Project

General

Profile

1
<?php
2
/**
3
 *
4
 * @category        admin
5
 * @package         settings
6
 * @author          WebsiteBaker Project
7
 * @copyright       2009-2012, WebsiteBaker Org. e.V.
8
 * @link			http://www.websitebaker2.org/
9
 * @license         http://www.gnu.org/licenses/gpl.html
10
 * @platform        WebsiteBaker 2.8.x
11
 * @requirements    PHP 5.2.2 and higher
12
 * @version         $Id: save.php 1844 2012-12-28 06:03:26Z Luisehahne $
13
 * @filesource		$HeadURL: svn://isteam.dynxs.de/wb-archiv/branches/2.8.x/wb/admin/settings/save.php $
14
 * @lastmodified    $Date: 2012-12-28 07:03:26 +0100 (Fri, 28 Dec 2012) $
15
 *
16
 */
17

    
18
// prevent this file from being accessed directly in the browser (would set all entries in DB settings table to '')
19
if(!isset($_POST['default_language']) || $_POST['default_language'] == '') die(header('Location: index.php'));
20

    
21
// Find out if the user was view advanced options or not
22
$advanced = ($_POST['advanced'] == 'yes') ? '?advanced=yes' : '';
23

    
24
// Print admin header
25
//require('../../config.php');
26
//require_once(WB_PATH.'/framework/class.admin.php');
27

    
28
// Include config file
29
$config_file = realpath('../../config.php');
30
if(file_exists($config_file) && !defined('WB_URL'))
31
{
32
	require($config_file);
33
}
34

    
35
if(!class_exists('admin', false)){ include(WB_PATH.'/framework/class.admin.php'); }
36

    
37
require_once(WB_PATH.'/framework/functions.php');
38

    
39
// suppress to print the header, so no new FTAN will be set
40
if($advanced == '')
41
{
42
	$admin = new admin('Settings', 'settings_basic',false);
43
} else {
44
	$admin = new admin('Settings', 'settings_advanced',false);
45
}
46

    
47
// Create a javascript back link
48
$js_back = ADMIN_URL.'/settings/index.php'.$advanced;
49
if( !$admin->checkFTAN() )
50
{
51
	$admin->print_header();
52
	$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'],$js_back );
53
}
54
// After check print the header
55
$admin->print_header();
56

    
57
// Ensure that the specified default email is formally valid
58
if(isset($_POST['server_email']))
59
{
60
	$_POST['server_email'] = strip_tags($_POST['server_email']);
61
//    // $pattern = '/^[-a-z0-9~!$%^&*_=+}{\'?]+(\.[-a-z0-9~!$%^&*_=+}{\'?]+)*@([a-z0-9]([-a-z0-9_]?[a-z0-9])*(\.[-a-z0-9_]+)*\.(aero|arpa|biz|com|coop|edu|gov|info|int|mil|museum|name|net|org|pro|travel|mobi|[a-z]{2})|([1]?\d{1,2}|2[0-4]{1}\d{1}|25[0-5]{1})(\.([1]?\d{1,2}|2[0-4]{1}\d{1}|25[0-5]{1})){3})(:[0-9]{1,5})?\r/im';
62
//    $pattern = '/^[_a-zA-Z0-9-]+(\.[_a-zA-Z0-9-]+)*@[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*\.(([0-9]{1,3})|([a-zA-Z]{2,6}))$/';
63
//    if(false == preg_match($pattern, $_POST['server_email']))
64
	if(!$admin->validate_email($_POST['server_email']))
65
    {
66
		$admin->print_error($MESSAGE['USERS_INVALID_EMAIL'].
67
			'<br /><strong>Email: '.htmlentities($_POST['server_email']).'</strong>', $js_back);
68
	}
69
}
70

    
71
if($admin->StripCodeFromText($admin->get_post('wbmailer_routine'))=='smtp') {
72

