Index: branches/5.0.x/core/install/install_toolkit.php =================================================================== diff -u -r12269 -r12277 --- branches/5.0.x/core/install/install_toolkit.php (.../install_toolkit.php) (revision 12269) +++ branches/5.0.x/core/install/install_toolkit.php (.../install_toolkit.php) (revision 12277) @@ -1,6 +1,6 @@ $name, 'Filename' => $name, 'AutomaticFilename' => 1, - $fields['description'] => $description, 'Status' => $status, 'Priority' => -9999, + $fields['description'] => $description, 'Status' => STATUS_ACTIVE, 'Priority' => -9999, ); $category_fields['ParentId'] = $this->Application->findModule('Name', 'Core', 'RootCat'); Index: branches/5.0.x/admin/system_presets/simple/images_u-img.php =================================================================== diff -u -r12265 -r12277 --- branches/5.0.x/admin/system_presets/simple/images_u-img.php (.../images_u-img.php) (revision 12265) +++ branches/5.0.x/admin/system_presets/simple/images_u-img.php (.../images_u-img.php) (revision 12277) @@ -1,7 +1,3 @@ UnitConfigReader->getPrefixFile('custom-sections') ) . '/../site_configs/'; - // include site config settings from main "img" prefix - include('images_img.php'); + include(SYSTEM_PRESET_PATH . DIRECTORY_SEPARATOR . 'images_img.php'); \ No newline at end of file Index: branches/5.0.x/core/units/pdf/pdf_styles.php =================================================================== diff -u -r12117 -r12277 --- branches/5.0.x/core/units/pdf/pdf_styles.php (.../pdf_styles.php) (revision 12117) +++ branches/5.0.x/core/units/pdf/pdf_styles.php (.../pdf_styles.php) (revision 12277) @@ -1,6 +1,6 @@ Prepare(); @@ -43,7 +43,7 @@ $this->SelectorOrder += 1000; } } - + public function ParseStyle($style) { $res = array(); @@ -54,7 +54,7 @@ $res[trim($name)] = trim($value); } } - + /* stylesheet : [ CDO | CDC | S | statement ]*; statement : ruleset | at-rule; @@ -67,10 +67,10 @@ value : [ any | block | ATKEYWORD S* ]+; any : [ IDENT | NUMBER | PERCENTAGE | DIMENSION | STRING | DELIM | URI | HASH | UNICODE-RANGE | INCLUDES - | DASHMATCH | FUNCTION S* any* ')' + | DASHMATCH | FUNCTION S* any* ')' | '(' S* any* ')' | '[' S* any* ']' ] S*; */ - + function ParseTokens($tokens, $origin=kPDFStylesheet::STYLE_ORIGIN_AUTHOR_NORMAL ) { $this->Buffer[0] = Array(); @@ -98,7 +98,7 @@ foreach ($tokens as $token) {$res .= $token['data'];} return $res; } - + public function ParseDefinitionTokens($tokens) { $mode = 'property'; @@ -133,12 +133,12 @@ if ($mode == 'colon') { trigger_error('Error parsing CSS definition, no colon and/or value after property '.$property, E_USER_WARNING); } - + $properties = $this->ProcessShortHands($properties); - + return $properties; } - + public function ProcessShortHands($properties) { $res = array(); @@ -164,7 +164,7 @@ $res['MARGIN-BOTTOM'] = $regs[3]; $res['MARGIN-LEFT'] = $regs[4]; } - + break; case 'BORDER-TOP': case 'BORDER-RIGHT': @@ -237,7 +237,7 @@ } return $res; } - + public function ParseBorderShorthand($definition) { $res = array(); @@ -255,7 +255,7 @@ } return $res; } - + public function ParseSelectorTokens($tokens, $origin) { $selectors = array(); @@ -274,9 +274,9 @@ } return $this->IdentifySelectors($selectors, $origin); } - + /* - + 'h' => '[0-9a-f]', 'nonascii' => '[\\200-\\377]', 'unicode' => '(\\{h}{1,6}(\r\n|[ \t\r\n\f])?)', @@ -287,7 +287,7 @@ 'string2' => '(\'([^\n\r\f\']|{nl}|{escape})*\')', 'invalid1' => '("([^\n\r\f"]|{nl}|{escape})*?)', 'invalid2' => '(\'([^\n\r\f\']|{nl}|{escape})*?)', - + 'ident' => '-?{nmstart}{nmchar}*', 'name' => '{nmchar}+', 'num' => '([0-9]+|[0-9]*\.[0-9]+)', @@ -297,38 +297,38 @@ 's' => '[ \t\r\n\f]', 'w' => '{s}*', 'nl' => '(\n|\r\n|\r|\f)', - + */ - + /* - + A simple selector is either a type selector or universal selector followed immediately by zero or more attribute selectors, ID selectors, or pseudo-classes, in any order. The simple selector matches if all of its components match. - - A selector is a chain of one or more simple selectors separated by combinators. Combinators are: whitespace, ">", and "+". + + A selector is a chain of one or more simple selectors separated by combinators. Combinators are: whitespace, ">", and "+". Whitespace may appear between a combinator and the simple selectors around it. - + A selector's specificity is calculated as follows: - * count 1 if the selector is a 'style' attribute rather than a selector, 0 otherwise (= a) + * count 1 if the selector is a 'style' attribute rather than a selector, 0 otherwise (= a) (In HTML, values of an element's "style" attribute are style sheet rules. These rules have no selectors, so a=1, b=0, c=0, and d=0.) * count the number of ID attributes in the selector (= b) * count the number of other attributes and pseudo-classes in the selector (= c) - * count the number of element names and pseudo-elements in the selector (= d) + * count the number of element names and pseudo-elements in the selector (= d) - The specificity is based only on the form of the selector. - In particular, a selector of the form "[id=p33]" is counted as an attribute selector (a=0, b=0, c=1, d=0), + The specificity is based only on the form of the selector. + In particular, a selector of the form "[id=p33]" is counted as an attribute selector (a=0, b=0, c=1, d=0), even if the id attribute is defined as an "ID" in the source document's DTD. - Concatenating the four numbers a-b-c-d (in a number system with a large base) gives the specificity. - + Concatenating the four numbers a-b-c-d (in a number system with a large base) gives the specificity. + */ - + function IdentifySelectors($selectors, $origin) { $processed = array(); $ident = $this->Macros['ident']; - + foreach ($selectors as $selector) { $parts = preg_split('/[ ]*([ >+])[ ]*/', $selector, null, PREG_SPLIT_DELIM_CAPTURE | PREG_SPLIT_NO_EMPTY); $parsed_selector = array(); @@ -407,7 +407,7 @@ $main = array(); $cur =& $main; - + foreach ($parsed_selector as $parts) { if (isset($parts['combinator'])) { switch ($parts['combinator']) { @@ -447,7 +447,7 @@ } return $processed; } - + public function AppendRule($selector_tokens, $definition_tokens, $origin) { $selectors = $this->ParseSelectorTokens($selector_tokens, $origin); @@ -456,15 +456,15 @@ foreach ($properties as $property => $value) { $definition .= "$property: $value
"; } - + foreach ($selectors as $selector) { $this->Mapping[strtoupper($selector['main'])][] = array('selector' => $selector, 'properties' => $properties); } - + $this->Rules[] = array('selectors' => $selectors, 'properties' => $properties); // echo "appending rule:
selector: ".join(',', $selectors)."
