/[docman2]/docman.php
This is repository of my old source code which isn't updated any more. Go to git.rot13.org for current projects!
ViewVC logotype

Diff of /docman.php

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.12 by dpavlin, Sat Jul 27 22:26:30 2002 UTC revision 1.13 by dpavlin, Sun Jul 28 11:39:59 2002 UTC
# Line 145  function EndHTML() { Line 145  function EndHTML() {
145                  $url_title="relogin";                  $url_title="relogin";
146          }          }
147          include("$html/footer.html");          include("$html/footer.html");
148    
149            global $debug;
150            if ($debug) print $debug;
151  } // end function EndHTML  } // end function EndHTML
152    
153  //////////////////////////////////////////////////////////////////  //////////////////////////////////////////////////////////////////
# Line 160  function DetailPage($fsRoot,$relDir,$fn) Line 163  function DetailPage($fsRoot,$relDir,$fn)
163    
164          $exists   = file_exists($fsPath) ;          $exists   = file_exists($fsPath) ;
165          $ext      = strtolower(strrchr($relPath,".")) ;          $ext      = strtolower(strrchr($relPath,".")) ;
166          $editable = ( $ext=="" || strstr(join(" ",$gblEditable),$ext)) ;          $editable = ( $ext=="" || strstr(join(" ",$gblEditable),$ext)) &&
167          $writable = is_writeable($fsPath) ;                  check_perm($relPath,trperm_w);
168            $writable = is_writeable($fsPath) && check_perm($relPath,trperm_w) ;
169            $writable_dir = is_writeable($fsDir) && check_perm($relDir,trperm_w) ;
170          $file_lock = CheckLock($fsPath);          $file_lock = CheckLock($fsPath);
171    
172          if (!$editable && !$exists)          if (!$editable && !$exists)
173                  Error("Creation unsupported for type",$relPath) ;                  Error("Creation denied","Can't create <tt>$relPath</tt>") ;
174          if (!exists && !is_writeable($fsDir) )          if (!$exists && !$writable_dir )
175                  Error("Creation denied",$relDir) ;                  Error("Creation denied","Can't write in directory <tt>$relDir</tt> while creating <tt>$relPath</tt>for which user has permissions.",1);
176    
177          $text  = _("Use this page to view, modify or ") ;          $text  = _("Use this page to view, modify or ") ;
178          if (is_dir($fsPath)) {          if (is_dir($fsPath)) {
# Line 200  function DetailPage($fsRoot,$relDir,$fn) Line 205  function DetailPage($fsRoot,$relDir,$fn)
205                  $fstr = htmlentities( $fstr ) ;                  $fstr = htmlentities( $fstr ) ;
206  ?>  ?>
207    
208  <FORM ACTION="<?= $self ; ?>" METHOD="POST">  <FORM ACTION="<?= $self ?>" METHOD="POST">
209  <SPAN TITLE="Click [SAVE] to store updated contents.">  <SPAN TITLE="Click [SAVE] to store updated contents.">
210          <B>DOCUMENT CONTENTS</B>          <B>DOCUMENT CONTENTS</B>
211  </SPAN><BR>  </SPAN><BR>
# Line 574  function Navigate($fsRoot,$relDir) { Line 579  function Navigate($fsRoot,$relDir) {
579                  $gblIgnoreUnknownFileType, $gblRepositoryDir,                  $gblIgnoreUnknownFileType, $gblRepositoryDir,
580                  $fsRealmDir, $realm, $realm_sep,                  $fsRealmDir, $realm, $realm_sep,
581                  $HTTP_GET_VARS, $html, $realm_config;                  $HTTP_GET_VARS, $html, $realm_config;
582            
583          $self     = $HTTP_SERVER_VARS["PHP_SELF"] ;          $self     = $HTTP_SERVER_VARS["PHP_SELF"] ;
584    
585          if ($relDir == "") $relDir = "/";          if ($relDir == "") $relDir = "/";
586    
587          $fsDir = $fsRoot.$relDir."/";   // current directory          $fsDir = $fsRoot.$relDir."/";   // current directory
588    
589          if (!is_dir($fsDir)) Error("Dir not found",$relDir) ;          if (!is_dir($fsDir)) Error("Dir not found",$relDir,1) ;
590    
591          $hide_items=",$gblHide,";          $hide_items=",$gblHide,";
592    
# Line 634  function Navigate($fsRoot,$relDir) { Line 639  function Navigate($fsRoot,$relDir) {
639          echo "<TABLE BORDER=0 CELLPADDING=2          echo "<TABLE BORDER=0 CELLPADDING=2
640                  CELLSPACING=3 WIDTH=\"100%\">" ;                  CELLSPACING=3 WIDTH=\"100%\">" ;
641    
642          // updir bar              // updir (parent) bar  
643          if (chopsl($fsDir) != chopsl($fsRoot)) {          if (chopsl($fsDir) != chopsl($fsRoot)) {
644                  $parent = dirname($relDir) ;                  $parent = dirname($relDir) ;
645                  if ($parent == "") $parent = "/" ;                  if ($parent == "") $parent = "/" ;
# Line 714  function Navigate($fsRoot,$relDir) { Line 719  function Navigate($fsRoot,$relDir) {
719                          $dir = $dirList[$key];                          $dir = $dirList[$key];
720    
721                          $info_url=self_args(array("A"=>"A=E", "F"=>"F=".urlencode($dir), "D"=>$D));                          $info_url=self_args(array("A"=>"A=E", "F"=>"F=".urlencode($dir), "D"=>$D));
722                          $dir_url=$self."?D=".urlencode($relDir."/".$dir);                          $dir_url=$self."?D=".urlencode(chopsl($relDir)."/".$dir);
723                          include("$html/Navigate-dirEntry.html");                          include("$html/Navigate-dirEntry.html");
724    
725                  }  // iterate over dirs                  }  // iterate over dirs
# Line 1212  function Download($path,$force=0) { Line 1217  function Download($path,$force=0) {
1217  //////////////////////////////////////////////////////////////////  //////////////////////////////////////////////////////////////////
1218    
1219  function chopsl($path) {  function chopsl($path) {
         if (substr($path,strlen($path)-1,1) == "/") $path=substr($path,0,strlen($path)-1);  
1220          $path=str_replace("//","/",$path);          $path=str_replace("//","/",$path);
1221            if (substr($path,strlen($path)-1,1) == "/") $path=substr($path,0,strlen($path)-1);
1222          return $path;          return $path;
1223  }  }
1224    
# Line 1438  function check_trustee($user,$path) { Line 1443  function check_trustee($user,$path) {
1443    
