source: trunk/plugins/LocalFilesEditor/admin.php @ 20715

Last change on this file since 20715 was 20715, checked in by plg, 11 years ago

merge r20713 from branch 2.4 to trunk

bug 2844: improve security on LocalFiles Editor, add pwg_token to avoid CSRF

  • Property svn:eol-style set to LF
File size: 5.5 KB
RevLine 
[2235]1<?php
2// +-----------------------------------------------------------------------+
[8728]3// | Piwigo - a PHP based photo gallery                                    |
[2297]4// +-----------------------------------------------------------------------+
[19703]5// | Copyright(C) 2008-2013 Piwigo Team                  http://piwigo.org |
[2297]6// | Copyright(C) 2003-2008 PhpWebGallery Team    http://phpwebgallery.net |
7// | Copyright(C) 2002-2003 Pierrick LE GALL   http://le-gall.net/pierrick |
8// +-----------------------------------------------------------------------+
9// | This program is free software; you can redistribute it and/or modify  |
10// | it under the terms of the GNU General Public License as published by  |
11// | the Free Software Foundation                                          |
12// |                                                                       |
13// | This program is distributed in the hope that it will be useful, but   |
14// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
15// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
16// | General Public License for more details.                              |
17// |                                                                       |
18// | You should have received a copy of the GNU General Public License     |
19// | along with this program; if not, write to the Free Software           |
20// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
21// | USA.                                                                  |
22// +-----------------------------------------------------------------------+
[2235]23
24if (!defined('PHPWG_ROOT_PATH')) die('Hacking attempt!');
25include_once(PHPWG_ROOT_PATH.'admin/include/tabsheet.class.php');
[10348]26include_once(LOCALEDIT_PATH.'include/functions.inc.php');
[2235]27load_language('plugin.lang', LOCALEDIT_PATH);
[9359]28$my_base_url = get_root_url().'admin.php?page=plugin-'.basename(dirname(__FILE__));
[2235]29
30// +-----------------------------------------------------------------------+
31// |                            Tabssheet
32// +-----------------------------------------------------------------------+
33
[11655]34if (empty($conf['LocalFilesEditor_tabs']))
35{
36  $conf['LocalFilesEditor_tabs'] = array('localconf', 'css', 'tpl', 'lang', 'plug');
37}
38
39$page['tab'] = isset($_GET['tab']) ? $_GET['tab'] : $conf['LocalFilesEditor_tabs'][0];
40
41if (!in_array($page['tab'], $conf['LocalFilesEditor_tabs'])) die('Hacking attempt!');
42
[2235]43$tabsheet = new tabsheet();
[11655]44foreach ($conf['LocalFilesEditor_tabs'] as $tab)
45{
46  $tabsheet->add($tab, l10n('locfiledit_onglet_'.$tab), $my_base_url.'-'.$tab);
47}
[2235]48$tabsheet->select($page['tab']);
49$tabsheet->assign();
50
[10348]51include_once(LOCALEDIT_PATH.'include/'.$page['tab'].'.inc.php');
[2235]52
53// +-----------------------------------------------------------------------+
54// |                           Load backup file
55// +-----------------------------------------------------------------------+
[8126]56if (isset($_POST['restore']))
[2235]57{
[2588]58  $content_file = file_get_contents(get_bak_file($edited_file));
[2235]59  array_push($page['infos'],
[2588]60    l10n('locfiledit_bak_loaded1'),
61    l10n('locfiledit_bak_loaded2'));
[2235]62}
63
64// +-----------------------------------------------------------------------+
65// |                            Save file
66// +-----------------------------------------------------------------------+
[8126]67if (isset($_POST['submit']))
[2235]68{
[20715]69  check_pwg_token();
70
[5272]71  if (!is_webmaster())
[5256]72  {
73    array_push($page['errors'], l10n('locfiledit_webmaster_only'));
[2235]74  }
[5256]75  else
76  {
77    $content_file = stripslashes($_POST['text']);
78    if (get_extension($edited_file) == 'php')
[2235]79    {
[5256]80      $content_file = eval_syntax($content_file);
[2235]81    }
[5256]82    if ($content_file === false)
[2235]83    {
[5256]84      array_push($page['errors'], l10n('locfiledit_syntax_error'));
[2235]85    }
[5256]86    else
[2235]87    {
[5256]88      if ($page['tab'] == 'plug' and !is_dir(PHPWG_PLUGINS_PATH . 'PersonalPlugin'))
89      {
90        @mkdir(PHPWG_PLUGINS_PATH . "PersonalPlugin");
91      }
92      if (file_exists($edited_file))
93      {
94        @copy($edited_file, get_bak_file($edited_file));
95        array_push($page['infos'], sprintf(l10n('locfiledit_saved_bak'), substr(get_bak_file($edited_file), 2)));
96      }
97     
98      if ($file = @fopen($edited_file , "w"))
99      {
100        @fwrite($file , $content_file);
101        @fclose($file);
102        array_unshift($page['infos'], l10n('locfiledit_save_config'));
103        $template->delete_compiled_templates();
104      }
105      else
106      {
107        array_push($page['errors'], l10n('locfiledit_cant_save'));
108      }
[2235]109    }
110  }
111}
112
113// +-----------------------------------------------------------------------+
114// |                            template initialization
115// +-----------------------------------------------------------------------+
116$template->set_filenames(array(
[10348]117    'plugin_admin_content' => dirname(__FILE__) . '/template/admin.tpl'));
[2235]118
119if (!empty($edited_file))
120{
121  if (!empty($page['errors']))
122        {
123    $content_file = stripslashes($_POST['text']);
124  }
125  $template->assign('zone_edit',
[10348]126    array(
127      'EDITED_FILE' => $edited_file,
128      'CONTENT_FILE' => htmlspecialchars($content_file),
129      'FILE_NAME' => trim($edited_file, './\\')
130    )
131  );
[2588]132  if (file_exists(get_bak_file($edited_file)))
[2235]133  {
134    $template->assign('restore', true);
135  }
[2588]136  if (file_exists($edited_file))
137  {
138    $template->assign('restore_infos', true);
139  }
[2235]140}
141
[2588]142$template->assign(array(
[9359]143  'F_ACTION' => PHPWG_ROOT_PATH.'admin.php?page=plugin-LocalFilesEditor-'.$page['tab'],
[2588]144  'LOCALEDIT_PATH' => LOCALEDIT_PATH,
[20715]145  'PWG_TOKEN' => get_pwg_token(),
[10307]146  'CODEMIRROR_MODE' => @$codemirror_mode
147  )
148);
[2291]149
[2235]150$template->assign_var_from_handle('ADMIN_CONTENT', 'plugin_admin_content');
151
152?>
Note: See TracBrowser for help on using the repository browser.