Project

General

Profile

« Previous | Next » 

Revision 1441

Added by Dietmar over 13 years ago

  1. recoded /modules/admin.php info_banner, now compare with modify in pages
  2. security fixes remove defined WB_PATH for backend templates
  3. fixed class.admin.php missing $TEXT declaration, add get_section_details

View differences:

admin.php
1
<?php
2
/**
3
 *
4
 * @category        backend
5
 * @package         modules
6
 * @author          WebsiteBaker Project
7
 * @copyright       2004-2009, Ryan Djurovich
8
 * @copyright       2009-2010, Website Baker Org. e.V.
9
 * @link			http://www.websitebaker2.org/
10
 * @license         http://www.gnu.org/licenses/gpl.html
11
 * @platform        WebsiteBaker 2.8.x
12
 * @requirements    PHP 5.2.2 and higher
13
 * @version         $Id$
14
 * @filesource		$HeadURL$
15
 * @lastmodified    $Date$
16
 *
17
*/
18

  
19
// Stop this file being access directly
20
if(!defined('WB_PATH')) { die('Direct access to this file is not allowed'); }
21

  
22
// Get page id
23
if(isset($_GET['page_id']) && is_numeric($_GET['page_id'])) {
24
	$page_id = (int)$_GET['page_id'];
25
} elseif(isset($_POST['page_id']) && is_numeric($_POST['page_id'])) {
26
	$page_id = (int)$_POST['page_id'];
27
} else {
28
	header("Location: index.php");
29
	exit(0);
30
}
31

  
32
// Get section id if there is one
33
if(isset($_GET['section_id']) && is_numeric($_GET['section_id'])) {
34
	$section_id = (int)$_GET['section_id'];
35
} elseif(isset($_POST['section_id']) && is_numeric($_POST['section_id'])) {
36
	$section_id = (int)$_POST['section_id'];
37
} else {
38
	// Check if we should redirect the user if there is no section id
39
	if(!isset($section_required)) {
40
		$section_id = 0;
41
	} else {
42
		header("Location: $section_required");
43
		exit(0);
44
	}
45
}
46

  
47
// Create js back link
48
$js_back = 'javascript: history.go(-1);';
49

  
50
// Create new admin object
51
require(WB_PATH.'/framework/class.admin.php');
52
$admin = new admin('Pages', 'pages_modify');
53

  
54
// Get perms
55
// $database = new database();
56
$results = $database->query("SELECT admin_groups,admin_users FROM ".TABLE_PREFIX."pages WHERE page_id = '$page_id'");
57
$results_array = $results->fetchRow();
58
$old_admin_groups = explode(',', str_replace('_', '', $results_array['admin_groups']));
59
$old_admin_users = explode(',', str_replace('_', '', $results_array['admin_users']));
60

  
61
$in_group = FALSE;
62
foreach($admin->get_groups_id() as $cur_gid){
63
    if (in_array($cur_gid, $old_admin_groups)) {
64
        $in_group = TRUE;
65
    }
66
}
67
if((!$in_group) && !is_numeric(array_search($admin->get_user_id(), $old_admin_users))) {
68
	echo $admin->get_group_id().$admin->get_user_id();
69
	print_r ($old_admin_groups);
70
	$admin->print_error($MESSAGE['PAGES']['INSUFFICIENT_PERMISSIONS']);
71
}
72

  
73
// some additional security checks:
74
// Check whether the section_id belongs to the page_id at all
75
if ($section_id != 0) {
76
	$sql  = "SELECT module FROM `".TABLE_PREFIX."sections` WHERE `page_id` = '$page_id' AND `section_id` = '$section_id'";
77
	$res_sec = $database->query($sql);
78
	if ($database->is_error())
79
	{
80
		$admin->print_error($database->get_error());
81
	}
82
	if ($res_sec->numRows() == 0)
83
	{
84
		$admin->print_error($MESSAGE['PAGES']['NOT_FOUND']);
85
	}
86

  
87
	// check module permissions:
88
	$sec = $res_sec->fetchRow();
89
	if (!$admin->get_permission($sec['module'], 'module'))
90
	{
91
		$admin->print_error($MESSAGE['PAGES']['INSUFFICIENT_PERMISSIONS']);
92
	}	
93
}
94

