Project

General

Profile

« Previous | Next » 

Revision 1355

Added by FrankH almost 14 years ago

Security fixes

View differences:

branches/2.8.x/CHANGELOG
11 11 
! = Update/Change
12 12 

  		




  13
  13
  
    
------------------------------------- 2.8.2 -------------------------------------


  		




  
  14
  
    
27 Dec-2010 Build 1355 Frank Heyne (FrankH)


  		




  
  15
  
    
# security fix: remaining vulnerabilities mentioned in http://secunia.com/secunia_research/2010-90/


  		




  
  16
  
    
# security fix: in path admin/templates/ - added FTAN check


  		




  
  17
  
    
# security fix: in path admin/settings/ - added FTAN check


  		




  14
  18
  
    
26 Dec-2010 Dietmar Woellbrink (Luisehahne)


  		




  15
  19
  
    
+ added admin/images


  		




  16
  20
  
    
# fixed save handling settings entries


  		




  17
  21
  
    
! local sync


  		




  18
  
  
    
26 Dec-2010 Frank Heyne (FrankH)


  		




  
  22
  
    
26 Dec-2010 Build 1353 Frank Heyne (FrankH)


  		




  19
  23
  
    
# security fix: in modules/admin.php - check whether section belongs to page


  		




  20
  24
  
    
! security fix: changed $section_required into $no_section_required (apparently used by no module at all)


  		




  21
  25
  
    
# security fix: in path admin/users/ - added FTAN check


  		












  

    
      branches/2.8.x/wb/admin/templates/uninstall.php
    
  





  42
  42
  
    
require_once(WB_PATH.'/framework/class.admin.php');


  		




  43
  43
  
    
$admin = new admin('Addons', 'templates_uninstall');


  		




  44
  44
  
    

  		




  
  45
  
    
if( !$admin->checkFTAN() )


  		




  
  46
  
    
{


  		




  
  47
  
    
	$admin->print_error($MESSAGE['PAGES_NOT_SAVED'],'index.php');


  		




  
  48
  
    
	exit();


  		




  
  49
  
    
}


  		




  
  50
  
    

  		




  45
  51
  
    
// Include the WB functions file


  		




  46
  52
  
    
require_once(WB_PATH.'/framework/functions.php');


  		




  47
  53
  
    

  		












  

    
      branches/2.8.x/wb/admin/templates/details.php
    
  





  29
  29
  
    
require_once(WB_PATH.'/framework/class.admin.php');


  		




  30
  30
  
    
$admin = new admin('Addons', 'templates_view',false);


  		




  31
  31
  
    

  		




  
  32
  
    
if( !$admin->checkFTAN() )


  		




  
  33
  
    
{


  		




  
  34
  
    
	$admin->print_error($MESSAGE['PAGES_NOT_SAVED'],'index.php');


  		




  
  35
  
    
	exit();


  		




  
  36
  
    
}


  		




  
  37
  
    

  		




  32
  38
  
    
// Get template name


  		




  33
  39
  
    
if(!isset($_POST['file']) OR $_POST['file'] == "") {


  		




  34
  40
  
    
	header("Location: index.php");


  		




  ......




  50
  56
  
    
$template = new Template(THEME_PATH.'/templates');


  		




  51
  57
  
    
$template->set_file('page', 'templates_details.htt');


  		




  52
  58
  
    
$template->set_block('page', 'main_block', 'main');


  		




  
  59
  
    
$template->set_var('FTAN', $admin->getFTAN());


  		




  53
  60
  
    

  		




  54
  61
  
    
// Insert values


  		




  55
  62
  
    
$result = $database->query("SELECT * FROM ".TABLE_PREFIX."addons WHERE type = 'template' AND directory = '$file'");


  		












  

    
      branches/2.8.x/wb/admin/templates/install.php
    
  





  37
  37
  
    
require_once(WB_PATH.'/framework/class.admin.php');


  		




  38
  38
  
    
$admin = new admin('Addons', 'templates_install');


  		




  39
  39
  
    

  		




  
  40
  
    
if( !$admin->checkFTAN() )


  		