definition:
$definition

"; } - + public function GetTokens($css) { $patterns = array( @@ -474,26 +474,26 @@ '-->' =>'CDC', '~=' =>'INCLUDES', '\\|=' =>'DASHMATCH', - + '{w}\\{' =>'LBRACE', '{w}\\+' =>'PLUS', '{w}\\>' =>'GREATER', '{w},' =>'COMMA', - + '{string}' =>'STRING', '{invalid}' =>'INVALID', /* unclosed string */ - + '{ident}' =>'IDENT', - + '#{name}' =>'HASH', - + '@import' =>'IMPORT_SYM', '@page' =>'PAGE_SYM', '@media' =>'MEDIA_SYM', '@charset' =>'CHARSET_SYM', - + '!{w}important' =>'IMPORTANT_SYM', - + /*'{num}{E}{M}' =>'EMS', '{num}{E}{X}' =>'EXS', '{num}{P}{X}' =>'LENGTH', @@ -510,7 +510,7 @@ '{num}{H}{Z}' =>'FREQ', '{num}{K}{H}{Z}' =>'FREQ', '{num}{ident}' =>'DIMENSION',*/ - + '{num}em' =>'EMS', '{num}ex' =>'EXS', '{num}px' =>'LENGTH', @@ -527,30 +527,30 @@ '{num}hz' =>'FREQ', '{num}khz' =>'FREQ', '{num}{ident}' =>'DIMENSION', - + '{num}%' =>'PERCENTAGE', '{num}' =>'NUMBER', - + 'url\({w}{string}{w}\)' =>'URI', 'url\({w}{url}{w}\)' =>'URI', '{ident}\(' =>'FUNCTION', - + /*'.' =>'*yytext',*/ ); - + $final_patterns = array(); foreach ($patterns as $regexp => $token) { foreach ($this->Macros as $macro => $replacement) { $regexp = str_replace('{'.$macro.'}', $replacement, $regexp); } $final_patterns[$regexp] = $token; } - + $css = preg_replace('/\\/\\*[^*]*\\*+([^\\/*][^*]*\\*+)*\\//', '', $css); $css = preg_replace('/[ \t\r\n\f]+\\/\\*[^*]*\\*+([^\\/*][^*]*\\*+)*\\//', ' ', $css); - + $css = preg_replace('/[ \t\r\n\f]+/', ' ', $css); // remove repeated whitespace - + $matches = array(); $token_indexes = array(); foreach ($final_patterns as $regexp => $token) { @@ -559,7 +559,7 @@ $token_indexes[$token] = 0; } } - + $tokens = array(); $last_token_pos = 0; $i = 0; @@ -575,9 +575,9 @@ } while ($cur_match && $cur_match[1] < $last_token_pos); if ( !$cur_match ) continue; $token_indexes[$token] = $cur_index-1; - if ( $min_pos === false || - ($cur_match[1] < $min_pos - || + if ( $min_pos === false || + ($cur_match[1] < $min_pos + || ( $cur_match[1] == $min_pos && strlen( $cur_match[0] ) > $max_len ) ) ) { @@ -590,7 +590,7 @@ if ($min_pos !== false) { $token_data = $matches[$longest][$token_indexes[$longest]]; if ($token_data[1] > $last_token_pos) { - $text_data = substr($css, $last_token_pos, $token_data[1] - $last_token_pos); + $text_data = substr($css, $last_token_pos, $token_data[1] - $last_token_pos); $tokens[] = array('name' => 'TEXT', 'data' => $text_data); // echo "found token TEXT: [$text_data]
\n"; } @@ -606,10 +606,10 @@ $tokens[] = array('name' => 'TEXT', 'data' => $text_data); // echo "found token FINAL TEXT: [$text_data]
\n"; } - + return $tokens; } - + public function Prepare() { /*$macros = array( @@ -623,7 +623,7 @@ 'string2' => '(\'([^\n\r\f\']|{nl}|{escape})*\')', 'invalid1' => '("([^\n\r\f"]|{nl}|{escape})*?)', 'invalid2' => '(\'([^\n\r\f\']|{nl}|{escape})*?)', - + 'ident' => '-?{nmstart}{nmchar}*', 'name' => '{nmchar}+', 'num' => '([0-9]+|[0-9]*\.[0-9]+)', @@ -633,7 +633,7 @@ 's' => '[ \t\r\n\f]', 'w' => '{s}*', 'nl' => '(\n|\r\n|\r|\f)', - + 'A' => 'a|\\0{0,4}(41|61)(\r\n|[ \t\r\n\f])?', 'C' => 'c|\\0{0,4}(43|63)(\r\n|[ \t\r\n\f])?', 'D' => 'd|\\0{0,4}(44|64)(\r\n|[ \t\r\n\f])?', @@ -651,7 +651,7 @@ 'X' => 'x|\\0{0,4}(58|78)(\r\n|[ \t\r\n\f])?|\\x', 'Z' => 'z|\\0{0,4}(5a|7a)(\r\n|[ \t\r\n\f])?|\\z', );*/ - + $simple = array( 'h' => '[0-9a-f]', 'nonascii' => '[\\200-\\377]', @@ -663,7 +663,7 @@ 'string2' => '(\'([^\n\r\f\']|{nl}|{escape})*\')', 'invalid1' => '("([^\n\r\f"]|{nl}|{escape})*?)', 'invalid2' => '(\'([^\n\r\f\']|{nl}|{escape})*?)', - + 'ident' => '-?{nmstart}{nmchar}*', 'name' => '{nmchar}+', 'num' => '([0-9]+|[0-9]*\.[0-9]+)', @@ -682,21 +682,21 @@ } $replaced_macros[$key] = $replaced; } - + $this->Macros = $replaced_macros; } - + public function GetHTMLVisualPropsSelector($node) { if (!$node->Attributes) return false; $non_visal_props = array( 'ABBR', 'ACCEPT-CHARSET', 'ACCEPT', 'ACCESSKEY', 'ACTION', 'ALT', 'ARCHIVE', 'AXIS', 'CHARSET', 'CHECKED', 'CITE', 'CLASS', 'CLASSID', 'CODE', 'CODEBASE', - 'CODETYPE', 'COLSPAN', 'COORDS', 'DATA', 'DATETIME', 'DECLARE', 'DEFER', 'DIR', 'DISABLED', 'ENCTYPE', 'FOR', 'HEADERS', 'HREF', 'HREFLANG', 'HTTP-EQUIV', - 'ID', 'ISMAP', 'LABEL', 'LANG', 'LANGUAGE', 'LONGDESC', 'MAXLENGTH', 'MEDIA', 'METHOD', 'MULTIPLE', 'NAME', 'NOHREF', 'OBJECT', 'ONBLUR', 'ONCHANGE', + 'CODETYPE', 'COLSPAN', 'COORDS', 'DATA', 'DATETIME', 'DECLARE', 'DEFER', 'DIR', 'DISABLED', 'ENCTYPE', 'FOR', 'HEADERS', 'HREF', 'HREFLANG', 'HTTP-EQUIV', + 'ID', 'ISMAP', 'LABEL', 'LANG', 'LANGUAGE', 'LONGDESC', 'MAXLENGTH', 'MEDIA', 'METHOD', 'MULTIPLE', 'NAME', 'NOHREF', 'OBJECT', 'ONBLUR', 'ONCHANGE', 'ONCLICK', 'ONDBLCLICK', 'ONFOCUS', 'ONKEYDOWN', 'ONKEYPRESS', 'ONKEYUP', 'ONLOAD', 'ONLOAD', 'ONMOUSEDOWN', 'ONMOUSEMOVE', 'ONMOUSEOUT', 'ONMOUSEOVER', - 'ONMOUSEUP', 'ONRESET', 'ONSELECT', 'ONSUBMIT', 'ONUNLOAD', 'ONUNLOAD', 'PROFILE', 'PROMPT', 'READONLY', 'REL', 'REV', 'ROWSPAN', 'SCHEME', 'SCOPE', - 'SELECTED', 'SHAPE', 'SPAN', 'SRC', 'STANDBY', 'START', 'STYLE', 'SUMMARY', 'TITLE', 'USEMAP', + 'ONMOUSEUP', 'ONRESET', 'ONSELECT', 'ONSUBMIT', 'ONUNLOAD', 'ONUNLOAD', 'PROFILE', 'PROMPT', 'READONLY', 'REL', 'REV', 'ROWSPAN', 'SCHEME', 'SCOPE', + 'SELECTED', 'SHAPE', 'SPAN', 'SRC', 'STANDBY', 'START', 'STYLE', 'SUMMARY', 'TITLE', 'USEMAP', 'VALUE', 'VALUETYPE', 'VERSION', ); if ($node->Name != 'LI' && $node->Name != 'OL' && $node->Name != 'UL') { @@ -716,7 +716,7 @@ $processed[0]['order'] = $this->HTMLVisualPropsSelectorOrder++; $processed[0]['specifity'] = 0; $this->Mapping['TD'][] = array( - 'selector' => $processed[0], + 