diff -r 0931d60f5bdb -r 2b2084ca1e60 includes/pageutils.php~
--- a/includes/pageutils.php~ Wed Jun 13 16:32:27 2007 -0400
+++ /dev/null Thu Jan 01 00:00:00 1970 +0000
@@ -1,2059 +0,0 @@
-sql_query('SELECT username FROM '.table_prefix.'users WHERE username=\''.$db->escape(rawurldecode($name)).'\'');
- if(!$q) die(mysql_error());
- if($db->numrows() < 1) { $db->free_result(); return('good'); }
- else { $db->free_result(); return('bad'); }
- }
-
- /**
- * Get the wiki formatting source for a page
- * @param $page the full page id (Namespace:Pagename)
- * @return string
- * @todo (DONE) Make it require a password (just for security purposes)
- */
-
- function getsource($page, $password = false)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- if(!isset($paths->pages[$page]))
- {
- return '';
- }
-
- if(strlen($paths->pages[$page]['password']) == 40)
- {
- if(!$password || ( $password != $paths->pages[$page]['password']))
- {
- return 'invalid_password';
- }
- }
-
- if(!$session->get_permissions('view_source')) // Dependencies handle this for us - this also checks for read privileges
- return 'access_denied';
- $pid = RenderMan::strToPageID($page);
- if($pid[1] == 'Special' || $pid[1] == 'Admin')
- {
- die('This type of page ('.$paths->nslist[$pid[1]].') cannot be edited because the page source code is not stored in the database.');
- }
-
- $e = $db->sql_query('SELECT page_text,char_tag FROM '.table_prefix.'page_text WHERE page_id=\''.$pid[0].'\' AND namespace=\''.$pid[1].'\'');
- if ( !$e )
- {
- $db->_die('The page text could not be selected.');
- }
- if( $db->numrows() < 1 )
- {
- return ''; //$db->_die('There were no rows in the text table that matched the page text query.');
- }
-
- $r = $db->fetchrow();
- $db->free_result();
- $message = $r['page_text'];
-
- return htmlspecialchars($message);
- }
-
- /**
- * Basically a frontend to RenderMan::getPage(), with the ability to send valid data for nonexistent pages
- * @param $page the full page id (Namespace:Pagename)
- * @param $send_headers true if the theme headers should be sent (still dependent on current page settings), false otherwise
- * @return string
- */
-
- function getpage($page, $send_headers = false, $hist_id = false)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- ob_start();
- $pid = RenderMan::strToPageID($page);
- //die('
'.print_r($pid, true).'
');
- if(isset($paths->pages[$page]['password']) && strlen($paths->pages[$page]['password']) == 40)
- {
- password_prompt($page);
- }
- if(isset($paths->pages[$page]))
- {
- doStats($pid[0], $pid[1]);
- }
- if($paths->custom_page || $pid[1] == 'Special')
- {
- // If we don't have access to the page, get out and quick!
- if(!$session->get_permissions('read') && $pid[0] != 'Login' && $pid[0] != 'Register')
- {
- $template->tpl_strings['PAGE_NAME'] = 'Access denied';
-
- if ( $send_headers )
- {
- $template->header();
- }
-
- echo '
Access to this page is denied. This may be because you are not logged in or you have not met certain criteria for viewing this page.
';
-
- if ( $send_headers )
- {
- $template->footer();
- }
-
- $r = ob_get_contents();
- ob_end_clean();
- return $r;
- }
-
- $fname = 'page_'.$pid[1].'_'.$paths->pages[$page]['urlname_nons'];
- @call_user_func($fname);
-
- }
- else if ( $pid[1] == 'Admin' )
- {
- // If we don't have access to the page, get out and quick!
- if(!$session->get_permissions('read'))
- {
- $template->tpl_strings['PAGE_NAME'] = 'Access denied';
- if ( $send_headers )
- {
- $template->header();
- }
- echo '
Access to this page is denied. This may be because you are not logged in or you have not met certain criteria for viewing this page.
';
- if ( $send_headers )
- {
- $template->footer();
- }
- $r = ob_get_contents();
- ob_end_clean();
- return $r;
- }
-
- $fname = 'page_'.$pid[1].'_'.$pid[0];
- if ( !function_exists($fname) )
- {
- $title = 'Page backend not found';
- $message = "The administration page you are looking for was properly registered using the page API, but the backend function
- ($fname) was not found. If this is a plugin page, then this is almost certainly a bug with the plugin.";
- if ( $send_headers )
- {
- die_friendly($title, "
You have requested a page that doesn\'t exist yet.';
- if($session->get_permissions('create_page')) echo ' You can create this page, or return to the homepage.';
- else echo ' Return to the homepage.
';
- if($session->get_permissions('history_rollback')) {
- $e = $db->sql_query('SELECT * FROM '.table_prefix.'logs WHERE action=\'delete\' AND page_id=\''.$paths->cpage['urlname_nons'].'\' AND namespace=\''.$pid[1].'\' ORDER BY time_id DESC;');
- if(!$e) $db->_die('The deletion log could not be selected.');
- if($db->numrows() > 0) {
- $r = $db->fetchrow();
- echo '
This page also appears to have some log entries in the database - it seems that it was deleted on '.$r['date_string'].'. You can probably roll back the deletion.
';
- }
- $db->free_result();
- }
- echo '
- HTTP Error: 404 Not Found
-
';
- }
- $template->footer();
- }
- else
- {
-
- // If we don't have access to the page, get out and quick!
- if(!$session->get_permissions('read'))
- {
- $template->tpl_strings['PAGE_NAME'] = 'Access denied';
- if($send_headers) $template->header();
- echo '
Access to this page is denied. This may be because you are not logged in or you have not met certain criteria for viewing this page.