1444  function check_perm($path,$trperm) {  function check_perm($path,$trperm) {
1445          global $gblLogin,$HAVE_TRUSTEE;          global $gblLogin,$HAVE_TRUSTEE;
1446  print "<br>check_perm: <tt>$path</tt> test perm ".display_trustee($perm)."<br>\n";  
1447            global $debug;
1448    $debug.="<br>check_perm: <tt>$path</tt> test perm ".display_trustee($perm)."<br>\n";
1449          $return = ! $HAVE_TRUSTEE;          $return = ! $HAVE_TRUSTEE;
1450          if ($HAVE_TRUSTEE) {          if ($HAVE_TRUSTEE) {
1451                  $perm = check_trustee($gblLogin,$path);                  $perm = check_trustee($gblLogin,$path);
1452  print " d: $perm[deny] (".display_trustee($perm[deny]).") a: $perm[allow] (".display_trustee($perm[allow]).") perm: $trperm";  $debug.=" d: $perm[deny] (".display_trustee($perm[deny]).") a: $perm[allow] (".display_trustee($perm[allow]).") perm: $trperm";
1453                  if ($perm[deny] & $trperm) $return=0;                  if ($perm[deny] & $trperm) $return=0;
1454                  elseif ($perm[allow] & $trperm) $return=1;                  elseif ($perm[allow] & $trperm) $return=1;
1455          }          }
1456  print " return: $return<br>\n";  $debug.=" return: $return<br>\n";
1457          return($return);          return($return);
1458  }  }
1459    
# Line 1476  function readMime() { Line 1483  function readMime() {
1483  }  }
1484    
1485  //////////////////////////////////////////////////////////////////  //////////////////////////////////////////////////////////////////
1486    
1487    // check for invalid characters in filename and dirname (.. and /)
1488    
1489    function check_dirname($file) {
1490            if (strstr($file,"..")) Error("Security violation","No parent dir <tt>..</tt> allowed in directory name <tt>$file</tt>",1);
1491    }
1492    
1493    function check_filename($file) {
1494            if (strstr($file,"..")) Error("Security violation","No parent dir <tt>..</tt> allowed in file name <tt>$file</tt>",1);
1495            if (strstr($file,"/")) Error("Security violation","No slashes <tt>/</tt> allowed in file name <tt>$file</tt>",1);
1496    }
1497    
1498    //////////////////////////////////////////////////////////////////
1499  // MAIN PROGRAM  // MAIN PROGRAM
1500    
1501          $gblFilePerms = 0640 ;         // default for new files          $gblFilePerms = 0640 ;         // default for new files
# Line 1569  function readMime() { Line 1589  function readMime() {
1589                  Error("401 Unauthorized","No trespassing !",0,1);                  Error("401 Unauthorized","No trespassing !",0,1);
1590          }          }
1591    
1592    
1593          // read mime.types          // read mime.types
1594          readMime();          readMime();
1595    
1596          // get current directory relative to $gblFsRoot          if ($HTTP_SERVER_VARS["REQUEST_METHOD"] == "POST") {
1597          $relDir = $DIR ;        // from POST                  // take variables from server
1598          if ($relDir == "") {    // not defined in POST ?                  $FN=stripSlashes($HTTP_POST_VARS["FN"]);
1599                  $relDir = urldecode($D) ;  // then use GET                  $DIR=stripSlashes($HTTP_POST_VARS["DIR"]);
1600          }                        $RELPATH=stripSlashes($HTTP_POST_VARS["RELPATH"]);
1601                    $T=stripSlashes($HTTP_POST_VARS["T"]);
1602                    $CONFIRM=stripSlashes($HTTP_POST_VARS["CONFIRM"]);
1603    
1604                    check_filename($FN);
1605                    check_dirname($DIR);
1606                    check_dirname($RELPATH);
1607    
1608          $relDir=stripSlashes($relDir);                  $relDir = $DIR;
1609            } else {
1610                    // get
1611                    $A=stripSlashes($HTTP_GET_VARS["A"]);
1612                    $D=stripSlashes(urldecode($HTTP_GET_VARS["D"]));
1613                    $F=stripSlashes($HTTP_GET_VARS["F"]);
1614    
1615          if ($relDir == "/") $relDir = "" ;                        check_filename($F);
1616          // default : website root = ""                  check_dirname($D);
1617    
1618          if (strstr($relDir,"..")) Error("No updirs allowed");                  $relDir = $D;
1619            }
1620    
1621          // full paths contain "fs" or "Fs". Paths realitve to root of          if ($relDir == "/") $relDir = "" ;      
         // website contain "rel" or "Rel". The script won't let you  
         // edit anything above directory equal to http://server.com  
         // i.e. below $gblFsRoot.  
1622    
1623          $relScriptDir = dirname($SCRIPT_NAME) ;                  $relScriptDir = dirname($SCRIPT_NAME) ;        
1624          // i.e. /docman          // i.e. /docman
1625    
1626          // start on server root          // start on server root
1627          $gblFsRoot = $gblRepositoryDir;          $gblFsRoot = $gblRepositoryDir;
1628          // i.e. /home/httpd/html          // i.e. /home/httpd/repository
1629    
1630          $fsDir = $gblFsRoot . $relDir ; // current directory          $fsDir = $gblFsRoot . $relDir ; // current directory
1631          if ( !is_dir($fsDir) ) Error("Dir not found",$relDir) ;          if ( !is_dir($fsDir) ) Error("Dir not found",$relDir,1) ;
1632    
1633          if (isset($HTTP_SERVER_VARS["HTTPS"]) && $HTTP_SERVER_VARS["HTTPS"] == "on") {          if (isset($HTTP_SERVER_VARS["HTTPS"]) && $HTTP_SERVER_VARS["HTTPS"] == "on") {
1634                  $webRoot  = "https://";                  $webRoot  = "https://";
# Line 1607  function readMime() { Line 1637  function readMime() {
1637          }          }
1638          $webRoot .= $HTTP_SERVER_VARS["HTTP_HOST"] . $relScriptDir;          $webRoot .= $HTTP_SERVER_VARS["HTTP_HOST"] . $relScriptDir;
1639    
         // take variables from server  
         $FN=stripSlashes($HTTP_POST_VARS["FN"]);  
         $DIR=stripSlashes($HTTP_POST_VARS["DIR"]);  
         $RELPATH=stripSlashes($HTTP_POST_VARS["RELPATH"]);  
         $T=stripSlashes($HTTP_POST_VARS["T"]);  
         $CONFIRM=stripSlashes($HTTP_POST_VARS["CONFIRM"]);  
   
