Project

General

Profile

« Previous | Next » 

Revision 61

Added by stefan about 19 years ago

View differences:

trunk/CHANGELOG
12 12

  
13 13
------------------------------------- 2.6.0 -------------------------------------
14 14
09-Sep-2005 Stefan Braunewell
15
+	Added new advanced setting "Rename Files On Upload". File extensions can be
16
	given so that respective files will have a ".txt" appended on media upload.
15 17
#	Fixed "None found" message bug when user has no top level page edit
16 18
	rights.
17 19
#	Fixed missing parent option 'none' - ticket #12 - and a minor scope bug.
trunk/wb/install/save.php
291 291
"define('HOMEPAGE_REDIRECTION', false);\n".
292 292
"define('PAGE_LANGUAGES', false);\n".
293 293
"\n".
294
"define('WYSIWYG_STYLE', 'font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;');\n".
295
"\n".
296 294
"define('MANAGE_SECTIONS', true);\n".
297 295
"define('SECTION_BLOCKS', false);\n".
298 296
"\n".
......
499 497
	$database->query($insert_website_header);
500 498
	$insert_website_footer = "INSERT INTO `".TABLE_PREFIX."settings` VALUES ('', 'footer', '')";
501 499
	$database->query($insert_website_footer);
500
	$insert_wysiwyg_style = "INSERT INTO `".TABLE_PREFIX."settings` VALUES ('', 'wysiwyg_style', 'font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;')";
501
	$database->query($insert_wysiwyg_style);
502
	$insert_rename_files_on_upload = "INSERT INTO `".TABLE_PREFIX."settings` VALUES ('', 'rename_files_on_upload', 'php,asp,phpx,aspx')";
503
	$database->query($insert_rename_files_on_upload);
504
	
502 505
	// Search header
503 506
	$search_header = addslashes('
504 507
<h1>Search</h1>
trunk/wb/languages/EN.php
374 374
$TEXT['PAGE_LANGUAGES'] = 'Page Languages';
375 375
$TEXT['HIDDEN'] = 'Hidden';
376 376
$TEXT['MAIN'] = 'Main';
377
$TEXT['RENAME_FILES_ON_UPLOAD'] = 'Rename Files On Upload';
377 378

  
378

  
379 379
// Success/error messages
380 380
$MESSAGE['FRONTEND']['SORRY_NO_VIEWING_PERMISSIONS'] = 'Sorry, you do not have permissions to view this page';
381 381

  
trunk/wb/admin/media/rename2.php
32 32
// Include the basic header file
33 33
require(ADMIN_PATH.'/media/basic_header.html');
34 34

  
35
// Get list of file types to which we're supposed to append 'txt'
36
$get_result=$database->query("SELECT value FROM ".TABLE_PREFIX."settings WHERE name='rename_files_on_upload' LIMIT 1");
37
$file_extension_string='';
38
if ($get_result->numRows()>0) {
39
	$fetch_result=$get_result->fetchRow();
40
	$file_extension_string=$fetch_result['value'];
41
}
42
$file_extensions=explode(",",$file_extension_string);
43

  
44

  
35 45
// Get the current dir
36 46
$directory = $admin->get_post('dir');
37 47
if($directory == '/') {
......
129 139
	$admin->print_error($MESSAGE['MEDIA']['BLANK_NAME'], "rename.php?dir=$directory&id=$file_id", false);
130 140
}
131 141

  
142
// Check for potentially malicious files and append 'txt' to their name
143
foreach($file_extensions as $file_ext) {
144
	$file_ext_len=strlen($file_ext);
145
	if (substr($name,-$file_ext_len)==$file_ext) {
146
		$name.='.txt';
147
	}
148
}		
149

  
150

  
132 151
// Check if we should overwrite or not
133 152
if($admin->get_post('overwrite') != 'yes' AND file_exists(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$name) == true) {
134 153
	if($type == 'folder') {
trunk/wb/admin/media/upload.php
1 1
<?php
2 2

  
3
// $Id: upload.php,v 1.11 2005/04/25 11:53:12 rdjurovich Exp $
3
// $Id$
4 4

  
5 5
/*
6 6

  
......
53 53
	$overwrite = false;
54 54
}
55 55

  
56
// Get list of file types to which we're supposed to append 'txt'
57
$get_result=$database->query("SELECT value FROM ".TABLE_PREFIX."settings WHERE name='rename_files_on_upload' LIMIT 1");
58
$file_extension_string='';
59
if ($get_result->numRows()>0) {
60
	$fetch_result=$get_result->fetchRow();
61
	$file_extension_string=$fetch_result['value'];
62
}
63
$file_extensions=explode(",",$file_extension_string);
64