  
95
// Workout if the developer wants to show the info banner
96
if(isset($print_info_banner) && $print_info_banner == true) {
97
	
98
// Get page details
99
// $database = new database();
100
$query = "SELECT page_id,page_title,modified_by,modified_when FROM ".TABLE_PREFIX."pages WHERE page_id = '$page_id'";
101
$results = $database->query($query);
102
if($database->is_error()) {
103
	$admin->print_header();
104
	$admin->print_error($database->get_error());
105
}
106
if($results->numRows() == 0) {
107
	$admin->print_header();
108
	$admin->print_error($MESSAGE['PAGES']['NOT_FOUND']);
109
}
110
$results_array = $results->fetchRow();
111

  
112
// Get display name of person who last modified the page
113
$user=$admin->get_user_details($results_array['modified_by']);
114

  
115
// Convert the unix ts for modified_when to human a readable form
116
if($results_array['modified_when'] != 0) {
117
	$modified_ts = gmdate(TIME_FORMAT.', '.DATE_FORMAT, $results_array['modified_when']+TIMEZONE);
118
} else {
119
	$modified_ts = 'Unknown';
120
}
121

  
122
// Include page info script
123
$template = new Template(THEME_PATH.'/templates');
124
$template->set_file('page', 'pages_modify.htt');
125
$template->set_block('page', 'main_block', 'main');
126
$template->set_var(array(
127
					'PAGE_ID' => $results_array['page_id'],
128
					'PAGE_TITLE' => ($results_array['page_title']),
129
					'MODIFIED_BY' => $user['display_name'],
130
					'MODIFIED_BY_USERNAME' => $user['username'],
131
					'MODIFIED_WHEN' => $modified_ts,
132
					'ADMIN_URL' => ADMIN_URL
133
					)
134
				);
135
if($modified_ts == 'Unknown') {
136
	$template->set_var('DISPLAY_MODIFIED', 'hide');
137
} else {
138
	$template->set_var('DISPLAY_MODIFIED', '');
139
}
140

  
141
// Work-out if we should show the "manage sections" link
142
$query_sections = $database->query("SELECT section_id FROM ".TABLE_PREFIX."sections WHERE page_id = '$page_id' AND module = 'menu_link'");
143
if($query_sections->numRows() > 0) {
144
	$template->set_var('DISPLAY_MANAGE_SECTIONS', 'none');
145
} elseif(MANAGE_SECTIONS == 'enabled') {
146
	$template->set_var('TEXT_MANAGE_SECTIONS', $HEADING['MANAGE_SECTIONS']);
147
} else {
148
	$template->set_var('DISPLAY_MANAGE_SECTIONS', 'none');
149
}
150

  
151
// Insert language TEXT
152
$template->set_var(array(
153
					'TEXT_CURRENT_PAGE' => $TEXT['CURRENT_PAGE'],
154
					'TEXT_CHANGE' => $TEXT['CHANGE'],
155
					'LAST_MODIFIED' => $MESSAGE['PAGES']['LAST_MODIFIED'],
156
					'TEXT_CHANGE_SETTINGS' => $TEXT['CHANGE_SETTINGS'],
157
					'HEADING_MODIFY_PAGE' => $HEADING['MODIFY_PAGE']
158
					)
159
				);
160

  
161
// Parse and print header template
162
$template->parse('main', 'main_block', false);
163
$template->pparse('output', 'page');
164

  
165
}
166

  
167
// Work-out if the developer wants us to update the timestamp for when the page was last modified
168
if(isset($update_when_modified) && $update_when_modified == true) {
169
	$database->query("UPDATE ".TABLE_PREFIX."pages SET modified_when = '".time()."', modified_by = '".$admin->get_user_id()."' WHERE page_id = '$page_id'");
170
}
171

  
172
?>
1
<?php
2
/**
3
 *
4
 * @category        backend
5
 * @package         modules
6
 * @author          WebsiteBaker Project
7
 * @copyright       2004-2009, Ryan Djurovich
8
 * @copyright       2009-2010, Website Baker Org. e.V.
9
 * @link			http://www.websitebaker2.org/
10
 * @license         http://www.gnu.org/licenses/gpl.html
11
 * @platform        WebsiteBaker 2.8.x
12
 * @requirements    PHP 5.2.2 and higher
13
 * @version         $Id$
14
 * @filesource		$HeadURL$
15
 * @lastmodified    $Date$
16
 *
17
*/
18

