1 |
2
|
Manuela
|
<?php
|
2 |
|
|
/*
|
3 |
|
|
* FCKeditor - The text editor for Internet - http://www.fckeditor.net
|
4 |
|
|
* Copyright (C) 2003-2010 Frederico Caldeira Knabben
|
5 |
|
|
*
|
6 |
|
|
* == BEGIN LICENSE ==
|
7 |
|
|
*
|
8 |
|
|
* Licensed under the terms of any of the following licenses at your
|
9 |
|
|
* choice:
|
10 |
|
|
*
|
11 |
|
|
* - GNU General Public License Version 2 or later (the "GPL")
|
12 |
|
|
* http://www.gnu.org/licenses/gpl.html
|
13 |
|
|
*
|
14 |
|
|
* - GNU Lesser General Public License Version 2.1 or later (the "LGPL")
|
15 |
|
|
* http://www.gnu.org/licenses/lgpl.html
|
16 |
|
|
*
|
17 |
|
|
* - Mozilla Public License Version 1.1 or later (the "MPL")
|
18 |
|
|
* http://www.mozilla.org/MPL/MPL-1.1.html
|
19 |
|
|
*
|
20 |
|
|
* == END LICENSE ==
|
21 |
|
|
*
|
22 |
|
|
* Configuration file for the File Manager Connector for PHP.
|
23 |
|
|
*/
|
24 |
|
|
|
25 |
|
|
global $Config ;
|
26 |
|
|
|
27 |
|
|
// SECURITY: You must explicitly enable this "connector". (Set it to "true").
|
28 |
|
|
// WARNING: don't just set "$Config['Enabled'] = true ;", you must be sure that only
|
29 |
|
|
// authenticated users can access this file or use some kind of session checking.
|
30 |
|
|
$Config['Enabled'] = false ;
|
31 |
|
|
|
32 |
|
|
/**
|
33 |
|
|
* SECURITY PATCH FOR WEBSITEBAKER (doc)
|
34 |
|
|
* only enable PHP connector if user is authenticated to WB
|
35 |
|
|
* and has at least permissions to view the WB MEDIA folder
|
36 |
|
|
*/
|
37 |
|
|
// include WB config.php file and admin class
|
38 |
|
|
if(!defined('WB_PATH'))
|
39 |
|
|
{
|
40 |
|
|
$configFile = ( (dirname(dirname(dirname(dirname(dirname(dirname(__DIR__))))))).'/config.php' );
|
41 |
|
|
if(is_readable($configFile) )
|
42 |
|
|
{
|
43 |
|
|
require($configFile);
|
44 |
|
|
} else {
|
45 |
|
|
die('tried to read a nonexisting configFile ['.basename($configFile).']!! ');
|
46 |
|
|
}
|
47 |
|
|
}
|
48 |
|
|
//$oReg = WbAdaptor::getInstance();
|
49 |
|
|
|
50 |
|
|
if(!class_exists('admin', false)){ include(WB_PATH.'/framework/class.admin.php'); }
|
51 |
|
|
|
52 |
|
|
$wb_path = str_replace('\\','/', WB_PATH);
|
53 |
|
|
$wb_path = str_replace('//','/', WB_PATH);
|
54 |
|
|
|
55 |
|
|
// check if user is authenticated if WB and has permission to view MEDIA folder
|
56 |
|
|
$admin = new admin('Media', 'media_view', false, false);
|
57 |
|
|
if(($admin->get_permission('media_view') === true))
|
58 |
|
|
{
|
59 |
|
|
// user allowed to view MEDIA folder -> enable PHP connector
|
60 |
|
|
$Config['Enabled'] = true ;
|
61 |
|
|
// allow actions to list folders and files
|
62 |
|
|
$Config['ConfigAllowedCommands'] = array('GetFolders', 'GetFoldersAndFiles') ;
|
63 |
|
|
}
|
64 |
|
|
|
65 |
|
|
// Path to user files relative to the document root.
