1
+ − 1
<?php
+ − 2
/*
+ − 3
* Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 4
* Version 1.0 (Banshee)
1
+ − 5
* pageprocess.php - intelligent retrieval of pages
+ − 6
* Copyright (C) 2006-2007 Dan Fuhry
+ − 7
*
+ − 8
* This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
+ − 9
* as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
+ − 10
*
+ − 11
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+ − 12
* warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.
+ − 13
*/
+ − 14
+ − 15
/**
+ − 16
* Class to handle fetching page text (possibly from a cache) and formatting it.
+ − 17
* @package Enano
+ − 18
* @subpackage UI
+ − 19
* @copyright 2007 Dan Fuhry
+ − 20
* @license GNU General Public License <http://www.gnu.org/licenses/gpl.html>
+ − 21
*/
+ − 22
+ − 23
class PageProcessor
+ − 24
{
+ − 25
+ − 26
/**
+ − 27
* Page ID and namespace of the page handled by this instance
+ − 28
* @var string
+ − 29
*/
+ − 30
+ − 31
var $page_id;
+ − 32
var $namespace;
+ − 33
+ − 34
/**
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 35
* The revision ID (history entry) to send. If set to 0 (the default) then the most recent revision will be sent.
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 36
* @var int
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 37
*/
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 38
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 39
var $revision_id = 0;
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 40
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 41
/**
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 42
* Unsanitized page ID.
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 43
* @var string
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 44
*/
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 45
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 46
var $page_id_unclean;
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 47
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 48
/**
1
+ − 49
* Tracks if the page we're loading exists in the database or not.
+ − 50
* @var bool
+ − 51
*/
+ − 52
+ − 53
var $page_exists = false;
+ − 54
+ − 55
/**
+ − 56
* Permissions!
+ − 57
* @var object
+ − 58
*/
+ − 59
+ − 60
var $perms = null;
+ − 61
+ − 62
/**
+ − 63
* Switch to track if redirects are allowed. Defaults to true.
+ − 64
* @var bool
+ − 65
*/
+ − 66
+ − 67
var $allow_redir = true;
+ − 68
+ − 69
/**
+ − 70
* If this is set to true, this will call the header and footer funcs on $template when render() is called.
+ − 71
* @var bool
+ − 72
*/
+ − 73
+ − 74
var $send_headers = false;
+ − 75
+ − 76
/**
+ − 77
* Cache the fetched text so we don't fetch it from the DB twice.
+ − 78
* @var string
+ − 79
*/
+ − 80
+ − 81
var $text_cache = '';
+ − 82
+ − 83
/**
+ − 84
* Debugging information to track errors. You can set enable to false to disable sending debug information.
+ − 85
* @var array
+ − 86
*/
+ − 87
+ − 88
var $debug = array(
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 89
'enable' => false,
1
+ − 90
'works' => false
+ − 91
);
+ − 92
+ − 93
/**
+ − 94
* Constructor.
+ − 95
* @param string The page ID (urlname) of the page
+ − 96
* @param string The namespace of the page
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 97
* @param int Optional. The revision ID to send.
1
+ − 98
*/
+ − 99
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 100
function __construct( $page_id, $namespace, $revision_id = 0 )
1
+ − 101
{
+ − 102
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 103
+ − 104
// See if we can get some debug info
+ − 105
if ( function_exists('debug_backtrace') && $this->debug['enable'] )
+ − 106
{
+ − 107
$this->debug['works'] = true;
+ − 108
$this->debug['backtrace'] = enano_debug_print_backtrace(true);
+ − 109
}
+ − 110
+ − 111
// First things first - check page existence and permissions
+ − 112
+ − 113
if ( !isset($paths->nslist[$namespace]) )
+ − 114
{
+ − 115
$this->send_error('The namespace "' . htmlspecialchars($namespace) . '" does not exist.');
+ − 116
}
+ − 117
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 118
if ( !is_int($revision_id) )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 119
$revision_id = 0;
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 120
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 121
$this->_setup( $page_id, $namespace, $revision_id );
1
+ − 122
+ − 123
}
+ − 124
+ − 125
/**
+ − 126
* The main method to send the page content. Also responsible for checking permissions.