';
- if($send_headers) $template->footer();
- $r = ob_get_contents();
- ob_end_clean();
- return $r;
- }
-
- ob_start();
- $code = $plugins->setHook('page_custom_handler');
- foreach ( $code as $cmd )
- {
- eval($cmd);
- }
- $text = ob_get_contents();
- if ( $text != '' )
- {
- ob_end_clean();
- return $text;
- }
-
- if($hist_id) {
- $e = $db->sql_query('SELECT page_text,date_string,char_tag FROM '.table_prefix.'logs WHERE page_id=\''.$paths->pages[$page]['urlname_nons'].'\' AND namespace=\''.$pid[1].'\' AND log_type=\'page\' AND action=\'edit\' AND time_id='.$db->escape($hist_id).'');
- if($db->numrows() < 1)
- {
- $db->_die('There were no rows in the text table that matched the page text query.');
- }
- $r = $db->fetchrow();
- $db->free_result();
- $message = '
';
- $q = 'SELECT time_id,action,date_string,page_id,namespace,author,edit_summary,minor_edit FROM '.table_prefix.'logs WHERE log_type=\'page\' AND action!=\'edit\' AND page_id=\''.$paths->cpage['urlname_nons'].'\' AND namespace=\''.$paths->namespace.'\' ORDER BY time_id DESC;';
- if(!$db->sql_query($q)) $db->_die('The history data for the page "'.$paths->cpage['name'].'" could not be selected.');
- if($db->numrows() < 1) echo 'No history entries in this category.';
- else {
-
- echo '
';
- }
- $db->free_result();
- $ret = ob_get_contents();
- ob_end_clean();
- return $ret;
- }
-
- /**
- * Rolls back a logged action
- * @param $id the time ID, a.k.a. the primary key in the logs table
- * @return string
- */
-
- function rollback($id)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- if(!$session->get_permissions('history_rollback')) return('You are not authorized to perform rollbacks.');
- if(!preg_match('#^([0-9]+)$#', (string)$id)) return('The value "id" on the query string must be an integer.');
- $e = $db->sql_query('SELECT log_type,action,date_string,page_id,namespace,page_text,char_tag,author,edit_summary FROM '.table_prefix.'logs WHERE time_id='.$id.';');
- if(!$e) $db->_die('The rollback data could not be selected.');
- $rb = $db->fetchrow();
- $db->free_result();
- switch($rb['log_type']) {
- case "page":
- switch($rb['action']) {
- case "edit":
- $t = $db->escape($rb['page_text']);
- $e = $db->sql_query('UPDATE '.table_prefix.'page_text SET page_text=\''.$t.'\',char_tag=\''.$rb['char_tag'].'\' WHERE page_id=\''.$rb['page_id'].'\' AND namespace=\''.$rb['namespace'].'\'');
- if(!$e) return("An error occurred during the rollback operation.\nMySQL said: ".mysql_error()."\n\nSQL backtrace:\n".$db->sql_backtrace());
- else return('The page "'.$paths->pages[$paths->nslist[$rb['namespace']].$rb['page_id']]['name'].'" has been rolled back to the state it was in on '.$rb['date_string'].'.');
- break;
- case "rename":
- $t = $db->escape($rb['edit_summary']);
- $e = $db->sql_query('UPDATE '.table_prefix.'pages SET name=\''.$t.'\' WHERE urlname=\''.$rb['page_id'].'\' AND namespace=\''.$rb['namespace'].'\'');
- if(!$e) return("An error occurred during the rollback operation.\nMySQL said: ".mysql_error()."\n\nSQL backtrace:\n".$db->sql_backtrace());
- else return('The page "'.$paths->pages[$paths->nslist[$rb['namespace']].$rb['page_id']]['name'].'" has been rolled back to the name it had ("'.$rb['edit_summary'].'") before '.$rb['date_string'].'.');
- break;
- case "prot":
- $e = $db->sql_query('UPDATE '.table_prefix.'pages SET protected=0 WHERE urlname=\''.$rb['page_id'].'\' AND namespace=\''.$rb['namespace'].'\'');
- if(!$e) return("An error occurred during the rollback operation.\nMySQL said: ".mysql_error()."\n\nSQL backtrace:\n".$db->sql_backtrace());
- else return('The page "'.$paths->pages[$paths->nslist[$rb['namespace']].$rb['page_id']]['name'].'" has been unprotected according to the log created at '.$rb['date_string'].'.');
- break;
- case "semiprot":
- $e = $db->sql_query('UPDATE '.table_prefix.'pages SET protected=0 WHERE urlname=\''.$rb['page_id'].'\' AND namespace=\''.$rb['namespace'].'\'');
- if(!$e) return("An error occurred during the rollback operation.\nMySQL said: ".mysql_error()."\n\nSQL backtrace:\n".$db->sql_backtrace());
- else return('The page "'.$paths->pages[$paths->nslist[$rb['namespace']].$rb['page_id']]['name'].'" has been unprotected according to the log created at '.$rb['date_string'].'.');
- break;
- case "unprot":
- $e = $db->sql_query('UPDATE '.table_prefix.'pages SET protected=1 WHERE urlname=\''.$rb['page_id'].'\' AND namespace=\''.$rb['namespace'].'\'');
- if(!$e) return("An error occurred during the rollback operation.\nMySQL said: ".mysql_error()."\n\nSQL backtrace:\n".$db->sql_backtrace());
- else return('The page "'.$paths->pages[$paths->nslist[$rb['namespace']].$rb['page_id']]['name'].'" has been protected according to the log created at '.$rb['date_string'].'.');
- break;
- case "delete":
- if(!$session->get_permissions('history_rollback_extra')) return('Administrative privileges are required for page undeletion.');
- if(isset($paths->pages[$paths->cpage['urlname']])) return('You cannot raise a dead page that is alive.');
- $name = str_replace('_', ' ', $rb['page_id']);
- $e = $db->sql_query('INSERT INTO '.table_prefix.'pages(name,urlname,namespace) VALUES( \''.$name.'\', \''.$rb['page_id'].'\',\''.$rb['namespace'].'\' )');if(!$e) return("An error occurred during the rollback operation.\nMySQL said: ".mysql_error()."\n\nSQL backtrace:\n".$db->sql_backtrace());
- $e = $db->sql_query('SELECT page_text,char_tag FROM '.table_prefix.'logs WHERE page_id=\''.$rb['page_id'].'\' AND namespace=\''.$rb['namespace'].'\' AND log_type=\'page\' AND action=\'edit\' ORDER BY time_id DESC;'); if(!$e) return("An error occurred during the rollback operation.\nMySQL said: ".mysql_error()."\n\nSQL backtrace:\n".$db->sql_backtrace());
- $r = $db->fetchrow();
- $e = $db->sql_query('INSERT INTO '.table_prefix.'page_text(page_id,namespace,page_text,char_tag) VALUES(\''.$rb['page_id'].'\',\''.$rb['namespace'].'\',\''.$db->escape($r['page_text']).'\',\''.$r['char_tag'].'\')'); if(!$e) return("An error occurred during the rollback operation.\nMySQL said: ".mysql_error()."\n\nSQL backtrace:\n".$db->sql_backtrace());
- return('The page "'.$name.'" has been undeleted according to the log created at '.$rb['date_string'].'.');
- break;
- case "reupload":
- if(!$session->get_permissions('history_rollbacks_extra')) return('Administrative privileges are required for file rollbacks.');
- $newtime = time();
- $newdate = date('d M Y h:i a');
- if(!$db->sql_query('UPDATE '.table_prefix.'logs SET time_id='.$newtime.',date_string=\''.$newdate.'\' WHERE time_id='.$id)) return('Error during query: '.mysql_error());
- if(!$db->sql_query('UPDATE '.table_prefix.'files SET time_id='.$newtime.' WHERE time_id='.$id)) return('Error during query: '.mysql_error());
- return('The file has been rolled back to the version uploaded on '.date('d M Y h:i a', (int)$id).'.');
- break;
- default:
- return('Rollback of the action "'.$rb['action'].'" is not yet supported.');
- break;
- }
- break;
- case "security":
- case "login":
- return('A '.$rb['log_type'].'-related log entry cannot be rolled back.');
- break;
- default:
- return('Unknown log entry type: "'.$rb['log_type'].'"');
- }
- }
-
- /**
- * Posts a comment.
