[Tikiwiki-cvs/svn] SF.net SVN: tikiwiki:[46017] branches/11.x/tiki-auto_save.php
Revision: 46017
http://sourceforge.net/p/tikiwiki/code/46017
Author: jonnybradley
Date: 2013-05-21 17:51:59 +0000 (Tue, 21 May 2013)
Log Message:
-----------
[FIX] auto_save: Check the user doing the save or preview has permission and is the one currently editing
the page. Thanks Marcela B?\195?\169n?\195?\169trix
Also modernise library use and fix some missing and/or unset vars
Modified Paths:
--------------
branches/11.x/tiki-auto_save.php
Modified: branches/11.x/tiki-auto_save.php
===================================================================
--- branches/11.x/tiki-auto_save.php 2013-05-21 17:47:52 UTC (rev 46016)
+++ branches/11.x/tiki-auto_save.php 2013-05-21 17:51:59 UTC (rev 46017)
<at> <at> -44,19 +44,29 <at> <at>
}
if (isset($_REQUEST['editor_id'])) {
+ global $user;
+ $tikilib = TikiLib::lib('tiki');
+ $editlib = TikiLib::lib('edit');
+ $smarty = TikiLib::lib('smarty');
+
+
if (isset($_REQUEST['command']) && isset($_REQUEST['data']) && $_REQUEST['data'] != 'ajax error') {
- if (!isset($_REQUEST['referer']))
+ if (!isset($_REQUEST['referer'])) {
$_REQUEST['referer'] = '';
+ }
$referer = explode(':', $_REQUEST['referer']); // user, section, object id
if ($referer && count($referer) === 3 && $referer[1] === 'wiki_page') {
$page = rawurldecode($referer[2]); // plugins use global $page for approval
+
+ if (!Perms::get('wiki page', $page)->edit || $user != $tikilib->get_semaphore_user($page)) {
+ send_ajax_response($_REQUEST['command'], '');
+ }
}
+ $res = '';
if ($_REQUEST['command'] == 'toWikiFormat') {
- global $editlib; include_once 'lib/wiki/editlib.php';
$res = $editlib->parseToWiki(urldecode($_REQUEST['data']));
} else if ($_REQUEST['command'] == 'toHtmlFormat') {
- global $editlib; include_once 'lib/wiki/editlib.php';
$res = $editlib->parseToWysiwyg(urldecode($_REQUEST['data']), false,
!empty($_REQUEST['allowhtml']) ? $_REQUEST['allowhtml'] : false);
} else if ($_REQUEST['command'] == 'auto_save') {
include_once 'lib/ajax/autosave.php';
<at> <at> -78,6 +88,11 <at> <at>
}
$page = $autoSaveIdParts[2]; // plugins use global $page for approval
+
+ if (!Perms::get('wiki page', $page)->edit || $user != $tikilib->get_semaphore_user($page)) {
+ send_ajax_response($_REQUEST['command'], '');
+ }
+
$info = $tikilib->get_page_info($page, false);
if (isset($_REQUEST['allowHtml']) || empty($info)) {
$info['is_html'] = !empty($_REQUEST['allowHtml'])? 1 : 0;
<at> <at> -89,14 +104,12 <at> <at>
if (count($autoSaveIdParts) === 3 && !empty($user) && $user === $autoSaveIdParts[0] &&
$autoSaveIdParts[1] === 'wiki_page') {
- $editlib; include_once 'lib/wiki/editlib.php';
if (isset($_REQUEST['inPage'])) {
if (!isset($_REQUEST['diff_style'])) { // use previously set diff_style
$_REQUEST['diff_style'] = isset($_COOKIE['preview_diff_style']) ?
$_COOKIE['preview_diff_style'] : '';
}
$data = $editlib->partialParseWysiwygToWiki(get_autosave($_REQUEST['editor_id'], $_REQUEST['autoSaveId']));
$smarty->assign('diff_style', $_REQUEST['diff_style']);
- global $tikilib;
if (!empty($_REQUEST['diff_style'])) {
$info = $tikilib->get_page_info($autoSaveIdParts[2]);
if (!empty($info)) {
<at> <at> -134,7 +147,7 <at> <at>
echo $data;
} else { // popup window
- $headerlib->add_js(
+ TikiLib::lib('header')->add_js(
'function get_new_preview() {
$("body").css("opacity", 0.6);
location.replace("' . $tikiroot . 'tiki-auto_save.php?editor_id=' . $_REQUEST['editor_id'] .
'&autoSaveId=' . $_REQUEST['autoSaveId'] . '");
This was sent by the SourceForge.net collaborative development platform, the world's largest Open
Source development site.
------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may
RSS Feed