Mercurial Mercurial > repos > enano-1.1 / comparison
summary | shortlog | changelog | graph | tags | bookmarks | branches | files | changeset | file | latest | revisions | annotate | diff | comparison | raw | help
Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
ajax.php
changeset 326 ab66d6d1f1f4
parent 313 854eecfada20
parent 325 e17cc42d77cf
child 334 c72b545f1304
equal deleted inserted replaced
314:474f8be55943 326:ab66d6d1f1f4 
    16  
    16  
    17   // fillusername should be done without the help of the rest of Enano - all we need is the DBAL
 
    17   // fillusername should be done without the help of the rest of Enano - all we need is the DBAL
 
    18   if ( isset($_GET['_mode']) && $_GET['_mode'] == 'fillusername' )
 
    18   if ( isset($_GET['_mode']) && $_GET['_mode'] == 'fillusername' )
 
    19   {
 
    19   {
 
    20     // setup and load a very basic, specialized instance of the Enano API
 
    20     // setup and load a very basic, specialized instance of the Enano API
 
    21     function dc_here($m)     { return false; }
 
       
    22     function dc_dump($a, $g) { return false; }
 
       
    23     function dc_watch($n)    { return false; }
 
       
    24     function dc_start_timer($u) { return false; }
 
       
    25     function dc_stop_timer($m) { return false; }
 
       
    26     function microtime_float()
 
    21     function microtime_float()
 
    27     {
 
    22     {
 
    28       list($usec, $sec) = explode(" ", microtime());
 
    23       list($usec, $sec) = explode(" ", microtime());
 
    29       return ((float)$usec + (float)$sec);
 
    24       return ((float)$usec + (float)$sec);
 
    30     }
 
    25     }
 
    39     }
 
    34     }
 
    40     define('ENANO_ROOT', dirname($filename));
 
    35     define('ENANO_ROOT', dirname($filename));
 
    41     require(ENANO_ROOT.'/includes/functions.php');
 
    36     require(ENANO_ROOT.'/includes/functions.php');
 
    42     require(ENANO_ROOT.'/includes/dbal.php');
 
    37     require(ENANO_ROOT.'/includes/dbal.php');
 
    43     require(ENANO_ROOT.'/includes/json.php');
 
    38     require(ENANO_ROOT.'/includes/json.php');
 
    44     $db = new mysql();
 
    39     
       
    40     require(ENANO_ROOT . '/config.php');
 
       
    41     unset($dbuser, $dbpasswd);
 
       
    42     if ( !isset($dbdriver) )
 
       
    43       $dbdriver = 'mysql';
 
       
    44     
       
    45     $db = new $dbdriver();
 
       
    46     
    45     $db->connect();
 
    47     $db->connect();
 
    46     
    48     
    47     // result is sent using JSON
 
    49     // result is sent using JSON
 
    48     $json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE);
 
    50     $json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE);
 
    49     $return = Array(
 
    51     $return = Array(
 
    60         'error' => 'Invalid URI'
 
    62         'error' => 'Invalid URI'
 
    61       );
 
    63       );
 
    62       die( $json->encode($return) );
 
    64       die( $json->encode($return) );
 
    63     }
 
    65     }
 
    64     $allowanon = ( isset($_GET['allowanon']) && $_GET['allowanon'] == '1' ) ? '' : ' AND user_id > 1';
 
    66     $allowanon = ( isset($_GET['allowanon']) && $_GET['allowanon'] == '1' ) ? '' : ' AND user_id > 1';
 
    65     $q = $db->sql_query('SELECT username FROM '.table_prefix.'users WHERE lcase(username) LIKE lcase(\'%'.$name.'%\')' . $allowanon . ' ORDER BY username ASC;');
 
    67     $q = $db->sql_query('SELECT username FROM '.table_prefix.'users WHERE ' . ENANO_SQLFUNC_LOWERCASE . '(username) LIKE ' . ENANO_SQLFUNC_LOWERCASE . '(\'%'.$name.'%\')' . $allowanon . ' ORDER BY username ASC;');
 
    66     if ( !$q )
 
    68     if ( !$q )
 
    67     {
 
    69     {
 
    68       $return = array(
 
    70       $db->die_json();
 
