/ - Diff - WB 2.08.x - Tracking

     ! = Update/Change
     ------------------------------------- 2.8.2 -------------------------------------
 Jan-2011 Build 1389 Frank Heyne (FrankH)
     # Security fixes for modules captcha_control, code and droplets
 Jan-2011 Build 1388 Dietmar Woellbrink (Luisehahne)
     # more Security fix for admin/pages
 Jan-2011 Build 1387 Dietmar Woellbrink (Luisehahne)

branches/2.8.x/wb/admin/interface/version.php
52	52
53	53	// check if defined to avoid errors during installation (redirect to admin panel fails if PHP error/warnings are enabled)
54	54	if(!defined('VERSION')) define('VERSION', '2.8.2.RC4');
55		if(!defined('REVISION')) define('REVISION', '1388');
	55	if(!defined('REVISION')) define('REVISION', '1389');
56	56
57	57	?>

     $module_directory 	= 'captcha_control';
     $module_name 			= 'Captcha and Advanced-Spam-Protection (ASP) Control';
     $module_function 		= 'tool';
     $module_version 		= '1.0';
     $module_version 		= '1.1';
     $module_platform 		= '2.7 | 2.8.x';
     $module_author 		= 'Thomas Hornik (thorn)';
     $module_license 		= 'GNU General Public License';