- * @param $page_id the page ID
- * @param $namespace the namespace
- * @param $name the name of the person posting, defaults to current username/IP
- * @param $subject the subject line of the comment
- * @param $text the comment text
- * @return string javascript code
- */
-
- function addcomment($page_id, $namespace, $name, $subject, $text, $captcha_code = false, $captcha_id = false)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- $_ob = '';
- if(!$session->get_permissions('post_comments'))
- return 'Access denied';
- if(getConfig('comments_need_login') == '2' && !$session->user_logged_in) _die('Access denied to post comments: you need to be logged in first.');
- if(getConfig('comments_need_login') == '1' && !$session->user_logged_in)
- {
- if(!$captcha_code || !$captcha_id) _die('BUG: PageUtils::addcomment: no CAPTCHA data passed to method');
- $result = $session->get_captcha($captcha_id);
- if($captcha_code != $result) _die('The confirmation code you entered was incorrect.');
- }
- $text = RenderMan::preprocess_text($text);
- $name = $session->user_logged_in ? RenderMan::preprocess_text($session->username) : RenderMan::preprocess_text($name);
- $subj = RenderMan::preprocess_text($subject);
- if(getConfig('approve_comments')=='1') $appr = '0'; else $appr = '1';
- $q = 'INSERT INTO '.table_prefix.'comments(page_id,namespace,subject,comment_data,name,user_id,approved,time) VALUES(\''.$page_id.'\',\''.$namespace.'\',\''.$subj.'\',\''.$text.'\',\''.$name.'\','.$session->user_id.','.$appr.','.time().')';
- $e = $db->sql_query($q);
- if(!$e) die('alert(unescape(\''.rawurlencode('Error inserting comment data: '.mysql_error().'\n\nQuery:\n'.$q).'\'))');
- else $_ob .= '
Your comment has been posted.
';
- return PageUtils::comments($page_id, $namespace, false, Array(), $_ob);
- }
-
- /**
- * Generates partly-compiled HTML/Javascript code to be eval'ed by the user's browser to display comments
- * @param $page_id the page ID
- * @param $namespace the namespace
- * @param $action administrative action to perform, default is false
- * @param $flags additional info for $action, shouldn't be used except when deleting/approving comments, etc.
- * @param $_ob text to prepend to output, used by PageUtils::addcomment
- * @return array
- * @access private
- */
-
- function comments_raw($page_id, $namespace, $action = false, $flags = Array(), $_ob = '')
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
-
- $pname = $paths->nslist[$namespace] . $page_id;
-
- ob_start();
-
- if($action && $session->get_permissions('mod_comments')) // Nip hacking attempts in the bud
- {
- switch($action) {
- case "delete":
- if(isset($flags['id']))
- {
- $q = 'DELETE FROM '.table_prefix.'comments WHERE page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\' AND comment_id='.intval($flags['id']).' LIMIT 1;';
- } else {
- $n = $db->escape($flags['name']);
- $s = $db->escape($flags['subj']);
- $t = $db->escape($flags['text']);
- $q = 'DELETE FROM '.table_prefix.'comments WHERE page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\' AND name=\''.$n.'\' AND subject=\''.$s.'\' AND comment_data=\''.$t.'\' LIMIT 1;';
- }
- $e=$db->sql_query($q);
- if(!$e) die('alert(unesape(\''.rawurlencode('Error during query: '.mysql_error().'\n\nQuery:\n'.$q).'\'));');
- break;
- case "approve":
- if(isset($flags['id']))
- {
- $where = 'comment_id='.intval($flags['id']);
- } else {
- $n = $db->escape($flags['name']);
- $s = $db->escape($flags['subj']);
- $t = $db->escape($flags['text']);
- $where = 'name=\''.$n.'\' AND subject=\''.$s.'\' AND comment_data=\''.$t.'\'';
- }
- $q = 'SELECT approved FROM '.table_prefix.'comments WHERE page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\' AND '.$where.' LIMIT 1;';
- $e = $db->sql_query($q);
- if(!$e) die('alert(unesape(\''.rawurlencode('Error selecting approval status: '.mysql_error().'\n\nQuery:\n'.$q).'\'));');
- $r = $db->fetchrow();
- $db->free_result();
- $a = ( $r['approved'] ) ? '0' : '1';
- $q = 'UPDATE '.table_prefix.'comments SET approved='.$a.' WHERE page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\' AND '.$where.';';
- $e=$db->sql_query($q);
- if(!$e) die('alert(unesape(\''.rawurlencode('Error during query: '.mysql_error().'\n\nQuery:\n'.$q).'\'));');
- if($a=='1') $v = 'Unapprove';
- else $v = 'Approve';
- echo 'document.getElementById("mdgApproveLink'.$_GET['id'].'").innerHTML="'.$v.'";';
- break;
- }
- }
-
- if(!defined('ENANO_TEMPLATE_LOADED'))
- {
- $template->load_theme($session->theme, $session->style);
- }
-
- $tpl = $template->makeParser('comment.tpl');
-
- $e = $db->sql_query('SELECT * FROM '.table_prefix.'comments WHERE page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\' AND approved=0;');
- if(!$e) $db->_die('The comment text data could not be selected.');
- $num_unapp = $db->numrows();
- $db->free_result();
- $e = $db->sql_query('SELECT * FROM '.table_prefix.'comments WHERE page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\' AND approved=1;');
- if(!$e) $db->_die('The comment text data could not be selected.');
- $num_app = $db->numrows();
- $db->free_result();
- $lq = $db->sql_query('SELECT c.comment_id,c.subject,c.name,c.comment_data,c.approved,c.time,c.user_id,u.user_level,u.signature
- FROM '.table_prefix.'comments AS c
- LEFT JOIN '.table_prefix.'users AS u
- ON c.user_id=u.user_id
- WHERE page_id=\''.$page_id.'\'
- AND namespace=\''.$namespace.'\' ORDER BY c.time ASC;');
- if(!$lq) _die('The comment text data could not be selected. '.mysql_error());
- $_ob .= '
If you have comments or suggestions on this article, you can shout it out here.';
- if(getConfig('approve_comments')=='1') $_ob .= ' Before your comment will be visible to the public, a moderator will have to approve it.';
- if(getConfig('comments_need_login') == '1' && !$session->user_logged_in) $_ob .= ' Because you are not logged in, you will need to enter a visual confirmation before your comment will be posted.';
- $sn = $session->user_logged_in ? $session->username . '' : '';
- $_ob .= ' Leave a comment...
