Project

General

Profile

« Previous | Next » 

Revision 1475

Added by Dietmar over 13 years ago

+ add SecureForm.mtab.php under mantennance by WebsiteBaker Community
! security fixes media, groups, users, sections
  1. change lang variable to remove upgrade-script
    ! reworked add sections in pages
    ! fix set empty href in show_menu2
    ! set show_menu2 version to 4.9.6
    ! reworked Droplet LoginBox, add redirect query
    - remove unneeded folder js
    ! set Droplet to version 1.1.0
    + add checkboxes to change frontend absolute url to relative urls
    ! set output_filter version to 0.2

View differences:

groups.php
20 20
require('../../config.php');
21 21
require_once(WB_PATH.'/framework/class.admin.php');
22 22

  
23
// Create new database object
24
// $database = new database();
23
// Set parameter 'action' as alternative to javascript mechanism
24
$action = 'cancel';
25
// Set parameter 'action' as alternative to javascript mechanism
26
$action = (isset($_POST['modify']) ? 'modify' : $action );
27
$action = (isset($_POST['delete']) ? 'delete' : $action );
25 28

  
26
if(!isset($_POST['action']) OR ($_POST['action'] != "modify" AND $_POST['action'] != "delete")) {
27
	header("Location: index.php");
28
	exit(0);
29
}
29
switch ($action):
30
	case 'modify' :
30 31

  
31
// Set parameter 'action' as alternative to javascript mechanism
32
if(isset($_POST['modify']))
33
	$_POST['action'] = "modify";
34
if(isset($_POST['delete']))
35
	$_POST['action'] = "delete";
32
			// Create new admin object
33
			$admin = new admin('Access', 'groups_modify' );
34
			// Check if group group_id is a valid number and doesnt equal 1
35
			$group_id = intval($admin->checkIDKEY('group_id', 0, $_SERVER['REQUEST_METHOD']));
36
			if( ($group_id < 2 ) )
37
			{
38
				// if($admin_header) { $admin->print_header(); }
39
				$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'] );
40
			}
36 41

  
37
// Check if group group_id is a valid number and doesnt equal 1
38
if(!isset($_POST['group_id']) OR !is_numeric($_POST['group_id']) OR $_POST['group_id'] == 1) {
39
	header("Location: index.php");
40
	exit(0);
41
}
42
			// Get existing values
43
			$results = $database->query("SELECT * FROM ".TABLE_PREFIX."groups WHERE group_id = '".$group_id."'");
44
			$group = $results->fetchRow();
45
			// Setup template object
46
			$template = new Template(THEME_PATH.'/templates');
47
			$template->set_file('page', 'groups_form.htt');
48
			$template->set_block('page', 'main_block', 'main');
49
			$template->set_var(	array(
50
									'ACTION_URL' => ADMIN_URL.'/groups/save.php',
51
									'SUBMIT_TITLE' => $TEXT['SAVE'],
52
									'GROUP_ID' => $group['group_id'],
53
									'GROUP_NAME' => $group['name'],
54
									'ADVANCED_ACTION' => 'groups.php',
55
									'FTAN' => $admin->getFTAN()
56
								));
57
			// Tell the browser whether or not to show advanced options
58
			if( true == (isset( $_POST['advanced']) AND ( strpos( $_POST['advanced'], ">>") > 0 ) ) ) {
59
				$template->set_var('DISPLAY_ADVANCED', '');
60
				$template->set_var('DISPLAY_BASIC', 'display:none;');
61
				$template->set_var('ADVANCED', 'yes');
62
				$template->set_var('ADVANCED_BUTTON', '&lt;&lt; '.$TEXT['HIDE_ADVANCED']);
63
			} else {
64
				$template->set_var('DISPLAY_ADVANCED', 'display:none;');
65
				$template->set_var('DISPLAY_BASIC', '');
66
				$template->set_var('ADVANCED', 'no');
67
				$template->set_var('ADVANCED_BUTTON', $TEXT['SHOW_ADVANCED'].'  &gt;&gt;');
68
			}
42 69

