WB 2.08.x

09 Nov-2011 Build 1519 Werner v.d.Decken(DarkViper)

! /modules/output_filter completely recoded

+ new filter for relative-URL added

+ some small fixes

! /admin/admintools/tool.php completely recoded

! /wb/index.php output_filter request changed to adopt new output_filter

if(!defined('REVISION')) define('REVISION', '1519');

 * @author          WB-Project, Werner v.d. Decken

 * @copyright       2011, Website Baker Org. e.V.

 * @platform        WebsiteBaker 2.8.2

	$toolDir = (isset($_GET['tool']) && (trim($_GET['tool']) != '') ? trim($_GET['tool']) : '');

	$doSave = (isset($_POST['save_settings']) || (isset($_POST['action']) && strtolower($_POST['action']) == 'save'));

// test for valid tool name

	if(preg_match('/^[a-z][a-z_\-0-9]{2,}$/i', $toolDir)) {

	// Check if tool is installed

		$sql = 'SELECT `name` FROM `'.TABLE_PREFIX.'addons` '.

		       'WHERE `type`=\'module\' AND `function`=\'tool\' '.

		              'AND `directory`=\''.$toolDir.'\'';

		if(($toolName = $database->get_one($sql))) {

		// create admin-object and print header if FTAN is NOT supported AND function 'save' is requested

			$admin_header = !(is_file(WB_PATH.'/modules/'.$toolDir.'/FTAN_SUPPORTED') && $doSave);

			$admin = new admin('admintools', 'admintools', $admin_header );

			if(!$doSave) {

			// show title if not function 'save' is requested

				print '<h4><a href="'.ADMIN_URL.'/admintools/index.php" '.

				      'title="'.$HEADING['ADMINISTRATION_TOOLS'].'">'.

				      $HEADING['ADMINISTRATION_TOOLS'].'</a>'.

					  '&raquo'.$toolName.'</h4>'."\n";

			}

			// include modules tool.php

			require(WB_PATH.'/modules/'.$toolDir.'/tool.php');

			$admin->print_footer();

		}else {

		// no installed module found, jump to index.php of admintools

			header('location: '.ADMIN_URL.'/admintools/index.php');

			exit(0);

		}

	}else {

	// invalid module name requested, jump to index.php of admintools

		header('location: '.ADMIN_URL.'/admintools/index.php');

		exit(0);

	}

 * @author          WB-Project, Werner v.d. Decken

 * @copyright       2011, Website Baker Org. e.V.

 * @copyright       2009-, Website Baker Org. e.V.

	if(file_exists(WB_PATH .'/modules/droplets/droplets.php')) {

		include_once(WB_PATH .'/modules/droplets/droplets.php');

		if(function_exists('evalDroplets')) {

			$output = evalDroplets($output);

		}

	}

	if(file_exists(WB_PATH .'/modules/output_filter/filter-routines.php')) {

		include_once(WB_PATH .'/modules/output_filter/filter-routines.php');

		if(function_exists('executeFrontendOutputFilter')) {

			$output = executeFrontendOutputFilter($output);

		}elseif(function_exists('filter_frontend_output')) {

			$output = filter_frontend_output($output);

		}

	}

	if(function_exists('moveCssToHead')) {

		$output = moveCssToHead($output);

	}

 * @author          Christian Sommer, WB-Project, Werner v.d. Decken

 * @copyright       2009-, Website Baker Org. e.V.

 * @platform        WebsiteBaker 2.8.2

/* -------------------------------------------------------- */

// Must include code to stop this file being accessed directly

require_once( dirname(dirname(dirname(__FILE__))).'/framework/globalExceptionHandler.php');

if(!defined('WB_PATH')) { throw new IllegalFileException(); }

/* -------------------------------------------------------- */

 * @author          Christian Sommer, WB-Project, Werner v.d. Decken

 * @copyright       2011, Website Baker Org. e.V.

 * @platform        WebsiteBaker 2.8.2

/* -------------------------------------------------------- */

// Must include code to stop this file being accessed directly

require_once( dirname(dirname(dirname(__FILE__))).'/framework/globalExceptionHandler.php');

if(!defined('WB_PATH')) { throw new IllegalFileException(); }

/* -------------------------------------------------------- */

/* ************************************************************************** */

/**

 * execute the frontend output filter to modify email addresses

 * @param string actual content

 * @return string modified content

 */

	function executeFrontendOutputFilter($content) {

		// get output filter settings from database

		$filter_settings = getOutputFilterSettings();

		$output_filter_mode = 0;

		$output_filter_mode |= ($filter_settings['email_filter'] * pow(2, 0));  // n | 2^0

