Log in with username/password: lyceum/lyceum

Changeset 425

Show
Ignore:
Timestamp:
01/18/06 02:50:17 (3 years ago)
Author:
jjb
Message:

more form and url fixes for token system.

removed a function that is no longer used.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved
  • trunk/src/lib/functions.php

    r422 r425  
    1515} 
    1616 
     17function tokeninput($targetscript, $action='default', $id=0){ 
     18   $token = formtoken($targetscript, $action, $id); 
     19   return "<input type=\"hidden\" name=\"token\" value=\"$token\" />"; 
     20} 
     21 
    1722function hv($thing){//"has value" 
    1823   return ( isset($thing) && (''!=$thing) ); 
    19 } 
    20  
    21 function homeurl(){ 
    22    global $blog; 
    23    return get_settings('home')."?b=$blog"; 
    2424} 
    2525 
     
    8181} 
    8282 
    83 function formtoken($targetscript, $action, $id=0) { 
    84    trace('formtoken: $targetscript, $action, $id', "$targetscript, $action, $id"); 
     83function formtoken($targetscript, $action='default', $id=0) { 
    8584   $name = "$targetscript-$action-$id"; 
    8685   arrayify($_SESSION['formtokens']); 
     
    8887   $token = md5(uniqid(rand(), TRUE)); 
    8988   $_SESSION['formtokens']["$name-tokens"][$token] = time();//TODO clear out old tokens(otherwise thousands will accumulate) 
     89trace('formtoken: $token, $targetscript, $action, $id', "$token, $targetscript, $action, $id"); 
    9090   return $token; 
    9191} 
    9292 
    93 function tokenIsValid ($token, $targetscript, $action, $id=0) { 
    94   trace('tokenIsValid: $targetscript, $action, $id', "$targetscript, $action, $id"); 
     93function tokenIsValid ($token, $targetscript, $action='default', $id=0) { 
     94trace('tokenIsValid: $token, $targetscript, $action, $id', "$token, $targetscript, $action, $id"); 
    9595   $name = "$targetscript-$action-$id"; 
    96  
     96//trace('$_SESSION[\'formtokens\']["$name-tokens"]', $_SESSION['formtokens']["$name-tokens"]); 
    9797   if (!array_key_exists($token, $_SESSION['formtokens']["$name-tokens"])) 
    9898      return false; 
  • trunk/src/lyceum/wp-admin/admin-functions.php

    r400 r425  
    630630    <td><?php echo mysql2date('Y-m-d g:i a', $post->post_modified); ?></td>  
    631631   <td><a href="<?php the_permalink(); ?>" rel="permalink" class="edit"><?php _e('View'); ?></a></td> 
    632     <td><?php if ( current_user_can('edit_pages') ) { echo "<a href='post.php?b=$blog&amp;action=edit&amp;post=$id' class='edit'>" . __('Edit') . "</a>"; } ?></td>  
    633     <td><?php if ( current_user_can('edit_pages') ) { echo "<a href='post.php?b=$blog&amp;action=delete&amp;post=$id' class='delete' onclick=\"return deleteSomething( 'page', $blog, " . $id . ", '" . sprintf(__("You are about to delete the &quot;%s&quot; page.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), wp_specialchars(get_the_title('','',0), 1)) . "' );\">" . __('Delete') . "</a>"; } ?></td>  
     632    <td><?php if ( current_user_can('edit_pages') ) { echo "<a href='post.php?token=".formtoken('post.php','edit',$id)."&amp;action=edit&amp;post=$id' class='edit'>" . __('Edit') . "</a>"; } ?></td>  
     633    <td><?php if ( current_user_can('edit_pages') ) { echo "<a href='post.php?b=$blog&amp;token=".formtoken('post.php','delete',$id)."&amp;action=delete&amp;post=$id' class='delete' onclick=\"return deleteSomething( 'page', $blog, " . $id . ", '" . sprintf(__("You are about to delete the &quot;%s&quot; page.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), wp_specialchars(get_the_title('','',0), 1)) . "' );\">" . __('Delete') . "</a>"; } ?></td>  
    634634  </tr>  
    635635 
  • trunk/src/lyceum/wp-admin/edit-comments.php