    69         'mode' => 'error',
 
       
    70         'error' => 'MySQL error selecting username data: '.addslashes(mysql_error())
 
       
    71       );
 
       
    72       die( $json->encode($return) );
 
       
    73     }
 
    71     }
 
    74     $i = 0;
 
    72     $i = 0;
 
    75     while($r = $db->fetchrow())
 
    73     while($r = $db->fetchrow())
 
    76     {
 
    74     {
 
    77       $return['users_real'][] = $r['username'];
 
    75       $return['users_real'][] = $r['username'];
 
    97   switch($_GET['_mode']) {
 
    95   switch($_GET['_mode']) {
 
    98     case "checkusername":
 
    96     case "checkusername":
 
    99       echo PageUtils::checkusername($_GET['name']);
 
    97       echo PageUtils::checkusername($_GET['name']);
 
   100       break;
 
    98       break;
 
   101     case "getsource":
 
    99     case "getsource":
 
   102       $p = ( isset($_GET['pagepass']) ) ? $_GET['pagepass'] : false;
 
   100       $password = ( isset($_GET['pagepass']) ) ? $_GET['pagepass'] : false;
 
   103       echo PageUtils::getsource($paths->page, $p);
 
   101       $page = new PageProcessor($paths->page_id, $paths->namespace);
 
       
   102       $page->password = $password;
 
       
   103       if ( $src = $page->fetch_source() )
 
       
   104       {
 
       
   105         echo $src;
 
       
   106       }
 
       
   107       else if ( $src !== false )
 
       
   108       {
 
       
   109         echo '';
 
       
   110       }
 
       
   111       else
 
       
   112       {
 
       
   113         echo 'err_access_denied';
 
       
   114       }
 
   104       break;
 
   115       break;
 
   105     case "getpage":
 
   116     case "getpage":
 
   106       // echo PageUtils::getpage($paths->page, false, ( (isset($_GET['oldid'])) ? $_GET['oldid'] : false ));
 
   117       // echo PageUtils::getpage($paths->page, false, ( (isset($_GET['oldid'])) ? $_GET['oldid'] : false ));
 
   107       $revision_id = ( (isset($_GET['oldid'])) ? intval($_GET['oldid']) : 0 );
 
   118       $revision_id = ( (isset($_GET['oldid'])) ? intval($_GET['oldid']) : 0 );
 
   108       $page = new PageProcessor( $paths->cpage['urlname_nons'], $paths->namespace, $revision_id );
 
   119       $page = new PageProcessor( $paths->page_id, $paths->namespace, $revision_id );
 
   109       
   120       
   110       $pagepass = ( isset($_REQUEST['pagepass']) ) ? $_REQUEST['pagepass'] : '';
 
   121       $pagepass = ( isset($_REQUEST['pagepass']) ) ? $_REQUEST['pagepass'] : '';
 
   111       $page->password = $pagepass;
 
   122       $page->password = $pagepass;
 
   112             
   123             
   113       $page->send();
 
   124       $page->send();
 
   114       break;
 
   125       break;
 
   115     case "savepage":
 
   126     case "savepage":
 
   116       $summ = ( isset($_POST['summary']) ) ? $_POST['summary'] : '';
 
   127       $summ = ( isset($_POST['summary']) ) ? $_POST['summary'] : '';
 
   117       $minor = isset($_POST['minor']);
 
   128       $minor = isset($_POST['minor']);
 
   118       $e = PageUtils::savepage($paths->cpage['urlname_nons'], $paths->namespace, $_POST['text'], $summ, $minor);
 
   129       $e = PageUtils::savepage($paths->page_id, $paths->namespace, $_POST['text'], $summ, $minor);
 
   119       if($e=='good')
 
   130       if($e=='good')
 
   120       {
 
   131       {
 
   121         $page = new PageProcessor($paths->cpage['urlname_nons'], $paths->namespace);
 
   132         $page = new PageProcessor($paths->page_id, $paths->namespace);
 
   122         $page->send();
 
   133         $page->send();
 
   123       }
 
   134       }
 
   124       else
 
   135       else
 
   125       {
 
   136       {
 
   126         echo '<p>Error saving the page: '.$e.'</p>';
 
