Bug in hack mod but author is not responding

[kevius]

Hello,

I'm French. I have a big problem with a vBulletin 4.2 mod :

https://vborg.vbsupport.ru/showthread.php?t=232556

The author is not here since march 2016...

The bug is : if a subject have " or ' character the hack make a SQL error when using it !

" and ' are typicaly french characters and i need a bug fix for this hack.

Is there anybody for this bug fix ?

Here it is the source code of the hack :

<?xml version="1.0" encoding="ISO-8859-1"?>

<product productid="wog_captit" active="1">
    <title>WoG - Change All Post Title In Thread</title>
    <description />
    <version>1.1.0</version>
    <url><![CDATA[https://vborg.vbsupport.ru/misc.php?do=producthelp&pid=wog_captit]]></url>
    <versioncheckurl><![CDATA[https://vborg.vbsupport.ru/misc.php?do=productcheck&pid=wog_captit]]></versioncheckurl>
    <dependencies>
        <dependency dependencytype="vbulletin" minversion="4.0.0" maxversion="" />
    </dependencies>
    <codes>
    </codes>
    <templates>
    </templates>
    <stylevardfns>
    </stylevardfns>
    <stylevars>
    </stylevars>
    <plugins>
        <plugin active="1" executionorder="5">
            <title>WoG - CAPTIT - Threadmanage Display</title>
            <hookname>threadmanage_complete</hookname>
            <phpcode><![CDATA[if ($vbulletin->options['wog_captit_enable'] AND $_REQUEST['do'] == 'editthread') 
{
    $wog_input = array('<label for="cb_open">');
    $wog_output = array('
                    <label for="wog_setall">
                        <input type="checkbox" name="wog_setall" value="yes" id="wog_setall" /> ' . $vbphrase['wog_setall'] . '
                    </label>
                </li>
                <li>
                    <label for="wog_prefixadd">
                        &nbsp;&nbsp;&nbsp;<input type="checkbox" name="wog_prefixadd" value="yes" id="wog_prefixadd" /> ' . construct_phrase($vbphrase['wog_prefixadd'], $vbulletin->options['wog_captit_prefix']) . '
                    </label>
                </li>
                <li>
                    <label for="cb_open">');
    $vbulletin->templatecache['threadadmin_editthread'] = str_replace($wog_input, $wog_output, $vbulletin->templatecache['threadadmin_editthread']);
}]]></phpcode>
        </plugin>
        <plugin active="1" executionorder="5">
            <title>WoG - CAPTIT - Threadmanage Init</title>
            <hookname>threadmanage_update</hookname>
            <phpcode><![CDATA[if ($vbulletin->options['wog_captit_enable'])
{
    $vbulletin->input->clean_array_gpc('p', array(
            'wog_setall'        => TYPE_BOOL,
            'wog_prefixadd'        => TYPE_BOOL,
    ));
    if ($vbulletin->GPC['wog_setall'])
    {
        if ($vbulletin->GPC['wog_prefixadd'])
        {
            $db->query_write("
                UPDATE `" . TABLE_PREFIX . "post` AS `post`
                SET `post`.`title` = '" . $vbulletin->options['wog_captit_prefix'] . $vbulletin->GPC['title'] . "'
                WHERE `post`.`threadid` = '" . $threadinfo['threadid'] . "'
                AND `post`.`postid` != '" . $threadinfo['firstpostid'] . "'
            ");
        }
        else
        {
            $db->query_write("
                UPDATE `" . TABLE_PREFIX . "post` AS `post`
                SET `post`.`title` = '" . $vbulletin->GPC['title'] . "'
                WHERE `post`.`threadid` = '" . $threadinfo['threadid'] . "'
            ");
        }
    }
}]]></phpcode>
        </plugin>
    </plugins>
    <phrases>
        <phrasetype name="Thread Management" fieldname="threadmanage">
            <phrase name="wog_setall" date="1262972458" username="WoG" version="1.0.0"><![CDATA[Set the title of this thread as the title of all posts in this thread]]></phrase>
            <phrase name="wog_prefixadd" date="0" username="WoG" version="1.1.0"><![CDATA[Add predefined prefix ({1}) to all posttitles excepting first post]]></phrase>
        </phrasetype>
        <phrasetype name="vBulletin Settings" fieldname="vbsettings">
            <phrase name="setting_wog_captit_enable_desc" date="0" username="WoG" version="1.0.0"><![CDATA[If 'Yes' - the modification is on.<br /> If 'No'- despite the setting - the modification is turned off.]]></phrase>
            <phrase name="setting_wog_captit_enable_title" date="0" username="WoG" version="1.0.0"><![CDATA[Hack Enabled?]]></phrase>
            <phrase name="setting_wog_captit_prefix_desc" date="0" username="WoG" version="1.1.0"><![CDATA[Please define a prefix, which will be placed before <i>posttitle</i>.<br />HTML is allowed.]]></phrase>
            <phrase name="setting_wog_captit_prefix_title" date="0" username="WoG" version="1.1.0"><![CDATA[Prefix]]></phrase>
            <phrase name="settinggroup_wog_captit_group" date="0" username="WoG" version="1.0.0"><![CDATA[WoG - Change All Post Title In Thread]]></phrase>
        </phrasetype>
    </phrases>
    <options>
        <settinggroup name="wog_captit_group" displayorder="65538">
            <setting varname="wog_captit_enable" displayorder="5">
                <datatype>boolean</datatype>
                <optioncode>yesno</optioncode>
                <defaultvalue>1</defaultvalue>
            </setting>
            <setting varname="wog_captit_prefix" displayorder="10">
                <datatype>free</datatype>
                <defaultvalue><![CDATA[Re:&nbsp;]]></defaultvalue>
            </setting>
        </settinggroup>
    </options>
    <helptopics>
    </helptopics>
    <cronentries>
    </cronentries>
    <faqentries>
    </faqentries>
</product>

