--- docman.php 2000/08/04 10:07:04 1.6 +++ docman.php 2001/06/21 08:54:54 1.44 @@ -35,22 +35,14 @@ /* existent address after file modifications. */ /* - 2000-07-25 Dobrica Pavlinusic - nuked exec calls (unsecure) - nuked writeable function (replaced by php is_writeable) - added support for https (tested with apache+mod_ssl) - added users file - date format user-selectable - cycle backup files in bak directory - support links as directoryes (for now) - support of file history logging - undelete capabilities (delete moves to .del directory) + This project is now called Directory Manager. - 2000-07-26 DbP + For more info, please see web pages at + http://www.rot13.org/~dpavlin/docman.html - added more checking on entered filename (when creating file/dir) - added rename option + It's relased under GPL by + Dobrica Pavlinusic IMPORTANT INSTALLATION NOTE: @@ -59,15 +51,14 @@ deleted files! .htusers is in form: - login:Real Name:md5(loginpassword) + login:Real Name:[md5(loginpassword)|auth_*]:email@host.dom TODO: mixed file/directory output (add type to each entry, real support for links) - add more content-management (like cms.sourceforge.net): - check-out/check-in/reserve - comments to files + access controll + */ ////////////////////////////////////////////////////////////////// @@ -80,58 +71,41 @@ // GLOBAL PARAMETERS // ================= -// Make modifications here to suit siteman to your needs +// Make modifications here to suit docman to your needs // error_reporting(4) ; // how verbose ? + // from where to include auth_*.php modules? + $gblIncDir = "/home/httpd/docman"; + // username/password should not be system // usernames/passwords !! -// $gblPw = "hash_of_your_username_and_password" ; - -// $gblAuth = false ; // use builtin authentication - $gblAuth = true ; // use builtin authentication - $gblHash = "md5" ; // hash function to use - $gblPw = ""; - if ($gblAuth) { - $htusers_file=dirname($SCRIPT_FILENAME)."/.htusers"; - if (! file_exists($htusers_file)) { - $htusers=fopen($htusers_file,"a+"); - fputs($htusers,"# Change owner of $htusers_file to root !!\n"); - fputs($htusers,"demo:full name:md5_hash\n"); - fclose($htusers); - } - $htusers=fopen($htusers_file,"r"); - while($user = fgetcsv($htusers,255,":")) { - if ($user[0] == $GLOBALS["PHP_AUTH_USER"]) { - $gblUserName=$user[1]; - $gblPw=$user[2]; - continue ; - } - } - fclose($htusers); - } - + // date format // $gblDateFmt="D, F d, Y"; -// $gblTimeFmt="g:i:sA"; - $gblDateFmt="Y-m-d"; + + // time format +// $gblTimeFmt="g:i:sA"; $gblTimeFmt="H:i:s"; -// Number of backup files to keep - $gblNumBackups=5; + // Number of backup files to keep + $gblNumBackups=3; + + // show red star if newer than ... days + $gblModDays=1; // choose GifIcon below unless you have the M$ // WingDings font installed on your system - $gblIcon = "GifIcon" ; // MockIcon or GifIcon + $gblIcon="GifIcon"; // MockIcon or GifIcon // the directory below should be /icons/ or /icons/small/ // on Apache; a set of icons is included in the distribution - $gblIconLocation = "/icons/" ; + $gblIconLocation="/icons/"; // files you want to be able to edit in text mode // and view with (primitive) syntax highlighting @@ -146,11 +120,17 @@ $gblImages = array( ".jpg",".jpeg",".gif",".png",".ico", ".bmp",".xbm") ; + // which files to hide (separated by ,) + $gblHide = ""; + + // Where are users? (by default in .htusers file) + $gblUsers = "htusers_file"; + ////////////////////////////////////////////////////////////////// function StartHTML($title,$text="") { - $title = "Site Manager " . $title ; + $title = "Document Manager " . $title ; $host = $GLOBALS["HTTP_HOST"] ; $self = $GLOBALS["PHP_SELF"] ; ?> @@ -194,7 +174,7 @@


