Mercurial > hg > mlmmj
annotate contrib/web/php-admin/htdocs/edit.php @ 783:a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
(Florian Streibelt, Morten Shearman Kirkegaard)
| author | Ben Schmidt |
|---|---|
| date | Sun, 21 Nov 2010 00:25:20 +1100 |
| parents | 6d354f3a8d90 |
| children | d92234debf5c |
| rev | line source |
|---|---|
| 309 | 1 <?php |
| 2 | |
| 3 /* mlmmj/php-admin: | |
| 4 * Copyright (C) 2004 Christoph Thiel <ct at kki dot org> | |
| 5 * | |
| 6 * mlmmj/php-perl: | |
| 7 * Copyright (C) 2004 Morten K. Poulsen <morten at afdelingp.dk> | |
| 8 * Copyright (C) 2004 Christian Laursen <christian@pil.dk> | |
| 9 * | |
| 10 * Permission is hereby granted, free of charge, to any person obtaining a copy | |
| 11 * of this software and associated documentation files (the "Software"), to | |
| 12 * deal in the Software without restriction, including without limitation the | |
| 13 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or | |
| 14 * sell copies of the Software, and to permit persons to whom the Software is | |
| 15 * furnished to do so, subject to the following conditions: | |
| 16 * | |
| 17 * The above copyright notice and this permission notice shall be included in | |
| 18 * all copies or substantial portions of the Software. | |
| 19 * | |
| 20 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |
| 21 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |
| 22 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | |
| 23 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | |
| 24 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING | |
| 25 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS | |
| 26 * IN THE SOFTWARE. | |
| 27 */ | |
| 28 | |
| 29 require("../conf/config.php"); | |
|
710
6d354f3a8d90
Replaced class.FastTemplate.php with class.rFastTemplate.php in contrib/web/php-admin (Christoph Thiel)
mortenp
parents:
687
diff
changeset
|
30 require("class.rFastTemplate.php"); |
| 309 | 31 |
| 32 function mlmmj_boolean($name, $nicename, $text) | |
| 33 { | |
| 34 global $tpl, $topdir, $list; | |
| 35 | |
| 36 if(is_file($topdir."/".$list."/control/".$name)) | |
| 37 $checked = TRUE; | |
| 38 else | |
| 39 $checked = FALSE; | |
| 40 | |
| 41 $tpl->assign(array("NAME" => htmlentities($name), | |
| 42 "NICENAME" => htmlentities($nicename), | |
| 43 "TEXT" => htmlentities($text))); | |
| 44 $tpl->assign(array("CHECKED" => $checked ? " checked" : "")); | |
| 45 | |
| 46 $tpl->parse("ROWS",".boolean"); | |
| 47 } | |
| 48 | |
| 49 function mlmmj_string($name, $nicename, $text) | |
| 50 { | |
| 51 global $tpl, $topdir, $list; | |
| 52 | |
| 53 $file = $topdir."/".$list."/control/".$name; | |
| 54 $value = ""; | |
| 55 | |
| 56 if(!is_file($file)) | |
| 57 $lines = ""; | |
| 58 else | |
| 59 $lines = file($file); | |
| 60 | |
| 61 $value = $lines[0]; | |
| 62 | |
| 63 $tpl->assign(array("NAME" => htmlentities($name), | |
| 64 "NICENAME" => htmlentities($nicename), | |
| 65 "TEXT" => htmlentities($text), | |
| 66 "VALUE" => htmlentities($value))); | |
| 67 | |
| 68 $tpl->parse("ROWS",".string"); | |
| 69 } | |
| 70 | |
| 71 function mlmmj_list($name, $nicename, $text) | |
| 72 { | |
| 73 global $tpl, $topdir, $list; | |
| 74 | |
| 75 $file = "$topdir/$list/control/$name"; | |
| 76 $value = ""; | |
| 77 | |
| 78 if(!is_file($file)) | |
| 79 $lines = array(); | |
| 80 else | |
| 81 $lines = file($file); | |
| 82 | |
| 83 foreach ($lines as $line) | |
| 84 { | |
| 85 $value .= $line; | |
| 86 } | |
| 87 | |
| 88 $tpl->assign(array("NAME" => htmlentities($name), | |
| 89 "NICENAME" => htmlentities($nicename), | |
| 90 "TEXT" => htmlentities($text), | |
| 91 "VALUE" => htmlentities($value))); | |
| 92 | |
| 93 $tpl->parse("ROWS",".list"); | |
| 94 } | |
| 95 | |
| 503 | 96 // Perl's encode_entities (to be able to use tunables.pl) |
| 97 function encode_entities($str) { return htmlentities($str); } | |
| 98 | |
| 99 | |
|
710
6d354f3a8d90
Replaced class.FastTemplate.php with class.rFastTemplate.php in contrib/web/php-admin (Christoph Thiel)
mortenp
parents:
687
diff
changeset
|
100 $tpl = new rFastTemplate($templatedir); |
| 309 | 101 |
| 102 $list = $HTTP_GET_VARS["list"]; | |
| 103 | |
| 384 | 104 if(!isset($list)) |
| 105 die("no list specified"); | |
| 106 | |
|
783
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
107 if (strchr($list, "/") !== false) |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
108 die("slash in list name"); |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
109 |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
110 if ($list == ".") |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
111 die("list name is dot"); |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
112 |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
113 if ($list == "..") |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
114 die("list name is dot-dot"); |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
115 |
| 309 | 116 if(!is_dir($topdir."/".$list)) |
| 117 die("non-existent list"); | |
| 118 | |
| 119 $tpl->define(array("main" => "edit.html", | |
| 120 "boolean" => "edit_boolean.html", | |
| 121 "string" => "edit_string.html", | |
| 122 "list" => "edit_list.html")); | |
| 123 | |
| 124 $tpl->assign(array("LIST" =>htmlentities($list))); | |
| 125 | |
| 687 | 126 $handle = fopen("$templatedir/../conf/tunables.pl", "r"); |
| 127 $tunables = fread($handle, filesize("$templatedir/../conf/tunables.pl")); | |
| 503 | 128 fclose($handle); |
| 129 | |
| 130 eval($tunables); | |
| 309 | 131 |
| 132 $tpl->parse("MAIN","main"); | |
| 133 $tpl->FastPrint("MAIN"); | |
| 134 | |
| 135 ?> |