   137         echo '<p>Error saving the page: '.$e.'</p>';
 
   127       }
 
   138       }
 
   128       break;
 
   139       break;
 
   129     case "protect":
 
   140     case "protect":
 
   130       echo PageUtils::protect($paths->cpage['urlname_nons'], $paths->namespace, (int)$_POST['level'], $_POST['reason']);
 
   141       echo PageUtils::protect($paths->page_id, $paths->namespace, (int)$_POST['level'], $_POST['reason']);
 
   131       break;
 
   142       break;
 
   132     case "histlist":
 
   143     case "histlist":
 
   133       echo PageUtils::histlist($paths->cpage['urlname_nons'], $paths->namespace);
 
   144       echo PageUtils::histlist($paths->page_id, $paths->namespace);
 
   134       break;
 
   145       break;
 
   135     case "rollback":
 
   146     case "rollback":
 
   136       echo PageUtils::rollback( (int)$_GET['id'] );
 
   147       echo PageUtils::rollback( (int)$_GET['id'] );
 
   137       break;
 
   148       break;
 
   138     case "comments":
 
   149     case "comments":
 
   139       $comments = new Comments($paths->cpage['urlname_nons'], $paths->namespace);
 
   150       $comments = new Comments($paths->page_id, $paths->namespace);
 
   140       if ( isset($_POST['data']) )
 
   151       if ( isset($_POST['data']) )
 
   141       {
 
   152       {
 
   142         $comments->process_json($_POST['data']);
 
   153         $comments->process_json($_POST['data']);
 
   143       }
 
   154       }
 
   144       else
 
   155       else
 
   145       {
 
   156       {
 
   146         die('{ "mode" : "error", "error" : "No input" }');
 
   157         die('{ "mode" : "error", "error" : "No input" }');
 
   147       }
 
   158       }
 
   148       break;
 
   159       break;
 
   149     case "rename":
 
   160     case "rename":
 
   150       echo PageUtils::rename($paths->cpage['urlname_nons'], $paths->namespace, $_POST['newtitle']);
 
   161       echo PageUtils::rename($paths->page_id, $paths->namespace, $_POST['newtitle']);
 
   151       break;
 
   162       break;
 
   152     case "flushlogs":
 
   163     case "flushlogs":
 
   153       echo PageUtils::flushlogs($paths->cpage['urlname_nons'], $paths->namespace);
 
   164       echo PageUtils::flushlogs($paths->page_id, $paths->namespace);
 
   154       break;
 
   165       break;
 
   155     case "deletepage":
 
   166     case "deletepage":
 
   156       $reason = ( isset($_POST['reason']) ) ? $_POST['reason'] : false;
 
   167       $reason = ( isset($_POST['reason']) ) ? $_POST['reason'] : false;
 
   157       if ( empty($reason) )
 
   168       if ( empty($reason) )
 
   158         die('Please enter a reason for deleting this page.');
 
   169         die('Please enter a reason for deleting this page.');
 
   159       echo PageUtils::deletepage($paths->cpage['urlname_nons'], $paths->namespace, $reason);
 
   170       echo PageUtils::deletepage($paths->page_id, $paths->namespace, $reason);
 
   160       break;
 
   171       break;
 
   161     case "delvote":
 
   172     case "delvote":
 
   162       echo PageUtils::delvote($paths->cpage['urlname_nons'], $paths->namespace);
 
   173       echo PageUtils::delvote($paths->page_id, $paths->namespace);
 
   163       break;
 
   174       break;
 
   164     case "resetdelvotes":
 
   175     case "resetdelvotes":
 
   165       echo PageUtils::resetdelvotes($paths->cpage['urlname_nons'], $paths->namespace);
 
   176       echo PageUtils::resetdelvotes($paths->page_id, $paths->namespace);
 
   166       break;
 
   177       break;
 
   167     case "getstyles":
 
   178     case "getstyles":
 
   168       echo PageUtils::getstyles($_GET['id']);
 
   179       echo PageUtils::getstyles($_GET['id']);
 
   169       break;
 
   180       break;
 
   170     case "catedit":
 
   181     case "catedit":
 
   171       echo PageUtils::catedit($paths->cpage['urlname_nons'], $paths->namespace);
 