'selector' => $processed[0], 'properties' => $this->ProcessShortHands(array( 'PADDING' => $val.'px', ))); @@ -728,22 +728,22 @@ $mapped_attributes[$key] = $val; } } - + return array( 'selector' => array('main' => $node->Name, 'specifity' => 0, 'order' => $this->HTMLVisualPropsSelectorOrder, 'origin' => kPDFStylesheet::STYLE_ORIGIN_AUTHOR_NORMAL ), 'properties' => $mapped_attributes, ); } return false; } - + public function GetMatchingSelectors($node) { $map = isset($this->Mapping[$node->Name]) ? $this->Mapping[$node->Name] : array(); if (isset($this->Mapping['*'])) { $map = array_merge($map, $this->Mapping['*']); } - + $matching = array(); $i = 0; foreach ($map as $selector) { @@ -752,25 +752,25 @@ $matching[] = $selector; } } - + $html_visual_selector = $this->GetHTMLVisualPropsSelector($node); if ($html_visual_selector) { $matching[] = $html_visual_selector; } - + usort($matching, array($this, 'CmpSelectors')); - + if (isset($node->Attributes['STYLE'])) { $style_selector = array( 'selector' => array('main' => '_STYLE_'), 'properties' => $this->ParseDefinitionTokens ( $this->GetTokens( $node->Attributes['STYLE'] ) ), ); $matching[] = $style_selector; } - + return $matching; } - + public function CmpSelectors($a, $b) { if ($a['selector']['origin'] == $b['selector']['origin']) { @@ -781,13 +781,13 @@ } return $a['selector']['origin'] < $b['selector']['origin'] ? -1 : 1; } - + public function SelectorMatches($selector_data, $node) { if ($selector_data['main'] != '*' && $node->Name != $selector_data['main']) { return false; } - + //check classes if (isset($selector_data['classes'])) { foreach ($selector_data['classes'] as $class) { @@ -797,14 +797,14 @@ } } } - + //check ids if (isset($selector_data['ids'])) { if (!isset($node->Attributes['ID']) || !in_array($node->Attributes['ID'], $selector_data['ids'])) { return false;; } } - + //check atts if (isset($selector_data['atts'])) { if (isset($selector_data['atts']['set'])) { @@ -825,42 +825,42 @@ foreach ($selector_data['atts']['space'] as $att => $value) { if (!isset($node->Attributes[$att]) || !preg_match('/(\A| )+'.preg_quote($value).'( |\Z)+/i', $node->Attributes[$att])) { return false;; - } + } } } if (isset($selector_data['atts']['hypen'])) { foreach ($selector_data['atts']['hypen'] as $att => $value) { if (!isset($node->Attributes[$att]) || !preg_match('/^'.preg_quote($value).'(-|\Z)+/i', $node->Attributes[$att])) { return false;; - } + } } } } - + //check pseudo if (isset($selector_data['pseudo_elements'])) { // we are not a browser - so don't know how to handle this.... return false; } - + if (isset($selector_data['pseudo_classes'])) { // we are not a browser - so don't know how to handle this.... return false; } - + //check comibantors if (isset($selector_data['child_of'])) { if (!$this->SelectorMatches($selector_data['child_of'], $node->Parent)) { return false; } } - + if (isset($selector_data['sibling_of'])) { if (!$this->SelectorMatches($selector_data['sibling_of'], $node->PrevSibling())) { return false; } } - + if (isset($selector_data['descendant_of'])) { $ancestor = $node; do { @@ -869,11 +869,11 @@ } while (!$matches && $ancestor->Parent); if (!$matches) return false; } - + // if we came through here, the selector matches the node return true; } - + public function GetAllProperties($node) { $selectors = $this->GetMatchingSelectors($node); Index: branches/5.0.x/core/install/incs/install.tpl =================================================================== diff -u -r12204 -r12277 --- branches/5.0.x/core/install/incs/install.tpl (.../install.tpl) (revision 12204) +++ branches/5.0.x/core/install/incs/install.tpl (.../install.tpl) (revision 12277) @@ -23,7 +23,7 @@   blocks - In-Portal Version toolkit->GetMaxModuleVersion('Core'); ?>: English US + In-Portal: English US blocks2

Index: branches/5.0.x/admin/system_presets/simple/files_l-file.php =================================================================== diff -u -r12265 -r12277 --- branches/5.0.x/admin/system_presets/simple/files_l-file.php (.../files_l-file.php) (revision 12265) +++ branches/5.0.x/admin/system_presets/simple/files_l-file.php (.../files_l-file.php) (revision 12277) @@ -1,7 +1,4 @@ UnitConfigReader->getPrefixFile('custom-sections') ) . '/../site_configs/'; - // include site config settings from main "file" prefix - include('files_file.php'); + include(SYSTEM_PRESET_PATH . DIRECTORY_SEPARATOR . 'files_file.php'); \ No newline at end of file Index: branches/5.0.x/core/units/sections/site_config_eh.php =================================================================== diff -u -r12265 -r12277 --- branches/5.0.x/core/units/sections/site_config_eh.php (.../site_config_eh.php) (revision 12265) +++ branches/5.0.x/core/units/sections/site_config_eh.php (.../site_config_eh.php) (revision 12277) @@ -1,6 +1,6 @@ Application->ConfigValue('AdminConsoleInterface'); - $base_path = FULL_PATH . ADMIN_DIRECTORY . '/system_presets/' . $preset_name; + define('SYSTEM_PRESET_PATH', FULL_PATH . ADMIN_DIRECTORY . DIRECTORY_SEPARATOR . 