0
|
1 |
<?php
|
|
2 |
/*
|
|
3 |
* Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between
|
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
|
4 |
* Version 1.0 (Banshee)
|
0
|
5 |
* Copyright (C) 2006-2007 Dan Fuhry
|
|
6 |
*
|
|
7 |
* This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
|
|
8 |
* as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
|
|
9 |
*
|
|
10 |
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
|
|
11 |
* warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.
|
|
12 |
*/
|
|
13 |
|
|
14 |
require('includes/common.php');
|
|
15 |
|
|
16 |
global $db, $session, $paths, $template, $plugins; // Common objects
|
|
17 |
if(!isset($_GET['_mode'])) die('This script cannot be accessed directly.');
|
|
18 |
|
|
19 |
$_ob = '';
|
|
20 |
|
|
21 |
switch($_GET['_mode']) {
|
|
22 |
case "checkusername":
|
|
23 |
echo PageUtils::checkusername($_GET['name']);
|
|
24 |
break;
|
|
25 |
case "getsource":
|
|
26 |
$p = ( isset($_GET['pagepass']) ) ? $_GET['pagepass'] : false;
|
|
27 |
echo PageUtils::getsource($paths->page, $p);
|
|
28 |
break;
|
|
29 |
case "getpage":
|
|
30 |
// echo PageUtils::getpage($paths->page, false, ( (isset($_GET['oldid'])) ? $_GET['oldid'] : false ));
|
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
|
31 |
$revision_id = ( (isset($_GET['oldid'])) ? intval($_GET['oldid']) : 0 );
|
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
|
32 |
$page = new PageProcessor( $paths->cpage['urlname_nons'], $paths->namespace, $revision_id );
|
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
33 |
|
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
34 |
$pagepass = ( isset($_REQUEST['pagepass']) ) ? $_REQUEST['pagepass'] : '';
|
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
35 |
$page->password = $pagepass;
|
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
36 |
|
0
|
37 |
$page->send();
|
|
38 |
break;
|
|
39 |
case "savepage":
|
|
40 |
$summ = ( isset($_POST['summary']) ) ? $_POST['summary'] : '';
|
|
41 |
$minor = isset($_POST['minor']);
|
|
42 |
$e = PageUtils::savepage($paths->cpage['urlname_nons'], $paths->namespace, $_POST['text'], $summ, $minor);
|
|
43 |
if($e=='good')
|
|
44 |
{
|
|
45 |
$page = new PageProcessor($paths->cpage['urlname_nons'], $paths->namespace);
|
|
46 |
$page->send();
|
|
47 |
}
|
|
48 |
else
|
|
49 |
{
|
|
50 |
echo 'Error saving the page: '.$e;
|
|
51 |
}
|
|
52 |
break;
|
|
53 |
case "protect":
|
|
54 |
echo PageUtils::protect($paths->cpage['urlname_nons'], $paths->namespace, (int)$_POST['level'], $_POST['reason']);
|
|
55 |
break;
|
|
56 |
case "histlist":
|
|
57 |
echo PageUtils::histlist($paths->cpage['urlname_nons'], $paths->namespace);
|
|
58 |
break;
|
|
59 |
case "rollback":
|
|
60 |
echo PageUtils::rollback( (int)$_GET['id'] );
|
|
61 |
break;
|
|
62 |
case "comments":
|
|
63 |
$comments = new Comments($paths->cpage['urlname_nons'], $paths->namespace);
|
|
64 |
if ( isset($_POST['data']) )
|
|
65 |
{
|
|
66 |
$comments->process_json($_POST['data']);
|
|
67 |
}
|
|
68 |
else
|
|
69 |
{
|
|
70 |
die('{ "mode" : "error", "error" : "No input" }');
|
|
71 |
}
|
|
72 |
break;
|
|
73 |
case "rename":
|
|
74 |
echo PageUtils::rename($paths->cpage['urlname_nons'], $paths->namespace, $_POST['newtitle']);
|
|
75 |
break;
|
|
76 |
case "flushlogs":
|
|
77 |
echo PageUtils::flushlogs($paths->cpage['urlname_nons'], $paths->namespace);
|
|
78 |
break;
|
|
79 |
case "deletepage":
|
28
|
80 |
$reason = ( isset($_POST['reason']) ) ? $_POST['reason'] : false;
|
|
81 |
if ( empty($reason) )
|
|
82 |
die('Please enter a reason for deleting this page.');
|
|
83 |
echo PageUtils::deletepage($paths->cpage['urlname_nons'], $paths->namespace, $reason);
|
0
|
84 |
break;
|
|
85 |
case "delvote":
|
|
86 |
echo PageUtils::delvote($paths->cpage['urlname_nons'], $paths->namespace);
|
|
87 |
break;
|
|
88 |
case "resetdelvotes":
|
|
89 |
echo PageUtils::resetdelvotes($paths->cpage['urlname_nons'], $paths->namespace);
|
|
90 |
break;
|
|
91 |
case "getstyles":
|
|
92 |
echo PageUtils::getstyles($_GET['id']);
|
|
93 |
break;
|
|
94 |
case "catedit":
|
|
95 |
echo PageUtils::catedit($paths->cpage['urlname_nons'], $paths->namespace);
|
