Beanz/flatpress
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

prevent cat-0 from being tampered with

Browse Source
This commit is contained in:
real_nowhereman 2010-09-29 19:41:16 +00:00
parent ea2de810ac
commit 8dfa99d8c6
3 changed files with 25 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
admin/panels/entry/admin.entry.cats.php
View File

@ -48,9 +48,19 @@
$str = stripslashes( trim( @$_POST['content'] ) ) ; $str = stripslashes( trim( @$_POST['content'] ) ) ;
if ($str) { if ($str) {
$success = io_write_file(CONTENT_DIR . 'categories.txt', $str); //$success = io_write_file(CONTENT_DIR . 'categories.txt', $str);
entry_categories_encode(); $success = entry_categories_encode($str);
$this->smarty->assign('success', ( $success )? 1 : -1 );
$ret = 1 ;
if ($success <= 0) {
if ($success == -1) $ret = -3;
elseif ($success == 0) $ret = -1;
} else {
$success = io_write_file(CONTENT_DIR . 'categories.txt', $str) ? -1 : 1;
}
$this->smarty->assign('success', $ret);
} else { } else {
$this->smarty->assign('success', -1 ); $this->smarty->assign('success', -1 );
} }

15
fp-includes/core/core.entry.php
View File

@ -498,10 +498,11 @@
} }
function entry_categories_encode() { function entry_categories_encode($cat_file) {
if ($string = io_load_file(CONTENT_DIR . 'categories.txt')) {
$lines = explode("\n", trim($string)); //if ($string = io_load_file(CONTENT_DIR . 'categories.txt')) {
$lines = explode("\n", trim($cat_file));
$idstack = $result = $indentstack=array(); $idstack = $result = $indentstack=array();
while (!empty($lines)) { while (!empty($lines)) {
@ -520,6 +521,12 @@
$id = trim($val[1]); $id = trim($val[1]);
$label = trim($val[0]); $label = trim($val[0]);
// IDs must be strictly positive
if ($label && $id <= 0) return -1;
if (empty($indentstack)) { if (empty($indentstack)) {
array_push($indentstack,$indent); array_push($indentstack,$indent);
array_push($idstack, $id); array_push($idstack, $id);
@ -554,7 +561,7 @@
return io_write_file(CONTENT_DIR . 'categories_encoded.dat', serialize($result)); return io_write_file(CONTENT_DIR . 'categories_encoded.dat', serialize($result));
} //}
return false; return false;

1
fp-interface/lang/en-us/lang.admin.entry.php
View File

@ -175,6 +175,7 @@ Technology :6
-1 => 'An error occurred while trying to save categories', -1 => 'An error occurred while trying to save categories',
2 => 'Categories cleared', 2 => 'Categories cleared',
-2 => 'An error occurred while trying to clear categories', -2 => 'An error occurred while trying to clear categories',
-3 => 'Category IDs must be strictly positive (0 is not allowed)'
); );