-
';
- }
- $list .= '};';
- echo 'document.getElementById(\'ajaxEditContainer\').innerHTML = unescape(\''. rawurlencode($_ob) .'\');
- ' . $list;
- echo 'Fat.fade_all(); document.getElementById(\'mdgCommentForm\').style.display = \'none\'; document.getElementById(\'mdgCommentFormLink\').style.display="inline";';
-
- $ret = ob_get_contents();
- ob_end_clean();
- return Array($ret, $_ob);
-
- }
-
- /**
- * Generates ready-to-execute Javascript code to be eval'ed by the user's browser to display comments
- * @param $page_id the page ID
- * @param $namespace the namespace
- * @param $action administrative action to perform, default is false
- * @param $flags additional info for $action, shouldn't be used except when deleting/approving comments, etc.
- * @param $_ob text to prepend to output, used by PageUtils::addcomment
- * @return string
- */
-
- function comments($page_id, $namespace, $action = false, $id = -1, $_ob = '')
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- $r = PageUtils::comments_raw($page_id, $namespace, $action, $id, $_ob);
- return $r[0];
- }
-
- /**
- * Generates HTML code for comments - used in browser compatibility mode
- * @param $page_id the page ID
- * @param $namespace the namespace
- * @param $action administrative action to perform, default is false
- * @param $flags additional info for $action, shouldn't be used except when deleting/approving comments, etc.
- * @param $_ob text to prepend to output, used by PageUtils::addcomment
- * @return string
- */
-
- function comments_html($page_id, $namespace, $action = false, $id = -1, $_ob = '')
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- $r = PageUtils::comments_raw($page_id, $namespace, $action, $id, $_ob);
- return $r[1];
- }
-
- /**
- * Updates comment data.
- * @param $page_id the page ID
- * @param $namespace the namespace
- * @param $subject new subject
- * @param $text new text
- * @param $old_subject the old subject, unprocessed and identical to the value in the DB
- * @param $old_text the old text, unprocessed and identical to the value in the DB
- * @param $id the javascript list ID, used internally by the client-side app
- * @return string
- */
-
- function savecomment($page_id, $namespace, $subject, $text, $old_subject, $old_text, $id = -1)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- if(!$session->get_permissions('edit_comments'))
- return 'result="BAD";error="Access denied"';
- // Avoid SQL injection
- $old_text = $db->escape($old_text);
- $old_subject = $db->escape($old_subject);
- // Safety check - username/login
- if(!$session->get_permissions('mod_comments')) // allow mods to edit comments
- {
- if(!$session->user_logged_in) _die('AJAX comment save safety check failed because you are not logged in. Sometimes this can happen because you are using a browser that does not send cookies as part of AJAX requests.
Please log in and try again.');
- $q = 'SELECT c.name FROM '.table_prefix.'comments c, '.table_prefix.'users u WHERE comment_data=\''.$old_text.'\' AND subject=\''.$old_subject.'\' AND page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\' AND u.user_id=c.user_id;';
- $s = $db->sql_query($q);
- if(!$s) _die('SQL error during safety check: '.mysql_error().'
Attempted SQL:
'.htmlspecialchars($q).'
');
- $r = $db->fetchrow($s);
- $db->free_result();
- if($db->numrows() < 1 || $r['name'] != $session->username) _die('Safety check failed, probably due to a hacking attempt.');
- }
- $s = RenderMan::preprocess_text($subject);
- $t = RenderMan::preprocess_text($text);
- $sql = 'UPDATE '.table_prefix.'comments SET subject=\''.$s.'\',comment_data=\''.$t.'\' WHERE comment_data=\''.$old_text.'\' AND subject=\''.$old_subject.'\' AND page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\'';
- $result = $db->sql_query($sql);
- if($result)
- {
- return 'result="GOOD";
- list['.$id.'][\'subject\'] = unescape(\''.str_replace('%5Cn', '%0A', rawurlencode(str_replace('{{EnAnO:Newline}}', '\\n', stripslashes(str_replace('\\n', '{{EnAnO:Newline}}', $s))))).'\');
- list['.$id.'][\'comment\'] = unescape(\''.str_replace('%5Cn', '%0A', rawurlencode(str_replace('{{EnAnO:Newline}}', '\\n', stripslashes(str_replace('\\n', '{{EnAnO:Newline}}', $t))))).'\'); id = '.$id.';
- s = unescape(\''.rawurlencode($s).'\');
- t = unescape(\''.str_replace('%5Cn', ' ', rawurlencode(RenderMan::render(str_replace('{{EnAnO:Newline}}', "\n", stripslashes(str_replace('\\n', '{{EnAnO:Newline}}', $t)))))).'\');';
- }
- else
- {
- return 'result="BAD"; error=unescape("'.rawurlencode('Enano encountered a problem whilst saving the comment.
- Performed SQL:
- '.$sql.'
-
- Error returned by MySQL: '.mysql_error()).'");';
- }
- }
-
- /**
- * Updates comment data using the comment_id column instead of the old, messy way
- * @param $page_id the page ID
- * @param $namespace the namespace
- * @param $subject new subject
- * @param $text new text
- * @param $id the comment ID (primary key in enano_comments table)
- * @return string
- */
-
- function savecomment_neater($page_id, $namespace, $subject, $text, $id)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- if(!is_int($id)) die('PageUtils::savecomment: $id is not an integer, aborting for safety');
- if(!$session->get_permissions('edit_comments'))
- return 'Access denied';
- // Safety check - username/login
- if(!$session->get_permissions('mod_comments')) // allow mods to edit comments
- {
- if(!$session->user_logged_in) _die('AJAX comment save safety check failed because you are not logged in. Sometimes this can happen because you are using a browser that does not send cookies as part of AJAX requests.
Please log in and try again.');
- $q = 'SELECT c.name FROM '.table_prefix.'comments c, '.table_prefix.'users u WHERE comment_id='.$id.' AND page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\' AND u.user_id=c.user_id;';
- $s = $db->sql_query($q);
- if(!$s) _die('SQL error during safety check: '.mysql_error().'
Attempted SQL:
'.htmlspecialchars($q).'
');
- $r = $db->fetchrow($s);
- if($db->numrows() < 1 || $r['name'] != $session->username) _die('Safety check failed, probably due to a hacking attempt.');
- $db->free_result();
- }
- $s = RenderMan::preprocess_text($subject);
- $t = RenderMan::preprocess_text($text);
- $sql = 'UPDATE '.table_prefix.'comments SET subject=\''.$s.'\',comment_data=\''.$t.'\' WHERE comment_id='.$id.' AND page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\'';
- $result = $db->sql_query($sql);
- if($result)
- return 'good';
- else return 'Enano encountered a problem whilst saving the comment.
