--- docman.php 2000/08/04 11:25:05 1.11 +++ docman.php 2001/02/15 22:14:21 1.33 @@ -35,22 +35,14 @@ /* existent address after file modifications. */ /* - 2000-07-25 Dobrica Pavlinusic - nuked exec calls (unsecure) - nuked writeable function (replaced by php is_writeable) - added support for https (tested with apache+mod_ssl) - added users file - date format user-selectable - cycle backup files in bak directory - support links as directoryes (for now) - support of file history logging - undelete capabilities (delete moves to .del directory) + This project is now called Directory Manager. - 2000-07-26 DbP + For more info, please see web pages at + http://www.rot13.org/~dpavlin/docman.html - added more checking on entered filename (when creating file/dir) - added rename option + It's relased under GPL by + Dobrica Pavlinusic IMPORTANT INSTALLATION NOTE: @@ -59,13 +51,14 @@ deleted files! .htusers is in form: - login:Real Name:md5(loginpassword) + login:Real Name:[md5(loginpassword)|auth_*]:email@host.dom TODO: mixed file/directory output (add type to each entry, real support for links) - retrieve old versions of files (overwritten) + access controll + */ ////////////////////////////////////////////////////////////////// @@ -78,58 +71,41 @@ // GLOBAL PARAMETERS // ================= -// Make modifications here to suit siteman to your needs +// Make modifications here to suit docman to your needs // error_reporting(4) ; // how verbose ? + // from where to include auth_*.php modules? + $gblIncDir = "/home/httpd/docman"; + // username/password should not be system // usernames/passwords !! -// $gblPw = "hash_of_your_username_and_password" ; - -// $gblAuth = false ; // use builtin authentication - $gblAuth = true ; // use builtin authentication - $gblHash = "md5" ; // hash function to use - $gblPw = ""; - if ($gblAuth) { - $htusers_file=dirname($SCRIPT_FILENAME)."/.htusers"; - if (! file_exists($htusers_file)) { - $htusers=fopen($htusers_file,"a+"); - fputs($htusers,"# Change owner of $htusers_file to root !!\n"); - fputs($htusers,"demo:full name:md5_hash\n"); - fclose($htusers); - } - $htusers=fopen($htusers_file,"r"); - while($user = fgetcsv($htusers,255,":")) { - if ($user[0] == $GLOBALS["PHP_AUTH_USER"]) { - $gblUserName=$user[1]; - $gblPw=$user[2]; - continue ; - } - } - fclose($htusers); - } - + // date format // $gblDateFmt="D, F d, Y"; -// $gblTimeFmt="g:i:sA"; - $gblDateFmt="Y-m-d"; + + // time format +// $gblTimeFmt="g:i:sA"; $gblTimeFmt="H:i:s"; -// Number of backup files to keep - $gblNumBackups=5; + // Number of backup files to keep + $gblNumBackups=3; + + // show red star if newer than ... days + $gblModDays=1; // choose GifIcon below unless you have the M$ // WingDings font installed on your system - $gblIcon = "GifIcon" ; // MockIcon or GifIcon + $gblIcon="GifIcon"; // MockIcon or GifIcon // the directory below should be /icons/ or /icons/small/ // on Apache; a set of icons is included in the distribution - $gblIconLocation = "/icons/" ; + $gblIconLocation="/icons/"; // files you want to be able to edit in text mode // and view with (primitive) syntax highlighting @@ -148,7 +124,7 @@ function StartHTML($title,$text="") { - $title = "Site Manager " . $title ; + $title = "Document Manager " . $title ; $host = $GLOBALS["HTTP_HOST"] ; $self = $GLOBALS["PHP_SELF"] ; ?> @@ -227,7 +203,7 @@ function DetailPage($fsRoot,$relDir,$fn) { - global $gblEditable, $gblImages ; + global $gblEditable, $gblImages, $webRoot ; $self = $GLOBALS["PHP_SELF"] ; $relPath = $relDir . "/" . $fn ; @@ -246,7 +222,11 @@ Error("Creation denied",$relDir) ; $text = "Use this page to view, modify or " ; - $text .= "delete a single document on this " ; + if (is_dir($fsPath)) { + $text .="delete a directory on this " ; + } else { + $text .= "delete a single document on this " ; + }; $text .= "web site." ; $title = "(Detail Page)" ; StartHTML($title, $text) ; @@ -256,18 +236,21 @@ $fsize = filesize($fsPath) ; $fmodified = date("$GLOBALS[gblDateFmt] $GLOBALS[gblTimeFmt]", filemtime($fsPath)) ; $faccessed = date("$GLOBALS[gblDateFmt] $GLOBALS[gblTimeFmt]", fileatime($fsPath)) ; - echo "
    file size: " . $fsize . " Bytes
" ;
+		$userinfo = posix_getpwuid(fileowner($fsPath));
+		$grpinfo = posix_getgrgid(filegroup($fsPath));
+		echo "
";
+		if (!is_dir($fsPath)) echo "file size: " . $fsize . " Bytes
" ;
 		echo "last modified: " . $fmodified . "
" ;
 		echo "last accessed: " . $faccessed . "
" ;
-		echo "        owner: " . fileowner($fsPath) . "
" ;
-		echo "        group: " . filegroup($fsPath) . "
" ;
+		echo "        owner: " . $userinfo["name"] . "
" ;
+		echo "        group: " . $grpinfo["name"] . "
" ;
 		echo "  permissions: " ; 
 		echo printf( "%o", fileperms($fsPath) ) . "" ;
 		echo "
" ;
 