|
66 |
|
|
// $Config['UserFilesPath'] = '/userfiles/' ;
|
67 |
|
|
$Config['UserFilesPath'] = WB_URL.MEDIA_DIRECTORY.'/' ;
|
68 |
|
|
// use home folder of current user as document root if available
|
69 |
|
|
if(isset($_SESSION['HOME_FOLDER']) && file_exists($wb_path .MEDIA_DIRECTORY .$_SESSION['HOME_FOLDER'])){
|
70 |
|
|
$Config['UserFilesPath'] = $Config['UserFilesPath'].$_SESSION['HOME_FOLDER'];
|
71 |
|
|
}
|
72 |
|
|
|
73 |
|
|
// Fill the following value it you prefer to specify the absolute path for the
|
74 |
|
|
// user files directory. Useful if you are using a virtual directory, symbolic
|
75 |
|
|
// link or alias. Examples: 'C:\\MySite\\userfiles\\' or '/root/mysite/userfiles/'.
|
76 |
|
|
// Attention: The above 'UserFilesPath' must point to the same directory.
|
77 |
|
|
// $Config['UserFilesAbsolutePath'] = '' ;
|
78 |
|
|
|
79 |
|
|
$Config['UserFilesAbsolutePath'] = $wb_path .MEDIA_DIRECTORY.'/' ;
|
80 |
|
|
// use home folder of current user as document root if available
|
81 |
|
|
if(isset($_SESSION['HOME_FOLDER']) && file_exists($wb_path .MEDIA_DIRECTORY .$_SESSION['HOME_FOLDER'])){
|
82 |
|
|
$Config['UserFilesAbsolutePath'] = $Config['UserFilesAbsolutePath'].$_SESSION['HOME_FOLDER'].'/';
|
83 |
|
|
}
|
84 |
|
|
// Due to security issues with Apache modules, it is recommended to leave the
|
85 |
|
|
// following setting enabled.
|
86 |
|
|
$Config['ForceSingleExtension'] = true ;
|
87 |
|
|
|
88 |
|
|
// Perform additional checks for image files.
|
89 |
|
|
// If set to true, validate image size (using getimagesize).
|
90 |
|
|
$Config['SecureImageUploads'] = true;
|
91 |
|
|
|
92 |
|
|
// What the user can do with this connector.
|
93 |
|
|
// $Config['ConfigAllowedCommands'] = array('QuickUpload', 'FileUpload', 'GetFolders', 'GetFoldersAndFiles', 'CreateFolder') ;
|
94 |
|
|
|
95 |
|
|
/**
|
96 |
|
|
Check WB permissions of the user/group for the MEDIA folder and
|
97 |
|
|
enable only those FCKEditor commands the user has permissions for
|
98 |
|
|
*/
|
99 |
|
|
// check if user is allowed to upload files to the media directory
|
100 |
|
|
if(($admin->get_permission('media_upload') === true)) {
|
101 |
|
|
// add actions to upload files to the MEDIA folder
|
102 |
|
|
array_push($Config['ConfigAllowedCommands'], 'FileUpload', 'QuickUpload');
|
103 |
|
|
}
|
104 |
|
|
|
105 |
|
|
// check if user is allowed to create new folders in the media directory
|
106 |
|
|
if(($admin->get_permission('media_create') === true)) {
|
107 |
|
|
// add action to create new folders in the MEDIA folder
|
108 |
|
|
array_push($Config['ConfigAllowedCommands'], 'CreateFolder');
|
109 |
|
|
}
|
110 |
|
|
|
111 |
|
|
// Allowed Resource Types.
|
112 |
|
|
$Config['ConfigAllowedTypes'] = array('File', 'Image', 'Flash', 'Media') ;
|
113 |
|
|
|
114 |
|
|
// For security, HTML is allowed in the first Kb of data for files having the
|
115 |
|
|
// following extensions only.
|
116 |
|
|
$Config['HtmlExtensions'] = array("html", "htm", "xml", "xsd", "txt", "js") ;
|
117 |
|
|
|
118 |
|
|
// After file is uploaded, sometimes it is required to change its permissions
|
119 |
|
|
// so that it was possible to access it at the later time.
|
120 |
|
|
// If possible, it is recommended to set more restrictive permissions, like 0755.