  
  41
  
    
{


  		




  
  42
  
    
	$admin->print_error($MESSAGE['PAGES_NOT_SAVED'],'index.php');


  		




  
  43
  
    
	exit();


  		




  
  44
  
    
}


  		




  
  45
  
    

  		




  40
  46
  
    
// Include the WB functions file


  		




  41
  47
  
    
require_once(WB_PATH.'/framework/functions.php');


  		




  42
  48
  
    

  		












  

    
      branches/2.8.x/wb/admin/templates/index.php
    
  





  32
  32
  
    
$template = new Template(THEME_PATH.'/templates');


  		




  33
  33
  
    
$template->set_file('page', 'templates.htt');


  		




  34
  34
  
    
$template->set_block('page', 'main_block', 'main');


  		




  
  35
  
    
$template->set_var('FTAN', $admin->getFTAN());


  		




  35
  36
  
    

  		




  36
  37
  
    
// Insert values into template list


  		




  37
  38
  
    
$template->set_block('main_block', 'template_list_block', 'template_list');


  		












  

    
      branches/2.8.x/wb/admin/interface/version.php
    
  





  52
  52
  
    

  		




  53
  53
  
    
// check if defined to avoid errors during installation (redirect to admin panel fails if PHP error/warnings are enabled)


  		




  54
  54
  
    
if(!defined('VERSION')) define('VERSION', '2.8.2.RC1');


  		




  55
  
  
    
if(!defined('REVISION')) define('REVISION', '1354');


  		




  
  55
  
    
if(!defined('REVISION')) define('REVISION', '1355');


  		




  56
  56
  
    

  		




  57
  57
  
    
?>


  		












  

    
      branches/2.8.x/wb/admin/settings/save.php
    
  





  34
  34
  
    
	$admin = new admin('Settings', 'settings_advanced');


  		




  35
  35
  
    
}


  		




  36
  36
  
    

  		




  
  37
  
    
if( !$admin->checkFTAN() )


  		




  
  38
  
    
{


  		




  
  39
  
    
	$admin->print_error($MESSAGE['PAGES_NOT_SAVED'],'index.php');


  		




  
  40
  
    
	exit();


  		




  
  41
  
    
}


  		




  
  42
  
    

  		




  37
  43
  
    
// Create a javascript back link


  		




  38
  44
  
    
$js_back = "javascript: history.go(-1);";


  		




  39
  45
  
    

  		












  

    
      branches/2.8.x/wb/admin/settings/index.php
    
  





  35
  35
  
    

  		




  36
  36
  
    
$template->set_file('page',        'settings.htt');


  		




  37
  37
  
    
$template->set_block('page',       'main_block', 'main');


  		




  
  38
  
    
$template->set_var('FTAN', $admin->getFTAN());


  		




  38
  39
  
    

  		




  39
  40
  
    
$template->set_block('main_block', 'template_list_block',         'template_list');


  		




  40
  41
  
    
$template->set_block('main_block', 'timezone_list_block',         'timezone_list');


  		












  

    
      branches/2.8.x/wb/templates/wb_theme/templates/templates.htt
    
  





  8
  8
  
    
{CHANGE_TEMPLATE_NOTICE}<br /><br />


  		




  9
  9
  
    

  		




  10
  10
  
    
<form name="install" enctype="multipart/form-data" action="install.php" method="post" class="{DISPLAY_INSTALL}">


  		




  
  11
  
    
{FTAN}


  		




  11
  12
  
    

  		




  12
  13
  
    
<h2>{HEADING_INSTALL_TEMPLATE}</h2>


  		




  13
  14
  
    

  		




  ......




  30
  31
  
    
</form>


  		




  31
  32
  
    

  		




  32
  33
  
    
<form name="uninstall" action="uninstall.php" method="post" class="{DISPLAY_UNINSTALL}">


  		




  
  34
  
    
{FTAN}


  		




  33
  35
  
    

  		




  34
  36
  
    
<h2>{HEADING_UNINSTALL_TEMPLATE}</h2>


  		




  35
  37
  
    

  		




  ......




