Project

General

Profile

1
<?php
2
/**
3
 *
4
 * @category        admin
5
 * @package         settings
6
 * @author          WebsiteBaker Project
7
 * @copyright       2009-2012, WebsiteBaker Org. e.V.
8
 * @link			http://www.websitebaker2.org/
9
 * @license         http://www.gnu.org/licenses/gpl.html
10
 * @platform        WebsiteBaker 2.8.x
11
 * @requirements    PHP 5.2.2 and higher
12
 * @version         $Id: save.php 1859 2013-01-11 22:12:04Z Luisehahne $
13
 * @filesource		$HeadURL: svn://isteam.dynxs.de/wb-archiv/branches/2.8.x/wb/admin/settings/save.php $
14
 * @lastmodified    $Date: 2013-01-11 23:12:04 +0100 (Fri, 11 Jan 2013) $
15
 *
16
 */
17

    
18
// prevent this file from being accessed directly in the browser (would set all entries in DB settings table to '')
19
if(!isset($_POST['default_language']) || $_POST['default_language'] == '') die(header('Location: index.php'));
20

    
21
// Find out if the user was view advanced options or not
22
$advanced = ($_POST['advanced'] == 'yes') ? '?advanced=yes' : '';
23

    
24
// Print admin header
25
//require('../../config.php');
26
//require_once(WB_PATH.'/framework/class.admin.php');
27

    
28
// Include config file
29
$config_file = realpath('../../config.php');
30
if(file_exists($config_file) && !defined('WB_URL'))
31
{
32
	require($config_file);
33
}
34

    
35
if(!class_exists('admin', false)){ include(WB_PATH.'/framework/class.admin.php'); }
36

    
37
require_once(WB_PATH.'/framework/functions.php');
38

    
39
// suppress to print the header, so no new FTAN will be set
40
if($advanced == '')
41
{
42
	$admin = new admin('Settings', 'settings_basic',false);
43
} else {
44
	$admin = new admin('Settings', 'settings_advanced',false);
45
}
46

    
47
// Create a javascript back link
48
$js_back = ADMIN_URL.'/settings/index.php'.$advanced;
49
if( !$admin->checkFTAN() )
50
{
51
	$admin->print_header();
52
	$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'],$js_back );
53
}
54
// After check print the header
55
$admin->print_header();
56

    
57
// Ensure that the specified default email is formally valid
58
if(isset($_POST['server_email']))
59
{
60
	$_POST['server_email'] = strip_tags($_POST['server_email']);
61
//    // $pattern = '/^[-a-z0-9~!$%^&*_=+}{\'?]+(\.[-a-z0-9~!$%^&*_=+}{\'?]+)*@([a-z0-9]([-a-z0-9_]?[a-z0-9])*(\.[-a-z0-9_]+)*\.(aero|arpa|biz|com|coop|edu|gov|info|int|mil|museum|name|net|org|pro|travel|mobi|[a-z]{2})|([1]?\d{1,2}|2[0-4]{1}\d{1}|25[0-5]{1})(\.([1]?\d{1,2}|2[0-4]{1}\d{1}|25[0-5]{1})){3})(:[0-9]{1,5})?\r/im';
62
//    $pattern = '/^[_a-zA-Z0-9-]+(\.[_a-zA-Z0-9-]+)*@[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*\.(([0-9]{1,3})|([a-zA-Z]{2,6}))$/';
63
//    if(false == preg_match($pattern, $_POST['server_email']))
64
	if(!$admin->validate_email($_POST['server_email']))
65
    {
66
		$admin->print_error($MESSAGE['USERS_INVALID_EMAIL'].
67
			'<br /><strong>Email: '.htmlentities($_POST['server_email']).'</strong>', $js_back);
68
	}
69
}
70

    
71
if($admin->StripCodeFromText($admin->get_post('wbmailer_routine'))=='smtp') {
72

