Hacking attempt using PHP $GLOBALS overwrite vulnerability detected, reported to admin
You're worse than this guy! Unless you are this guy...
Powered by Enano and valid XHTML 1.1
- Powered by debugConsole'); -dc_here('common: including files'); -require_once(ENANO_ROOT.'/includes/functions.php'); -require_once(ENANO_ROOT.'/includes/dbal.php'); -require_once(ENANO_ROOT.'/includes/paths.php'); -require_once(ENANO_ROOT.'/includes/sessions.php'); -require_once(ENANO_ROOT.'/includes/template.php'); -require_once(ENANO_ROOT.'/includes/plugins.php'); -require_once(ENANO_ROOT.'/includes/comment.php'); -require_once(ENANO_ROOT.'/includes/wikiformat.php'); -require_once(ENANO_ROOT.'/includes/diff.php'); -require_once(ENANO_ROOT.'/includes/render.php'); -require_once(ENANO_ROOT.'/includes/stats.php'); -require_once(ENANO_ROOT.'/includes/pageutils.php'); -require_once(ENANO_ROOT.'/includes/js-compressor.php'); -require_once(ENANO_ROOT.'/includes/rijndael.php'); -require_once(ENANO_ROOT.'/includes/email.php'); -require_once(ENANO_ROOT.'/includes/search.php'); -require_once(ENANO_ROOT.'/includes/json.php'); -require_once(ENANO_ROOT.'/includes/wikiengine/Tables.php'); - -strip_magic_quotes_gpc(); - -// Enano has five parts: the database abstraction layer (DBAL), the session manager, the path/URL manager, the template engine, and the plugin manager. -// Each part has its own class and a global var; nearly all Enano functions are handled by one of these five components. - -global $db, $session, $paths, $template, $plugins; // Common objects -global $enano_config; // A global used to cache config information without making loads of queries ;-) - // In addition, $enano_config is used to fetch config information if die_semicritical() is called. - -global $email; - -if(!isset($_SERVER['HTTP_HOST'])) grinding_halt('Cannot get hostname', 'Your web browser did not provide the HTTP Host: field. This site requires a modern browser that supports the HTTP 1.1 standard.
'); - -$db = new mysql(); -dc_here('common: calling $db->connect();'); -$db->connect(); // Redirects to install.php if an installation is not detected - -if(strstr(contentPath, '?')) $sep = '&'; -else $sep = '?'; -define('urlSeparator', $sep); -unset($sep); // save 10 bytes of memory... - -// See if any diagnostic actions have been requested -if ( isset($_GET['do']) && $_GET['do'] == 'diag' && isset($_GET['sub']) ) -{ - switch($_GET['sub']) - { - case 'cookie_destroy': - unset($_COOKIE['sid']); - setcookie('sid', '', time()-3600*24, scriptPath); - setcookie('sid', '', time()-3600*24, scriptPath.'/'); - die('Session cookie cleared. Continue'); - break; - } -} - -// Select and fetch the site configuration -dc_here('common: selecting global config data'); -$e = $db->sql_query('SELECT config_name, config_value FROM '.table_prefix.'config;'); -if(!$e) $db->_die('Some critical configuration information could not be selected.'); -else define('ENANO_CONFIG_FETCHED', ''); // Used in die_semicritical to figure out whether to call getConfig() or not - -dc_here('common: fetching $enano_config'); -$enano_config = Array(); -while($r = $db->fetchrow()) -{ - $enano_config[$r['config_name']] = $r['config_value']; -} - -$db->free_result(); - -if(enano_version(false, true) != $version) -{ - grinding_halt('Version mismatch', 'It seems that the Enano release we\'re trying to run ('.$version.') is different from the version specified in your database ('.enano_version().'). Perhaps you need to upgrade?
'); -} - -// Our list of tables included in Enano -$system_table_list = Array( - table_prefix.'categories', - table_prefix.'comments', - table_prefix.'config', - table_prefix.'logs', - table_prefix.'page_text', - table_prefix.'session_keys', - table_prefix.'pages', - table_prefix.'users', - table_prefix.'themes', - table_prefix.'buddies', - table_prefix.'banlist', - table_prefix.'files', - table_prefix.'privmsgs', - table_prefix.'sidebar', - table_prefix.'hits', - table_prefix.'search_index', - table_prefix.'groups', - table_prefix.'group_members', - table_prefix.'acl', - table_prefix.'search_cache' - ); - -dc_here('common: initializing base classes'); -$plugins = new pluginLoader(); - -// So where does the majority of Enano get executed? How about the next nine lines of code :) -dc_here('common: ok, we\'re set up, starting mainstream execution'); - -$plugins->loadAll(); -dc_here('common: loading plugins'); - global $plugins; - foreach($plugins->load_list as $f) { include_once $f; } // Can't be in object context when this is done - -$session = new sessionManager(); -$paths = new pathManager(); -$template = new template(); -$email = new EmailEncryptor(); - -define('ENANO_BASE_CLASSES_INITIALIZED', ''); - -$code = $plugins->setHook('base_classes_initted'); -foreach ( $code as $cmd ) -{ - eval($cmd); -} - -$p = RenderMan::strToPageId($paths->get_pageid_from_url()); -if( ( $p[1] == 'Admin' || $p[1] == 'Special' ) && function_exists('page_'.$p[1].'_'.$p[0].'_preloader')) -{ - @call_user_func('page_'.$p[1].'_'.$p[0].'_preloader'); -} - -$session->start(); -$paths->init(); - -define('ENANO_MAINSTREAM', ''); - -// If the site is disabled, bail out, unless we're trying to log in or administer the site -if(getConfig('site_disabled') == '1') -{ - if ( $paths->namespace == 'Admin' || ( $paths->namespace == 'Special' && ( $paths->cpage['urlname_nons'] == 'CSS' || $paths->cpage['urlname_nons'] == 'Administration' || $paths->cpage['urlname_nons'] == 'Login' ) ) ) - { - // do nothing; allow execution to continue - } - else - { - if(!$n = getConfig('site_disabled_notice')) $n = 'The administrator has disabled the site. Please check back later.'; - - $text = RenderMan::render($n) . ' -' . $message . '
If you are not redirected within ' . ( $timeout + 1 ) . ' seconds, please click here.
'; - $template->footer(true); - - $db->close(); - exit(0); - -} - -// Removed wikiFormat() from here, replaced with RenderMan::render - -function isPage($p) { - global $db, $session, $paths, $template, $plugins; // Common objects - if(isset($paths->pages[$p])) return true; - $d = RenderMan::strToPageID($p); - if($d[1] != 'Special' && $d[1] != 'Template' && $d[1] != 'Admin') return false; - $a = explode('/', $p); - if(isset($paths->pages[$a[0]])) return true; - else return false; -} - -function arrayItemUp($arr, $keyname) { - $keylist = array_keys($arr); - $keyflop = array_flip($keylist); - $idx = $keyflop[$keyname]; - $idxm = $idx - 1; - $temp = $arr[$keylist[$idxm]]; - if($arr[$keylist[0]] == $arr[$keyname]) return $arr; - $arr[$keylist[$idxm]] = $arr[$keylist[$idx]]; - $arr[$keylist[$idx]] = $temp; - return $arr; -} - -function arrayItemDown($arr, $keyname) { - $keylist = array_keys($arr); - $keyflop = array_flip($keylist); - $idx = $keyflop[$keyname]; - $idxm = $idx + 1; - $temp = $arr[$keylist[$idxm]]; - $sz = sizeof($arr); $sz--; - if($arr[$keylist[$sz]] == $arr[$keyname]) return $arr; - $arr[$keylist[$idxm]] = $arr[$keylist[$idx]]; - $arr[$keylist[$idx]] = $temp; - return $arr; -} - -function arrayItemTop($arr, $keyname) { - $keylist = array_keys($arr); - $keyflop = array_flip($keylist); - $idx = $keyflop[$keyname]; - while( $orig != $arr[$keylist[0]] ) { - // echo 'Keyname: '.$keylist[$idx] . ''; - print_r($arr); - echo '
'; - print_r($arr); - echo '
There are no subcategories in this category.
'; - echo '| '.$paths->pages[$paths->nslist[$row['namespace']].$row['page_id']]['name'].' | '; - if($ticker==2) echo '
There are no pages in this category.
'; - echo '| '.$paths->pages[$paths->nslist[$row['namespace']].$row['page_id']]['name'].' | '; - if($ticker==2) echo '
There are no files uploaded with this name yet. Upload a file...
Type: '.$r['mimetype'].'
Size: ';
- $fs = $r['size'];
- echo $fs.' bytes';
- $fs = (int)$fs;
- if($fs >= 1048576)
- {
- $fs = round($fs / 1048576, 1);
- echo ' ('.$fs.' MB)';
- } elseif($fs >= 1024) {
- $fs = round($fs / 1024, 1);
- echo ' ('.$fs.' KB)';
- }
- echo '
Uploaded: '.$datestring.'
Download this file'; - if(!$paths->page_protected && ( $paths->wiki_mode || $session->get_permissions('upload_new_version') )) - { - echo ' | Upload new version'; - } - echo '
'; - if($db->numrows() > 1) - { - echo '';
- while($r = $db->fetchrow())
- {
- echo '(this ver) ';
- if($session->get_permissions('history_rollback'))
- echo ' (revert) ';
- $mimetype = $r['mimetype'];
- $datestring = date('F d, Y h:i a', (int)$r['time_id']);
- echo $datestring.': '.$r['mimetype'].', ';
- $fs = $r['size'];
- $fs = (int)$fs;
- if($fs >= 1048576)
- {
- $fs = round($fs / 1048576, 1);
- echo ' '.$fs.' MB';
- } elseif($fs >= 1024) {
- $fs = round($fs / 1024, 1);
- echo ' '.$fs.' KB';
- } else {
- echo ' '.$fs.' bytes';
- }
- echo '
';
- }
- echo '
You must supply a password to access this page.
'; - - $cont = ob_get_contents(); - ob_end_clean(); - return Array($cont, $_ob); - } - - /** - * Saves category information - * WARNING: If $which_cats is empty, all the category information for the selected page will be nuked! - * @param $page_id string the page ID - * @param $namespace string the namespace - * @param $which_cats array associative array of categories to put the page in - * @return string "GOOD" on success, error string on failure - */ - - function catsave($page_id, $namespace, $which_cats) - { - global $db, $session, $paths, $template, $plugins; // Common objects - if(!$session->get_permissions('edit_cat')) return('Insufficient privileges to change category information'); - - $page_perms = $session->fetch_page_acl($page_id, $namespace); - $page_data =& $paths->pages[$paths->nslist[$namespace].$page_id]; - - $cat_all = Array(); - for($i=0;$iComparing revisions: {$time1} → {$time2}
- "; - // Free some memory - unset($row1, $row2, $q1, $q2); - - $_ob .= RenderMan::diff($text1, $text2); - return $_ob; - } - - /** - * Gets ACL information about the selected page for target type X and target ID Y. - * @param string $page_id The page ID - * @param string $namespace The namespace - * @param array $parms What to select. This is an array purely for JSON compatibility. It should be an associative array with keys target_type and target_id. - * @return array - */ - - function acl_editor($parms = Array()) - { - global $db, $session, $paths, $template, $plugins; // Common objects - if(!$session->get_permissions('edit_acl') && $session->user_level < USER_LEVEL_ADMIN) - return 'Access is denied.'; - $parms['page_id'] = ( isset($parms['page_id']) ) ? $parms['page_id'] : false; - $parms['namespace'] = ( isset($parms['namespace']) ) ? $parms['namespace'] : false; - $page_id =& $parms['page_id']; - $namespace =& $parms['namespace']; - $page_where_clause = ( empty($page_id) || empty($namespace) ) ? 'AND a.page_id IS NULL AND a.namespace IS NULL' : 'AND a.page_id=\''.$db->escape($page_id).'\' AND a.namespace=\''.$db->escape($namespace).'\''; - $page_where_clause_lite = ( empty($page_id) || empty($namespace) ) ? 'AND page_id IS NULL AND namespace IS NULL' : 'AND page_id=\''.$db->escape($page_id).'\' AND namespace=\''.$db->escape($namespace).'\''; - //die(print_r($page_id,true)); - $template->load_theme(); - // $perms_obj = $session->fetch_page_acl($page_id, $namespace); - $perms_obj =& $session; - $return = Array(); - if ( !file_exists(ENANO_ROOT . '/themes/' . $session->theme . '/acledit.tpl') ) - { - return Array( - 'mode' => 'error', - 'error' => 'It seems that (a) the file acledit.tpl is missing from these theme, and (b) the JSON response is working.', - ); - } - $return['template'] = $template->extract_vars('acledit.tpl'); - $return['page_id'] = $page_id; - $return['namespace'] = $namespace; - if(isset($parms['mode'])) - { - switch($parms['mode']) - { - case 'listgroups': - $return['groups'] = Array(); - $q = $db->sql_query('SELECT group_id,group_name FROM '.table_prefix.'groups ORDER BY group_name ASC;'); - while($row = $db->fetchrow()) - { - $return['groups'][] = Array( - 'id' => $row['group_id'], - 'name' => $row['group_name'], - ); - } - $db->free_result(); - break; - case 'seltarget': - $return['mode'] = 'seltarget'; - $return['acl_types'] = $perms_obj->acl_types; - $return['acl_deps'] = $perms_obj->acl_deps; - $return['acl_descs'] = $perms_obj->acl_descs; - $return['target_type'] = $parms['target_type']; - $return['target_id'] = $parms['target_id']; - switch($parms['target_type']) - { - case ACL_TYPE_USER: - $q = $db->sql_query('SELECT a.rules,u.user_id FROM '.table_prefix.'users AS u - LEFT JOIN '.table_prefix.'acl AS a - ON a.target_id=u.user_id - WHERE a.target_type='.ACL_TYPE_USER.' - AND u.username=\''.$db->escape($parms['target_id']).'\' - '.$page_where_clause.';'); - if(!$q) - return(Array('mode'=>'error','error'=>mysql_error())); - if($db->numrows() < 1) - { - $return['type'] = 'new'; - $q = $db->sql_query('SELECT user_id FROM '.table_prefix.'users WHERE username=\''.$db->escape($parms['target_id']).'\';'); - if(!