Changeset 1716


Ignore:
Timestamp:
Jan 12, 2007, 12:15:26 AM (17 years ago)
Author:
rvelices
Message:

plugins improvements: allow plugins to fail the installation/activation
comments.php improvements:

  • no more double sql escaping on author & keyword (once in common.inc.php and

once in comments.php)

  • now can search comment content on all special char ( ', ", <, >, & )
  • author & keyword are correctly redisplayed in browser when they are MySql

escaped

Location:
trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • trunk/admin/plugins.php

    r1699 r1716  
    22// +-----------------------------------------------------------------------+
    33// | PhpWebGallery - a PHP based picture gallery                           |
    4 // | Copyright (C) 2002-2003 Pierrick LE GALL - pierrick@phpwebgallery.net |
    5 // | Copyright (C) 2003-2006 PhpWebGallery Team - http://phpwebgallery.net |
     4// | Copyright (C) 2003-2007 PhpWebGallery Team - http://phpwebgallery.net |
    65// +-----------------------------------------------------------------------+
    76// | branch        : BSF (Best So Far)
    8 // | file          : $RCSfile$
     7// | file          : $Id$
    98// | last update   : $Date$
    109// | last modifier : $Author$
    … …  
    3736
    3837
    39 
    4038// +-----------------------------------------------------------------------+
    4139// |                     perform requested actions                         |
    … …  
    4341if ( isset($_REQUEST['action']) and isset($_REQUEST['plugin'])  )
    4442{
    45   if (function_exists('mysql_real_escape_string'))
    46   {
    47     $plugin_id = mysql_real_escape_string($_REQUEST['plugin']);
    48   }
    49   else
    50   {
    51     $plugin_id = mysql_escape_string($_REQUEST['plugin']);
    52   }
    53 
     43  $plugin_id = $_REQUEST['plugin'];
    5444  $crt_db_plugin = get_db_plugins('', $plugin_id);
    5545  if (!empty($crt_db_plugin))
    … …  
    6252  }
    6353
     54  $errors = array();
    6455  $file_to_include = PHPWG_PLUGINS_PATH.$plugin_id.'/maintain.inc.php';
    6556
    … …  
    6960      if ( !empty($crt_db_plugin))
    7061      {
    71         die ('CANNOT install - ALREADY INSTALLED');
     62        array_push($errors, 'CANNOT install - ALREADY INSTALLED');
     63        break;
    7264      }
    7365      $fs_plugins = get_fs_plugins();
    7466      if ( !isset( $fs_plugins[$plugin_id] ) )
    7567      {
    76         die ('CANNOT install - NO SUCH PLUGIN');
    77       }
    78       $query = '
     68        array_push($errors, 'CANNOT install - NO SUCH PLUGIN');
     69        break;
     70      }
     71      if ( file_exists($file_to_include) )
     72      {
     73        include_once($file_to_include);
     74        if ( function_exists('plugin_install') )
     75        {
     76          plugin_install($plugin_id, $fs_plugins[$plugin_id]['version'], $errors);
     77        }