    
73
	$checkSmtpHost = (($admin->StripCodeFromText($admin->get_post('wbmailer_smtp_host'))=='') ? false : true);
74
//	$checkSmtpHost = (isset($_POST['wbmailer_smtp_host']) && ($_POST['wbmailer_smtp_host']=='') ? false : true);
75
	$checkSmtpUser = (($admin->StripCodeFromText($admin->get_post('wbmailer_smtp_username'))=='') ? false : true);
76
//	$checkSmtpUser = (isset($_POST['wbmailer_smtp_username']) && ($_POST['wbmailer_smtp_username']=='') ? false : true);
77
	$checkSmtpPassword = (($admin->StripCodeFromText($admin->get_post('wbmailer_smtp_password'))=='') ? false : true);
78
//	$checkSmtpPassword = (isset($_POST['wbmailer_smtp_password']) && ($_POST['wbmailer_smtp_password']=='') ? false : true);
79

    
80
	if(!$checkSmtpHost || !$checkSmtpUser || !$checkSmtpPassword) {
81
		$admin->print_error($TEXT['REQUIRED'].' '.$TEXT['WBMAILER_SMTP_AUTH'].
82
			'<br /><strong>'.$MESSAGE['GENERIC_FILL_IN_ALL'].'</strong>', $js_back);
83
	}
84

    
85
}
86

    
87
// Work-out file mode
88
if($advanced == '')
89
{
90
	$file_mode = STRING_FILE_MODE;
91
	$dir_mode = STRING_DIR_MODE;
92
	// Check if should be set to 777 or left alone
93
//	if(isset($_POST['world_writeable']) && $_POST['world_writeable'] == 'true')
94
//    {
95
//		$file_mode = '0777';
96
//		$dir_mode = '0777';
97
//	} else {
98
//		$file_mode = STRING_FILE_MODE;
99
//		$dir_mode = STRING_DIR_MODE;
100
//	}
101
} else {
102
	$file_mode = STRING_FILE_MODE;
103
	$dir_mode = STRING_DIR_MODE;
104
	if($admin->get_user_id()=='1')
105
	{
106
		// Work-out the octal value for file mode
107
		$u = 0;
108
		if(isset($_POST['file_u_r']) && $_POST['file_u_r'] == 'true') {
109
			$u = $u+4;
110
		}
111
		if(isset($_POST['file_u_w']) && $_POST['file_u_w'] == 'true') {
112
			$u = $u+2;
113
		}
114
		if(isset($_POST['file_u_e']) && $_POST['file_u_e'] == 'true') {
115
			$u = $u+1;
116
		}
117
		$g = 0;
118
		if(isset($_POST['file_g_r']) && $_POST['file_g_r'] == 'true') {
119
			$g = $g+4;
120
		}
121
		if(isset($_POST['file_g_w']) && $_POST['file_g_w'] == 'true') {
122
			$g = $g+2;
123
		}
124
		if(isset($_POST['file_g_e']) && $_POST['file_g_e'] == 'true') {
125
			$g = $g+1;
126
		}
127
		$o = 0;
128
		if(isset($_POST['file_o_r']) && $_POST['file_o_r'] == 'true') {
129
			$o = $o+4;
130
		}
131
		if(isset($_POST['file_o_w']) && $_POST['file_o_w'] == 'true') {
132
			$o = $o+2;
133
		}
134
		if(isset($_POST['file_o_e']) && $_POST['file_o_e'] == 'true') {
135
			$o = $o+1;
136
		}
137
		$file_mode = "0".$u.$g.$o;
138
		// Work-out the octal value for dir mode
139
		$u = 0;
140
		if(isset($_POST['dir_u_r']) && $_POST['dir_u_r'] == 'true') {
141
			$u = $u+4;
142
		}
143
		if(isset($_POST['dir_u_w']) && $_POST['dir_u_w'] == 'true') {
144
			$u = $u+2;
145
		}
146
		if(isset($_POST['dir_u_e']) && $_POST['dir_u_e'] == 'true') {
147
			$u = $u+1;
148
		}
149
		$g = 0;
150
		if(isset($_POST['dir_g_r']) && $_POST['dir_g_r'] == 'true') {
151
			$g = $g+4;
152
		}
153
		if(isset($_POST['dir_g_w']) && $_POST['dir_g_w'] == 'true') {
154
			$g = $g+2;
155
		}
156
		if(isset($_POST['dir_g_e']) && $_POST['dir_g_e'] == 'true') {
157
			$g = $g+1;
158
		}
159
		$o = 0;
160
		if(isset($_POST['dir_o_r']) && $_POST['dir_o_r'] == 'true') {
161
			$o = $o+4;
162
		}
163
		if(isset($_POST['dir_o_w']) && $_POST['dir_o_w'] == 'true') {
164
			$o = $o+2;
165
		}
166
		if(isset($_POST['dir_o_e']) && $_POST['dir_o_e'] == 'true') {
167
			$o = $o+1;
168
		}
169
		$dir_mode = "0".$u.$g.$o;
170
	}
171
}
172