$q) - return(Array('mode'=>'error','error'=>mysql_error())); - if($db->numrows() < 1) - return Array('mode'=>'error','error'=>'The username you entered was not found.'); - $row = $db->fetchrow(); - $return['target_name'] = $return['target_id']; - $return['target_id'] = intval($row['user_id']); - $return['current_perms'] = $session->acl_types; - } - else - { - $return['type'] = 'edit'; - $row = $db->fetchrow(); - $return['target_name'] = $return['target_id']; - $return['target_id'] = intval($row['user_id']); - $return['current_perms'] = $session->acl_merge($perms_obj->acl_types, $session->string_to_perm($row['rules'])); - } - $db->free_result(); - // Eliminate types that don't apply to this namespace - if ( $namespace ) - { - foreach ( $return['current_perms'] AS $i => $perm ) - { - if ( ( $page_id != null && $namespace != null ) && ( !in_array ( $namespace, $session->acl_scope[$i] ) && !in_array('All', $session->acl_scope[$i]) ) ) - { - // echo "// SCOPE CONTROL: eliminating: $i\n"; - unset($return['current_perms'][$i]); - unset($return['acl_types'][$i]); - unset($return['acl_descs'][$i]); - unset($return['acl_deps'][$i]); - } - } - } - break; - case ACL_TYPE_GROUP: - $q = $db->sql_query('SELECT a.rules,g.group_name,g.group_id FROM '.table_prefix.'groups AS g - LEFT JOIN '.table_prefix.'acl AS a - ON a.target_id=g.group_id - WHERE a.target_type='.ACL_TYPE_GROUP.' - AND g.group_id=\''.intval($parms['target_id']).'\' - '.$page_where_clause.';'); - if(!$q) - return(Array('mode'=>'error','error'=>mysql_error())); - if($db->numrows() < 1) - { - $return['type'] = 'new'; - $q = $db->sql_query('SELECT group_id,group_name FROM '.table_prefix.'groups WHERE group_id=\''.intval($parms['target_id']).'\';'); - if(!$q) - return(Array('mode'=>'error','error'=>mysql_error())); - if($db->numrows() < 1) - return Array('mode'=>'error','error'=>'The group ID you submitted is not valid.'); - $row = $db->fetchrow(); - $return['target_name'] = $row['group_name']; - $return['target_id'] = intval($row['group_id']); - $return['current_perms'] = $session->acl_types; - } - else - { - $return['type'] = 'edit'; - $row = $db->fetchrow(); - $return['target_name'] = $row['group_name']; - $return['target_id'] = intval($row['group_id']); - $return['current_perms'] = $session->acl_merge($session->acl_types, $session->string_to_perm($row['rules'])); - } - $db->free_result(); - // Eliminate types that don't apply to this namespace - if ( $namespace ) - { - foreach ( $return['current_perms'] AS $i => $perm ) - { - if ( ( $page_id != false && $namespace != false ) && ( !in_array ( $namespace, $session->acl_scope[$i] ) && !in_array('All', $session->acl_scope[$i]) ) ) - { - // echo "// SCOPE CONTROL: eliminating: $i\n"; //; ".print_r($namespace,true).":".print_r($page_id,true)."\n"; - unset($return['current_perms'][$i]); - unset($return['acl_types'][$i]); - unset($return['acl_descs'][$i]); - unset($return['acl_deps'][$i]); - } - } - } - //return Array('mode'=>'debug','text'=>print_r($return, true)); - break; - default: - return Array('mode'=>'error','error','Invalid ACL type ID'); - break; - } - return $return; - break; - case 'save_new': - case 'save_edit': - $q = $db->sql_query('DELETE FROM '.table_prefix.'acl WHERE target_type='.intval($parms['target_type']).' AND target_id='.intval($parms['target_id']).' - '.$page_where_clause_lite.';'); - if(!$q) - return Array('mode'=>'error','error'=>mysql_error()); - $rules = $session->perm_to_string($parms['perms']); - if ( sizeof ( $rules ) < 1 ) - { - return array( - 'mode' => 'error', - 'error' => 'Supplied rule list has a length of zero' - ); - } - $q = ($page_id && $namespace) ? 'INSERT INTO '.table_prefix.'acl ( target_type, target_id, page_id, namespace, rules ) - VALUES( '.intval($parms['target_type']).', '.intval($parms['target_id']).', \''.$db->escape($page_id).'\', \''.$db->escape($namespace).'\', \''.$db->escape($rules).'\' )' : - 'INSERT INTO '.table_prefix.'acl ( target_type, target_id, rules ) - VALUES( '.intval($parms['target_type']).', '.intval($parms['target_id']).', \''.$db->escape($rules).'\' )'; - if(!$db->sql_query($q)) return Array('mode'=>'error','error'=>mysql_error()); - return Array( - 'mode' => 'success', - 'target_type' => $parms['target_type'], - 'target_id' => $parms['target_id'], - 'target_name' => $parms['target_name'], - 'page_id' => $page_id, - 'namespace' => $namespace, - ); - break; - case 'delete': - $q = $db->sql_query('DELETE FROM '.table_prefix.'acl WHERE target_type='.intval($parms['target_type']).' AND target_id='.intval($parms['target_id']).' - '.$page_where_clause_lite.';'); - if(!$q) - return Array('mode'=>'error','error'=>mysql_error()); - return Array( - 'mode' => 'delete', - 'target_type' => $parms['target_type'], - 'target_id' => $parms['target_id'], - 'target_name' => $parms['target_name'], - 'page_id' => $page_id, - 'namespace' => $namespace, - ); - break; - default: - return Array('mode'=>'error','error'=>'Hacking attempt'); - break; - } - } - return $return; - } - - /** - * Same as PageUtils::acl_editor(), but the parms are a JSON string instead of an array. This also returns a JSON string. - * @param string $parms Same as PageUtils::acl_editor/$parms, but should be a valid JSON string. - * @return string - */ - - function acl_json($parms = '{ }') - { - global $db, $session, $paths, $template, $plugins; // Common objects - $json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE); - $parms = $json->decode($parms); - $ret = PageUtils::acl_editor($parms); - $ret = $json->encode($ret); - return $ret; - } - - /** - * A non-Javascript frontend for the ACL API. - * @param array The request data, if any, this should be in the format required by PageUtils::acl_editor() - */ - - function aclmanager($parms) - { - global $db, $session, $paths, $template, $plugins; // Common objects - ob_start(); - // Convenience - $formstart = ''; - $parms = PageUtils::acl_preprocess($parms); - $response = PageUtils::acl_editor($parms); - $response = PageUtils::acl_postprocess($response); - - //die('' . htmlspecialchars(print_r($response, true)) . ''); - - switch($response['mode']) - { - case 'debug': - echo '
' . htmlspecialchars($response['text']) . ''; - break; - case 'stage1': - echo '
Please select who should be affected by this access rule.
'; - echo $formstart; - echo ' - - -' . $template->username_field('data[target_id_user]') . '
-What should this access rule control?
- - -Error returned by permissions API:
' . htmlspecialchars($response['error']) . ''); - break; - } - $ret = ob_get_contents(); - ob_end_clean(); - echo - $template->getHeader() . - $ret . - $template->getFooter(); - } - - /** - * Preprocessor to turn the form-submitted data from the ACL editor into something the backend can handle - * @param array The posted data - * @return array - * @access private - */ - - function acl_preprocess($parms) - { - if ( !isset($parms['mode']) ) - // Nothing to do - return $parms; - switch ( $parms['mode'] ) - { - case 'seltarget': - - // Who's affected? - $parms['target_type'] = intval( $parms['target_type'] ); - $parms['target_id'] = ( $parms['target_type'] == ACL_TYPE_GROUP ) ? $parms['target_id_grp'] : $parms['target_id_user']; - - case 'save_edit': - case 'save_new': - if ( isset($parms['act_delete_rule']) ) - { - $parms['mode'] = 'delete'; - } - - // Scope (just this page or entire site?) - if ( $parms['scope'] == 'entire_site' || ( $parms['page_id'] == 'false' && $parms['namespace'] == 'false' ) ) - { - $parms['page_id'] = false; - $parms['namespace'] = false; - } - - break; - } - - if ( isset($parms['act_go_stage1']) ) - { - $parms = array( - 'mode' => 'listgroups' - ); - } - - return $parms; - } - - function acl_postprocess($response) - { - if(!isset($response['mode'])) - { - if ( isset($response['groups']) ) - $response['mode'] = 'stage1'; - else - $response = Array( - 'mode' => 'error', - 'error' => 'Invalid action passed by API backend.', - ); - } - return $response; - } - -} - -?> diff -r 0931d60f5bdb -r 2b2084ca1e60 includes/paths.php~ --- a/includes/paths.php~ Wed Jun 13 16:32:27 2007 -0400 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,808 +0,0 @@ -pages = Array(); - - dc_here('paths: setting up namespaces, admin nodes'); - - // DEFINE NAMESPACES HERE - // The key names should NOT EVER be changed, or Enano will be very broken - $this->nslist = Array( - 'Article' =>'', - 'User' =>'User:', - 'File' =>'File:', - 'Help' =>'Help:', - 'Admin' =>'Admin:', - 'Special' =>'Special:', - 'System' =>'Enano:', - 'Template'=>'Template:', - 'Category'=>'Category:', - 'Project' =>str_replace(' ', '_', getConfig('site_name')).':', - ); - - // ACL types - // Note: you can set any of these to AUTH_DENY to universally and unconditionally deny access to the selected action. - // These can also be added from within plugins - - $session->register_acl_type('read', AUTH_ALLOW, 'Read page(s)'); - $session->register_acl_type('post_comments', AUTH_ALLOW, 'Post comments', Array('read'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('edit_comments', AUTH_ALLOW, 'Edit own comments', Array('post_comments'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('edit_page', AUTH_WIKIMODE, 'Edit page', Array('view_source'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('view_source', AUTH_WIKIMODE, 'View source', Array('read'), 'Article|User|Project|Template|File|Help|System|Category'); // Only used if the page is protected - $session->register_acl_type('mod_comments', AUTH_DISALLOW, 'Moderate comments', Array('edit_comments'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('history_view', AUTH_WIKIMODE, 'View history/diffs', Array('read'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('history_rollback', AUTH_DISALLOW, 'Rollback history', Array('history_view'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('history_rollback_extra', AUTH_DISALLOW, 'Undelete page(s)', Array('history_rollback'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('protect', AUTH_DISALLOW, 'Protect page(s)', Array('read'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('rename', AUTH_WIKIMODE, 'Rename page(s)', Array('read'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('clear_logs', AUTH_DISALLOW, 'Clear page logs (dangerous)', Array('read', 'protect', 'even_when_protected'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('vote_delete', AUTH_ALLOW, 'Vote to delete', Array('read'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('vote_reset', AUTH_DISALLOW, 'Reset delete votes', Array('read'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('delete_page', AUTH_DISALLOW, 'Delete page(s)', Array(), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('set_wiki_mode', AUTH_DISALLOW, 'Set per-page wiki mode', Array('read'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('password_set', AUTH_DISALLOW, 'Set password', Array('read'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('password_reset', AUTH_DISALLOW, 'Disable/reset password', Array('read'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('mod_misc', AUTH_DISALLOW, 'Super moderator (generate SQL backtraces, view IP addresses, and send large numbers of private messages)', Array(), 'All'); - $session->register_acl_type('edit_cat', AUTH_WIKIMODE, 'Edit categorization', Array('read'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('even_when_protected', AUTH_DISALLOW, 'Allow editing, renaming, and categorization even when protected', Array('edit_page', 'rename', 'mod_comments', 'edit_cat'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('upload_files', AUTH_DISALLOW, 'Upload files', Array('create_page'), 'Article|User|Project|Template|File|Help|System|Category|Special'); - $session->register_acl_type('upload_new_version', AUTH_WIKIMODE, 'Upload new versions of files', Array('upload_files'), 'Article|User|Project|Template|File|Help|System|Category|Special'); - $session->register_acl_type('create_page', AUTH_WIKIMODE, 'Create pages', Array(), 'Article|User|Project|Template|File|Help|System|Category|Special'); - $session->register_acl_type('php_in_pages', AUTH_DISALLOW, 'Embed PHP code in pages', Array('edit_page'), 'Article|User|Project|Template|File|Help|System|Category'); - $session->register_acl_type('edit_acl', AUTH_DISALLOW, 'Edit access control lists', Array('read', 'post_comments', 'edit_comments', 'edit_page', 'view_source', 'mod_comments', 'history_view', 'history_rollback', 'history_rollback_extra', 'protect', 'rename', 'clear_logs', 'vote_delete', 'vote_reset', 'delete_page', 'set_wiki_mode', 'password_set', 'password_reset', 'mod_misc', 'edit_cat', 'even_when_protected', 'upload_files', 'upload_new_version', 'create_page', 'php_in_pages')); - - // DO NOT add new admin pages here! Use a plugin to call $paths->addAdminNode(); - $this->addAdminNode('General', 'General Configuration', 'GeneralConfig'); - $this->addAdminNode('General', 'File uploads', 'UploadConfig'); - $this->addAdminNode('General', 'Allowed file types', 'UploadAllowedMimeTypes'); - $this->addAdminNode('General', 'Manage Plugins', 'PluginManager'); - $this->addAdminNode('General', 'Backup database', 'DBBackup'); - $this->addAdminNode('Content', 'Manage Pages', 'PageManager'); - $this->addAdminNode('Content', 'Edit page content', 'PageEditor'); - $this->addAdminNode('Appearance', 'Manage themes', 'ThemeManager'); - $this->addAdminNode('Users', 'Manage users', 'UserManager'); - $this->addAdminNode('Users', 'Edit groups', 'GroupManager'); - $this->addAdminNode('Users', 'Ban control', 'BanControl'); - $this->addAdminNode('Users', 'Mass e-mail', 'MassEmail'); - - $code = $plugins->setHook('acl_rule_init'); - foreach ( $code as $cmd ) - { - eval($cmd); - } - - $this->wiki_mode = (int)getConfig('wiki_mode')=='1'; - $this->template_cache = Array(); - } - function pathManager() - { - $this->__construct(); - } - function init() - { - global $db, $session, $paths, $template, $plugins; // Common objects - - dc_here('paths: selecting master page data'); - - $code = $plugins->setHook('paths_init_before'); - foreach ( $code as $cmd ) - { - eval($cmd); - } - - $e = $db->sql_query('SELECT name,urlname,namespace,special,visible,comments_on,protected,delvotes,delvote_ips,wiki_mode,password FROM '.table_prefix.'pages ORDER BY name;'); - if( !