    
73
	$checkSmtpHost = (($admin->StripCodeFromText($admin->get_post('wbmailer_smtp_host'))=='') ? false : true);
74
//	$checkSmtpHost = (isset($_POST['wbmailer_smtp_host']) && ($_POST['wbmailer_smtp_host']=='') ? false : true);
75
	$checkSmtpUser = (($admin->StripCodeFromText($admin->get_post('wbmailer_smtp_username'))=='') ? false : true);
76
//	$checkSmtpUser = (isset($_POST['wbmailer_smtp_username']) && ($_POST['wbmailer_smtp_username']=='') ? false : true);
77
	$checkSmtpPassword = (($admin->StripCodeFromText($admin->get_post('wbmailer_smtp_password'))=='') ? false : true);
78
//	$checkSmtpPassword = (isset($_POST['wbmailer_smtp_password']) && ($_POST['wbmailer_smtp_password']=='') ? false : true);
79

    
80
	if(!$checkSmtpHost || !$checkSmtpUser || !$checkSmtpPassword) {
81
		$admin->print_error($TEXT['REQUIRED'].' '.$TEXT['WBMAILER_SMTP_AUTH'].
82
			'<br /><strong>'.$MESSAGE['GENERIC_FILL_IN_ALL'].'</strong>', $js_back);
83
	}
84

    
85
}
86

    
87
// Work-out file mode
88
if($advanced == '')
89
{
90
	$file_mode = STRING_FILE_MODE;
91
	$dir_mode = STRING_DIR_MODE;
92
	// Check if should be set to 777 or left alone
93
//	if(isset($_POST['world_writeable']) && $_POST['world_writeable'] == 'true')
94
//    {
95
//		$file_mode = '0777';
96
//		$dir_mode = '0777';
97
//	} else {
98
//		$file_mode = STRING_FILE_MODE;
99
//		$dir_mode = STRING_DIR_MODE;
100
//	}
101
} else {
102
	$file_mode = STRING_FILE_MODE;
103
	$dir_mode = STRING_DIR_MODE;
104
	if($admin->get_user_id()=='1')
105
	{
106
		// Work-out the octal value for file mode
107
		$u = 0;
108
		if(isset($_POST['file_u_r']) && $_POST['file_u_r'] == 'true') {
109
			$u = $u+4;
110
		}
111
		if(isset($_POST['file_u_w']) && $_POST['file_u_w'] == 'true') {
112
			$u = $u+2;
113
		}
114
		if(isset($_POST['file_u_e']) && $_POST['file_u_e'] == 'true') {
115
			$u = $u+1;
116
		}
117
		$g = 0;
118
		if(isset($_POST['file_g_r']) && $_POST['file_g_r'] == 'true') {
119
			$g = $g+4;
120
		}
121
		if(isset($_POST['file_g_w']) && $_POST['file_g_w'] == 'true') {
122
			$g = $g+2;
123
		}
124
		if(isset($_POST['file_g_e']) && $_POST['file_g_e'] == 'true') {
125
			$g = $g+1;
126
		}
127
		$o = 0;
128
		if(isset($_POST['file_o_r']) && $_POST['file_o_r'] == 'true') {
129
			$o = $o+4;
130
		}
131
		if(isset($_POST['file_o_w']) && $_POST['file_o_w'] == 'true') {
132
			$o = $o+2;
133
		}
134
		if(isset($_POST['file_o_e']) && $_POST['file_o_e'] == 'true') {
135
			$o = $o+1;
136
		}
137
		$file_mode = "0".$u.$g.$o;
138
		// Work-out the octal value for dir mode
139
		$u = 0;
140
		if(isset($_POST['dir_u_r']) && $_POST['dir_u_r'] == 'true') {
141
			$u = $u+4;
142
		}
143
		if(isset($_POST['dir_u_w']) && $_POST['dir_u_w'] == 'true') {
144
			$u = $u+2;
145
		}
146
		if(isset($_POST['dir_u_e']) && $_POST['dir_u_e'] == 'true') {
147
			$u = $u+1;
148
		}
149
		$g = 0;
150
		if(isset($_POST['dir_g_r']) && $_POST['dir_g_r'] == 'true') {
151
			$g = $g+4;
152
		}
153
		if(isset($_POST['dir_g_w']) && $_POST['dir_g_w'] == 'true') {
154
			$g = $g+2;
155
		}
156
		if(isset($_POST['dir_g_e']) && $_POST['dir_g_e'] == 'true') {
157
			$g = $g+1;
158
		}
159
		$o = 0;
160
		if(isset($_POST['dir_o_r']) && $_POST['dir_o_r'] == 'true') {
161
			$o = $o+4;
162
		}
163
		if(isset($_POST['dir_o_w']) && $_POST['dir_o_w'] == 'true') {
164
			$o = $o+2;
165
		}
166
		if(isset($_POST['dir_o_e']) && $_POST['dir_o_e'] == 'true') {
167
			$o = $o+1;
168
		}
169
		$dir_mode = "0".$u.$g.$o;
170
	}
171
}
172

