<br><br><input type=\"submit\" value=\"Comment\">\n";
         $html .= "\t\t\t\t\t\t<br><br>\n";
diff --git a/edit-page.php b/edit-page.php
index d88697d..ce6fa5b 100755
--- a/edit-page.php
+++ b/edit-page.php
@@ -67,7 +67,7 @@ $html = "";
 $html = printHeader($html, 0);
 
 $html .= "\t\t\t<h1>Editing '$defaultEndpoint'</h1>\n";
-$html .= "\t\t\t\t<form class=\"pageWriteForm\" action=\"/post-edit.php?redir=edit-page&id=$postID\" method=\"post\">\n";
+$html .= "\t\t\t\t<<form method=\"POST\" class=\"pageWriteForm\" action=\"/post-edit.php?redir=edit-page&id=$postID\" method=\"post\">\n";
 $html .= "\t\t\t\t\t<br><textarea id=\"pageWriteArea\" class=\"pageWriteArea\" name=\"body\" rows=\"32\" cols=\"98\">$defaultText</textarea>\n";
 $html .= "\t\t\t\t\t<br><br><label for=\"message\">Message</label>\n";
 $html .= "\t\t\t\t\t<input type=\"text\" name=\"message\" placeholder=\"Fix typo in blog post\"><br>\n";
diff --git a/edit.php b/edit.php
index 94006d7..918fa52 100755
--- a/edit.php
+++ b/edit.php
@@ -153,15 +153,15 @@ if ($Action == "write") {
     }
 
     $html .= "\t\t\t\t<p class=\"pageWarning\"><strong>Switching tab will delete changes made to the Markdown document. Press 'Save' to avoid this.</strong></p>\n";
-    $html .= "\t\t\t\t<form class=\"newForm\" action=\"/edit.php\"><input type=\"submit\" value=\"New\"></form>\n";
+    $html .= "\t\t\t\t<<form method=\"POST\" class=\"newForm\" action=\"/edit.php\"><input type=\"submit\" value=\"New\"></form>\n";
 
     if ($postID == -1) {
-        $html .= "\t\t\t\t<form class=\"pageWriteForm\" action=\"/create.php?redir=edit\" method=\"post\">\n";
+        $html .= "\t\t\t\t<<form method=\"POST\" class=\"pageWriteForm\" action=\"/create.php?redir=edit\" method=\"post\">\n";
     } else {
         if ($Request == "true") {
-            $html .= "\t\t\t\t<form class=\"pageWriteForm\" action=\"/update.php?redir=edit&id=$postID&request=true\" method=\"post\">\n";
+            $html .= "\t\t\t\t<<form method=\"POST\" class=\"pageWriteForm\" action=\"/update.php?redir=edit&id=$postID&request=true\" method=\"post\">\n";
         } else {
-            $html .= "\t\t\t\t<form class=\"pageWriteForm\" action=\"/update.php?redir=edit&id=$postID\" method=\"post\">\n";
+            $html .= "\t\t\t\t<<form method=\"POST\" class=\"pageWriteForm\" action=\"/update.php?redir=edit&id=$postID\" method=\"post\">\n";
         }
     }
 
@@ -196,7 +196,7 @@ if ($Action == "write") {
         $html .= "\t\t\t\t<p class=\"pageSuccess\">$Date: Your changes have been saved.</p>\n";
     }
 } else if ($Action == "attachments") {
-    $html .= "\t\t\t\t<form class=\"pageFileUploadForm\" action=\"/upload.php?redir=edit\" method=\"post\" enctype=\"multipart/form-data\">\n";
+    $html .= "\t\t\t\t<<form method=\"POST\" class=\"pageFileUploadForm\" action=\"/upload.php?redir=edit\" method=\"post\" enctype=\"multipart/form-data\">\n";
     $html .= "\t\t\t\t\t<br><input type=\"file\" name=\"file\" id=\"file\">\n";
     $html .= "\t\t\t\t\t<input type=\"submit\" value=\"Upload selected file\" id=\"upload\" name=\"upload\">\n";
     $html .= "\t\t\t\t</form>\n";
diff --git a/login.php b/login.php
index 9b2b3dc..046e5a4 100755
--- a/login.php
+++ b/login.php
@@ -161,7 +161,7 @@ if (isset($_REQUEST['username']) && isset($_REQUEST['password'])) {
 
     $html .= "\t\t\t<h1 id='loginHeader'>Login</h1>\n";
     $html .= "\t\t\t\t<p>Enter your username and password to continue.</p>\n";
-    $html .= "\t\t\t\t<form action=\"login.php\">\n";
+    $html .= "\t\t\t\t<<form method=\"POST\" action=\"login.php\">\n";
     $html .= "\t\t\t\t\t<input type=\"text\" name=\"username\" placeholder=\"Username\">\n";
     $html .= "\t\t\t\t\t<input type=\"password\" name=\"password\" placeholder=\"Password\">\n";
     if (isset($Redirect)) $html .= "\t\t\t\t\t<input type=\"hidden\" name=\"redir\" value=\"$Redirect\">\n";
diff --git a/register.php b/register.php
index f8f703f..600d6ec 100755
--- a/register.php
+++ b/register.php
@@ -57,7 +57,7 @@ if (isset($_REQUEST['username']) && isset($_REQUEST['password'])) {
 
     $html .= "\t\t\t<h1 id='registerHeader'>Welcome to $instanceName</h1>\n";
     $html .= "\t\t\t\t<p>To create an account, enter your desired user name and password.</p>\n";
-    $html .= "\t\t\t\t<form action=\"register.php\">\n";
+    $html .= "\t\t\t\t<<form method=\"POST\" action=\"register.php\">\n";
     $html .= "\t\t\t\t\t<input type=\"text\" name=\"username\" placeholder=\"Username\">\n";
     $html .= "\t\t\t\t\t<input type=\"password\" name=\"password\" placeholder=\"Password\">\n";
     $html .= "\t\t\t\t\t<input type=\"password\" name=\"cpassword\" placeholder=\"Confirm password\">\n";
diff --git a/setup.php b/setup.php
index db7769d..7bf7fd6 100755
--- a/setup.php
+++ b/setup.php
@@ -17,7 +17,7 @@ $html = printHeader($html, 0);
 $html .= "\t\t\t<h1>Welcome</h1>\n";
 $html .= "\t\t\t\t<p>Before csgen can be used, an administrator user must be created.</p>\n";
 
-$html .= "\t\t\t\t<form class=\"adminCreateForm\" action=\"create-user.php?redir=setup\" method=\"post\">\n";
+$html .= "\t\t\t\t<<form method=\"POST\" class=\"adminCreateForm\" action=\"create-user.php?redir=setup\" method=\"post\">\n";
 $html .= "\t\t\t\t\t<label for=\"username\">Username</label>\n";
 $html .= "\t\t\t\t\t<input type=\"text\" name=\"username\" placeholder=\"Username\">\n";
 $html .= "\t\t\t\t\t<label for=\"password\">Password</label>\n";