$e ) - { - $db->_die('The error seems to have occured while selecting the page information. File: includes/paths.php; line: '.__LINE__); - } - while($r = $db->fetchrow()) - { - - $r['urlname_nons'] = $r['urlname']; - $r['urlname'] = $this->nslist[$r['namespace']] . $r['urlname']; // Applies the User:/File:/etc prefixes to the URL names - - if ( $r['delvotes'] == null) - { - $r['delvotes'] = 0; - } - if ( $r['protected'] == 0 || $r['protected'] == 1 ) - { - $r['really_protected'] = (int)$r['protected']; - } - else if ( $r['protected'] == 2 && getConfig('wiki_mode') == '1') - { - $r['really_protected'] = 1; - } - else if ( $r['protected'] == 2 && getConfig('wiki_mode') == '0' ) - { - $r['really_protected'] = 0; - } - - $this->pages[$r['urlname']] = $r; - $this->pages[] =& $this->pages[$r['urlname']]; - - } - $db->free_result(); - dc_here('paths: determining page ID'); - if( isset($_GET['title']) ) - { - if ( $_GET['title'] == '' && getConfig('main_page') != '' ) - { - $this->main_page(); - } - if(strstr($_GET['title'], ' ')) - { - $loc = urldecode(rawurldecode($_SERVER['REQUEST_URI'])); - $loc = str_replace(' ', '_', $loc); - $loc = str_replace('+', '_', $loc); - $loc = str_replace('%20', '_', $loc); - redirect($loc, 'Redirecting...', 'Space detected in the URL, please wait whilst you are redirected', 0); - exit; - } - $url_namespace_special = substr($_GET['title'], 0, strlen($this->nslist['Special']) ); - $url_namespace_template = substr($_GET['title'], 0, strlen($this->nslist['Template']) ); - if($url_namespace_special == $this->nslist['Special'] || $url_namespace_template == $this->nslist['Template'] ) - { - $ex = explode('/', $_GET['title']); - $this->page = $ex[0]; - } - else - { - $this->page = $_GET['title']; - } - $this->fullpage = $_GET['title']; - } - elseif( isset($_SERVER['PATH_INFO']) ) - { - $pi = explode('/', $_SERVER['PATH_INFO']); - - if( !isset($pi[1]) || (isset($pi[1]) && $pi[1] == '' && getConfig('main_page') != '') ) - { - $this->main_page(); - } - if( strstr($pi[1], ' ') ) - { - $loc = str_replace(' ', '_', urldecode(rawurldecode($_SERVER['REQUEST_URI']))); - $loc = str_replace('+', '_', $loc); - $loc = str_replace('%20', '_', $loc); - redirect($loc, 'Redirecting...', 'Please wait whilst you are redirected', 3); - exit; - } - unset($pi[0]); - if( substr($pi[1], 0, strlen($this->nslist['Special'])) == $this->nslist['Special'] || substr($pi[1], 0, strlen($this->nslist['Template'])) == $this->nslist['Template'] ) - { - $pi2 = $pi[1]; - } - else - { - $pi2 = implode('/', $pi); - } - $this->page = $pi2; - $this->fullpage = implode('/', $pi); - } - else - { - $k = array_keys($_GET); - foreach($k as $c) - { - if(substr($c, 0, 1) == '/') - { - $this->page = substr($c, 1, strlen($c)); - - // Bugfix for apache somehow passing dots as underscores - global $mime_types; - $exts = array_keys($mime_types); - $exts = '(' . implode('|', $exts) . ')'; - if ( preg_match( '#_'.$exts.'#i', $this->page ) ) - $this->page = preg_replace( '#_'.$exts.'#i', '.\\1', $this->page ); - - $this->fullpage = $this->page; - - if(substr($this->page, 0, strlen($this->nslist['Special']))==$this->nslist['Special'] || substr($this->page, 0, strlen($this->nslist['Template']))==$this->nslist['Template']) - { - $ex = explode('/', $this->page); - $this->page = $ex[0]; - } - if(strstr($this->page, ' ')) - { - $loc = str_replace(' ', '_', urldecode(rawurldecode($_SERVER['REQUEST_URI']))); - $loc = str_replace('+', '_', $loc); - $loc = str_replace('%20', '_', $loc); - redirect($loc, 'Redirecting...', 'Space in the URL detected, please wait whilst you are redirected', 0); - exit; - } - break; - } - } - if(!$this->page && !($this->page == '' && getConfig('main_page') == '')) - { - $this->main_page(); - } - } - - dc_here('paths: setting $paths->cpage'); - - if(isset($this->pages[$this->page])) - { - dc_here('paths: page existence verified, our page ID is: '.$this->page); - $this->page_exists = true; - $this->cpage = $this->pages[$this->page]; - $this->namespace = $this->cpage['namespace']; - if(!isset($this->cpage['wiki_mode'])) $this->cpage['wiki_mode'] = 2; - - // Determine the wiki mode for this page, now that we have this->cpage established - if($this->cpage['wiki_mode'] == 2) - { - $this->wiki_mode = (int)getConfig('wiki_mode'); - } - else - { - $this->wiki_mode = $this->cpage['wiki_mode']; - } - // Allow the user to create/modify his user page uncondtionally (admins can still protect the page) - if($this->page == $this->nslist['User'].str_replace(' ', '_', $session->username)) - { - $this->wiki_mode = true; - } - // And above all, if the site requires wiki mode to be off for non-logged-in users, disable it now - if(getConfig('wiki_mode_require_login')=='1' && !$session->user_logged_in) - { - $this->wiki_mode = false; - } - if($this->cpage['protected'] == 2) - { - // The page is semi-protected, determine permissions - if($session->user_logged_in && $session->reg_time + 60*60*24*4 < time()) - { - $this->page_protected = 0; - } - else - { - $this->page_protected = 1; - } - } - else - { - $this->page_protected = $this->cpage['protected']; - } - } - else - { - dc_here('paths: page doesn\'t exist, creating new page in memory
'.print_r($search->index, true).''; - // return; - $q = $db->sql_query('DELETE FROM '.table_prefix.'search_index'); - if(!$q) return false; - $secs = Array(); - $q = 'INSERT INTO '.table_prefix.'search_index(word,page_names) VALUES'; - foreach($search->index as $word => $pages) - { - $secs[] = '(\''.$db->escape($word).'\', \''.$db->escape($pages).'\')'; - } - $q .= implode(',', $secs); - unset($secs); - $q .= ';'; - $result = $db->sql_query($q); - $db->free_result(); - if($result) - return true; - else - $db->_die('The search index was trying to rebuild itself when the error occured.'); - } - - /** - * Partially rebuilds the search index, removing/inserting entries only for the current page - * @param string $page_id - * @param string $namespace - */ - - function rebuild_page_index($page_id, $namespace) - { - global $db, $session, $paths, $template, $plugins; // Common objects - if(!$db->sql_query('SELECT page_text FROM '.table_prefix.'page_text - WHERE page_id=\''.$db->escape($page_id).'\' AND namespace=\''.$db->escape($namespace).'\';')) - { - return $db->get_error(); - } - $row = $db->fetchrow(); - $db->free_result(); - $search = new Searcher(); - $search->buildIndex(Array("ns={$namespace};pid={$page_id}"=>$row['page_text'])); - $new_index = $search->index; - - $keys = array_keys($search->index); - foreach($keys as $i => $k) - { - $c =& $keys[$i]; - $c = hexencode($c, '', ''); - } - $keys = "word=0x" . implode ( " OR word=0x", $keys ) . ""; - - // Zap the cache - $cache = array_keys($search->index); - if ( count($cache) < 1 ) - { - return false; - } - $cache = "query LIKE '%" . implode ( "%' OR query LIKE '%", $cache ) . "%'"; - $db->sql_query('DELETE FROM '.table_prefix.'search_cache WHERE '.$cache); - - $query = $db->sql_query('SELECT word,page_names FROM '.table_prefix.'search_index WHERE '.$keys.';'); - - while($row = $db->fetchrow()) - { - $row['word'] = rtrim($row['word'], "\0"); - $new_index[ $row['word'] ] = $row['page_names'] . ',' . $search->index[ $row['word'] ]; - } - $db->free_result(); - - $db->sql_query('DELETE FROM '.table_prefix.'search_index WHERE '.$keys.';'); - - $secs = Array(); - $q = 'INSERT INTO '.table_prefix.'search_index(word,page_names) VALUES'; - foreach($new_index as $word => $pages) - { - $secs[] = '(\''.$db->escape($word).'\', \''.$db->escape($pages).'\')'; - } - $q .= implode(',', $secs); - unset($secs); - $q .= ';'; - if(!$db->check_query($q)) - { - die('BUG: PathManager::rebuild_page_index: Query rejected by SQL parser:
'.$q.''); - } - $result = $db->sql_query($q); - if($result) - return true; - else - $db->_die('The search index was trying to rebuild itself when the error occured.'); - - } - - /** - * Creates an instance of the Searcher class, including index info - * @return object - */ - - function makeSearcher($match_case = false) - { - global $db, $session, $paths, $template, $plugins; // Common objects - $search = new Searcher(); - $q = $db->sql_query('SELECT word,page_names FROM '.table_prefix.'search_index;'); - if(!$q) - { - echo $db->get_error(); - return false; - } - $idx = Array(); - while($row = $db->fetchrow($q)) - { - $row['word'] = rtrim($row['word'], "\0"); - $idx[$row['word']] = $row['page_names']; - } - $db->free_result(); - $search->index = $idx; - if($match_case) - $search->match_case = true; - return $search; - } - - /** - * Creates an associative array filled with the values of all the page titles - * @return array - */ - - function get_page_titles() - { - $texts = Array(); - for ( $i = 0; $i < sizeof($this->pages) / 2; $i++ ) - { - $texts[$this->pages[$i]['urlname']] = $this->pages[$i]['name']; - } - return $texts; - } - - /** - * Creates an instance of the Searcher class, including index info for page titles - * @return object - */ - - function makeTitleSearcher($match_case = false) - { - global $db, $session, $paths, $template, $plugins; // Common objects - $search = new Searcher(); - $texts = $this->get_page_titles(); - $search->buildIndex($texts); - if($match_case) - $search->match_case = true; - return $search; - } - -} - -?> diff -r 0931d60f5bdb -r 2b2084ca1e60 includes/render.php~ --- a/includes/render.php~ Wed Jun 13 16:32:27 2007 -0400 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,792 +0,0 @@ -nslist); - for($i=0;$i
'.print_r($paths->cpage,true).''); - - dc_here('render: wreckin\' $template, and reloading the theme vars to match the new page
 | This page is a redirector. This means that this page will not show its own content by default. Instead it will display the contents of the page it redirects to. To create a redirect page, make the first characters in the page content #redirect [[Page_ID]]. For more information, see the Enano Wiki formatting guide. This page redirects to '.$paths->pages[$m[1]]['name'].'. |
'.print_r($nowiki,true).''; - - for($i=0;$i
'.htmlspecialchars($message).''; - - $j = preg_match_all('#\[\[:'.$paths->nslist['File'].'([\w\s0-9_\(\)!@%\^\+\|\.-]+?)\|([0-9]+)\|([0-9]+)\]\]#is', $message, $matchlist); - $matches = Array(); - $matches['images'] = $matchlist[1]; - $matches['widths'] = $matchlist[2]; - $matches['heights'] = $matchlist[3]; - for($i=0;$i
'.htmlspecialchars($message2).''; - //$message = str_replace(array('
([\s]*?)<\/p>#is', '', $result);
- $result = preg_replace('#
([\s]*?)\n", "", $result);
- $result = preg_replace("/
\n", "\n", $result);
- $result = str_replace("", " ", $result);
- $result = str_replace("
", "", $result);
- $result = str_replace("
", "
'.print_r($linklist, true).''; - for($i=0;$i
- $text = '{{Template
- parm1 = Foo
- parm2 = Bar
- }}';
- $text = include_templates($text);
- *
- */
-
- function include_templates($text)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- $template_regex = "/\{\{([A-z0-9_-]+?)((\n([ ]*?)[A-z0-9]+([ ]*?)=([ ]*?)(.+?))*)\}\}/is";
- if ( $count = preg_match_all($template_regex, $text, $matches) )
- {
- for ( $i = 0; $i < $count; $i++ )
- {
- $parmsection = trim($matches[2][$i]);
- if ( !empty($parmsection) )
- {
- $parms = parse_template_vars($parmsection);
- foreach ( $parms as $j => $parm )
- {
- $parms[$j] = $parm;
- }
- }
- else
- {
- $parms = Array();
- }
- if ( $tpl_code = RenderMan::fetch_template_text($matches[1][$i]) )
- {
- $parser = $template->makeParserText($tpl_code);
- $parser->assign_vars($parms);
- $text = str_replace($matches[0][$i], $parser->run(), $text);
- }
- }
- }
- return $text;
- }
-
- /**
- * Preprocesses an HTML text string prior to being sent to MySQL.
- * @param string $text
- * @param bool $strip_all_php - if true, strips all PHP regardless of user permissions. Else, strips PHP only if user level < USER_LEVEL_ADMIN.
- */
- function preprocess_text($text, $strip_all_php = true, $sqlescape = true)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- $random_id = md5( time() . mt_rand() );
-
- $can_do_php = ( $session->get_permissions('php_in_pages') && !$strip_all_php );
-
- $text = sanitize_html($text, ( !$can_do_php ));
-
- if ( !$can_do_php )
- {
- // If we can't do PHP, we can't do Javascript either.
- $text = RenderMan::destroy_javascript($text);
- }
-
- // Strip out '.htmlspecialchars(print_r($phpsec, true))."\n".htmlspecialchars(print_r($text, true)).''); - - for($i=0;$i
\\2';
- $text = preg_replace($regex1, $regex2, $text);
- }
- */
-
- // Strip out '.htmlspecialchars($text).''; - $nw = preg_match_all('#
No private key was found in the config file, and we can\'t generate one because we don\'t have write access to the config file. Please CHMOD config.php to 666 or 777 and reload this page.
