Project

General

Profile

« Previous | Next » 

Revision 1914

Added by Dietmar over 11 years ago

! /admin/pages/ add/change to new Translate class
add a default.ini with a list of protected basenames,
and a PagesEnvironment to force writing the accessfile forever

View differences:

add.php
4 4
 * @category        admin
5 5
 * @package         pages
6 6
 * @author          Ryan Djurovich, WebsiteBaker Project
7
 * @copyright       2009-2012, WebsiteBaker Org. e.V.
8
 * @link			http://www.websitebaker2.org/
7
 * @copyright       2009-2013, WebsiteBaker Org. e.V.
8
 * @link            http://www.websitebaker.org/
9 9
 * @license         http://www.gnu.org/licenses/gpl.html
10 10
 * @platform        WebsiteBaker 2.8.x
11 11
 * @requirements    PHP 5.2.2 and higher
12 12
 * @version         $Id$
13
 * @filesource		$HeadURL$
13
 * @filesource      $HeadURL$
14 14
 * @lastmodified    $Date$
15 15
 *
16 16
 */
17 17

  
18
// Create new admin object and print admin header
19
//require('../../config.php');
20
//require_once(WB_PATH.'/framework/class.admin.php');
21
// Create new admin object and print admin header
22 18
if(!defined('WB_URL'))
23 19
{
24 20
    $config_file = realpath('../../config.php');
......
27 23
    	require($config_file);
28 24
    }
29 25
}
26
// Create new admin object and print admin header
30 27
if(!class_exists('admin', false)){ include(WB_PATH.'/framework/class.admin.php'); }
28
$mLang = Translate::getinstance();
29
$mLang->enableAddon('admin\pages');
30

  
31 31
// suppress to print the header, so no new FTAN will be set
32 32
$admin = new admin('Pages', 'pages_add', false);
33 33
if (!$admin->checkFTAN())
34 34
{
35 35
	$admin->print_header();
36
	$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS']);
36
	$admin->print_error($mLang->MESSAGE_GENERIC_SECURITY_ACCESS);
37 37
}
38 38

  
39 39
// Include the WB functions file
40 40
require_once(WB_PATH.'/framework/functions.php');
41 41

  
42 42
// Get values
43
//$title = $admin->get_post_escaped('title');
44
//$title = htmlspecialchars($title);
45
$title = str_replace(array("[[", "]]"), '', htmlspecialchars($admin->get_post_escaped('title')));
43
//$title = str_replace(array("[[", "]]"), '', htmlspecialchars($admin->get_post_escaped('title')));
44
$title = ($admin->StripCodeFromText($admin->get_post('title')));
46 45
$module = preg_replace('/[^a-z0-9_-]/i', "", $admin->get_post('type')); // fix secunia 2010-93-4
47 46
$parent = intval($admin->get_post('parent')); // fix secunia 2010-91-2
48 47
$visibility = $admin->get_post('visibility');
......
63 62
if ($parent!=0) {
64 63
	if (!$admin->get_page_permission($parent,'admin'))
65 64
    {
66
        $admin->print_error($MESSAGE['PAGES_INSUFFICIENT_PERMISSIONS']);
65
        $admin->print_error($mLang->MESSAGE_PAGES_INSUFFICIENT_PERMISSIONS);
67 66
    }
68 67

  
69 68
} elseif (!$admin->get_permission('pages_add_l0','system'))
70 69
{
71
	$admin->print_error($MESSAGE['PAGES_INSUFFICIENT_PERMISSIONS']);
70
	$admin->print_error($mLang->MESSAGE_PAGES_INSUFFICIENT_PERMISSIONS);
72 71
}
73 72

  
74 73
// check module permissions:
75 74
if (!$admin->get_permission($module, 'module'))
76 75
{
77
	$admin->print_error($MESSAGE['PAGES_INSUFFICIENT_PERMISSIONS']);
76
	$admin->print_error($mLang->MESSAGE_PAGES_INSUFFICIENT_PERMISSIONS);
78 77
}
79 78

  
80 79
// Validate data
81 80
if($title == '' || substr($title,0,1)=='.')
82 81
{
83
	$admin->print_error($title.'::'.$MESSAGE['PAGES_BLANK_PAGE_TITLE']);
82
	$admin->print_error($title.'::'.$mLang->MESSAGE_PAGES_BLANK_PAGE_TITLE);
84 83
}
85 84