'system_presets' . DIRECTORY_SEPARATOR . $preset_name); } $prefix_file = basename( $this->Application->UnitConfigReader->getPrefixFile($event->MasterEvent->Prefix) ); $cut_pos = strrpos($prefix_file, '_config.php'); $prefix_file = substr($prefix_file, 0, $cut_pos) . '_' . $event->MasterEvent->Prefix . '.php'; - if (file_exists($base_path . '/' . $prefix_file)) { + if (file_exists(SYSTEM_PRESET_PATH . DIRECTORY_SEPARATOR . $prefix_file)) { /*if ($this->Application->isDebugMode()) { $this->Application->Debugger->appendHTML('Using site config: ' . $prefix_file); }*/ - require $base_path . '/' . $prefix_file; + require SYSTEM_PRESET_PATH . DIRECTORY_SEPARATOR . $prefix_file; } else { /*if ($this->Application->isDebugMode()) { Index: branches/5.0.x/admin/system_presets/simple/relationship_c-rel.php =================================================================== diff -u -r12265 -r12277 --- branches/5.0.x/admin/system_presets/simple/relationship_c-rel.php (.../relationship_c-rel.php) (revision 12265) +++ branches/5.0.x/admin/system_presets/simple/relationship_c-rel.php (.../relationship_c-rel.php) (revision 12277) @@ -1,7 +1,3 @@ UnitConfigReader->getPrefixFile('custom-sections') ) . '/../site_configs/'; - // include site config settings from main "rel" prefix - include('relationship_rel.php'); + include(SYSTEM_PRESET_PATH . DIRECTORY_SEPARATOR . 'relationship_rel.php'); Index: branches/5.0.x/core/install/step_templates/security.tpl =================================================================== diff -u -r12204 -r12277 --- branches/5.0.x/core/install/step_templates/security.tpl (.../security.tpl) (revision 12204) +++ branches/5.0.x/core/install/step_templates/security.tpl (.../security.tpl) (revision 12277) @@ -74,5 +74,27 @@ '; } + $output .= sprintf($heading_tpl, 'Webserver PHP Configuration', 'text'); + + $directive_check = true; + $ini_vars = Array ('register_globals' => false, 'open_basedir' => true, 'allow_url_fopen' => false); + foreach ($ini_vars as $var_name => $var_value) { + $current_value = ini_get($var_name); + + if (($var_value && !$current_value) || (!$var_value && $current_value)) { + $directive_check = false; + $status_text = 'Vulnerable'; + } + else { + $status_text = 'Secure'; + } + + $output .= sprintf($error_tpl, 'Directive: ' . $var_name . '', $status_text); + } + + /*if (!$directive_check) { + // show additional warning about directives + }*/ + echo $output; ?> \ No newline at end of file Index: branches/5.0.x/core/install/english.lang =================================================================== diff -u -r12265 -r12277 --- branches/5.0.x/core/install/english.lang (.../english.lang) (revision 12265) +++ branches/5.0.x/core/install/english.lang (.../english.lang) (revision 12277) @@ -215,6 +215,7 @@ VXNlIFBhZ2VIaXQgY291bnRlcg== VXNlIFBvcHVwcyBmb3IgRWRpdGluZw== VXNlIFNtYWxsIFNlY3Rpb24gSGVhZGVycw== + Q29tcHJlc3MgQ29tcGlsZWQgUEhQIFRlbXBsYXRlcw== VXNlIFRvb2xiYXIgTGFiZWxz VXNlIEphdmFTY3JpcHQgcmVkaXJlY3Rpb24gYWZ0ZXIgbG9naW4vbG9nb3V0IChmb3IgSUlTKQ== VXNlIE1PRCBSRVdSSVRF Index: branches/5.0.x/core/units/general/libchart/classes/libchart.php =================================================================== diff -u -r12117 -r12277 --- branches/5.0.x/core/units/general/libchart/classes/libchart.php (.../libchart.php) (revision 12117) +++ branches/5.0.x/core/units/general/libchart/classes/libchart.php (.../libchart.php) (revision 12277) @@ -1,27 +1,29 @@ . - * + * */ + exit; + require_once 'model/Point.php'; require_once 'model/DataSet.php'; require_once 'model/XYDataSet.php'; require_once 'model/XYSeriesDataSet.php'; - + require_once 'view/primitive/Padding.php'; require_once 'view/primitive/Rectangle.php'; require_once 'view/primitive/Primitive.php'; Index: branches/5.0.x/core/install/install_data.sql =================================================================== diff -u -r12265 -r12277 --- branches/5.0.x/core/install/install_data.sql (.../install_data.sql) (revision 12265) +++ branches/5.0.x/core/install/install_data.sql (.../install_data.sql) (revision 12277) @@ -139,17 +139,19 @@ INSERT INTO ConfigurationValues VALUES (DEFAULT, 'UseOutputCompression', '0', 'In-Portal', 'in-portal:configure_advanced'); INSERT INTO ConfigurationAdmin VALUES ('OutputCompressionLevel', 'la_section_SettingsSystem', 'la_config_OutputCompressionLevel', 'text', '', '', 60.02, 0, 1); INSERT INTO ConfigurationValues VALUES (DEFAULT, 'OutputCompressionLevel', '7', 'In-Portal', 'in-portal:configure_advanced'); -INSERT INTO ConfigurationAdmin VALUES ('TrimRequiredFields', 'la_section_SettingsSystem', 'la_config_TrimRequiredFields', 'checkbox', '', '', 60.03, 0, 0); +INSERT INTO ConfigurationAdmin VALUES ('UseTemplateCompression', 'la_section_SettingsSystem', 'la_config_UseTemplateCompression', 'checkbox', '', '', 60.03, 0, 1); +INSERT INTO ConfigurationValues VALUES (DEFAULT, 'UseTemplateCompression', '0', 'In-Portal', 'in-portal:configure_advanced'); +INSERT INTO ConfigurationAdmin VALUES ('TrimRequiredFields', 'la_section_SettingsSystem', 'la_config_TrimRequiredFields', 'checkbox', '', '', 60.04, 0, 0); INSERT INTO ConfigurationValues VALUES (DEFAULT, 'TrimRequiredFields', '0', 'In-Portal', 'in-portal:configure_advanced'); -INSERT INTO ConfigurationAdmin VALUES ('UseCronForRegularEvent', 'la_section_SettingsSystem', 'la_UseCronForRegularEvent', 'checkbox', NULL, NULL, 60.04, 0, 0); +INSERT INTO ConfigurationAdmin VALUES ('UseCronForRegularEvent', 'la_section_SettingsSystem', 'la_UseCronForRegularEvent', 'checkbox', NULL, NULL, 60.05, 0, 0); INSERT INTO ConfigurationValues VALUES (DEFAULT, 'UseCronForRegularEvent', '0', 'In-Portal', 'in-portal:configure_advanced'); -INSERT INTO ConfigurationAdmin VALUES ('UseChangeLog', 'la_section_SettingsSystem', 'la_config_UseChangeLog', 'checkbox', '', '', 60.05, 0, 0); +INSERT INTO ConfigurationAdmin VALUES ('UseChangeLog', 'la_section_SettingsSystem', 'la_config_UseChangeLog', 'checkbox', '', '', 60.06, 0, 0); INSERT INTO ConfigurationValues VALUES (DEFAULT, 'UseChangeLog', '0', 'In-Portal', 'in-portal:configure_advanced'); -INSERT INTO ConfigurationAdmin