Changeset 25791 for extensions/AdminTools/include

Timestamp:

Dec 5, 2013, 8:36:36 PM (10 years ago)

Author:

mistic100

Message:

fix security problem, fix sql fatal error, try to fix display on smartpocket

Location:

extensions/AdminTools/include

Files:

• MultiView.class.php (modified) (2 diffs)
• events.inc.php (modified) (6 diffs)

extensions/AdminTools/include/MultiView.class.php

@@ -113 +113 @@
       );
 
-    if ($this->is_admin)
+    // inactive on ws.php to allow AJAX admin tasks
+    if ($this->is_admin && script_basename() != 'ws')
     {
       if ($this->data['view_as'] == 0)
@@ -201 +202 @@
   public function init()
   {
-    if (isset($_GET['ato_purge_template']))
-    {
-      global $template;
-      $template->delete_compiled_templates();
-      FileCombiner::clear_combined_files();
+    if ($this->is_admin)
+    {
+      if (isset($_GET['ato_purge_template']))
+      {
+        global $template;
+        $template->delete_compiled_templates();
+        FileCombiner::clear_combined_files();
+      }
     }
   }

extensions/AdminTools/include/events.inc.php

@@ -8 +8 @@
 function admintools_add_public_controller()
 {
-  global $MultiView, $conf;
+  global $MultiView, $conf, $template, $page, $user;
 
   if (!$MultiView->is_admin())
@@ -14 +14 @@
     return;
   }
-
-  global $template, $page, $user;
 
   $url_root = get_root_url();
@@ -99 +97 @@
 
     $tpl_vars['QUICK_EDIT'] = array(
-      'img' =>                $picture['current']['derivatives']['square'],
+      'img' =>                $picture['current']['derivatives']['square']->get_url(),
       'name' =>               $picture['current']['name'],
       'comment' =>            $picture['current']['comment'],
@@ -132 +130 @@
     }
 
-    $query = '
+    $tpl_vars['QUICK_EDIT'] = array(
+      'img' =>      null,
+      'name' =>     $page['category']['name'],
+      'comment' =>  $page['category']['comment'],
+      );
+
+    if (!empty($page['category']['representative_picture_id']))
+    {
+      $query = '
 SELECT * FROM '.IMAGES_TABLE.'
   WHERE id = '. $page['category']['representative_picture_id'] .'
 ;';
-    $image_infos = pwg_db_fetch_assoc(pwg_query($query));
-
-    $tpl_vars['QUICK_EDIT'] = array(
-      'img' =>      DerivativeImage::get_one(IMG_SQUARE, $image_infos),
-      'name' =>     $page['category']['name'],
-      'comment' =>  $page['category']['comment'],
-      );
+      $image_infos = pwg_db_fetch_assoc(pwg_query($query));
+
+      $tpl_vars['QUICK_EDIT']['img'] = DerivativeImage::get_one(IMG_SQUARE, $image_infos)->get_url();
+    }
   }
 
@@ -201 +204 @@
 function admintools_save_picture()
 {
-  global $page, $conf;
+  global $page, $conf, $MultiView;
+
+  if (!$MultiView->is_admin())
+  {
+    return;
+  }
 
   if (isset($_GET['delete']) and get_pwg_token()==@$_GET['pwg_token'])
@@ -269 +277 @@
 function admintools_save_category()
 {
-  global $page, $conf;
+  global $page, $conf, $MultiView;
+
+  if (!$MultiView->is_admin())
+  {
+    return;
+  }
   
   if (@$_POST['action'] == 'quick_edit')