Mercurial > hg > mlmmj
annotate contrib/web/php-admin/htdocs/edit.php @ 786:b542f6e55f5b
Better validation of input in php-admin (Thomas Goirand)
author | Ben Schmidt |
---|---|
date | Sun, 21 Nov 2010 00:30:23 +1100 |
parents | a50b8ab11d28 |
children | d03fae037eb4 |
rev | line source |
---|---|
309 | 1 <?php |
2 | |
3 /* mlmmj/php-admin: | |
4 * Copyright (C) 2004 Christoph Thiel <ct at kki dot org> | |
5 * | |
6 * mlmmj/php-perl: | |
7 * Copyright (C) 2004 Morten K. Poulsen <morten at afdelingp.dk> | |
8 * Copyright (C) 2004 Christian Laursen <christian@pil.dk> | |
9 * | |
10 * Permission is hereby granted, free of charge, to any person obtaining a copy | |
11 * of this software and associated documentation files (the "Software"), to | |
12 * deal in the Software without restriction, including without limitation the | |
13 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or | |
14 * sell copies of the Software, and to permit persons to whom the Software is | |
15 * furnished to do so, subject to the following conditions: | |
16 * | |
17 * The above copyright notice and this permission notice shall be included in | |
18 * all copies or substantial portions of the Software. | |
19 * | |
20 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |
21 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |
22 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | |
23 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | |
24 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING | |
25 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS | |
26 * IN THE SOFTWARE. | |
27 */ | |
28 | |
29 require("../conf/config.php"); | |
710
6d354f3a8d90
Replaced class.FastTemplate.php with class.rFastTemplate.php in contrib/web/php-admin (Christoph Thiel)
mortenp
parents:
687
diff
changeset
|
30 require("class.rFastTemplate.php"); |
309 | 31 |
32 function mlmmj_boolean($name, $nicename, $text) | |
33 { | |
34 global $tpl, $topdir, $list; | |
35 | |
36 if(is_file($topdir."/".$list."/control/".$name)) | |
37 $checked = TRUE; | |
38 else | |
39 $checked = FALSE; | |
40 | |
41 $tpl->assign(array("NAME" => htmlentities($name), | |
42 "NICENAME" => htmlentities($nicename), | |
43 "TEXT" => htmlentities($text))); | |
44 $tpl->assign(array("CHECKED" => $checked ? " checked" : "")); | |
45 | |
46 $tpl->parse("ROWS",".boolean"); | |
47 } | |
48 | |
49 function mlmmj_string($name, $nicename, $text) | |
50 { | |
51 global $tpl, $topdir, $list; | |
52 | |
53 $file = $topdir."/".$list."/control/".$name; | |
54 $value = ""; | |
55 | |
56 if(!is_file($file)) | |
57 $lines = ""; | |
58 else | |
59 $lines = file($file); | |
60 | |
61 $value = $lines[0]; | |
62 | |
63 $tpl->assign(array("NAME" => htmlentities($name), | |
64 "NICENAME" => htmlentities($nicename), | |
65 "TEXT" => htmlentities($text), | |
66 "VALUE" => htmlentities($value))); | |
67 | |
68 $tpl->parse("ROWS",".string"); | |
69 } | |
70 | |
71 function mlmmj_list($name, $nicename, $text) | |
72 { | |
73 global $tpl, $topdir, $list; | |
74 | |
75 $file = "$topdir/$list/control/$name"; | |
76 $value = ""; | |
77 | |
78 if(!is_file($file)) | |
79 $lines = array(); | |
80 else | |
81 $lines = file($file); | |
82 | |
83 foreach ($lines as $line) | |
84 { | |
85 $value .= $line; | |
86 } | |
87 | |
88 $tpl->assign(array("NAME" => htmlentities($name), | |
89 "NICENAME" => htmlentities($nicename), | |
90 "TEXT" => htmlentities($text), | |
91 "VALUE" => htmlentities($value))); | |
92 | |
93 $tpl->parse("ROWS",".list"); | |
94 } | |
95 | |
503 | 96 // Perl's encode_entities (to be able to use tunables.pl) |
97 function encode_entities($str) { return htmlentities($str); } | |
98 | |
99 | |
710
6d354f3a8d90
Replaced class.FastTemplate.php with class.rFastTemplate.php in contrib/web/php-admin (Christoph Thiel)
mortenp
parents:
687
diff
changeset
|
100 $tpl = new rFastTemplate($templatedir); |
309 | 101 |
102 $list = $HTTP_GET_VARS["list"]; | |
103 | |
384 | 104 if(!isset($list)) |
105 die("no list specified"); | |
106 | |
786
b542f6e55f5b
Better validation of input in php-admin (Thomas Goirand)
Ben Schmidt
parents:
783
diff
changeset
|
107 if (dirname(realpath($topdir."/".$list)) != $topdir) |
b542f6e55f5b
Better validation of input in php-admin (Thomas Goirand)
Ben Schmidt
parents:
783
diff
changeset
|
108 die("list outside topdir"); |
783
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
109 |
309 | 110 if(!is_dir($topdir."/".$list)) |
111 die("non-existent list"); | |
112 | |
113 $tpl->define(array("main" => "edit.html", | |
114 "boolean" => "edit_boolean.html", | |
115 "string" => "edit_string.html", | |
116 "list" => "edit_list.html")); | |
117 | |
118 $tpl->assign(array("LIST" =>htmlentities($list))); | |
119 | |
687 | 120 $handle = fopen("$templatedir/../conf/tunables.pl", "r"); |
121 $tunables = fread($handle, filesize("$templatedir/../conf/tunables.pl")); | |
503 | 122 fclose($handle); |
123 | |
124 eval($tunables); | |
309 | 125 |
126 $tpl->parse("MAIN","main"); | |
127 $tpl->FastPrint("MAIN"); | |
128 | |
129 ?> |