		$output_filter_mode |= ($filter_settings['mailto_filter'] * pow(2, 1)); // n | 2^1

		define('OUTPUT_FILTER_AT_REPLACEMENT', $filter_settings['at_replacement']);

		define('OUTPUT_FILTER_DOT_REPLACEMENT', $filter_settings['dot_replacement']);

/* ### filter type: full qualified URLs ##################################### */

        if($filter_settings['sys_rel'] == 1){

			$content = _doFilterRelUrl($content);

		}

/* ### filter type: protect email addresses ################################# */

		if( ($output_filter_mode & pow(2, 0)) || ($output_filter_mode & pow(2, 1)) ) {

			$content = _doFilterEmail($content, $output_filter_mode);

		}

/* ### end of filters ####################################################### */

		return $content;

	}

/* ************************************************************************** */

/**

 * function to read the current filter settings

 * @global object $database

 * @global object $admin

 * @param void

 * @return array contains all settings

 */

	function getOutputFilterSettings() {

	// set default values

		$settings = array(

			'sys_rel'         => 0,

			'email_filter'    => 0,

			'mailto_filter'   => 0,

			'at_replacement'  => '(at)',

			'dot_replacement' => '(dot)'

		);

	// be sure field 'sys_rel' is in table

		$database->field_add( TABLE_PREFIX.'mod_output_filter', 'sys_rel', 'INT NOT NULL DEFAULT \'0\' FIRST');

	// request settings from database

		$sql = 'SELECT * FROM `'.TABLE_PREFIX.'mod_output_filter';

		if(($res = $database->query($sql))) {

			if(($rec = $res->fetchRow())) {

				$settings = $rec;

				$settings['at_replacement']  = $admin->strip_slashes($settings['at_replacement']);

				$settings['dot_replacement'] = $admin->strip_slashes($settings['dot_replacement']);

			}

	// return array with filter settings

		return $settings;

/* ************************************************************************** */

/**

 * Convert full qualified, local URLs into relative URLs

 * @param string $content

 * @return string

 */

	function _doFilterRelUrl($content) {

		$content = preg_replace_callback(

				'/((?:href|src)\s*=\s*")([^\"]*?)(")/iU',

				create_function('$matches',

				    '$retval = $matches[0]; '.

		            '$h = parse_url($matches[2], PHP_URL_HOST); '.

		            'if(stripos(WB_URL, $h) !== false) { '.

		            '$a = parse_url($matches[2]); '.

		            '$p = (isset($a[\'path\']) ? $a[\'path\'] : \'\'); '.

		            '$q = (isset($a[\'query\']) ? \'?\'.$a[\'query\'] : \'\'); '.

		            '$f = (isset($a[\'fragment\']) ? \'#\'.$a[\'fragment\'] : \'\'); '.

		            '$p .= ($q.$f); '.

		            '$retval = $matches[1]."/".(isset($p) ? ltrim(str_replace("//", "/", $p), "/") : "").$matches[3]; '.

		            '} '.

		            'return $retval;'),

		        $content);

		return $content;

	}

/* ************************************************************************** */

/**

 * protect email addresses (replace '@' and '.' and obfuscate address

 * @param string $content

 * @return string

 */

	function _doFilterEmail($content, $output_filter_mode) {

	// test if js-decryption is installed

		if( preg_match('/<head.*<.*src=\".*\/mdcr.js.*>.*<\/head/siU', $content) ) {

			$output_filter_mode |= pow(2, 2); // n | 2^2

		}else {

		// try to insert js-decrypt into <head> if available

			$script = str_replace('\\', '/', dirname(__FILE__)).'/js/mdcr.js';

			if(is_readable($script)) {

				$scriptLink = '<script src="'.$script.'" type="text/javascript"></script>';

				$regex = '/(.*)(<\s*?\/\s*?head\s*>.*)/isU';

				$replace = '$1<script src="'.$scriptLink.'" type="text/javascript"></script>$2';

				$content = preg_replace ($regex, $replace, $content);

				$output_filter_mode |= pow(2, 2); // n | 2^2

	// define some constants so we do not call the database in the callback functions again

		define('OUTPUT_FILTER_MODE', (int)$output_filter_mode);

/* *** obfuscate mailto addresses by js:mdcr *** */

/*

	Sub 1:\b(<a.[^<]*href\s*?=\s*?"\s*?mailto\s*?:\s*?)			-->	"<a id="yyy" class="xxx" href = " mailto :" ignoring white spaces