  
43
if($_POST['action'] == 'modify') {
44
	// Create new admin object
45
	$admin = new admin('Access', 'groups_modify', false);
46
/*  */
47
	if (!$admin->checkFTAN())
48
	{
49
		$admin->print_header();
50
		$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS']);
51
	}
70
			// Explode system permissions
71
			$system_permissions = explode(',', $group['system_permissions']);
72
			// Check system permissions boxes
73
			foreach($system_permissions AS $name) {
74
					$template->set_var($name.'_checked', ' checked="checked"');
75
			}
76
			// Explode module permissions
77
			$module_permissions = explode(',', $group['module_permissions']);
78
			// Explode template permissions
79
			$template_permissions = explode(',', $group['template_permissions']);
52 80

  
53
	// Print header
54
	$admin->print_header();
55
	// Get existing values
56
	$results = $database->query("SELECT * FROM ".TABLE_PREFIX."groups WHERE group_id = '".$_POST['group_id']."'");
57
	$group = $results->fetchRow();
58
	// Setup template object
59
	$template = new Template(THEME_PATH.'/templates');
60
	$template->set_file('page', 'groups_form.htt');
61
	$template->set_block('page', 'main_block', 'main');
62
	$template->set_var(	array(
63
							'ACTION_URL' => ADMIN_URL.'/groups/save.php',
64
							'SUBMIT_TITLE' => $TEXT['SAVE'],
65
							'GROUP_ID' => $group['group_id'],
66
							'GROUP_NAME' => $group['name'],
67
							'ADVANCED_ACTION' => 'groups.php',
68
							'FTAN' => $admin->getFTAN()
69
						));
70
	// Tell the browser whether or not to show advanced options
71
	if( true == (isset( $_POST['advanced']) AND ( strpos( $_POST['advanced'], ">>") > 0 ) ) ) {
72
		$template->set_var('DISPLAY_ADVANCED', '');
73
		$template->set_var('DISPLAY_BASIC', 'display:none;');
74
		$template->set_var('ADVANCED', 'yes');
75
		$template->set_var('ADVANCED_BUTTON', '&lt;&lt; '.$TEXT['HIDE_ADVANCED']);
76
	} else {
77
		$template->set_var('DISPLAY_ADVANCED', 'display:none;');
78
		$template->set_var('DISPLAY_BASIC', '');
79
		$template->set_var('ADVANCED', 'no');
80
		$template->set_var('ADVANCED_BUTTON', $TEXT['SHOW_ADVANCED'].'  &gt;&gt;');
81
	}
81
			// Insert values into module list
82
			$template->set_block('main_block', 'module_list_block', 'module_list');
83
			$result = $database->query('SELECT * FROM `'.TABLE_PREFIX.'addons` WHERE `type` = "module" AND `function` = "page" ORDER BY `name`');
84
			if($result->numRows() > 0) {
85
				while($addon = $result->fetchRow()) {
86
					$template->set_var('VALUE', $addon['directory']);
87
					$template->set_var('NAME', $addon['name']);
88
					if(!is_numeric(array_search($addon['directory'], $module_permissions))) {
89
						$template->set_var('CHECKED', ' checked="checked"');
90
					} else {
91
						$template->set_var('CHECKED', '');
92
					}
93
					$template->parse('module_list', 'module_list_block', true);
94
				}
95
			}
82 96

  
83
	// Explode system permissions
84
	$system_permissions = explode(',', $group['system_permissions']);
85
	// Check system permissions boxes
86
	foreach($system_permissions AS $name) {
87
			$template->set_var($name.'_checked', ' checked="checked"');
88
	}
89
	// Explode module permissions
90
	$module_permissions = explode(',', $group['module_permissions']);
91
	// Explode template permissions
92
	$template_permissions = explode(',', $group['template_permissions']);
93
	
