Project

General

Profile

« Previous | Next » 

Revision 1400

Added by FrankH almost 14 years ago

  1. Security fix in account
  2. Security fix in admin/media, thanks to hal 9000

View differences:

browse.php
1 1
<?php
2
/**
3
 *
4
 * @category        admin
5
 * @package         media
6
 * @author          WebsiteBaker Project
7
 * @copyright       2004-2009, Ryan Djurovich
8
 * @copyright       2009-2011, Website Baker Org. e.V.
9
 * @link			http://www.websitebaker2.org/
10
 * @license         http://www.gnu.org/licenses/gpl.html
11
 * @platform        WebsiteBaker 2.8.x
12
 * @requirements    PHP 5.2.2 and higher
13
 * @version         $Id$
14
 * @filesource		$HeadURL:  $
15
 * @lastmodified    $Date:  $
16
 *
17
 */
2 18

  
3
// $Id$
4

  
5
/*
6

  
7
 Website Baker Project <http://www.websitebaker.org/>
8
 Copyright (C) 2004-2009, Ryan Djurovich
9

  
10
 Website Baker is free software; you can redistribute it and/or modify
11
 it under the terms of the GNU General Public License as published by
12
 the Free Software Foundation; either version 2 of the License, or
13
 (at your option) any later version.
14

  
15
 Website Baker is distributed in the hope that it will be useful,
16
 but WITHOUT ANY WARRANTY; without even the implied warranty of
17
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18
 GNU General Public License for more details.
19

  
20
 You should have received a copy of the GNU General Public License
21
 along with Website Baker; if not, write to the Free Software
22
 Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
23

  
24
*/
25

  
26 19
// Create admin object
27 20
require('../../config.php');
28 21
require_once(WB_PATH.'/framework/class.admin.php');
......
88 81
}
89 82

  
90 83
// Check to see if it contains ../
91
if(strstr($directory, '../')) {
84
if (!check_media_path($directory)) {
92 85
	$admin->print_header();
93 86
	$admin->print_error($MESSAGE['MEDIA']['DIR_DOT_DOT_SLASH']);
94 87
}
......
157 150
			$template->set_var(array(
158 151
											'NAME' => $name,
159 152
											'NAME_SLASHED' => addslashes($name),
160
											'TEMP_ID' => $temp_id,
153
											'TEMP_ID' => $admin->getIDKEY($temp_id),
161 154
											'LINK' => "browse.php?dir=$directory/$link_name",
162 155
											'LINK_TARGET' => '',
163 156
											'ROW_BG_COLOR' => $row_bg_color,
......
212 205
			$template->set_var(array(
213 206
											'NAME' => $name,
214 207
											'NAME_SLASHED' => addslashes($name),
215
											'TEMP_ID' => $temp_id,
208
											'TEMP_ID' => $admin->getIDKEY($temp_id),
216 209
											'LINK' => WB_URL.MEDIA_DIRECTORY.$directory.'/'.$name,
217 210
											'LINK_TARGET' => '_blank',
218 211
											'ROW_BG_COLOR' => $row_bg_color,

Also available in: Unified diff