plugins/PunBB.php
author Dan
Sun, 06 Apr 2008 00:35:38 -0400
changeset 8 8baccbad4a55
parent 6 5e1f1e916419
child 9 a932ce8c4827
permissions -rwxr-xr-x
Fixed images
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
1
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
     1
<?php
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
     2
/*
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
     3
Plugin Name: PunBB forum integration
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
     4
Plugin URI: http://enanocms.org/PunBB_plugin
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
     5
Description: Provides a complete forum solution in PunBB, a separately maintained and very lightweight GPL forum.
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
     6
Author: Dan Fuhry
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
     7
Version: 1.3-beta
1
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
     8
Author URI: http://enanocms.org/
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
     9
*/
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    10
1
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    11
/*
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    12
 * PunBB Plugin for Enano CMS
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
    13
 * Version 1.3-beta
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
    14
 * Copyright (C) 2006-2008 Dan Fuhry
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
    15
 * Copyright (C) 2002-2008 Rickard Andersson
1
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    16
 *
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    17
 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    18
 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    19
 *
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    20
 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    21
 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    22
 */
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    23
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    24
$plugins->attachHook('base_classes_initted', '
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    25
    global $paths;
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    26
    
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    27
    $paths->add_page(Array(
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    28
      \'name\'=>\'Forum\',
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    29
      \'urlname\'=>\'Forum\',
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    30
      \'namespace\'=>\'Special\',
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    31
      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    32
    ));
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    33
    
1
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    34
  ');
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    35
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    36
$plugins->attachHook('session_started', '
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    37
    $pid = RenderMan::strToPageId($paths->get_pageid_from_url());
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    38
8
8baccbad4a55 Fixed images
Dan
parents: 6
diff changeset
    39
    $is_style_or_script = ( ( strpos($_SERVER["REQUEST_URI"], "/style/") || strpos($_SERVER["REQUEST_URI"], "/include/js/") || strpos($_SERVER["REQUEST_URI"], "/img/") ) && !strpos($_SERVER["REQUEST_URI"], "/help/") );
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
    40
    if ( getConfig("punbb_installed") == "yes" && getConfig("punbb_version") == PUNANO_VERSION && $pid[0] == "Forum" && $pid[1] == "Special" && !$is_style_or_script )
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    41
    {
5
e3d7322305bf Merging Scribus and Nighthawk branches
Dan
parents: 4
diff changeset
    42
      require( "punbb/include/common.php" );
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    43
    }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    44
    ');
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    45
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
    46
define('PUNANO_VERSION', '0.1.3-beta');
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
    47
define('PUNBB_VERSION',  '1.3-beta');
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    48
define('PUN_ROOT', ENANO_ROOT . '/punbb/');
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    49
define('PUN', '');
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    50
define('PUN_DISABLE_BUFFERING', '');
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
    51
// define('PUN_SHOW_QUERIES', '');
1
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    52
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    53
function page_Special_Forum()
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    54
{
3
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
    55
  global $db, $session, $paths, $template, $plugins; // Common objects
1
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    56
  if ( getConfig('punbb_installed') != 'yes' )
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    57
  {
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    58
    punano_installer();
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    59
  }
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    60
  else if ( getConfig('punbb_version') != PUNANO_VERSION )
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    61
  {
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    62
    punano_upgrade();
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    63
  }
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
    64
  else if ( $paths->getParam(0) == 'admin' )
3
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
    65
  {
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
    66
    punano_admin_console();
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
    67
  }
8
8baccbad4a55 Fixed images
Dan
parents: 6
diff changeset
    68
  else if ( ( $paths->getParam(0) == 'style' ) || ( $paths->getParam(0) == 'include' && $paths->getParam(1) == 'js' ) || ( $paths->getParam(0) == 'img' ) )
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
    69
  {
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
    70
    $path = $paths->getAllParams();
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
    71
    header('Location: ' . scriptPath . '/punbb/' . $path);
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
    72
    exit();
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
    73
  }
1
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    74
  else
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    75
  {
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    76
    punano_main();
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    77
  }
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    78
}
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    79
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    80
function punano_installer()
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    81
{
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    82
  global $db, $session, $paths, $template, $plugins; // Common objects
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    83
  // First check our permissions
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    84
  if ( $session->user_level < USER_LEVEL_ADMIN )
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    85
  {
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    86
    die_friendly('Punano initialization error', '<p>The Punano plugin doesn\'t have its database schema installed yet, and your user account doesn\'t have permission to install it. Please ask the administrator of this site to set up Punano.</p>');
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    87
  }
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    88
  else if ( $session->auth_level < USER_LEVEL_ADMIN )
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    89
  {
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    90
    $url = makeUrlNS('Special', 'Login/' . $paths->page, 'level=' . USER_LEVEL_ADMIN, true);
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
    91
    pun_redirect($url, 'Permission denied', 'You need to have an active high-privilege session to set up Punano.', 4);
1
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    92
  }
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    93
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    94
  $template->header();
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    95
  