'); - } - } - // Check for compatibility mode - if(defined('IN_ENANO_INSTALL')) - { - $q = $db->sql_query('SELECT old_encryption FROM '.table_prefix.'users LIMIT 1;'); - if(!$q) - { - $error = mysql_error(); - if(strstr($error, "Unknown column 'old_encryption'")) - $this->compat = true; - else - $db->_die('This should never happen and is a bug - the only error that was supposed to happen here didn\'t happen. (sessions.php in constructor, during compat mode check)'); - } - $db->free_result(); - } - } - - /** - * PHP 4 compatible constructor. - */ - - function sessionManager() - { - $this->__construct(); - } - - /** - * Wrapper function to sanitize strings for MySQL and HTML - * @param string $text The text to sanitize - * @return string - */ - - function prepare_text($text) - { - global $db; - return $db->escape(htmlspecialchars($text)); - } - - /** - * Makes a SQL query and handles error checking - * @param string $query The SQL query to make - * @return resource - */ - - function sql($query) - { - global $db, $session, $paths, $template, $plugins; // Common objects - $result = $db->sql_query($query); - if(!$result) - { - $db->_die('The error seems to have occurred somewhere in the session management code.'); - } - return $result; - } - - # Session restoration and permissions - - /** - * Initializes the basic state of things, including most user prefs, login data, cookie stuff - */ - - function start() - { - global $db, $session, $paths, $template, $plugins; // Common objects - if($this->started) return; - $this->started = true; - $user = false; - if(isset($_COOKIE['sid'])) - { - if($this->compat) - { - $userdata = $this->compat_validate_session($_COOKIE['sid']); - } - else - { - $userdata = $this->validate_session($_COOKIE['sid']); - } - if(is_array($userdata)) - { - $data = RenderMan::strToPageID($paths->get_pageid_from_url()); - - if(!$this->compat && $userdata['account_active'] != 1 && $data[1] != 'Special' && $data[1] != 'Admin') - { - $this->logout(); - $a = getConfig('account_activation'); - switch($a) - { - case 'none': - default: - $solution = 'Your account was most likely deactivated by an administrator. Please contact the site administration for further assistance.'; - break; - case 'user': - $solution = 'Please check your e-mail; you should have been sent a message with instructions on how to activate your account. If you do not receive an e-mail from this site within 24 hours, please contact the site administration for further assistance.'; - break; - case 'admin': - $solution = 'This website has been configured so that all user accounts must be activated by the administrator before they can be used, so your account will most likely be activated the next time the one of the administrators visits the site.'; - break; - } - die_semicritical('Account error', 'It appears that your user account has not yet been activated. '.$solution.'
'); - } - - $this->sid = $_COOKIE['sid']; - $this->user_logged_in = true; - $this->user_id = intval($userdata['user_id']); - $this->username = $userdata['username']; - $this->password_hash = $userdata['password']; - $this->user_level = intval($userdata['user_level']); - $this->real_name = $userdata['real_name']; - $this->email = $userdata['email']; - $this->unread_pms = $userdata['num_pms']; - if(!$this->compat) - { - $this->theme = $userdata['theme']; - $this->style = $userdata['style']; - $this->signature = $userdata['signature']; - $this->reg_time = $userdata['reg_time']; - } - // Small security risk here - it allows someone who has already authenticated as an administrator to store the "super" key in - // the cookie. Change this to USER_LEVEL_MEMBER to override that. The same 15-minute restriction applies to this "exploit". - $this->auth_level = $userdata['auth_level']; - if(!isset($template->named_theme_list[$this->theme])) - { - if($this->compat || !is_object($template)) - { - $this->theme = 'oxygen'; - $this->style = 'bleu'; - } - else - { - $this->theme = $template->default_theme; - $this->style = $template->default_style; - } - } - $user = true; - - if(isset($_REQUEST['auth']) && !$this->sid_super) - { - // Now he thinks he's a moderator. Or maybe even an administrator. Let's find out if he's telling the truth. - if($this->compat) - { - $key = $_REQUEST['auth']; - $super = $this->compat_validate_session($key); - } - else - { - $key = strrev($_REQUEST['auth']); - $super = $this->validate_session($key); - } - if(is_array($super)) - { - $this->auth_level = intval($super['auth_level']); - $this->sid_super = $_REQUEST['auth']; - } - } - } - } - if(!$user) - { - //exit; - $this->register_guest_session(); - } - if(!$this->compat) - { - // init groups - $q = $this->sql('SELECT g.group_name,g.group_id,m.is_mod FROM '.table_prefix.'groups AS g - LEFT JOIN '.table_prefix.'group_members AS m - ON g.group_id=m.group_id - WHERE ( m.user_id='.$this->user_id.' - OR g.group_name=\'Everyone\') - ' . ( enano_version() == '1.0RC1' ? '' : 'AND ( m.pending != 1 OR m.pending IS NULL )' ) . ' - ORDER BY group_id ASC;'); // Make sure "Everyone" comes first so the permissions can be overridden - if($row = $db->fetchrow()) - { - do { - $this->groups[$row['group_id']] = $row['group_name']; - $this->group_mod[$row['group_id']] = ( intval($row['is_mod']) == 1 ); - } while($row = $db->fetchrow()); - } - else - { - die('No group info'); - } - } - $this->check_banlist(); - - if ( isset ( $_GET['printable'] ) ) - { - $this->theme = 'printable'; - $this->style = 'default'; - } - - } - - # Logins - - /** - * Attempts to perform a login using crypto functions - * @param string $username The username - * @param string $aes_data The encrypted password, hex-encoded - * @param string $aes_key The MD5 hash of the encryption key, hex-encoded - * @param string $challenge The 256-bit MD5 challenge string - first 128 bits should be the hash, the last 128 should be the challenge salt - * @param int $level The privilege level we're authenticating for, defaults to 0 - * @return string 'success' on success, or error string on failure - */ - - function login_with_crypto($username, $aes_data, $aes_key, $challenge, $level = USER_LEVEL_MEMBER) - { - global $db, $session, $paths, $template, $plugins; // Common objects - - $privcache = $this->private_key; - - // Instanciate the Rijndael encryption object - $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE); - - // Fetch our decryption key - - $aes_key = $this->fetch_public_key($aes_key); - if(!$aes_key) - return 'Couldn\'t look up public key "'.$aes_key.'" for decryption'; - - // Convert the key to a binary string - $bin_key = hexdecode($aes_key); - - if(strlen($bin_key) != AES_BITS / 8) - return 'The decryption key is the wrong length'; - - // Decrypt our password - $password = $aes->decrypt($aes_data, $bin_key, ENC_HEX); - - // Initialize our success switch - $success = false; - - // Select the user data from the table, and decrypt that so we can verify the password - $this->sql('SELECT password,old_encryption,user_id,user_level,theme,style,temp_password,temp_password_time FROM '.table_prefix.'users WHERE lcase(username)=\''.$this->prepare_text(strtolower($username)).'\';'); - if($db->numrows() < 1) - return 'The username and/or password is incorrect.'; - $row = $db->fetchrow(); - - // Check to see if we're logging in using a temporary password - - if((intval($row['temp_password_time']) + 3600*24) > time() ) - { - $temp_pass = $aes->decrypt( $row['temp_password'], $this->private_key, ENC_HEX ); - if( $temp_pass == $password ) - { - $url = makeUrlComplete('Special', 'PasswordReset/stage2/' . $row['user_id'] . '/' . $row['temp_password']); - redirect($url, 'Login sucessful', 'Please wait while you are transferred to the Password Reset form.'); - exit; - } - } - - if($row['old_encryption'] == 1) - { - // The user's password is stored using the obsolete and insecure MD5 algorithm, so we'll update the field with the new password - if(md5($password) == $row['password']) - { - $pass_stashed = $aes->encrypt($password, $this->private_key, ENC_HEX); - $this->sql('UPDATE '.table_prefix.'users SET password=\''.$pass_stashed.'\',old_encryption=0 WHERE user_id='.$row['user_id'].';'); - $success = true; - } - } - else - { - // Our password field is up-to-date with the >=1.0RC1 encryption standards, so decrypt the password in the table and see if we have a match; if so then do challenge authentication - $real_pass = $aes->decrypt(hexdecode($row['password']), $this->private_key, ENC_BINARY); - if($password == $real_pass) - { - // Yay! We passed AES authentication, now do an MD5 challenge check to make sure we weren't spoofed - $chal = substr($challenge, 0, 32); - $salt = substr($challenge, 32, 32); - $correct_challenge = md5( $real_pass . $salt ); - if($chal == $correct_challenge) - $success = true; - } - } - if($success) - { - if($level > $row['user_level']) - return 'You are not authorized for this level of access.'; - - $sess = $this->register_session(intval($row['user_id']), $username, $password, $level); - if($sess) - { - $this->username = $username; - $this->user_id = intval($row['user_id']); - $this->theme = $row['theme']; - $this->style = $row['style']; - - if($level > USER_LEVEL_MEMBER) - $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')'); - else - $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')'); - - $code = $plugins->setHook('login_success'); - foreach ( $code as $cmd ) - { - eval($cmd); - } - return 'success'; - } - else - return 'Your login credentials were correct, but an internal error occurred while registering the session key in the database.'; - } - else - { - if($level > USER_LEVEL_MEMBER) - $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')'); - else - $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')'); - - return 'The username and/or password is incorrect.'; - } - } - - /** - * Attempts to login without using crypto stuff, mainly for use when the other side doesn't like Javascript - * This method of authentication is inherently insecure, there's really nothing we can do about it except hope and pray that everyone moves to Firefox - * Technically it still uses crypto, but it only decrypts the password already stored, which is (obviously) required for authentication - * @param string $username The username - * @param string $password The password -OR- the MD5 hash of the password if $already_md5ed is true - * @param bool $already_md5ed This should be set to true if $password is an MD5 hash, and should be false if it's plaintext. Defaults to false. - * @param int $level The privilege level we're authenticating for, defaults to 0 - */ - - function login_without_crypto($username, $password, $already_md5ed = false, $level = USER_LEVEL_MEMBER) - { - global $db, $session, $paths, $template, $plugins; // Common objects - - $pass_hashed = ( $already_md5ed ) ? $password : md5($password); - - // Perhaps we're upgrading Enano? - if($this->compat) - { - return $this->login_compat($username, $pass_hashed, $level); - } - - // Instanciate the Rijndael encryption object - $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE); - - // Initialize our success switch - $success = false; - - // Retrieve the real password from the database - $this->sql('SELECT password,old_encryption,user_id,user_level,temp_password,temp_password_time FROM '.table_prefix.'users WHERE lcase(username)=\''.$this->prepare_text(strtolower($username)).'\';'); - if($db->numrows() < 1) - return 'The username and/or password is incorrect.'; - $row = $db->fetchrow(); - - // Check to see if we're logging in using a temporary password - - if((intval($row['temp_password_time']) + 3600*24) > time() ) - { - $temp_pass = $aes->decrypt( $row['temp_password'], $this->private_key, ENC_HEX ); - if( md5($temp_pass) == $pass_hashed ) - { - header('Location: ' . makeUrlComplete('Special', 'PasswordReset/stage2/' . $row['user_id'] . '/' . $row['temp_password']) ); - exit; - } - } - - if($row['old_encryption'] == 1) - { - // The user's password is stored using the obsolete and insecure MD5 algorithm - we'll update the field with the new password - if($pass_hashed == $row['password'] && !$already_md5ed) - { - $pass_stashed = $aes->encrypt($password, $this->private_key, ENC_HEX); - $this->sql('UPDATE '.table_prefix.'users SET password=\''.$pass_stashed.'\',old_encryption=0 WHERE user_id='.$row['user_id'].';'); - $success = true; - } - elseif($pass_hashed == $row['password'] && $already_md5ed) - { - // We don't have the real password so don't bother with encrypting it, just call it success and get out of here - $success = true; - } - } - else - { - // Our password field is up-to-date with the >=1.0RC1 encryption standards, so decrypt the password in the table and see if we have a match - $real_pass = $aes->decrypt($row['password'], $this->private_key); - if($pass_hashed == md5($real_pass)) - { - $success = true; - } - } - if($success) - { - if((int)$level > (int)$row['user_level']) - return 'You are not authorized for this level of access.'; - $sess = $this->register_session(intval($row['user_id']), $username, $real_pass, $level); - if($sess) - { - if($level > USER_LEVEL_MEMBER) - $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')'); - else - $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')'); - - $code = $plugins->setHook('login_success'); - foreach ( $code as $cmd ) - { - eval($cmd); - } - return 'success'; - } - else - return 'Your login credentials were correct, but an internal error occured while registering the session key in the database.'; - } - else - { - if($level > USER_LEVEL_MEMBER) - $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')'); - else - $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')'); - - return 'The username and/or password is incorrect.'; - } - } - - /** - * Attempts to log in using the old table structure and algorithm. - * @param string $username - * @param string $password This should be an MD5 hash - * @return string 'success' if successful, or error message on failure - */ - - function login_compat($username, $password, $level = 0) - { - global $db, $session, $paths, $template, $plugins; // Common objects - $pass_hashed =& $password; - $this->sql('SELECT password,user_id,user_level FROM '.table_prefix.'users WHERE username=\''.$this->prepare_text($username).'\';'); - if($db->numrows() < 1) - return 'The username and/or password is incorrect.'; - $row = $db->fetchrow(); - if($row['password'] == $password) - { - if((int)$level > (int)$row['user_level']) - return 'You are not authorized for this level of access.'; - $sess = $this->register_session_compat(intval($row['user_id']), $username, $password, $level); - if($sess) - return 'success'; - else - return 'Your login credentials were correct, but an internal error occured while registering the session key in the database.'; - } - else - { - return 'The username and/or password is incorrect.'; - } - } - - /** - * Registers a session key in the database. This function *ASSUMES* that the username and password have already been validated! - * Basically the session key is a base64-encoded cookie (encrypted with the site's private key) that says "u=[username];p=[sha1 of password]" - * @param int $user_id - * @param string $username - * @param string $password - * @param int $level The level of access to grant, defaults to USER_LEVEL_MEMBER - * @return bool - */ - - function register_session($user_id, $username, $password, $level = USER_LEVEL_MEMBER) - { - $salt = md5(microtime() . mt_rand()); - $passha1 = sha1($password); - $session_key = "u=$username;p=$passha1;s=$salt"; - $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE); - $session_key = $aes->encrypt($session_key, $this->private_key, ENC_HEX); - if($level > USER_LEVEL_MEMBER) - { - $hexkey = strrev($session_key); - $this->sid_super = $hexkey; - $_GET['auth'] = $hexkey; - } - else - { - setcookie( 'sid', $session_key, time()+315360000, scriptPath.'/' ); - $_COOKIE['sid'] = $session_key; - } - $keyhash = md5($session_key); - $ip = ip2hex($_SERVER['REMOTE_ADDR']); - if(!$ip) - die('$session->register_session: Remote-Addr was spoofed'); - $time = time(); - if(!is_int($user_id)) - die('Somehow an SQL injection attempt crawled into our session registrar! (1)'); - if(!is_int($level)) - die('Somehow an SQL injection attempt crawled into our session registrar! (2)'); - - $query = $this->sql('INSERT INTO '.table_prefix.'session_keys(session_key, salt, user_id, auth_level, source_ip, time) VALUES(\''.$keyhash.'\', \''.$salt.'\', '.$user_id.', '.$level.', \''.$ip.'\', '.$time.');'); - return true; - } - - /** - * Identical to register_session in nature, but uses the old login/table structure. DO NOT use this. - * @see sessionManager::register_session() - * @access private - */ - - function register_session_compat($user_id, $username, $password, $level = 0) - { - $salt = md5(microtime() . mt_rand()); - $thekey = md5($password . $salt); - if($level > 0) - { - $this->sid_super = $thekey; - } - else - { - setcookie( 'sid', $thekey, time()+315360000, scriptPath.'/' ); - $_COOKIE['sid'] = $thekey; - } - $ip = ip2hex($_SERVER['REMOTE_ADDR']); - if(!$ip) - die('$session->register_session: Remote-Addr was spoofed'); - $time = time(); - if(!is_int($user_id)) - die('Somehow an SQL injection attempt crawled into our session registrar! (1)'); - if(!is_int($level)) - die('Somehow an SQL injection attempt crawled into our session registrar! (2)'); - $query = $this->sql('INSERT INTO '.table_prefix.'session_keys(session_key, salt, user_id, auth_level, source_ip, time) VALUES(\''.$thekey.'\', \''.$salt.'\', '.$user_id.', '.$level.', \''.$ip.'\', '.$time.');'); - return true; - } - - /** - * Creates/restores a guest session - * @todo implement real session management for guests - */ - - function register_guest_session() - { - global $db, $session, $paths, $template, $plugins; // Common objects - $this->username = $_SERVER['REMOTE_ADDR']; - $this->user_level = USER_LEVEL_GUEST; - if($this->compat || defined('IN_ENANO_INSTALL')) - { - $this->theme = 'oxygen'; - $this->style = 'bleu'; - } - else - { - $this->theme = ( isset($_GET['theme']) && isset($template->named_theme_list[$_GET['theme']])) ? $_GET['theme'] : $template->default_theme; - $this->style = ( isset($_GET['style']) && file_exists(ENANO_ROOT.'/themes/'.$this->theme . '/css/'.$_GET['style'].'.css' )) ? $_GET['style'] : substr($template->named_theme_list[$this->theme]['default_style'], 0, strlen($template->named_theme_list[$this->theme]['default_style'])-4); - } - $this->user_id = 1; - } - - /** - * Validates a session key, and returns the userdata associated with the key or false - * @param string $key The session key to validate - * @return array Keys are 'user_id', 'username', 'email', 'real_name', 'user_level', 'theme', 'style', 'signature', 'reg_time', 'account_active', 'activation_key', and 'auth_level' or bool false if validation failed. The key 'auth_level' is the maximum authorization level that this key provides. - */ - - function validate_session($key) - { - global $db, $session, $paths, $template, $plugins; // Common objects - $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE, true); - $decrypted_key = $aes->decrypt($key, $this->private_key, ENC_HEX); - - if ( !$decrypted_key ) - { - die_semicritical('AES encryption error', 'Something went wrong during the AES decryption process.
