Changeset 5335

Timestamp:

Mar 25, 2010, 6:59:35 AM (14 years ago)

Author:

rvelices

Message:

• fix cat_modify
  • missing token in url
  • double icon display
• simplified func check_pwg_token

Location:

trunk

Files:

• admin/cat_modify.php (modified) (6 diffs)
• admin/themes/default/template/cat_modify.tpl (modified) (1 diff)
• include/functions.inc.php (modified) (1 diff)

trunk/admin/cat_modify.php

@@ -27 +27 @@
 }
 
-include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
 include_once(PHPWG_ROOT_PATH.'include/functions_mail.inc.php');
 
@@ -290 +289 @@
   $template->assign(
     array(
-      'U_DELETE' => $self_url.'&delete='.$category['id'],
+      'U_DELETE' => $self_url.'&delete='.$category['id'].'&pwg_token='.get_pwg_token(),
       )
     );
@@ -345 +344 @@
       'DIRECTION' => array('ASC'),
     );
-  
+
   if ( isset($matches[1][$i]) )
   {
     $tpl_image_order_select['FIELD'] = array($matches[1][$i]);
   }
-  
+
   if (isset($matches[2][$i]) and strcasecmp($matches[2][$i],'DESC')==0)
   {
@@ -451 +450 @@
   set_make_full_url();
 
-  /* TODO: if $category['representative_picture_id'] 
+  /* TODO: if $category['representative_picture_id']
     is empty find child representative_picture_id */
   if (!empty($category['representative_picture_id']))
@@ -475 +474 @@
     }
   }
-  
+
   if (!isset($img_url))
   {
@@ -513 +512 @@
 ;';
   list($group_name) = pwg_db_fetch_row(pwg_query($query));
-  
+
   array_push(
     $page['infos'],

trunk/admin/themes/default/template/cat_modify.tpl

@@ -22 +22 @@
   {/if}
   {if isset($U_DELETE) }
-  <li><a href="{$U_DELETE}" title="{'Are you sure?'|@translate|@escape:'javascript'}');"><img src="{$ROOT_URL}{$themeconf.admin_icon_dir}/category_delete.png" class="button" alt="{'delete'|@translate}" onclick="return confirm('{'Are you sure?'|@translate|@escape:'javascript'}');"><img src="{$ROOT_URL}{$themeconf.admin_icon_dir}/category_delete.png" class="button" alt="{'delete'|@translate}"></a></li>
+  <li><a href="{$U_DELETE}" title="{'delete'|@translate}"><img src="{$ROOT_URL}{$themeconf.admin_icon_dir}/category_delete.png" class="button" alt="{'delete'|@translate}" onclick="return confirm('{'Are you sure?'|@translate|@escape:javascript}');"></a></li>
   {/if}
 </ul>

trunk/include/functions.inc.php

@@ -1454 +1454 @@
 function check_pwg_token()
 {
-  $valid_token = get_pwg_token();
-  $given_token = null;
-
-  if (!empty($_POST['pwg_token']))
-  {
-    $given_token = $_POST['pwg_token'];
-  }
-  elseif (!empty($_GET['pwg_token']))
-  {
-    $given_token = $_GET['pwg_token'];
-  }
-  if ($given_token != $valid_token)
-  {
-    access_denied();
-  }
+  if (!empty($_REQUEST['pwg_token']))
+  {
+    if (get_pwg_token() != $_REQUEST['pwg_token'])
+    {
+      access_denied();
+    }
+  }
+  else
+    bad_request('missing token');
 }