94
	// Insert values into module list
95
	$template->set_block('main_block', 'module_list_block', 'module_list');
96
	$result = $database->query('SELECT * FROM `'.TABLE_PREFIX.'addons` WHERE `type` = "module" AND `function` = "page" ORDER BY `name`');
97
	if($result->numRows() > 0) {
98
		while($addon = $result->fetchRow()) {
99
			$template->set_var('VALUE', $addon['directory']);
100
			$template->set_var('NAME', $addon['name']);
101
			if(!is_numeric(array_search($addon['directory'], $module_permissions))) {
102
				$template->set_var('CHECKED', ' checked="checked"');
103
			} else {
104
				$template->set_var('CHECKED', '');
97
			// Insert values into template list
98
			$template->set_block('main_block', 'template_list_block', 'template_list');
99
			$result = $database->query('SELECT * FROM `'.TABLE_PREFIX.'addons` WHERE `type` = "template" ORDER BY `name`');
100
			if($result->numRows() > 0) {
101
				while($addon = $result->fetchRow()) {
102
					$template->set_var('VALUE', $addon['directory']);
103
					$template->set_var('NAME', $addon['name']);
104
					if(!is_numeric(array_search($addon['directory'], $template_permissions))) {
105
						$template->set_var('CHECKED', ' checked="checked"');
106
					} else {
107
						$template->set_var('CHECKED', '');
108
					}
109
					$template->parse('template_list', 'template_list_block', true);
110
				}
105 111
			}
106
			$template->parse('module_list', 'module_list_block', true);
107
		}
108
	}
109
	
110
	// Insert values into template list
111
	$template->set_block('main_block', 'template_list_block', 'template_list');
112
	$result = $database->query('SELECT * FROM `'.TABLE_PREFIX.'addons` WHERE `type` = "template" ORDER BY `name`');
113
	if($result->numRows() > 0) {
114
		while($addon = $result->fetchRow()) {
115
			$template->set_var('VALUE', $addon['directory']);
116
			$template->set_var('NAME', $addon['name']);
117
			if(!is_numeric(array_search($addon['directory'], $template_permissions))) {
118
				$template->set_var('CHECKED', ' checked="checked"');
112