VALUES ('Backup_Path', 'la_section_SettingsSystem', 'la_config_backup_path', 'text', '', '', 60.06, 0, 1); +INSERT INTO ConfigurationAdmin VALUES ('Backup_Path', 'la_section_SettingsSystem', 'la_config_backup_path', 'text', '', '', 60.07, 0, 1); INSERT INTO ConfigurationValues VALUES (DEFAULT, 'Backup_Path', '', 'In-Portal', 'in-portal:configure_advanced'); -INSERT INTO ConfigurationAdmin VALUES ('SystemTagCache', 'la_section_SettingsSystem', 'la_prompt_syscache_enable', 'checkbox', NULL, NULL, 60.07, 0, 0); +INSERT INTO ConfigurationAdmin VALUES ('SystemTagCache', 'la_section_SettingsSystem', 'la_prompt_syscache_enable', 'checkbox', NULL, NULL, 60.08, 0, 0); INSERT INTO ConfigurationValues VALUES (DEFAULT, 'SystemTagCache', '0', 'In-Portal', 'in-portal:configure_advanced'); -INSERT INTO ConfigurationAdmin VALUES ('SocketBlockingMode', 'la_section_SettingsSystem', 'la_prompt_socket_blocking_mode', 'checkbox', NULL, NULL, 60.08, 0, 0); +INSERT INTO ConfigurationAdmin VALUES ('SocketBlockingMode', 'la_section_SettingsSystem', 'la_prompt_socket_blocking_mode', 'checkbox', NULL, NULL, 60.09, 0, 0); INSERT INTO ConfigurationValues VALUES (DEFAULT, 'SocketBlockingMode', '0', 'In-Portal', 'in-portal:configure_advanced'); INSERT INTO ConfigurationAdmin VALUES ('CSVExportDelimiter', 'la_section_SettingsCSVExport', 'la_config_CSVExportDelimiter', 'select', NULL, '0=la_opt_Tab,1=la_opt_Comma,2=la_opt_Semicolon,3=la_opt_Space,4=la_opt_Colon', 70.01, 0, 1); INSERT INTO ConfigurationValues VALUES (DEFAULT, 'CSVExportDelimiter', '1', 'In-Portal', 'in-portal:configure_advanced'); Index: branches/5.0.x/core/units/pdf/pdf_renderer_zend.php =================================================================== diff -u -r12117 -r12277 --- branches/5.0.x/core/units/pdf/pdf_renderer_zend.php (.../pdf_renderer_zend.php) (revision 12117) +++ branches/5.0.x/core/units/pdf/pdf_renderer_zend.php (.../pdf_renderer_zend.php) (revision 12277) @@ -1,6 +1,6 @@ PDF = new Zend_Pdf(); $this->PDF->pages[] = ($page1 = new Zend_Pdf_Page(Zend_Pdf_Page::SIZE_A4)); $this->CurPage = $page1; } - + function GetWidth() { return $this->CurPage->getWidth(); } - + function GetHeight() { return $this->CurPage->getHeight(); } - + function SetFont($font, $size) { $mapping = array( @@ -59,62 +61,62 @@ $this->CurFontSize = $size; return $this->CurPage->setFont($this->CurFont, $size); } - + function SetFontSize($size) { $this->SetFont($this->CurFont, $size); } - + function SetFillColor($color) { return $this->CurPage->setFillColor( new Zend_Pdf_Color_HTML($color) ); } - + function SetLineColor($color) { return $this->CurPage->setLineColor( new Zend_Pdf_Color_HTML($color) ); } - - function SetLineWidth($width) + + function SetLineWidth($width) { return $this->CurPage->setLineWidth($width); } - + function DrawLine($x1, $y1, $x2, $y2) { return $this->CurPage->drawLine($x1, $y1, $x2, $y2); } - + function DrawRectangle($x1, $y1, $x2, $y2, $mode) { return $this->CurPage->drawRectangle($x1, $y1, $x2, $y2, $mode); } - + function DrawText($x, $y, $text) { return $this->CurPage->drawText($x, $y, $text); } - + function GetPDFString() { return $this->PDF->render(); } - + function GetAscent() { return ($this->CurFont->getAscent() / $this->CurFont->getUnitsPerEm()) * $this->CurFontSize; } - + function GetDescent() { return ($this->CurFont->getDescent() / $this->CurFont->getUnitsPerEm()) * $this->CurFontSize; } - + function GetLineGap() { return ($this->CurFont->getLineGap() / $this->CurFont->getUnitsPerEm()) * $this->CurFontSize; } - + function GetStringWidth($string) { $drawingString = iconv('UTF-8', 'UTF-16BE//IGNORE', $string); Index: branches/5.0.x/core/editor/fckeditor.php =================================================================== diff -u -r12117 -r12277 --- branches/5.0.x/core/editor/fckeditor.php (.../fckeditor.php) (revision 12117) +++ branches/5.0.x/core/editor/fckeditor.php (.../fckeditor.php) (revision 12277) @@ -25,7 +25,10 @@ * strict error messages with PHP 5). */ -if ( !function_exists('version_compare') || version_compare( phpversion(), '5', '<' ) ) - include_once( 'fckeditor_php4.php' ) ; -else - include_once( 'fckeditor_php5.php' ) ; +$fck_folder = realpath( dirname(__FILE__) ); + +if ( !function_exists('version_compare') || version_compare( phpversion(), '5', '<' ) ) { + include_once( $fck_folder . DIRECTORY_SEPARATOR . 'fckeditor_php4.php' ) ; +} else { + include_once( $fck_folder . DIRECTORY_SEPARATOR . 'fckeditor_php5.php' ) ; +} Index: branches/5.0.x/core/kernel/nparser/nparser.php =================================================================== diff -u -r12229 -r12277 --- branches/5.0.x/core/kernel/nparser/nparser.php (.../nparser.php) (revision 12229) +++ branches/5.0.x/core/kernel/nparser/nparser.php (.../nparser.php) (revision 12277) @@ -1,6 +1,6 @@ _compressOutput = $this->Application->ConfigValue('UseTemplateCompression'); } function Compile($pre_parsed, $template_name = 'unknown') @@ -74,6 +80,11 @@ } else { $compiled = fopen($pre_parsed['fname'], 'w'); + + if ($this->_compressOutput) { + $this->Buffers[0] = $this->_compress($this->Buffers[0]); + } + if (!fwrite($compiled, $this->Buffers[0])) { trigger_error('Saving compiled template failed', E_USER_ERROR); } @@ -729,4 +740,140 @@ $this->CacheSet($this->PopPointer(), $ret); // . ($this->CurrentKeyPart ? ':'.$this->CurrentKeyPart : '') echo $ret; } + + function _compress($src) { + // Whitespaces left and right from this signs can be ignored + static $IW = array( + T_CONCAT_EQUAL, // .