	Sub 2:([A-Z0-9._%+-]+@(?:[A-Z0-9-]+\.)+[A-Z]{2,4})			-->	the email address in the mailto: part of the mail link

	Sub 3:([^"]*?)"												--> possible ?Subject&cc... stuff attached to the mail address

	Sub 4:([^>]*>)												--> all class or id statements after the mailto but before closing ..>

	Sub 5:(.*?)</a>\b											--> the mailto text; all characters between >xxxxx</a>

	Sub 6:|\b([A-Z0-9._%+-]+@(?:[A-Z0-9-]+\.)+[A-Z]{2,4})\b		--> email addresses which may appear in the text (require word boundaries)

*/

		$content = preg_replace_callback($pattern, '_cbDoExecuteFilter', $content);

/* ************************************************************************** */

/**

 * callback-function for function _doFilterEmail() to proceed search results

 * @param array results from preg_replace

 * @return string proceeded replacement string

 */

	function _cbDoExecuteFilter($match) {

		// check if required arguments are defined

		if(!( defined('OUTPUT_FILTER_MODE')

		      && defined('OUTPUT_FILTER_AT_REPLACEMENT')

		      && defined('OUTPUT_FILTER_MODE')

    	    ) ) {

		switch (count($match)) {

			case 8:

			/** OUTPUT FILTER FOR EMAIL ADDRESSES EMBEDDED IN TEXT **/

				if(!in_array(OUTPUT_FILTER_MODE, array(1,3,7))) return $match[0];

				// do not filter mail addresses included in input tags (<input ... value = "test@mail)

				if (strpos($match[6], 'value') !== false) return $match[0];

				// filtering of non mailto email addresses enabled

				return str_replace($search, $replace, $match[0]);

			break;

			case 6:

			/** OUTPUT FILTER FOR EMAIL ADDRESSES EMBEDDED IN MAILTO LINKS **/

				if(!in_array(OUTPUT_FILTER_MODE, array(2,3,6,7))) return $match[0];

				// check if last part of the a href link: >xxxx</a> contains a email address we need to filter

				$pattern = '#[A-Z0-9._%+-]+@(?:[A-Z0-9-]+\.)+[A-Z]{2,4}#i';

				if(preg_match_all($pattern, $match[5], $matches)) {

					foreach($matches as $submatch) {

						foreach($submatch as $value) {

							$match[5] = str_replace($value, str_replace($search, $replace, $value), $match[5]);

						}

				// check if Javascript encryption routine is enabled

				if(in_array(OUTPUT_FILTER_MODE, array(6,7))) {

					preg_match('/class\s*?=\s*?("|\')(.*?)\1/ix', $match[0], $class_attr);

					$class_attr = empty($class_attr) ? '' : 'class="' . $class_attr[2] . '" ';

					preg_match('/id\s*?=\s*?("|\')(.*?)\1/ix', $match[0], $id_attr);

					$id_attr = empty($id_attr) ? '' : 'id="' . $id_attr[2] . '" ';

					$search = array('@', '.', '_', '-'); $replace = array('F', 'Z', 'X', 'K');

					$email_address = str_replace($search, $replace, strtolower($match[2]));

					$email_subject = rawurlencode(html_entity_decode($match[3]));

					mt_srand((double)microtime()*1000000);	// (PHP < 4.2.0)

					$shift = mt_rand(1, 25);

					$encrypted_email = "";

					for($i = strlen($email_address) -1; $i > -1; $i--) {

						if(preg_match('#[FZXK0-9]#', $email_address[$i], $characters)) {

							$encrypted_email .= $email_address[$i];

						} else {

							$encrypted_email .= chr((ord($email_address[$i]) -97 + $shift) % 26 + 97);

						}

					$encrypted_email .= chr($shift + 97);

					$mailto_link  = "<a {$class_attr}{$id_attr}href=\"javascript:mdcr('$encrypted_email','$email_subject')\">" .$match[5] ."</a>";

					return $mailto_link;

				} else {

				// as minimum protection, replace @ in the mailto part by (at)

					return $match[1] .str_replace('@', OUTPUT_FILTER_AT_REPLACEMENT, $match[2]) .$match[3] .'"' .$match[4] .$match[5] .'</a>';

				}

			break;

			default:

		// number of subpatterns do not match the requirements ... do nothing

				return $match[0];

			break;

	}

/* ************************************************************************** */

 * @copyright       2011, Website Baker Org. e.V.

 * @platform        WebsiteBaker 2.8.2

$module_version	= '0.3';

$module_platform = '2.8.2';

$module_author = 'Christian Sommer(doc), WB-Project, Werner v.d. Decken(DarkViper)';

 * @author          Christian Sommer, WB-Project, Werner v.d. Decken

 * @copyright       2011-, Website Baker Org. e.V.