  
113
			// Insert language text and messages
114
			$template->set_var(array(
115
						'TEXT_RESET' => $TEXT['RESET'],
116
						'TEXT_ACTIVE' => $TEXT['ACTIVE'],
117
						'TEXT_DISABLED' => $TEXT['DISABLED'],
118
						'TEXT_PLEASE_SELECT' => $TEXT['PLEASE_SELECT'],
119
						'TEXT_USERNAME' => $TEXT['USERNAME'],
120
						'TEXT_PASSWORD' => $TEXT['PASSWORD'],
121
						'TEXT_RETYPE_PASSWORD' => $TEXT['RETYPE_PASSWORD'],
122
						'TEXT_DISPLAY_NAME' => $TEXT['DISPLAY_NAME'],
123
						'TEXT_EMAIL' => $TEXT['EMAIL'],
124
						'TEXT_GROUP' => $TEXT['GROUP'],
125
						'TEXT_SYSTEM_PERMISSIONS' => $TEXT['SYSTEM_PERMISSIONS'],
126
						'TEXT_MODULE_PERMISSIONS' => $TEXT['MODULE_PERMISSIONS'],
127
						'TEXT_TEMPLATE_PERMISSIONS' => $TEXT['TEMPLATE_PERMISSIONS'],
128
						'TEXT_NAME' => $TEXT['NAME'],
129
						'SECTION_PAGES' => $MENU['PAGES'],
130
						'SECTION_MEDIA' => $MENU['MEDIA'],
131
						'SECTION_MODULES' => $MENU['MODULES'],
132
						'SECTION_TEMPLATES' => $MENU['TEMPLATES'],
133
						'SECTION_LANGUAGES' => $MENU['LANGUAGES'],
134
						'SECTION_SETTINGS' => $MENU['SETTINGS'],
135
						'SECTION_USERS' => $MENU['USERS'],
136
						'SECTION_GROUPS' => $MENU['GROUPS'],
137
						'SECTION_ADMINTOOLS' => $MENU['ADMINTOOLS'],
138
						'TEXT_VIEW' => $TEXT['VIEW'],
139
						'TEXT_ADD' => $TEXT['ADD'],
140
						'TEXT_LEVEL' => $TEXT['LEVEL'],
141
						'TEXT_MODIFY' => $TEXT['MODIFY'],
142
						'TEXT_DELETE' => $TEXT['DELETE'],
143
						'TEXT_MODIFY_CONTENT' => $TEXT['MODIFY_CONTENT'],
144
						'TEXT_MODIFY_SETTINGS' => $TEXT['MODIFY_SETTINGS'],
145
						'HEADING_MODIFY_INTRO_PAGE' => $HEADING['MODIFY_INTRO_PAGE'],
146
						'TEXT_CREATE_FOLDER' => $TEXT['CREATE_FOLDER'],
147
						'TEXT_RENAME' => $TEXT['RENAME'],
148
						'TEXT_UPLOAD_FILES' => $TEXT['UPLOAD_FILES'],
149
						'TEXT_BASIC' => $TEXT['BASIC'],
150
						'TEXT_ADVANCED' => $TEXT['ADVANCED'],
151
						'CHANGING_PASSWORD' => $MESSAGE['USERS']['CHANGING_PASSWORD'],
152
						'HEADING_MODIFY_GROUP' => $HEADING['MODIFY_GROUP'],
153
					));
154

  
155
			// Parse template object
156
			$template->parse('main', 'main_block', false);
157
			$template->pparse('output', 'page');
158
			break;
159
		case 'delete' :
160
			// Create new admin object
161
			$admin = new admin('Access', 'groups_delete');
162
			$group_id = intval($admin->checkIDKEY('group_id', 0, $_SERVER['REQUEST_METHOD']));
163
			// Check if user id is a valid number and doesnt equal 1
164
			if( ($group_id < 2 ) )
165
			{
166
				// if($admin_header) { $admin->print_header(); }
167
				$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'] );
168
			}
169
			// Print header
170
			$admin->print_header();
171
			// Delete the group
172
			$database->query("DELETE FROM ".TABLE_PREFIX."groups WHERE group_id = '".$group_id."' LIMIT 1");
173
			if($database->is_error()) {
174
				$admin->print_error($database->get_error());
119 175
			} else {
120
				$template->set_var('CHECKED', '');
176
				// Delete users in the group
177
				$database->query("DELETE FROM ".TABLE_PREFIX."users WHERE group_id = '".$group_id."'");
178
				if($database->is_error()) {
179
					$admin->print_error($database->get_error());
180
				} else {
181
					$admin->print_success($MESSAGE['GROUPS']['DELETED']);
182
				}
121 183
			}
122
			$template->parse('template_list', 'template_list_block', true);
123
		}
124
	}
125
		