'.print_r($decrypted_key, true).''); - } - - $n = preg_match('/^u='.$this->valid_username.';p=([A-Fa-f0-9]+?);s=([A-Fa-f0-9]+?)$/', $decrypted_key, $keydata); - if($n < 1) - { - // echo '(debug) $session->validate_session: Key does not match regex
'.print_r($keydata, true).''); - if(sha1($real_pass) != $keydata[2]) - { - // Failed password check - // echo '(debug) $session->validate_session: encrypted password is wrong
'.print_r($keydata, true).''); - if($real_key != $key) - { - // Failed password check - // echo '(debug) $session->validate_session: supplied password is wrong
'.print_r($deps, true).''); - foreach($deps as $d) - { - if ( !$this->get_permissions($d) ) - { - return false; - } - } - return true; - } - - /** - * Makes a CAPTCHA code and caches the code in the database - * @param int $len The length of the code, in bytes - * @return string A unique identifier assigned to the code. This hash should be passed to sessionManager::getCaptcha() to retrieve the code. - */ - - function make_captcha($len = 7) - { - $chars = array('A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', '1', '2', '3', '4', '5', '6', '7', '8', '9'); - $s = ''; - for($i=0;$i<$len;$i++) $s .= $chars[mt_rand(0, count($chars)-1)]; - $hash = md5(microtime() . mt_rand()); - $this->sql('INSERT INTO '.table_prefix.'session_keys(session_key,salt,auth_level,source_ip,user_id) VALUES(\''.$hash.'\', \''.$s.'\', -1, \''.ip2hex($_SERVER['REMOTE_ADDR']).'\', -2);'); - return $hash; - } - - /** - * For the given code ID, returns the correct CAPTCHA code, or false on failure - * @param string $hash The unique ID assigned to the code - * @return string The correct confirmation code - */ - - function get_captcha($hash) - { - global $db, $session, $paths, $template, $plugins; // Common objects - $s = $this->sql('SELECT salt FROM '.table_prefix.'session_keys WHERE session_key=\''.$db->escape($hash).'\' AND source_ip=\''.ip2hex($_SERVER['REMOTE_ADDR']).'\';'); - if($db->numrows() < 1) return false; - $r = $db->fetchrow(); - return $r['salt']; - } - - /** - * Deletes all CAPTCHA codes cached in the DB for this user. - */ - - function kill_captcha() - { - $this->sql('DELETE FROM '.table_prefix.'session_keys WHERE user_id=-2 AND source_ip=\''.ip2hex($_SERVER['REMOTE_ADDR']).'\';'); - } - - /** - * Generates a random password. - * @param int $length Optional - length of password - * @return string - */ - - function random_pass($length = 10) - { - $valid_chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_+@#%&<>'; - $valid_chars = enano_str_split($valid_chars); - $ret = ''; - for ( $i = 0; $i < $length; $i++ ) - { - $ret .= $valid_chars[mt_rand(0, count($valid_chars)-1)]; - } - return $ret; - } - - /** - * Generates some Javascript that calls the AES encryption library. - * @param string The name of the form - * @param string The name of the password field - * @param string The name of the field that switches encryption on or off - * @param string The name of the field that contains the encryption key - * @param string The name of the field that will contain the encrypted password - * @param string The name of the field that handles MD5 challenge data - * @return string - */ - - function aes_javascript($form_name, $pw_field, $use_crypt, $crypt_key, $crypt_data, $challenge) - { - $code = ' - - '; - return $code; - } - -} - -/** - * Class used to fetch permissions for a specific page. Used internally by SessionManager. - * @package Enano - * @subpackage Session manager - * @license http://www.gnu.org/copyleft/gpl.html - * @access private - */ - -class Session_ACLPageInfo { - - /** - * The page ID of this ACL info package - * @var string - */ - - var $page_id; - - /** - * The namespace of the page being checked - * @var string - */ - - var $namespace; - - /** - * Our list of permission types. - * @access private - * @var array - */ - - var $acl_types = Array(); - - /** - * The list of descriptions for the permission types - * @var array - */ - - var $acl_descs = Array(); - - /** - * A list of dependencies for ACL types. - * @var array - */ - - var $acl_deps = Array(); - - /** - * Our tell-all list of permissions. - * @access private - or, preferably, protected...too bad this has to be PHP4 compatible - * @var array - */ - - var $perms = Array(); - - /** - * Constructor. - * @param string $page_id The ID of the page to check - * @param string $namespace The namespace of the page to check. - * @param array $acl_types List of ACL types - * @param array $acl_descs List of human-readable descriptions for permissions (associative) - * @param array $acl_deps List of dependencies for permissions. For example, viewing history/diffs depends on the ability to read the page. - * @param array $base What to start with - this is an attempt to reduce the number of SQL queries. - */ - - function Session_ACLPageInfo($page_id, $namespace, $acl_types, $acl_descs, $acl_deps, $base) - { - global $db, $session, $paths, $template, $plugins; // Common objects - - $this->perms = $session->acl_merge_complete($acl_types, $base); - $this->acl_deps = $acl_deps; - $this->acl_types = $acl_types; - $this->acl_descs = $acl_descs; - - // Build a query to grab ACL info - $bs = 'SELECT rules FROM '.table_prefix.'acl WHERE ( '; - $q = Array(); - $q[] = '( target_type='.ACL_TYPE_USER.' AND target_id='.$session->user_id.' )'; - if(count($session->groups) > 0) - { - foreach($session->groups as $g_id => $g_name) - { - $q[] = '( target_type='.ACL_TYPE_GROUP.' AND target_id='.intval($g_id).' )'; - } - } - // The reason we're using an ORDER BY statement here is because ACL_TYPE_GROUP is less than ACL_TYPE_USER, causing the user's individual - // permissions to override group permissions. - $bs .= implode(' OR ', $q) . ' ) AND ( page_id=\''.$db->escape($page_id).'\' AND namespace=\''.$db->escape($namespace).'\' ) - ORDER BY target_type ASC, page_id ASC, namespace ASC;'; - $q = $session->sql($bs); - if ( $row = $db->fetchrow() ) - { - do { - $rules = $session->string_to_perm($row['rules']); - $this->perms = $session->acl_merge($this->perms, $rules); - } while ( $row = $db->fetchrow() ); - } - - $this->page_id = $page_id; - $this->namespace = $namespace; - } - - /** - * Tells us whether permission $type is allowed or not based on the current rules. - * @param string $type The permission identifier ($acl_type passed to sessionManager::register_acl_type()) - * @param bool $no_deps If true, disables dependency checking - * @return bool True if allowed, false if denied or if an error occured - */ - - function get_permissions($type, $no_deps = false) - { - global $db, $session, $paths, $template, $plugins; // Common objects - if ( isset( $this->perms[$type] ) ) - { - if ( $this->perms[$type] == AUTH_DENY ) - $ret = false; - else if ( $this->perms[$type] == AUTH_WIKIMODE && - ( isset($paths->pages[$paths->nslist[$this->namespace].$this->page_id]) && - ( $paths->pages[$paths->nslist[$this->namespace].$this->page_id]['wiki_mode'] == '1' || - ( $paths->pages[$paths->nslist[$this->namespace].$this->page_id]['wiki_mode'] == '2' - && getConfig('wiki_mode') == '1' - ) ) ) ) - $ret = true; - else if ( $this->perms[$type] == AUTH_WIKIMODE && ( - !isset($paths->pages[$paths->nslist[$this->namespace].$this->page_id]) - || ( - isset($paths->pages[$paths->nslist[$this->namespace].$this->page_id]) && ( - $paths->pages[$paths->nslist[$this->namespace].$this->page_id]['wiki_mode'] == '0' - || ( - $paths->pages[$paths->nslist[$this->namespace].$this->page_id]['wiki_mode'] == '2' && getConfig('wiki_mode') != '1' - ) ) ) ) ) - $ret = false; - else if ( $this->perms[$type] == AUTH_ALLOW ) - $ret = true; - else if ( $this->perms[$type] == AUTH_DISALLOW ) - $ret = false; - } - else if(isset($this->acl_types[$type])) - { - if ( $this->acl_types[$type] == AUTH_DENY ) - $ret = false; - else if ( $this->acl_types[$type] == AUTH_WIKIMODE && $paths->wiki_mode ) - $ret = true; - else if ( $this->acl_types[$type] == AUTH_WIKIMODE && !$paths->wiki_mode ) - $ret = false; - else if ( $this->acl_types[$type] == AUTH_ALLOW ) - $ret = true; - else if ( $this->acl_types[$type] == AUTH_DISALLOW ) - $ret = false; - } - else - { - // ACL type is undefined - trigger_error('Unknown access type "' . $type . '"', E_USER_WARNING); - return false; // Be on the safe side and deny access - } - if ( !$no_deps ) - { - if ( !$this->acl_check_deps($type) ) - return false; - } - return $ret; - } - - /** - * Tell us if the dependencies for a given permission are met. - * @param string The ACL permission ID - * @return bool - */ - - function acl_check_deps($type) - { - if(!isset($this->acl_deps[$type])) // This will only happen if the permissions table is hacked or improperly accessed - return true; - if(sizeof($this->acl_deps[$type]) < 1) - return true; - $deps = $this->acl_deps[$type]; - while(true) - { - $full_resolved = true; - $j = sizeof($deps); - for ( $i = 0; $i < $j; $i++ ) - { - $b = $deps; - $deps = array_merge($deps, $this->acl_deps[$deps[$i]]); - if( $b == $deps ) - { - break 2; - } - $j = sizeof($deps); - } - } - //die('
'.print_r($deps, true).''); - foreach($deps as $d) - { - if ( !$this->get_permissions($d) ) - { - return false; - } - } - return true; - } - -} - -?> diff -r 0931d60f5bdb -r 2b2084ca1e60 includes/template.php~ --- a/includes/template.php~ Wed Jun 13 16:32:27 2007 -0400 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,1785 +0,0 @@ -tpl_bool = Array(); - $this->tpl_strings = Array(); - $this->sidebar_extra = ''; - $this->toolbar_menu = ''; - $this->additional_headers = ''; - $this->plugin_blocks = Array(); - $this->theme_loaded = false; - - $this->theme_list = Array(); - $this->named_theme_list = Array(); - $e = $db->sql_query('SELECT theme_id,theme_name,enabled,default_style FROM '.table_prefix.'themes WHERE enabled=1 ORDER BY theme_order;'); - if(!$e) $db->_die('The list of themes could not be selected.'); - for($i=0;$i < $db->numrows(); $i++) - { - $this->theme_list[$i] = $db->fetchrow(); - $this->named_theme_list[$this->theme_list[$i]['theme_id']] = $this->theme_list[$i]; - } - $db->free_result(); - $this->default_theme = $this->theme_list[0]['theme_id']; - $dir = ENANO_ROOT.'/themes/'.$this->default_theme.'/css/'; - $list = Array(); - // Open a known directory, and proceed to read its contents - if (is_dir($dir)) { - if ($dh = opendir($dir)) { - while (($file = readdir($dh)) !== false) { - if(preg_match('#^(.*?)\.css$#i', $file) && $file != '_printable.css') { - $list[] = substr($file, 0, strlen($file)-4); - } - } - closedir($dh); - } - } - - $def = ENANO_ROOT.'/themes/'.$this->default_theme.'/css/'.$this->named_theme_list[$this->default_theme]['default_style']; - if(file_exists($def)) - { - $this->default_style = substr($this->named_theme_list[$this->default_theme]['default_style'], 0, strlen($this->named_theme_list[$this->default_theme]['default_style'])-4); - } else { - $this->default_style = $list[0]; - } - - $this->style_list = $list; - - } - function template() - { - $this->__construct(); - } - function sidebar_widget($t, $h) - { - global $db, $session, $paths, $template, $plugins; // Common objects - if(!defined('ENANO_TEMPLATE_LOADED')) - { - $this->load_theme($session->theme, $session->style); - } - if(!$this->sidebar_widgets) - $this->sidebar_widgets = ''; - $tplvars = $this->extract_vars('elements.tpl'); - $parser = $this->makeParserText($tplvars['sidebar_section_raw']); - $parser->assign_vars(Array('TITLE'=>$t,'CONTENT'=>$h)); - $this->plugin_blocks[$t] = $h; - $this->sidebar_widgets .= $parser->run(); - } - function add_header($html) - { - $this->additional_headers .= "\n" . $html; - } - function get_css($s = false) - { - global $db, $session, $paths, $template, $plugins; // Common objects - if(!defined('ENANO_TEMPLATE_LOADED')) - $this->load_theme($session->theme, $session->style); - $path = ( $s ) ? 'css/'.$s : 'css/'.$this->style.'.css'; - if ( !file_exists(ENANO_ROOT . '/themes/' . $this->theme . '/' . $path) ) - { - echo "/* WARNING: Falling back to default file because file $path does not exist */\n"; - $path = 'css/' . $this->style_list[0] . '.css'; - } - return $this->process_template($path); - } - function load_theme($name = false, $css = false) - { - global $db, $session, $paths, $template, $plugins; // Common objects - $this->theme = ( $name ) ? $name : $session->theme; - $this->style = ( $css ) ? $css : $session->style; - if ( !$this->theme ) - { - $this->theme = $this->theme_list[0]['theme_id']; - $this->style = substr($this->theme_list[0]['default_style'], 0, strlen($this->theme_list[0]['default_style'])-4); - } - $this->theme_loaded = true; - } - - function init_vars() - { - global $db, $session, $paths, $template, $plugins; // Common objects - global $email; - - dc_here("template: initializing all variables"); - - if(!$this->theme || !$this->style) - { - $this->load_theme(); - } - - if(defined('ENANO_TEMPLATE_LOADED')) - { - dc_here('template: access denied to call template::init_vars(), bailing out'); - die_semicritical('Illegal call', '
$template->load_theme was called multiple times, this is not supposed to happen. Exiting with fatal error.