|
121 |
|
|
// Set to 0 to disable this feature.
|
122 |
|
|
// Note: not needed on Windows-based servers.
|
123 |
|
|
$Config['ChmodOnUpload'] = defined('OCTAL_FILE_MODE') ? OCTAL_FILE_MODE : 0777 ;
|
124 |
|
|
|
125 |
|
|
// See comments above.
|
126 |
|
|
// Used when creating folders that does not exist.
|
127 |
|
|
$Config['ChmodOnFolderCreate'] = defined('OCTAL_DIR_MODE') ? OCTAL_DIR_MODE : 0777 ;
|
128 |
|
|
|
129 |
|
|
/*
|
130 |
|
|
Configuration settings for each Resource Type
|
131 |
|
|
|
132 |
|
|
- AllowedExtensions: the possible extensions that can be allowed.
|
133 |
|
|
If it is empty then any file type can be uploaded.
|
134 |
|
|
- DeniedExtensions: The extensions that won't be allowed.
|
135 |
|
|
If it is empty then no restrictions are done here.
|
136 |
|
|
|
137 |
|
|
For a file to be uploaded it has to fulfill both the AllowedExtensions
|
138 |
|
|
and DeniedExtensions (that's it: not being denied) conditions.
|
139 |
|
|
|
140 |
|
|
- FileTypesPath: the virtual folder relative to the document root where
|
141 |
|
|
these resources will be located.
|
142 |
|
|
Attention: It must start and end with a slash: '/'
|
143 |
|
|
|
144 |
|
|
- FileTypesAbsolutePath: the physical path to the above folder. It must be
|
145 |
|
|
an absolute path.
|
146 |
|
|
If it's an empty string then it will be autocalculated.
|
147 |
|
|
Useful if you are using a virtual directory, symbolic link or alias.
|
148 |
|
|
Examples: 'C:\\MySite\\userfiles\\' or '/root/mysite/userfiles/'.
|
149 |
|
|
Attention: The above 'FileTypesPath' must point to the same directory.
|
150 |
|
|
Attention: It must end with a slash: '/'
|
151 |
|
|
|
152 |
|
|
- QuickUploadPath: the virtual folder relative to the document root where
|
153 |
|
|
these resources will be uploaded using the Upload tab in the resources
|
154 |
|
|
dialogs.
|
155 |
|
|
Attention: It must start and end with a slash: '/'
|
156 |
|
|
|
157 |
|
|
- QuickUploadAbsolutePath: the physical path to the above folder. It must be
|
158 |
|
|
an absolute path.
|
159 |
|
|
If it's an empty string then it will be autocalculated.
|
160 |
|
|
Useful if you are using a virtual directory, symbolic link or alias.
|
161 |
|
|
Examples: 'C:\\MySite\\userfiles\\' or '/root/mysite/userfiles/'.
|
162 |
|
|
Attention: The above 'QuickUploadPath' must point to the same directory.
|
163 |
|
|
Attention: It must end with a slash: '/'
|
164 |
|
|
|
165 |
|
|
NOTE: by default, QuickUploadPath and QuickUploadAbsolutePath point to
|
166 |
|
|
"userfiles" directory to maintain backwards compatibility with older versions of FCKeditor.
|
167 |
|
|
This is fine, but you in some cases you will be not able to browse uploaded files using file browser.
|
168 |
|
|
Example: if you click on "image button", select "Upload" tab and send image
|
169 |
|
|
to the server, image will appear in FCKeditor correctly, but because it is placed
|
170 |
|
|
directly in /userfiles/ directory, you'll be not able to see it in built-in file browser.
|
171 |
|
|
The more expected behaviour would be to send images directly to "image" subfolder.