   182       echo PageUtils::catedit($paths->page_id, $paths->namespace);
 
   172       break;
 
   183       break;
 
   173     case "catsave":
 
   184     case "catsave":
 
   174       echo PageUtils::catsave($paths->cpage['urlname_nons'], $paths->namespace, $_POST);
 
   185       echo PageUtils::catsave($paths->page_id, $paths->namespace, $_POST);
 
   175       break;
 
   186       break;
 
   176     case "setwikimode":
 
   187     case "setwikimode":
 
   177       echo PageUtils::setwikimode($paths->cpage['urlname_nons'], $paths->namespace, (int)$_GET['mode']);
 
   188       echo PageUtils::setwikimode($paths->page_id, $paths->namespace, (int)$_GET['mode']);
 
   178       break;
 
   189       break;
 
   179     case "setpass":
 
   190     case "setpass":
 
   180       echo PageUtils::setpass($paths->cpage['urlname_nons'], $paths->namespace, $_POST['password']);
 
   191       echo PageUtils::setpass($paths->page_id, $paths->namespace, $_POST['password']);
 
   181       break;
 
   192       break;
 
   182     case "fillusername":
 
   193     case "fillusername":
 
   183       break;
 
   194       break;
 
   184     case "fillpagename":
 
   195     case "fillpagename":
 
   185       $name = (isset($_GET['name'])) ? $_GET['name'] : false;
 
   196       $name = (isset($_GET['name'])) ? $_GET['name'] : false;
 
   230       $id1 = ( isset($_GET['diff1']) ) ? (int)$_GET['diff1'] : false;
 
   241       $id1 = ( isset($_GET['diff1']) ) ? (int)$_GET['diff1'] : false;
 
   231       $id2 = ( isset($_GET['diff2']) ) ? (int)$_GET['diff2'] : false;
 
   242       $id2 = ( isset($_GET['diff2']) ) ? (int)$_GET['diff2'] : false;
 
   232       if(!$id1 || !$id2) { echo '<p>Invalid request.</p>'; $template->footer(); break; }
 
   243       if(!$id1 || !$id2) { echo '<p>Invalid request.</p>'; $template->footer(); break; }
 
   233       if(!preg_match('#^([0-9]+)$#', (string)$_GET['diff1']) ||
 
   244       if(!preg_match('#^([0-9]+)$#', (string)$_GET['diff1']) ||
 
   234          !preg_match('#^([0-9]+)$#', (string)$_GET['diff2']  )) { echo '<p>SQL injection attempt</p>'; $template->footer(); break; }
 
   245          !preg_match('#^([0-9]+)$#', (string)$_GET['diff2']  )) { echo '<p>SQL injection attempt</p>'; $template->footer(); break; }
 
   235       echo PageUtils::pagediff($paths->cpage['urlname_nons'], $paths->namespace, $id1, $id2);
 
   246       echo PageUtils::pagediff($paths->page_id, $paths->namespace, $id1, $id2);
 
   236       break;
 
   247       break;
 
   237     case "jsres":
 
   248     case "jsres":
 
   238       die('// ERROR: this section is deprecated and has moved to includes/clientside/static/enano-lib-basic.js.');
 
   249       die('// ERROR: this section is deprecated and has moved to includes/clientside/static/enano-lib-basic.js.');
 
   239       break;
 
   250       break;
 
   240     case "rdns":
 
   251     case "rdns":
 
   275       break;
 
   286       break;
 
   276     case 'get_tags':
 
   287     case 'get_tags':
 
   277       $json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE);
 
   288       $json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE);
 
   278       
   289       
   279       $ret = array('tags' => array(), 'user_level' => $session->user_level, 'can_add' => $session->get_permissions('tag_create'));
 
   290       $ret = array('tags' => array(), 'user_level' => $session->user_level, 'can_add' => $session->get_permissions('tag_create'));
 
   280       $q = $db->sql_query('SELECT t.tag_id, t.tag_name, pg.pg_target IS NOT NULL AS used_in_acl, t.user FROM '.table_prefix.'tags AS t
 
   291       $q = $db->sql_query('SELECT t.tag_id, t.tag_name, pg.pg_target IS NOT NULL AS used_in_acl, t.user_id FROM '.table_prefix.'tags AS t
 
