".GifIcon(up)." Back to front page.
"; + print "".GifIcon("up")." Back to front page.
"; } ////////////////////////////////////////////////////////////////// @@ -1393,11 +1405,9 @@ } // helper function -function unroll_perm($u,$t,$user,$perm) { +function unroll_perm($u,$t,$perm,$one_level) { - // check user FIX - if ($t & trmask_not && ($u==$user)) continue; - if (!($t & trmask_not) && ($u!=$user)) continue; + if ($t & trmask_one_level && !$one_level) return $perm; if ($t & trmask_deny) { if ($t & trmask_clear) { @@ -1429,31 +1439,35 @@ $tmppath.=array_shift($path_arr); $debug.= ">> $tmppath "; - # clear one level flag - $perm['allow'] &= ~trmask_one_level; - $perm['deny'] &= ~trmask_one_level; - if (! isset($trustees[$tmppath])) continue; $tr = $trustees[$tmppath]; + $one_level = (!count($path_arr)); +$debug.=" O($one_level) "; + if (isset($tr)) { // first apply trustee for all if (isset($tr['*'])) { - $perm = unroll_perm($user,$tr['*'],$user, $perm); + $perm = unroll_perm($user,$tr['*'],$perm, $one_level); unset($tr['*']); } - // then apply group policies + // then apply not and group policies foreach ($tr as $g=>$t) { - if ($t & trmask_group && in_group($user,$g)) { + if ($t & trmask_not && $g != $user) { + $t = $t & ~trmask_not; + $perm = unroll_perm($user,$t,$perm, $one_level); + unset($tr[$g]); + + } elseif ($t & trmask_group && in_group($user,$g)) { // resolv user $t = $t & ~trmask_group; - $perm = unroll_perm($user,$t,$user, $perm); + $perm = unroll_perm($user,$t,$perm, $one_level); unset($tr[$g]); } } // then apply user policy if (isset($tr[$user])) { - $perm = unroll_perm($user,$tr[$user],$user, $perm); + $perm = unroll_perm($user,$tr[$user],$perm,$one_level); unset($tr[$user]); } } @@ -1528,18 +1542,26 @@ // [replacement for register_globals in php.ini] function HTTP_GET_VAR($var) { - global $HTTP_GET_VARS, $GLOBALS; + global $HTTP_GET_VARS, ${$var}; if (isset($HTTP_GET_VARS[$var])) { - $GLOBALS[$var] = stripSlashes($HTTP_GET_VARS[$var]); - return $GLOBALS[$var]; + $$var = stripSlashes($HTTP_GET_VARS[$var]); + return $$var; } } function HTTP_POST_VAR($var) { - global $HTTP_GET_VARS, $GLOBALS; - if (isset($HTTP_GET_VARS[$var])) { - $GLOBALS[$var] = stripSlashes($HTTP_GET_VARS[$var]); - return $GLOBALS[$var]; + global $HTTP_POST_VARS, ${$var}; + if (isset($HTTP_POST_VARS[$var])) { + $$var = $HTTP_POST_VARS[$var]; + return $$var; + } +} + +function HTTP_SERVER_VAR($var) { + global $HTTP_SERVER_VARS, ${$var}; + if (isset($HTTP_SERVER_VARS[$var])) { + $$var = $HTTP_SERVER_VARS[$var]; + return $$var; } } @@ -1650,19 +1672,22 @@ // read mime.types readMime(); +HTTP_POST_VAR("FN"); + if ($HTTP_SERVER_VARS["REQUEST_METHOD"] == "POST") { // take variables from server - if (HTTP_POST_VAR("FN")) check_filename($FN); + if (HTTP_POST_VAR("FN")) + check_filename($FN); if (HTTP_POST_VAR("DIR")) { check_dirname($DIR); $relDir = $DIR; } else { trigger_error("Can't get DIR",E_USER_WARNING); + $relDir = "/"; } if (HTTP_POST_VAR("RELPATH")) check_dirname($RELPATH); HTTP_POST_VAR("T"); HTTP_POST_VAR("CONFIRM"); - } else { // get HTTP_GET_VAR("A"); @@ -1707,8 +1732,7 @@ Error("You must select file with browse to upload it!"); } - $FILENAME = $HTTP_POST_VARS["FILENAME"]; - check_filename($FILENAME); + if (HTTP_POST_VAR("FILENAME")) check_filename($FILENAME); if (! isset($FILENAME)) { // from update file $target = "$fsDir/".basename($FN); @@ -1721,11 +1745,11 @@ if (! file_exists($dir."/.bak")) { mkdir($dir."/.bak",0700); } - if (! file_exists($dir."/.bak/$GLOBALS[gblNumBackups]")) { - mkdir($dir."/.bak/$GLOBALS[gblNumBackups]",0700); + if (! file_exists($dir."/.bak/$gblNumBackups")) { + mkdir($dir."/.bak/$gblNumBackups",0700); } $file=basename($target); - for($i=$GLOBALS[gblNumBackups]-1;$i>0;$i--) { + for($i=$gblNumBackups-1;$i>0;$i--) { MoveTo("$dir/.bak/$i/$file","$dir/.bak/".($i+1)."/"); } MoveTo($target,$dir."/.bak/1/"); @@ -1751,7 +1775,7 @@ if (!($writable || (!$exists && $legaldir))) Error("Write denied",$RELPATH) ; $fh = fopen($path, "w") ; - $FILEDATA=stripSlashes($FILEDATA); + HTTP_POST_VAR("FILEDATA"); fwrite($fh,$FILEDATA) ; fclose($fh) ; clearstatcache() ; @@ -1760,7 +1784,11 @@ case "CREATE" : // we know $fsDir exists - if ($FN == "") break; // no filename! + if (! check_perm($relDir, trperm_w)) + Error("Write access denied","You don't have permission to write in $relDir"); + if ($T == "D") $type = "directory"; + else $type ="file"; + if ($FN == "") Error("Can't create $type","You must enter name of $type to create it."); if (!is_writeable($fsDir)) Error("Write denied",$relDir) ; $path = $fsDir . "/" . $FN ; // file or dir to create $relPath = $relDir . "/" . $FN ; @@ -1786,7 +1814,7 @@ } else { Error("Creation of file $relPath failed -- $path"); } - $tstr = "$PHP_SELF?A=E&D=".urlencode($relDir)."&F=".urlencode($FN) ; + $tstr = $HTTP_SERVER_VARS["PHP_SELF"]."?A=E&D=".urlencode($relDir)."&F=".urlencode($FN) ; header("Location: " . $tstr) ; exit ; } @@ -1865,8 +1893,8 @@ // common to all POSTs : redirect to directory view ($relDir) if (isset($POSTACTION)) { - $tstr = $PHP_SELF . "?D=" . urlencode($relDir) ; - header("Location: " . $tstr) ; + $tstr = $HTTP_SERVER_VARS["PHP_SELF"]."?D=".urlencode($relDir); + header("Location: ".$tstr) ; exit ; }