Project

General

Profile

« Previous | Next » 

Revision 40

Added by stefan about 19 years ago

Change addslashes,stripslashes to (wb class) method calls add_slashes,strip_slashes

View differences:

save.php
1 1
<?php
2 2

  
3
// $Id: save.php,v 1.15 2005/04/25 11:53:12 rdjurovich Exp $
3
// $Id$
4 4

  
5 5
/*
6 6

  
......
106 106
	return $default_dir_mode;
107 107
}
108 108

  
109
require_once('../framework/class.wb.php');
110

  
109 111
// Begin check to see if form was even submitted
110
	// Set error if no post vars found
111
	if(!isset($_POST['website_title'])) {
112
		set_error('Please fill-in the form below');
113
	}
112
// Set error if no post vars found
113
if(!isset($_POST['website_title'])) {
114
	set_error('Please fill-in the form below');
115
}
114 116
// End check to see if form was even submitted
115 117

  
116 118
// Begin path and timezone details code
117
	// Check if user has entered the installation path
118
	if(!isset($_POST['wb_path']) OR $_POST['wb_path'] == '') {
119
		set_error('Please enter an absolute path');
120
	} else {
121
		$wb_path = $_POST['wb_path'];
122
	}
123
	// Check if user has entered the installation url
124
	if(!isset($_POST['wb_url']) OR $_POST['wb_url'] == '') {
125
		set_error('Please enter an absolute URL');
126
	} else {
127
		$wb_url = $_POST['wb_url'];
128
	}
129
	// Remove any slashes at the end of the URL and path
130
	if(substr($wb_url, strlen($wb_url)-1, 1) == "/") {
131
		$wb_url = substr($wb_url, 0, strlen($wb_url)-1);
132
	}
133
	if(substr($wb_path, strlen($wb_path)-1, 1) == "/") {
134
		$wb_path = substr($wb_path, 0, strlen($wb_path)-1);
135
	}
136
	if(substr($wb_url, strlen($wb_url)-1, 1) == "\\") {
137
		$wb_url = substr($wb_url, 0, strlen($wb_url)-1);
138
	}
139
	if(substr($wb_path, strlen($wb_path)-1, 1) == "\\") {
140
		$wb_path = substr($wb_path, 0, strlen($wb_path)-1);
141
	}
142
	if(substr($wb_url, strlen($wb_url)-1, 1) == "/") {
143
		$wb_url = substr($wb_url, 0, strlen($wb_url)-1);
144
	}
145
	if(substr($wb_path, strlen($wb_path)-1, 1) == "/") {
146
		$wb_path = substr($wb_path, 0, strlen($wb_path)-1);
147
	}
148
	if(substr($wb_url, strlen($wb_url)-1, 1) == "\\") {
149
		$wb_url = substr($wb_url, 0, strlen($wb_url)-1);
150
	}
151
	if(substr($wb_path, strlen($wb_path)-1, 1) == "\\") {
152
		$wb_path = substr($wb_path, 0, strlen($wb_path)-1);
153
	}
154
	// Get the default time zone
155
	if(!isset($_POST['default_timezone']) OR !is_numeric($_POST['default_timezone'])) {
156
		set_error('Please select a valid default timezone');
157
	} else {
158
		$default_timezone = $_POST['default_timezone']*60*60;
159
	}
119
// Check if user has entered the installation path
120
if(!isset($_POST['wb_path']) OR $_POST['wb_path'] == '') {
121
	set_error('Please enter an absolute path');
122
} else {
123
	$wb_path = $_POST['wb_path'];
124
}
125
// Check if user has entered the installation url
126
if(!isset($_POST['wb_url']) OR $_POST['wb_url'] == '') {
127
	set_error('Please enter an absolute URL');
128
} else {
129
	$wb_url = $_POST['wb_url'];
130
}
131
// Remove any slashes at the end of the URL and path
132
if(substr($wb_url, strlen($wb_url)-1, 1) == "/") {
133
	$wb_url = substr($wb_url, 0, strlen($wb_url)-1);
134
}
135
if(substr($wb_path, strlen($wb_path)-1, 1) == "/") {
136
	$wb_path = substr($wb_path, 0, strlen($wb_path)-1);
137
}
138
if(substr($wb_url, strlen($wb_url)-1, 1) == "\\") {
139
	$wb_url = substr($wb_url, 0, strlen($wb_url)-1);
140
}
141
if(substr($wb_path, strlen($wb_path)-1, 1) == "\\") {
142
	$wb_path = substr($wb_path, 0, strlen($wb_path)-1);
143
}
144
if(substr($wb_url, strlen($wb_url)-1, 1) == "/") {
145
	$wb_url = substr($wb_url, 0, strlen($wb_url)-1);
146
}
147
if(substr($wb_path, strlen($wb_path)-1, 1) == "/") {
148
	$wb_path = substr($wb_path, 0, strlen($wb_path)-1);
149
}
150
if(substr($wb_url, strlen($wb_url)-1, 1) == "\\") {
151
	$wb_url = substr($wb_url, 0, strlen($wb_url)-1);
152
}
153
if(substr($wb_path, strlen($wb_path)-1, 1) == "\\") {
154
	$wb_path = substr($wb_path, 0, strlen($wb_path)-1);
155
}
156
// Get the default time zone
157
if(!isset($_POST['default_timezone']) OR !is_numeric($_POST['default_timezone'])) {
158
	set_error('Please select a valid default timezone');
159
} else {
160
	$default_timezone = $_POST['default_timezone']*60*60;
161
}
160 162
// End path and timezone details code
161 163