     <?php
     // $Id$
     /*
      Website Baker Project <http://www.websitebaker.org/>
      Copyright (C) 2004-2009, Ryan Djurovich
      Website Baker is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published by
      the Free Software Foundation; either version 2 of the License, or
      (at your option) any later version.
      Website Baker is distributed in the hope that it will be useful,
      but WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      GNU General Public License for more details.
      You should have received a copy of the GNU General Public License
      along with Website Baker; if not, write to the Free Software
      Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
     */
     // direct access prevention
     defined('WB_PATH') OR die(header('Location: ../index.php'));
     // check if module language file exists for the language set by the user (e.g. DE, EN)
     if(!file_exists(WB_PATH .'/modules/captcha_control/languages/'.LANGUAGE .'.php')) {
     	// no module language file exists for the language set by the user, include default module language file EN.php
     	require_once(WB_PATH .'/modules/captcha_control/languages/EN.php');
     } else {
     	// a module language file exists for the language defined by the user, load it
     	require_once(WB_PATH .'/modules/captcha_control/languages/'.LANGUAGE .'.php');
+    }
     $table = TABLE_PREFIX.'mod_captcha_control';
     $js_back = "javascript: history.go(-1);";
     // check if data was submitted
     if(isset($_POST['save_settings'])) {
     	// get configuration settings
     	$enabled_captcha = ($_POST['enabled_captcha'] == '1') ? '1' : '0';
     	$enabled_asp = ($_POST['enabled_asp'] == '1') ? '1' : '0';
     	$captcha_type = $admin->add_slashes($_POST['captcha_type']);
     	// update database settings
     	$database->query("UPDATE $table SET
     		enabled_captcha = '$enabled_captcha',
     		enabled_asp = '$enabled_asp',
     		captcha_type = '$captcha_type'
     	");
     	// save text-captchas
     	if($captcha_type == 'text') { // ct_text
     		$text_qa=$admin->add_slashes($_POST['text_qa']);
     		if(!preg_match('/### .*? ###/', $text_qa)) {
     			$database->query("UPDATE $table SET ct_text = '$text_qa'");
+    		}
+    	}
     	// check if there is a database error, otherwise say successful
     	if($database->is_error()) {
     		$admin->print_error($database->get_error(), $js_back);
     	} else {
     		$admin->print_success($MESSAGE['PAGES']['SAVED'], ADMIN_URL.'/admintools/tool.php?tool=captcha_control');
+    	}
     } else {
     	// include captcha-file
     	require_once(WB_PATH .'/include/captcha/captcha.php');
     	// load text-captchas
     	$text_qa='';
     	if($query = $database->query("SELECT ct_text FROM $table")) {
     		$data = $query->fetchRow();
     		$text_qa = $data['ct_text'];
+    	}
     	if($text_qa == '')
     		$text_qa = $MOD_CAPTCHA_CONTROL['CAPTCHA_TEXT_DESC'];
     // script to load image
     ?>
     <script type="text/javascript">
     	var pics = new Array();
     	pics["ttf_image"] = new Image();
     	pics["ttf_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/ttf_image.png'?>";
     	pics["calc_image"] = new Image();
     	pics["calc_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/calc_image.png'?>";
     	pics["calc_ttf_image"] = new Image();
     	pics["calc_ttf_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/calc_ttf_image.png'?>";
     	pics["old_image"] = new Image();
     	pics["old_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/old_image.png'?>";
     	pics["calc_text"] = new Image();
     	pics["calc_text"].src = "<?php echo WB_URL.'/include/captcha/captchas/calc_text.png'?>";
     	pics["text"] = new Image();
     	pics["text"].src = "<?php echo WB_URL.'/include/captcha/captchas/text.png'?>";
     	function load_captcha_image() {
     		document.captcha_example.src = pics[document.store_settings.captcha_type.value].src;
     		toggle_text_qa();
+    	}
     	function toggle_text_qa() {
     		if(document.store_settings.captcha_type.value == 'text' ) {
     			document.getElementById('text_qa').style.display = '';
     		} else {
     			document.getElementById('text_qa').style.display = 'none';
+    		}
+    	}
     </script>
     <?php
     	// connect to database and read out captcha settings
     	if($query = $database->query("SELECT * FROM $table")) {
     		$data = $query->fetchRow();
     		$enabled_captcha = $data['enabled_captcha'];
     		$enabled_asp = $data['enabled_asp'];
     		$captcha_type = $data['captcha_type'];
     	} else {
     		// something went wrong, use dummy value
     		$enabled_captcha = '1';
     		$enabled_asp = '1';
     		$captcha_type = 'calc_text';
+    	}
     	// write out heading
     	echo '<h2>' .$MOD_CAPTCHA_CONTROL['HEADING'] .'</h2>';
     	// output the form with values from the database
     	echo '<p>' .$MOD_CAPTCHA_CONTROL['HOWTO'] .'</p>';
     ?>
     <form name="store_settings" action="<?php echo $_SERVER['REQUEST_URI']; ?>" method="post">
     	<table width="98%" cellspacing="0" border="0" cellpadding="5px" class="row_a">
     	<tr><td colspan="2"><strong><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_CONF'];?>:</strong></td></tr>
     	<tr>