  
86 85
// Check to see if page created has needed permissions
......
96 95
	}
97 96
	if ($admin_perm_ok == false)
98 97
    {
99
		$admin->print_error($MESSAGE['PAGES_INSUFFICIENT_PERMISSIONS']);
98
		$admin->print_error($mLang->MESSAGE_PAGES_INSUFFICIENT_PERMISSIONS);
100 99
	}
101 100
	$admin_perm_ok = false;
102 101
	foreach ($viewing_groups as $view_group)
......
108 107
	}
109 108
	if ($admin_perm_ok == false)
110 109
    {
111
		$admin->print_error($MESSAGE['PAGES_INSUFFICIENT_PERMISSIONS']);
110
		$admin->print_error($mLang->MESSAGE_PAGES_INSUFFICIENT_PERMISSIONS);
112 111
	}
113 112
}
114 113

  
115 114
$admin_groups = implode(',', $admin_groups);
116 115
$viewing_groups = implode(',', $viewing_groups);
117 116

  
117
// preparing root_check to protect system directories and important files from being overwritten if PAGES_DIR = '/'
118
$denied = false;
119
$forbidden  = array();
120
$aTempIniList  = array();
121
$aTempIniList = parse_ini_file(dirname(__FILE__).'/default.ini',true);
122
$bAccessFileOverwrite = $aTempIniList['PagesEnvironment']['AccessFileOverwrite'];
123
$aTempIniList['ProtectedNames']['List'][] = (defined('ADMIN_DIRECTORY') ? trim(ADMIN_DIRECTORY,'/') : 'admin');
124
$aTempIniList['ProtectedNames']['List'][] = (defined('MEDIA_DIRECTORY') ? trim(MEDIA_DIRECTORY,'/') : 'media');
125
$aTempIniList['ProtectedNames']['List'][] = (defined('PAGES_DIRECTORY') ? trim(PAGES_DIRECTORY,'/') : 'pages');
126
$forbidden = $aTempIniList['ProtectedNames'];
127

  
128
$link = '/'.page_filename($title);
118 129
// Work-out what the link and page filename should be
119 130
if($parent == '0')
120 131
{
121
	$link = '/'.page_filename($title);
122 132
	// rename menu titles: index && intro to prevent clashes with intro page feature and WB core file /pages/index.php
123
	if($link == '/index' || $link == '/intro')
124
    {
125
		$sTmpFile = WB_PATH .PAGES_DIRECTORY .$link.PAGE_EXTENSION;
126
		$link .= (file_exists($sTmpFile)) ? '_0' : '';
127
		$filename = WB_PATH .PAGES_DIRECTORY .$link .PAGE_EXTENSION;
128
	} else {
129
		$filename = WB_PATH.PAGES_DIRECTORY.$link.PAGE_EXTENSION;
133
	if( defined('PAGES_DIRECTORY') && trim(PAGES_DIRECTORY,'/')=='' ) {
134
// Work-out what the link should be
135
		$denied = in_array(trim($link,'/'), $forbidden['List']);
136
		if( $denied )
137
		{
138
//			$link .= '_'.$iNextPageId;
139
			$admin->print_error($mLang->MESSAGE_PAGES_CANNOT_CREATE_PROTECTED_FILE);
140
		}
130 141
	}
142
	$filename = WB_PATH.PAGES_DIRECTORY.$link.PAGE_EXTENSION;
131 143

  
132 144
} else {
133 145
	$parent_section = '';
......
143 155
}
144 156

  
145 157
// Check if a page with same page filename exists
146
$get_same_page = $database->query("SELECT page_id FROM ".TABLE_PREFIX."pages WHERE link = '$link'");
147
if($get_same_page->numRows() > 0 OR file_exists(WB_PATH.PAGES_DIRECTORY.$link.PAGE_EXTENSION) OR file_exists(WB_PATH.PAGES_DIRECTORY.$link.'/'))
148
{
158
//$get_same_page = $database->query("SELECT page_id FROM ".TABLE_PREFIX."pages WHERE link = '$link'");
159
//if($get_same_page->numRows() > 0 OR file_exists(WB_PATH.PAGES_DIRECTORY.$link.PAGE_EXTENSION) OR file_exists(WB_PATH.PAGES_DIRECTORY.$link.'/'))
160
//{
161
//	$admin->print_error($MESSAGE['PAGES_PAGE_EXISTS']);
162
//}
163
$bLinkExists = file_exists(WB_PATH.PAGES_DIRECTORY.$link.PAGE_EXTENSION) || file_exists(WB_PATH.PAGES_DIRECTORY.$link);
164

  
165
// UNLOCK TABLES
166
$sql = 'SELECT COUNT(*) FROM `'.TABLE_PREFIX.'pages` '
167
     . 'WHERE `link` = \''.$link.'\' ';
168
if( (($iSamePages = intval($database->get_one($sql))) > 0) || $bLinkExists ){
149 169
	$admin->print_error($MESSAGE['PAGES_PAGE_EXISTS']);
150 170
}
151 171

