Index: branches/2.8.x/CHANGELOG =================================================================== --- branches/2.8.x/CHANGELOG (revision 1374) +++ branches/2.8.x/CHANGELOG (revision 1375) @@ -11,6 +11,9 @@ ! = Update/Change ------------------------------------- 2.8.2 ------------------------------------- +10 Jan-2011 Build 1375 Frank Heyne (FrankH) +# Security fix for Form module (new version is 2.8) +# bugfix for delete_field in Form module 10 Jan-2011 Build 1374 Dietmar Woellbrink (Luisehahne) # fixed headerinfos 10 Jan-2011 Build 1373 Dietmar Woellbrink (Luisehahne) Index: branches/2.8.x/wb/admin/interface/version.php =================================================================== --- branches/2.8.x/wb/admin/interface/version.php (revision 1374) +++ branches/2.8.x/wb/admin/interface/version.php (revision 1375) @@ -52,6 +52,6 @@ // check if defined to avoid errors during installation (redirect to admin panel fails if PHP error/warnings are enabled) if(!defined('VERSION')) define('VERSION', '2.8.2.RC4'); -if(!defined('REVISION')) define('REVISION', '1374'); +if(!defined('REVISION')) define('REVISION', '1375'); ?> \ No newline at end of file Index: branches/2.8.x/wb/modules/form/modify_field.php =================================================================== --- branches/2.8.x/wb/modules/form/modify_field.php (revision 1374) +++ branches/2.8.x/wb/modules/form/modify_field.php (revision 1375) @@ -1,46 +1,33 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ - -require('../../config.php'); - // Get id -if(!isset($_GET['field_id']) OR !is_numeric($_GET['field_id'])) { - header("Location: ".ADMIN_URL."/pages/index.php"); - exit(0); -} else { - $field_id = $_GET['field_id']; +$field_id = $admin->checkIDKEY('field_id', false, 'GET'); +if (!$field_id) { + $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS']." MF: $field_id :-(", ADMIN_URL.'/pages/modify.php?page_id='.$page_id); + exit(); } -// Include WB admin wrapper script -require(WB_PATH.'/modules/admin.php'); - // Get header and footer $query_content = $database->query("SELECT * FROM ".TABLE_PREFIX."mod_form_fields WHERE field_id = '$field_id'"); $form = $query_content->fetchRow(); @@ -59,6 +46,7 @@ +getFTAN(); ?> Index: branches/2.8.x/wb/modules/form/add_field.php =================================================================== --- branches/2.8.x/wb/modules/form/add_field.php (revision 1374) +++ branches/2.8.x/wb/modules/form/add_field.php (revision 1375) @@ -1,33 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ - require('../../config.php'); // Include WB admin wrapper script @@ -47,9 +35,9 @@ // Say that a new record has been added, then redirect to modify page if($database->is_error()) { - $admin->print_error($database->get_error(), WB_URL.'/modules/form/modify_field.php?page_id='.$page_id.'§ion_id='.$section_id.'&field_id='.$field_id); + $admin->print_error($database->get_error(), WB_URL.'/modules/form/modify_field.php?page_id='.$page_id.'§ion_id='.$section_id.'&field_id='.$admin->getIDKEY($field_id)); } else { - $admin->print_success($TEXT['SUCCESS'], WB_URL.'/modules/form/modify_field.php?page_id='.$page_id.'§ion_id='.$section_id.'&field_id='.$field_id); + $admin->print_success($TEXT['SUCCESS'], WB_URL.'/modules/form/modify_field.php?page_id='.$page_id.'§ion_id='.$section_id.'&field_id='.$admin->getIDKEY($field_id)); } // Print admin footer Index: branches/2.8.x/wb/modules/form/info.php =================================================================== --- branches/2.8.x/wb/modules/form/info.php (revision 1374) +++ branches/2.8.x/wb/modules/form/info.php (revision 1375) @@ -1,37 +1,25 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ - $module_directory = 'form'; $module_name = 'Form'; $module_function = 'page'; -$module_version = '2.7'; +$module_version = '2.8'; $module_platform = '2.7 | 2.8.x'; $module_author = 'Ryan Djurovich & Rudolph Lartey - additions John Maats - PCWacht'; $module_license = 'GNU General Public License'; Index: branches/2.8.x/wb/modules/form/move_down.php =================================================================== --- branches/2.8.x/wb/modules/form/move_down.php (revision 1374) +++ branches/2.8.x/wb/modules/form/move_down.php (revision 1375) @@ -1,46 +1,33 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ - -require('../../config.php'); - // Get id -if(!isset($_GET['field_id']) OR !is_numeric($_GET['field_id'])) { - header("Location: index.php"); - exit(0); -} else { - $field_id = $_GET['field_id']; +$field_id = $admin->checkIDKEY('field_id', false, 'GET'); +if (!