Enano CMS (1.0.x): comparison install.php

equal deleted inserted replaced

-:6a4573507ff8
+:3daa715e0f69
 </form>
 <?php
 break;
 case "website":
 if(!isset($_POST['_cont'])) {
-echo 'No POST data signature found. Please <a href="install.php?mode=license">restart the installation</a>.';
+echo 'No POST data signature found. Please <a href="install.php?mode=sysreqs">restart the installation</a>.';
 $template->footer();
 exit;
 }
 unset($_POST['_cont']);
 ?>
 </form>
 <?php
 break;
 case "login":
 if(!isset($_POST['_cont'])) {
-echo 'No POST data signature found. Please <a href="install.php?mode=license">restart the installation</a>.';
+echo 'No POST data signature found. Please <a href="install.php?mode=sysreqs">restart the installation</a>.';
 $template->footer();
 exit;
 }
 unset($_POST['_cont']);
 require('config.php');
 <script type="text/javascript">
 function verify()
 {
 var frm = document.forms.login;
 ret = true;
-if ( frm.admin_user.value.match(/^([A-z0-9 \-\.]+)$/g) && !frm.admin_user.value.match(/^(?:(?:\d{1,2}|1\d\d|2[0-4]\d|25[0-5])\.){3}(?:\d{1,2}|1\d\d|2[0-4]\d|25[0-5])$/) && frm.admin_user.value.toLowerCase() != 'anonymous' )
+var ip_regexp = new RegExp('^(?:(?:\d{1,2}|1\d\d|2[0-4]\d|25[0-5])\.){3}(?:\d{1,2}|1\d\d|2[0-4]\d|25[0-5])$', '');
+var valid_username = new RegExp('^([A-z0-9 \-\.]+)$', '');
+if ( frm.admin_user.value.match(valid_username) && !frm.admin_user.value.match(ip_regexp) && frm.admin_user.value.toLowerCase() != 'anonymous' )
 {
 document.getElementById('s_user').src = 'images/good.gif';
 }
 else
 {
 else
 {
 document.getElementById('s_password').src = 'images/bad.gif';
 ret = false;
 }
-if(frm.admin_email.value.match(/^(?:[\w\d]+\.?)+@(?:(?:[\w\d]\-?)+\.)+\w{2,4}$/))
+var valid_email = new RegExp('^(?:[\w\d]+\.?)+@(?:(?:[\w\d]\-?)+\.)+\w{2,4}$', '');
+if(frm.admin_email.value.match(valid_email))
 {
 document.getElementById('s_email').src = 'images/good.gif';
 }
 else
 {
 </script>
 <?php
 break;
 case "confirm":
 if(!isset($_POST['_cont'])) {
-echo 'No POST data signature found. Please <a href="install.php?mode=license">restart the installation</a>.';
+echo 'No POST data signature found. Please <a href="install.php?mode=sysreqs">restart the installation</a>.';
 $template->footer();
 exit;
 }
 unset($_POST['_cont']);
 ?>
 !isset($_POST['admin_pass']) ||
 !isset($_POST['admin_embed_php']) || ( isset($_POST['admin_embed_php']) && !in_array($_POST['admin_embed_php'], array('2', '4')) ) ||
 !isset($_POST['urlscheme'])
 )
 {
-echo 'The installer has detected that one or more required form values is not set. Please <a href="install.php?mode=license">restart the installation</a>.';
+echo 'The installer has detected that one or more required form values is not set. Please <a href="install.php?mode=sysreqs">restart the installation</a>.';
 $template->footer();
 exit;
 }
 switch($_POST['urlscheme'])
 {
 $cp = scriptPath.'/';
 break;
 }
 function err($t) { global $template; echo $t; $template->footer(); exit; }
+if ( !preg_match('/^[a-z0-9_]*$/', $_POST['table_prefix']) )
+err('Hacking attempt was detected in table_prefix.');
 echo 'Connecting to MySQL...';
 if($_POST['db_root_user'] != '')
 {
 $conn = mysql_connect($_POST['db_host'], $_POST['db_root_user'], $_POST['db_root_pass']);
 if(!$conn) err('Error connecting to MySQL: '.mysql_error());
 /* Enano auto-generated configuration file - editing not recommended! */
 $dbhost   = \''.addslashes($_POST['db_host']).'\';
 $dbname   = \''.addslashes($_POST['db_name']).'\';
 $dbuser   = \''.addslashes($_POST['db_user']).'\';
 $dbpasswd = \''.addslashes($_POST['db_pass']).'\';
-if(!defined(\'ENANO_CONSTANTS\')) {
+if ( !defined(\'ENANO_CONSTANTS\') )
-define(\'ENANO_CONSTANTS\', \'\');
+{
-define(\'table_prefix\', \''.$_POST['table_prefix'].'\');
+define(\'ENANO_CONSTANTS\', \'\');
-define(\'scriptPath\', \''.scriptPath.'\');
+define(\'table_prefix\', \''.addslashes($_POST['table_prefix']).'\');
-define(\'contentPath\', \''.$cp.'\');
+define(\'scriptPath\', \''.scriptPath.'\');
-define(\'ENANO_INSTALLED\', \'true\');
+define(\'contentPath\', \''.$cp.'\');
+define(\'ENANO_INSTALLED\', \'true\');
 }
 $crypto_key = \''.$privkey.'\';
 ?>';
 $cf_handle = fopen(ENANO_ROOT.'/config.php', 'w');

changeset 195	3daa715e0f69
parent 186	9e09480cb38f
child 197	cc358458a012