= + T_DOUBLE_ARROW, // => + T_BOOLEAN_AND, // && + T_BOOLEAN_OR, // || + T_IS_EQUAL, // == + T_IS_NOT_EQUAL, // != or <> + T_IS_SMALLER_OR_EQUAL, // <= + T_IS_GREATER_OR_EQUAL, // >= + T_INC, // ++ + T_DEC, // -- + T_PLUS_EQUAL, // += + T_MINUS_EQUAL, // -= + T_MUL_EQUAL, // *= + T_DIV_EQUAL, // /= + T_IS_IDENTICAL, // === + T_IS_NOT_IDENTICAL, // !== + T_DOUBLE_COLON, // :: + T_PAAMAYIM_NEKUDOTAYIM, // :: + T_OBJECT_OPERATOR, // -> + T_DOLLAR_OPEN_CURLY_BRACES, // ${ + T_AND_EQUAL, // &= + T_MOD_EQUAL, // %= + T_XOR_EQUAL, // ^= + T_OR_EQUAL, // |= + T_SL, // << + T_SR, // >> + T_SL_EQUAL, // <<= + T_SR_EQUAL, // >>= + ); + + $tokens = token_get_all($src); + + $new = ""; + $c = sizeof($tokens); + $iw = false; // ignore whitespace + $ih = false; // in HEREDOC + $ls = ""; // last sign + $ot = null; // open tag + + for ($i = 0; $i < $c; $i++) { + $token = $tokens[$i]; + + if (is_array($token)) { + list ($tn, $ts) = $token; // tokens: number, string, line + $tname = token_name($tn); + + if ($tn == T_INLINE_HTML) { + $new .= $ts; + $iw = false; + } else { + if ($tn == T_OPEN_TAG) { + if (strpos($ts, " ") || strpos($ts, "\n") || strpos($ts, "\t") || strpos($ts, "\r")) { + $ts = rtrim($ts); + } + + $ts .= " "; + $new .= $ts; + $ot = T_OPEN_TAG; + $iw = true; + } elseif ($tn == T_OPEN_TAG_WITH_ECHO) { + $new .= $ts; + $ot = T_OPEN_TAG_WITH_ECHO; + $iw = true; + } elseif ($tn == T_CLOSE_TAG) { + if ($ot == T_OPEN_TAG_WITH_ECHO) { + $new = rtrim($new, "; "); + } else { + $ts = " ".$ts; + } + + $new .= $ts; + $ot = null; + $iw = false; + } elseif (in_array($tn, $IW)) { + $new .= $ts; + $iw = true; + } elseif ($tn == T_CONSTANT_ENCAPSED_STRING || $tn == T_ENCAPSED_AND_WHITESPACE) { + if ($ts[0] == '"') { + $ts = addcslashes($ts, "\n\t\r"); + } + + $new .= $ts; + $iw = true; + } elseif ($tn == T_WHITESPACE) { + $nt = @$tokens[$i+1]; + if (!$iw && (!is_string($nt) || $nt == '$') && !in_array($nt[0], $IW)) { + $new .= " "; + } + + $iw = false; + } elseif ($tn == T_START_HEREDOC) { + $new .= "<< '|'.implode('|', $data['parent_path']).'|', // allow old fashion system templates to work Index: branches/5.0.x/admin/system_presets/simple/relationship_l-rel.php =================================================================== diff -u -r12265 -r12277 --- branches/5.0.x/admin/system_presets/simple/relationship_l-rel.php (.../relationship_l-rel.php) (revision 12265) +++ branches/5.0.x/admin/system_presets/simple/relationship_l-rel.php (.../relationship_l-rel.php) (revision 12277) @@ -1,7 +1,3 @@ UnitConfigReader->getPrefixFile('custom-sections') ) . '/../site_configs/'; - // include site config settings from main "rel" prefix - include('relationship_rel.php'); + include(SYSTEM_PRESET_PATH . DIRECTORY_SEPARATOR . 'relationship_rel.php'); Index: branches/5.0.x/core/units/general/cat_event_handler.php =================================================================== diff -u -r12117 -r12277 --- branches/5.0.x/core/units/general/cat_event_handler.php (.../cat_event_handler.php) (revision 12117) +++ branches/5.0.x/core/units/general/cat_event_handler.php (.../cat_event_handler.php) (revision 12277) @@ -1,6 +1,6 @@ Factory->includeClassFile('kDBEventHandler'); - class kCatDBEventHandler extends kDBEventHandler { /** Index: branches/5.0.x/core/units/categories/categories_event_handler.php =================================================================== diff -u -r12231 -r12277 --- branches/5.0.x/core/units/categories/categories_event_handler.php (.../categories_event_handler.php) (revision 12231) +++ branches/5.0.x/core/units/categories/categories_event_handler.php (.../categories_event_handler.php) (revision 12277) @@ -1,6 +1,6 @@ GetDBField('ParentId') == $root_category) && ($object->GetDBField('Template') == CATEGORY_TEMPLATE_INHERIT)) { $object->SetError('Template', 'no_inherit'); } + + if (!$this->Application->IsAdmin() || !$this->Application->LoggedIn()) { + // only administrator can set/change "cust_RssSource" field + + if ($object->GetDBField('cust_RssSource') != $object->GetOriginalField('cust_RssSource')) { + $object->SetError('cust_RssSource', 'not_allowed', 'la_error_NotAllowed'); + } + } } /** Index: branches/5.0.x/core/kernel/utility/debugger/debugger_responce.php =================================================================== diff -u -r12117 -r12277 --- branches/5.0.x/core/kernel/utility/debugger/debugger_responce.php (.../debugger_responce.php) (revision 12117) +++ branches/5.0.x/core/kernel/utility/debugger/debugger_responce.php (.../debugger_responce.php) (revision 12277) @@ -1,6 +1,6 @@ UnitConfigReader->getPrefixFile('custom-sections') ) . '/../site_configs/'; - // include site config settings from main "rev" prefix - include('reviews_rev.php'); + include(SYSTEM_PRESET_PATH . DIRECTORY_SEPARATOR . 'reviews_rev.php'); Index: branches/5.0.x/core/kernel/application.php =================================================================== diff -u -r12235 -r12277 --- branches/5.0.x/core/kernel/application.php (.../application.php) (revision 12235) +++ branches/5.0.x/core/kernel/application.php (.../application.php) (revision 12277) @@ -1,6 +1,6 @@ Debugger->appendMemoryUsage('Application before Done:'); } - //eval("?".">".$this->HTML); - if ($this->isDebugMode()) { $this->EventManager->RunRegularEvents(reAFTER); $this->Session->SaveData(); Index: branches/5.0.x/core/units/general/helpers/geocode_helper.php =================================================================== diff -u -r12117 -r12277 --- branches/5.0.x/core/units/general/helpers/geocode_helper.php (.../geocode_helper.php) (revision 12117) +++ branches/5.0.x/core/units/general/helpers/geocode_helper.php (.../geocode_helper.php) (revision 12277) @@ -1,6 +1,6 @@ Application->ConfigValue('GeoCodeUser'); $pass = $this->Application->ConfigValue('GeoCodePass'); @@ -39,7 +36,7 @@ if ($code == 0) { $out_data = explode('|', $geo_array[2]); - include_once(FULL_PATH.'