- +

file size: " . $fsize . " Bytes
" ; + $fuid=fileowner($fsPath); + $fgid=filegroup($fsPath); + $userinfo = posix_getpwuid($fuid); + $grpinfo = posix_getgrgid($fgid); + echo "
";
+		if (!is_dir($fsPath)) echo "    file size: " . $fsize . " Bytes
" ;
 		echo "last modified: " . $fmodified . "
" ;
 		echo "last accessed: " . $faccessed . "
" ;
-		echo "        owner: " . fileowner($fsPath) . "
" ;
-		echo "        group: " . filegroup($fsPath) . "
" ;
+		echo "        owner: " . $userinfo["name"] . " [$fuid]
" ;
+		echo "        group: " . $grpinfo["name"] . " [$fgid]
" ;
 		echo "  permissions: " ; 
 		echo printf( "%o", fileperms($fsPath) ) . "" ;
 		echo "
" ; } - if ( $editable && ($writable || !$exists) && !$file_lock ) { + if ( !is_dir($fsPath) && $editable && ($writable || !$exists) && !$file_lock ) { $fh = fopen($fsPath,"a+") ; rewind($fh) ; $fstr = fread($fh,filesize($fsPath)) ; @@ -294,12 +283,14 @@ " ; - echo htmlentities($tstr) . "

" . $tstr ; +// echo htmlentities($tstr) . "

" . $tstr ; + echo $tstr ; } ?> @@ -361,18 +352,35 @@
CHANGES TO THIS FILE
\n"; $log=fopen($logname,"r"); - $cl1=" class=lst"; $cl2=""; + $cl1=" class=LST"; $cl2=""; + $logarr = array(); while($line = fgetcsv($log,255,"\t")) { $cl=$cl1; $cl1=$cl2; $cl2=$cl; - print "$line[0]$line[1]$line[2]$line[3]\n"; + array_unshift($logarr,array($cl,$line[0],$line[1],$line[2],$line[3])); } fclose($log); + if (is_dir("$fsDir/$fn")) { + $whatis="DIRECTORY"; + } else { + $whatis="FILE"; + } + print "

CHANGES TO THIS $whatis
\n"; + $bakcount = 0; // start from 0, skip fist backup (it's current) + while ($e = array_shift($logarr)) { + if (strstr($e[4],"upload")) { + if (file_exists("$bakdir/$bakcount/$name")) { + $e[4]="$e[4]"; + } + $bakcount++; + } + print "$e[1]$e[2]$e[3]$e[4]\n"; + } print "
"; } @@ -628,23 +636,21 @@ function Navigate($fsRoot,$relDir) { - global $gblEditable, $gblIcon ; + global $gblEditable, $gblIcon, $gblModDays, $webRoot, $gblHide ; $self = $GLOBALS["PHP_SELF"] ; - if (isset($GLOBALS["HTTPS"]) && $GLOBALS["HTTPS"] == "on") { - $webRoot = "https://" . $GLOBALS["SERVER_NAME"] ; - } else { - $webRoot = "http://" . $GLOBALS["SERVER_NAME"] ; - } - $fsDir = $fsRoot . $relDir . "/" ; // current directory + + $fsDir = $fsRoot . $relDir . "/" ; // current directory if (!is_dir($fsDir)) Error("Dir not found",$relDir) ; + $hide_items=",$gblHide,"; + // read directory contents if ( !($dir = @opendir($fsDir)) ) Error("Read Access denied",$relDir) ; while ($item = readdir($dir)) { - if ( $item == ".." || $item == "." || substr($item,0,1) == "." ) continue ; + if ( substr($item,0,1) == "." || strstr($hide_items,",$item,") ) continue ; if ( is_dir($fsDir . $item) ) { $dirList[] = $item ; } else if ( is_file($fsDir . $item) ) { @@ -677,6 +683,7 @@ $text .= ", undelete"; } $text .= " or revise files on this web site." ; + $text .= "
Examine list of files changed in last day or all changes."; StartHTML("(Navigate)",$text) ; echo " 1) { + $out.="s"; + } + return $out; +} + // output subdirs if (sizeof($dirList) > 0) { sort($dirList) ; ?> - +" . $dir . "/" ; + $note_html="".$gblIcon("note")."".ReadNote($fsDir.$dir); ?> - - + + + - + @@ -743,9 +763,9 @@ $info_url=$self."?A=E&F=".urlencode($file)."&D=".urlencode($relDir); - if ( ($mod + 30*86400) > time() ) { + if ( ($mod + $gblModDays*86400) > time() ) { $a = " * " ; + $a .= " than $gblModDays days\"> * " ; } $file_lock=CheckLock($path); @@ -810,7 +830,13 @@ + + @@ -830,15 +856,14 @@ - - - + + "; +} +?> @@ -861,7 +886,7 @@ ////////////////////////////////////////////////////////////////// -function UploadPage($fsRoot, $relDir, $filename) { +function UploadPage($fsRoot, $relDir, $filename="") { $self = $GLOBALS["PHP_SELF"] ; if ($relDir == "") $relDir = "/" ; @@ -871,7 +896,7 @@ DESTINATION DIRECTORY: - +
DESTINATION FILE: @@ -906,29 +931,6 @@ ////////////////////////////////////////////////////////////////// -function CreateHash($user, $pw) { - - global $gblHash ; // hash function to use - - if ($user == "" || $pw == "") { - $text = "either no password or no username supplied" ; - Error("Create Hash",$text) ; - } - $title = "(Create Hash)" ; - StartHTML($title) ; - echo "

