Index: src/forum.c ================================================================== --- src/forum.c +++ src/forum.c @@ -833,14 +833,17 @@ ** ** fpid=X Hash of the post to be editted. REQUIRED */ void forumedit_page(void){ int fpid; + int froot; Manifest *pPost = 0; + Manifest *pRootPost = 0; const char *zMimetype = 0; const char *zContent = 0; const char *zTitle = 0; + char *zDate = 0; int isCsrfSafe; int isDelete = 0; login_check_credentials(); if( !g.perm.WrForum ){ @@ -849,10 +852,14 @@ } fpid = symbolic_name_to_rid(PD("fpid",""), "f"); if( fpid<=0 || (pPost = manifest_get(fpid, CFTYPE_FORUM, 0))==0 ){ webpage_error("Missing or invalid fpid query parameter"); } + froot = db_int(0, "SELECT froot FROM forumpost WHERE fpid=%d", fpid); + if( froot==0 || (pRootPost = manifest_get(froot, CFTYPE_FORUM, 0))==0 ){ + webpage_error("fpid does not appear to be a forum post: \"%d\"", fpid); + } if( P("cancel") ){ cgi_redirectf("%R/forumpost/%S",P("fpid")); return; } isCsrfSafe = cgi_csrf_safe(1); @@ -947,10 +954,16 @@ /* Reply */ zMimetype = PD("mimetype",DEFAULT_FORUM_MIMETYPE); zContent = PDT("content",""); style_header("Reply"); @
%h(pPost->zThreadTitle ? "Post" : "Reply") by %h(pPost->zUser) on %h(zDate) + fossil_free(zDate); forum_render(0, pPost->zMimetype, pPost->zWiki, "forumEdit"); if( P("preview") ){ @