     		<td width="30%"><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_TYPE'];?>:</td>
     		<td>
     		<select name="captcha_type" id="captcha_type" onchange="load_captcha_image()" style="width: 98%;">
     			<?php foreach($useable_captchas AS $key=>$text) {
     			echo "<option value=\"$key\" ".($captcha_type==$key ? ' selected="selected"' : '').">$text</option>";
     			} ?>
     		</select>
     		</td>
     	</tr>
     	<tr>
     		<td>&nbsp;</td>
     		<td align="left" width="150px">
                 <img alt="captcha_example" id="captcha_example" src="<?php echo WB_URL.'/include/captcha/captchas/'.$captcha_type.'.png'?>" />
             </td>
     	</tr>
     	<tr id="text_qa" style="display:<?php if($captcha_type=='text') echo ''; else echo 'none'; ;?>;">
     		<td valign="top" class="setting_name"><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_ENTER_TEXT'];?>:</td>
     		<td class="setting_value" colspan="2">
     			<textarea name="text_qa" cols="60" rows="10"><?php echo $text_qa; ?></textarea>
     		</td>
     	</tr>
     	<tr>
     		<td><?php echo $MOD_CAPTCHA_CONTROL['USE_SIGNUP_CAPTCHA'];?>:</td>
     		<td>
     			<input type="radio" <?php echo ($enabled_captcha=='1') ?'checked="checked"' :'';?>
     				name="enabled_captcha" value="1" /><?php echo $MOD_CAPTCHA_CONTROL['ENABLED'];?>
     			<input type="radio" <?php echo ($enabled_captcha=='0') ?'checked="checked"' :'';?>
     				name="enabled_captcha" value="0" /><?php echo $MOD_CAPTCHA_CONTROL['DISABLED'];?>
     		</td>
     	</tr>
     	<tr><td>&nbsp;</td><td style="font-size:smaller;"><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_EXP'];?></td></tr>
     	<tr><td colspan="2"><br /><strong><?php echo $MOD_CAPTCHA_CONTROL['ASP_CONF'];?>:</strong></td></tr>
     	<tr>
     		<td><?php echo $MOD_CAPTCHA_CONTROL['ASP_TEXT'];?>:</td>
     		<td>
     			<input type="radio" <?php echo ($enabled_asp=='1') ?'checked="checked"' :'';?>
     				name="enabled_asp" value="1" /><?php echo $MOD_CAPTCHA_CONTROL['ENABLED'];?>
     			<input type="radio" <?php echo ($enabled_asp=='0') ?'checked="checked"' :'';?>
     				name="enabled_asp" value="0" /><?php echo $MOD_CAPTCHA_CONTROL['DISABLED'];?>
     		</td>
     	</tr>
     	<tr>
             <td>&nbsp;</td>
             <td style="font-size:smaller;"><?php echo $MOD_CAPTCHA_CONTROL['ASP_EXP'];?></td>
         </tr>
     	</table>
     	<input type="submit" name="save_settings" style="margin-top:10px; width:140px;" value="<?php echo $TEXT['SAVE']; ?>" />
     </form>
     <?php
+    }
     <?php
     // $Id$
     /*
      Website Baker Project <http://www.websitebaker.org/>
      Copyright (C) 2004-2009, Ryan Djurovich
      Website Baker is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published by
      the Free Software Foundation; either version 2 of the License, or
      (at your option) any later version.
      Website Baker is distributed in the hope that it will be useful,
      but WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      GNU General Public License for more details.
      You should have received a copy of the GNU General Public License
      along with Website Baker; if not, write to the Free Software
      Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
     */
     // direct access prevention
     defined('WB_PATH') OR die(header('Location: ../index.php'));
     // check if module language file exists for the language set by the user (e.g. DE, EN)
     if(!file_exists(WB_PATH .'/modules/captcha_control/languages/'.LANGUAGE .'.php')) {
     	// no module language file exists for the language set by the user, include default module language file EN.php
     	require_once(WB_PATH .'/modules/captcha_control/languages/EN.php');
     } else {
     	// a module language file exists for the language defined by the user, load it
     	require_once(WB_PATH .'/modules/captcha_control/languages/'.LANGUAGE .'.php');
+    }
     $table = TABLE_PREFIX.'mod_captcha_control';
     $js_back = "javascript: history.go(-1);";
     // check if data was submitted
     if(isset($_POST['save_settings'])) {
     	if (!$admin->checkFTAN())
+    	{
     		$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL);
     		exit();
+    	}
     	// get configuration settings
     	$enabled_captcha = ($_POST['enabled_captcha'] == '1') ? '1' : '0';
     	$enabled_asp = ($_POST['enabled_asp'] == '1') ? '1' : '0';
     	$captcha_type = $admin->add_slashes($_POST['captcha_type']);
     	// update database settings
     	$database->query("UPDATE $table SET
     		enabled_captcha = '$enabled_captcha',
     		enabled_asp = '$enabled_asp',
     		captcha_type = '$captcha_type'
     	");
     	// save text-captchas
     	if($captcha_type == 'text') { // ct_text
     		$text_qa=$admin->add_slashes($_POST['text_qa']);
     		if(!preg_match('/### .*? ###/', $text_qa)) {
     			$database->query("UPDATE $table SET ct_text = '$text_qa'");
+    		}
+    	}
     	// check if there is a database error, otherwise say successful
     	if($database->is_error()) {
     		$admin->print_error($database->get_error(), $js_back);
     	} else {
     		$admin->print_success($MESSAGE['PAGES']['SAVED'], ADMIN_URL.'/admintools/tool.php?tool=captcha_control');
+    	}
     } else {