1
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
    96
  // Permissions are good
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    97
  if ( isset($_POST['do_install']) )
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    98
  {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
    99
    $result = _punano_perform_install();
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   100
    if ( $result )
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   101
    {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   102
      echo '<p>PunBB installation has succeeded.</p>';
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   103
      echo '<p><b><a href="' . makeUrlNS('Special', 'Forum') . '">Take me to my forum!</a></b></p>';
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   104
    }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   105
  }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   106
  else
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   107
  {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   108
    $url = makeUrlNS('Special', 'Forum');
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   109
    ?>
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   110
    <form action="<?php echo $url; ?>" method="post">
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   111
      <p><b>Before Punano can be used, you need to install the database.</b></p>
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   112
      <p>This process will create several new tables in your database, and then fill them in with a default configuration for PunBB.
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   113
         You should only continue if you have CREATE TABLE and CREATE INDEX privileges on your database.</p>
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   114
      <p><input type="submit" style="font-weight: bold;" name="do_install" value="Install PunBB" /></p>
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   115
    </form>
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   116
    <?php
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   117
  }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   118
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   119
  $template->footer();
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   120
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   121
}
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   122
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   123
function _punano_perform_install()
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   124
{
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   125
  global $db, $session, $paths, $template, $plugins; // Common objects
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
   126
  global $dbdriver;
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
   127
  
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   128
  $db_prefix = table_prefix . 'pun_';
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   129
  $admin_email = getConfig('contact_email');
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   130
  $pun_version = PUNBB_VERSION;
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   131
  
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
   132
  $schema = file_get_contents( ENANO_ROOT . "/punbb/install-$dbdriver.sql" );
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   133
  if ( empty($schema) )
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   134
  {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   135
    echo 'ERROR: cannot load schema file!';
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   136
    return false;
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   137
  }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   138
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   139
  $replace = array(
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   140
      '{{TABLE_PREFIX}}' => $db_prefix,
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   141
      '{{ENANO_ADMIN_EMAIL}}' => $admin_email,
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
   142
      '{{PUN_VERSION}}' => $pun_version,
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
   143
      '{{NOW}}' => strval(time())
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   144
    );
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   145
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   146
  $schema = strtr($schema, $replace);
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   147
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   148
  // Build an array of queries (from Enano's install.php)
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   149
  $schema = explode("\n", $schema);
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   150
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   151
  foreach ( $schema as $i => $sql )
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   152
  {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   153
    $query =& $schema[$i];
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   154
    $t = trim($query);
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   155
    if ( empty($t) || preg_match('/^(\#|--)/i', $t) )
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   156
    {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   157
      unset($schema[$i]);
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   158
      unset($query);
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   159
    }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   160
  }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   161
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   162
  $schema = array_values($schema);
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   163
  $schema = implode("\n", $schema);
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   164
  $schema = explode(";\n", $schema);
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   165
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   166
  foreach ( $schema as $i => $sql )
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   167
  {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   168
    $query =& $schema[$i];
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   169
    if ( substr($query, ( strlen($query) - 1 ), 1 ) != ';' )
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   170
    {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   171
      $query .= ';';
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   172
    }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   173
    if ( !$db->check_query($query) )
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   174
    {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   175
      echo 'ERROR: Query safety check failed.<pre>' . $query . '</pre>';
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   176
    }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   177
  }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   178
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   179
  foreach ( $schema as $query )
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   180
  {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   181
    if ( !$db->sql_query($query) )
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   182
    {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   183
      echo $db->get_error();
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   184
      return false;
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   185
    }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   186
  }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   187
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   188
  // Insert users
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   189
  $q = $db->sql_query('SELECT user_id FROM '.table_prefix.'users WHERE user_id > 1;');
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   190
  if ( !$q )
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   191
  {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   192
    echo $db->get_error();
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   193
    return false;
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   194
  }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   195
  $uid_list = array();
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   196
  while ( $row = $db->fetchrow_num() )
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   197
  {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   198
    $uid_list[] = $row[0];
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   199
  }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   200
  $query = 'INSERT INTO '.table_prefix.'pun_users(id) VALUES(' . implode('),(', $uid_list) . ');';
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   201
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   202
  if ( !$db->sql_query($query) )
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   203
  {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   204
    echo $db->get_error();
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   205
    return false;
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   206
  }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   207
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   208
  setConfig('punbb_installed', 'yes');
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   209
  setConfig('punbb_version', PUNANO_VERSION);
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   210
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   211
  return true;
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   212
  