  
19
// Stop this file being access directly
20
if(defined('WB_PATH') == false)
21
{
22
	die('<head><title>Access denied</title></head><body><h2 style="color:red;margin:3em auto;text-align:center;">Cannot access this file directly</h2></body></html>');
23
}
24

  
25
// if admin is be call from admin modify core you have $page_id
26
if(!isset($page_id)) {
27
	// Get page id
28
	if(isset($_GET['page_id']) && is_numeric($_GET['page_id'])) {
29
		$page_id = (int)$_GET['page_id'];
30
	} elseif(isset($_POST['page_id']) && is_numeric($_POST['page_id'])) {
31
		$page_id = (int)$_POST['page_id'];
32
	} else {
33
		header("Location: index.php");
34
		exit(0);
35
	}
36
}
37

  
38
// if admin is be call from admin modify core you have $section_id
39
if(!isset($section_id)) {
40
// Get section id if there is one
41
	if(isset($_GET['section_id']) && is_numeric($_GET['section_id'])) {
42
		$section_id = (int)$_GET['section_id'];
43
	} elseif(isset($_POST['section_id']) && is_numeric($_POST['section_id'])) {
44
		$section_id = (int)$_POST['section_id'];
45
	} else {
46
		// Check if we should redirect the user if there is no section id
47
		if(!isset($section_required)) {
48
			$section_id = 0;
49
		} else {
50
			header("Location: $section_required");
51
			exit(0);
52
		}
53
	}
54
}
55
// be sure is is numeric
56
$page_id = intval($page_id);
57
$section_id = intval($section_id);
58

  
59
// Create js back link
60
// $js_back = 'javascript: history.go(-1);';
61
$js_back = ADMIN_URL.'/pages/sections.php?page_id='.(int)$page_id;
62
// Create new admin object, you can set the next variable in your module
63
// to print with or without header, default is with header
64
// it is recommed to set the variable before including the /modules/admin.php
65
$admin_header = (!isset($admin_header)) ? true : $admin_header;
66
require_once(WB_PATH.'/framework/class.admin.php');
67
$admin = new admin('Pages', 'pages_modify',(bool)$admin_header);
68
// Get perms
69
// unset($admin_header);
70

  
71
$page = $admin->get_page_details($page_id,ADMIN_URL.'/pages/index.php' );
72

  
73
$old_admin_groups = explode(',', str_replace('_', '', $page['admin_groups']));
74
$old_admin_users = explode(',', str_replace('_', '', $page['admin_users']));
75

  
76
$in_group = false;
77
foreach($admin->get_groups_id() as $cur_gid){
78
    if (in_array($cur_gid, $old_admin_groups)) {
79
        $in_group = true;
80
    }
81
}
82

  
83
if((!$in_group) && !is_numeric(array_search($admin->get_user_id(), $old_admin_users))) {
84
	print $admin->get_group_id().$admin->get_user_id();
85
	print_r ($old_admin_groups);
86
	$admin->print_error($MESSAGE['PAGES']['INSUFFICIENT_PERMISSIONS']);
87
}
88

  
89
// some additional security checks:
90
// Check whether the section_id belongs to the page_id at all
91
if ($section_id != 0) {
92
	$section = $admin->get_section_details($section_id,ADMIN_URL.'/pages/index.php');
93
	if (!$admin->get_permission($section['module'], 'module'))
94
	{
95
		$admin->print_error($MESSAGE['PAGES']['INSUFFICIENT_PERMISSIONS']);
96
	}	
97
}
98

  
99
// Workout if the developer wants to show the info banner
100
if(isset($print_info_banner) && $print_info_banner == true) {
101
	// Get page details already defined
102

  
103
	// Get display name of person who last modified the page
104
	$user = $admin->get_user_details($page['modified_by']);
105

  
106
	// Convert the unix ts for modified_when to human a readable form
107
	if($page['modified_when'] != 0) {
108
		$modified_ts = gmdate(TIME_FORMAT.', '.DATE_FORMAT, $page['modified_when']+TIMEZONE);
109
	} else {
110
		$modified_ts = 'Unknown';
111
	}
112