- Performed SQL:
- '.$sql.'
-
- Error returned by MySQL: '.mysql_error();
- }
-
- /**
- * Deletes a comment.
- * @param $page_id the page ID
- * @param $namespace the namespace
- * @param $name the name the user posted under
- * @param $subj the subject of the comment to be deleted
- * @param $text the text of the comment to be deleted
- * @param $id the javascript list ID, used internally by the client-side app
- * @return string
- */
-
- function deletecomment($page_id, $namespace, $name, $subj, $text, $id)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
-
- if(!$session->get_permissions('edit_comments'))
- return 'alert("Access to delete/edit comments is denied");';
-
- if(!preg_match('#^([0-9]+)$#', (string)$id)) die('$_GET[id] is improperly formed.');
- $n = $db->escape($name);
- $s = $db->escape($subj);
- $t = $db->escape($text);
-
- // Safety check - username/login
- if(!$session->get_permissions('mod_comments')) // allows mods to delete comments
- {
- if(!$session->user_logged_in) _die('AJAX comment save safety check failed because you are not logged in. Sometimes this can happen because you are using a browser that does not send cookies as part of AJAX requests.
Please log in and try again.');
- $q = 'SELECT c.name FROM '.table_prefix.'comments c, '.table_prefix.'users u WHERE comment_data=\''.$t.'\' AND subject=\''.$s.'\' AND page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\' AND u.user_id=c.user_id;';
- $s = $db->sql_query($q);
- if(!$s) _die('SQL error during safety check: '.mysql_error().'
Attempted SQL:
'.htmlspecialchars($q).'
');
- $r = $db->fetchrow($s);
- if($db->numrows() < 1 || $r['name'] != $session->username) _die('Safety check failed, probably due to a hacking attempt.');
- $db->free_result();
- }
- $q = 'DELETE FROM '.table_prefix.'comments WHERE page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\' AND name=\''.$n.'\' AND subject=\''.$s.'\' AND comment_data=\''.$t.'\' LIMIT 1;';
- $e=$db->sql_query($q);
- if(!$e) return('alert(unesape(\''.rawurlencode('Error during query: '.mysql_error().'\n\nQuery:\n'.$q).'\'));');
- return('good');
- }
-
- /**
- * Deletes a comment in a cleaner fashion.
- * @param $page_id the page ID
- * @param $namespace the namespace
- * @param $id the comment ID (primary key)
- * @return string
- */
-
- function deletecomment_neater($page_id, $namespace, $id)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
-
- if(!preg_match('#^([0-9]+)$#', (string)$id)) die('$_GET[id] is improperly formed.');
-
- if(!$session->get_permissions('edit_comments'))
- return 'alert("Access to delete/edit comments is denied");';
-
- // Safety check - username/login
- if(!$session->get_permissions('mod_comments')) // allows mods to delete comments
- {
- if(!$session->user_logged_in) _die('AJAX comment save safety check failed because you are not logged in. Sometimes this can happen because you are using a browser that does not send cookies as part of AJAX requests.
Please log in and try again.');
- $q = 'SELECT c.name FROM '.table_prefix.'comments c, '.table_prefix.'users u WHERE comment_id='.$id.' AND page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\' AND u.user_id=c.user_id;';
- $s = $db->sql_query($q);
- if(!$s) _die('SQL error during safety check: '.mysql_error().'
Attempted SQL:
'.htmlspecialchars($q).'
');
- $r = $db->fetchrow($s);
- if($db->numrows() < 1 || $r['name'] != $session->username) _die('Safety check failed, probably due to a hacking attempt.');
- $db->free_result();
- }
- $q = 'DELETE FROM '.table_prefix.'comments WHERE page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\' AND comment_id='.$id.' LIMIT 1;';
- $e=$db->sql_query($q);
- if(!$e) return('alert(unesape(\''.rawurlencode('Error during query: '.mysql_error().'\n\nQuery:\n'.$q).'\'));');
- return('good');
- }
-
- /**
- * Renames a page.
- * @param $page_id the page ID
- * @param $namespace the namespace
- * @param $name the new name for the page
- * @return string error string or success message
- */
-
- function rename($page_id, $namespace, $name)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
-
- $pname = $paths->nslist[$namespace] . $page_id;
-
- $prot = ( ( $paths->pages[$pname]['protected'] == 2 && $session->user_logged_in && $session->reg_time + 60*60*24*4 < time() ) || $paths->pages[$pname]['protected'] == 1) ? true : false;
- $wiki = ( ( $paths->pages[$pname]['wiki_mode'] == 2 && getConfig('wiki_mode') == '1') || $paths->pages[$pname]['wiki_mode'] == 1) ? true : false;
-
- if( empty($name)) die('Name is too short');
- if( ( $session->get_permissions('rename') && ( ( $prot && $session->get_permissions('even_when_protected') ) || !$prot ) ) && ( $paths->namespace != 'Special' && $paths->namespace != 'Admin' )) {
- $e = $db->sql_query('INSERT INTO '.table_prefix.'logs(time_id,date_string,log_type,action,page_id,namespace,author,edit_summary) VALUES('.time().', \''.date('d M Y h:i a').'\', \'page\', \'rename\', \''.$paths->cpage['urlname_nons'].'\', \''.$paths->namespace.'\', \''.$session->username.'\', \''.$paths->cpage['name'].'\')');
- if(!$e) $db->_die('The page title could not be updated.');
- $e = $db->sql_query('UPDATE '.table_prefix.'pages SET name=\''.$db->escape($name).'\' WHERE urlname=\''.$page_id.'\' AND namespace=\''.$namespace.'\';');
- if(!$e) $db->_die('The page title could not be updated.');
- else return('The page "'.$paths->pages[$pname]['name'].'" has been renamed to "'.$name.'". You are encouraged to leave a comment explaining your action.
-
-You will see the change take effect the next time you reload this page.');
- } else {
- return('Access is denied.');
- }
- }
-
- /**
- * Flushes (clears) the action logs for a given page
- * @param $page_id the page ID
- * @param $namespace the namespace
- * @return string error/success string
- */
-
- function flushlogs($page_id, $namespace)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- if(!$session->get_permissions('clear_logs')) die('Administrative privileges are required to flush logs, you loser.');
- $e = $db->sql_query('DELETE FROM '.table_prefix.'logs WHERE page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\';');
- if(!$e) $db->_die('The log entries could not be deleted.');
- $e = $db->sql_query('SELECT page_text,char_tag FROM '.table_prefix.'page_text WHERE page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\';');
- if(!$e) $db->_die('The current page text could not be selected; as a result, creating the backup of the page failed. Please make a backup copy of the page by clicking Edit this page and then clicking Save Changes.');
- $row = $db->fetchrow();
- $db->free_result();
- $q='INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,page_id,namespace,page_text,char_tag,author,edit_summary,minor_edit) VALUES(\'page\', \'edit\', '.time().', \''.date('d M Y h:i a').'\', \''.$page_id.'\', \''.$namespace.'\', \''.$db->escape($row['page_text']).'\', \''.$row['char_tag'].'\', \''.$session->username.'\', \''."Automatic backup created when logs were purged".'\', '.'false'.');';
- if(!$db->sql_query($q)) $db->_die('The history (log) entry could not be inserted into the logs table.');
- return('The logs for this page have been cleared. A backup of this page has been added to the logs table so that this page can be restored in case of vandalism or spam later.');
- }
-
- /**
- * Deletes a page.