|
96 |
break;
|
|
97 |
case "catsave":
|
|
98 |
echo PageUtils::catsave($paths->cpage['urlname_nons'], $paths->namespace, $_POST);
|
|
99 |
break;
|
|
100 |
case "setwikimode":
|
|
101 |
echo PageUtils::setwikimode($paths->cpage['urlname_nons'], $paths->namespace, (int)$_GET['mode']);
|
|
102 |
break;
|
|
103 |
case "setpass":
|
|
104 |
echo PageUtils::setpass($paths->cpage['urlname_nons'], $paths->namespace, $_POST['password']);
|
|
105 |
break;
|
|
106 |
case "wikihelp":
|
36
|
107 |
$html = file_get_contents('http://enanocms.org/ajax.php?title=Help:Wiki_formatting&_mode=getpage&nofooters');
|
|
108 |
$html = str_replace('src="/Special', 'src="http://enanocms.org/Special', $html);
|
0
|
109 |
echo '<div class="contentDiv"><h2>Wiki formatting guide</h2>'.$html.'</div>';
|
|
110 |
break;
|
|
111 |
case "fillusername":
|
|
112 |
$name = (isset($_GET['name'])) ? $db->escape($_GET['name']) : false;
|
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
113 |
if ( !$name )
|
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
114 |
{
|
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
115 |
die('userlist = new Array(); errorstring=\'Invalid URI\'');
|
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
116 |
}
|
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
117 |
$q = $db->sql_query('SELECT username,user_id FROM '.table_prefix.'users WHERE lcase(username) LIKE lcase(\'%'.$name.'%\');');
|
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
118 |
if ( !$q )
|
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
119 |
{
|
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
120 |
die('userlist = new Array(); errorstring=\'MySQL error selecting username data: '.addslashes(mysql_error()).'\'');
|
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
121 |
}
|
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
122 |
if($db->numrows() < 1)
|
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
123 |
{
|
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
124 |
die('userlist = new Array(); errorstring=\'No usernames found\';');
|
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
125 |
}
|
0
|
126 |
echo 'var errorstring = false; userlist = new Array();';
|
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
|
127 |
$i = 0;
|
0
|
128 |
while($r = $db->fetchrow())
|
|
129 |
{
|
|
130 |
echo "userlist[$i] = '".addslashes($r['username'])."'; ";
|
|
131 |
$i++;
|
|
132 |
}
|
|
133 |
$db->free_result();
|
|
134 |
break;
|
|
135 |
case "fillpagename":
|
|
136 |
$name = (isset($_GET['name'])) ? $_GET['name'] : false;
|
|
137 |
if(!$name) die('userlist = new Array(); namelist = new Array(); errorstring=\'Invalid URI\'');
|
|
138 |
$nd = RenderMan::strToPageID($name);
|
|
139 |
$c = 0;
|
|
140 |
$u = Array();
|
|
141 |
$n = Array();
|
22
|
142 |
|
|
143 |
$name = sanitize_page_id($name);
|
|
144 |
$name = str_replace('_', ' ', $name);
|
|
145 |
|
0
|
146 |
for($i=0;$i<sizeof($paths->pages)/2;$i++)
|
|
147 |
{
|
|
148 |
if( (
|
|
149 |
preg_match('#'.preg_quote($name).'(.*)#i', $paths->pages[$i]['name']) ||
|
|
150 |
preg_match('#'.preg_quote($name).'(.*)#i', $paths->pages[$i]['urlname']) ||
|
|
151 |
preg_match('#'.preg_quote($name).'(.*)#i', $paths->pages[$i]['urlname_nons']) ||
|
|
152 |
preg_match('#'.preg_quote(str_replace(' ', '_', $name)).'(.*)#i', $paths->pages[$i]['name']) ||
|
|
153 |
preg_match('#'.preg_quote(str_replace(' ', '_', $name)).'(.*)#i', $paths->pages[$i]['urlname']) ||
|
|
154 |
preg_match('#'.preg_quote(str_replace(' ', '_', $name)).'(.*)#i', $paths->pages[$i]['urlname_nons'])
|
|
155 |
) &&
|
|
156 |
( ( $nd[1] != 'Article' && $paths->pages[$i]['namespace'] == $nd[1] ) || $nd[1] == 'Article' )
|
|
157 |
&& $paths->pages[$i]['visible']
|
|
158 |
)
|
|
159 |
{
|
|
160 |
$c++;
|
|
161 |
$u[] = $paths->pages[$i]['name'];
|
|
162 |
$n[] = $paths->pages[$i]['urlname'];
|
|
163 |
}
|
|
164 |
}
|
|
165 |
if($c > 0)
|
|
166 |
{
|
|
167 |
echo 'userlist = new Array(); namelist = new Array(); errorstring = false; '."\n";
|
|
168 |
for($i=0;$i<sizeof($u);$i++) // Can't use foreach because we need the value of $i and we need to use both $u and $n
|
|
169 |
{
|
|
170 |