1
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
   213
}
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
   214
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
   215
function punano_upgrade()
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
   216
{
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
   217
  global $db, $session, $paths, $template, $plugins; // Common objects
5
e3d7322305bf Merging Scribus and Nighthawk branches
Dan
parents: 4
diff changeset
   218
  
1
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
   219
}
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
   220
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
   221
function punano_main()
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
   222
{
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
   223
  global $db, $session, $paths, $template, $plugins; // Common objects
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
   224
  
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   225
  // At this point, the PunBB API is already loaded
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   226
  // So we'll include one of the Pun frontend files
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   227
  
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
   228
  /*
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   229
  $valid = array('delete', 'edit', 'extern', 'help', 'index', 'misc', 'moderate', 'post', 'profile', 'search', 'userlist', 'viewforum', 'viewtopic');
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   230
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   231
  $file = 'index';
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   232
  if ( $x = $paths->getParam(0) )
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   233
  {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   234
    $x = preg_replace('/\.php$/', '', $x);
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   235
    if ( in_array(strtolower($x), $valid) )
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   236
    {
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   237
      $file = strtolower($x);
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   238
    }
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   239
  }
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
   240
  */
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
   241
  $file = 'rewrite';
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   242
  
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 1
diff changeset
   243
  // Don't worry. This is sanitized.
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
   244
  $file = PUN_ROOT . $file . '.php';
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
   245
  require $file;
1
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
   246
}
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
   247
3
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   248
function punano_admin_console()
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   249
{
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   250
  global $db, $session, $paths, $template, $plugins; // Common objects
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   251
  
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
   252
  $valid = array('bans', 'categories', 'censoring', 'extensions', 'forums', 'groups', 'index', 'options', 'prune', 'ranks', 'reindex', 'reports', 'users');
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
   253
  $mod   = array();
3
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   254
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   255
  $file = 'index';
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   256
  
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
   257
  if ( $x = $paths->getParam(1) )
3
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   258
  {
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   259
    $x = preg_replace('/\.php$/', '', $x);
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   260
    $x = preg_replace('/^admin_/i', '', $x);
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
   261
    if ( in_array(strtolower($x), $valid) || in_array(strtolower($x), $mod) )
3
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   262
    {
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   263
      $file = strtolower($x);
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   264
    }
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   265
  }
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   266
  
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   267
  if ( in_array($file, $mod) )
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   268
  {
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   269
    $need_level = USER_LEVEL_MOD;
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   270
  }
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   271
  else
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   272
  {
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   273
    $need_level = USER_LEVEL_ADMIN;
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   274
  }
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   275
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   276
  if ( $session->auth_level < $need_level )
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   277
  {
5
e3d7322305bf Merging Scribus and Nighthawk branches
Dan
parents: 4
diff changeset
   278
    redirect( makeUrlNS('Special', 'Login/' . $paths->fullpage, 'level=' . $session->user_level, false), 'Permission denied', 'You need to have permission level ' . $session->userlevel_to_string($need_level) . ' to use the PunBB administration console.', 2);
3
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   279
  }
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   280
  
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   281
  // Don't worry. This is sanitized.
6
5e1f1e916419 Big upgrade to 1.3 beta. Basic things are working.
Dan
parents: 5
diff changeset
   282
  require PUN_ROOT . 'admin/' . $file . '.php';
3
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   283
  
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   284
}
c0c445d4a13e Got some basic security in there, admin panel works now, and most admin panel forms work (used regex mass search + replace)
Dan
parents: 2
diff changeset
   285
1
8f6143115bf5 Nothing exciting, just syncing with Scribus...
Dan
parents: 0
diff changeset
   286
?>