" ; - echo "

Copy the value below and paste it " ; - echo "into the
value for \$gblPw in the source of " ; - echo "this file

" . $gblHash($user.$pw) ; - echo "

Hash function: " . $gblHash ; - echo "

" ; - EndHTML() ; - exit ; - -} // end function CreateHash - -////////////////////////////////////////////////////////////////// - function NoEntry() { $user = $GLOBALS["PHP_AUTH_USER"] ; @@ -938,27 +940,14 @@ $title = "(401 Unauthorized)" ; $text = "No trespassing !" ; StartHTML($title,$text) ; -?> - - - - -
If you are a site administrator:

-Click below to generate a password hash
from -the username-password pair you just
entered. Then include the hash in -the source
of this file.

- -
- - $to\n"; + if (file_exists($from) && is_writeable(dirname($to))) { + rename($from,$to); + } + } + + function try_dir($todir) { + if (! file_exists($todir)) { + mkdir($todir,0700); + } + } + + $to="$fromdir/$tofile"; + $todir=dirname($to); + $tofile=basename($to); + +# print "
$fromdir / $fromfile -> $todir / $tofile\n\n";
+
+	try_rename("$fromdir/$fromfile","$todir/$tofile");
+	try_dir("$todir/.log");
+	try_rename("$fromdir/.log/$fromfile","$todir/.log/$tofile");
+	try_dir("$todir/.note");
+	try_rename("$fromdir/.note/$fromfile","$todir/.note/$tofile");
+	try_dir("$todir/.lock");
+	try_rename("$fromdir/.lock/$fromfile","$todir/.lock/$tofile");
+	try_dir("$todir/.bak");
+	for($i=0;$i<=$GLOBALS[gblNumBackups];$i++) {
+		try_rename("$fromdir/.bak/$i/$fromfile","$todir/.bak/$i/$tofile");
+	}
+}
+
+
+//////////////////////////////////////////////////////////////////
+
+// recursivly delete directory
+
+function rrmdir($dir) {
+	$handle=opendir($dir);
+	while ($file = readdir($handle)) {
+		if ($file != "." && $file != "..") {
+			if (is_dir("$dir/$file"))
+				rrmdir("$dir/$file");
+			else
+				if (! @unlink("$dir/$file")) return(0);
+		}
+	}
+	closedir($handle);
+	return @rmdir($dir);
+}
+
+//////////////////////////////////////////////////////////////////
+
+function ChangeLog($target,$msg) {
+
+	global $gblFsRoot;
+	$log=fopen("$gblFsRoot/.changelog","a+");
+	if (substr($target,0,strlen($gblFsRoot)) == $gblFsRoot)
+		$target=substr($target,strlen($gblFsRoot),strlen($target)-strlen($gblFsRoot));
+	fputs($log,time()."\t$target\t$GLOBALS[gblUserName]\t$msg\n");
+	fclose($log);
+
+}
+
+function DisplayChangeLog($day) {
+
+	global $gblFsRoot;
+	if (!file_exists("$gblFsRoot/.changelog")) return;
+	$log=fopen("$gblFsRoot/.changelog","r");
+	$logarr = array();
+	while($line = fgetcsv($log,255,"\t")) {
+		if ($day!=1 || ($day==1 && (time()-$line[0] < 24*60*60))) {
+			array_unshift($logarr,array($line[0],$line[1],$line[2],$line[3]));
+		}
+	}
+	fclose($log);
+	$cl1=" class=LST"; $cl2="";
+	print "
DIRECTORY NAME
DIRECTORY NAME ()DIRECTORY NOTE
+ +
DOCUMENT NAME
DOCUMENT NAME () NOTE LAST UPDATEFILE SIZE
+ No files in this directory +
-To just view file without editing, select it's filename (don't edit files which are opened this way!)
-To edit file select to check-out -and edit it locally. After editing is over, select filename or to check-in (update copy of file on server).
-If you select icon left from filename, you will get detailed information -about file, as well as delete, rename and annotation options. -
"; + include(".info.inc"); + print "
CREATE NEW @@ -847,9 +872,9 @@ NAME - - OR UPLOAD A FILE + + + OR UPLOAD A FILE
\n"; + while ($e = array_shift($logarr)) { + $cl=$cl1; $cl1=$cl2; $cl2=$cl; + $date = date("$GLOBALS[gblDateFmt]", $e[0]); + $time = date("$GLOBALS[gblTimeFmt]", $e[0]); + $dir = dirname($e[1]); + $file = basename($e[1]); + print "$date$time$dir/$file$e[2]$e[3]\n"; + } + print "
"; + print "