/compat/array_combine.php'); +// include_once(FULL_PATH.'/compat/array_combine.php'); $assoc_data = array_combine(explode('|', $geo_array[1]), $out_data); $lon = abs($out_data[8]); // set to positive, because required by SQL formula @@ -83,10 +80,14 @@ $request_url = $this->Application->ConfigValue('GoogleMapsURL').'output=xml&key='. $this->Application->ConfigValue('GoogleMapsKey').'&q='.urlencode($qaddress); + $curl_helper =& $this->Application->recallObject('CurlHelper'); + /* @var $curl_helper kCurlHelper */ + $delay = 0; while (true) { - $xml = file_get_contents($request_url); + $xml = $curl_helper->Send($request_url); + if (strpos($xml, '620')) { $delay += 100000; } elseif (strpos($xml, '200')) { Index: branches/5.0.x/core/kernel/utility/unit_config_reader.php =================================================================== diff -u -r12202 -r12277 --- branches/5.0.x/core/kernel/utility/unit_config_reader.php (.../unit_config_reader.php) (revision 12202) +++ branches/5.0.x/core/kernel/utility/unit_config_reader.php (.../unit_config_reader.php) (revision 12277) @@ -1,6 +1,6 @@ getConfigName($folderPath . DIRECTORY_SEPARATOR . $sub_folder))) { - $this->configFiles[] = $this->getConfigName($folderPath . DIRECTORY_SEPARATOR . $sub_folder); + $config_name = $this->getConfigName($folderPath . DIRECTORY_SEPARATOR . $sub_folder); + + if (file_exists(FULL_PATH . $config_name)) { + $this->configFiles[] = $config_name; } $this->findConfigFiles($full_path, $level + 1); Index: branches/5.0.x/core/install/upgrades.sql =================================================================== diff -u -r12265 -r12277 --- branches/5.0.x/core/install/upgrades.sql (.../upgrades.sql) (revision 12265) +++ branches/5.0.x/core/install/upgrades.sql (.../upgrades.sql) (revision 12277) @@ -1429,18 +1429,19 @@ DELETE FROM ConfigurationAdmin WHERE VariableName = 'SiteNameSubTitle'; DELETE FROM ConfigurationValues WHERE VariableName = 'SiteNameSubTitle'; - UPDATE ConfigurationAdmin SET DisplayOrder = DisplayOrder - 0.01 WHERE VariableName IN ('UseModRewrite', 'cms_DefaultDesign', 'ErrorTemplate' 'NoPermissionTemplate', 'UsePageHitCounter', 'ForceImageMagickResize', 'CheckStopWords'); ALTER TABLE ConfigurationAdmin CHANGE validation Validation TEXT NULL DEFAULT NULL; UPDATE ConfigurationAdmin SET Validation = 'a:3:{s:4:"type";s:3:"int";s:13:"min_value_inc";i:1;s:8:"required";i:1;}' WHERE VariableName = 'SessionTimeout'; INSERT INTO ConfigurationAdmin VALUES ('AdminConsoleInterface', 'la_section_SettingsAdmin', 'la_config_AdminConsoleInterface', 'select', '', 'simple=+simple,intermediate=+intermediate,advanced=+advanced', 50.01, 0, 1); INSERT INTO ConfigurationValues VALUES (DEFAULT, 'AdminConsoleInterface', 'simple', 'In-Portal', 'in-portal:configure_general'); - INSERT INTO ConfigurationAdmin VALUES ('AllowAdminConsoleInterfaceChange', 'la_section_SettingsAdmin', 'la_config_AllowAdminConsoleInterfaceChange', 'checkbox', NULL , NULL , 40.01, 0, 0); INSERT INTO ConfigurationValues VALUES (DEFAULT, 'AllowAdminConsoleInterfaceChange', '1', 'In-Portal', 'in-portal:configure_advanced'); - UPDATE ConfigurationAdmin SET DisplayOrder = DisplayOrder + 0.01 WHERE VariableName IN ('UseToolbarLabels', 'UseSmallHeader', 'UseColumnFreezer', 'UsePopups', 'UseDoubleSorting', 'MenuFrameWidth', 'ResizableFrames', 'AutoRefreshIntervals', 'DebugOnlyFormConfigurator', 'UseModalWindows'); +INSERT INTO ConfigurationAdmin VALUES ('UseTemplateCompression', 'la_section_SettingsSystem', 'la_config_UseTemplateCompression', 'checkbox', '', '', 60.03, 0, 1); +INSERT INTO ConfigurationValues VALUES (DEFAULT, 'UseTemplateCompression', '0', 'In-Portal', 'in-portal:configure_advanced'); +UPDATE ConfigurationAdmin SET DisplayOrder = DisplayOrder + 0.01 WHERE VariableName IN ('TrimRequiredFields', 'UseCronForRegularEvent', 'UseChangeLog', 'Backup_Path', 'SystemTagCache', 'SocketBlockingMode'); + UPDATE Modules SET Version = '5.0.1', Loaded = 1 WHERE Name = 'In-Portal'; \ No newline at end of file Index: branches/5.0.x/core/install.php =================================================================== diff -u -r12204 -r12277 --- branches/5.0.x/core/install.php (.../install.php) (revision 12204) +++ branches/5.0.x/core/install.php (.../install.php) (revision 12277) @@ -1,6 +1,6 @@ Array ('check_paths', 'db_config', 'select_license', 'download_license', 'select_domain', 'root_password', 'choose_modules', 'post_config', 'select_theme', 'security', 'finish'), - 'clean_reinstall' => Array ('check_paths', 'clean_db', 'db_config', 'select_license', 'download_license', 'select_domain', 'root_password', 'choose_modules', 'post_config', 'select_theme', 'security', 'finish'), + 'fresh_install' => Array ('check_paths', 'db_config', 'select_license', /*'download_license',*/ 'select_domain', 'root_password', 'choose_modules', 'post_config', 'select_theme', 'security', 'finish'), + 'clean_reinstall' => Array ('check_paths', 'clean_db', 'db_config', 'select_license', /*'download_license',*/ 'select_domain', 'root_password', 'choose_modules', 'post_config', 'select_theme', 'security', 'finish'), 'already_installed' => Array ('check_paths', 'install_setup'), 'upgrade' => Array ('check_paths', 'install_setup', 'upgrade_modules', 'security', 'finish'), - 