 	}
 
-	if ( $editable && ($writable || !$exists) && !$file_lock ) { 
+	if ( !is_dir($fsPath) && $editable && ($writable || !$exists) && !$file_lock ) { 
 		$fh = fopen($fsPath,"a+") ;
 		rewind($fh) ;
 		$fstr = fread($fh,filesize($fsPath)) ;
@@ -293,9 +276,9 @@
 
 " ;
 //		echo htmlentities($tstr) . "

" . $tstr ;
@@ -361,25 +344,30 @@
 
 
 
CHANGES TO THIS FILE
\n";
+		if (is_dir("$fsDir/$fn")) {
+			$whatis="DIRECTORY";
+		} else {
+			$whatis="FILE";
+		}
+		print "

CHANGES TO THIS $whatis
\n";
 		$bakcount = 0;	// start from 0, skip fist backup (it's current)
 		while ($e = array_shift($logarr)) {
 			if (strstr($e[4],"upload")) {
 				if (file_exists("$bakdir/$bakcount/$name")) {
-					$e[4]="$e[4]";
+					$e[4]="$e[4]";
 				}
 				$bakcount++;
 			}
@@ -640,15 +628,11 @@
 
 function Navigate($fsRoot,$relDir) {
 
-	global $gblEditable, $gblIcon ;
+	global $gblEditable, $gblIcon, $gblModDays, $webRoot ;
 
 	$self     = $GLOBALS["PHP_SELF"] ;
-	if (isset($GLOBALS["HTTPS"]) && $GLOBALS["HTTPS"] == "on") {
-		$webRoot  = "https://" . $GLOBALS["SERVER_NAME"] ;
-	} else {
-		$webRoot  = "http://" . $GLOBALS["SERVER_NAME"] ;
-	}
-	$fsDir    = $fsRoot . $relDir . "/" ; // current directory
+
+	$fsDir = $fsRoot . $relDir . "/" ; // current directory
 
 	if (!is_dir($fsDir)) Error("Dir not found",$relDir) ; 
 
@@ -689,6 +673,7 @@
 		$text .= ", undelete";
 	}
 	$text .= " or revise files on this web site." ;
+	$text .= "
Examine list of files changed in last day or all changes.";
 	StartHTML("(Navigate)",$text) ;
 
 	echo "

 
-
+" . $dir . "/" ;
+			$note_html="".$gblIcon("note")."".ReadNote($fsDir.$dir);
 ?>
 
-
-
+
+
+ time() ) {
+		if ( ($mod + $gblModDays*86400) > time() ) {
 			$a  = " * " ;
+			$a .= " than $gblModDays days\"> * " ;
 		}
 
 		$file_lock=CheckLock($path);
@@ -822,7 +812,13 @@
 
 
+ 
+
@@ -842,15 +838,14 @@
 
 
 
-
-
-
+
+	";
+}
+?>
 
 $date$time$dir/$file$e[2]$e[3]\n";
+	}
+	print "
DIRECTORY NAME
DIRECTORY NAMEDIRECTORY NOTE

 
 

+
+

 
 

+  No files in this directory
+ 

-To just view file without editing, select it's filename (don't edit files which are opened this way!)