         // get  
         $A=stripSlashes($HTTP_GET_VARS["A"]);  
         $D=stripSlashes($HTTP_GET_VARS["D"]);  
   
 //      if (isset($F)) Error("Document manager system error","variable $F shouldn't be set here (re-check old code)",1);  
 //      $F=stripSlashes($HTTP_SERVER_VARS["PATH_INFO"]);  
         $F=stripSlashes($HTTP_GET_VARS["F"]);  
   
1640          switch ($HTTP_POST_VARS["POSTACTION"]) {          switch ($HTTP_POST_VARS["POSTACTION"]) {
1641          case "UPLOAD" :          case "UPLOAD" :
1642                  $FN_name=stripSlashes($HTTP_POST_FILES["FN"]["tmp_name"]);                  $FN_name=stripSlashes($HTTP_POST_FILES["FN"]["tmp_name"]);
# Line 1634  function readMime() { Line 1649  function readMime() {
1649                  }                  }
1650    
1651                  $FILENAME = $HTTP_POST_VARS["FILENAME"];                  $FILENAME = $HTTP_POST_VARS["FILENAME"];
1652                  if (strstr($FILENAME,"/"))                  check_filename($FILENAME);
1653                          Error("Upload error","Non-conforming filename. Filename <tt>$FILENAME</tt> has slashes (<tt>/</tt>) in it.") ;  
1654                  if (! isset($FILENAME)) {       // from update file                  if (! isset($FILENAME)) {       // from update file
1655                          $target = "$fsDir/".basename($FN);                          $target = "$fsDir/".basename($FN);
1656                  } else {                  } else {
Legend:
Removed from v.1.12  
changed lines
  Added in v.1.13
  ViewVC Help
Powered by ViewVC 1.1.26