    
173
$allow_tags_in_fields = array(
174
    'website_header',
175
    'website_footer',
176
    'wbmail_signature'
177
    );
178
$allow_empty_values = array(
179
    'website_header',
180
    'website_footer',
181
    'wbmail_signature',
182
    'wysiwyg_style',
183
    'pages_directory',
184
    'page_icon_dir',
185
    'rename_files_on_upload',
186
    'page_spacer',
187
    'page_icon_dir',
188
    );
189
$disallow_in_fields = array(
190
    'pages_directory',
191
    'media_directory',
192
    'wb_version'
193
    );
194
$StripCodeFromInput = array(
195
    'website_title',
196
    'website_description',
197
    'website_keywords',
198
    'wbmail_signature',
199
    'wysiwyg_style',
200
    'pages_directory',
201
    'page_icon_dir',
202
    'media_directory',
203
    'page_extension',
204
    'rename_files_on_upload',
205
    'page_spacer',
206
    'page_icon_dir',
207
    );
208

    
209
// Query current settings in the db, then loop through them and update the db with the new value
210
$settings = array();
211
$old_settings = array();
212
// Query current settings in the db, then loop through them to get old values
213
$sql  = 'SELECT `name`, `value` FROM `'.TABLE_PREFIX.'settings`';
214
$sql .= 'ORDER BY `name`';
215

    
216
if($res_settings = $database->query($sql)) {
217
	$passed = false;
218
	while($setting = $res_settings->fetchRow(MYSQL_ASSOC))
219
	{
220
		$setting_name = $setting['name'];
221
		$old_settings[$setting_name] = $setting['value'];
222
		$value = $admin->get_post($setting_name);
223
		$value = isset($_POST[$setting_name]) ? $value : $old_settings[$setting_name] ;
224
		switch ($setting_name) {
225
			case 'default_timezone':
226
		    	$value = (is_numeric($value) ? $value : 0);
227
		    	$value = ( ($value >= -12 && $value <= 13) ? $value :0 ) * 3600;
228
				$passed = true;
229
				break;
230
			case 'string_dir_mode':
231
				$value=$dir_mode;
232
				$passed = true;
233
				break;
234
			case 'string_file_mode':
235
				$value=$file_mode;
236
	 			$passed = true;
237
    			break;
238
			case 'sec_anchor':
239
                $value = $admin->StripCodeFromText($value);
240
				$value=(($value=='') ? 'section_' : $value);
241
	 			$passed = true;
242
				break;
243
			case 'media_directory':
244
				$value = ( (strpos($value,'/',0)===false) && ($value!= '') ) ? '/'.$value : rtrim($value,'/'); 
245
	 			$passed = true;
246
				break;
247
			case 'pages_directory':
248
				if( ($database->get_one('SELECT COUNT(*) FROM `'.TABLE_PREFIX.'pages`'))==0 ) {
249
					$value = rtrim($admin->StripCodeFromText($value));
250
					$passed = true;
251
				} else {
252
					$value = rtrim($old_settings[$setting_name]);
253
				}
254
				$value = ( (strpos($value,'/',0)===false) && ($value != '')  ? '/'.$value : rtrim($value,'/') ); 
255
				break;
256
			case 'wbmailer_smtp_auth':
257
				$value = true ;
258
	 			$passed = true;
259
				break;
260
			default :
261
                $passed = in_array($setting_name, $allow_empty_values);
262
                if(in_array($setting_name, $StripCodeFromInput) ) {
263
                    $value = $admin->StripCodeFromText($value);
264
                }
265
				break;
266
		}
267

    
268
	    if (!in_array($setting_name, $allow_tags_in_fields))
269
	    {
270
	        $value = strip_tags($value);
271
	    }
272