-To edit file select  to check-out
-and edit it locally. After editing is over, select filename or  to check-in (update copy of file on server).

-If you select icon left from filename, you will get detailed information
-about file, as well as delete, rename and annotation options. 
-
";
+	include(".info.inc");
+	print "

 
CREATE NEW
@@ -872,7 +867,7 @@
 
 //////////////////////////////////////////////////////////////////
 
-function UploadPage($fsRoot, $relDir, $filename) {
+function UploadPage($fsRoot, $relDir, $filename="") {
 
 	$self = $GLOBALS["PHP_SELF"] ;
 	if ($relDir == "") $relDir = "/" ; 
@@ -882,7 +877,7 @@
 
 DESTINATION DIRECTORY:
-
+
 
DESTINATION FILE:
 
 
@@ -917,29 +912,6 @@
 
 //////////////////////////////////////////////////////////////////
 
-function CreateHash($user, $pw) {
-
-	global $gblHash ;  // hash function to use 
-
-	if ($user == "" || $pw == "") {
-		$text = "either no password or no username supplied" ;
-		Error("Create Hash",$text) ;
-	}
-	$title = "(Create Hash)" ;
-	StartHTML($title) ;
-	echo "
" ;
-	echo "
Copy the value below and paste it " ;
-	echo "into the
value for \$gblPw in the source of " ;
-	echo "this file

" . $gblHash($user.$pw) ;
-	echo "

Hash function: " . $gblHash ;
-	echo "
" ;
-	EndHTML() ;
-	exit ;
-
-} // end function CreateHash
-
-//////////////////////////////////////////////////////////////////
-
 function NoEntry() {
 
 	$user = $GLOBALS["PHP_AUTH_USER"] ;
@@ -949,27 +921,14 @@
 	$title = "(401 Unauthorized)" ;
 	$text  = "No trespassing !" ;
 	StartHTML($title,$text) ;
-?>
 
-
-
-
-
-
If you are a site administrator:


-Click below to generate a password hash
from 
-the username-password pair you just
entered. Then include the hash in 
-the source
of this file.


-
-

-
-\n";
+	while ($e = array_shift($logarr)) {
+		$cl=$cl1; $cl1=$cl2; $cl2=$cl;
+		$date = date("$GLOBALS[gblDateFmt]", $e[0]);
+		$time = date("$GLOBALS[gblTimeFmt]", $e[0]);
+		$dir = dirname($e[1]);
+		$file = basename($e[1]);
+		print "
";
+	print "
".GifIcon(up)." Back to front page.
";
+}
+
+//////////////////////////////////////////////////////////////////
+
 // MAIN PROGRAM
 // ============
 // query parameters: capital letters
@@ -1113,15 +1135,44 @@
 	// forks before authentication: style sheet and hash
 	// creation if password not yet set.
 	if ($STYLE == "get") { CSS() ; exit ; }
-	if ($HASH != "") { 
-		CreateHash($USER, $PW) ; 
-		exit ; 
+
+	$htusers_file=dirname($SCRIPT_FILENAME)."/.htusers";
+	if (! file_exists($htusers_file)) {
+		if (is_writable(dirname($SCRIPT_FILENAME))) {
+			$htusers=fopen($htusers_file,"a+");
+			fputs($htusers,"# Change owner of $htusers_file to root !!\n");
+			fputs($htusers,"demo:full name:[md5_hash|auth_*]:e-mail\n");
+			fclose($htusers);
+			Error("Proto user file created!","Please edit $htusers_file and set it correct permissions (not writable by web server as it is now!). You can add users using adduser.pl script!");
+			exit;
+		} else {
+			Error("Can't create proto user file!","Please make directory ".dirname($htusers_file)." writable or create .htusers file by hand using adduser.pl script!");
+			exit;
+		}
+	}
+	$htusers=fopen($htusers_file,"r");
+	while($user = fgetcsv($htusers,255,":")) {
+		if ($user[0] == $GLOBALS["PHP_AUTH_USER"]) {
+			$gblUserName=$user[1];
+			$gblPw=$user[2];
+			if (substr($gblPw,0,5) == "auth_" && file_exists("$gblIncDir/$gblPw.php")) {
+				require("$gblIncDir/$gblPw.php");
+				if ($gblPw($user)) {
+					$gblPw=md5($PHP_AUTH_USER.$PHP_AUTH_PW);
+				} else {
+					$gblPw="error".md5($PHP_AUTH_USER.$PHP_AUTH_PW);
+				}
+			}
+			$gblEmail=$user[3];
+			continue ;
+		}
 	}
+	fclose($htusers);
 