$field_id) { + $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL.'/pages/modify.php?page_id='.$page_id); + exit(); } -// Include WB admin wrapper script -require(WB_PATH.'/modules/admin.php'); - // Include the ordering class require(WB_PATH.'/framework/class.order.php'); Index: branches/2.8.x/wb/modules/form/save_field.php =================================================================== --- branches/2.8.x/wb/modules/form/save_field.php (revision 1374) +++ branches/2.8.x/wb/modules/form/save_field.php (revision 1375) @@ -1,38 +1,27 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ - require('../../config.php'); +require(WB_PATH.'/modules/admin.php'); // Get id if(!isset($_POST['field_id']) OR !is_numeric($_POST['field_id'])) { - header("Location: ".ADMIN_URL."/pages/index.php"); + $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL.'/pages/modify.php?page_id='.$page_id); exit(0); } else { $field_id = $_POST['field_id']; @@ -40,11 +29,16 @@ // Include WB admin wrapper script $update_when_modified = true; // Tells script to update when this page was last updated -require(WB_PATH.'/modules/admin.php'); +if (!$admin->checkFTAN()) +{ + $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL.'/pages/modify.php?page_id='.$page_id); + exit(); +} + // Validate all fields if($admin->get_post('title') == '' OR $admin->get_post('type') == '') { - $admin->print_error($MESSAGE['GENERIC']['FILL_IN_ALL'], WB_URL.'/modules/form/modify_field.php?page_id='.$page_id.'§ion_id='.$section_id.'&field_id='.$field_id); + $admin->print_error($MESSAGE['GENERIC']['FILL_IN_ALL'], WB_URL.'/modules/form/modify_field.php?page_id='.$page_id.'§ion_id='.$section_id.'&field_id='.$admin->getIDKEY($field_id)); } else { $title = htmlspecialchars($admin->get_post_escaped('title'), ENT_QUOTES); $type = $admin->add_slashes($admin->get_post('type')); @@ -93,9 +87,9 @@ // Check if there is a db error, otherwise say successful if($database->is_error()) { - $admin->print_error($database->get_error(), WB_URL.'/modules/form/modify_field.php?page_id='.$page_id.'§ion_id='.$section_id.'&field_id='.$field_id); + $admin->print_error($database->get_error(), WB_URL.'/modules/form/modify_field.php?page_id='.$page_id.'§ion_id='.$section_id.'&field_id='.$admin->getIDKEY($field_id)); } else { - $admin->print_success($TEXT['SUCCESS'], WB_URL.'/modules/form/modify_field.php?page_id='.$page_id.'§ion_id='.$section_id.'&field_id='.$field_id); + $admin->print_success($TEXT['SUCCESS'], WB_URL.'/modules/form/modify_field.php?page_id='.$page_id.'§ion_id='.$section_id.'&field_id='.$admin->getIDKEY($field_id)); } // Print admin footer Index: branches/2.8.x/wb/modules/form/delete.php =================================================================== --- branches/2.8.x/wb/modules/form/delete.php (revision 1374) +++ branches/2.8.x/wb/modules/form/delete.php (revision 1375) @@ -23,10 +23,8 @@ */ -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ +// Must include code to stop this file being access directly +if(defined('WB_PATH') == false) { exit("Cannot access this file directly"); } // Delete page from mod_wysiwyg $database->query("DELETE FROM ".TABLE_PREFIX."mod_form_fields WHERE page_id = '$page_id' AND section_id='$section_id'"); Index: branches/2.8.x/wb/modules/form/search.php =================================================================== --- branches/2.8.x/wb/modules/form/search.php (revision 1374) +++ branches/2.8.x/wb/modules/form/search.php (revision 1375) @@ -1,28 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - function form_search($func_vars) { extract($func_vars, EXTR_PREFIX_ALL, 'func'); Index: branches/2.8.x/wb/modules/form/delete_field.php =================================================================== --- branches/2.8.x/wb/modules/form/delete_field.php (revision 1374) +++ branches/2.8.x/wb/modules/form/delete_field.php (revision 1375) @@ -1,52 +1,44 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ - require('../../config.php'); -// Get id -if(!isset($_GET['field_id']) OR !is_numeric($_GET['field_id'])) { - header("Location: ".ADMIN_URL."