Project

General

Profile

1
<?php
2
/**
3
 *
4
 * @category        admin
5
 * @package         settings
6
 * @author          WebsiteBaker Project
7
 * @copyright       Ryan Djurovich
8
 * @copyright       WebsiteBaker Org. e.V.
9
 * @link            http://websitebaker.org/
10
 * @license         http://www.gnu.org/licenses/gpl.html
11
 * @platform        WebsiteBaker 2.8.3
12
 * @requirements    PHP 5.3.6 and higher
13
 * @version         $Id: save.php 2 2017-07-02 15:14:29Z Manuela $
14
 * @filesource      $HeadURL: svn://isteam.dynxs.de/wb/2.10.x/trunk/admin/settings/save.php $
15
 * @lastmodified    $Date: 2017-07-02 17:14:29 +0200 (Sun, 02 Jul 2017) $
16
 *
17
 */
18

    
19
// prevent this file from being accessed directly in the browser (would set all entries in DB settings table to '')
20
//if(!isset($_POST['default_language']) || $_POST['default_language'] == '') die(header('Location: index.php'));
21

    
22
// Find out if the user was view advanced options or not
23
$bAdvanced = intval ((@intval($_POST['advanced'])) ?: 0);
24

    
25
// Print admin header
26
if ( !defined( 'WB_PATH' ) ){ require( dirname(dirname((__DIR__))).'/config.php' ); }
27
if ( !class_exists('admin', false) ) { require(WB_PATH.'/framework/class.admin.php'); }
28

    
29
// suppress to print the header, so no new FTAN will be set
30
if(!$bAdvanced)
31
{
32
    $admin = new admin('Settings', 'settings_basic',false);
33
} else {
34
    $admin = new admin('Settings', 'settings_advanced',false);
35
}
36

    
37
// Create a javascript back link
38
$js_back = ADMIN_URL.'/settings/index.php?advanced='.($bAdvanced);
39

    
40
if( !$admin->checkFTAN() )
41
{
42
    $admin->print_header();
43
    $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], $js_back );
44
}
45
$admin->print_header();
46

    
47
$TOKENS = unserialize($_SESSION['TOKENS']);
48
$array  = $_POST;
49
ksort($array);
50

    
51
$aInputs = array();
52
$aOutputs = array();
53

    
54
$sql = 'SELECT `name`, `value` FROM `'.TABLE_PREFIX.'settings` '
55
     . 'ORDER BY `name`';
56
if($oSettings = $database->query($sql)) {
57
    while($aSetting = $oSettings->fetchRow( MYSQLI_ASSOC )) {
58
      $aOutputs['_POST'][$aSetting['name']] = $aSetting['value'];
59
    }
60
}
61
// After check print the header
62

    
63
// Work-out file mode
64
if( !$bAdvanced )
65
{
66
    // Check if should be set to 777 or left alone
67
    if(isset($_POST['world_writeable']) && $_POST['world_writeable'] == 'true')
68
    {
69
        $file_mode = '0777';
70
        $dir_mode  = '0777';
71
    } else {
72
        $file_mode = STRING_FILE_MODE;
73
        $dir_mode  = STRING_DIR_MODE;
74
    }
75
} else {
76
    $file_mode = STRING_FILE_MODE;
77
    $dir_mode  = STRING_DIR_MODE;
78

