1 |
816
|
doc
|
<?php
|
2 |
|
|
/*
|
3 |
|
|
* FCKeditor - The text editor for Internet - http://www.fckeditor.net
|
4 |
918
|
Ruebenwurz
|
* Copyright (C) 2003-2009 Frederico Caldeira Knabben
|
5 |
816
|
doc
|
*
|
6 |
|
|
* == BEGIN LICENSE ==
|
7 |
|
|
*
|
8 |
|
|
* Licensed under the terms of any of the following licenses at your
|
9 |
|
|
* choice:
|
10 |
|
|
*
|
11 |
|
|
* - GNU General Public License Version 2 or later (the "GPL")
|
12 |
|
|
* http://www.gnu.org/licenses/gpl.html
|
13 |
|
|
*
|
14 |
|
|
* - GNU Lesser General Public License Version 2.1 or later (the "LGPL")
|
15 |
|
|
* http://www.gnu.org/licenses/lgpl.html
|
16 |
|
|
*
|
17 |
|
|
* - Mozilla Public License Version 1.1 or later (the "MPL")
|
18 |
|
|
* http://www.mozilla.org/MPL/MPL-1.1.html
|
19 |
|
|
*
|
20 |
|
|
* == END LICENSE ==
|
21 |
|
|
*
|
22 |
|
|
* Configuration file for the File Manager Connector for PHP.
|
23 |
|
|
*/
|
24 |
|
|
|
25 |
|
|
global $Config ;
|
26 |
|
|
|
27 |
|
|
// SECURITY: You must explicitly enable this "connector". (Set it to "true").
|
28 |
|
|
// WARNING: don't just set "$Config['Enabled'] = true ;", you must be sure that only
|
29 |
|
|
// authenticated users can access this file or use some kind of session checking.
|
30 |
|
|
$Config['Enabled'] = false ;
|
31 |
|
|
|
32 |
1161
|
Luisehahne
|
/**
|
33 |
816
|
doc
|
SECURITY PATCH FOR WEBSITE BAKER (doc)
|
34 |
|
|
only enable PHP connector if user is authenticated to WB
|
35 |
|
|
and has at least permissions to view the WB MEDIA folder
|
36 |
|
|
*/
|
37 |
|
|
// include WB config.php file and admin class
|
38 |
|
|
require_once('../../../../../../../config.php');
|
39 |
|
|
require_once(WB_PATH .'/framework/class.admin.php');
|
40 |
|
|
|
41 |
1199
|
Luisehahne
|
$wb_path = str_replace('\\','/', WB_PATH);
|
42 |
|
|
$wb_path = str_replace('//','/', WB_PATH);
|
43 |
|
|
|
44 |
816
|
doc
|
// check if user is authenticated if WB and has permission to view MEDIA folder
|
45 |
|
|
$admin = new admin('Media', 'media_view', false, false);
|
46 |
1199
|
Luisehahne
|
if(($admin->get_permission('media_view') === true))
|
47 |
|
|
{
|
48 |
816
|
doc
|
// user allowed to view MEDIA folder -> enable PHP connector
|
49 |
|
|
$Config['Enabled'] = true ;
|
50 |
|
|
// allow actions to list folders and files
|
51 |
|
|
$Config['ConfigAllowedCommands'] = array('GetFolders', 'GetFoldersAndFiles') ;
|
52 |
|
|
}
|
53 |
|
|
|
54 |
|
|
// Path to user files relative to the document root.
|
55 |
|
|
// $Config['UserFilesPath'] = '/userfiles/' ;
|
56 |
1199
|
Luisehahne
|
$Config['UserFilesPath'] = WB_URL.MEDIA_DIRECTORY.'/' ;
|
57 |
816
|
doc
|
// use home folder of current user as document root if available
|
58 |
1199
|
Luisehahne
|
if(isset($_SESSION['HOME_FOLDER']) && file_exists($wb_path .MEDIA_DIRECTORY .$_SESSION['HOME_FOLDER'])){
|
59 |
816
|
doc
|
$Config['UserFilesPath'] = $Config['UserFilesPath'].$_SESSION['HOME_FOLDER'];
|
60 |
|
|
}
|
61 |
|
|
|
62 |
|
|
// Fill the following value it you prefer to specify the absolute path for the
|
63 |
|
|
// user files directory. Useful if you are using a virtual directory, symbolic
|
64 |
|
|
// link or alias. Examples: 'C:\\MySite\\userfiles\\' or '/root/mysite/userfiles/'.