     	// include captcha-file
     	require_once(WB_PATH .'/include/captcha/captcha.php');
     	// load text-captchas
     	$text_qa='';
     	if($query = $database->query("SELECT ct_text FROM $table")) {
     		$data = $query->fetchRow();
     		$text_qa = $data['ct_text'];
+    	}
     	if($text_qa == '')
     		$text_qa = $MOD_CAPTCHA_CONTROL['CAPTCHA_TEXT_DESC'];
     // script to load image
     ?>
     <script type="text/javascript">
     	var pics = new Array();
     	pics["ttf_image"] = new Image();
     	pics["ttf_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/ttf_image.png'?>";
     	pics["calc_image"] = new Image();
     	pics["calc_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/calc_image.png'?>";
     	pics["calc_ttf_image"] = new Image();
     	pics["calc_ttf_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/calc_ttf_image.png'?>";
     	pics["old_image"] = new Image();
     	pics["old_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/old_image.png'?>";
     	pics["calc_text"] = new Image();
     	pics["calc_text"].src = "<?php echo WB_URL.'/include/captcha/captchas/calc_text.png'?>";
     	pics["text"] = new Image();
     	pics["text"].src = "<?php echo WB_URL.'/include/captcha/captchas/text.png'?>";
     	function load_captcha_image() {
     		document.captcha_example.src = pics[document.store_settings.captcha_type.value].src;
     		toggle_text_qa();
+    	}
     	function toggle_text_qa() {
     		if(document.store_settings.captcha_type.value == 'text' ) {
     			document.getElementById('text_qa').style.display = '';
     		} else {
     			document.getElementById('text_qa').style.display = 'none';
+    		}
+    	}
     </script>
     <?php
     	// connect to database and read out captcha settings
     	if($query = $database->query("SELECT * FROM $table")) {
     		$data = $query->fetchRow();
     		$enabled_captcha = $data['enabled_captcha'];
     		$enabled_asp = $data['enabled_asp'];
     		$captcha_type = $data['captcha_type'];
     	} else {
     		// something went wrong, use dummy value
     		$enabled_captcha = '1';
     		$enabled_asp = '1';
     		$captcha_type = 'calc_text';
+    	}
     	// write out heading
     	echo '<h2>' .$MOD_CAPTCHA_CONTROL['HEADING'] .'</h2>';
     	// output the form with values from the database
     	echo '<p>' .$MOD_CAPTCHA_CONTROL['HOWTO'] .'</p>';
     ?>
     <form name="store_settings" action="<?php echo $_SERVER['REQUEST_URI']; ?>" method="post">
     	<?php echo $admin->getFTAN(); ?>
     	<table width="98%" cellspacing="0" border="0" cellpadding="5px" class="row_a">
     	<tr><td colspan="2"><strong><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_CONF'];?>:</strong></td></tr>
     	<tr>
     		<td width="30%"><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_TYPE'];?>:</td>
     		<td>
     		<select name="captcha_type" id="captcha_type" onchange="load_captcha_image()" style="width: 98%;">
     			<?php foreach($useable_captchas AS $key=>$text) {
     			echo "<option value=\"$key\" ".($captcha_type==$key ? ' selected="selected"' : '').">$text</option>";
     			} ?>
     		</select>
     		</td>
     	</tr>
     	<tr>
     		<td>&nbsp;</td>
     		<td align="left" width="150px">
                 <img alt="captcha_example" id="captcha_example" src="<?php echo WB_URL.'/include/captcha/captchas/'.$captcha_type.'.png'?>" />
             </td>
     	</tr>
     	<tr id="text_qa" style="display:<?php if($captcha_type=='text') echo ''; else echo 'none'; ;?>;">
     		<td valign="top" class="setting_name"><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_ENTER_TEXT'];?>:</td>
     		<td class="setting_value" colspan="2">
     			<textarea name="text_qa" cols="60" rows="10"><?php echo $text_qa; ?></textarea>
     		</td>
     	</tr>
     	<tr>
     		<td><?php echo $MOD_CAPTCHA_CONTROL['USE_SIGNUP_CAPTCHA'];?>:</td>
     		<td>
     			<input type="radio" <?php echo ($enabled_captcha=='1') ?'checked="checked"' :'';?>
     				name="enabled_captcha" value="1" /><?php echo $MOD_CAPTCHA_CONTROL['ENABLED'];?>
     			<input type="radio" <?php echo ($enabled_captcha=='0') ?'checked="checked"' :'';?>
     				name="enabled_captcha" value="0" /><?php echo $MOD_CAPTCHA_CONTROL['DISABLED'];?>
     		</td>
     	</tr>
     	<tr><td>&nbsp;</td><td style="font-size:smaller;"><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_EXP'];?></td></tr>
     	<tr><td colspan="2"><br /><strong><?php echo $MOD_CAPTCHA_CONTROL['ASP_CONF'];?>:</strong></td></tr>
     	<tr>
     		<td><?php echo $MOD_CAPTCHA_CONTROL['ASP_TEXT'];?>:</td>
     		<td>
     			<input type="radio" <?php echo ($enabled_asp=='1') ?'checked="checked"' :'';?>
     				name="enabled_asp" value="1" /><?php echo $MOD_CAPTCHA_CONTROL['ENABLED'];?>
     			<input type="radio" <?php echo ($enabled_asp=='0') ?'checked="checked"' :'';?>
     				name="enabled_asp" value="0" /><?php echo $MOD_CAPTCHA_CONTROL['DISABLED'];?>
     		</td>
     	</tr>
     	<tr>
             <td>&nbsp;</td>
             <td style="font-size:smaller;"><?php echo $MOD_CAPTCHA_CONTROL['ASP_EXP'];?></td>
         </tr>
     	</table>
     	<input type="submit" name="save_settings" style="margin-top:10px; width:140px;" value="<?php echo $TEXT['SAVE']; ?>" />
     </form>
     <?php
+    }
     ?>