  
162 164
// Begin operating system specific code
163
	// Get operating system
164
	if(!isset($_POST['operating_system']) OR $_POST['operating_system'] != 'linux' AND $_POST['operating_system'] != 'windows') {
165
		set_error('Please select a valid operating system');
166
	} else {
167
		$operating_system = $_POST['operating_system'];
168
	}
169
	// Work-out file permissions
170
	if($operating_system == 'windows') {
171
		$file_mode = '0777';
172
		$dir_mode = '0777';
173
	} elseif(isset($_POST['world_writeable']) AND $_POST['world_writeable'] == 'true') {
174
		$file_mode = '0777';
175
		$dir_mode = '0777';
176
	} else {
177
		$file_mode = default_file_mode('../temp');
178
		$dir_mode = default_dir_mode('../temp');
179
	}
165
// Get operating system
166
if(!isset($_POST['operating_system']) OR $_POST['operating_system'] != 'linux' AND $_POST['operating_system'] != 'windows') {
167
	set_error('Please select a valid operating system');
168
} else {
169
	$operating_system = $_POST['operating_system'];
170
}
171
// Work-out file permissions
172
if($operating_system == 'windows') {
173
	$file_mode = '0777';
174
	$dir_mode = '0777';
175
} elseif(isset($_POST['world_writeable']) AND $_POST['world_writeable'] == 'true') {
176
	$file_mode = '0777';
177
	$dir_mode = '0777';
178
} else {
179
	$file_mode = default_file_mode('../temp');
180
	$dir_mode = default_dir_mode('../temp');
181
}
180 182
// End operating system specific code
181 183

  
182 184
// Begin database details code
183
	// Check if user has entered a database host
184
	if(!isset($_POST['database_host']) OR $_POST['database_host'] == '') {
185
		set_error('Please enter a database host name');
186
	} else {
187
		$database_host = $_POST['database_host'];
188
	}
189
	// Check if user has entered a database username
190
	if(!isset($_POST['database_username']) OR $_POST['database_username'] == '') {
191
		set_error('Please enter a database username');
192
	} else {
193
		$database_username = $_POST['database_username'];
194
	}
195
	// Check if user has entered a database password
196
	if(!isset($_POST['database_password'])) {
197
		set_error('Please enter a database password');
198
	} else {
199
		$database_password = $_POST['database_password'];
200
	}
201
	// Check if user has entered a database name
202
	if(!isset($_POST['database_name']) OR $_POST['database_name'] == '') {
203
		set_error('Please enter a database name');
204
	} else {
205
		$database_name = $_POST['database_name'];
206
	}
207
	// Get table prefix
208
	$table_prefix = $_POST['table_prefix'];
209
	// Find out if the user wants to install tables and data
210
	if(isset($_POST['install_tables']) AND $_POST['install_tables'] == 'true') {
211
		$install_tables = true;
212
	} else {
213
		$install_tables = false;
214
	}
185
// Check if user has entered a database host
186
if(!isset($_POST['database_host']) OR $_POST['database_host'] == '') {
187
	set_error('Please enter a database host name');
188
} else {
189
	$database_host = $_POST['database_host'];
190
}
191
// Check if user has entered a database username
192
if(!isset($_POST['database_username']) OR $_POST['database_username'] == '') {
193
	set_error('Please enter a database username');
194
} else {
195
	$database_username = $_POST['database_username'];
196
}
197
// Check if user has entered a database password
198
if(!isset($_POST['database_password'])) {
199
	set_error('Please enter a database password');
200
} else {
201
	$database_password = $_POST['database_password'];
202
}
203
// Check if user has entered a database name
204
if(!isset($_POST['database_name']) OR $_POST['database_name'] == '') {
205
	set_error('Please enter a database name');
206
} else {
207
	$database_name = $_POST['database_name'];
208
}
209
// Get table prefix
210
$table_prefix = $_POST['table_prefix'];
211
// Find out if the user wants to install tables and data
212
if(isset($_POST['install_tables']) AND $_POST['install_tables'] == 'true') {
213
	$install_tables = true;
214
} else {
215
	$install_tables = false;
216
}
215 217
// End database details code
216 218