  54
  56
  
    
</form>


  		




  55
  57
  
    

  		




  56
  58
  
    
<form name="details" action="details.php" method="post" class="{DISPLAY_LIST}">


  		




  
  59
  
    
{FTAN}


  		




  57
  60
  
    

  		




  58
  61
  
    
<h2>{HEADING_TEMPLATE_DETAILS}</h2>


  		




  59
  62
  
    

  		












  

    
      branches/2.8.x/wb/templates/wb_theme/templates/settings.htt
    
  





  2
  2
  
    

  		




  3
  3
  
    
<form name="settings" action="save.php" method="post">


  		




  4
  4
  
    
<input type="hidden" name="advanced" value="{ADVANCED}" />


  		




  
  5
  
    
{FTAN}


  		




  5
  6
  
    

  		




  6
  7
  
    
<table cellpadding="3" cellspacing="0" border="0" align="center" width="100%" class="settings_table">


  		




  7
  8
  
    
<tr>


  		












  

    
      branches/2.8.x/wb/templates/argos_theme/templates/settings.htt
    
  





  2
  2
  
    

  		




  3
  3
  
    
<form name="settings" action="save.php" method="post">


  		




  4
  4
  
    
<input type="hidden" name="advanced" value="{ADVANCED}" />


  		




  
  5
  
    
{FTAN}


  		




  5
  6
  
    

  		




  6
  7
  
    
<table cellpadding="3" cellspacing="0" border="0" align="center" width="100%" class="settings_table">


  		




  7
  8
  
    
<tr>


  		












  

    
      branches/2.8.x/wb/templates/argos_theme/templates/templates.htt
    
  





  14
  14
  
    
</table>


  		




  15
  15
  
    

  		




  16
  16
  
    
<form name="install" enctype="multipart/form-data" action="install.php" method="post" class="{DISPLAY_INSTALL}">


  		




  
  17
  
    
{FTAN}


  		




  17
  18
  
    

  		




  18
  19
  
    
<h2>{HEADING_INSTALL_TEMPLATE}</h2>


  		




  19
  20
  
    

  		




  ......




  36
  37
  
    
</form>


  		




  37
  38
  
    

  		




  38
  39
  
    
<form name="uninstall" action="uninstall.php" method="post" class="{DISPLAY_UNINSTALL}">


  		




  
  40
  
    
{FTAN}


  		




  39
  41
  
    

  		




  40
  42
  
    
<h2>{HEADING_UNINSTALL_TEMPLATE}</h2>


  		




  41
  43
  
    

  		




  ......




  60
  62
  
    
</form>


  		




  61
  63
  
    

  		




  62
  64
  
    
<form name="details" action="details.php" method="post" class="{DISPLAY_LIST}">


  		




  
  65
  
    
{FTAN}


  		




  63
  66
  
    

  		




  64
  67
  
    
<h2>{HEADING_TEMPLATE_DETAILS}</h2>


  		




  65
  68
  
    

  		












  

    
      branches/2.8.x/wb/modules/form/save_field.php
    
  





  46
  46
  
    
if($admin->get_post('title') == '' OR $admin->get_post('type') == '') {


  		




  47
  47
  
    
	$admin->print_error($MESSAGE['GENERIC']['FILL_IN_ALL'], WB_URL.'/modules/form/modify_field.php?page_id='.$page_id.'&section_id='.$section_id.'&field_id='.$field_id);


  		




  48
  48
  
    
} else {


  		




  49
  
  
    
	$title = $admin->add_slashes($admin->get_post('title'));


  		




  
  49
  
    
	$title = htmlspecialchars($admin->get_post_escaped('title'), ENT_QUOTES);


  		




  50
  50
  
    
	$type = $admin->add_slashes($admin->get_post('type'));


  		




  51
  
  
    
	$required = $admin->add_slashes($admin->get_post('required'));


  		




  
  51
  
    
	$required = (int) $admin->add_slashes($admin->get_post('required'));


  		




  52
  52
  
    
}


  		




  53
  53
  
    
$value = '';


  		




  54
  54
  
    

  		












Also available in:  Unified diff