     <input type="hidden" name="page_id" value="{PAGE_ID}" />
     <input type="hidden" name="section_id" value="{SECTION_ID}" />
     {FTAN}
     <textarea cols="2" rows="20"  id="content{SECTION}" name="content" style="width: 100%; height: 380px">{CONTENT}</textarea>
     <table cellpadding="0" cellspacing="0" border="0" width="100%" >

     $module_directory	= 'code';
     $module_name		= 'Code';
     $module_function	= 'page';
     $module_version		= '2.8.1';
     $module_version		= '2.8.2';
     $module_platform	= '2.7 | 2.8.x';
     $module_author		= 'Ryan Djurovich';
     $module_license		= 'GNU General Public License';

     $update_when_modified = true; // Tells script to update when this page was last updated
     require(WB_PATH.'/modules/admin.php');
     if (!$admin->checkFTAN())
+    {
     	$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL);
     	exit();
+    }
     // Update the mod_wysiwygs table with the contents
     if(isset($_POST['content'])) {
     	$tags = array('<?php', '?>' , '<?');

     		'CONTENT'				=> $content,
     		'TEXT_SAVE'				=> $TEXT['SAVE'],
     		'TEXT_CANCEL'			=> $TEXT['CANCEL'],
     		'SECTION'				=> $section_id
     		'SECTION'				=> $section_id,
     		'FTAN'					=> $admin->getFTAN()
+    	)
     );

     require('../../config.php');
     // Get id
     if(!isset($_GET['droplet_id']) OR !is_numeric($_GET['droplet_id'])) {
     	header("Location: ".ADMIN_URL."/pages/index.php");
     } else {
     	$droplet_id = $_GET['droplet_id'];
+    }
     // Include WB admin wrapper script
     require_once(WB_PATH.'/framework/class.admin.php');
     require_once(WB_PATH.'/framework/functions.php');
     // Get id
     $droplet_id = $admin->checkIDKEY('droplet_id', false, 'GET');
     if (!$droplet_id) {
      $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL);
      exit();
+    }
     // check website baker platform (with WB 2.7, Admin-Tools were moved out of settings dialogue)
     if(file_exists(ADMIN_PATH .'/admintools/tool.php')) {
     	$admintool_link = ADMIN_URL .'/admintools/index.php';

     $module_directory = 'droplets';
     $module_name = 'Droplets';
     $module_function = 'tool';
     $module_version = '1.0.3';
     $module_version = '1.0.4';
     $module_platform = '2.8.x';
     $module_author = 'Ruud and pcwacht';
     $module_license = 'GNU General Public License';