  
65

  
56 66
// Loop through the files
57 67
$good_uploads = 0;
58 68
for($count = 1; $count <= 10; $count++) {
......
62 72
		$filename = media_filename($_FILES["file$count"]['name']);
63 73
		// Check if there is still a filename left
64 74
		if($filename != '') {
75
			// Check for potentially malicious files and append 'txt' to their name
76
			foreach($file_extensions as $file_ext) {
77
				$file_ext_len=strlen($file_ext);
78
				if (substr($filename,-$file_ext_len)==$file_ext) {
79
					$filename.='.txt';
80
				}
81
			}		
65 82
			// Move to relative path (in media folder)
66 83
			if(file_exists($relative.$filename) AND $overwrite == true) {			
67 84
				if(move_uploaded_file($_FILES["file$count"]['tmp_name'], $relative.$filename)) {
trunk/wb/admin/settings/save.php
199 199
	"define('HOMEPAGE_REDIRECTION', ".str_replace(';', '', $_POST['homepage_redirection']).");\n".
200 200
	"define('PAGE_LANGUAGES', ".str_replace(';', '', $_POST['page_languages']).");\n".
201 201
	"\n".
202
	"define('WYSIWYG_STYLE', '".$admin->add_slashes($_POST['wysiwyg_style'])."');\n".
203
	"\n".
204 202
	"define('WYSIWYG_EDITOR', '".addslashes($_POST['wysiwyg_editor'])."');\n".
205 203
	"\n".
206 204
	"define('MANAGE_SECTIONS', ".str_replace(';', '', $_POST['manage_sections']).");\n".
trunk/wb/admin/settings/index.php
31 31
	$admin = new admin('Settings', 'settings_basic');
32 32
}
33 33

  
34
// Create new database object
35
$database = new database();
36

  
37 34
// Include the WB functions file
38 35
require_once(WB_PATH.'/framework/functions.php');
39 36

  
......
73 70
		case 'footer':
74 71
			$template->set_var('FOOTER', $setting_value);
75 72
		break;
73
		// WYSIWYG style
74
		case 'wysiwyg_style':
75
			$template->set_var('WYSIWYG_STYLE', $setting_value);
76
		break;
77
		case 'rename_files_on_upload':
78
			$template->set_var('RENAME_FILES_ON_UPLOAD', $setting_value);
79
		break;
76 80
	}
77 81
}
78 82

  
......
489 493
	$template->set_var('DIR_O_E_CHECKED', 'checked');
490 494
}
491 495

  
492
// Insert WYSIWYG style value into template
493
$template->set_var('WYSIWYG_STYLE', $admin->strip_slashes_dummy(WYSIWYG_STYLE));
494

  
495 496
// Insert Server Email value into template
496 497
$template->set_var('SERVER_EMAIL', SERVER_EMAIL);
497 498

  
......
533 534
								'TEXT_PHP_ERROR_LEVEL' => $TEXT['PHP_ERROR_LEVEL'],
534 535
								'TEXT_PAGE_EXTENSION' => $TEXT['PAGE_EXTENSION'],
535 536
								'TEXT_PAGE_SPACER' => $TEXT['PAGE_SPACER'],
537
								'TEXT_RENAME_FILES_ON_UPLOAD' => $TEXT['RENAME_FILES_ON_UPLOAD'],
536 538
								'TEXT_SERVER_OPERATING_SYSTEM' => $TEXT['SERVER_OPERATING_SYSTEM'],
537 539
								'TEXT_LINUX_UNIX_BASED' => $TEXT['LINUX_UNIX_BASED'],
538 540
								'TEXT_WINDOWS' => $TEXT['WINDOWS'],
trunk/wb/admin/settings/template.html
548 548
		<input type="text" name="page_spacer" value="{PAGE_SPACER}" />
549 549
	</td>
550 550
</tr>
551
<tr class="advanced">
552
	<td class="setting_name">{TEXT_RENAME_FILES_ON_UPLOAD}:</td>
553
	<td class="setting_value" colspan="2">
554
		<input type="text" name="rename_files_on_upload" value="{RENAME_FILES_ON_UPLOAD}" />
555
	</td>
556
</tr>
551 557
<tr>
552 558
	<td>&nbsp;</td>
553 559
	<td>

Also available in: Unified diff