  
217 219
// Begin website title code
218
	// Get website title
219
	if(!isset($_POST['website_title']) OR $_POST['website_title'] == '') {
220
		set_error('Please enter a website title');
221
	} else {
222
		$website_title = addslashes($_POST['website_title']);
223
	}
220
// Get website title
221
if(!isset($_POST['website_title']) OR $_POST['website_title'] == '') {
222
	set_error('Please enter a website title');
223
} else {
224
	$website_title = wb::addslashes($_POST['website_title']);
225
}
224 226
// End website title code
225 227

  
226 228
// Begin admin user details code
227
	// Get admin username
228
	if(!isset($_POST['admin_username']) OR $_POST['admin_username'] == '') {
229
		set_error('Please enter a username for the Administrator account');
229
// Get admin username
230
if(!isset($_POST['admin_username']) OR $_POST['admin_username'] == '') {
231
	set_error('Please enter a username for the Administrator account');
232
} else {
233
	$admin_username = $_POST['admin_username'];
234
}
235
// Get admin email and validate it
236
if(!isset($_POST['admin_email']) OR $_POST['admin_email'] == '') {
237
	set_error('Please enter an email for the Administrator account');
238
} else {
239
	if(eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$", $_POST['admin_email'])) {
240
		$admin_email = $_POST['admin_email'];
230 241
	} else {
231
		$admin_username = $_POST['admin_username'];
242
		set_error('Please enter a valid email address for the Administrator account');
232 243
	}
233
	// Get admin email and validate it
234
	if(!isset($_POST['admin_email']) OR $_POST['admin_email'] == '') {
235
		set_error('Please enter an email for the Administrator account');
236
	} else {
237
		if(eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$", $_POST['admin_email'])) {
238
			$admin_email = $_POST['admin_email'];
239
		} else {
240
			set_error('Please enter a valid email address for the Administrator account');
241
		}
242
	}
243
	// Get the two admin passwords entered, and check that they match
244
	if(!isset($_POST['admin_password']) OR $_POST['admin_password'] == '') {
245
		set_error('Please enter a password for the Administrator account');
246
	} else {
247
		$admin_password = $_POST['admin_password'];
248
	}
249
	if(!isset($_POST['admin_repassword']) OR $_POST['admin_repassword'] == '') {
250
		set_error('Please make sure you re-enter the password for the Administrator account');
251
	} else {
252
		$admin_repassword = $_POST['admin_repassword'];
253
	}
254
	if($admin_password != $admin_repassword) {
255
		set_error('Sorry, the two Administrator account passwords you entered do not match');
256
	}
244
}
245
// Get the two admin passwords entered, and check that they match
246
if(!isset($_POST['admin_password']) OR $_POST['admin_password'] == '') {
247
	set_error('Please enter a password for the Administrator account');
248
} else {
249
	$admin_password = $_POST['admin_password'];
250
}
251
if(!isset($_POST['admin_repassword']) OR $_POST['admin_repassword'] == '') {
252
	set_error('Please make sure you re-enter the password for the Administrator account');
253
} else {
254
	$admin_repassword = $_POST['admin_repassword'];
255
}
256
if($admin_password != $admin_repassword) {
257
	set_error('Sorry, the two Administrator account passwords you entered do not match');
258
}
257 259
// End admin user details code
258 260

  
259 261
// Try and write settings to config file
......
362 364
mysql_close();
363 365

  
364 366
// Re-connect to the database, this time using in-build database class
365
require(WB_PATH.'/framework/class.admin.php');
367
require_once(WB_PATH.'/framework/class.admin.php');
366 368
$database = new database();
367 369

  
368 370
// Check if we should install tables
......
498 500
	$insert_website_footer = "INSERT INTO `".TABLE_PREFIX."settings` VALUES ('', 'footer', '')";
499 501
	$database->query($insert_website_footer);
500 502
	// Search header
501
	$search_header = addslashes('
503
	$search_header = wb::addslashes('
502 504
<h1>Search</h1>
503 505