|
172 |
|
|
To achieve that, simply change
|
173 |
|
|
$Config['QuickUploadPath']['Image'] = $Config['UserFilesPath'] ;
|
174 |
|
|
$Config['QuickUploadAbsolutePath']['Image'] = $Config['UserFilesAbsolutePath'] ;
|
175 |
|
|
into:
|
176 |
|
|
$Config['QuickUploadPath']['Image'] = $Config['FileTypesPath']['Image'] ;
|
177 |
|
|
$Config['QuickUploadAbsolutePath']['Image'] = $Config['FileTypesAbsolutePath']['Image'] ;
|
178 |
|
|
|
179 |
|
|
*/
|
180 |
|
|
|
181 |
|
|
/**
|
182 |
|
|
APPLY MORE RESTRICTIVE SETTINGS FOR WEBSITE BAKER
|
183 |
|
|
+ only allow file types: only textfiles (no PHP, Javascript or HTML files per default)
|
184 |
|
|
+ only allows images type: bmp, gif, jpges, jpg and png
|
185 |
|
|
+ only allows flash types: swf, flv (no fla ... flash action script per default)
|
186 |
|
|
+ only allows media types: swf, flv, jpg, gif, jpeg, png, avi, mgp, mpeg
|
187 |
|
|
*/
|
188 |
|
|
$Config['AllowedExtensions']['File'] = array();
|
189 |
|
|
$Config['DeniedExtensions']['File'] = array('html','htm','php','php2','php3','php4','php5','phtml','pwml','inc','asp','aspx','ascx','jsp','cfm','cfc','pl','bat','exe','com','dll','vbs','js','reg','cgi','htaccess','asis') ;
|
190 |
|
|
$Config['FileTypesPath']['File'] = $Config['UserFilesPath'];
|
191 |
|
|
$Config['FileTypesAbsolutePath']['File'] = $Config['UserFilesAbsolutePath'] ;
|
192 |
|
|
$Config['QuickUploadPath']['File'] = $Config['UserFilesPath'] ;
|
193 |
|
|
$Config['QuickUploadAbsolutePath']['File'] = $Config['UserFilesAbsolutePath'] ;
|
194 |
|
|
|
195 |
|
|
$Config['AllowedExtensions']['Image'] = array('bmp','gif','jpeg','jpg','png') ;
|
196 |
|
|
$Config['DeniedExtensions']['Image'] = array() ;
|
197 |
|
|
$Config['FileTypesPath']['Image'] = $Config['UserFilesPath'] ;
|
198 |
|
|
$Config['FileTypesAbsolutePath']['Image'] = $Config['UserFilesAbsolutePath'];
|
199 |
|
|
$Config['QuickUploadPath']['Image'] = $Config['UserFilesPath'] ;
|
200 |
|
|
$Config['QuickUploadAbsolutePath']['Image'] = $Config['UserFilesAbsolutePath'] ;
|
201 |
|
|
|
202 |
|
|
$Config['AllowedExtensions']['Flash'] = array('swf','flv') ;
|
203 |
|
|
$Config['DeniedExtensions']['Flash'] = array() ;
|
204 |
|
|
$Config['FileTypesPath']['Flash'] = $Config['UserFilesPath'];
|
205 |
|
|
$Config['FileTypesAbsolutePath']['Flash'] = $Config['UserFilesAbsolutePath'];
|
206 |
|
|
$Config['QuickUploadPath']['Flash'] = $Config['UserFilesPath'] ;
|
207 |
|
|
$Config['QuickUploadAbsolutePath']['Flash'] = $Config['UserFilesAbsolutePath'] ;
|
208 |
|
|
|
209 |
|
|
$Config['AllowedExtensions']['Media'] = array('swf','flv','jpg','gif','jpeg','png','avi','mpg','mpeg') ;
|
210 |
|
|
$Config['DeniedExtensions']['Media'] = array() ;
|
211 |
|
|
$Config['FileTypesPath']['Media'] = $Config['UserFilesPath'] . '' ;
|
212 |
|
|
$Config['FileTypesAbsolutePath']['Media'] = $Config['UserFilesAbsolutePath'];
|
213 |
|
|
$Config['QuickUploadPath']['Media'] = $Config['UserFilesPath'] ;
|
214 |
|
|
$Config['QuickUploadAbsolutePath']['Media'] = $Config['UserFilesAbsolutePath'] ;
|
215 |
|
|
|
216 |
|
|
?>
|