  
......
170 190
}
171 191

  
172 192
// Insert page into pages table
173
$sql  = 'INSERT INTO `'.TABLE_PREFIX.'pages` SET ';
174
$sql .= '`parent` = '.$parent.', ';
193
$sql  = 'INSERT INTO `'.TABLE_PREFIX.'pages` ';
194
$sql .= 'SET `parent` = '.$parent.', ';
175 195
$sql .= '`target` = "_top", ';
176 196
$sql .= '`page_title` = "'.$title.'", ';
177 197
$sql .= '`menu_title` = "'.$title.'", ';
......
187 207
$sql .= '`admin_groups` = "'.$admin_groups.'", ';
188 208
$sql .= '`viewing_groups` = "'.$viewing_groups.'"';
189 209

  
190
$database->query($sql);
191

  
192
if($database->is_error())
193
{
194
	$admin->print_error($database->get_error());
210
if(!$database->query($sql)) {
211
	if($database->is_error())
212
	{
213
		$admin->print_error($database->get_error());
214
	}
195 215
}
196 216

  
197 217
// Get the page id
198
$page_id = $database->get_one("SELECT LAST_INSERT_ID()");
199

  
218
//$page_id = $database->get_one("SELECT LAST_INSERT_ID()");
219
$page_id = $database->LastInsertId;
200 220
// Work out level
201 221
$level = level_count($page_id);
202 222
// Work out root parent
......
204 224
// Work out page trail
205 225
$page_trail = get_page_trail($page_id);
206 226

  
227
/*
228
$database->query("UPDATE ".TABLE_PREFIX."pages SET link = '$link', level = '$level', root_parent = '$root_parent', page_trail = '$page_trail' WHERE page_id = '$page_id'");
229
*/
207 230
// Update page with new level and link
208 231
$sql  = 'UPDATE `'.TABLE_PREFIX.'pages` SET ';
209 232
$sql .= '`root_parent` = '.$root_parent.', ';
210 233
$sql .= '`level` = '.$level.', ';
211
$sql .= '`link` = "'.$link.'", ';
212
$sql .= '`page_trail` = "'.$page_trail.'"';
213
$sql .= ((defined('PAGE_LANGUAGES') && PAGE_LANGUAGES)
214
         && $field_set
215
         && ($language == DEFAULT_LANGUAGE)
216
         && class_exists('m_MultiLingual_Lib')
217
         ? ', `page_code` = '.(int)$page_id.' ' : ' ');
234
$sql .= '`link` = \''.$link.'\', ';
235
$sql .= '`page_trail` = \''.$page_trail.'\'';
236
$sql .= ((defined('PAGE_LANGUAGES') && PAGE_LANGUAGES) && $field_set && ($language == DEFAULT_LANGUAGE)
237
                                    && class_exists('m_MultiLingual_Lib') ? ', `page_code` = '.(int)$page_id.' ' : ' ');
218 238
$sql .= 'WHERE `page_id` = '.$page_id;
219 239
$database->query($sql);
220
/*
221
$database->query("UPDATE ".TABLE_PREFIX."pages SET link = '$link', level = '$level', root_parent = '$root_parent', page_trail = '$page_trail' WHERE page_id = '$page_id'");
222
*/
223 240
if($database->is_error())
224 241
{
225 242
	$admin->print_error($database->get_error());
......
230 247

  
231 248
// Add new record into the sections table
232 249
// Insert module into DB
233
$sql  = 'INSERT INTO `'.TABLE_PREFIX.'sections` SET ';
234
$sql .= '`page_id` = '.(int)$page_id.', ';
250
$sql  = 'INSERT INTO `'.TABLE_PREFIX.'sections` ';
251
$sql .= 'SET `page_id` = '.(int)$page_id.', ';
235 252
$sql .= '`module` = \''.$module.'\', ';
236 253
$sql .= '`position` = '.(int)$position.', ';
237 254
$sql .= '`block` = \'1\', ';
......
251 268
create_access_file($filename, $page_id, $level);
252 269

  
253 270
if(!file_exists($filename)) {
254
	$admin->print_error($MESSAGE['PAGES_CANNOT_CREATE_ACCESS_FILE']);
271
	$admin->print_error($mLang->MESSAGE_PAGES_CANNOT_CREATE_ACCESS_FILE);
255 272
}
256 273

  
257 274
// Check if there is a db error, otherwise say successful
258 275
if($database->is_error()) {
259 276
	$admin->print_error($database->get_error().' (sections)');
260 277
} else {
261
	$admin->print_success($MESSAGE['PAGES_ADDED'], ADMIN_URL.'/pages/modify.php?page_id='.$page_id);
278
	$admin->print_success($mLang->MESSAGE_PAGES_ADDED, ADMIN_URL.'/pages/modify.php?page_id='.$page_id);
262 279
}
263 280

  
281
$mLang->disableAddon();
264 282
// Print admin footer
265 283
$admin->print_footer();

Also available in: Unified diff