   281         LEFT JOIN '.table_prefix.'page_groups AS pg
 
   292         LEFT JOIN '.table_prefix.'page_groups AS pg
 
   282           ON ( ( pg.pg_type = ' . PAGE_GRP_TAGGED . ' AND pg.pg_target=t.tag_name ) OR ( pg.pg_type IS NULL AND pg.pg_target IS NULL ) )
 
   293           ON ( ( pg.pg_type = ' . PAGE_GRP_TAGGED . ' AND pg.pg_target=t.tag_name ) OR ( pg.pg_type IS NULL AND pg.pg_target IS NULL ) )
 
   283         WHERE t.page_id=\'' . $db->escape($paths->cpage['urlname_nons']) . '\' AND t.namespace=\'' . $db->escape($paths->namespace) . '\';');
 
   294         WHERE t.page_id=\'' . $db->escape($paths->page_id) . '\' AND t.namespace=\'' . $db->escape($paths->namespace) . '\';');
 
   284       if ( !$q )
 
   295       if ( !$q )
 
   285         $db->_die();
 
   296         $db->_die();
 
   286       
   297       
   287       while ( $row = $db->fetchrow() )
 
   298       while ( $row = $db->fetchrow() )
 
   288       {
 
   299       {
 
   289         $can_del = true;
 
   300         $can_del = true;
 
   290         
   301         
   291         $perm = ( $row['user'] != $session->user_id ) ?
 
   302         $perm = ( $row['user_id'] != $session->user_id ) ?
 
   292                 'tag_delete_other' :
 
   303                 'tag_delete_other' :
 
   293                 'tag_delete_own';
 
   304                 'tag_delete_own';
 
   294         
   305         
   295         if ( $row['user'] == 1 && !$session->user_logged_in )
 
   306         if ( $row['user_id'] == 1 && !$session->user_logged_in )
 
   296           // anonymous user trying to delete tag (hardcode blacklisted)
 
   307           // anonymous user trying to delete tag (hardcode blacklisted)
 
   297           $can_del = false;
 
   308           $can_del = false;
 
   298           
   309           
   299         if ( !$session->get_permissions($perm) )
 
   310         if ( !$session->get_permissions($perm) )
 
   300           $can_del = false;
 
   311           $can_del = false;
 
   338         $resp['error'] = 'Tags must consist of at least 2 alphanumeric characters.';
 
   349         $resp['error'] = 'Tags must consist of at least 2 alphanumeric characters.';
 
   339         die($json->encode($resp));
 
   350         die($json->encode($resp));
 
   340       }
 
   351       }
 
   341       
   352       
   342       // check if tag is already on page
 
   353       // check if tag is already on page
 
   343       $q = $db->sql_query('SELECT 1 FROM '.table_prefix.'tags WHERE page_id=\'' . $db->escape($paths->cpage['urlname_nons']) . '\' AND namespace=\'' . $db->escape($paths->namespace) . '\' AND tag_name=\'' . $tag . '\';');
 
   354       $q = $db->sql_query('SELECT 1 FROM '.table_prefix.'tags WHERE page_id=\'' . $db->escape($paths->page_id) . '\' AND namespace=\'' . $db->escape($paths->namespace) . '\' AND tag_name=\'' . $tag . '\';');
 
   344       if ( !$q )
 
   355       if ( !$q )
 
   345         $db->_die();
 
   356         $db->_die();
 
   346       if ( $db->numrows() > 0 )
 
   357       if ( $db->numrows() > 0 )
 
   347       {
 
   358       {
 
   348         $resp['error'] = 'This page already has this tag.';
 
   359         $resp['error'] = 'This page already has this tag.';
 
   362       }
 
   373       }
 
   363       $resp['in_acl'] = ( $db->numrows() > 0 );
 
   374       $resp['in_acl'] = ( $db->numrows() > 0 );
 
   364       $db->free_result();
 
   375       $db->free_result();
 
   365       
   376       
   366       // we're good
 
   377       // we're good
 
   367       $q = $db->sql_query('INSERT INTO '.table_prefix.'tags(tag_name,page_id,namespace,user) VALUES(\'' . $tag . '\', \'' . $db->escape($paths->cpage['urlname_nons']) . '\', \'' . $db->escape($paths->namespace) . '\', ' . $session->user_id . ');');
 