|
65 |
|
|
// Attention: The above 'UserFilesPath' must point to the same directory.
|
66 |
|
|
// $Config['UserFilesAbsolutePath'] = '' ;
|
67 |
1199
|
Luisehahne
|
|
68 |
|
|
$Config['UserFilesAbsolutePath'] = $wb_path .MEDIA_DIRECTORY.'/' ;
|
69 |
816
|
doc
|
// use home folder of current user as document root if available
|
70 |
1199
|
Luisehahne
|
if(isset($_SESSION['HOME_FOLDER']) && file_exists($wb_path .MEDIA_DIRECTORY .$_SESSION['HOME_FOLDER'])){
|
71 |
|
|
$Config['UserFilesAbsolutePath'] = $Config['UserFilesAbsolutePath'].$_SESSION['HOME_FOLDER'].'/';
|
72 |
816
|
doc
|
}
|
73 |
|
|
// Due to security issues with Apache modules, it is recommended to leave the
|
74 |
|
|
// following setting enabled.
|
75 |
|
|
$Config['ForceSingleExtension'] = true ;
|
76 |
|
|
|
77 |
|
|
// Perform additional checks for image files.
|
78 |
|
|
// If set to true, validate image size (using getimagesize).
|
79 |
|
|
$Config['SecureImageUploads'] = true;
|
80 |
|
|
|
81 |
|
|
// What the user can do with this connector.
|
82 |
|
|
// $Config['ConfigAllowedCommands'] = array('QuickUpload', 'FileUpload', 'GetFolders', 'GetFoldersAndFiles', 'CreateFolder') ;
|
83 |
|
|
|
84 |
1161
|
Luisehahne
|
/**
|
85 |
|
|
Check WB permissions of the user/group for the MEDIA folder and
|
86 |
|
|
enable only those FCKEditor commands the user has permissions for
|
87 |
816
|
doc
|
*/
|
88 |
|
|
// check if user is allowed to upload files to the media directory
|
89 |
|
|
if(($admin->get_permission('media_upload') === true)) {
|
90 |
|
|
// add actions to upload files to the MEDIA folder
|
91 |
|
|
array_push($Config['ConfigAllowedCommands'], 'FileUpload', 'QuickUpload');
|
92 |
|
|
}
|
93 |
|
|
|
94 |
|
|
// check if user is allowed to create new folders in the media directory
|
95 |
|
|
if(($admin->get_permission('media_create') === true)) {
|
96 |
|
|
// add action to create new folders in the MEDIA folder
|
97 |
|
|
array_push($Config['ConfigAllowedCommands'], 'CreateFolder');
|
98 |
|
|
}
|
99 |
|
|
|
100 |
|
|
// Allowed Resource Types.
|
101 |
|
|
$Config['ConfigAllowedTypes'] = array('File', 'Image', 'Flash', 'Media') ;
|
102 |
|
|
|
103 |
|
|
// For security, HTML is allowed in the first Kb of data for files having the
|
104 |
|
|
// following extensions only.
|
105 |
|
|
$Config['HtmlExtensions'] = array("html", "htm", "xml", "xsd", "txt", "js") ;
|
106 |
|
|
|
107 |
|
|
// After file is uploaded, sometimes it is required to change its permissions
|
108 |
|
|
// so that it was possible to access it at the later time.
|
109 |
|
|
// If possible, it is recommended to set more restrictive permissions, like 0755.
|
110 |
|
|
// Set to 0 to disable this feature.
|
111 |
|
|
// Note: not needed on Windows-based servers.