    
173
$allow_tags_in_fields = array(
174
    'website_header',
175
    'website_footer',
176
    'wbmail_signature'
177
    );
178
$allow_empty_values = array(
179
    'website_header',
180
    'website_footer',
181
    'wbmail_signature',
182
    'wysiwyg_style',
183
    'pages_directory',
184
    'page_icon_dir',
185
    'rename_files_on_upload',
186
    'page_spacer',
187
    'page_icon_dir',
188
    'modules_upgrade_list'
189
    );
190
$disallow_in_fields = array(
191
    'pages_directory',
192
    'media_directory',
193
    'wb_version'
194
    );
195
$StripCodeFromInput = array(
196
    'website_title',
197
    'website_description',
198
    'website_keywords',
199
    'wbmail_signature',
200
    'wysiwyg_style',
201
    'pages_directory',
202
    'page_icon_dir',
203
    'media_directory',
204
    'page_extension',
205
    'rename_files_on_upload',
206
    'page_spacer',
207
    'page_icon_dir',
208
    'modules_upgrade_list'
209
    );
210

    
211
// Query current settings in the db, then loop through them and update the db with the new value
212
$settings = array();
213
$old_settings = array();
214
// Query current settings in the db, then loop through them to get old values
215
$sql = 'SELECT `name`, `value` FROM `'.TABLE_PREFIX.'settings`';
216
$sql .= 'ORDER BY `name`';
217

    
218
if($res_settings = $database->query($sql)) {
219
	$passed = false;
220
	while($setting = $res_settings->fetchRow(MYSQL_ASSOC))
221
	{
222
		$setting_name = $setting['name'];
223
		$old_settings[$setting_name] = $setting['value'];
224
		$value = $admin->get_post($setting_name);
225
		$value = isset($_POST[$setting_name]) ? $value : $old_settings[$setting_name] ;
226
		switch ($setting_name) {
227
			case 'default_timezone':
228
				$value=$value*60*60;
229
				$passed = true;
230
				break;
231
			case 'string_dir_mode':
232
				$value=$dir_mode;
233
				$passed = true;
234
				break;
235
			case 'string_file_mode':
236
				$value=$file_mode;
237
	 			$passed = true;
238
    			break;
239
			case 'sec_anchor':
240
                $value = $admin->StripCodeFromText($value);
241
				$value=(($value=='') ? 'section_' : $value);
242
	 			$passed = true;
243
				break;
244
			case 'media_directory':
245
				if(strpos($value,'/',0)===false) {	$value= '/'.$value;	}
246
	 			$passed = true;
247
				break;
248
			case 'pages_directory':
249
				if( ($database->get_one('SELECT COUNT(*) FROM `'.TABLE_PREFIX.'pages`'))==0 ) {
250
					$value = $admin->StripCodeFromText($value);
251
					$passed = true;
252
				} else {
253
					$value = $old_settings[$setting_name];
254
				}
255
				if(strpos($value,'/',0)===false) {	$value= '/'.$value;	}
256
				break;
257
			case 'wbmailer_smtp_auth':
258
				$value = true ;
259
	 			$passed = true;
260
				break;
261
			default :
262
                $passed = in_array($setting_name, $allow_empty_values);
263
                if(in_array($setting_name, $StripCodeFromInput) ) {
264
                    $value = $admin->StripCodeFromText($value);
265
                }
266
				break;
267
		}
268

    
269
	    if (!in_array($setting_name, $allow_tags_in_fields))
270
	    {
271
	        $value = strip_tags($value);
272
	    }
273