/pages/index.php"); - exit(0); -} else { - $field_id = $_GET['field_id']; -} - // Include WB admin wrapper script $update_when_modified = true; // Tells script to update when this page was last updated require(WB_PATH.'/modules/admin.php'); +// Get id +$field_id = $admin->checkIDKEY('field_id', false, 'GET'); +if (!$field_id) { + $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL.'/pages/modify.php?page_id='.$page_id); + exit(); +} + // Delete row $database->query("DELETE FROM ".TABLE_PREFIX."mod_form_fields WHERE field_id = '$field_id'"); -// Check if there is a db error, otherwise say successful -if($database->is_error()) { +// Include the ordering class +require(WB_PATH.'/framework/class.order.php'); + +// Create new order object an reorder +$order = new order(TABLE_PREFIX.'mod_form_fields', 'position', 'field_id', 'section_id'); + +if($order->clean($section_id)) { $admin->print_error($database->get_error(), ADMIN_URL.'/pages/modify.php?page_id='.$page_id); } else { $admin->print_success($TEXT['SUCCESS'], ADMIN_URL.'/pages/modify.php?page_id='.$page_id); Index: branches/2.8.x/wb/modules/form/index.php =================================================================== --- branches/2.8.x/wb/modules/form/index.php (revision 1374) +++ branches/2.8.x/wb/modules/form/index.php (revision 1375) @@ -1,33 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ - header('Location: ../index.php'); ?> \ No newline at end of file Index: branches/2.8.x/wb/modules/form/modify_settings.php =================================================================== --- branches/2.8.x/wb/modules/form/modify_settings.php (revision 1374) +++ branches/2.8.x/wb/modules/form/modify_settings.php (revision 1375) @@ -1,33 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ - require('../../config.php'); // Include WB admin wrapper script @@ -75,6 +63,7 @@ +getFTAN(); ?>
Index: branches/2.8.x/wb/modules/form/uninstall.php =================================================================== --- branches/2.8.x/wb/modules/form/uninstall.php (revision 1374) +++ branches/2.8.x/wb/modules/form/uninstall.php (revision 1375) @@ -1,33 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ - // Must include code to stop this file being access directly if(defined('WB_PATH') == false) { exit("Cannot access this file directly"); } Index: branches/2.8.x/wb/modules/form/view.php =================================================================== --- branches/2.8.x/wb/modules/form/view.php (revision 1374) +++ branches/2.8.x/wb/modules/form/view.php (revision 1375) @@ -1,41 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - - * @category frontend - * @package outputfilter - * @author(s) Dietmar Wöllbrink , Dietrich Roland Pehlke - * @platform WB 2.8.0 - * @require PHP 5.2.x - * @license http://www.gnu.org/licenses/gpl.html - * @link http://project.websitebaker2.org/browser/branches/2.8.x/wb/modules/form/view.php - * @changeset 2009/12/03 comment out ob_end_flush line 259 -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ - // Must include code to stop this file being access directly if(defined('WB_PATH') == false) { exit("Cannot access this file directly"); } @@ -147,6 +127,7 @@
0) AND (false == $use_xhtml_strict) ) ? "name=\"".$form_name."\"" : ""); ?> action="#wb_" method="post">
+getFTAN(); ?>
checkFTAN()) + { + $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS']); + exit(); + } + // Submit form data // First start message settings $query_settings = $database->query("SELECT * FROM ".TABLE_PREFIX."mod_form_settings WHERE section_id = '$section_id'"); Index: branches/2.8.x/wb/modules/form/move_up.php =================================================================== --- branches/2.8.x/wb/modules/form/move_up.php (revision 1374) +++ branches/2.8.x/wb/modules/form/move_up.php (revision 1375) @@ -1,46 +1,33 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ - -require('../../config.php'); - // Get id -if(!isset($_GET['field_id']) OR !is_numeric($_GET['field_id'])) { - header("Location: index.php"); - exit(0); -} else { - $field_id = $_GET['field_id']; +$field_id = $admin->checkIDKEY('field_id', false, 'GET'); +if (!