126
	// Insert language text and messages
127
	$template->set_var(array(
128
				'TEXT_RESET' => $TEXT['RESET'],
129
				'TEXT_ACTIVE' => $TEXT['ACTIVE'],
130
				'TEXT_DISABLED' => $TEXT['DISABLED'],
131
				'TEXT_PLEASE_SELECT' => $TEXT['PLEASE_SELECT'],
132
				'TEXT_USERNAME' => $TEXT['USERNAME'],
133
				'TEXT_PASSWORD' => $TEXT['PASSWORD'],
134
				'TEXT_RETYPE_PASSWORD' => $TEXT['RETYPE_PASSWORD'],
135
				'TEXT_DISPLAY_NAME' => $TEXT['DISPLAY_NAME'],
136
				'TEXT_EMAIL' => $TEXT['EMAIL'],
137
				'TEXT_GROUP' => $TEXT['GROUP'],
138
				'TEXT_SYSTEM_PERMISSIONS' => $TEXT['SYSTEM_PERMISSIONS'],
139
				'TEXT_MODULE_PERMISSIONS' => $TEXT['MODULE_PERMISSIONS'],
140
				'TEXT_TEMPLATE_PERMISSIONS' => $TEXT['TEMPLATE_PERMISSIONS'],
141
				'TEXT_NAME' => $TEXT['NAME'],
142
				'SECTION_PAGES' => $MENU['PAGES'],
143
				'SECTION_MEDIA' => $MENU['MEDIA'],
144
				'SECTION_MODULES' => $MENU['MODULES'],
145
				'SECTION_TEMPLATES' => $MENU['TEMPLATES'],
146
				'SECTION_LANGUAGES' => $MENU['LANGUAGES'],
147
				'SECTION_SETTINGS' => $MENU['SETTINGS'],
148
				'SECTION_USERS' => $MENU['USERS'],
149
				'SECTION_GROUPS' => $MENU['GROUPS'],
150
				'SECTION_ADMINTOOLS' => $MENU['ADMINTOOLS'],
151
				'TEXT_VIEW' => $TEXT['VIEW'],
152
				'TEXT_ADD' => $TEXT['ADD'],
153
				'TEXT_LEVEL' => $TEXT['LEVEL'],
154
				'TEXT_MODIFY' => $TEXT['MODIFY'],
155
				'TEXT_DELETE' => $TEXT['DELETE'],
156
				'TEXT_MODIFY_CONTENT' => $TEXT['MODIFY_CONTENT'],
157
				'TEXT_MODIFY_SETTINGS' => $TEXT['MODIFY_SETTINGS'],
158
				'HEADING_MODIFY_INTRO_PAGE' => $HEADING['MODIFY_INTRO_PAGE'],
159
				'TEXT_CREATE_FOLDER' => $TEXT['CREATE_FOLDER'],
160
				'TEXT_RENAME' => $TEXT['RENAME'],
161
				'TEXT_UPLOAD_FILES' => $TEXT['UPLOAD_FILES'],
162
				'TEXT_BASIC' => $TEXT['BASIC'],
163
				'TEXT_ADVANCED' => $TEXT['ADVANCED'],
164
				'CHANGING_PASSWORD' => $MESSAGE['USERS']['CHANGING_PASSWORD'],
165
				'HEADING_MODIFY_GROUP' => $HEADING['MODIFY_GROUP'],
166
			));
167
	
168
	// Parse template object
169
	$template->parse('main', 'main_block', false);
170
	$template->pparse('output', 'page');
171
} elseif($_POST['action'] == 'delete') {
172
	// Create new admin object
173
	$admin = new admin('Access', 'groups_delete', false);
174
/*  */
175
	if (!$admin->checkFTAN())
176
	{
177
		$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL);
178
	}
179
	// Print header
180
	$admin->print_header();
181
	// Delete the group
182
	$database->query("DELETE FROM ".TABLE_PREFIX."groups WHERE group_id = '".$_POST['group_id']."' LIMIT 1");
183
	if($database->is_error()) {
184
		$admin->print_error($database->get_error());
185
	} else {
186
		// Delete users in the group
187
		$database->query("DELETE FROM ".TABLE_PREFIX."users WHERE group_id = '".$_POST['group_id']."'");
188
		if($database->is_error()) {
189
			$admin->print_error($database->get_error());
190
		} else {
191
			$admin->print_success($MESSAGE['GROUPS']['DELETED']);
192
		}
193
	}
194
}
184
			break;
185
	default:
186
			break;
187
endswitch;
195 188

  
196 189
// Print admin footer
197 190
$admin->print_footer();

Also available in: Unified diff