extern/egroupware
1
0
Fork 1
mirror of https://github.com/EGroupware/egroupware.git synced 2025-01-14 09:58:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

$GLOBALS, using boinfolog->write(), and closed security-hole,

Browse Source 
that non-admin users could call csv_import, if they new the url
(check if user is allowed to run admin-app)
This commit is contained in:
Ralf Becker 2001-10-04 20:13:00 +00:00
parent 118c9a80dd
commit 116de14b92
1 changed files with 63 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
infolog/csv_import.php
View File

@ -12,11 +12,24 @@
/* $Id$ */ /* $Id$ */
$phpgw_info['flags']['currentapp'] = 'infolog'; $GLOBALS['phpgw_info']['flags'] = array(
$phpgw_info['flags']['enable_contacts_class'] = True; 'currentapp' => 'infolog',
'noheader' => True,
'nonavbar' => True,
'enable_contacts_class' => True
);
include("../header.inc.php"); include("../header.inc.php");
$phpgw->infolog = createobject('infolog.uiinfolog'); if (!isset($GLOBALS['phpgw_info']['user']['apps']['admin']) ||
!$GLOBALS['phpgw_info']['user']['apps']['admin']) // no admin
{
Header('Location: ' . $GLOBALS['phpgw']->link('/home.php'));
$GLOBALS['phpgw']->common->phpgw_exit();
}
$GLOBALS['phpgw']->common->phpgw_header();
echo parse_navbar();
$infolog = createobject('infolog.uiinfolog');
$t = CreateObject('phpgwapi.Template',PHPGW_APP_TPL); // $t->unknows = 'keep'; $t->debug = 1; $t = CreateObject('phpgwapi.Template',PHPGW_APP_TPL); // $t->unknows = 'keep'; $t->debug = 1;
$t->set_file(array('import' => 'csv_import.tpl')); $t->set_file(array('import' => 'csv_import.tpl'));
@ -26,14 +39,14 @@
$t->set_block('import','ffooter','ffooterhandle'); $t->set_block('import','ffooter','ffooterhandle');
$t->set_block('import','imported','importedhandle'); $t->set_block('import','imported','importedhandle');
// $t->set_var("navbar_bg",$phpgw_info["theme"]["navbar_bg"]); // $t->set_var("navbar_bg",$GLOBALS['phpgw_info']["theme"]["navbar_bg"]);
// $t->set_var("navbar_text",$phpgw_info["theme"]["navbar_text"]); // $t->set_var("navbar_text",$GLOBALS['phpgw_info']["theme"]["navbar_text"]);
if ($action == 'download' && (!$fieldsep || !$csvfile || !($fp=fopen($csvfile,"r")))) { if ($action == 'download' && (!$fieldsep || !$csvfile || !($fp=fopen($csvfile,"r")))) {
$action = ''; $action = '';
} }
$t->set_var("action_url",$phpgw->link("/infolog/csv_import.php")); $t->set_var("action_url",$GLOBALS['phpgw']->link("/infolog/csv_import.php"));
$t->set_var( $phpgw->infolog->setStyleSheet( )); $t->set_var( $infolog->setStyleSheet( ));
$t->set_var("lang_info_action",lang("InfoLog - Import CSV-File")); $t->set_var("lang_info_action",lang("InfoLog - Import CSV-File"));
$PSep = '||'; // Pattern-Separator, separats the pattern-replacement-pairs in trans $PSep = '||'; // Pattern-Separator, separats the pattern-replacement-pairs in trans
@ -83,14 +96,14 @@ function cat_id( $cats )
if (isset($cat2id[$cat])) { if (isset($cat2id[$cat])) {
$ids[$cat] = $cat2id[$cat]; // cat is in cache $ids[$cat] = $cat2id[$cat]; // cat is in cache
} else { } else {
if (!is_object($phpgw->categories)) { if (!is_object($GLOBALS['phpgw']->categories)) {
$phpgw->categories = createobject('phpgwapi.categories'); $GLOBALS['phpgw']->categories = createobject('phpgwapi.categories');
} }
if ($id = $phpgw->categories->name2id( $cat )) { // cat exists if ($id = $GLOBALS['phpgw']->categories->name2id( $cat )) { // cat exists
$cat2id[$cat] = $ids[$cat] = $id; $cat2id[$cat] = $ids[$cat] = $id;
} else { // create new cat } else { // create new cat
$phpgw->categories->add( $cat,0,$cat,'','public',0); $GLOBALS['phpgw']->categories->add( $cat,0,$cat,'','public',0);
$cat2id[$cat] = $ids[$cat] = $phpgw->categories->name2id( $cat ); $cat2id[$cat] = $ids[$cat] = $GLOBALS['phpgw']->categories->name2id( $cat );
} }
} }
} }
@ -164,7 +177,7 @@ function cat_id( $cats )
$info_name_options = "<option value=\"\">none\n"; $info_name_options = "<option value=\"\">none\n";
while (list($field,$name) = each($info_names)) { while (list($field,$name) = each($info_names)) {
$info_name_options .= "<option value=\"$field\">".$phpgw->strip_html($name)."\n"; $info_name_options .= "<option value=\"$field\">".$GLOBALS['phpgw']->strip_html($name)."\n";
} }
$csv_fields = fgetcsv($fp,8000,$fieldsep); $csv_fields = fgetcsv($fp,8000,$fieldsep);
$csv_fields[] = 'no CSV 1'; // eg. for static assignments $csv_fields[] = 'no CSV 1'; // eg. for static assignments
@ -189,7 +202,7 @@ function cat_id( $cats )
$t->set_var('max',200); $t->set_var('max',200);
$t->parse('ffooterhandle','ffooter'); $t->parse('ffooterhandle','ffooter');
fclose($fp); fclose($fp);
$old = $csvfile; $csvfile = $phpgw_info['server']['temp_dir'].'/info_log_import_'.basename($csvfile); $old = $csvfile; $csvfile = $GLOBALS['phpgw_info']['server']['temp_dir'].'/info_log_import_'.basename($csvfile);
rename($old,$csvfile); rename($old,$csvfile);
$hiddenvars .= '<input type="hidden" name="csvfile" value="'.$csvfile.'">'; $hiddenvars .= '<input type="hidden" name="csvfile" value="'.$csvfile.'">';
$help_on_trans = "<a name='help'><b>How to use Translation's</b><p>". $help_on_trans = "<a name='help'><b>How to use Translation's</b><p>".
@ -307,7 +320,7 @@ function cat_id( $cats )
if (!isset($values['datecreated'])) $values['datecreated'] = $values['startdate']; if (!isset($values['datecreated'])) $values['datecreated'] = $values['startdate'];
if (!$debug) { if (!$debug) {
$phpgw->infolog->write($values); $infolog->bo->write($values);
} }
} }
$log .= "\t</tr>\n</table>\n"; $log .= "\t</tr>\n</table>\n";
@ -321,6 +334,6 @@ function cat_id( $cats )
} }
$t->set_var('hiddenvars',$hiddenvars); $t->set_var('hiddenvars',$hiddenvars);
$t->pfp('out','import',True); $t->pfp('out','import',True);
$phpgw->common->phpgw_footer(); $GLOBALS['phpgw']->common->phpgw_footer();
?> ?>