Index: branches/2.8.x/CHANGELOG =================================================================== --- branches/2.8.x/CHANGELOG (revision 1375) +++ branches/2.8.x/CHANGELOG (revision 1376) @@ -11,6 +11,9 @@ ! = Update/Change ------------------------------------- 2.8.2 ------------------------------------- +11 Jan-2011 Build 1376 Frank Heyne (FrankH) +# Security fix for WYSIWYG module +# Security fix for Wrapper module 10 Jan-2011 Build 1375 Frank Heyne (FrankH) # Security fix for Form module (new version is 2.8) # bugfix for delete_field in Form module Index: branches/2.8.x/wb/admin/interface/version.php =================================================================== --- branches/2.8.x/wb/admin/interface/version.php (revision 1375) +++ branches/2.8.x/wb/admin/interface/version.php (revision 1376) @@ -52,6 +52,6 @@ // check if defined to avoid errors during installation (redirect to admin panel fails if PHP error/warnings are enabled) if(!defined('VERSION')) define('VERSION', '2.8.2.RC4'); -if(!defined('REVISION')) define('REVISION', '1375'); +if(!defined('REVISION')) define('REVISION', '1376'); ?> \ No newline at end of file Index: branches/2.8.x/wb/modules/wrapper/view.php =================================================================== --- branches/2.8.x/wb/modules/wrapper/view.php (revision 1375) +++ branches/2.8.x/wb/modules/wrapper/view.php (revision 1376) @@ -1,28 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - // check if module language file exists for the language set by the user (e.g. DE, EN) if(!file_exists(WB_PATH .'/modules/wrapper/languages/'.LANGUAGE .'.php')) { // no module language file exists for the language set by the user, include default module language file EN.php Index: branches/2.8.x/wb/modules/wrapper/info.php =================================================================== --- branches/2.8.x/wb/modules/wrapper/info.php (revision 1375) +++ branches/2.8.x/wb/modules/wrapper/info.php (revision 1376) @@ -1,32 +1,25 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - $module_directory = 'wrapper'; $module_name = 'Wrapper'; $module_function = 'page'; -$module_version = '2.7'; +$module_version = '2.8'; $module_platform = '2.7 | 2.8.x'; $module_author = 'Ryan Djurovich'; $module_license = 'GNU General Public License'; Index: branches/2.8.x/wb/modules/wrapper/save.php =================================================================== --- branches/2.8.x/wb/modules/wrapper/save.php (revision 1375) +++ branches/2.8.x/wb/modules/wrapper/save.php (revision 1376) @@ -1,28 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - require('../../config.php'); // Include WB admin wrapper script @@ -29,6 +22,12 @@ $update_when_modified = true; // Tells script to update when this page was last updated require(WB_PATH.'/modules/admin.php'); +if (!$admin->checkFTAN()) +{ + $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL.'/pages/modify.php?page_id='.$page_id); + exit(); +} + // Update the mod_wrapper table with the contents if(isset($_POST['url'])) { $url = $admin->add_slashes(strip_tags($_POST['url'])); Index: branches/2.8.x/wb/modules/wrapper/modify.htt =================================================================== --- branches/2.8.x/wb/modules/wrapper/modify.htt (revision 1375) +++ branches/2.8.x/wb/modules/wrapper/modify.htt (revision 1376) @@ -4,7 +4,7 @@ - +{FTAN}
Index: branches/2.8.x/wb/modules/wrapper/delete.php =================================================================== --- branches/2.8.x/wb/modules/wrapper/delete.php (revision 1375) +++ branches/2.8.x/wb/modules/wrapper/delete.php (revision 1376) @@ -1,28 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - // Delete page from mod_wrapper $database->query("DELETE FROM ".TABLE_PREFIX."mod_wrapper WHERE section_id = '$section_id'"); Index: branches/2.8.x/wb/modules/wrapper/index.php =================================================================== --- branches/2.8.x/wb/modules/wrapper/index.php (revision 1375) +++ branches/2.8.x/wb/modules/wrapper/index.php (revision 1376) @@ -1,28 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - header('Location: ../index.php'); ?