".GifIcon(up)." Back to front page.

"; +} + +////////////////////////////////////////////////////////////////// + // MAIN PROGRAM // ============ // query parameters: capital letters @@ -1085,15 +1182,26 @@ // forks before authentication: style sheet and hash // creation if password not yet set. if ($STYLE == "get") { CSS() ; exit ; } - if ($HASH != "") { - CreateHash($USER, $PW) ; - exit ; + + $fsScriptDir = dirname($SCRIPT_FILENAME) ; + // i.e. /home/httpd/html/docman + + // read user-defined configuration + if (file_exists("$fsScriptDir/.docman.conf")) { + include("$fsScriptDir/.docman.conf"); + } + + // where do we get users from? + if (file_exists("$gblIncDir/$gblUsers.php")) { + include("$gblIncDir/$gblUsers.php"); + } else { + Error("Configuration error","Can't find user handling module at $gblIncDir/$gblUsers.php ! Please fix $fsScriptDir/.docman.conf"); } - // authentication if $gblAuth == true - if ( $gblAuth && $gblHash($PHP_AUTH_USER.$PHP_AUTH_PW) != $gblPw || + // authentication failure + if ( md5($PHP_AUTH_USER.$PHP_AUTH_PW) != $gblPw || isset($relogin) && $gblPw == $relogin ) { - header("WWW-authenticate: basic realm=\"$SERVER_NAME\"") ; + header("WWW-authenticate: basic realm=\"$HTTP_HOST\"") ; header("HTTP/1.0 401 Unauthorized") ; NoEntry() ; exit ; @@ -1105,6 +1213,8 @@ $relDir = urldecode($D) ; // then use GET } + $relDir=stripSlashes($relDir); + if ($relDir == "/") $relDir = "" ; // default : website root = "" @@ -1116,18 +1226,27 @@ // i.e. below $gblFsRoot. $relScriptDir = dirname($SCRIPT_NAME) ; - // i.e. /siteman + // i.e. /docman - $fsScriptDir = dirname($SCRIPT_FILENAME) ; - // i.e. /home/httpd/html/siteman - - $gblFsRoot = substr($fsScriptDir,0, - strlen($fsScriptDir)-strlen($relScriptDir)) ; + // start on server root +// $gblFsRoot = substr($fsScriptDir,0, strlen($fsScriptDir)-strlen($relScriptDir)) ; + // or on script root + $gblFsRoot = $fsScriptDir; // i.e. /home/httpd/html $fsDir = $gblFsRoot . $relDir ; // current directory if ( !is_dir($fsDir) ) Error("Dir not found",$relDir) ; - + + if (isset($GLOBALS["HTTPS"]) && $GLOBALS["HTTPS"] == "on") { + $webRoot = "https://"; + } else { + $webRoot = "http://"; + } + $webRoot .= $GLOBALS["HTTP_HOST"] . $relScriptDir; + + $FN=stripSlashes($FN); + + switch ($POSTACTION) { case "UPLOAD" : if (!is_writeable($fsDir)) Error("Write denied",$relDir) ; @@ -1136,6 +1255,9 @@ // TODO : should rather check for escapeshellcmds // but maybe RFC 18xx asserts safe filenames .... $source = $FN ; + if (! file_exists($source)) { + Error("You must select file with browse to upload it!"); + } if (! isset($FILENAME)) { // from update file $target = "$fsDir/$FN_name" ; } else { @@ -1163,10 +1285,12 @@ if (isset($FILENAME)) { Unlock($target); } + ChangeLog($target,"updated"); break ; case "SAVE" : - $path = $gblFsRoot . escapeshellcmd($RELPATH) ; + $path = $gblFsRoot . $RELPATH ; + $path=stripSlashes($path); $writable = is_writeable($path) ; $legaldir = is_writeable(dirname($path)) ; $exists = (file_exists($path)) ? 1 : 0 ; @@ -1174,10 +1298,12 @@ if (!($writable || (!