--- docman.php 2002/07/29 12:04:43 1.27
+++ docman.php 2002/09/06 17:34:06 1.33
@@ -157,6 +157,7 @@
global $gblEditable, $gblImages,
$gblDateFmt, $gblTimeFmt,
+ $gblPermNote,
$webRoot, $html,
$HTTP_SERVER_VARS ;
$self = $HTTP_SERVER_VARS["PHP_SELF"] ;
@@ -208,52 +209,27 @@
$fstr = fread($fh,filesize($fsPath)) ;
fclose($fh) ;
$fstr = htmlentities( $fstr ) ;
-?>
-
-
-" ;
// echo htmlentities($tstr) . "
" . $tstr ;
echo $tstr ;
}
-?>
-
+ }
+
+ if (check_perm($relDir.$fn,$gblPermNote)) {
+ include("$html/DetailPage-note.html");
+ }
-";
$name=basename("$fsDir/$fn");
$logname=dirname("$fsDir/$fn")."/.log/$name";
@@ -481,18 +436,10 @@
//////////////////////////////////////////////////////////////////
-function GifIcon($txt) {
- global $gblIconLocation ;
+function GifIcon($txt = "") {
+ global $gblIconLocation, $gblImages ;
switch (strtolower($txt)) {
- case ".bmp" :
- case ".gif" :
- case ".jpg" :
- case ".jpeg":
- case ".tif" :
- case ".tiff":
- $d = "image2.gif" ;
- break ;
case ".doc" :
$d = "layout.gif" ;
break ;
@@ -570,9 +517,14 @@
$d = "quill.gif";
break;
default :
- $d = "generic.gif" ;
+ if (in_array(strtolower($txt),$gblImages)) {
+ $d = "image2.gif" ;
+ } else {
+ $d = "generic.gif" ;
+ }
}
+
return "" ;
} // end function GifIcon
@@ -583,6 +535,7 @@
global $gblEditable, $gblIcon, $gblModDays, $webRoot, $gblHide,
$gblIgnoreUnknownFileType, $gblRepositoryDir,
$gblLogin, $gblUserName, $gblDateFmt, $gblTimeFmt,
+ $gblPermNote,
$fsRealmDir, $realm, $realm_sep,
$html, $realm_config,
$HTTP_GET_VARS, $HTTP_SERVER_VARS;
@@ -657,8 +610,7 @@
$text .= "
Examine list of files changed in last day or all changes.";
StartHTML("(Navigate)",$text) ;
- echo "" ;
+ print "" ;
// updir (parent) bar
if (chopsl($fsDir) != chopsl($fsRoot)) {
@@ -676,7 +628,8 @@
return $out;
}
- if (! HTTP_GET_VAR("dsort")) $dsort = "name"; // default directory sort
+ $dsort = HTTP_GET_VAR("dsort");
+ if (! isset($dsort)) $dsort = "name"; // default directory sort
$dsort_arr = array(
"name" => array ("rname", "note"),
@@ -685,7 +638,8 @@
"rnote" => array ("name", "note")
);
- if (! HTTP_GET_VAR("fsort")) $fsort = "name"; // default directory sort
+ $fsort = HTTP_GET_VAR("fsort");
+ if (! isset($fsort)) $fsort = "name"; // default directory sort
$fsort_arr = array(
"name" => array ("rname", "note", "date", "size"),
@@ -747,6 +701,12 @@
}
$dir_url=$self."?D=".urlencode(chopsl($relDir)."/".$dir);
+ if (check_perm($relDir.$dir,$gblPermNote)) {
+ $note_html="".$gblIcon("note")."".$dirNote[$key];
+ } else {
+ $note_html=$dirNote[$key];
+ }
+
include("$html/Navigate-dirEntry.html");
} // iterate over dirs
@@ -827,7 +787,11 @@
$file_url_html .= substr($file,5,strlen($file)-5) . " deleted";
}
- $note_html="".$gblIcon("note")."".ReadNote($path);
+ if (check_perm($relDir.$file,$gblPermNote)) {
+ $note_html="".$gblIcon("note")."".$fileNote[$key];
+ } else {
+ $note_html=$fileNote[$key];
+ }
$ext = strtolower(strrchr($file,".")) ;
@@ -847,9 +811,11 @@
$file_url_html = "$file $a";
}
} else {
- $b.="" ;
- $b.=$gblIcon("checkout")."";
+ if (check_perm($relDir.$file,trperm_w)) {
+ $b.="" ;
+ $b.=$gblIcon("checkout")."";
+ }
if ( $ext=="" || strstr(join(" ",$gblEditable),$ext) ) {
$b.="
- |
- No files in this directory
- |
-
+ include("$html/Navigate-noFiles.html");
}
if ($emptyDir && $relDir != "") {
-?>
-
-
-
-
-
- |
|
-
+ include("$html/Navigate-hr.html");
-if (file_exists("$fsRealmDir/$realm".$realm_sep."info.inc")) {
- print " | ";