     78      }
     79      if (empty($errors))
     80      {
     81        $query = '
    7982INSERT INTO '.PLUGINS_TABLE.' (id,version) VALUES ("'
    8083.$plugin_id.'","'.$fs_plugins[$plugin_id]['version'].'"
    8184)';
    82       pwg_query($query);
    83 
    84       // MAYBE TODO HERE = what if we die or we fail ???
    85       @include_once($file_to_include);
    86       if ( function_exists('plugin_install') )
    87       {
    88         plugin_install($plugin_id);
    89       }
    90       break;
    91 
     85        pwg_query($query);
     86      }
     87      break;
    9288
    9389    case 'activate':
    9490      if ( !isset($crt_db_plugin) )
    9591      {
    96         die ('CANNOT '. $_REQUEST['action'] .' - NOT INSTALLED');
     92        array_push($errors, 'CANNOT '. $_REQUEST['action'] .' - NOT INSTALLED');
    9793      }
    9894      if ($crt_db_plugin['state']!='inactive')
    9995      {
    100         die('invalid current state '.$crt_db_plugin['state']);
    101       }
    102       $query = '
     96        array_push($errors, 'invalid current state '.$crt_db_plugin['state']);
     97      }
     98      if ( file_exists($file_to_include) )
     99      {
     100        include_once($file_to_include);
     101        if ( function_exists('plugin_activate') )
     102        {
     103          plugin_activate($plugin_id, $crt_db_plugin['version'], $errors);
     104        }
     105      }
     106      if (empty($errors))
     107      {
     108        $query = '
    103109UPDATE '.PLUGINS_TABLE.' SET state="active" WHERE id="'.$plugin_id.'"';
    104       pwg_query($query);
    105 
    106       // MAYBE TODO HERE = what if we die or we fail ???
    107       @include_once($file_to_include);
    108       if ( function_exists('plugin_activate') )
    109       {
    110         plugin_activate($plugin_id);
    111       }
    112       break;
    113 
     110        pwg_query($query);
     111      }
     112      break;
    114113
    115114    case 'deactivate':
    … …  
    126125      pwg_query($query);
    127126
    128       // MAYBE TODO HERE = what if we die or we fail ???
    129127      @include_once($file_to_include);
    130128      if ( function_exists('plugin_deactivate') )
    … …  
    143141      pwg_query($query);
    144142
    145       // MAYBE TODO HERE = what if we die or we fail ???
    146143      @include_once($file_to_include);
    147144      if ( function_exists('plugin_uninstall') )
    … …  
    151148      break;
    152149  }
    153   // do the redirection so that we allow the plugins to load/unload
    154   redirect($my_base_url);
     150  if (empty($errors))
     151  {
     152    // do the redirection so that we allow the plugins to load/unload
     153    redirect($my_base_url);
     154  }
     155  else
     156  {
     157    $page['errors'] = array_merge($page['errors'], $errors);
     158  }
    155159}
    156160