     	<td valign="top" width="50%" align="right">
     		<a href="#" onclick="javascript: window.open('<?php echo WB_URL; ?>/modules/droplets/readme/<?php echo $DR_TEXT['README']; ?>','helpwindow','width=700,height=550,directories=no,location=no,menubar=no,scrollbars=yes,status=no,toolbar=no,resizable=yes');"><?php echo $DR_TEXT['HELP']; ?></a>
     		<br /><br />
     		<a href="#" onclick="javascript: window.location = '<?php echo WB_URL; ?>/modules/droplets/backup_droplets.php';"><?php echo $DR_TEXT['BACKUP']; ?></a>
     		<a href="#" onclick="javascript: window.location = '<?php echo WB_URL; ?>/modules/droplets/backup_droplets.php?id=<?php echo $admin->getIDKEY(999) . '\';">' .$DR_TEXT['BACKUP']; ?></a>
     	</td>
     </tr>
     </table>
-...
     		<tr class="row_<?php echo $row; ?>" >
     			<td >
     				<a href="<?php echo WB_URL; ?>/modules/droplets/modify_droplet.php?droplet_id=<?php echo $droplet['id']?>" title="<?php echo $TEXT['MODIFY']; ?>">
     				<a href="<?php echo WB_URL; ?>/modules/droplets/modify_droplet.php?droplet_id=<?php echo $admin->getIDKEY($droplet['id']); ?>" title="<?php echo $TEXT['MODIFY']; ?>">
     					<img src="<?php echo THEME_URL; ?>/images/modify_16.png" border="0" alt="Modify" />
     				</a>
     			</td>
     			<td >
     				<a href="<?php echo WB_URL; ?>/modules/droplets/modify_droplet.php?droplet_id=<?php echo $droplet['id']?>" class="tooltip">
     				<a href="<?php echo WB_URL; ?>/modules/droplets/modify_droplet.php?droplet_id=<?php echo $admin->getIDKEY($droplet['id']); ?>" class="tooltip">
     							<?php if ($valid_code && $unique_droplet) { ?><img src="<?php echo WB_URL; ?>/modules/droplets/img/droplet.png" border="0" alt=""/>
     							<?php } else {  ?><img src="<?php echo WB_URL; ?>/modules/droplets/img/invalid.gif" border="0" title="" alt=""/><?php }  ?>
     					<?php echo $droplet['name']; ?><?php echo $comments; ?>
-...
     				<b><?php if($droplet['active'] == 1){ echo '<span style="color: green;">'. $TEXT['YES']. '</span>'; } else { echo '<span style="color: red;">'.$TEXT['NO'].'</span>';  } ?></b>
     			</td>
     			<td >
     				<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php echo WB_URL; ?>/modules/droplets/delete_droplet.php?droplet_id=<?php echo $droplet['id']?>');" title="<?php echo $TEXT['DELETE']; ?>">
     				<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php echo WB_URL; ?>/modules/droplets/delete_droplet.php?droplet_id=<?php echo $admin->getIDKEY($droplet['id']); ?>');" title="<?php echo $TEXT['DELETE']; ?>">
     					<img src="<?php echo THEME_URL; ?>/images/delete_16.png" border="0" alt="X" />
     				</a>
     			</td>

     require('../../config.php');
     require_once(WB_PATH.'/framework/class.admin.php');
     require_once(WB_PATH.'/framework/functions.php');
     // Get id
     if(!isset($_GET['droplet_id']) OR !is_numeric($_GET['droplet_id'])) {
     	header("Location: ".ADMIN_URL."/pages/index.php");
     } else {
     	$droplet_id = $_GET['droplet_id'];
     $droplet_id = $admin->checkIDKEY('droplet_id', false, 'GET');
     if (!$droplet_id) {
      $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL);
      exit();
+    }
     require_once(WB_PATH.'/framework/class.admin.php');
     require_once(WB_PATH.'/framework/functions.php');
     $admintool_link = ADMIN_URL .'/admintools/index.php';
     $module_edit_link = ADMIN_URL .'/admintools/tool.php?tool=droplets';
     $admin = new admin('admintools', 'admintools');
-...
     <input type="hidden" name="data_codepress" value="" />
     <input type="hidden" name="droplet_id" value="<?php echo $droplet_id; ?>" />
     <input type="hidden" name="show_wysiwyg" value="<?php echo $fetch_content['show_wysiwyg']; ?>" />
     <?php echo $admin->getFTAN(); ?>
     <table class="row_a" cellpadding="4" cellspacing="0" border="0" width="100%">
     		<tr>

