Re: Add basic template ownership patch
adrian15 <adrian15sgd <at> gmail.com>
2009-11-22 16:40:59 GMT
Michiel Dethmers escribió:
>
> Thanks for that. That sounds interesting. Once I have some time, I'll
> take a closer look and then will continue the discussion in the mantis
> issue.
>
> Michiel
>
Thank you very much!
I attach an updated version of the patch that now works after applying
the 15 patches that I have sent in a previous email.
At viewtemplate.php now when inserting the if clause I do not ident the
lines inside it so it is ugly but it works.
What I mean is that there has not been any functional changes, it is a
minor change so that the 15 patches apply.
You will the patch attached here and whenever I have time I will upload
it to the mantis issue.
adrian15
--
Support free software. Donate to Super Grub Disk. Apoya el software
libre. Dona a Super Grub Disk. http://www.supergrubdisk.org/index.php?pid=10
diff -urN src_original/phplist-2.10.10/public_html/lists/admin/connect.php src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/connect.php
--- src_original/phplist-2.10.10/public_html/lists/admin/connect.php 2009-05-05
16:40:48.000000000 +0200
+++ src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/connect.php 2009-11-15
18:17:59.000000000 +0100
@@ -11,7 +11,7 @@
$version = "dev";
}
-define("VERSION","2.10.10");
+define("VERSION","2.10.11");
include_once dirname(__FILE__) . "/commonlib/lib/userlib.php";
include_once dirname(__FILE__) . "/pluginlib.php";
diff -urN src_original/phplist-2.10.10/public_html/lists/admin/lib.php src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/lib.php
--- src_original/phplist-2.10.10/public_html/lists/admin/lib.php 2009-01-28
13:02:34.000000000 +0100
+++ src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/lib.php 2009-11-15
22:24:36.000000000 +0100
@@ -378,7 +378,8 @@
if (defined("IN_WEBBLER")) {
$more = '&pi='.$_GET["pi"];
}
- $tmpl = Sql_Fetch_Row_Query(sprintf('select template from %s where id = %d',$tables["template"],$id));
+ $tmpl = Sql_Fetch_Row_Query(sprintf('select template from %s where ((id = %d) and (adminid = %d))',$tables["template"],$id,$adminid));
+ if ($tmpl) {
$template = stripslashes($tmpl[0]);
$img_req = Sql_Query(sprintf('select id,filename from %s where template = %d order by filename desc',$tables["templateimage"],$id));
while ($img = Sql_Fetch_Array($img_req)) {
@@ -406,7 +407,10 @@
$template = ereg_replace('<form','< form',$template);
$template = ereg_replace('</form','< /form',$template);
- return $template;
+ return $template;
+ } else {
+ return FALSE;
+ }
}
diff -urN src_original/phplist-2.10.10/public_html/lists/admin/send_core.php src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/send_core.php
--- src_original/phplist-2.10.10/public_html/lists/admin/send_core.php 2009-03-26
18:18:23.000000000 +0100
+++ src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/send_core.php 2009-11-15
23:02:20.000000000 +0100
@@ -1,7 +1,7 @@
<?php
// 2004-1-7 This function really isn't quite ready for register globals.
require_once dirname(__FILE__).'/accesscheck.php';
-
+$AdminID = $_SESSION["logindetails"]["id"]; // Required for admin-template-ownerswip support
#initialisation###############
// Verify that FCKeditor is available
@@ -1129,11 +1129,11 @@
}
$formatting_content .= '</td></tr>';
- $req = Sql_Query("select id,title from {$tables["template"]} order by listorder");
+ $req = Sql_Query("select id,title from {$tables["template"]} where (adminid = $AdminID) order by listorder");
if (Sql_affected_Rows()) {
$formatting_content .= '<tr><td>'.Help("usetemplate").'