|
112 |
1199
|
Luisehahne
|
$Config['ChmodOnUpload'] = defined('OCTAL_FILE_MODE') ? OCTAL_FILE_MODE : 0777 ;
|
113 |
816
|
doc
|
|
114 |
|
|
// See comments above.
|
115 |
|
|
// Used when creating folders that does not exist.
|
116 |
1199
|
Luisehahne
|
$Config['ChmodOnFolderCreate'] = defined('OCTAL_DIR_MODE') ? OCTAL_DIR_MODE : 0777 ;
|
117 |
816
|
doc
|
|
118 |
|
|
/*
|
119 |
|
|
Configuration settings for each Resource Type
|
120 |
|
|
|
121 |
|
|
- AllowedExtensions: the possible extensions that can be allowed.
|
122 |
|
|
If it is empty then any file type can be uploaded.
|
123 |
|
|
- DeniedExtensions: The extensions that won't be allowed.
|
124 |
|
|
If it is empty then no restrictions are done here.
|
125 |
|
|
|
126 |
|
|
For a file to be uploaded it has to fulfill both the AllowedExtensions
|
127 |
|
|
and DeniedExtensions (that's it: not being denied) conditions.
|
128 |
|
|
|
129 |
|
|
- FileTypesPath: the virtual folder relative to the document root where
|
130 |
|
|
these resources will be located.
|
131 |
|
|
Attention: It must start and end with a slash: '/'
|
132 |
|
|
|
133 |
|
|
- FileTypesAbsolutePath: the physical path to the above folder. It must be
|
134 |
|
|
an absolute path.
|
135 |
|
|
If it's an empty string then it will be autocalculated.
|
136 |
|
|
Useful if you are using a virtual directory, symbolic link or alias.
|
137 |
|
|
Examples: 'C:\\MySite\\userfiles\\' or '/root/mysite/userfiles/'.
|
138 |
|
|
Attention: The above 'FileTypesPath' must point to the same directory.
|
139 |
|
|
Attention: It must end with a slash: '/'
|
140 |
|
|
|
141 |
|
|
- QuickUploadPath: the virtual folder relative to the document root where
|
142 |
|
|
these resources will be uploaded using the Upload tab in the resources
|
143 |
|
|
dialogs.
|
144 |
|
|
Attention: It must start and end with a slash: '/'
|
145 |
|
|
|
146 |
|
|
- QuickUploadAbsolutePath: the physical path to the above folder. It must be
|
147 |
|
|
an absolute path.
|
148 |
|
|
If it's an empty string then it will be autocalculated.
|
149 |
|
|
Useful if you are using a virtual directory, symbolic link or alias.
|
150 |
|
|
Examples: 'C:\\MySite\\userfiles\\' or '/root/mysite/userfiles/'.
|
151 |
|
|
Attention: The above 'QuickUploadPath' must point to the same directory.
|
152 |
|
|
Attention: It must end with a slash: '/'
|
153 |
|
|
|
154 |
|
|
NOTE: by default, QuickUploadPath and QuickUploadAbsolutePath point to
|
155 |
|
|
"userfiles" directory to maintain backwards compatibility with older versions of FCKeditor.
|
156 |
|
|
This is fine, but you in some cases you will be not able to browse uploaded files using file browser.
|
157 |
|
|
Example: if you click on "image button", select "Upload" tab and send image
|
158 |
|
|
to the server, image will appear in FCKeditor correctly, but because it is placed
|
159 |
|
|
directly in /userfiles/ directory, you'll be not able to see it in built-in file browser.
|
160 |
|
|
The more expected behaviour would be to send images directly to "image" subfolder.