  
504 506
<form name="search" action="[WB_URL]/search/index[PAGE_EXTENSION]" method="post">
505 507
<table cellpadding="3" cellspacing="0" border="0" width="500">
506 508
<tr>
507 509
<td>
508
	<input type="text" name="string" value="[SEARCH_STRING]" style="width: 100%;" />
510
<input type="text" name="string" value="[SEARCH_STRING]" style="width: 100%;" />
509 511
</td>
510 512
<td width="150">
511
	<input type="submit" value="[TEXT_SEARCH]" style="width: 100%;" />
513
<input type="submit" value="[TEXT_SEARCH]" style="width: 100%;" />
512 514
</td>
513 515
</tr>
514 516
<tr>
515 517
<td colspan="2">
516
	<input type="radio" name="match" id="match_all" value="all"[ALL_CHECKED] />
517
	<a href="javascript: toggle_radio(\'match_all\');">[TEXT_ALL_WORDS]</a>
518
	<input type="radio" name="match" id="match_any" value="any"[ANY_CHECKED] />
519
	<a href="javascript: toggle_radio(\'match_any\');">[TEXT_ANY_WORDS]</a>
520
	<input type="radio" name="match" id="match_exact" value="exact"[EXACT_CHECKED] />
521
	<a href="javascript: toggle_radio(\'match_exact\');">[TEXT_EXACT_MATCH]</a>
518
<input type="radio" name="match" id="match_all" value="all"[ALL_CHECKED] />
519
<a href="javascript: toggle_radio(\'match_all\');">[TEXT_ALL_WORDS]</a>
520
<input type="radio" name="match" id="match_any" value="any"[ANY_CHECKED] />
521
<a href="javascript: toggle_radio(\'match_any\');">[TEXT_ANY_WORDS]</a>
522
<input type="radio" name="match" id="match_exact" value="exact"[EXACT_CHECKED] />
523
<a href="javascript: toggle_radio(\'match_exact\');">[TEXT_EXACT_MATCH]</a>
522 524
</td>
523 525
</tr>
524 526
</table>
......
530 532
	$insert_search_header = "INSERT INTO `".TABLE_PREFIX."search` VALUES ('', 'header', '$search_header', '')";
531 533
	$database->query($insert_search_header);
532 534
	// Search footer
533
	$search_footer = addslashes('');
535
	$search_footer = wb::addslashes('');
534 536
	$insert_search_footer = "INSERT INTO `".TABLE_PREFIX."search` VALUES ('', 'footer', '$search_footer', '')";
535 537
	$database->query($insert_search_footer);
536 538
	// Search results header
537
	$search_results_header = addslashes(''.
539
	$search_results_header = wb::addslashes(''.
538 540
'[TEXT_RESULTS_FOR] \'<b>[SEARCH_STRING]</b>\':
539 541
<table cellpadding="2" cellspacing="0" border="0" width="100%" style="padding-top: 10px;">');
540 542
	$insert_search_results_header = "INSERT INTO `".TABLE_PREFIX."search` VALUES ('', 'results_header', '$search_results_header', '')";
541 543
	$database->query($insert_search_results_header);
542 544
	// Search results loop
543
	$search_results_loop = addslashes(''.
545
	$search_results_loop = wb::addslashes(''.
544 546
'<tr style="background-color: #F0F0F0;">
545 547
<td><a href="[LINK]">[TITLE]</a></td>
546 548
<td align="right">[TEXT_LAST_UPDATED_BY] [DISPLAY_NAME] ([USERNAME]) [TEXT_ON] [DATE]</td>
547 549
</tr>
548 550
<tr><td colspan="2" style="text-align: justify; padding-bottom: 10px;">[DESCRIPTION]</td></tr>');
549
	$insert_search_results_loop = "INSERT INTO `".TABLE_PREFIX."search` VALUES ('', 'results_loop', '$search_results_loop', '')";
550
	$database->query($insert_search_results_loop);
551
	// Search results footer
552
	$search_results_footer = addslashes("</table>");
553
	$insert_search_results_footer = "INSERT INTO `".TABLE_PREFIX."search` VALUES ('', 'results_footer', '$search_results_footer', '')";
554
	$database->query($insert_search_results_footer);
555
	// Search no results
556
	$search_no_results = addslashes('<br />No results found');
551
$insert_search_results_loop = "INSERT INTO `".TABLE_PREFIX."search` VALUES ('', 'results_loop', '$search_results_loop', '')";
552
$database->query($insert_search_results_loop);
553
// Search results footer
554
$search_results_footer = wb::addslashes("</table>");
555
$insert_search_results_footer = "INSERT INTO `".TABLE_PREFIX."search` VALUES ('', 'results_footer', '$search_results_footer', '')";
556
$database->query($insert_search_results_footer);
557
// Search no results
558
$search_no_results = wb::add_slashes('<br />No results found');
557 559
	$insert_search_no_results = "INSERT INTO `".TABLE_PREFIX."search` VALUES ('', 'no_results', '$search_no_results', '')";
558 560
	$database->query($insert_search_no_results);
559 561
	// Search template

Also available in: Unified diff