+ − 127
*/
+ − 128
+ − 129
function send()
+ − 130
{
+ − 131
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 132
if ( !$this->perms->get_permissions('read') )
+ − 133
{
+ − 134
$this->err_access_denied();
+ − 135
return false;
+ − 136
}
+ − 137
if ( $this->namespace == 'Special' || $this->namespace == 'Admin' )
+ − 138
{
+ − 139
if ( !$this->page_exists )
+ − 140
{
+ − 141
redirect( makeUrl(getConfig('main_page')), 'Can\'t find special page', 'The special or administration page you requested does not exist. You will now be transferred to the main page.', 2 );
+ − 142
}
+ − 143
$func_name = "page_{$this->namespace}_{$this->page_id}";
+ − 144
if ( function_exists($func_name) )
+ − 145
{
+ − 146
return @call_user_func($func_name);
+ − 147
}
+ − 148
else
+ − 149
{
+ − 150
$title = 'Page backend not found';
+ − 151
$message = "The administration page you are looking for was properly registered using the page API, but the backend function
+ − 152
(<tt>$fname</tt>) was not found. If this is a plugin page, then this is almost certainly a bug with the plugin.";
+ − 153
+ − 154
if ( $this->send_headers )
+ − 155
{
+ − 156
$template->tpl_strings['PAGE_NAME'] = $title;
+ − 157
$template->header();
+ − 158
echo "<p>$message</p>";
+ − 159
$template->footer();
+ − 160
}
+ − 161
else
+ − 162
{
+ − 163
echo "<h2>$title</h2>
+ − 164
<p>$message</p>";
+ − 165
}
+ − 166
return false;
+ − 167
}
+ − 168
}
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 169
else if ( $this->namespace == 'User' )
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 170
{
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 171
$this->_handle_userpage();
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 172
}
1
+ − 173
else if ( ( $this->namespace == 'Template' || $this->namespace == 'System' ) && $this->page_exists )
+ − 174
{
+ − 175
$this->header();
+ − 176
+ − 177
$text = $this->fetch_text();
+ − 178
$text = preg_replace('/<noinclude>(.*?)<\/noinclude>/is', '\\1', $text);
+ − 179
$text = preg_replace('/<nodisplay>(.*?)<\/nodisplay>/is', '', $text);
+ − 180
+ − 181
$text = RenderMan::render( $text );
+ − 182
+ − 183
echo $text;
+ − 184
+ − 185
$this->footer();
+ − 186
+ − 187
}
+ − 188
else if ( !$this->page_exists )
+ − 189
{
+ − 190
// Perhaps this is hooked?
+ − 191
ob_start();
+ − 192
+ − 193
$code = $plugins->setHook('page_not_found');
+ − 194
foreach ( $code as $cmd )
+ − 195
{
+ − 196
eval($cmd);
+ − 197
}
+ − 198
+ − 199
$ob = ob_get_contents();
+ − 200
+ − 201
if ( empty($ob) )
+ − 202
{
+ − 203
$this->err_page_not_existent();
+ − 204
}
+ − 205
}
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 206
else // (disabled for compatibility reasons) if ( in_array($this->namespace, array('Article', 'User', 'Project', 'Help', 'File', 'Category')) && $this->page_exists )
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 207
{
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 208
// Send as regular page
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 209
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 210
// die($this->page_id);
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 211
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 212
$text = $this->fetch_text();
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 213
if ( $text == 'err_no_text_rows' )
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 214
{
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 215
$this->err_no_rows();
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 216
return false;
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 217
}
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 218
else
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 219
{
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 220
$this->render();
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 221
}
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 222
}
1
+ − 223
}
+ − 224
+ − 225
/**
+ − 226
* Sets internal variables.
+ − 227
* @access private
+ − 228
*/
+ − 229
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 230
function _setup($page_id, $namespace, $revision_id)
1
+ − 231
{
+ − 232
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 233
+ − 234
$page_id_cleaned = sanitize_page_id($page_id);
+ − 235
+ − 236
$this->page_id = $page_id_cleaned;
+ − 237
$this->namespace = $namespace;
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 238
$this->revision_id = $revision_id;
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 239
$this->page_id_unclean = dirtify_page_id($page_id);
1
+ − 240
+ − 241
$this->perms = $session->fetch_page_acl( $page_id, $namespace );
+ − 242
+ − 243
// Exception for Admin: pages
+ − 244
if ( $this->namespace == 'Admin' )
+ − 245
{
+ − 246
$fname = "page_Admin_{$this->page_id}";
+ − 247
}
+ − 248
+ − 249
// Does the page "exist"?
4
+ − 250
if ( $paths->cpage['urlname_nons'] == $page_id && $paths->namespace == $namespace && !$paths->page_exists && ( $this->namespace != 'Admin' || ($this->namespace == 'Admin' && !function_exists($fname) ) ) )
1
+ − 251
{
+ − 252
$this->page_exists = false;
+ − 253
}
+ − 254
else if ( !isset( $paths->pages[ $paths->nslist[$namespace] . $page_id ] ) && ( $this->namespace == 'Admin' && !function_exists($fname) ) )
+ − 255
{
+ − 256
$this->page_exists = false;
+ − 257
}
+ − 258
else
+ − 259
{
+ − 260
$this->page_exists = true;
+ − 261
}
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 262
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 263
// Compatibility with older databases
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 264
if ( strstr($this->page_id, '.2e') && !$this->page_exists )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 265
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 266
$page_id = str_replace('.2e', '.', $page_id);
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 267
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 268
if ( $paths->cpage['urlname_nons'] == $page_id && $paths->namespace == $namespace && !$paths->page_exists && ( $this->namespace != 'Admin' || ($this->namespace == 'Admin' && !function_exists($fname) ) ) )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 269
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 270
$this->page_exists = false;
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 271
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 272
else if ( !isset( $paths->pages[ $paths->nslist[$namespace] . $page_id ] ) && ( $this->namespace == 'Admin' && !function_exists($fname) ) )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 273
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 274
$this->page_exists = false;
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 275
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 276
else
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 277
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 278
$this->page_exists = true;
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 279
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 280
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 281
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 282
1
+ − 283
}
+ − 284
+ − 285
/**
+ − 286
* Renders it all in one go, and echoes it out. This assumes that the text is in the DB.