- include("$fsRealmDir/$realm".$realm_sep."info.inc");
- print " |
|
|
";
-} elseif (file_exists("$gblRepositoryDir/.info.inc")) {
- print " | ";
- include("$gblRepositoryDir/.info.inc");
- print " |
|
|
";
-}
+ if (file_exists("$fsRealmDir/$realm".$realm_sep."info.inc")) {
+ print " | ";
+ include("$fsRealmDir/$realm".$realm_sep."info.inc");
+ print " |
";
+ include("$html/Navigate-hr.html");
+ } elseif (file_exists("$gblRepositoryDir/.info.inc")) {
+ print " | ";
+ include("$gblRepositoryDir/.info.inc");
+ print " |
";
+ include("$html/Navigate-hr.html");
+ }
+ include("$html/Navigate-createNew.html");
-?>
-
-
-
+ print "
";
-$dir/.note/$file for writing",1);
+ }
fputs($note,"$msg\n");
fclose($note);
@@ -1701,7 +1640,11 @@
// read mime.types
readMime();
-HTTP_POST_VAR("FN");
+ if (! isset($gblPermNote)) {
+ $gblPermNote = trperm_r;
+ }
+
+ HTTP_POST_VAR("FN");
if ($HTTP_SERVER_VARS["REQUEST_METHOD"] == "POST") {
// take variables from server
@@ -1758,7 +1701,7 @@
$source = $FN_name ;
if (! file_exists($source)) {
- Error("You must select file with browse to upload it!");
+ Error("You must select file with browse to upload it!","If file is too big, you might need to modify php configuration options post_max_size and upload_max_filesize",1);
}
if (HTTP_POST_VAR("FILENAME")) check_filename($FILENAME);
@@ -1769,6 +1712,9 @@
$target = "$fsDir/$FILENAME";
}
+ if (! check_perm("$relDir/".basename($target), trperm_w))
+ Error("Access denied","User $gblLogin tried to upload $relDir/".basename($target)." without valid trustee.",1);
+
// backup old files first
$dir=dirname($target);
if (! file_exists($dir."/.bak")) {
@@ -1797,10 +1743,14 @@
case "SAVE" :
$path = $gblFsRoot . $RELPATH ;
$path=stripSlashes($path);
+
+ if (! check_perm("$RELPATH", trperm_w))
+ Error("Access denied","User $gblLogin tried to save $RELPATH without valid trustee.",1);
+
$writable = is_writeable($path) ;
$legaldir = is_writeable(dirname($path)) ;
$exists = (file_exists($path)) ? 1 : 0 ;
-// check for legal extension here as well
+ // FIX: more verbose error message
if (!($writable || (!$exists && $legaldir)))
Error("Write denied",$RELPATH) ;
$fh = fopen($path, "w") ;
@@ -1895,6 +1845,9 @@
if (substr($FN,0,4) != ".del") break ;
$file=substr($FN,4,strlen($FN)-4);
+ if (! check_perm("$relDir/$file", trperm_w))
+ Error("Access denied","User $gblLogin tried to undelete $relDir/$file without valid trustee.",1);
+
LogIt("$fsDir/.del/$file","undeleted",trperm_w);
MoveTo("$fsDir/.del/$file","$fsDir/");
MoveTo("$fsDir/.del/.log/$file","$fsDir/.log/");
@@ -1918,13 +1871,19 @@
safe_rename($fsDir,$FN,$NEWNAME);
break ;
- case "NOTE" :
- $NOTE=stripSlashes($HTTP_POST_VARS["NOTE"]);
- WriteNote("$fsDir/$FN","$NOTE");
+ case "NOTE" :
+ if (! HTTP_POST_VAR("NOTE"))
+ Error("Can't add note to object","Can't find var \$NOTE",1);
+ if (! check_perm("$relDir/$FN", trperm_w))
+ Error("Access denied","User $gblLogin tried to add note to $relDir/$FN without valid trustee.",1);
+
+ WriteNote("$fsDir/$FN",$NOTE);
break ;
case "UNLOCK" :
if ( $CONFIRM != "on" ) break ;
+ if (! check_perm("$relDir/$FN", trperm_w))
+ Error("Access denied","User $gblLogin tried to unlock $relDir/$FN without valid trustee.",1);
Unlock("$fsDir/$FN");
break ;
@@ -1938,7 +1897,7 @@
header("Location: ".$tstr) ;
exit ;
}
-
+
// check for mode.. navigate, code display, upload, or detail?
// $A=U : upload to path given in $D
// $A=E : display detail of file $D/$F and edit