  • trunk/comments.php

    r1696 r1716  
    33// | PhpWebGallery - a PHP based picture gallery                           |
    44// | Copyright (C) 2002-2003 Pierrick LE GALL - pierrick@phpwebgallery.net |
    5 // | Copyright (C) 2003-2005 PhpWebGallery Team - http://phpwebgallery.net |
     5// | Copyright (C) 2003-2007 PhpWebGallery Team - http://phpwebgallery.net |
    66// +-----------------------------------------------------------------------+
    77// | branch        : BSF (Best So Far)
    … …  
    6464  );
    6565
    66 $page['since'] = isset($_GET['since']) ? $_GET['since'] : 3;
     66$page['since'] = isset($_GET['since']) ? $_GET['since'] : 4;
    6767
    6868// on which field sorting
    … …  
    9292}
    9393
     94$page['where_clauses'] = array();
     95
    9496// which category to filter on ?
    95 $page['cat_clause'] = '1=1';
    9697if (isset($_GET['cat']) and 0 != $_GET['cat'])
    9798{
    98   $page['cat_clause'] =
     99  $page['where_clauses'][] =
    99100    'category_id IN ('.implode(',', get_subcat_ids(array($_GET['cat']))).')';
    100101}
    101102
    102103// search a particular author
    103 $page['author_clause'] = '1=1';
    104104if (isset($_GET['author']) and !empty($_GET['author']))
    105105{
    106   if (function_exists('mysql_real_escape_string'))
    107   {
    108     $author = mysql_real_escape_string($_GET['author']);
    109   }
    110   else
    111   {
    112     $author = mysql_escape_string($_GET['author']);
    113   }
    114 
    115   $page['author_clause'] = 'author = \''.$author.'\'';
     106  $page['where_clauses'][] = 'com.author = \''.$_GET['author'].'\'';
    116107}
    117108
    118109// search a substring among comments content
    119 $page['keyword_clause'] = '1=1';
    120110if (isset($_GET['keyword']) and !empty($_GET['keyword']))
    121111{
    122   if (function_exists('mysql_real_escape_string'))
    123   {
    124     $keyword = mysql_real_escape_string($_GET['keyword']);
    125   }
    126   else
    127   {
    128     $keyword = mysql_escape_string($_GET['keyword']);
    129   }
    130   $page['keyword_clause'] =
     112  // fors some odd reason comment content is htmlspecialchars in the database
     113  $keyword = addslashes(
     114      htmlspecialchars( stripslashes($_GET['keyword']), ENT_QUOTES)
     115    );
     116  $page['where_clauses'][] =
    131117    '('.
    132118    implode(' AND ',
    … …  
    142128}
    143129
     130$page['where_clauses'][] = $since_options[$page['since']]['clause'];
     131
    144132// which status to filter on ?
    145 if ( is_admin() )
    146 {
    147   $page['status_clause'] = '1=1';
    148 }
    149 else
    150 {
    151   $page['status_clause'] = 'validated="true"';
    152 }
    153 
     133if ( !is_admin() )
     134{
     135  $page['where_clauses'][] = 'validated="true"';
     136}
     137
     138$page['where_clauses'][] = get_sql_condition_FandF
     139  (
     140    array
     141      (
     142        'forbidden_categories' => 'category_id',
     143        'visible_categories' => 'category_id',
     144        'visible_images' => 'ic.image_id'
     145      ),
     146    '', true
     147  );
    154148
    155149// +-----------------------------------------------------------------------+
    … …  
    194188
    195189    'F_ACTION'=>PHPWG_ROOT_PATH.'comments.php',
    196     'F_KEYWORD'=>@htmlentities($_GET['keyword']),
    197     'F_AUTHOR'=>@htmlentities($_GET['author']),
     190    'F_KEYWORD'=>@htmlentities(stripslashes($_GET['keyword'])),
     191    'F_AUTHOR'=>@htmlentities(stripslashes($_GET['author'])),
    198192
    199193    'U_HOME' => make_index_url(),
    … …  
    308302    INNER JOIN '.COMMENTS_TABLE.' AS com
    309303    ON ic.image_id = com.image_id
    310   WHERE '.$since_options[$page['since']]['clause'].'
    311     AND '.$page['cat_clause'].'
    312     AND '.$page['author_clause'].'
    313     AND '.$page['keyword_clause'].'
    314     AND '.$page['status_clause'].'
    315 '.get_sql_condition_FandF
    316   (
    317     array
    318       (
    319         'forbidden_categories' => 'category_id',
    320         'visible_categories' => 'category_id',
    321         'visible_images' => 'ic.image_id'
    322       ),
    323     'AND'
    324   ).'
     304  WHERE '.implode('
     305    AND ', $page['where_clauses']).'
    325306;';
    326307list($counter) = mysql_fetch_row(pwg_query($query));
    … …  
    358339    INNER JOIN '.COMMENTS_TABLE.' AS com
    359340    ON ic.image_id = com.image_id
    360   WHERE '.$since_options[$page['since']]['clause'].'
    361     AND '.$page['cat_clause'].'
    362     AND '.$page['author_clause'].'
    363     AND '.$page['keyword_clause'].'
    364     AND '.$page['status_clause'].'
    365 '.get_sql_condition_FandF
    366   (
    367     array
    368       (
    369         'forbidden_categories' => 'category_id',
    370         'visible_categories' => 'category_id',
    371         'visible_images' => 'ic.image_id'
    372       ),
    373     'AND'
    374   ).'
     341  WHERE '.implode('
     342    AND ', $page['where_clauses']).'
    375343  GROUP BY comment_id
    376344  ORDER BY '.$page['sort_by'].' '.$page['sort_order'];
Note: See TracChangeset for help on using the changeset viewer.