|
161 |
|
|
To achieve that, simply change
|
162 |
|
|
$Config['QuickUploadPath']['Image'] = $Config['UserFilesPath'] ;
|
163 |
|
|
$Config['QuickUploadAbsolutePath']['Image'] = $Config['UserFilesAbsolutePath'] ;
|
164 |
|
|
into:
|
165 |
|
|
$Config['QuickUploadPath']['Image'] = $Config['FileTypesPath']['Image'] ;
|
166 |
|
|
$Config['QuickUploadAbsolutePath']['Image'] = $Config['FileTypesAbsolutePath']['Image'] ;
|
167 |
|
|
|
168 |
|
|
*/
|
169 |
|
|
|
170 |
|
|
/*
|
171 |
|
|
$Config['AllowedExtensions']['File'] = array('7z', 'aiff', 'asf', 'avi', 'bmp', 'csv', 'doc', 'fla', 'flv', 'gif', 'gz', 'gzip', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'ods', 'odt', 'pdf', 'png', 'ppt', 'pxd', 'qt', 'ram', 'rar', 'rm', 'rmi', 'rmvb', 'rtf', 'sdc', 'sitd', 'swf', 'sxc', 'sxw', 'tar', 'tgz', 'tif', 'tiff', 'txt', 'vsd', 'wav', 'wma', 'wmv', 'xls', 'xml', 'zip') ;
|
172 |
|
|
$Config['DeniedExtensions']['File'] = array() ;
|
173 |
|
|
$Config['FileTypesPath']['File'] = $Config['UserFilesPath'] . 'file/' ;
|
174 |
|
|
$Config['FileTypesAbsolutePath']['File']= ($Config['UserFilesAbsolutePath'] == '') ? '' : $Config['UserFilesAbsolutePath'].'file/' ;
|
175 |
|
|
$Config['QuickUploadPath']['File'] = $Config['UserFilesPath'] ;
|
176 |
|
|
$Config['QuickUploadAbsolutePath']['File']= $Config['UserFilesAbsolutePath'] ;
|
177 |
|
|
|
178 |
|
|
$Config['AllowedExtensions']['Image'] = array('bmp','gif','jpeg','jpg','png') ;
|
179 |
|
|
$Config['DeniedExtensions']['Image'] = array() ;
|
180 |
|
|
$Config['FileTypesPath']['Image'] = $Config['UserFilesPath'] . 'image/' ;
|
181 |
|
|
$Config['FileTypesAbsolutePath']['Image']= ($Config['UserFilesAbsolutePath'] == '') ? '' : $Config['UserFilesAbsolutePath'].'image/' ;
|
182 |
|
|
$Config['QuickUploadPath']['Image'] = $Config['UserFilesPath'] ;
|
183 |
|
|
$Config['QuickUploadAbsolutePath']['Image']= $Config['UserFilesAbsolutePath'] ;
|
184 |
|
|
|
185 |
|
|
$Config['AllowedExtensions']['Flash'] = array('swf','flv') ;
|
186 |
|
|
$Config['DeniedExtensions']['Flash'] = array() ;
|
187 |
|
|
$Config['FileTypesPath']['Flash'] = $Config['UserFilesPath'] . 'flash/' ;
|
188 |
|
|
$Config['FileTypesAbsolutePath']['Flash']= ($Config['UserFilesAbsolutePath'] == '') ? '' : $Config['UserFilesAbsolutePath'].'flash/' ;
|
189 |
|
|
$Config['QuickUploadPath']['Flash'] = $Config['UserFilesPath'] ;
|
190 |
|
|
$Config['QuickUploadAbsolutePath']['Flash']= $Config['UserFilesAbsolutePath'] ;
|
191 |
|
|
|
192 |
|
|
$Config['AllowedExtensions']['Media'] = array('aiff', 'asf', 'avi', 'bmp', 'fla', 'flv', 'gif', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'png', 'qt', 'ram', 'rm', 'rmi', 'rmvb', 'swf', 'tif', 'tiff', 'wav', 'wma', 'wmv') ;
|
193 |
|
|
$Config['DeniedExtensions']['Media'] = array() ;
|
194 |
|
|
$Config['FileTypesPath']['Media'] = $Config['UserFilesPath'] . 'media/' ;
|
195 |
|
|