    r396 r425  
    9999         <p><?php _e('Posted'); echo ' '; comment_date('M j, g:i A');    
    100100         if ( current_user_can('edit_post', $comment->comment_post_ID) ) { 
    101             echo " | <a href=\"post.php?b=$blog&amp;action=editcomment&amp;comment=".$comment->comment_ID."\">" . __('Edit Comment') . "</a>"; 
    102             echo " | <a href=\"post.php?b=$blog&amp;action=deletecomment&amp;p=".$comment->comment_post_ID."&amp;comment=".$comment->comment_ID."\" onclick=\"return deleteSomething( 'comment', $blog, $comment->comment_ID, '" . sprintf(__("You are about to delete this comment by &quot;%s&quot;.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), wp_specialchars( $comment->comment_author, 1 ))  . "' );\">" . __('Delete Comment') . "</a> &#8212; "; 
     101            echo " | <a href=\"post.php?b=$blog&amp;token=".formtoken('post.php','editcomment',$comment->comment_ID)."&amp;action=editcomment&amp;comment=".$comment->comment_ID."\">" . __('Edit Comment') . "</a>"; 
     102            echo " | <a href=\"post.php?b=$blog&amp;token=".formtoken('post.php','deletecomment',$comment->comment_ID)."&amp;action=deletecomment&amp;p=".$comment->comment_post_ID."&amp;comment=".$comment->comment_ID."\" onclick=\"return deleteSomething( 'comment', $blog, $comment->comment_ID, '" . sprintf(__("You are about to delete this comment by &quot;%s&quot;.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), wp_specialchars( $comment->comment_author, 1 )) . "' );\">" . __('Delete Comment') . "</a> &#8212; "; 
    103103         } // end if any comments to show 
    104104         // Get post title 
     
    107107            $post_title = $wpdb->get_var("SELECT post_title FROM $wpdb->posts WHERE ID = '$comment->comment_post_ID'"); 
    108108            $post_title = ('' == $post_title) ? "# $comment->comment_post_ID" : $post_title; 
    109             ?> <a href="post.php?b=<?=$blog?>&amp;action=edit&amp;post=<?php echo $comment->comment_post_ID; ?>"><?php printf(__('Edit Post &#8220;%s&#8221;'), stripslashes($post_title)); ?></a> 
     109            ?> <a href="post.php?b=<?=$blog?>&amp;token=<?=formtoken('post.php','edit',$comment->comment_post_ID)?>&amp;action=edit&amp;post=<?php echo $comment->comment_post_ID; ?>"><?php printf(__('Edit Post &#8220;%s&#8221;'), stripslashes($post_title)); ?></a> 
    110110            <?php } ?> 
    111111          | <a href="<?php echo get_permalink($comment->comment_post_ID); ?>"><?php _e('View Post') ?></a></p> 
     
    151151      <td><a href="<?php echo get_permalink($comment->comment_post_ID); ?>#comment-<?php comment_ID() ?>" class="edit"><?php _e('View') ?></a></td> 
    152152      <td><?php if ( current_user_can('edit_post', $comment->comment_post_ID) ) { 
    153    echo "<a href='post.php?b=$blog&amp;action=editcomment&amp;comment=$comment->comment_ID' class='edit'>" .  __('Edit') . "</a>"; } ?></td> 
     153   echo "<a href='post.php?b=$blog&amp;token=".formtoken('post.php','editcomment',$comment->comment_ID)."&amp;action=editcomment&amp;comment=$comment->comment_ID' class='edit'>" .   __('Edit') . "</a>"; } ?></td> 
    154154      <td><?php if ( current_user_can('edit_post', $comment->comment_post_ID) ) { 
    155                   echo "<a href=\"post.php?b=$blog&action=deletecomment&amp;p=".$comment->comment_post_ID."&amp;comment=".$comment->comment_ID."\" onclick=\"return confirm('" . sprintf(__("You are about to delete this comment by \'%s\'\\n   \'Cancel\' to stop, \'OK\' to delete."), $comment->comment_author) . "')\"    class='delete'>" . __('Delete') . "</a>"; } ?></td> 
     155                  echo "<a href=\"post.php?b=$blog&amp;token=".formtoken('post.php','deletecomment',$comment-comment_ID)."&amp;action=deletecomment&amp;p=".$comment->comment_post_ID."&amp;comment=".$comment->comment_ID."\" onclick=\"return confirm('" . sprintf(__("You are about to delete this comment by \'%s\'\\n  \'Cancel\' to stop, \'OK\' to delete."), $comment->comment_author) . "')\"    class='delete'>" . __('Delete') . "</a>"; } ?></td> 
    156156   </tr> 
    157157      <?php  
  • trunk/src/lyceum/wp-admin/edit-form-advanced.php