Help will be very appreciated !

Thanks a lot

Fred

[Dave]

In that XML file, replace

PHP Code:

        if ($vbulletin->GPC['wog_prefixadd'])
        {
            $db->query_write("
                UPDATE `" . TABLE_PREFIX . "post` AS `post`
                SET `post`.`title` = '" . $vbulletin->options['wog_captit_prefix'] . $vbulletin->GPC['title'] . "'
                WHERE `post`.`threadid` = '" . $threadinfo['threadid'] . "'
                AND `post`.`postid` != '" . $threadinfo['firstpostid'] . "'
            ");
        }
        else
        {
            $db->query_write("
                UPDATE `" . TABLE_PREFIX . "post` AS `post`
                SET `post`.`title` = '" . $vbulletin->GPC['title'] . "'
                WHERE `post`.`threadid` = '" . $threadinfo['threadid'] . "'
            ");
        } 


with

PHP Code:

        if ($vbulletin->GPC['wog_prefixadd'])
        {
            $db->query_write("
                UPDATE `" . TABLE_PREFIX . "post` AS `post`
                SET `post`.`title` = '" . $vbulletin->db->escape_string($vbulletin->options['wog_captit_prefix'] . $vbulletin->GPC['title']) . "'
                WHERE `post`.`threadid` = '" . $threadinfo['threadid'] . "'
                AND `post`.`postid` != '" . $threadinfo['firstpostid'] . "'
            ");
        }
        else
        {
            $db->query_write("
                UPDATE `" . TABLE_PREFIX . "post` AS `post`
                SET `post`.`title` = '" . $vbulletin->db->escape_string($vbulletin->GPC['title']) . "'
                WHERE `post`.`threadid` = '" . $threadinfo['threadid'] . "'
            ");
        } 


[kevius]

wouawou !

THANK YOU VERY VERY MUCH !!!!