Don't allow marking deleted messages as unread

sections/inbox/massdelete_handle.php

@@ -1,9 +1,7 @@
 <?
+authorize();
 
-/* replace
 $UserID = $LoggedUser['ID'];
-authorize();
-replace */
 
 if (!isset($_POST['messages']) || !is_array($_POST['messages'])) {
   error('You forgot to select messages to delete.');
@@ -33,22 +31,24 @@ if (isset($_POST['delete'])) {
   $DB->query("
     UPDATE pm_conversations_users
     SET
-      InInbox='0',
-      InSentbox='0',
-      Sticky='0',
-      UnRead='0'
+      InInbox = '0',
+      InSentbox = '0',
+      Sticky = '0',
+      UnRead = '0'
     WHERE ConvID IN($ConvIDs)
-      AND UserID=$UserID");
+      AND UserID = $UserID");
 } elseif (isset($_POST['unread'])) {
   $DB->query("
     UPDATE pm_conversations_users
-    SET Unread='1'
-    WHERE ConvID IN($ConvIDs) AND UserID=$UserID");
+    SET Unread = '1'
+    WHERE ConvID IN($ConvIDs)
+    AND InInbox = '1'
+    AND UserID = $UserID");
 } elseif (isset($_POST['read'])) {
   $DB->query("
     UPDATE pm_conversations_users
-    SET Unread='0'
-    WHERE ConvID IN($ConvIDs) AND UserID=$UserID");
+    SET Unread = '0'
+    WHERE ConvID IN($ConvIDs) AND UserID = $UserID");
 }
 $Cache->delete_value('inbox_new_'.$UserID);
 

sections/inbox/takeedit.php

@@ -3,13 +3,11 @@ authorize();
 
 $UserID = $LoggedUser['ID'];
 $ConvID = $_POST['convid'];
-if (!is_number($ConvID)) {
-  error(404);
-}
+
 $DB->query("
   SELECT UserID
   FROM pm_conversations_users
-  WHERE UserID='$UserID' AND ConvID='$ConvID'");
+  WHERE UserID = ? AND ConvID = ?", $UserID, $ConvID);
 if (!$DB->has_results()) {
   error(403);
 }
@@ -18,27 +16,29 @@ if (isset($_POST['delete'])) {
   $DB->query("
     UPDATE pm_conversations_users
     SET
-      InInbox='0',
-      InSentbox='0',
-      Sticky='0'
-    WHERE ConvID='$ConvID' AND UserID='$UserID'");
+      InInbox = '0',
+      InSentbox = '0',
+      Sticky = '0'
+    WHERE ConvID = ? AND UserID = ?", $ConvID, $UserID);
 } else {
   if (isset($_POST['sticky'])) {
     $DB->query("
       UPDATE pm_conversations_users
-      SET Sticky='1'
-      WHERE ConvID='$ConvID' AND UserID='$UserID'");
+      SET Sticky = '1'
+      WHERE ConvID = ? AND UserID = ?", $ConvID, $UserID);
   } else {
     $DB->query("
       UPDATE pm_conversations_users
-      SET Sticky='0'
-      WHERE ConvID='$ConvID' AND UserID='$UserID'");
+      SET Sticky = '0'
+      WHERE ConvID = ? AND UserID = ?", $ConvID, $UserID);
   }
   if (isset($_POST['mark_unread'])) {
     $DB->query("
       UPDATE pm_conversations_users
-      SET Unread='1'
-      WHERE ConvID='$ConvID' AND UserID='$UserID'");
+      SET Unread = '1'
+      WHERE ConvID = ?
+      AND InInbox = '1'
+      AND UserID = ?", $ConvID, $UserID);
     $Cache->increment('inbox_new_'.$UserID);
   }
 }