- * @param $page_id the condemned page ID
- * @param $namespace the condemned namespace
- * @return string
- */
-
- function deletepage($page_id, $namespace)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- $perms = $session->fetch_page_acl($page_id, $namespace);
- if(!$perms->get_permissions('delete_page')) die('Administrative privileges are required to delete pages, you loser.');
- $e = $db->sql_query('INSERT INTO '.table_prefix.'logs(time_id,date_string,log_type,action,page_id,namespace,author) VALUES('.time().', \''.date('d M Y h:i a').'\', \'page\', \'delete\', \''.$page_id.'\', \''.$namespace.'\', \''.$session->username.'\')');
- if(!$e) $db->_die('The page log entry could not be inserted.');
- $e = $db->sql_query('DELETE FROM '.table_prefix.'categories WHERE page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\'');
- if(!$e) $db->_die('The page categorization entries could not be deleted.');
- $e = $db->sql_query('DELETE FROM '.table_prefix.'comments WHERE page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\'');
- if(!$e) $db->_die('The page comments could not be deleted.');
- $e = $db->sql_query('DELETE FROM '.table_prefix.'page_text WHERE page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\'');
- if(!$e) $db->_die('The page text entry could not be deleted.');
- $e = $db->sql_query('DELETE FROM '.table_prefix.'pages WHERE urlname=\''.$page_id.'\' AND namespace=\''.$namespace.'\'');
- if(!$e) $db->_die('The page entry could not be deleted.');
- $e = $db->sql_query('DELETE FROM '.table_prefix.'files WHERE page_id=\''.$page_id.'\'');
- if(!$e) $db->_die('The file entry could not be deleted.');
- return('This page has been deleted. Note that there is still a log of edits and actions in the database, and anyone with admin rights can raise this page from the dead unless the log is cleared. If the deleted file is an image, there may still be cached thumbnails of it in the cache/ directory, which is inaccessible to users.');
- }
-
- /**
- * Increments the deletion votes for a page by 1, and adds the current username/IP to the list of users that have voted for the page to prevent dual-voting
- * @param $page_id the page ID
- * @param $namespace the namespace
- * @return string
- */
-
- function delvote($page_id, $namespace)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- if(!$session->get_permissions('vote_delete'))
- return 'Access denied';
- $pname = $paths->nslist[$namespace] . $page_id;
- $cv = $paths->pages[$pname]['delvotes'];
- $ips = $paths->pages[$pname]['delvote_ips'];
- $ips = explode('|', $ips);
- if(in_array($_SERVER['REMOTE_ADDR'], $ips)) return('It appears that you have already voted to have this page deleted.');
- if($session->user_logged_in)
- if(in_array($session->username, $ips))
- return('It appears that you have already voted to have this page deleted.');
- $ips[] = $_SERVER['REMOTE_ADDR'];
- if($session->user_logged_in) $ips[] = $session->username;
- $ips = implode('|', $ips);
- $ips = substr($ips, 1, strlen($ips));
- $cv++;
- $q = 'UPDATE '.table_prefix.'pages SET delvotes='.$cv.',delvote_ips=\''.$ips.'\' WHERE urlname=\''.$page_id.'\' AND namespace=\''.$namespace.'\'';
- $w = $db->sql_query($q);
- if(!$w) return("Error updating pages table: ".mysql_error()."\n\nAttemped SQL:\n".$q);
- return('Your vote to have this page deleted has been cast.'."\nYou are encouraged to leave a comment explaining the reason for your vote.");
- }
-
- /**
- * Resets the number of votes against a page to 0.
- * @param $page_id the page ID
- * @param $namespace the namespace
- * @return string
- */
-
- function resetdelvotes($page_id, $namespace)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- if(!$session->get_permissions('vote_reset')) die('You need moderator rights in order to do this, stinkin\' hacker.');
- $q = 'UPDATE '.table_prefix.'pages SET delvotes=0,delvote_ips=\'\' WHERE urlname=\''.$page_id.'\' AND namespace=\''.$namespace.'\'';
- $e = $db->sql_query($q);
- if(!$e) $db->_die('The number of delete votes was not reset.');
- else return('The number of votes for having this page deleted has been reset to zero.');
- }
-
- /**
- * Gets a list of styles for a given theme name.
- * @param $id the name of the directory for the theme
- * @return string Javascript code
- */
-
- function getstyles()
- {
- $dir = './themes/'.$_GET['id'].'/css/';
- $list = Array();
- // Open a known directory, and proceed to read its contents
- if (is_dir($dir)) {
- if ($dh = opendir($dir)) {
- while (($file = readdir($dh)) !== false) {
- if(preg_match('#^(.*?)\.css$#is', $file) && $file != '_printable.css') { // _printable.css should be included with every theme
- // it should be a copy of the original style, but
- // mostly black and white
- // Note to self: document this
- $list[] = substr($file, 0, strlen($file)-4);
- }
- }
- closedir($dh);
- }
- } else return($dir.' is not a dir');
- $l = 'var list = new Array();';
- $i = -1;
- foreach($list as $li) {
- $i++;
- $l .= "list[$i] = '$li';";
- }
- return $l;
- }
-
- /**
- * Assembles a Javascript app with category information
- * @param $page_id the page ID
- * @param $namespace the namespace
- * @return string Javascript code
- */
-
- function catedit($page_id, $namespace)
- {
- $d = PageUtils::catedit_raw($page_id, $namespace);
- return $d[0] . ' /* BEGIN CONTENT */ document.getElementById("ajaxEditContainer").innerHTML = unescape(\''.rawurlencode($d[1]).'\');';
- }
-
- /**
- * Does the actual HTML/javascript generation for cat editing, but returns an array
- * @access private
- */
-
- function catedit_raw($page_id, $namespace)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- ob_start();
- $_ob = '';
- $e = $db->sql_query('SELECT category_id FROM '.table_prefix.'categories WHERE page_id=\''.$paths->cpage['urlname_nons'].'\' AND namespace=\''.$paths->namespace.'\'');
- if(!$e) jsdie('Error selecting category information for current page: '.mysql_error());
- $cat_current = Array();
- while($r = $db->fetchrow())
- {
- $cat_current[] = $r;
- }
- $db->free_result();
- $cat_all = Array();
- for($i=0;$ipages)/2;$i++)
- {
- if($paths->pages[$i]['namespace']=='Category') $cat_all[] = $paths->pages[$i];
- }
-
- // Make $cat_all an associative array, like $paths->pages
- $sz = sizeof($cat_all);
- for($i=0;$i<$sz;$i++)
- {
- $cat_all[$cat_all[$i]['urlname_nons']] = $cat_all[$i];
- }
- // Now, the "zipper" function - join the list of categories with the list of cats that this page is a part of
- $cat_info = $cat_all;
- for($i=0;$i';
- if ( sizeof($cat_info) < 1 )
- {
- $_ob .= '
';
- }
-
- /**
- * Makes a scrollable box
- * @param string $text the inner HTML
- * @param int $height Optional - the maximum height. Defaults to 250.