$exists && $legaldir))) Error("Write denied",$RELPATH) ; $fh = fopen($path, "w") ; + $FILEDATA=stripSlashes($FILEDATA); fwrite($fh,$FILEDATA) ; fclose($fh) ; clearstatcache() ; Logit($path,"saved changes"); + ChangeLog($path,"saved changes"); break ; case "CREATE" : @@ -1196,7 +1322,7 @@ // this functionality is doubled in DetailView(). // better keep it here altogether // chmod perms to $gblFilePerms - if ( file_exists($path) && !is_writable($path) ) + if ( file_exists($path) && !is_writeable($path) ) Error("File not writable", $relPath) ; $fh = fopen($path, "w+") ; if ($fh) { @@ -1208,6 +1334,7 @@ } $tstr = "$PHP_SELF?A=E&D=".urlencode($relDir)."&F=".urlencode($FN) ; header("Location: " . $tstr) ; + ChangeLog($target,"created"); exit ; } break ; @@ -1240,7 +1367,7 @@ } } else { // delete directory - if ( ! @rmdir($fsDir) ) { + if ( ! @rrmdir($fsDir) ) { Error("Rmdir failed", $tstr . $fsDir) ; } else { @@ -1267,11 +1394,7 @@ if ( $CONFIRM != "on" ) break ; Logit("$fsDir/$FN","renamed $FN to $NEWNAME"); - rename("$fsDir/$FN","$fsDir/$NEWNAME"); - rename("$fsDir/.log/$FN","$fsDir/.log/$NEWNAME"); - rename("$fsDir/.note/$FN","$fsDir/.note/$NEWNAME"); - rename("$fsDir/.lock/$FN","$fsDir/.lock/$NEWNAME"); - + safe_rename($fsDir,$FN,$NEWNAME); break ; case "NOTE" : @@ -1302,47 +1425,60 @@ // $A=Ci : checkin file $D/$F // $A=V : view file (do nothing except log) // default : display directory $D - + switch ($A) { case "U" : // upload to $relDir if (!is_writeable($gblFsRoot . $relDir)) Error("Write access denied",$relDir) ; $text = "Use this page to upload a single " ; - $text .= "file to $SERVER_NAME." ; + $text .= "file to $HTTP_HOST." ; StartHTML("(Upload Page)", $text) ; UploadPage($gblFsRoot, $relDir) ; EndHTML() ; exit ; case "E" : + $F=stripSlashes($F); // detail of $relDir/$F - if (is_file("$gblFsRoot/$relDir/$F")) DetailPage($gblFsRoot, $relDir, $F) ; + if (is_file("$gblFsRoot/$relDir/$F") || is_dir("$gblFsRoot/$relDir/$F")) DetailPage($gblFsRoot, $relDir, $F) ; exit ; case "C" : + $F=stripSlashes($F); // listing of $relDir/$F DisplayCode($gblFsRoot, $relDir, $F) ; exit ; case "Co" : // checkout Lock("$gblFsRoot/$relDir/$F"); - $url="$relDir/$F"; $url=str_replace(" ","%20",$url); - Header("Location: $url"); + header("Content-Disposition: attachment; filename=$F" ); + Header("Location: $webRoot".urlpath("$relDir/$F")); exit; case "Ci" : + $F=stripSlashes($F); // upload && update to $relDir if (!is_writeable($gblFsRoot . $relDir)) Error("Write access denied",$relDir) ; $text = "Use this page to update a single " ; - $text .= "file to $SERVER_NAME." ; + $text .= "file to $HTTP_HOST." ; StartHTML("(Update file Page)", $text) ; UploadPage($gblFsRoot, $relDir, $F) ; EndHTML() ; exit ; case "V" : // view - Log("viewed"); - $url="$relDir/$F"; $url=str_replace(" ","%20",$url); - Header("Location: $url"); + LogIt("$gblFsRoot/$relDir/$F","viewed"); + header("Content-Disposition: attachment; filename=$F" ); + Header("Location: $webRoot".urlpath("$relDir/$F")); + exit; + case "Ch" : + StartHTML("(File changes)","All changes chronologicaly..."); + DisplayChangeLog(0); // all + EndHTML() ; + exit; + case "Ch1" : + StartHTML("(File changes)","Changes to files in last day..."); + DisplayChangeLog(1); + EndHTML() ; exit; }