    
79
    if($admin->get_user_id()=='1')
80
    {
81
        // Work-out the octal value for file mode
82
        $u = 0;
83
        if(isset($_POST['file_u_r']) && $_POST['file_u_r'] == 'true') {
84
            $u = $u+4;
85
        }
86
        if(isset($_POST['file_u_w']) && $_POST['file_u_w'] == 'true') {
87
            $u = $u+2;
88
        }
89
        if(isset($_POST['file_u_e']) && $_POST['file_u_e'] == 'true') {
90
            $u = $u+1;
91
        }
92
        $g = 0;
93
        if(isset($_POST['file_g_r']) && $_POST['file_g_r'] == 'true') {
94
            $g = $g+4;
95
        }
96
        if(isset($_POST['file_g_w']) && $_POST['file_g_w'] == 'true') {
97
            $g = $g+2;
98
        }
99
        if(isset($_POST['file_g_e']) && $_POST['file_g_e'] == 'true') {
100
            $g = $g+1;
101
        }
102
        $o = 0;
103
        if(isset($_POST['file_o_r']) && $_POST['file_o_r'] == 'true') {
104
            $o = $o+4;
105
        }
106
        if(isset($_POST['file_o_w']) && $_POST['file_o_w'] == 'true') {
107
            $o = $o+2;
108
        }
109
        if(isset($_POST['file_o_e']) && $_POST['file_o_e'] == 'true') {
110
            $o = $o+1;
111
        }
112
        $file_mode = "0".$u.$g.$o;
113
        // Work-out the octal value for dir mode
114
        $u = 0;
115
        if(isset($_POST['dir_u_r']) && $_POST['dir_u_r'] == 'true') {
116
            $u = $u+4;
117
        }
118
        if(isset($_POST['dir_u_w']) && $_POST['dir_u_w'] == 'true') {
119
            $u = $u+2;
120
        }
121
        if(isset($_POST['dir_u_e']) && $_POST['dir_u_e'] == 'true') {
122
            $u = $u+1;
123
        }
124
        $g = 0;
125
        if(isset($_POST['dir_g_r']) && $_POST['dir_g_r'] == 'true') {
126
            $g = $g+4;
127
        }
128
        if(isset($_POST['dir_g_w']) && $_POST['dir_g_w'] == 'true') {
129
            $g = $g+2;
130
        }
131
        if(isset($_POST['dir_g_e']) && $_POST['dir_g_e'] == 'true') {
132
            $g = $g+1;
133
        }
134
        $o = 0;
135
        if(isset($_POST['dir_o_r']) && $_POST['dir_o_r'] == 'true') {
136
            $o = $o+4;
137
        }
138
        if(isset($_POST['dir_o_w']) && $_POST['dir_o_w'] == 'true') {
139
            $o = $o+2;
140
        }
141
        if(isset($_POST['dir_o_e']) && $_POST['dir_o_e'] == 'true') {
142
            $o = $o+1;
143
        }
144
        $dir_mode = "0".$u.$g.$o;
145
    }
146
// Ensure that the specified default email is formally valid
147
    if(isset($_POST['server_email']))
148
    {
149
        $_POST['server_email'] = strip_tags($_POST['server_email']);
150
        // $pattern = '/^[-a-z0-9~!$%^&*_=+}{\'?]+(\.[-a-z0-9~!$%^&*_=+}{\'?]+)*@([a-z0-9]([-a-z0-9_]?[a-z0-9])*(\.[-a-z0-9_]+)*\.(aero|arpa|biz|com|coop|edu|gov|info|int|mil|museum|name|net|org|pro|travel|mobi|[a-z]{2})|([1]?\d{1,2}|2[0-4]{1}\d{1}|25[0-5]{1})(\.([1]?\d{1,2}|2[0-4]{1}\d{1}|25[0-5]{1})){3})(:[0-9]{1,5})?\r/im';
151
        $pattern = '/^[_a-zA-Z0-9-]+(\.[_a-zA-Z0-9-]+)*@[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*\.(([0-9]{1,3})|([a-zA-Z]{2,6}))$/';
152
        if(false == preg_match($pattern, $_POST['server_email']))
153
        {
154
            $admin->print_error($MESSAGE['USERS_INVALID_EMAIL'].
155
                '<br /><strong>Email: '.htmlentities($_POST['server_email']).'</strong>', $js_back);
156
        }
157
    }
158

    
159
    if(isset($_POST['wbmailer_routine']) && ($_POST['wbmailer_routine']=='smtp')) {
160

    
161
        $checkSmtpHost = (isset($_POST['wbmailer_smtp_host']) && ($_POST['wbmailer_smtp_host']=='') ? false : true);
162
        $checkSmtpUser = (isset($_POST['wbmailer_smtp_username']) && ($_POST['wbmailer_smtp_username']=='') ? false : true);
163
        $checkSmtpPassword = (isset($_POST['wbmailer_smtp_password']) && ($_POST['wbmailer_smtp_password']=='') ? false : true);
164
        if(!$checkSmtpHost || !$checkSmtpUser || !$checkSmtpPassword) {
165
            $admin->print_error($TEXT['REQUIRED'].' '.$TEXT['WBMAILER_SMTP_AUTH'].
166
                '<br /><strong>'.$MESSAGE['GENERIC_FILL_IN_ALL'].'</strong>', $js_back);
167
        }
168

    
169
    }
170
}
171

    
172
$allow_tags_in_fields = array('website_header', 'website_footer','website_signature');
173
$allow_empty_values   = array('website_header','website_footer','website_signature','sec_anchor','pages_directory','page_spacer','wbmailer_smtp_secure');
174
$disallow_in_fields   = array('pages_directory', 'media_directory','wb_version');
175