    r399 r425  
    5555<input type="hidden" name="action" value="<?php echo $form_action ?>" /> 
    5656<input type="hidden" name="post_author" value="<?php echo $post->post_author ?>" /> 
     57<?trace('$form_action, $post_ID', "$form_action, $post_ID");?> 
     58<?=tokeninput('post.php', $form_action, isset($post_ID) ? $post_ID : 0)?> 
    5759 
    5860<?php echo $form_extra ?> 
  • trunk/src/lyceum/wp-admin/edit.php

    r421 r425  
    2525      if ($draft->post_title == '') 
    2626         $draft->post_title = sprintf(__('Post #%s'), $draft->ID); 
    27       echo "<a href='post.php?b=$blog&amp;action=edit&amp;post=$draft->ID' title='" . __('Edit this draft') . "'>$draft->post_title</a>"; 
     27      echo "<a href='post.php?b=$blogdata->blogname&amp;action=edit&amp;post=$draft->ID' title='" . __('Edit this draft') . "'>$draft->post_title</a>"; 
    2828      ++$i; 
    2929      } 
     
    4242      if ($draft->post_title == '') 
    4343         $draft->post_title = sprintf(__('Post #%s'), $draft->ID); 
    44       echo "<a href='post.php?b=$blog&amp;action=edit&amp;post=$draft->ID' title='" . __('Edit this draft') . "'>$draft->post_title</a>"; 
     44      echo "<a href='post.php?b=$blogdata->blogname&amp;action=edit&amp;post=$draft->ID' title='" . __('Edit this draft') . "'>$draft->post_title</a>"; 
    4545      ++$i; 
    4646      } 
     
    186186   case 'comments': 
    187187      ?> 
    188       <td><a href="edit.php?b=<?=$blog;?>&amp;p=<?php echo $id ?>&amp;c=1">  
     188      <td><a href="edit.php?b=<?=$blogdata->blogname;?>&amp;p=<?php echo $id ?>&amp;c=1">  
    189189      <?php comments_number(__('0'), __('1'), __('%')) ?>  
    190190      </a></td> 
     
    206206   case 'control_edit': 
    207207      ?> 
    208       <td><?php if ( current_user_can('edit_post',$post->ID) ) { echo "<a href='post.php?b=$blog&amp;action=edit&amp;post=$id' class='edit'>" . __('Edit') . "</a>"; } ?></td> 
     208      <td><?php if ( current_user_can('edit_post',$post->ID) ) { echo "<a href='post.php?b=$blogdata->blogname&amp;action=edit&amp;post=$id' class='edit'>" . __('Edit') . "</a>"; } ?></td> 
    209209      <?php 
    210210      break; 
     
    212212   case 'control_delete': 
    213213      ?> 
    214       <td><?php if ( current_user_can('edit_post',$post->ID) ) { echo "<a href='post.php?b=$blog&amp;action=delete&amp;post=$id' class='delete' onclick=\"return deleteSomething( 'post', $blog, " . $id . ", '" . sprintf(__("You are about to delete this post &quot;%s&quot;.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), wp_specialchars(get_the_title('', ''), 1) ) . "' );\">" . __('Delete') . "</a>"; } ?></td> 
     214      <td><?php if ( current_user_can('edit_post',$post->ID) ) { echo "<a href='post.php?b=$blogdata->blogname&amp;action=delete&amp;post=$id' class='delete' onclick=\"return deleteSomething( 'post', $blogdata->blogname, " . $id . ", '" . sprintf(__("You are about to delete this post &quot;%s&quot;.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), wp_specialchars(get_the_title('', ''), 1) ) . "' );\">" . __('Delete') . "</a>"; } ?></td> 
    215215      <?php 
    216216      break; 
     