'); - } - - define('ENANO_TEMPLATE_LOADED', ''); - - $tplvars = $this->extract_vars('elements.tpl'); - - dc_here('template: setting all template vars'); - - if(isset($_SERVER['HTTP_USER_AGENT']) && strstr($_SERVER['HTTP_USER_AGENT'], 'MSIE')) - { - $this->add_header(' - - '); - } - - // Get the "article" button text (depends on namespace) - switch($paths->namespace) { - case "Article": - default: - $ns = 'article'; - break; - case "Admin": - $ns = 'administration page'; - break; - case "System": - $ns = 'system message'; - break; - case "File": - $ns = 'uploaded file'; - break; - case "Help": - $ns = 'documentation page'; - break; - case "User": - $ns = 'user page'; - break; - case "Special": - $ns = 'special page'; - break; - case "Template": - $ns = 'template'; - break; - case "Project": - $ns = 'project page'; - break; - case "Category": - $ns = 'category'; - break; - } - $this->namespace_string = $ns; - $code = $plugins->setHook('page_type_string_set'); - foreach ( $code as $cmd ) - { - eval($cmd); - } - $ns =& $this->namespace_string; - - // Initialize the toolbar - $tb = ''; - - // Create "xx page" button - - $btn_selected = ( isset($tplvars['toolbar_button_selected'])) ? $tplvars['toolbar_button_selected'] : $tplvars['toolbar_button']; - $parser = $this->makeParserText($btn_selected); - - $parser->assign_vars(array( - 'FLAGS' => 'onclick="void(ajaxReset()); return false;" title="View the page contents, all of the page contents, and nothing but the page contents (alt-a)" accesskey="a"', - 'PARENTFLAGS' => 'id="mdgToolbar_article"', - 'HREF' => makeUrl($paths->page, null, true), - 'TEXT' => $this->namespace_string - )); - - $tb .= $parser->run(); - - $button = $this->makeParserText($tplvars['toolbar_button']); - - // Page toolbar - // Comments button - if ( $session->get_permissions('read') && getConfig('enable_comments')=='1' && $paths->namespace != 'Special' && $paths->namespace != 'Admin' && $paths->cpage['comments_on'] == 1 ) - { - - $e = $db->sql_query('SELECT approved FROM '.table_prefix.'comments WHERE page_id=\''.$paths->cpage['urlname_nons'].'\' AND namespace=\''.$paths->namespace.'\';'); - if ( !$e ) - { - $db->_die(); - } - $nc = $db->numrows(); - $nu = 0; - $na = 0; - - while ( $r = $db->fetchrow() ) - { - if ( !$r['approved'] ) - { - $nu++; - } - else - { - $na++; - } - } - - $db->free_result(); - $n = ( $session->get_permissions('mod_comments') ) ? (string)$nc : (string)$na; - if ( $session->get_permissions('mod_comments') && $nu > 0 ) - { - $n .= ' total/'.$nu.' unapp.'; - } - - $button->assign_vars(array( - 'FLAGS' => 'onclick="void(ajaxComments()); return false;" title="View the comments that other users have posted about this page (alt-c)" accesskey="c"', - 'PARENTFLAGS' => 'id="mdgToolbar_discussion"', - 'HREF' => makeUrl($paths->page, 'do=comments', true), - 'TEXT' => 'discussion ('.$n.')', - )); - - $tb .= $button->run(); - } - // Edit button - if($session->get_permissions('read') && ($paths->namespace != 'Special' && $paths->namespace != 'Admin') && ( $session->get_permissions('edit_page') && ( ( $paths->page_protected && $session->get_permissions('even_when_protected') ) || !$paths->page_protected ) ) ) - { - $button->assign_vars(array( - 'FLAGS' => 'onclick="void(ajaxEditor()); return false;" title="Edit the contents of this page (alt-e)" accesskey="e"', - 'PARENTFLAGS' => 'id="mdgToolbar_edit"', - 'HREF' => makeUrl($paths->page, 'do=edit', true), - 'TEXT' => 'edit this page' - )); - $tb .= $button->run(); - // View source button - } - else if($session->get_permissions('view_source') && ( !$session->get_permissions('edit_page') || !$session->get_permissions('even_when_protected') && $paths->page_protected ) && $paths->namespace != 'Special' && $paths->namespace != 'Admin') - { - $button->assign_vars(array( - 'FLAGS' => 'onclick="void(ajaxViewSource()); return false;" title="View the source code (wiki markup) that this page uses (alt-e)" accesskey="e"', - 'PARENTFLAGS' => 'id="mdgToolbar_edit"', - 'HREF' => makeUrl($paths->page, 'do=viewsource', true), - 'TEXT' => 'view source' - )); - $tb .= $button->run(); - } - // History button - if ( $session->get_permissions('read') /* && $paths->wiki_mode */ && $paths->page_exists && $paths->namespace != 'Special' && $paths->namespace != 'Admin' && $session->get_permissions('history_view') ) - { - $button->assign_vars(array( - 'FLAGS' => 'onclick="void(ajaxHistory()); return false;" title="View a log of actions taken on this page (alt-h)" accesskey="h"', - 'PARENTFLAGS' => 'id="mdgToolbar_history"', - 'HREF' => makeUrl($paths->page, 'do=history', true), - 'TEXT' => 'history' - )); - $tb .= $button->run(); - } - - $menubtn = $this->makeParserText($tplvars['toolbar_menu_button']); - - // Additional actions menu - // Rename button - if ( $session->get_permissions('read') && $paths->page_exists && ( $session->get_permissions('rename') && ( $paths->page_protected && $session->get_permissions('even_when_protected') || !$paths->page_protected ) ) && $paths->namespace != 'Special' && $paths->namespace != 'Admin' ) - { - $menubtn->assign_vars(array( - 'FLAGS' => 'onclick="void(ajaxRename()); return false;" title="Change the display name of this page (alt-r)" accesskey="r"', - 'HREF' => makeUrl($paths->page, 'do=rename', true), - 'TEXT' => 'rename', - )); - $this->toolbar_menu .= $menubtn->run(); - } - - // Vote-to-delete button - if ( $paths->wiki_mode && $session->get_permissions('vote_delete') && $paths->page_exists && $paths->namespace != 'Special' && $paths->namespace != 'Admin') - { - $menubtn->assign_vars(array( - 'FLAGS' => 'onclick="void(ajaxDelVote()); return false;" title="Vote to have this page deleted (alt-d)" accesskey="d"', - 'HREF' => makeUrl($paths->page, 'do=delvote', true), - 'TEXT' => 'vote to delete this page', - )); - $this->toolbar_menu .= $menubtn->run(); - } - - // Clear-votes button - if ( $session->get_permissions('read') && $paths->wiki_mode && $paths->page_exists && $paths->namespace != 'Special' && $paths->namespace != 'Admin' && $session->get_permissions('vote_reset') && $paths->cpage['delvotes'] > 0) - { - $menubtn->assign_vars(array( - 'FLAGS' => 'onclick="void(ajaxResetDelVotes()); return false;" title="Vote to have this page deleted (alt-y)" accesskey="y"', - 'HREF' => makeUrl($paths->page, 'do=resetvotes', true), - 'TEXT' => 'reset deletion votes', - )); - $this->toolbar_menu .= $menubtn->run(); - } - - // Printable page button - if ( $paths->page_exists && $paths->namespace != 'Special' && $paths->namespace != 'Admin' ) - { - $menubtn->assign_vars(array( - 'FLAGS' => 'title="View a version of this page that is suitable for printing"', - 'HREF' => makeUrl($paths->page, 'printable=yes', true), - 'TEXT' => 'view printable version', - )); - $this->toolbar_menu .= $menubtn->run(); - } - - // Protect button - if($session->get_permissions('read') && $paths->wiki_mode && $paths->page_exists && $paths->namespace != 'Special' && $paths->namespace != 'Admin' && $session->get_permissions('protect')) - { - - $label = $this->makeParserText($tplvars['toolbar_label']); - $label->assign_vars(array('TEXT' => 'protection:')); - $t0 = $label->run(); - - $ctmp = ''; - if ( $paths->cpage['protected'] == 1 ) - { - $ctmp=' style="text-decoration: underline;"'; - } - $menubtn->assign_vars(array( - 'FLAGS' => 'accesskey="i" onclick="ajaxProtect(1); return false;" id="protbtn_1" title="Prevents all non-administrators from editing this page. [alt-i]"'.$ctmp, - 'HREF' => makeUrl($paths->page, 'do=protect&level=1', true), - 'TEXT' => 'on' - )); - $t1 = $menubtn->run(); - - $ctmp = ''; - if ( $paths->cpage['protected'] == 0 ) - { - $ctmp=' style="text-decoration: underline;"'; - } - $menubtn->assign_vars(array( - 'FLAGS' => 'accesskey="o" onclick="ajaxProtect(0); return false;" id="protbtn_0" title="Allows everyone to edit this page. [alt-o]"'.$ctmp, - 'HREF' => makeUrl($paths->page, 'do=protect&level=0', true), - 'TEXT' => 'off' - )); - $t2 = $menubtn->run(); - - $ctmp = ''; - if ( $paths->cpage['protected'] == 2 ) - { - $ctmp = ' style="text-decoration: underline;"'; - } - $menubtn->assign_vars(array( - 'FLAGS' => 'accesskey="p" onclick="ajaxProtect(2); return false;" id="protbtn_2" title="Allows only users who have been registered for 4 days to edit this page. [alt-p]"'.$ctmp, - 'HREF' => makeUrl($paths->page, 'do=protect&level=2', true), - 'TEXT' => 'semi' - )); - $t3 = $menubtn->run(); - - $this->toolbar_menu .= '| '.$t0.' | -'.$t1.' | -'.$t2.' | -'.$t3.' | -
| '.$t0.' | -'.$t1.' | -'.$t2.' | -'.$t3.' | -
| '.$t0.' | '.$t.' |
'; - echo $db->sql_backtrace(); - echo ''; - } - - $f = microtime_float(); - $f = $f - $_starttime; - $f = round($f, 4); - $dbg = 'Time: '.$f.'s | Queries: '.$db->num_queries; - $t = ( $simple ) ? $this->process_template('simple-footer.tpl') : $this->process_template('footer.tpl'); - $t = str_replace('[[Stats]]', $dbg, $t); - $t = str_replace('[[NumQueries]]', (string)$db->num_queries, $t); - $t = str_replace('[[GenTime]]', (string)$f, $t); - echo $t; - - ob_end_flush(); - } - else return ''; - } - function getHeader() - { - $headers_sent = true; - dc_here('template: generating and sending the page header'); - if(!defined('ENANO_HEADERS_SENT')) - define('ENANO_HEADERS_SENT', ''); - if(!$this->no_headers) return $this->process_template('header.tpl'); - } - function getFooter() - { - global $db, $session, $paths, $template, $plugins; // Common objects - dc_here('template: generating and sending the page footer'); - if(!$this->no_headers) { - global $_starttime; - $t = ''; - - if(isset($_GET['sqldbg']) && $session->get_permissions('mod_misc')) - { - $t .= '
'; - $t .= $db->sql_backtrace(); - $t .= ''; - } - - $f = microtime_float(); - $f = $f - $_starttime; - $f = round($f, 4); - $dbg = 'Time: '.$f.'s | Queries: '.$db->num_queries; - $t.= $this->process_template('footer.tpl'); - $t = str_replace('[[Stats]]', $dbg, $t); - $t = str_replace('[[NumQueries]]', (string)$db->num_queries, $t); - $t = str_replace('[[GenTime]]', (string)$f, $t); - return $t; - } - else return ''; - } - - function process_template($file) { - global $db, $session, $paths, $template, $plugins; // Common objects - if(!defined('ENANO_TEMPLATE_LOADED')) - { - $this->load_theme(); - $this->init_vars(); - } - eval($this->compile_template($file)); - return $tpl_code; - } - - function extract_vars($file) { - global $db, $session, $paths, $template, $plugins; // Common objects - if(!$this->theme) - { - die('$template->extract_vars(): theme not yet loaded, so we can\'t open template files yet...this is a bug and should be reported.