    
273
	    if ( !in_array($value, $disallow_in_fields) && (isset($_POST[$setting_name]) || $passed == true) )
274
	    {
275
	        $value = trim($admin->add_slashes($value));
276
	        $sql = 'UPDATE `'.TABLE_PREFIX.'settings` ';
277
	        $sql .= 'SET `value` = \''.($value).'\' '; // mysql_escape_string
278
	        $sql .= 'WHERE `name` != \'wb_version\' ';
279
	        $sql .= 'AND `name` = \''.$setting_name.'\' ';
280
	        if (!$database->query($sql))
281
	        {
282
				if($database->is_error()) {
283
					$admin->print_error($database->get_error, $js_back );
284
				}
285
	        }
286
		}
287
	}
288

    
289
}
290
/**
291
 * now save search settings
292
 */
293
$StripCodeFromISearch = array(
294
    'search_header',
295
    'search_results_header',
296
    'search_results_loop',
297
    'search_results_footer',
298
    'search_footer',
299
    'search_module_order',
300
    'search_max_excerpt',
301
    'search_no_results',
302
    'search_time_limit',
303
    'search_max_excerpt',
304
    );
305
$allow_empty_values = array(
306
    'header',
307
    'results_header',
308
    'results_loop',
309
    'results_footer',
310
    'footer',
311
    'module_order',
312
    'no_results',
313
    );
314
$allow_tags_in_fields = array(
315
    'header',
316
    'results_header',
317
    'results_loop',
318
    'results_footer',
319
    'no_results',
320
    'footer',
321
    );
322

    
323
// Query current search settings in the db, then loop through them and update the db with the new value
324
$sql  = 'SELECT `name`, `value` FROM `'.TABLE_PREFIX.'search` ';
325
$sql .= 'WHERE `extra` =  \'\' ';
326
if( !($oSearch = $database->query($sql)) ) {
327
    if($database->is_error()) {
328
    	$admin->print_error(explode(';',$database->get_error()), $js_back );
329
    }
330
}
331

    
332
while($aSearch = $oSearch->fetchRow(MYSQL_ASSOC))
333
{
334
	$passed = false;
335
	$old_value = $aSearch['value'];
336
	$sSearchName = $aSearch['name'];
337
	$sPostName = 'search_'.$sSearchName;
338

    
339
    $value = $admin->get_post($sPostName);
340
    $value = isset($value) ?  $value : $old_value;
341
    if(in_array($sPostName, $StripCodeFromISearch) ) {
342
        $value = $admin->StripCodeFromText($value);
343
    }
344

    
345
/**
346
 *  hold old value if post is empty
347
 *  check search template
348
 */
349
	switch ($sSearchName) {
350
		case 'template':
351
 			$passed = true;
352
            $value =  ( !($admin->get_post($sPostName)) || ($value == DEFAULT_TEMPLATE ) ) ? '' : $admin->get_post($sPostName);
353
			break;
354
		case 'max_excerpt':
355
 			$passed = true;
356
        	if(preg_match('/[^0-9]+/i', $value)) {
357
                $value = $old_value;
358
        	}
359
			break;
360
		case 'time_limit':
361
            $passed = true;
362
        	if(preg_match('/[^0-9]+/i', $value)) {
363
                $value = $old_value;
364
        	}
365
			break;
366
		default :
367
        	$passed = ($admin->get_post($sPostName) || in_array($sSearchName, $allow_empty_values));
368

    
369
            if (!in_array($sSearchName, $allow_tags_in_fields))
370
            {
371
                $value = strip_tags($value);
372
            }
373
			break;
374
	}
375

    
376
    if ( ($passed == true) )
377
	{
378
		$value = $admin->add_slashes($value);
379
        $sql  = 'UPDATE `'.TABLE_PREFIX.'search` ';
380
        $sql .= 'SET `value` = \''.$value.'\' ';
381
        $sql .= 'WHERE `name` = \''.$sSearchName.'\' ';
382
        $sql .= 'AND `extra` = \'\' ';
383
		if($database->query($sql)) {
384

    
385
		}
386
		$sql_info = mysql_info($database->db_handle);
387
    }
388
}
389

    
390
// Check if there was an error updating the db
391
if($database->is_error()) {
392
	$admin->print_error($database->get_error, $js_back );
393
} else {
394
	$admin->print_success($MESSAGE['SETTINGS_SAVED'], $js_back );
395
}
396
$admin->print_footer();
(3-3/4)