    263263  <?php  
    264264         if ( current_user_can('edit_post', $post->ID) ) { 
    265             echo "[ <a href=\"post.php?b=".$blog."&amp;action=editcomment&amp;comment=".$comment->comment_ID."\">" .  __('Edit') . "</a>"; 
    266             echo " - <a href=\"post.php?b=".$blog."&amp;action=deletecomment&amp;p=".$post->ID."&amp;comment=".$comment->comment_ID."\" onclick=\"return confirm('" . sprintf(__("You are about to delete this comment by \'%s\'\\n  \'OK\' to delete, \'Cancel\' to stop."), $comment->comment_author) . "')\">" . __('Delete') . "</a> "; 
     265            echo "[ <a href=\"post.php?token=".formtoken('post.php','editcomment',$comment->comment_ID)."&amp;action=editcomment&amp;comment=".$comment->comment_ID."\">" .  __('Edit') . "</a>"; 
     266            echo " - <a href=\"post.php?token=".formtoken('post.php','deletecomment',$comment->comment_ID)."&amp;action=deletecomment&amp;p=".$post->ID."&amp;comment=".$comment->comment_ID."\" onclick=\"return confirm('" . sprintf(__("You are about to delete this comment by \'%s\'\\n  \'OK\' to delete, \'Cancel\' to stop."), $comment->comment_author) . "')\">" . __('Delete') . "</a> "; 
    267267            if ( ('none' != $comment_status) && ( current_user_can('moderate_comments') ) ) { 
    268268               if ('approved' == wp_get_comment_status($comment->comment_ID)) { 
    269                   echo " - <a href=\"post.php?b=".$blog."&amp;action=unapprovecomment&amp;p=".$post->ID."&amp;comment=".$comment->comment_ID."\">" . __('Unapprove') . "</a> "; 
     269                  echo " - <a href=\"post.php?token=".formtoken('post.php','unapprovecomment',$comment->comment_ID)."&amp;action=unapprovecomment&amp;p=".$post->ID."&amp;comment=".$comment->comment_ID."\">" . __('Unapprove') . "</a> "; 
    270270               } else { 
    271                   echo " - <a href=\"post.php?b=".$blogdata->name."&amp;token=".formtoken('post.php','approvecomment',$comment->comment_ID)."&amp;action=approvecomment&amp;p=".$post->ID."&amp;comment=".$comment->comment_ID."\">" . __('Approve') . "</a> "; 
     271                  echo " - <a href=\"post.php?token=".formtoken('post.php','approvecomment',$comment->comment_ID)."&amp;action=approvecomment&amp;p=".$post->ID."&amp;comment=".$comment->comment_ID."\">" . __('Approve') . "</a> "; 
    272272               } 
    273273            } 
  • trunk/src/lyceum/wp-admin/post.php

    r424 r425  
    3030$editing = true; 
    3131 
    32 if (!( 
    33    tokenIsValid($_REQUEST['token'], 'post.php', $action, (int)$_REQUEST['comment']) || 
    34    tokenIsValid($_REQUEST['token'], 'post.php', $action, (int)$_REQUEST['post']) || 
    35    tokenIsValid($_REQUEST['token'], 'post.php', $action) 
    36    ))     
    37    die("token is not valid"); 
     32if (isset($_REQUEST['action'])) 
     33   if (!( 
     34      tokenIsValid($_REQUEST['token'], 'post.php', $action, (int)$_REQUEST['comment']) || 
     35      tokenIsValid($_REQUEST['token'], 'post.php', $action, (int)$_REQUEST['post']) || 
     36      tokenIsValid($_REQUEST['token'], 'post.php', $action) 
     37      ))     
     38      die("token is not valid"); 
    3839 
    3940switch($action) { 
  • trunk/src/lyceum/wp-includes/functions.php

    r396 r425  
    10071007 
    10081008   if ( $wpdb->get_var(" 
    1009       SELECT post_id FROM $wpdb->postmeta  
     1009      SELECT $wpdb->postmeta.post_id FROM $wpdb->postmeta  
    10101010         INNER JOIN $wpdb->post2cat ON ($wpdb->post2cat.post_id = $wpdb->postmeta.post_id) 
    10111011            INNER JOIN $wpdb->categories ON (category_id = cat_ID) 
Log in with username/password: lyceum/lyceum