     	if($database->is_error()) {
     		$admin->print_error($database->get_error(), $module_edit_link);
     	} else {
     		$admin->print_success($TEXT['SUCCESS'], WB_URL.'/modules/droplets/modify_droplet.php?droplet_id='.$droplet_id);
     		$admin->print_success($TEXT['SUCCESS'], WB_URL.'/modules/droplets/modify_droplet.php?droplet_id='. $admin->getIDKEY($droplet_id));
+    	}
     	// Print admin footer

     // tool_edit.php
     require_once('../../config.php');
     require_once(WB_PATH.'/framework/class.admin.php');
     require_once(WB_PATH.'/framework/functions.php');
     // create admin object depending on platform (admin tools were moved out of settings with WB 2.7)
     $admin = new admin('admintools', 'admintools');
-...
     $module_edit_link = ADMIN_URL .'/admintools/tool.php?tool=droplets';
     $template_edit_link = ADMIN_URL .'/admintools/tool.php?tool=templateedit';
     // protect from CSRF
     $id = $admin->checkIDKEY('id', false, 'GET');
     if (!$id or $id != 999) {
      $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL);
      exit();
+    }
     ?>
     <h4 style="margin: 0; border-bottom: 1px solid #DDD; padding-bottom: 5px;">

     if(!isset($_POST['droplet_id']) OR !is_numeric($_POST['droplet_id'])) {
     	header("Location: ".ADMIN_URL."/pages/index.php");
     } else {
     	$droplet_id = $_POST['droplet_id'];
     	$droplet_id = (int) $_POST['droplet_id'];
+    }
     // Include WB admin wrapper script
     require_once(WB_PATH.'/framework/class.admin.php');
     require_once(WB_PATH.'/framework/functions.php');
     if (!$admin->checkFTAN())
+    {
     	$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL);
     	exit();
+    }
     // check website baker platform (with WB 2.7, Admin-Tools were moved out of settings dialogue)
     if(file_exists(ADMIN_PATH .'/admintools/tool.php')) {
     	$admintool_link = ADMIN_URL .'/admintools/index.php';
-...
     	$admin->print_error($MESSAGE['GENERIC']['FILL_IN_ALL'], WB_URL.'/modules/droplets/modify_droplet.php?droplet_id='.$droplet_id);
     } else {
     	$title = $admin->add_slashes($admin->get_post('title'));
     	$active = $admin->get_post('active');
     	$admin_view = $admin->get_post('admin_view');
     	$admin_edit = $admin->get_post('admin_edit');
     	$show_wysiwyg = $admin->get_post('show_wysiwyg');
     	$active = (int) $admin->get_post('active');
     	$admin_view = (int) $admin->get_post('admin_view');
     	$admin_edit = (int) $admin->get_post('admin_edit');
     	$show_wysiwyg = (int) $admin->get_post('show_wysiwyg');
     	$description = $admin->add_slashes($admin->get_post('description'));
     	$tags = array('<?php', '?>' , '<?');
     	$content = $admin->add_slashes(str_replace($tags, '', $_POST['savecontent']));
     	$comments = $admin->add_slashes($admin->get_post('comments'));
     	$modified_when = time();
     	$modified_by = $admin->get_user_id();
     	$modified_by = (int) $admin->get_user_id();
+    }
     // Update row
-...
     // Check if there is a db error, otherwise say successful
     if($database->is_error()) {
     	$admin->print_error($database->get_error(), WB_URL.'/modules/droplets/modify_droplet.php?droplet_id='.$droplet_id);
     	$admin->print_error($database->get_error(), WB_URL.'/modules/droplets/modify_droplet.php?droplet_id='. $admin->getIDKEY($droplet_id));
     } else {
         $admin->print_success($TEXT['SUCCESS'], $module_edit_link);
+    }

Project

General

Profile

WB 2.08.x

Revision 1389

Added by FrankH almost 14 years ago