   378       $q = $db->sql_query('INSERT INTO '.table_prefix.'tags(tag_name,page_id,namespace,user_id) VALUES(\'' . $tag . '\', \'' . $db->escape($paths->page_id) . '\', \'' . $db->escape($paths->namespace) . '\', ' . $session->user_id . ');');
 
   368       if ( !$q )
 
   379       if ( !$q )
 
   369         $db->_die();
 
   380         $db->_die();
 
   370       
   381       
   371       $resp['success'] = true;
 
   382       $resp['success'] = true;
 
   372       $resp['tag'] = $tag;
 
   383       $resp['tag'] = $tag;
 
   378       
   389       
   379       $tag_id = intval($_POST['tag_id']);
 
   390       $tag_id = intval($_POST['tag_id']);
 
   380       if ( empty($tag_id) )
 
   391       if ( empty($tag_id) )
 
   381         die('Invalid tag ID');
 
   392         die('Invalid tag ID');
 
   382       
   393       
   383       $q = $db->sql_query('SELECT t.tag_id, t.user, t.page_id, t.namespace, pg.pg_target IS NOT NULL AS used_in_acl FROM '.table_prefix.'tags AS t
 
   394       $q = $db->sql_query('SELECT t.tag_id, t.user_id, t.page_id, t.namespace, pg.pg_target IS NOT NULL AS used_in_acl FROM '.table_prefix.'tags AS t
 
   384   LEFT JOIN '.table_prefix.'page_groups AS pg
 
   395   LEFT JOIN '.table_prefix.'page_groups AS pg
 
   385     ON ( pg.pg_id IS NULL OR ( pg.pg_target = t.tag_name AND pg.pg_type = ' . PAGE_GRP_TAGGED . ' ) )
 
   396     ON ( pg.pg_id IS NULL OR ( pg.pg_target = t.tag_name AND pg.pg_type = ' . PAGE_GRP_TAGGED . ' ) )
 
   386   WHERE t.tag_id=' . $tag_id . ';');
 
   397   WHERE t.tag_id=' . $tag_id . ';');
 
   387       
   398       
   388       if ( !$q )
 
   399       if ( !$q )
 
   392         die('Could not find a tag with that ID');
 
   403         die('Could not find a tag with that ID');
 
   393       
   404       
   394       $row = $db->fetchrow();
 
   405       $row = $db->fetchrow();
 
   395       $db->free_result();
 
   406       $db->free_result();
 
   396       
   407       
   397       if ( $row['page_id'] == $paths->cpage['urlname_nons'] && $row['namespace'] == $paths->namespace )
 
   408       if ( $row['page_id'] == $paths->page_id && $row['namespace'] == $paths->namespace )
 
   398         $perms =& $session;
 
   409         $perms =& $session;
 
   399       else
 
   410       else
 
   400         $perms = $session->fetch_page_acl($row['page_id'], $row['namespace']);
 
   411         $perms = $session->fetch_page_acl($row['page_id'], $row['namespace']);
 
   401         
   412         
   402       $perm = ( $row['user'] != $session->user_id ) ?
 
   413       $perm = ( $row['user_id'] != $session->user_id ) ?
 
   403                 'tag_delete_other' :
 
   414                 'tag_delete_other' :
 
   404                 'tag_delete_own';
 
   415                 'tag_delete_own';
 
   405       
   416       
   406       if ( $row['user'] == 1 && !$session->user_logged_in )
 
   417       if ( $row['user_id'] == 1 && !$session->user_logged_in )
 
   407         // anonymous user trying to delete tag (hardcode blacklisted)
 
   418         // anonymous user trying to delete tag (hardcode blacklisted)
 
   408         die('You are not authorized to delete this tag.');
 
   419         die('You are not authorized to delete this tag.');
 
   409         
   420         
   410       if ( !$perms->get_permissions($perm) )
 
   421       if ( !$perms->get_permissions($perm) )
 
   411         die('You are not authorized to delete this tag.');
 
   422         die('You are not authorized to delete this tag.');
Enano CMS (1.1.x)