$field_id) { + $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL.'/pages/modify.php?page_id='.$page_id); + exit(); } -// Include WB admin wrapper script -require(WB_PATH.'/modules/admin.php'); - // Include the ordering class require(WB_PATH.'/framework/class.order.php'); Index: branches/2.8.x/wb/modules/form/delete_submission.php =================================================================== --- branches/2.8.x/wb/modules/form/delete_submission.php (revision 1374) +++ branches/2.8.x/wb/modules/form/delete_submission.php (revision 1375) @@ -1,47 +1,34 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra submission types -*/ - require('../../config.php'); -// Get id -if(!isset($_GET['submission_id']) OR !is_numeric($_GET['submission_id'])) { - header("Location: ".ADMIN_URL."/pages/index.php"); - exit(0); -} else { - $submission_id = $_GET['submission_id']; -} - // Include WB admin wrapper script $update_when_modified = true; // Tells script to update when this page was last updated require(WB_PATH.'/modules/admin.php'); +// Get id +$submission_id = $admin->checkIDKEY('submission_id', false, 'GET'); +if (!$submission_id) { + $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL.'/pages/modify.php?page_id='.$page_id); + exit(); +} + // Delete row $database->query("DELETE FROM ".TABLE_PREFIX."mod_form_submissions WHERE submission_id = '$submission_id'"); Index: branches/2.8.x/wb/modules/form/save_settings.php =================================================================== --- branches/2.8.x/wb/modules/form/save_settings.php (revision 1374) +++ branches/2.8.x/wb/modules/form/save_settings.php (revision 1375) @@ -1,33 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ - require('../../config.php'); // Include WB admin wrapper script @@ -34,6 +22,12 @@ $update_when_modified = true; // Tells script to update when this page was last updated require(WB_PATH.'/modules/admin.php'); +if (!$admin->checkFTAN()) +{ + $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL.'/pages/modify.php?page_id='.$page_id); + exit(); +} + // This code removes any ', ''); Index: branches/2.8.x/wb/modules/form/view_submission.php =================================================================== --- branches/2.8.x/wb/modules/form/view_submission.php (revision 1374) +++ branches/2.8.x/wb/modules/form/view_submission.php (revision 1375) @@ -1,46 +1,33 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ - -require('../../config.php'); - // Get id -if(!isset($_GET['submission_id']) OR !is_numeric($_GET['submission_id'])) { - header("Location: ".ADMIN_URL."/pages/index.php"); - exit(0); -} else { - $submission_id = $_GET['submission_id']; +$submission_id = $admin->checkIDKEY('submission_id', false, 'GET'); +if (!$submission_id) { + $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL.'/pages/modify.php?page_id='.$page_id); + exit(); } -// Include WB admin wrapper script -require(WB_PATH.'/modules/admin.php'); - // Get submission details $query_content = $database->query("SELECT * FROM ".TABLE_PREFIX."mod_form_submissions WHERE submission_id = '$submission_id'"); $submission = $query_content->fetchRow(); @@ -84,7 +71,7 @@
- + - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ - // Must include code to stop this file being access directly if(!defined('WB_PATH')) { exit("Cannot access this file directly"); } @@ -68,12 +56,12 @@ ?> @@ -114,7 +102,7 @@ @@ -167,7 +155,7 @@ ?> @@ -174,7 +162,7 @@ Index: branches/2.8.x/wb/modules/form/add.php =================================================================== --- branches/2.8.x/wb/modules/form/add.php (revision 1374) +++ branches/2.8.x/wb/modules/form/add.php (revision 1375) @@ -1,33 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - -/* -The Website Baker Project would like to thank Rudolph Lartey -for his contributions to this module - adding extra field types -*/ - // Insert an extra rows into the database $header = '
- + ^ - + - + ^ @@ -121,13 +109,13 @@ - + v - + X
- + <?php echo $TEXT['OPEN']; ?> - + X
'; $field_loop = '';
{TITLE}{REQUIRED}:{FIELD}