Several problems with ShowAppDirectory.module

Hi,

ShowAppDirectory.module has something really strange.
Basically, to add an application for a user, you just do:

function ShowAppDirectory_addApplication()
{
  $app_id       = $_GET['app_id'];
  $u_id         = $_GET['u_id'];
  $resultAddApp = db_query("INSERT INTO user_applications (user_id,application_id) values(%d,%d)", $u_id, $app_id);
  header("location:ShowAppDirectory");
}

This is a _huge_ security risk. It means that I could target one specific user, and just add every single application to him/her.
This should instead be a proper Drupal form, and the application should be added to the viewing user rather than passing the uid to the query string.

Basically, ShowAppDirectory.module needs a complete rewrite so that it follows Drupal's "standard" way of doing things. That includes not having html tags in the page, but using theming functions instead.

Bye,

Merc.