Enano CMS (1.1.x): comparison plugins/SpecialAdmin.php

equal deleted inserted replaced

-:fd0e9c7a7b28
+:e858bacb5cfa
 if( !isset($_GET['side']) || ( isset($_GET['side']) && !preg_match('#^([0-9]+)$#', $_GET['side']) ) )
 {
 echo '<div class="warning-box" style="margin: 10px 0;">$_GET[\'side\'] contained an SQL injection attempt</div>';
 break;
 }
-$query = $db->sql_query('UPDATE '.table_prefix.'sidebar SET sidebar_id=' . $db->escape($_GET['side']) . ' WHERE item_id=' . $db->escape($_GET['id']) . ';');
+$query = $db->sql_query('UPDATE '.table_prefix.'sidebar SET sidebar_id=' . $db->escape($_GET['side']) . ' WHERE item_id=' . intval($_GET['id']) . ';');
 if(!$query)
 {
 echo $db->get_error();
 $template->footer();
 exit;
 }
 echo '<div class="info-box" style="margin: 10px 0;">Item moved.</div>';
 break;
 case 'delete':
-$query = $db->sql_query('DELETE FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';'); // Already checked for injection attempts ;-)
+$query = $db->sql_query('DELETE FROM '.table_prefix.'sidebar WHERE item_id=' . intval($_GET['id']) . ';'); // Already checked for injection attempts ;-)
 if(!$query)
 {
 echo $db->get_error();
 $template->footer();
 exit;
 die('GOOD');
 }
 echo '<div class="error-box" style="margin: 10px 0;">Item deleted.</div>';
 break;
 case 'disenable';
-$q = $db->sql_query('SELECT item_enabled FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';');
+$q = $db->sql_query('SELECT item_enabled FROM '.table_prefix.'sidebar WHERE item_id=' . intval($_GET['id']) . ';');
 if(!$q)
 {
 echo $db->get_error();
 $template->footer();
 exit;
 }
 $r = $db->fetchrow();
 $db->free_result();
 $e = ( $r['item_enabled'] == 1 ) ? '0' : '1';
-$q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET item_enabled='.$e.' WHERE item_id=' . $db->escape($_GET['id']) . ';');
+$q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET item_enabled='.$e.' WHERE item_id=' . intval($_GET['id']) . ';');
 if(!$q)
 {
 echo $db->get_error();
 $template->footer();
 exit;
 {
 ob_end_clean();
 die('GOOD');
 }
 break;
+case 'rename';
+$newname = $db->escape($_POST['newname']);
+$q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET block_name=\''.$newname.'\' WHERE item_id=' . intval($_GET['id']) . ';');
+if(!$q)
+{
+echo $db->get_error();
+$template->footer();
+exit;
+}
+if(isset($_GET['ajax']))
+{
+ob_end_clean();
+die('GOOD');
+}
+break;
 case 'getsource':
-$q = $db->sql_query('SELECT block_content,block_type FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';');
+$q = $db->sql_query('SELECT block_content,block_type FROM '.table_prefix.'sidebar WHERE item_id=' . intval($_GET['id']) . ';');
 if(!$q)
 {
 echo $db->get_error();
 $template->footer();
 exit;
 die($r['block_content']);
 break;
 case 'save':
 if ( defined('ENANO_DEMO_MODE') )
 {
-$q = $db->sql_query('SELECT block_type FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';');
+$q = $db->sql_query('SELECT block_type FROM '.table_prefix.'sidebar WHERE item_id=' . intval($_GET['id']) . ';');
 if(!$q)
 {
 echo 'var status=unescape(\''.hexencode($db->get_error()).'\');';
 exit;
 }
 else
 {
 $_POST['content'] = sanitize_html($_POST['content'], true);
 }
 }
-$q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET block_content=\''.$db->escape(rawurldecode($_POST['content'])).'\' WHERE item_id=' . $db->escape($_GET['id']) . ';');
+$q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET block_content=\''.$db->escape(rawurldecode($_POST['content'])).'\' WHERE item_id=' . intval($_GET['id']) . ';');
 if(!$q)
 {
 echo 'var status=unescape(\''.hexencode($db->get_error()).'\');';
 exit;
 }
-$q = $db->sql_query('SELECT block_type,block_content FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';');
+$q = $db->sql_query('SELECT block_type,block_content FROM '.table_prefix.'sidebar WHERE item_id=' . intval($_GET['id']) . ';');
 if(!$q)
 {
 echo 'var status=unescape(\''.hexencode($db->get_error()).'\');';
 exit;
 }
 case BLOCK_PLUGIN:
 $parser = $template->makeParserText($vars['sidebar_section_raw']);
 $c = ($template->fetch_block($row['block_content'])) ? $template->fetch_block($row['block_content']) : 'Can\'t find plugin block';
 break;
 }
-$t = $template->tplWikiFormat($row['block_name']);
+$t = '<span title="Double-click to rename this block" id="sbrename_' . $row['item_id'] . '" ondblclick="ajaxRenameSidebarStage1(this, \''.$row['item_id'].'\'); return false;">' . $template->tplWikiFormat($row['block_name']) . '</span>';
 if($row['item_enabled'] == 0) $t .= ' <span id="disabled_'.$row['item_id'].'" style="color: red;">(disabled)</span>';
 else           $t .= ' <span id="disabled_'.$row['item_id'].'" style="color: red; display: none;">(disabled)</span>';
 $side = ( $row['sidebar_id'] == SIDEBAR_LEFT ) ? SIDEBAR_RIGHT : SIDEBAR_LEFT;
 $tb = '<a title="Enable or disable this block"    href="'.makeUrl($paths->page, 'action=disenable&id='.$row['item_id'].''       , true).'" onclick="ajaxDisenableBlock(\''.$row['item_id'].'\'); return false;"   ><img alt="Enable/disable this block" style="border-width: 0;" src="'.scriptPath.'/images/disenable.png" /></a>
 <a title="Edit the contents of this block" href="'.makeUrl($paths->page, 'action=edit&id='.$row['item_id'].''            , true).'" onclick="ajaxEditBlock(\''.$row['item_id'].'\', this); return false;"><img alt="Edit this block" style="border-width: 0;" src="'.scriptPath.'/images/edit.png" /></a>

changeset 190	e858bacb5cfa
parent 183	91127e62f38f
child 192	9237767a23ae