'.enano_debug_print_backtrace(true).''); - } - if(!is_file(ENANO_ROOT . '/themes/'.$this->theme.'/'.$file)) die('Cannot find '.$file.' file for style "'.$this->theme.'", exiting'); - $text = file_get_contents(ENANO_ROOT . '/themes/'.$this->theme.'/'.$file); - preg_match_all('#<\!-- VAR ([A-z0-9_-]*) -->(.*?)<\!-- ENDVAR \\1 -->#is', $text, $matches); - $tplvars = Array(); - for($i=0;$i
'.htmlspecialchars(print_r($m, true)).''); - for($i = 0; $i < sizeof($m[1]); $i++) - { - $text = str_replace("", "{PHPCODE:{$i}:{$seed}}", $text); - } - //die('
'.htmlspecialchars($text).''); - $text = 'ob_start(); echo \''.str_replace('\'', '\\\'', $text).'\'; $tpl_code = ob_get_contents(); ob_end_clean();'; - $text = preg_replace('##is', '\'; if(isset($this->tpl_bool[\'\\1\']) && $this->tpl_bool[\'\\1\']) { echo \'', $text); - $text = preg_replace('##is', '\'; if(isset($this->tpl_strings[\'\\1\'])) { echo \'', $text); - $text = preg_replace('##is', '\'; if(getConfig(\'plugin_\\1\')==\'1\') { echo \'', $text); - $text = preg_replace('##is', '\'; echo $template->tplWikiFormat($paths->sysMsg(\'\\1\')); echo \'', $text); - $text = preg_replace('##is', '\'; if(!$this->tpl_bool[\'\\1\']) { echo \'', $text); - $text = preg_replace('##is', '\'; } else { echo \'', $text); - $text = preg_replace('##is', '\'; } echo \'', $text); - $text = preg_replace('#\{([A-z0-9]*)\}#is', '\'.$this->tpl_strings[\'\\1\'].\'', $text); - for($i = 0; $i < sizeof($m[1]); $i++) - { - $text = str_replace("{PHPCODE:{$i}:{$seed}}", "'; {$m[1][$i]} echo '", $text); - } - if(is_writable(ENANO_ROOT.'/cache/') && getConfig('cache_thumbs')=='1') - { - //die($tpl_filename); - $h = fopen($tpl_filename, 'w'); - if(!$h) return $text; - $t = addslashes($text); - fwrite($h, ''); - fclose($h); - } - return $text; //('
'.htmlspecialchars($text).''); - } - - function compile_template_text($text) { - $seed = md5 ( microtime() . mt_rand() ); - preg_match_all("/<\?php(.*?)\?>/is", $text, $m); - //die('
'.htmlspecialchars(print_r($m, true)).''); - for($i = 0; $i < sizeof($m[1]); $i++) - { - $text = str_replace("", "{PHPCODE:{$i}:{$seed}}", $text); - } - //die('
'.htmlspecialchars($text).''); - $text = 'ob_start(); echo \''.str_replace('\'', '\\\'', $text).'\'; $tpl_code = ob_get_contents(); ob_end_clean(); return $tpl_code;'; - $text = preg_replace('##is', '\'; if(isset($this->tpl_bool[\'\\1\']) && $this->tpl_bool[\'\\1\']) { echo \'', $text); - $text = preg_replace('##is', '\'; if(isset($this->tpl_strings[\'\\1\'])) { echo \'', $text); - $text = preg_replace('##is', '\'; if(getConfig(\'plugin_\\1\')==\'1\') { echo \'', $text); - $text = preg_replace('##is', '\'; echo $template->tplWikiFormat($paths->sysMsg(\'\\1\')); echo \'', $text); - $text = preg_replace('##is', '\'; if(!$this->tpl_bool[\'\\1\']) { echo \'', $text); - $text = preg_replace('##is', '\'; } else { echo \'', $text); - $text = preg_replace('##is', '\'; } echo \'', $text); - $text = preg_replace('#\{([A-z0-9]*)\}#is', '\'.$this->tpl_strings[\'\\1\'].\'', $text); - for($i = 0; $i < sizeof($m[1]); $i++) - { - $text = str_replace("{PHPCODE:{$i}:{$seed}}", "'; {$m[1][$i]} echo '", $text); - } - return $text; //('
'.htmlspecialchars($text).''); - } - - function parse($text) - { - $text = $this->compile_template_text($text); - return eval($text); - } - - // Steps to turn this: - // [[Project:Community Portal]] - // into this: - // Community Portal - // Must be done WITHOUT creating eval'ed code!!! - - // 1. preg_replace \[\[([a-zA-Z0-9 -_:]*?)\]\] with \\1 - // 2. preg_match_all - // 3. For each match, replace matches with identifiers - // 4. For each match, str_replace ' ' with '_' - // 5. For each match, str_replace match_id:random_val with $matches[$match_id] - - // The template language is really a miniature programming language; with variables, conditionals, everything! - // So you can implement custom logic into your sidebar if you wish. - // "Real" PHP support coming soon :-D - - function tplWikiFormat($message, $filter_links = false, $filename = 'elements.tpl') { - global $db, $session, $paths, $template, $plugins; // Common objects - $filter_links = false; - $tplvars = $this->extract_vars($filename); - if($session->sid_super) $as = htmlspecialchars(urlSeparator).'auth='.$session->sid_super; - else $as = ''; - error_reporting(E_ALL); - $random_id = sha1(microtime().''); // A temp value - - /* - * PREPROCESSOR - */ - - // Variables - - preg_match_all('#\$([A-Z_-]+)\$#', $message, $links); - $links = $links[1]; - - for($i=0;$i
Error: Syntax error (possibly XSS attack) caught in template code:
'; - echo '';
- echo '{if '.$links[1][$i].'}';
- echo "\n ";
- for($k=0;$k<$j;$k++) echo " ";
- echo '^';
- echo '';
- continue 2;
- }
- if($current_var != '')
- {
- $cd = '( isset($this->tpl_bool[\''.$current_var.'\']) && $this->tpl_bool[\''.$current_var.'\'] )';
- $cvt = substr($links[1][$i], 0, $current_var_start_pos) . $cd . substr($links[1][$i], $current_var_end_pos, strlen($links[1][$i]));
- $j = $j + strlen($cd) - strlen($current_var);
- $current_var = '';
- $links[1][$i] = $cvt;
- $d = strlen($links[1][$i]);
- }
- }
- $links[1][$i] = substr($links[1][$i], 0, strlen($links[1][$i])-1);
- $links[1][$i] = '$chk = ( '.$links[1][$i].' ) ? true : false;';
- eval($links[1][$i]);
-
- if($chk) { // isset($this->tpl_bool[$links[1][$i]]) && $this->tpl_bool[$links[1][$i]]
- if(strstr($links[2][$i], '{else}')) $c = substr($links[2][$i], 0, strpos($links[2][$i], '{else}'));
- else $c = $links[2][$i];
- $message = str_replace('{CONDITIONAL:'.$i.':'.$random_id.'}', $c, $message);
- } else {
- if(strstr($links[2][$i], '{else}')) $c = substr($links[2][$i], strpos($links[2][$i], '{else}')+6, strlen($links[2][$i]));
- else $c = '';
- $message = str_replace('{CONDITIONAL:'.$i.':'.$random_id.'}', $c, $message);
- }
- }
-
- preg_match_all('#\{!if ([A-Za-z_-]*)\}(.*?)\{\/if\}#is', $message, $links);
-
- for($i=0;$i'.htmlspecialchars($message).''); - //eval($message); exit; - return $message; - } - - /** - * Print a text field that auto-completes a username entered into it. - * @param string $name - the name of the form field - * @return string - */ - - function username_field($name, $value = false) - { - $randomid = md5( time() . microtime() . mt_rand() ); - $text = ''; - return $text; - } - - /** - * Sends a textarea that can be converted to and from a TinyMCE widget on the fly. - * @param string The name of the form element - * @param string The initial content. Optional, defaults to blank - * @param int Rows in textarea - * @param int Columns in textarea - * @return string HTML and Javascript code. - */ - - function tinymce_textarea($name, $content = '', $rows = 20, $cols = 60) - { - $randomid = md5(microtime() . mt_rand()); - $html = ''; - $html .= ''; - $html .= '
';
- if(getConfig('sflogo_enabled')=='1')
- {
- $ob[] = '
'.htmlspecialchars($text).''); - } - - function compile_template_text($text) { - global $sideinfo; - $text = str_replace('', '', $text); // Remove the AJAX code - we don't need it, and it requires a database connection - $text = '$tpl_code = \''.str_replace('\'', '\\\'', $text).'\'; return $tpl_code;'; - $text = preg_replace('##is', '\'; if($this->tpl_bool[\'\\1\']) { $tpl_code .= \'', $text); - $text = preg_replace('##is', '\'; if(getConfig(\'plugin_\\1\')==\'1\') { $tpl_code .= \'', $text); - if(defined('IN_ENANO_INSTALL')) $text = str_replace('', '', $text); - else $text = str_replace('', '', $text); - $text = preg_replace('##is', '', $text); - $text = preg_replace('##is', '\'; if(!$this->tpl_bool[\'\\1\']) { $tpl_code .= \'', $text); - $text = preg_replace('##is', '\'; } else { $tpl_code .= \'', $text); - $text = preg_replace('##is', '\'; } $tpl_code .= \'', $text); - $text = preg_replace('#{([A-z0-9]*)}#is', '\'.$this->tpl_strings[\'\\1\'].\'', $text); - return $text; //('
'.htmlspecialchars($text).''); - } - - /** - * Allows individual parsing of template files. Similar to phpBB but follows the spirit of object-oriented programming ;) - * Returns on object of class templateIndividual. Usage instructions can be found in the inline docs for that class. - * @param $filename the filename of the template to be parsed - * @return object - */ - - function makeParser($filename) - { - $filename = ENANO_ROOT.'/themes/'.$this->theme.'/'.$filename; - if(!file_exists($filename)) die('templateIndividual: file '.$filename.' does not exist'); - $code = file_get_contents($filename); - $parser = new templateIndividualSafe($code, $this); - return $parser; - } - - /** - * Same as $template->makeParser(), but takes a string instead of a filename. - * @param $text the text to parse - * @return object - */ - - function makeParserText($code) - { - $parser = new templateIndividualSafe($code, $this); - return $parser; - } - -} // class template_nodb - -/** - * Identical to templateIndividual, except extends template_nodb instead of template - * @see class template - */ - -class templateIndividualSafe extends template_nodb { - var $tpl_strings, $tpl_bool, $tpl_code; - var $compiled = false; - /** - * Constructor. - */ - function __construct($text, $parent) - { - global $db, $session, $paths, $template, $plugins; // Common objects - $this->tpl_code = $text; - $this->tpl_strings = $parent->tpl_strings; - $this->tpl_bool = $parent->tpl_bool; - } - /** - * PHP 4 constructor. - */ - function templateIndividual($text) - { - $this->__construct($text); - } - /** - * Assigns an array of string values to the template. Strings can be accessed from the template by inserting {KEY_NAME} in the template file. - * @param $vars array - */ - function assign_vars($vars) - { - if(is_array($this->tpl_strings)) - $this->tpl_strings = array_merge($this->tpl_strings, $vars); - else - $this->tpl_strings = $vars; - } - /** - * Assigns an array of boolean values to the template. These can be used for statements. - * @param $vars array - */ - function assign_bool($vars) - { - $this->tpl_bool = array_merge($this->tpl_bool, $vars); - } - /** - * Compiles and executes the template code. - * @return string - */ - function run() - { - global $db, $session, $paths, $template, $plugins; // Common objects - if(!$this->compiled) - { - $this->tpl_code = $this->compile_template_text($this->tpl_code); - $this->compiled = true; - } - return eval($this->tpl_code); - } -} - -?> diff -r 0931d60f5bdb -r 2b2084ca1e60 plugins/#Untitled-1# --- a/plugins/#Untitled-1# Wed Jun 13 16:32:27 2007 -0400 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,1 +0,0 @@ - MAUMEE, OH, US 06/12/2007 11:26 P.M. ARRIVAL SCAN diff -r 0931d60f5bdb -r 2b2084ca1e60 plugins/SpecialAdmin.php~ --- a/plugins/SpecialAdmin.php~ Wed Jun 13 16:32:27 2007 -0400 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,2722 +0,0 @@ -attachHook('base_classes_initted', ' - global $paths; - $paths->add_page(Array( - \'name\'=>\'Administration\', - \'urlname\'=>\'Administration\', - \'namespace\'=>\'Special\', - \'special\'=>0,\'visible\'=>0,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\', - )); - - $paths->add_page(Array( - \'name\'=>\'Manage the Sidebar\', - \'urlname\'=>\'EditSidebar\', - \'namespace\'=>\'Special\', - \'special\'=>0,\'visible\'=>0,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\', - )); - '); - -// function names are IMPORTANT!!! The name pattern is: page_
It looks like your administration session is invalid or you are not authorized to access this administration page. Please re-authenticate to continue.