$Config['FileTypesAbsolutePath']['Media']= ($Config['UserFilesAbsolutePath'] == '') ? '' : $Config['UserFilesAbsolutePath'].'media/' ;
|
196 |
|
|
$Config['QuickUploadPath']['Media'] = $Config['UserFilesPath'] ;
|
197 |
|
|
$Config['QuickUploadAbsolutePath']['Media']= $Config['UserFilesAbsolutePath'] ;
|
198 |
|
|
*/
|
199 |
|
|
|
200 |
|
|
/**
|
201 |
|
|
APPLY MORE RESTRICTIVE SETTINGS FOR WEBSITE BAKER
|
202 |
|
|
+ only allow file types: only textfiles (no PHP, Javascript or HTML files per default)
|
203 |
|
|
+ only allows images type: bmp, gif, jpges, jpg and png
|
204 |
|
|
+ only allows flash types: swf, flv (no fla ... flash action script per default)
|
205 |
|
|
+ only allows media types: swf, flv, jpg, gif, jpeg, png, avi, mgp, mpeg
|
206 |
|
|
*/
|
207 |
|
|
$Config['AllowedExtensions']['File'] = array();
|
208 |
|
|
$Config['DeniedExtensions']['File'] = array('html','htm','php','php2','php3','php4','php5','phtml','pwml','inc','asp','aspx','ascx','jsp','cfm','cfc','pl','bat','exe','com','dll','vbs','js','reg','cgi','htaccess','asis') ;
|
209 |
|
|
$Config['FileTypesPath']['File'] = $Config['UserFilesPath'];
|
210 |
|
|
$Config['FileTypesAbsolutePath']['File'] = $Config['UserFilesAbsolutePath'] ;
|
211 |
|
|
$Config['QuickUploadPath']['File'] = $Config['UserFilesPath'] ;
|
212 |
|
|
$Config['QuickUploadAbsolutePath']['File'] = $Config['UserFilesAbsolutePath'] ;
|
213 |
|
|
|
214 |
|
|
$Config['AllowedExtensions']['Image'] = array('bmp','gif','jpeg','jpg','png') ;
|
215 |
|
|
$Config['DeniedExtensions']['Image'] = array() ;
|
216 |
|
|
$Config['FileTypesPath']['Image'] = $Config['UserFilesPath'] ;
|
217 |
|
|
$Config['FileTypesAbsolutePath']['Image'] = $Config['UserFilesAbsolutePath'];
|
218 |
|
|
$Config['QuickUploadPath']['Image'] = $Config['UserFilesPath'] ;
|
219 |
|
|
$Config['QuickUploadAbsolutePath']['Image'] = $Config['UserFilesAbsolutePath'] ;
|
220 |
|
|
|
221 |
|
|
$Config['AllowedExtensions']['Flash'] = array('swf','flv') ;
|
222 |
|
|
$Config['DeniedExtensions']['Flash'] = array() ;
|
223 |
|
|
$Config['FileTypesPath']['Flash'] = $Config['UserFilesPath'];
|
224 |
|
|
$Config['FileTypesAbsolutePath']['Flash'] = $Config['UserFilesAbsolutePath'];
|
225 |
|
|
$Config['QuickUploadPath']['Flash'] = $Config['UserFilesPath'] ;
|
226 |
|
|
$Config['QuickUploadAbsolutePath']['Flash'] = $Config['UserFilesAbsolutePath'] ;
|
227 |
|
|
|
228 |
|
|
$Config['AllowedExtensions']['Media'] = array('swf','flv','jpg','gif','jpeg','png','avi','mpg','mpeg') ;
|
229 |
|
|
$Config['DeniedExtensions']['Media'] = array() ;
|
230 |
|
|
$Config['FileTypesPath']['Media'] = $Config['UserFilesPath'] . '' ;
|
231 |
|
|
$Config['FileTypesAbsolutePath']['Media'] = $Config['UserFilesAbsolutePath'];
|
232 |
|
|
$Config['QuickUploadPath']['Media'] = $Config['UserFilesPath'] ;
|
233 |
|
|
$Config['QuickUploadAbsolutePath']['Media'] = $Config['UserFilesAbsolutePath'] ;
|
234 |
|
|
|
235 |
1161
|
Luisehahne
|
?>
|