-	// authentication if $gblAuth == true
-	if ( $gblAuth && $gblHash($PHP_AUTH_USER.$PHP_AUTH_PW) != $gblPw ||
+	// authentication failure
+	if ( md5($PHP_AUTH_USER.$PHP_AUTH_PW) != $gblPw ||
 		isset($relogin) && $gblPw == $relogin ) {
-		header("WWW-authenticate: basic realm=\"$SERVER_NAME\"") ;
+		header("WWW-authenticate: basic realm=\"$HTTP_HOST\"") ;
 		header("HTTP/1.0 401 Unauthorized") ;
 		NoEntry() ;
 		exit ;
@@ -1144,18 +1195,29 @@
 	// i.e. below $gblFsRoot.
 
 	$relScriptDir = dirname($SCRIPT_NAME) ;  	
-	// i.e. /siteman
+	// i.e. /docman
 
 	$fsScriptDir  = dirname($SCRIPT_FILENAME) ; 	
-	// i.e. /home/httpd/html/siteman
+	// i.e. /home/httpd/html/docman
 
-	$gblFsRoot = substr($fsScriptDir,0,
-	  strlen($fsScriptDir)-strlen($relScriptDir)) ;
+	// start on server root
+//	$gblFsRoot = substr($fsScriptDir,0, strlen($fsScriptDir)-strlen($relScriptDir)) ;
+	// or on script root
+	$gblFsRoot = $fsScriptDir;
 	// i.e. /home/httpd/html
 
 	$fsDir = $gblFsRoot . $relDir ; // current directory
 	if ( !is_dir($fsDir) ) Error("Dir not found",$relDir) ;
-	
+
+	if (isset($GLOBALS["HTTPS"]) && $GLOBALS["HTTPS"] == "on") {
+		$webRoot  = "https://";
+	} else {
+		$webRoot  = "http://";
+	}
+	$webRoot .= $GLOBALS["HTTP_HOST"] . $relScriptDir;
+
+	$FN=stripSlashes($FN);
+
 	switch ($POSTACTION) {
 	case "UPLOAD" :
 		if (!is_writeable($fsDir)) Error("Write denied",$relDir) ;
@@ -1164,6 +1226,9 @@
 		// TODO : should rather check for escapeshellcmds
 		// but maybe RFC 18xx asserts safe filenames ....
 		$source = $FN ;
+		if (! file_exists($source)) {
+			Error("You must select file with browse to upload it!");
+		}
 		if (! isset($FILENAME)) { 	// from update file
 			$target = "$fsDir/$FN_name" ;
 		} else {
@@ -1191,10 +1256,12 @@
 		if (isset($FILENAME)) {
 			Unlock($target);
 		}
+		ChangeLog($target,"updated");
 		break ;
 