echo "userlist[$i] = '".addslashes($n[$i])."';\n";
|
|
171 |
echo "namelist[$i] = '".addslashes($u[$i])."';\n";
|
|
172 |
}
|
|
173 |
} else {
|
|
174 |
die('userlist = new Array(); namelist = new Array(); errorstring=\'No page matches found.\'');
|
|
175 |
}
|
|
176 |
break;
|
|
177 |
case "preview":
|
|
178 |
echo PageUtils::genPreview($_POST['text']);
|
|
179 |
break;
|
|
180 |
case "pagediff":
|
|
181 |
$id1 = ( isset($_GET['diff1']) ) ? (int)$_GET['diff1'] : false;
|
|
182 |
$id2 = ( isset($_GET['diff2']) ) ? (int)$_GET['diff2'] : false;
|
|
183 |
if(!$id1 || !$id2) { echo '<p>Invalid request.</p>'; $template->footer(); break; }
|
|
184 |
if(!preg_match('#^([0-9]+)$#', (string)$_GET['diff1']) ||
|
|
185 |
!preg_match('#^([0-9]+)$#', (string)$_GET['diff2'] )) { echo '<p>SQL injection attempt</p>'; $template->footer(); break; }
|
|
186 |
echo PageUtils::pagediff($paths->cpage['urlname_nons'], $paths->namespace, $id1, $id2);
|
|
187 |
break;
|
|
188 |
case "jsres":
|
|
189 |
die('// ERROR: this section is deprecated and has moved to includes/clientside/static/enano-lib-basic.js.');
|
|
190 |
break;
|
|
191 |
case "rdns":
|
|
192 |
if(!$session->get_permissions('mod_misc')) die('Go somewhere else for your reverse DNS info!');
|
|
193 |
$ip = $_GET['ip'];
|
|
194 |
$rdns = gethostbyaddr($ip);
|
|
195 |
if($rdns == $ip) echo 'Unable to get reverse DNS information. Perhaps the IP address does not exist anymore.';
|
|
196 |
else echo $rdns;
|
|
197 |
break;
|
|
198 |
case 'acljson':
|
|
199 |
$parms = ( isset($_POST['acl_params']) ) ? rawurldecode($_POST['acl_params']) : false;
|
|
200 |
echo PageUtils::acl_json($parms);
|
|
201 |
break;
|
29
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
202 |
case "change_theme":
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
203 |
if ( !isset($_POST['theme_id']) || !isset($_POST['style_id']) )
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
204 |
{
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
205 |
die('Invalid input');
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
206 |
}
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
207 |
if ( !preg_match('/^([a-z0-9_-]+)$/i', $_POST['theme_id']) || !preg_match('/^([a-z0-9_-]+)$/i', $_POST['style_id']) )
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
208 |
{
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
209 |
die('Invalid input');
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
210 |
}
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
211 |
if ( !file_exists(ENANO_ROOT . '/themes/' . $_POST['theme_id'] . '/css/' . $_POST['style_id'] . '.css') )
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
212 |
{
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
213 |
die('Can\'t find theme file: ' . ENANO_ROOT . '/themes/' . $_POST['theme_id'] . '/css/' . $_POST['style_id'] . '.css');
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
214 |
}
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
215 |
if ( !$session->user_logged_in )
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
216 |
{
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
217 |
die('You must be logged in to change your theme');
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
218 |
}
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
219 |
// Just in case something slipped through...
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
220 |
$theme_id = $db->escape($_POST['theme_id']);
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
221 |
$style_id = $db->escape($_POST['style_id']);
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
222 |
$e = $db->sql_query('UPDATE ' . table_prefix . "users SET theme='$theme_id', style='$style_id' WHERE user_id=$session->user_id;");
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
223 |
if ( !$e )
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
224 |
die( $db->get_error() );
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
225 |
die('GOOD');
|
e5484a9e0818
Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image
Dan
diff
changeset
|
226 |
break;
|
0
|
227 |
default:
|
|
228 |
die('Hacking attempt');
|
|
229 |
break;
|
|
230 |
}
|
|
231 |
|
|
232 |
?> |