From 141074eb99a435f4788613465e304faae6407a07 Mon Sep 17 00:00:00 2001
From: mauirixxx <mauirixxx@users.noreply.github.com>
Date: Wed, 24 May 2017 22:39:05 -1000
Subject: [PATCH] more session fun

---
 gw-action.php | 4 ++--
 gw-pull.php   | 4 +++-
 2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/gw-action.php b/gw-action.php
index 73a9319..2317528 100644
--- a/gw-action.php
+++ b/gw-action.php
@@ -1,12 +1,12 @@
 <?php
 session_start();
 $playerid = $_SESSION['playerid'];
-$toonid = $_POST['playerid'];
+//$toonid = $_POST['playerid'];
 $action = $_POST['gwaction'];
 echo'<TITLE>Redirecting ...</TITLE>';
 if ($action == 1){ //insert dropped items data
 	echo '<BODY onload="document.record.submit()">';
-	echo '<FORM METHOD="POST" ACTION="gw-location.php" NAME="record"><INPUT TYPE="HIDDEN" NAME="playerid" VALUE="'. $toonid . '"><INPUT TYPE="SUBMIT" ID="clkRecord"></FORM></BODY>';
+	echo '<FORM METHOD="POST" ACTION="gw-location.php" NAME="record"><INPUT TYPE="HIDDEN" NAME="playerid" VALUE="'. $playerid . '"><INPUT TYPE="SUBMIT" ID="clkRecord"></FORM></BODY>';
 } else if ($action == 2){ //view history of dropped items
 	echo '<BODY onload="document.insert.submit()">';
 	echo '<FORM METHOD="POST" ACTION="gw-pull.php" NAME="insert"><INPUT TYPE="HIDDEN" NAME="cnameid" VALUE="' . $playerid . '"><INPUT TYPE="SUBMIT" ID="clkInsert"></FORM></BODY>';
diff --git a/gw-pull.php b/gw-pull.php
index 7ba4b7a..de55d5f 100644
--- a/gw-pull.php
+++ b/gw-pull.php
@@ -1,9 +1,11 @@
 <TITLE>Treasure Data</TITLE>
 <BODY>
 <?php
+session_start();
 include_once 'gw-connect.php';
 $con = new mysqli(DATABASE_HOST, DATABASE_USER, DATABASE_PASS, DATABASE_NAME);
-$cnameid = mysqli_real_escape_string($con, $_POST['cnameid']); //need to sanitize & validate this input somehow
+//$cnameid = mysqli_real_escape_string($con, $_POST['cnameid']); //need to sanitize & validate this input somehow
+$cnameid = $_SESSION['playerid'];
 if ($con->connect_errno > 0){
 	die ('Unable to connect to database [' . $db->connect_errno . ']');
 }