'.$GLOBALS['I18N']->get("usetemplate").': </td>
<td><select name="template"><option value=0>-- '.$GLOBALS['I18N']->get("selectone").'</option>';
- $req = Sql_Query("select id,title from {$tables["template"]} order by listorder");
+ $req = Sql_Query("select id,title from {$tables["template"]} where (adminid = $AdminID) order by listorder");
while ($row = Sql_Fetch_Array($req)) {
$formatting_content .= sprintf('<option value="%d" %s>%s</option>',$row["id"], $row["id"]==$_POST["template"]?'SELECTED':'',$row["title"]);
}
diff -urN src_original/phplist-2.10.10/public_html/lists/admin/structure.php src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/structure.php
--- src_original/phplist-2.10.10/public_html/lists/admin/structure.php 2009-05-05
16:40:48.000000000 +0200
+++ src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/structure.php 2009-11-15
18:15:51.000000000 +0100
@@ -1,7 +1,7 @@
<?php
require_once dirname(__FILE__).'/accesscheck.php';
-define("STRUCTUREVERSION","2.10.10");
+define("STRUCTUREVERSION","2.10.11");
$DBstruct = array( # order of tables is essential for smooth upgrade
"attribute" => array ( # attributes of a user or a message
@@ -220,7 +220,8 @@
"title" => array("varchar(255) not null","Title"),
"template" => array("longblob","The template"),
"listorder" => array("integer",""),
- "unique_1" => array("(title)","")
+ "adminid" => array("integer",""),
+ "unique_1" => array("(title,adminid)",""),
),
"templateimage" => array(
"id" => array("integer not null primary key auto_increment","ID"),
diff -urN src_original/phplist-2.10.10/public_html/lists/admin/template.php src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/template.php
--- src_original/phplist-2.10.10/public_html/lists/admin/template.php 2007-08-21
21:26:05.000000000 +0200
+++ src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/template.php 2009-11-15
22:01:42.000000000 +0100
@@ -3,6 +3,7 @@
<?php
require_once dirname(__FILE__).'/accesscheck.php';
+$AdminID = $_SESSION["logindetails"]["id"]; // Required for admin-template-ownerswip support
if (!empty($_FILES['file_template']) &&
is_uploaded_file($_FILES['file_template']['tmp_name'])) {
$content = file_get_contents($_FILES['file_template']['tmp_name']);
} elseif (isset($_POST['content'])) {
@@ -136,7 +137,7 @@
}
if ($templateok) {
if (!$id) {
- Sql_Query("insert into {$tables["template"]} (title) values(\"$title\")");
+ Sql_Query("insert into {$tables["template"]} (title,adminid) values(\"$title\",$AdminID)");
$id = Sql_Insert_id();
}
Sql_Query(sprintf('update %s set title = "%s",template = "%s" where id = %d',
@@ -178,8 +179,13 @@
}
} else {
if ($id) {
- $req = Sql_Query("select * from {$tables["template"]} where id = $id");
+ // Check edited id ownership
+ $req = Sql_Query("select * from {$tables["template"]} where ((adminid = $AdminID) and (id = $id))" );
+ if (!Sql_Affected_Rows()) {
+ $id=0;
+ } else {
$data = Sql_Fetch_Array($req);
+ }
}
}
?>
diff -urN src_original/phplist-2.10.10/public_html/lists/admin/templates.php src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/templates.php
--- src_original/phplist-2.10.10/public_html/lists/admin/templates.php 2005-08-03
04:37:10.000000000 +0200
+++ src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/templates.php 2009-11-15
19:20:41.000000000 +0100
@@ -1,13 +1,21 @@
<?php
require_once dirname(__FILE__).'/accesscheck.php';
+$AdminID = $_SESSION["logindetails"]["id"]; // Required for admin-template-ownerswip support
+
if (isset($_GET['delete'])) {