  
113
	// Include page info script
114
	$template = new Template(THEME_PATH.'/templates');
115
	$template->set_file('page', 'pages_modify.htt');
116
	$template->set_block('page', 'main_block', 'main');
117
	$template->set_block('main_block', 'section_block', 'section_list');
118
	$template->set_block('section_block', 'block_block', 'block_list');
119
	$template->set_var(array(
120
				'PAGE_ID' => $page['page_id'],
121
				// 'PAGE_IDKEY' => $admin->getIDKEY($page['page_id']),
122
				'PAGE_IDKEY' => $page['page_id'],
123
				'PAGE_TITLE' => ($page['page_title']),
124
				'MENU_TITLE' => ($page['menu_title']),
125
				'ADMIN_URL' => ADMIN_URL,
126
				'WB_URL' => WB_URL,
127
				'THEME_URL' => THEME_URL
128
				));
129

  
130
	$template->set_var(array(
131
				'MODIFIED_BY' => $user['display_name'],
132
				'MODIFIED_BY_USERNAME' => $user['username'],
133
				'MODIFIED_WHEN' => $modified_ts,
134
				'LAST_MODIFIED' => $MESSAGE['PAGES']['LAST_MODIFIED'],
135
				));
136

  
137
	$template->set_block('main_block', 'show_modify_block', 'show_modify');
138
	if($modified_ts == 'Unknown')
139
	{
140
	    $template->set_block('show_modify', '');
141
		$template->set_var('CLASS_DISPLAY_MODIFIED', 'hide');
142

  
143
	} else {
144
		$template->set_var('CLASS_DISPLAY_MODIFIED', '');
145
	    $template->parse('show_modify', 'show_modify_block', true);
146
	}
147

  
148
	// Work-out if we should show the "manage sections" link
149
	$sql  = 'SELECT `section_id` FROM `'.TABLE_PREFIX.'sections` WHERE `page_id` = '.(int)$page_id.' ';
150
	$sql .= 'AND `module` = "menu_link"';
151
	$query_sections = $database->query($sql);
152

  
153
	$template->set_block('main_block', 'show_section_block', 'show_section');
154
	if($query_sections->numRows() > 0)
155
	{
156
		$template->set_block('show_section', '');
157
		$template->set_var('DISPLAY_MANAGE_SECTIONS', 'display:none;');
158

  
159
	} elseif(MANAGE_SECTIONS == 'enabled')
160
	{
161

  
162
		$template->set_var('TEXT_MANAGE_SECTIONS', $HEADING['MANAGE_SECTIONS']);
163
	    $template->parse('show_section', 'show_section_block', true);
164

  
165
	} else {
166
		$template->set_block('show_section', '');
167
		$template->set_var('DISPLAY_MANAGE_SECTIONS', 'display:none;');
168

  
169
	}
170

  
171
	// Insert language TEXT
172
	$template->set_var(array(
173
					'TEXT_CURRENT_PAGE' => $TEXT['CURRENT_PAGE'],
174
					'TEXT_CHANGE_SETTINGS' => $TEXT['CHANGE_SETTINGS'],
175
					'HEADING_MODIFY_PAGE' => $HEADING['MODIFY_PAGE']
176
					));
177

  
178
	// Parse and print header template
179
	$template->parse('main', 'main_block', false);
180
	$template->pparse('output', 'page');
181

  
182
	// unset($print_info_banner);
183
	unset($template);
184
	print '<div id="wb_'.$section['section_id'].'"><b>' . $TEXT['BLOCK'] . ': </b>' . $section['block'];
185
	print '<b>  Modul: </b>' . $section['module']." ";
186
	print '<b>  ID: </b>' . $section_id."</div>\n";
187

  
188
} //
189

  
190
// Work-out if the developer wants us to update the timestamp for when the page was last modified
191
if(isset($update_when_modified) && $update_when_modified == true) {
192
	$database->query("UPDATE ".TABLE_PREFIX."pages SET modified_when = '".time()."', modified_by = '".$admin->get_user_id()."' WHERE page_id = '$page_id'");
193
}

Also available in: Unified diff