    
274
	    if ( !in_array($value, $disallow_in_fields) && (isset($_POST[$setting_name]) || $passed == true) )
275
	    {
276
	        $value = trim($admin->add_slashes($value));
277
	        $sql = 'UPDATE `'.TABLE_PREFIX.'settings` ';
278
	        $sql .= 'SET `value` = \''.($value).'\' '; // mysql_escape_string
279
	        $sql .= 'WHERE `name` != \'wb_version\' ';
280
	        $sql .= 'AND `name` = \''.$setting_name.'\' ';
281
	        if (!$database->query($sql))
282
	        {
283
				if($database->is_error()) {
284
					$admin->print_error($database->get_error, $js_back );
285
				}
286
	        }
287
		}
288
	}
289

    
290
}
291
/**
292
 * now save search settings
293
 */
294
$StripCodeFromISearch = array(
295
    'search_header',
296
    'search_results_header',
297
    'search_results_loop',
298
    'search_results_footer',
299
    'search_footer',
300
    'search_module_order',
301
    'search_max_excerpt',
302
    'search_no_results',
303
    'search_time_limit',
304
    'search_max_excerpt',
305
    );
306
$allow_empty_values = array(
307
    'header',
308
    'results_header',
309
    'results_loop',
310
    'results_footer',
311
    'footer',
312
    'module_order',
313
    'no_results',
314
    );
315
$allow_tags_in_fields = array(
316
    'header',
317
    'results_header',
318
    'results_loop',
319
    'results_footer',
320
    'no_results',
321
    'footer',
322
    );
323

    
324
// Query current search settings in the db, then loop through them and update the db with the new value
325
$sql  = 'SELECT `name`, `value` FROM `'.TABLE_PREFIX.'search` ';
326
$sql .= 'WHERE `extra` =  \'\' ';
327
if( !($oSearch = $database->query($sql)) ) {
328
    if($database->is_error()) {
329
    	$admin->print_error(explode(';',$database->get_error()), $js_back );
330
    }
331
}
332

    
333
while($aSearch = $oSearch->fetchRow(MYSQL_ASSOC))
334
{
335
	$passed = false;
336
	$old_value = $aSearch['value'];
337
	$sSearchName = $aSearch['name'];
338
	$sPostName = 'search_'.$sSearchName;
339

    
340
    $value = $admin->get_post($sPostName);
341
    $value = isset($value) ?  $value : $old_value;
342
    if(in_array($sPostName, $StripCodeFromISearch) ) {
343
        $value = $admin->StripCodeFromText($value);
344
    }
345

    
346
/**
347
 *  hold old value if post is empty
348
 *  check search template
349
 */
350
	switch ($sSearchName) {
351
		case 'template':
352
 			$passed = true;
353
            $value =  ( !($admin->get_post($sPostName)) || ($value == DEFAULT_TEMPLATE ) ) ? '' : $admin->get_post($sPostName);
354
			break;
355
		case 'max_excerpt':
356
 			$passed = true;
357
        	if(preg_match('/[^0-9]+/i', $value)) {
358
                $value = $old_value;
359
        	}
360
			break;
361
		case 'time_limit':
362
            $passed = true;
363
        	if(preg_match('/[^0-9]+/i', $value)) {
364
                $value = $old_value;
365
        	}
366
			break;
367
		default :
368
        	$passed = ($admin->get_post($sPostName) || in_array($sSearchName, $allow_empty_values));
369

    
370
            if (!in_array($sSearchName, $allow_tags_in_fields))
371
            {
372
                $value = strip_tags($value);
373
            }
374
			break;
375
	}
376

    
377
    if ( ($passed == true) )
378
	{
379
		$value = $admin->add_slashes($value);
380
        $sql  = 'UPDATE `'.TABLE_PREFIX.'search` ';
381
        $sql .= 'SET `value` = \''.$value.'\' ';
382
        $sql .= 'WHERE `name` = \''.$sSearchName.'\' ';
383
        $sql .= 'AND `extra` = \'\' ';
384
		if($database->query($sql)) {
385

    
386
		}
387
		$sql_info = mysql_info($database->db_handle);
388
    }
389
}
390

    
391
// Check if there was an error updating the db
392
if($database->is_error()) {
393
	$admin->print_error($database->get_error, $js_back );
394
} else {
395
	$admin->print_success($MESSAGE['SETTINGS_SAVED'], $js_back );
396
}
397
$admin->print_footer();
(3-3/4)