- * @return string
- */
-
- function scrollBox($text, $height = 250)
- {
- return '
'.$text.'
';
- }
-
- /**
- * Generates a diff summary between two page revisions.
- * @param $page_id the page ID
- * @param $namespace the namespace
- * @param $id1 the time ID of the first revision
- * @param $id2 the time ID of the second revision
- * @return string XHTML-formatted diff
- */
-
- function pagediff($page_id, $namespace, $id1, $id2)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- if(!$session->get_permissions('history_view'))
- return 'Access denied';
- if(!preg_match('#^([0-9]+)$#', (string)$id1) ||
- !preg_match('#^([0-9]+)$#', (string)$id2 )) return 'SQL injection attempt';
- // OK we made it through security
- // Safest way to make sure we don't end up with the revisions in wrong columns is to make 2 queries
- if(!$q1 = $db->sql_query('SELECT page_text,char_tag,author,edit_summary FROM '.table_prefix.'logs WHERE time_id='.$id1.' AND log_type=\'page\' AND action=\'edit\' AND page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\';')) return 'MySQL error: '.mysql_error();
- if(!$q2 = $db->sql_query('SELECT page_text,char_tag,author,edit_summary FROM '.table_prefix.'logs WHERE time_id='.$id2.' AND log_type=\'page\' AND action=\'edit\' AND page_id=\''.$page_id.'\' AND namespace=\''.$namespace.'\';')) return 'MySQL error: '.mysql_error();
- $row1 = $db->fetchrow($q1);
- $db->free_result($q1);
- $row2 = $db->fetchrow($q2);
- $db->free_result($q2);
- if(sizeof($row1) < 1 || sizeof($row2) < 2) return 'Couldn\'t find any rows that matched the query. The time ID probably doesn\'t exist in the logs table.';
- $text1 = $row1['page_text'];
- $text2 = $row2['page_text'];
- $time1 = date('F d, Y h:i a', $id1);
- $time2 = date('F d, Y h:i a', $id2);
- $_ob = "
-
Comparing revisions: {$time1} → {$time2}
- ";
- // Free some memory
- unset($row1, $row2, $q1, $q2);
-
- $_ob .= RenderMan::diff($text1, $text2);
- return $_ob;
- }
-
- /**
- * Gets ACL information about the selected page for target type X and target ID Y.
- * @param string $page_id The page ID
- * @param string $namespace The namespace
- * @param array $parms What to select. This is an array purely for JSON compatibility. It should be an associative array with keys target_type and target_id.
- * @return array
- */
-
- function acl_editor($parms = Array())
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- if(!$session->get_permissions('edit_acl') && $session->user_level < USER_LEVEL_ADMIN)
- return 'Access is denied.';
- $parms['page_id'] = ( isset($parms['page_id']) ) ? $parms['page_id'] : false;
- $parms['namespace'] = ( isset($parms['namespace']) ) ? $parms['namespace'] : false;
- $page_id =& $parms['page_id'];
- $namespace =& $parms['namespace'];
- $page_where_clause = ( empty($page_id) || empty($namespace) ) ? 'AND a.page_id IS NULL AND a.namespace IS NULL' : 'AND a.page_id=\''.$db->escape($page_id).'\' AND a.namespace=\''.$db->escape($namespace).'\'';
- $page_where_clause_lite = ( empty($page_id) || empty($namespace) ) ? 'AND page_id IS NULL AND namespace IS NULL' : 'AND page_id=\''.$db->escape($page_id).'\' AND namespace=\''.$db->escape($namespace).'\'';
- //die(print_r($page_id,true));
- $template->load_theme();
- // $perms_obj = $session->fetch_page_acl($page_id, $namespace);
- $perms_obj =& $session;
- $return = Array();
- if ( !file_exists(ENANO_ROOT . '/themes/' . $session->theme . '/acledit.tpl') )
- {
- return Array(
- 'mode' => 'error',
- 'error' => 'It seems that (a) the file acledit.tpl is missing from these theme, and (b) the JSON response is working.',
- );
- }
- $return['template'] = $template->extract_vars('acledit.tpl');
- $return['page_id'] = $page_id;
- $return['namespace'] = $namespace;
- if(isset($parms['mode']))
- {
- switch($parms['mode'])
- {
- case 'listgroups':
- $return['groups'] = Array();
- $q = $db->sql_query('SELECT group_id,group_name FROM '.table_prefix.'groups ORDER BY group_name ASC;');
- while($row = $db->fetchrow())
- {
- $return['groups'][] = Array(
- 'id' => $row['group_id'],
- 'name' => $row['group_name'],
- );
- }
- $db->free_result();
- break;
- case 'seltarget':
- $return['mode'] = 'seltarget';
- $return['acl_types'] = $perms_obj->acl_types;
- $return['acl_deps'] = $perms_obj->acl_deps;
- $return['acl_descs'] = $perms_obj->acl_descs;
- $return['target_type'] = $parms['target_type'];
- $return['target_id'] = $parms['target_id'];
- switch($parms['target_type'])
- {
- case ACL_TYPE_USER:
- $q = $db->sql_query('SELECT a.rules,u.user_id FROM '.table_prefix.'users AS u
- LEFT JOIN '.table_prefix.'acl AS a
- ON a.target_id=u.user_id
- WHERE a.target_type='.ACL_TYPE_USER.'