'update_license' => Array ('check_paths', 'install_setup', 'select_license', 'download_license', 'select_domain', 'security', 'finish'), + 'update_license' => Array ('check_paths', 'install_setup', 'select_license', /*'download_license',*/ 'select_domain', 'security', 'finish'), 'db_reconfig' => Array ('check_paths', 'install_setup', 'db_reconfig', 'security', 'finish'), 'fix_paths' => Array ('check_paths', 'install_setup', 'fix_paths', 'security', 'finish'), ); @@ -83,7 +83,7 @@ * * @var Array */ - var $skipLoginSteps = Array ('check_paths', 'select_license', 'download_license', 'select_domain', 'root_password', 'choose_modules', 'post_config', 'select_theme', 'security', 'finish', -1); + var $skipLoginSteps = Array ('check_paths', 'select_license', /*'download_license',*/ 'select_domain', 'root_password', 'choose_modules', 'post_config', 'select_theme', 'security', 'finish', -1); /** * Steps, on which kApplication should not be initialized, because of missing correct db table structure @@ -422,12 +422,23 @@ unlink(WRITEABLE . '/install_check.php'); $execute_check = ($output !== 'OK'); - if (!$write_check || !$execute_check) { + $directive_check = true; + $ini_vars = Array ('register_globals' => false, 'open_basedir' => true, 'allow_url_fopen' => false); + foreach ($ini_vars as $var_name => $var_value) { + $current_value = ini_get($var_name); + + if (($var_value && !$current_value) || (!$var_value && $current_value)) { + $directive_check = false; + break; + } + } + + if (!$write_check || !$execute_check || !$directive_check) { $this->errorMessage = true; } - else { + /*else { $this->currentStep = $this->GetNextStep(); - } + }*/ break; } Index: branches/5.0.x/core/kernel/db/db_event_handler.php =================================================================== diff -u -r12264 -r12277 --- branches/5.0.x/core/kernel/db/db_event_handler.php (.../db_event_handler.php) (revision 12264) +++ branches/5.0.x/core/kernel/db/db_event_handler.php (.../db_event_handler.php) (revision 12277) @@ -1,6 +1,6 @@ Application->GetVar('file'), '../') !== false) return ; + $file = $this->Application->GetVar('file'); + if ((strpos($file, '../') !== false) || (trim($file) !== $file)) { + // when relative paths or special chars are found template names from url, then it's hacking attempt + return ; + } + if ($this->Application->GetVar('tmp')) { $path = WRITEABLE . '/tmp/' . $this->Application->GetVar('id') . '_' . $this->Application->GetVar('file'); } else { $object =& $event->getObject(array('skip_autoload'=>true)); $options = $object->GetFieldOptions($this->Application->GetVar('field')); - $path = FULL_PATH.$options['upload_dir'].$this->Application->GetVar('file'); + $path = FULL_PATH.$options['upload_dir'].$file; } $path = str_replace('/', DIRECTORY_SEPARATOR, $path); Index: branches/5.0.x/admin/system_presets/simple/images_l-img.php =================================================================== diff -u -r12265 -r12277 --- branches/5.0.x/admin/system_presets/simple/images_l-img.php (.../images_l-img.php) (revision 12265) +++ branches/5.0.x/admin/system_presets/simple/images_l-img.php (.../images_l-img.php) (revision 12277) @@ -1,7 +1,3 @@ UnitConfigReader->getPrefixFile('custom-sections') ) . '/../site_configs/'; - // include site config settings from main "img" prefix - include('images_img.php'); + include(SYSTEM_PRESET_PATH . DIRECTORY_SEPARATOR . 'images_img.php'); \ No newline at end of file Index: branches/5.0.x/admin/system_presets/simple/related_searches_c-search.php =================================================================== diff -u -r12265 -r12277 --- branches/5.0.x/admin/system_presets/simple/related_searches_c-search.php (.../related_searches_c-search.php) (revision 12265) +++ branches/5.0.x/admin/system_presets/simple/related_searches_c-search.php (.../related_searches_c-search.php) (revision 12277) @@ -1,7 +1,3 @@ UnitConfigReader->getPrefixFile('custom-sections') ) . '/../site_configs/'; - // include site config settings from main "search" prefix - include('related_searches_search.php'); \ No newline at end of file + include(SYSTEM_PRESET_PATH . DIRECTORY_SEPARATOR . 'related_searches_search.php'); \ No newline at end of file Index: branches/5.0.x/core/units/general/custom_fields.php =================================================================== diff -u -r12117 -r12277 --- branches/5.0.x/core/units/general/custom_fields.php (.../custom_fields.php) (revision 12117) +++ branches/5.0.x/core/units/general/custom_fields.php (.../custom_fields.php) (revision 12277) @@ -1,6 +1,6 @@ ', '%3$s'), Array (TABLE_PREFIX, $this->Application->GetVar('m_lang')), $valueString) ); - preg_match_all("|\{(.*)\}|U", $string, $embedded_vars, PREG_SET_ORDER); - - /* - in ValueList now can use globally available variables. - Usage: {$_POST['variable']|what to output if $_POST['variable'] is set} - e.g. $_POST['variable']='Hello' - Will output: what to output if Hello is set - */ - - if ($embedded_vars) { - for ($i = 0; $i < count($embedded_vars); $i++) { - $embedded_var = $embedded_vars[$i][1]; - $embedded_var_src = $embedded_vars[$i][0]; - - list($var_name, $pattern) = explode('|', $embedded_var); - eval('$var_value = (isset('.$var_name.')?'.$var_name.':false);'); - - if ($var_value !== false) { - $pattern = str_replace($var_name, $var_value, $pattern); - $string = str_replace($embedded_var_src, $pattern, $string); - } - else { - $string = str_replace($embedded_var_src, '', $string); - } - } - } - if (preg_match_all('/(.*?)<\/SQL>/', $string, $regs)) { $i = 0; $sql_count = count($regs[0]);