'; - return; - } - - - // Basic information - echo RenderMan::render( -'== Welcome to Runt, the Enano administration panel. == - -Thank you for choosing Enano as your CMS. This screen allows you to see some information about your website, plus some details about how your site is doing statistically. - -Using the links on the left you can control every aspect of your website\'s look and feel, plus you can manage users, work with pages, and install plugins to make your Enano installation even better.'); - - // Check for the installer scripts - if(file_exists(ENANO_ROOT.'/install.php') || file_exists(ENANO_ROOT.'/schema.sql')) - { - echo '| Page | Hits |
|---|---|
| '.$paths->pages[$page]['name'].' | '.$count.' | '; - echo '
| Type | Date | Username | IP Address |
|---|---|---|---|
| ';
- switch($r['action']) {
- case "admin_auth_good": echo 'Successful elevated authentication'; if ( !empty($r['page_text']) ) { $level = $session->userlevel_to_string( intval($r['page_text']) ); echo " Authentication level: $level"; } break; - case "admin_auth_bad": echo 'Failed administration logon'; break; - case "activ_good": echo 'Successful account activation'; break; - case "auth_good": echo 'Successful regular user logon'; break; - case "activ_bad": echo 'Failed account activation'; break; - case "auth_bad": echo 'Failed regular user logon'; break; - case "sql_inject": echo 'SQL injection attempt Offending query: ' . htmlspecialchars($r['page_text']) . ' '; break;
- case "db_backup": echo 'Database backup createdTables: ' . $r['page_text'] . ''; break; - case "install_enano": echo "Installed Enano version {$r['page_text']}"; break; - } - echo ' | '.date('d M Y h:i a', $r['time_id']).' | '.$r['author'].' | '.$r['edit_summary'].' |
It looks like your administration session is invalid or you are not authorized to access this administration page. Please re-authenticate to continue.
'; - return; - } - - if(isset($_POST['submit'])) { - - // Global site options - setConfig('site_name', $_POST['site_name']); - setConfig('site_desc', $_POST['site_desc']); - setConfig('main_page', str_replace(' ', '_', $_POST['main_page'])); - setConfig('copyright_notice', $_POST['copyright']); - setConfig('contact_email', $_POST['contact_email']); - - // Wiki mode - if(isset($_POST['wikimode'])) setConfig('wiki_mode', '1'); - else setConfig('wiki_mode', '0'); - if(isset($_POST['wiki_mode_require_login'])) setConfig('wiki_mode_require_login', '1'); - else setConfig('wiki_mode_require_login', '0'); - if(isset($_POST['editmsg'])) setConfig('wiki_edit_notice', '1'); - else setConfig('wiki_edit_notice', '0'); - setConfig('wiki_edit_notice_text', $_POST['editmsg_text']); - - // Stats - if(isset($_POST['log_hits'])) setConfig('log_hits', '1'); - else setConfig('log_hits', '0'); - - // Disablement - if(isset($_POST['site_disabled'])) { setConfig('site_disabled', '1'); setConfig('site_disabled_notice', $_POST['site_disabled_notice']); } - else setConfig('site_disabled', '0'); - - // Account activation - setConfig('account_activation', $_POST['account_activation']); - - // W3C compliance buttons - if(isset($_POST['w3c-vh32'])) setConfig("w3c_vh32", "1"); - else setConfig("w3c_vh32", "0"); - if(isset($_POST['w3c-vh40'])) setConfig("w3c_vh40", "1"); - else setConfig("w3c_vh40", "0"); - if(isset($_POST['w3c-vh401'])) setConfig("w3c_vh401", "1"); - else setConfig("w3c_vh401", "0"); - if(isset($_POST['w3c-vxhtml10'])) setConfig("w3c_vxhtml10", "1"); - else setConfig("w3c_vxhtml10", "0"); - if(isset($_POST['w3c-vxhtml11'])) setConfig("w3c_vxhtml11", "1"); - else setConfig("w3c_vxhtml11", "0"); - if(isset($_POST['w3c-vcss'])) setConfig("w3c_vcss", "1"); - else setConfig("w3c_vcss", "0"); - - // SourceForge.net logo - if(isset($_POST['showsf'])) setConfig('sflogo_enabled', '1'); - else setConfig('sflogo_enabled', '0'); - setConfig('sflogo_groupid', $_POST['sfgroup']); - setConfig('sflogo_type', $_POST['sflogo']); - - // Comment options - if(isset($_POST['comment-approval'])) setConfig('approve_comments', '1'); - else setConfig('approve_comments', '0'); - if(isset($_POST['enable-comments'])) setConfig('enable_comments', '1'); - else setConfig('enable_comments', '0'); - setConfig('comments_need_login', $_POST['comments_need_login']); - - // Powered by link - if ( isset($_POST['enano_powered_link']) ) setConfig('powered_btn', '1'); - else setConfig('powered_btn', '0'); - - if(isset($_POST['dbdbutton'])) setConfig('dbd_button', '1'); - else setConfig('dbd_button', '0'); - - if($_POST['emailmethod'] == 'phpmail') setConfig('smtp_enabled', '0'); - else setConfig('smtp_enabled', '1'); - - setConfig('smtp_server', $_POST['smtp_host']); - setConfig('smtp_user', $_POST['smtp_user']); - if($_POST['smtp_pass'] != 'XXXXXXXXXXXX') setConfig('smtp_password', $_POST['smtp_pass']); - - echo 'It looks like your administration session is invalid or you are not authorized to access this administration page. Please re-authenticate to continue.
'; - return; - } - - if(isset($_POST['save'])) - { - if(isset($_POST['enable_uploads'])) setConfig('enable_uploads', '1'); else setConfig('enable_uploads', '0'); - if(isset($_POST['enable_imagemagick'])) setConfig('enable_imagemagick', '1'); else setConfig('enable_imagemagick', '0'); - if(isset($_POST['cache_thumbs'])) setConfig('cache_thumbs', '1'); else setConfig('cache_thumbs', '0'); - if(isset($_POST['file_history'])) setConfig('file_history', '1'); else setConfig('file_history', '0'); - if(file_exists($_POST['imagemagick_path'])) setConfig('imagemagick_path', $_POST['imagemagick_path']); - else echo 'Warning: the file "'.$_POST['imagemagick_path'].'" was not found, and the ImageMagick file path was not updated.'; - $max_upload = floor((float)$_POST['max_file_size'] * (int)$_POST['fs_units']); - setConfig('max_file_size', $max_upload.''); - } - echo ''; - ?> - auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN ) - { - echo 'It looks like your administration session is invalid or you are not authorized to access this administration page. Please re-authenticate to continue.
'; - return; - } - - ?> -The Enano sidebar is a versatile tool when scripted correctly. You don't have to be a programmer to enjoy the features the Sidebar - provides; however, editing the sidebar requires a small bit of programming knowledge and an understanding of Enano's system message - markup language. -
-The Enano system markup language is somewhat similar to HTML, in that it uses tags (<example>like this</example>) for the - main syntax. However, Enano uses curly brackets ({ and }) as opposed to less-than and greater-than signs (< and >).
-Programming the Enano sidebar requires the use of two tags: {slider} and {if}. The {slider} tag is used to create a new heading - on the sidebar, and all text enclosed in that tag will be collapsed when the heading is clicked. To specify the text on the heading, - use an equals sign (=) after the "slider" text. Then insert any links (they should be wiki-formatted) to internal Enano pages and - external sites.
-So here is what the language for the default sidebar's "Navigation" heading looks like:
-{slider=Navigation}
- [[Main Page|Home]]
- [[Enano:Sidebar|Edit the sidebar]]
-{/slider}
- Pretty simple, huh? Good, now we're going to learn another common aspect of Enano programming: conditionals. The {if} tag allows you - to decide whether a portion of the sidebar will be displayed based on a template variable. Currently the only available conditions are - "user_logged_in" and "auth_admin", but more will be added soon. To use a conditional, enter {if conditional_name}, and then the - wiki-formatted text that you want to be under that condition, and then close the tag with {/if}. In the same way, you can reverse the - effect with {!if}. With {!if}, the closing tag is still {/if}, so keep that in mind. An {else} tag will be supported soon.
-Now it's time for some real fun: variables. All template variables can be accessed from the sidebar. A variable is simply the - variable name, prefixed by a dollar sign ($). Some of the most common variables are $USERNAME, $SITE_NAME, $SITE_DESC, and $PAGE_NAME. - The sidebar also has some special variables that it uses for some of its links. The logout link can be added with $LOGOUT_LINK, and - the "change theme" button can be added with $STYLE_LINK.
-So here is the Enano markup for the portion of the sidebar that contains the user tools:
-{slider=$USERNAME}
- [[User:$USERNAME|User page]]
- [[Special:Contributions?user=$USERNAME|My Contributions]]
- {if user_logged_in}
- [[Special:Preferences|Preferences]]
- $THEME_LINK
- {/if}
- {if auth_admin}
- [[Special:Administration|Administration]]
- {/if}
- {if user_logged_in}
- $LOGOUT_LINK
- {/if}
- {!if user_logged_in}
- Create an account
- Log in
- {/if}
-{/slider}
- auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
- {
- echo 'It looks like your administration session is invalid or you are not authorized to access this administration page. Please re-authenticate to continue.
'; - return; - } - - if(isset($_POST['go'])) { - // We need the user ID before we can do anything - $q = $db->sql_query('SELECT user_id,username,email,real_name,style,user_level FROM '.table_prefix.'users WHERE username=\'' . $db->escape($_POST['username']) . '\''); - if(!$q) die('Error selecting user ID: '.mysql_error()); - if($db->numrows() < 1) { echo('User does not exist, please enter another username.'); return; } - $r = $db->fetchrow(); - $db->free_result(); - if(isset($_POST['save'])) - { - $_POST['level'] = intval($_POST['level']); - - $new_level = $_POST['level']; - $old_level = intval($r['user_level']); - - $re = $session->update_user((int)$r['user_id'], $_POST['new_username'], false, $_POST['new_pass'], $_POST['email'], $_POST['real_name'], false, $_POST['level']); - - if($re == 'success') - { - - if ( $new_level != $old_level ) - { - $user_id = intval($r['user_id']); - // We need to update group memberships - if ( $old_level == USER_LEVEL_ADMIN ) - { - $session->remove_user_from_group($user_id, GROUP_ID_ADMIN); - } - else if ( $old_level == USER_LEVEL_MOD ) - { - $session->remove_user_from_group($user_id, GROUP_ID_MOD); - } - - if ( $new_level == USER_LEVEL_ADMIN ) - { - $session->add_user_to_group($user_id, GROUP_ID_ADMIN, false); - } - else if ( $new_level == USER_LEVEL_MOD ) - { - $session->add_user_to_group($user_id, GROUP_ID_MOD, false); - } - } - - echo('| Date of request | Requested by | Requested for | Actions | ||
|---|---|---|---|---|---|
| '.date('F d, Y h:i a', $row['time_id']).' | '.$row['author'].' | '.$row['edit_summary'].' | Activate now | Send activation e-mail | Deny request |
It looks like your administration session is invalid or you are not authorized to access this administration page. Please re-authenticate to continue.
'; - return; - } - - if(isset($_POST['do_create_stage1'])) - { - if(!preg_match('/^([A-z0-9 -]+)$/', $_POST['create_group_name'])) - { - echo 'The group name you chose is invalid.
'; - return; - } - echo ''; - return; - } - elseif(isset($_POST['do_create_stage2'])) - { - if(!preg_match('/^([A-z0-9 -]+)$/', $_POST['create_group_name'])) - { - echo 'The group name you chose is invalid.
'; - return; - } - if(!in_array(intval($_POST['group_status']), Array(GROUP_CLOSED, GROUP_OPEN, GROUP_HIDDEN, GROUP_REQUEST))) - { - echo 'Hacking attempt
'; - return; - } - $e = $db->sql_query('SELECT group_id FROM '.table_prefix.'groups WHERE group_name=\''.$db->escape($_POST['create_group_name']).'\';'); - if(!$e) - { - echo $db->get_error(); - return; - } - if($db->numrows() > 0) - { - echo 'The group name you entered already exists.
'; - return; - } - $db->free_result(); - $q = $db->sql_query('INSERT INTO '.table_prefix.'groups(group_name,group_type) VALUES( \''.$db->escape($_POST['create_group_name']).'\', ' . intval($_POST['group_status']) . ' )'); - if(!$q) - { - echo $db->get_error(); - return; - } - $e = $db->sql_query('SELECT user_id FROM '.table_prefix.'users WHERE username=\''.$db->escape($_POST['group_mod']).'\';'); - if(!$e) - { - echo $db->get_error(); - return; - } - if($db->numrows() < 1) - { - echo 'The username you entered could not be found.
'; - return; - } - $row = $db->fetchrow(); - $id = $row['user_id']; - $db->free_result(); - $e = $db->sql_query('SELECT group_id FROM '.table_prefix.'groups WHERE group_name=\''.$db->escape($_POST['create_group_name']).'\';'); - if(!$e) - { - echo $db->get_error(); - return; - } - if($db->numrows() < 1) - { - echo 'The group ID could not be looked up.
'; - return; - } - $row = $db->fetchrow(); - $gid = $row['group_id']; - $db->free_result(); - $e = $db->sql_query('INSERT INTO '.table_prefix.'group_members(group_id,user_id,is_mod) VALUES('.$gid.', '.$id.', 1);'); - if(!$e) - { - echo $db->get_error(); - return; - } - echo "Error: couldn\'t look up group name
'; - } - $row = $db->fetchrow(); - $name = $row['group_name']; - $db->free_result(); - if(isset($_POST['edit_do'])) - { - if(isset($_POST['edit_do']['del_group'])) - { - if ( $row['system_group'] == 1 ) - { - echo 'The group name you chose is invalid.
'; - return; - } - $q = $db->sql_query('UPDATE '.table_prefix.'groups SET group_name=\''.$db->escape($_POST['group_name']).'\' - WHERE group_id='.intval($_POST['group_edit_id']).';'); - if(!$q) - { - echo $db->get_error(); - return; - } - else - { - echo 'It looks like your administration session is invalid or you are not authorized to access this administration page. Please re-authenticate to continue.
'; - return; - } - - - echo '