    
176
// Query current settings in the db, then loop through them and update the db with the new value
177
$settings = array();
178
$old_settings = array();
179
// Query current settings in the db, then loop through them to get old values
180
$sql  = 'SELECT `name`, `value` FROM `'.TABLE_PREFIX.'settings` '
181
      . 'ORDER BY `name`';
182
if($res_settings = $database->query($sql)) {
183
    $passed = false;
184
    while($setting = $res_settings->fetchRow(MYSQLI_ASSOC)) :
185
        $old_settings[$setting['name']] = $setting['value'];
186
        $setting_name = $setting['name'];
187
        if($setting_name=='wb_version') { continue; }
188
        $value = $admin->get_post($setting_name);
189
        $value = is_null($value) ? '' : $value;
190
        $value = isset($_POST[$setting_name]) ? $value : $old_settings[$setting_name] ;
191
        switch ($setting_name) :
192
            case 'website_header':
193
            case 'website_footer':
194
            case 'website_signature':
195
                $sRelUrl = preg_replace('/^https?:\/\/[^\/]+(.*)/is', '\1', WB_URL);
196
                $sDocumentRootUrl = str_replace($sRelUrl, '', WB_URL);
197
                $sMediaUrl = WB_URL.MEDIA_DIRECTORY;
198
                $aPatterns = array(
199
                    '/(<[^>]*?=\s*\")(\/+)([^\"]*?\"[^>]*?)/is',
200
                    '/(<[^>]*=\s*")('.preg_quote($sMediaUrl, '/').')([^">]*".*>)/siU'
201
                );
202
                $aReplacements = array(
203
                    '\1'.$sDocumentRootUrl.'/\3',
204
                    '$1{SYSVAR:MEDIA_REL}$3'
205
                );
206
                $value = preg_replace($aPatterns, $aReplacements, $value);
207
                $passed = true;
208
                break;
209
            case 'default_timezone':
210
                $value=$value*60*60;
211
                $passed = true;
212
                break;
213
            case 'string_dir_mode':
214
                $value=$dir_mode;
215
                $passed = true;
216
                break;
217
            case 'string_file_mode':
218
                $value=$file_mode;
219
                $passed = true;
220
            break;
221
            case 'pages_directory':
222
                break;
223
            case 'wbmailer_smtp_auth':
224
                // $value = isset($_POST[$setting_name]) ? $_POST[$setting_name] : '' ;
225
                $value = true ;
226
                $passed = true;
227
                break;
228
            case 'sec_token_netmask4':
229
                $iValue = intval( $value );
230
                $value  = (($iValue > 32) || ( $iValue < 0 ) ? '24' : $value);
231
                $passed = true;
232
                break;
233
            case 'sec_token_netmask6':
234
                $iValue = intval( $value );
235
                $value  = (($iValue > 128) || ( $iValue < 0 ) ? '64' : $value);
236
                $passed = true;
237
                break;
238
            case 'sec_token_life_time':
239
                $value = $admin->sanitizeLifeTime(intval( $value ) * 60 );
240
                $passed = true;
241
                break;
242
            case 'wb_version':
243
                continue;
244
                break;
245
            default :
246
                $passed = in_array($setting_name, $allow_empty_values);
247
                break;
248
        endswitch;
249
        if(is_array($value)){ $value = $value['0']; }
250
        if ( !in_array($setting_name, $allow_tags_in_fields)) {
251
          $value = strip_tags($value);
252
        } else {
253

    
254
        }
255
        if ( (!in_array($value, $disallow_in_fields) && (isset($_POST[$setting_name])) || $passed == true)) {
256
            $sIdentifier = trim($database->escapeString($setting_name));
257
            $value = trim($database->escapeString($value));
258
            if (!db_update_key_value('settings',$sIdentifier,$value)) {
259
                $admin->print_error($database->get_error, $js_back );
260
            }
261
/*
262
            $sql = 'UPDATE `'.TABLE_PREFIX.'settings` SET '
263
                 . '`value`=\''.$value.'\' '
264
                 . 'WHERE  `name`=\''.$database->escapeString($setting_name).'\'';
265
            if (!$database->query($sql)) {
266
                $admin->print_error($database->get_error, $js_back );
267
                break;
268
            }
269
*/
270
        }
271
    endwhile;
272
}
273

    
274
// Query current search settings in the db, then loop through them and update the db with the new value
275
$sql = 'SELECT `name`, `value` FROM `'.TABLE_PREFIX.'search` '
276
     . 'WHERE `extra`=\'\'';
277
if (!($res_search = $database->query($sql))) {
278
    $admin->print_error($database->is_error(), $js_back );
279
}
280
while($search_setting = $res_search->fetchRow()) :
281
    $old_value = $search_setting['value'];
282
    $setting_name = $search_setting['name'];
283
    $post_name = 'search_'.$search_setting['name'];
284

    
285
    // hold old value if post is empty
286
    // check search template
287
    $value = (($admin->get_post($post_name) == '') && ($setting_name != 'template'))
288
             ? $old_value
289
             : $admin->get_post($post_name);
290
    if (isset($value)) {
291
        $value = $database->escapeString($value);
292
        $sql = 'UPDATE `'.TABLE_PREFIX.'search` '
293
             . 'SET `value`=\''.$value.'\' '
294
             . 'WHERE `name`=\''.$setting_name.'\' AND `extra`=\'\'';
295
        if(!($database->query($sql))) {
296
            $admin->print_error( TABLE_PREFIX.'search :: '.$MESSAGE['GENERIC_NOT_UPGRADED'].'<br />'.$database->get_error, $js_back );
297
            break;
298
        }
299
        // $sql_info = mysql_info($database->db_handle); //->> nicht mehr erforderlich
300
    }
301
endwhile;
302

    
303
$admin->print_success($MESSAGE['SETTINGS_SAVED'], $js_back );
304
$admin->print_footer();
305

    
(3-3/3)