# delete the index in delete
$delete = sprintf('%d',$_GET['delete']);
- print $GLOBALS['I18N']->get('Deleting')." $delete ...\n";
- $result = Sql_query("delete from ".$tables["template"]." where id = $delete");
- $result = Sql_query("delete from ".$tables["templateimage"]." where template = $delete");
- print "... ".$GLOBALS['I18N']->get('Done')."<br /><hr /><br />\n";
+ print $GLOBALS['I18N']->get('Checking')." $delete ...\n";
+ $req = Sql_Query("select * from {$tables["template"]} where ((adminid = $AdminID) and (id = $delete))"
);
+ if (!Sql_Affected_Rows()) {
+ print '<p class="error">'.$GLOBALS['I18N']->get("You do not have enough permissions to delete this template.").'</p>';
+ } else {
+ print $GLOBALS['I18N']->get('Deleting')." $delete ...\n";
+ $result = Sql_query("delete from ".$tables["template"]." where id = $delete");
+ $result = Sql_query("delete from ".$tables["templateimage"]." where template = $delete");
+ print "... ".$GLOBALS['I18N']->get('Done')."<br /><hr /><br />\n";
+ }
}
if (isset($_POST['defaulttemplate'])) {
saveConfig('defaultmessagetemplate',sprintf('%d',$_POST['defaulttemplate']));
@@ -19,8 +27,7 @@
<?php
-
-$req = Sql_Query("select * from {$tables["template"]} order by listorder");
+$req = Sql_Query("select * from {$tables["template"]} where (adminid = $AdminID) order by listorder");
if (!Sql_Affected_Rows())
print '<p class="error">'.$GLOBALS['I18N']->get("No template have been defined").'</p>';
diff -urN src_original/phplist-2.10.10/public_html/lists/admin/upgrade.php src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/upgrade.php
--- src_original/phplist-2.10.10/public_html/lists/admin/upgrade.php 2007-07-16
20:09:37.000000000 +0200
+++ src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/upgrade.php 2009-11-15
18:32:45.000000000 +0100
@@ -345,6 +345,14 @@
}
Sql_Query(sprintf('delete from %s where page = "all" or page = "none"',$GLOBALS['tables']['task']));
+ switch ($dbversion) {
+ case "2.10.10":
+ Sql_Query(sprintf('alter table %s DROP INDEX title',$tables["template"]));
+ Sql_Query(sprintf('alter table %s ADD adminid INT',$tables["template"]));
+ Sql_Query(sprintf('alter table %s ADD unique (title,adminid)',$tables["template"]));
+ break;
+ }
+
# mark the database to be our current version
if ($success) {
SaveConfig("version",VERSION,0);
diff -urN src_original/phplist-2.10.10/public_html/lists/admin/viewtemplate.php src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/viewtemplate.php
--- src_original/phplist-2.10.10/public_html/lists/admin/viewtemplate.php 2005-08-03
04:37:10.000000000 +0200
+++
src_admin_ownerswip2/phplist-2.10.10/public_html/lists/admin/viewtemplate.php 2009-11-22
16:57:51.000000000 +0100
@@ -1,6 +1,11 @@
<?php
# view template
require_once dirname(__FILE__).'/accesscheck.php';
+$AdminID = $_SESSION["logindetails"]["id"]; // Required for admin-template-ownerswip support
+
+// Check edited id ownership
+$req = Sql_Query("select * from {$tables["template"]} where ((adminid = $AdminID) and (id =
{$_GET["id"]}))" );
+if (Sql_Affected_Rows()) {
if ($_GET["pi"] && defined("IN_WEBBLER")) {
$more = '&pi='.$_GET["pi"];
}
@@ -14,5 +19,6 @@
ob_end_clean();
print previewTemplate($id,$_SESSION["logindetails"]["id"],nl2br($GLOBALS['I18N']->get('TempSample')));
}
+} else print $GLOBALS['I18N']->get('You do not have enough permissions to view this template.');
?>
_______________________________________________
Phplist-developers mailing list
Phplist-developers <at> tincan.co.uk
http://mail.tincan.co.uk/mailman/listinfo/phplist-developers
RSS Feed