Security Update

(1) **s (Ptt_prints):
    Only information can be queried by others will be revealed.
    i.e., **b(birthday), **u(utmp number) will be removed
          **m(money) will show level messages instead of real number
(2) Reply will show as **X instead of converted message
(3) Ansi (^V) mode in editor will display as **X.


git-svn-id: http://opensvn.csie.org/pttbbs/trunk/pttbbs@2878 63ad8ddf-47c3-0310-b6dd-a9e9d9715204

1 files changed, 2 insertions, 9 deletions

diff --git a/mbbsd/talk.c b/mbbsd/talk.c
index 0d0dc6fa..039a75ef 100644
--- a/mbbsd/talk.c
+++ b/mbbsd/talk.c
@@ -377,12 +377,8 @@ int
 my_query(const char *uident)
 {
     userec_t        muser;
-    int             tuid, i, fri_stat = 0;
-    unsigned int    j;
+    int             tuid, fri_stat = 0;
     userinfo_t     *uentp;
-    const char *money[10] =
-    {"債台高築", "赤貧", "清寒", "普通", "小康",
-    "小富", "中富", "大富翁", "富可敵國", "比爾蓋\天"};
     const char *sex[8] =
     {MSG_BIG_BOY, MSG_BIG_GIRL,
 	MSG_LITTLE_BOY, MSG_LITTLE_GIRL,
@@ -399,14 +395,11 @@ my_query(const char *uident)
 	if ((uentp = (userinfo_t *) search_ulist(tuid)))
 	    fri_stat = friend_stat(currutmp, uentp);
 
-	j = muser.money;
-	for (i = 0; i < 10 && j > 10; i++)
-	    j /= 10;
 	prints("《ＩＤ暱稱》%s(%s)%*s《經濟狀況》%s",
 	       muser.userid,
 	       muser.username,
 	       (int)(26 - strlen(muser.userid) - strlen(muser.username)), "",
-	       money[i]);
+	       money_level(cuser.money));
 	if (uentp && ((fri_stat & HFM && !uentp->invisible) || strcmp(muser.userid,cuser.userid) == 0))
 	    prints(" ($%d)", muser.money);
 	outc('\n');