 * @platform        WebsiteBaker 2.8.2

/* -------------------------------------------------------- */

// Must include code to stop this file being accessed directly

require_once( dirname(dirname(dirname(__FILE__))).'/framework/globalExceptionHandler.php');

if(!defined('WB_PATH')) { throw new IllegalFileException(); }

/* -------------------------------------------------------- */

	$modPath = str_replace('\\', '/', dirname(__FILE__)).'/';

	$msgTxt = '';

	$msgCls = 'msg-box';

// include the modules language definitions

	if(!is_readable($modPath.'languages/'.LANGUAGE .'.php')) {

		require_once($modPath.'languages/EN.php');

	} else {

		require_once($modPath.'languages/'.LANGUAGE .'.php');

	}

	if($doSave) {

	// take over post - arguments

		$data = array();

		$data['sys_rel']       = (int)(intval(isset($_POST['sys_rel']) ? $_POST['sys_rel'] : 0) != 0);

		$data['email_filter']  = (int)(intval(isset($_POST['email_filter']) ? $_POST['email_filter'] : 0) != 0);

		$data['mailto_filter'] = (int)(intval(isset($_POST['mailto_filter']) ? $_POST['mailto_filter'] : 0) != 0);

		$data['at_replacement']  = isset($_POST['at_replacement']) ? trim(strip_tags($_POST['at_replacement'])) : '';

		$data['dot_replacement'] = isset($_POST['dot_replacement']) ? trim(strip_tags($_POST['dot_replacement'])) : '';

		if ($admin->checkFTAN()) {

		// update database settings

			$sql = 'UPDATE `'.TABLE_PREFIX.'mod_output_filter` SET '.

					  '`email_filter`='.$data['email_filter'].', '.

					  '`sys_rel`='.$data['sys_rel'].', '.

					  '`mailto_filter`='.$data['mailto_filter'].', '.

					  '`at_replacement`=\''.mysql_real_escape_string($data['at_replacement']).'\', '.

					  '`dot_replacement`=\''.mysql_real_escape_string($data['dot_replacement']).'\'';

			if($database->query($sql)) {

			//anything ok

				$msgTxt = $MESSAGE['RECORD_MODIFIED_SAVED'];

				$msgCls = 'msg-box';

			}else {

			// database error

				$msgTxt = $MESSAGE['RECORD_MODIFIED_FAILED'];

				$msgCls = 'error-box';

			}

		}else {

		// FTAN error

			$msgTxt = $MESSAGE['GENERIC_SECURITY_ACCESS'];

			$msgCls = 'error-box';

		}

	}else {

	// read settings from the database to show

		require_once($modPath.'filter-routines.php');

		$data = getOutputFilterSettings();

	// write out header if needed

	if( $msgTxt != '') {

	// write message box if needed

		echo '<div class="'.$msgCls.'">'.$msgTxt.'</div>';

<h2><?php echo $MOD_MAIL_FILTER['HEADING']; ?></h2>

<p><?php echo $MOD_MAIL_FILTER['HOWTO']; ?></p>

	<?php echo $admin->getFTAN(); ?>

	<input type="hidden" name="action" value="save" />

	<input type="submit" style="margin-top:10px; width:140px;" value="<?php echo $TEXT['SAVE']; ?>" />

</form>

 * @author          Christian Sommer, WB-Project, Werner v.d. Decken

 * @copyright       2011-, Website Baker Org. e.V.

 * @platform        WebsiteBaker 2.8.2

/* -------------------------------------------------------- */

// Must include code to stop this file being accessed directly

require_once( dirname(dirname(dirname(__FILE__))).'/framework/globalExceptionHandler.php');

if(!defined('WB_PATH')) { throw new IllegalFileException(); }

/* -------------------------------------------------------- */

	`sys_rel` INT NOT NULL DEFAULT '0',

 * @author          Christian Sommer, WB-Project, Werner v.d. Decken

 * @platform        WebsiteBaker 2.8.2

 * @author          Christian Sommer, WB-Project, Werner v.d. Decken

 * @platform        WebsiteBaker 2.8.2

/* -------------------------------------------------------- */

// Must include code to stop this file being accessed directly

require_once( dirname(dirname(dirname(__FILE__))).'/framework/globalExceptionHandler.php');

if(!defined('WB_PATH')) { throw new IllegalFileException(); }

/* -------------------------------------------------------- */

	$description = 'INT NOT NULL DEFAULT \'0\' FIRST';