- AND u.username=\''.$db->escape($parms['target_id']).'\'
- '.$page_where_clause.';');
- if(!$q)
- return(Array('mode'=>'error','error'=>mysql_error()));
- if($db->numrows() < 1)
- {
- $return['type'] = 'new';
- $q = $db->sql_query('SELECT user_id FROM '.table_prefix.'users WHERE username=\''.$db->escape($parms['target_id']).'\';');
- if(!$q)
- return(Array('mode'=>'error','error'=>mysql_error()));
- if($db->numrows() < 1)
- return Array('mode'=>'error','error'=>'The username you entered was not found.');
- $row = $db->fetchrow();
- $return['target_name'] = $return['target_id'];
- $return['target_id'] = intval($row['user_id']);
- $return['current_perms'] = $session->acl_types;
- }
- else
- {
- $return['type'] = 'edit';
- $row = $db->fetchrow();
- $return['target_name'] = $return['target_id'];
- $return['target_id'] = intval($row['user_id']);
- $return['current_perms'] = $session->acl_merge($perms_obj->acl_types, $session->string_to_perm($row['rules']));
- }
- $db->free_result();
- // Eliminate types that don't apply to this namespace
- if ( $namespace )
- {
- foreach ( $return['current_perms'] AS $i => $perm )
- {
- if ( ( $page_id != null && $namespace != null ) && ( !in_array ( $namespace, $session->acl_scope[$i] ) && !in_array('All', $session->acl_scope[$i]) ) )
- {
- // echo "// SCOPE CONTROL: eliminating: $i\n";
- unset($return['current_perms'][$i]);
- unset($return['acl_types'][$i]);
- unset($return['acl_descs'][$i]);
- unset($return['acl_deps'][$i]);
- }
- }
- }
- break;
- case ACL_TYPE_GROUP:
- $q = $db->sql_query('SELECT a.rules,g.group_name,g.group_id FROM '.table_prefix.'groups AS g
- LEFT JOIN '.table_prefix.'acl AS a
- ON a.target_id=g.group_id
- WHERE a.target_type='.ACL_TYPE_GROUP.'
- AND g.group_id=\''.intval($parms['target_id']).'\'
- '.$page_where_clause.';');
- if(!$q)
- return(Array('mode'=>'error','error'=>mysql_error()));
- if($db->numrows() < 1)
- {
- $return['type'] = 'new';
- $q = $db->sql_query('SELECT group_id,group_name FROM '.table_prefix.'groups WHERE group_id=\''.intval($parms['target_id']).'\';');
- if(!$q)
- return(Array('mode'=>'error','error'=>mysql_error()));
- if($db->numrows() < 1)
- return Array('mode'=>'error','error'=>'The group ID you submitted is not valid.');
- $row = $db->fetchrow();
- $return['target_name'] = $row['group_name'];
- $return['target_id'] = intval($row['group_id']);
- $return['current_perms'] = $session->acl_types;
- }
- else
- {
- $return['type'] = 'edit';
- $row = $db->fetchrow();
- $return['target_name'] = $row['group_name'];
- $return['target_id'] = intval($row['group_id']);
- $return['current_perms'] = $session->acl_merge($session->acl_types, $session->string_to_perm($row['rules']));
- }
- $db->free_result();
- // Eliminate types that don't apply to this namespace
- if ( $namespace )
- {
- foreach ( $return['current_perms'] AS $i => $perm )
- {
- if ( ( $page_id != false && $namespace != false ) && ( !in_array ( $namespace, $session->acl_scope[$i] ) && !in_array('All', $session->acl_scope[$i]) ) )
- {
- // echo "// SCOPE CONTROL: eliminating: $i\n"; //; ".print_r($namespace,true).":".print_r($page_id,true)."\n";
- unset($return['current_perms'][$i]);
- unset($return['acl_types'][$i]);
- unset($return['acl_descs'][$i]);
- unset($return['acl_deps'][$i]);
- }
- }
- }
- //return Array('mode'=>'debug','text'=>print_r($return, true));
- break;
- default:
- return Array('mode'=>'error','error','Invalid ACL type ID');
- break;
- }
- return $return;
- break;
- case 'save_new':
- case 'save_edit':
- $q = $db->sql_query('DELETE FROM '.table_prefix.'acl WHERE target_type='.intval($parms['target_type']).' AND target_id='.intval($parms['target_id']).'
- '.$page_where_clause_lite.';');
- if(!$q)
- return Array('mode'=>'error','error'=>mysql_error());
- $rules = $session->perm_to_string($parms['perms']);
- if ( sizeof ( $rules ) < 1 )
- {
- return array(
- 'mode' => 'error',
- 'error' => 'Supplied rule list has a length of zero'
- );
- }
- $q = ($page_id && $namespace) ? 'INSERT INTO '.table_prefix.'acl ( target_type, target_id, page_id, namespace, rules )
- VALUES( '.intval($parms['target_type']).', '.intval($parms['target_id']).', \''.$db->escape($page_id).'\', \''.$db->escape($namespace).'\', \''.$db->escape($rules).'\' )' :
- 'INSERT INTO '.table_prefix.'acl ( target_type, target_id, rules )
- VALUES( '.intval($parms['target_type']).', '.intval($parms['target_id']).', \''.$db->escape($rules).'\' )';
- if(!$db->sql_query($q)) return Array('mode'=>'error','error'=>mysql_error());
- return Array(
- 'mode' => 'success',
- 'target_type' => $parms['target_type'],
- 'target_id' => $parms['target_id'],
- 'target_name' => $parms['target_name'],
- 'page_id' => $page_id,
- 'namespace' => $namespace,
- );
- break;
- case 'delete':
- $q = $db->sql_query('DELETE FROM '.table_prefix.'acl WHERE target_type='.intval($parms['target_type']).' AND target_id='.intval($parms['target_id']).'
- '.$page_where_clause_lite.';');
- if(!$q)
- return Array('mode'=>'error','error'=>mysql_error());
- return Array(
- 'mode' => 'delete',
- 'target_type' => $parms['target_type'],
- 'target_id' => $parms['target_id'],
- 'target_name' => $parms['target_name'],
- 'page_id' => $page_id,
- 'namespace' => $namespace,
- );
- break;
- default:
- return Array('mode'=>'error','error'=>'Hacking attempt');
- break;
- }
- }
- return $return;
- }
-
- /**
- * Same as PageUtils::acl_editor(), but the parms are a JSON string instead of an array. This also returns a JSON string.
- * @param string $parms Same as PageUtils::acl_editor/$parms, but should be a valid JSON string.
- * @return string
- */
-
- function acl_json($parms = '{ }')
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- $json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE);
- $parms = $json->decode($parms);
- $ret = PageUtils::acl_editor($parms);
- $ret = $json->encode($ret);
- return $ret;
- }
-
- /**
- * A non-Javascript frontend for the ACL API.
- * @param array The request data, if any, this should be in the format required by PageUtils::acl_editor()
- */
-
- function aclmanager($parms)
- {
- global $db, $session, $paths, $template, $plugins; // Common objects
- ob_start();
- // Convenience
- $formstart = '';
- $parms = PageUtils::acl_preprocess($parms);
- $response = PageUtils::acl_editor($parms);
- $response = PageUtils::acl_postprocess($response);
-
- //die('
' : '';
- echo 'catlist['.$i.'] = \''.$cat_info[$i]['urlname_nons'].'\';';
- $_ob .= ''.$cat_info[$i]['name'].$prottext.'