> \ No newline at end of file Index: branches/2.8.x/wb/modules/wrapper/modify.php =================================================================== --- branches/2.8.x/wb/modules/wrapper/modify.php (revision 1375) +++ branches/2.8.x/wb/modules/wrapper/modify.php (revision 1376) @@ -1,28 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - // Setup template object $template = new Template(WB_PATH.'/modules/wrapper'); $template->set_file('page', 'modify.htt'); @@ -45,7 +38,8 @@ 'TEXT_URL' => $TEXT['URL'], 'TEXT_HEIGHT' => $TEXT['HEIGHT'], 'TEXT_SAVE' => $TEXT['SAVE'], - 'TEXT_CANCEL' => $TEXT['CANCEL'] + 'TEXT_CANCEL' => $TEXT['CANCEL'], + 'FTAN' => $admin->getFTAN() ) ); Index: branches/2.8.x/wb/modules/wrapper/add.php =================================================================== --- branches/2.8.x/wb/modules/wrapper/add.php (revision 1375) +++ branches/2.8.x/wb/modules/wrapper/add.php (revision 1376) @@ -1,28 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - // Insert an extra row into the database $database->query("INSERT INTO ".TABLE_PREFIX."mod_wrapper (page_id,section_id,height) VALUES ('$page_id','$section_id','400')"); Index: branches/2.8.x/wb/modules/wysiwyg/save.php =================================================================== --- branches/2.8.x/wb/modules/wysiwyg/save.php (revision 1375) +++ branches/2.8.x/wb/modules/wysiwyg/save.php (revision 1376) @@ -22,6 +22,12 @@ $update_when_modified = true; // Tells script to update when this page was last updated require(WB_PATH.'/modules/admin.php'); +if (!$admin->checkFTAN()) +{ + $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL.'/pages/modify.php?page_id='.$page_id); + exit(); +} + // Include the WB functions file require_once(WB_PATH.'/framework/functions.php'); @@ -30,7 +36,6 @@ $content = $admin->add_slashes($_POST['content'.$section_id]); // searching in $text will be much easier this way $text = umlauts_to_entities(strip_tags($content), strtoupper(DEFAULT_CHARSET), 0); - $database = new database(); $query = "UPDATE ".TABLE_PREFIX."mod_wysiwyg SET content = '$content', text = '$text' WHERE section_id = '$section_id'"; $database->query($query); } Index: branches/2.8.x/wb/modules/wysiwyg/delete.php =================================================================== --- branches/2.8.x/wb/modules/wysiwyg/delete.php (revision 1375) +++ branches/2.8.x/wb/modules/wysiwyg/delete.php (revision 1376) @@ -1,28 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - // Delete record from the database $database->query("DELETE FROM ".TABLE_PREFIX."mod_wysiwyg WHERE section_id = '$section_id'"); Index: branches/2.8.x/wb/modules/wysiwyg/index.php =================================================================== --- branches/2.8.x/wb/modules/wysiwyg/index.php (revision 1375) +++ branches/2.8.x/wb/modules/wysiwyg/index.php (revision 1376) @@ -1,28 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - header('Location: ../index.php'); ?> \ No newline at end of file Index: branches/2.8.x/wb/modules/wysiwyg/modify.php =================================================================== --- branches/2.8.x/wb/modules/wysiwyg/modify.php (revision 1375) +++ branches/2.8.x/wb/modules/wysiwyg/modify.php (revision 1376) @@ -52,6 +52,7 @@ getFTAN()."\n"; show_wysiwyg_editor('content'.$section_id,'content'.$section_id,$content,'100%','350px'); ?> Index: branches/2.8.x/wb/modules/wysiwyg/add.php =================================================================== --- branches/2.8.x/wb/modules/wysiwyg/add.php (revision 1375) +++ branches/2.8.x/wb/modules/wysiwyg/add.php (revision 1376) @@ -1,28 +1,21 @@ - Copyright (C) 2004-2009, Ryan Djurovich - - Website Baker is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - Website Baker is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with Website Baker; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -*/ - // Insert an extra row into the database $database->query("INSERT INTO ".TABLE_PREFIX."mod_wysiwyg (page_id,section_id) VALUES ('$page_id','$section_id')");