 	case "SAVE" :
-		$path = $gblFsRoot . escapeshellcmd($RELPATH) ;
+		$path = $gblFsRoot . $RELPATH ;
+		$path=stripSlashes($path);
 		$writable = is_writeable($path) ;
 		$legaldir = is_writeable(dirname($path)) ;
 		$exists   = (file_exists($path)) ? 1 : 0 ; 
@@ -1202,10 +1269,12 @@
 	 	if (!($writable || (!$exists && $legaldir))) 
 			Error("Write denied",$RELPATH) ;
 		$fh = fopen($path, "w") ;
+		$FILEDATA=stripSlashes($FILEDATA);
 		fwrite($fh,$FILEDATA) ;
 		fclose($fh) ;
 		clearstatcache() ;
 		Logit($path,"saved changes");
+		ChangeLog($path,"saved changes");
 		break ;
 
 	case "CREATE" :
@@ -1236,6 +1305,7 @@
 			}
 			$tstr = "$PHP_SELF?A=E&D=".urlencode($relDir)."&F=".urlencode($FN) ;
 			header("Location: " . $tstr) ;
+			ChangeLog($target,"created");
 			exit ;
 		}
 		break ;
@@ -1268,7 +1338,7 @@
 			}
 		}
 		else {  // delete directory
-		  if ( ! @rmdir($fsDir) ) {
+		  if ( ! @rrmdir($fsDir) ) {
 		    Error("Rmdir failed", $tstr . $fsDir) ; 
 		  }
 		  else {
@@ -1333,37 +1403,41 @@
 	// $A=Ci : checkin file $D/$F
 	// $A=V : view file (do nothing except log)
 	// default : display directory $D
-	
+
 	switch ($A) {
 	case "U" :
 		// upload to $relDir
 		if (!is_writeable($gblFsRoot . $relDir)) 
 			Error("Write access denied",$relDir) ;
 		$text  = "Use this page to upload a single " ;
-		$text .= "file to $SERVER_NAME." ;
+		$text .= "file to $HTTP_HOST." ;
 		StartHTML("(Upload Page)", $text) ;
 		UploadPage($gblFsRoot, $relDir) ;
 		EndHTML() ;
 		exit ;
 	case "E" :
+		$F=stripSlashes($F);
 		// detail of $relDir/$F
-		if (is_file("$gblFsRoot/$relDir/$F")) DetailPage($gblFsRoot, $relDir, $F) ;
+		if (is_file("$gblFsRoot/$relDir/$F") || is_dir("$gblFsRoot/$relDir/$F")) DetailPage($gblFsRoot, $relDir, $F) ;
 		exit ;
 	case "C" :
+		$F=stripSlashes($F);
 		// listing of $relDir/$F 
 		DisplayCode($gblFsRoot, $relDir, $F) ;
 		exit ;
 	case "Co" :
 		// checkout
 		Lock("$gblFsRoot/$relDir/$F");
-		Header("Location: ".urlpath("$relDir/$F"));
+		header("Content-Disposition: attachment; filename=$F" );
+		Header("Location: $webRoot".urlpath("$relDir/$F"));
 		exit;
 	case "Ci" :
+		$F=stripSlashes($F);
 		// upload && update to $relDir
 		if (!is_writeable($gblFsRoot . $relDir)) 
 			Error("Write access denied",$relDir) ;
 		$text  = "Use this page to update a single " ;
-		$text .= "file to $SERVER_NAME." ;
+		$text .= "file to $HTTP_HOST." ;
 		StartHTML("(Update file Page)", $text) ;
 		UploadPage($gblFsRoot, $relDir, $F) ;
 		EndHTML() ;
@@ -1371,7 +1445,18 @@
 	case "V" :
 		// view
 		LogIt("$gblFsRoot/$relDir/$F","viewed");
-		Header("Location: ".urlpath("$relDir/$F"));
+		header("Content-Disposition: attachment; filename=$F" );
+		Header("Location: $webRoot".urlpath("$relDir/$F"));
+		exit;
+	case "Ch" :
+		StartHTML("(File changes)","All changes chronologicaly...");
+		DisplayChangeLog(0);	// all
+		EndHTML() ;
+		exit;
+	case "Ch1" :
+		StartHTML("(File changes)","Changes to files in last day...");
+		DisplayChangeLog(1);
+		EndHTML() ;
 		exit;
 	}