Merge branch 'g2zer0-stable-2.x-patch-92828' into 'stable-2.x'

DSGVO Fix: Kein Newsletter mehr an gesperrte User, die durch die Sperrung...

See merge request !45

adminforce/content/newssystem/news.php

@@ -16,13 +16,35 @@ if ($_POST['news2'] == 'Newsletter und seite') {
     db_query("UPDATE " . $db_prefix . "_kontodaten SET news='1' WHERE 1");
     if ($_POST['id'] == 0) db_query("INSERT INTO " . $db_prefix . "_news (zeit,titel,news) VALUES ('" . time() . "','" . $_POST['titel'] . "','" . $_POST['news'] . "')");
     if ($_POST['id'] >= 1) db_query("UPDATE " . $db_prefix . "_news SET titel='" . $_POST['titel'] . "',news='" . $_POST['news'] . "' WHERE id='" . $_POST['id'] . "'");
-    $empfaenger = db_query('SELECT emailadresse FROM ' . $db_prefix . '_emaildaten WHERE freigabe_fuer = 1 OR freigabe_fuer = 3 GROUP BY emailadresse');
-    while ($user = mysql_fetch_assoc($empfaenger)) usermail ($user['emailadresse'], $_POST['titel'], $_POST['news'], '"' . $seitenname . '" <' . $betreibermail . '>');
+    $empfaenger = db_query('
+		SELECT e.emailadresse, k.status
+		FROM ' . $db_prefix . '_emaildaten e
+		LEFT JOIN ' . $db_prefix . '_kontodaten k ON e.uid = k.uid
+		WHERE e.freigabe_fuer IN (1, 3)
+		GROUP BY e.emailadresse
+	');
+
+	while ($row = mysql_fetch_assoc($empfaenger)) {
+		if ($row['status'] == 1) {
+			usermail($row['emailadresse'], $_POST['titel'], $_POST['news'], '"' . $system['seitenname'] . '" <' . $system['betreibermail'] . '>');
+		}
+	}
 }
 if ($_POST['news3'] == 'Newsletter') {
     db_query("UPDATE " . $db_prefix . "_kontodaten SET news='1' WHERE 1");
-    $empfaenger = db_query('SELECT emailadresse FROM ' . $db_prefix . '_emaildaten WHERE freigabe_fuer = 1 OR freigabe_fuer = 3 GROUP BY emailadresse');
-    while ($user = mysql_fetch_assoc($empfaenger)) usermail ($user['emailadresse'], $_POST['titel'], $_POST['news'], '"' . $seitenname . '" <' . $betreibermail . '>');
+    $empfaenger = db_query('
+		SELECT e.emailadresse, k.status
+		FROM ' . $db_prefix . '_emaildaten e
+		LEFT JOIN ' . $db_prefix . '_kontodaten k ON e.uid = k.uid
+		WHERE e.freigabe_fuer IN (1, 3)
+		GROUP BY e.emailadresse
+	');
+
+	while ($row = mysql_fetch_assoc($empfaenger)) {
+		if ($row['status'] == 1) {
+			usermail($row['emailadresse'], $_POST['titel'], $_POST['news'], '"' . $system['seitenname'] . '" <' . $system['betreibermail'] . '>');
+		}
+	}
 }
 
 if ($_POST['load'] == 'Editieren') {
@@ -74,4 +96,4 @@ head("News schreiben (html erlaubt!)");
 <input type="Hidden" name="id" value="<?php echo $id;?>">
 </form>
 </div>
-<?php foot();?>
\ No newline at end of file
+<?php foot();?>