+ − 287
* @access private
+ − 288
*/
+ − 289
+ − 290
function render()
+ − 291
{
+ − 292
$text = $this->fetch_text();
+ − 293
+ − 294
$this->header();
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 295
// if ( $this->send_headers )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 296
// {
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 297
display_page_headers();
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 298
// }
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 299
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 300
if ( $this->revision_id )
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 301
{
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 302
echo '<div class="info-box" style="margin-left: 0; margin-top: 5px;"><b>Notice:</b><br />The page you are viewing was archived on '.date('F d, Y \a\t h:i a', $this->revision_id).'.<br /><a href="'.makeUrlNS($this->namespace, $this->page_id).'" onclick="ajaxReset(); return false;">View current version</a> | <a href="'.makeUrlNS($this->namespace, $this->pageid, 'do=rollback&id='.$this->revision_id).'" onclick="ajaxRollback(\''.$this->revision_id.'\')">Restore this version</a></div><br />';
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 303
}
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 304
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 305
$text = '?>' . RenderMan::render($text);
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 306
// echo('<pre>'.htmlspecialchars($text).'</pre>');
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 307
eval ( $text );
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 308
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 309
// if ( $this->send_headers )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 310
// {
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 311
display_page_footers();
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 312
// }
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 313
1
+ − 314
$this->footer();
+ − 315
}
+ − 316
+ − 317
/**
+ − 318
* Sends the page header, dependent on, of course, whether we're supposed to.
+ − 319
*/
+ − 320
+ − 321
function header()
+ − 322
{
+ − 323
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 324
if ( $this->send_headers )
+ − 325
$template->header();
+ − 326
}
+ − 327
+ − 328
/**
+ − 329
* Sends the page footer, dependent on, of course, whether we're supposed to.
+ − 330
*/
+ − 331
+ − 332
function footer()
+ − 333
{
+ − 334
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 335
if ( $this->send_headers )
+ − 336
$template->footer();
+ − 337
}
+ − 338
+ − 339
/**
+ − 340
* Fetches the raw, unfiltered page text.
+ − 341
* @access public
+ − 342
*/
+ − 343
+ − 344
function fetch_text()
+ − 345
{
+ − 346
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 347
+ − 348
if ( !empty($this->text_cache) )
+ − 349
{
+ − 350
return $this->text_cache;
+ − 351
}
+ − 352
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 353
if ( $this->revision_id > 0 && is_int($this->revision_id) )
1
+ − 354
{
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 355
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 356
$q = $db->sql_query('SELECT page_text, char_tag, date_string FROM '.table_prefix.'logs WHERE page_id=\'' . $this->page_id . '\' AND namespace=\'' . $this->namespace . '\' AND time_id=' . $this->revision_id . ';');
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 357
if ( !$q )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 358
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 359
$this->send_error('Error during SQL query.', true);
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 360
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 361
if ( $db->numrows() < 1 )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 362
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 363
// Compatibility fix for old pages with dots in the page ID
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 364
if ( strstr($this->page_id, '.2e') )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 365
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 366
$db->free_result();
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 367
$page_id = str_replace('.2e', '.', $this->page_id);
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 368
$q = $db->sql_query('SELECT page_text, char_tag, date_string FROM '.table_prefix.'logs WHERE page_id=\'' . $page_id . '\' AND namespace=\'' . $this->namespace . '\' AND time_id=' . $this->revision_id . ';');
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 369
if ( !$q )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 370
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 371
$this->send_error('Error during SQL query.', true);
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 372
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 373
if ( $db->numrows() < 1 )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 374
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 375
$this->page_exists = false;
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 376
return 'err_no_text_rows';
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 377
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 378
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 379
else
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 380
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 381
$this->page_exists = false;
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 382
return 'err_no_text_rows';
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 383
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 384
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 385
else
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 386
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 387
$row = $db->fetchrow();
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 388
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 389
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 390
$db->free_result();
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 391
1
+ − 392
}
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 393
else
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 394
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 395
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 396
$q = $db->sql_query('SELECT page_text, char_tag FROM '.table_prefix.'page_text WHERE page_id=\'' . $this->page_id . '\' AND namespace=\'' . $this->namespace . '\';');
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 397
if ( !$q )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 398
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 399
$this->send_error('Error during SQL query.', true);
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 400
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 401
if ( $db->numrows() < 1 )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 402
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 403
// Compatibility fix for old pages with dots in the page ID
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 404
if ( strstr($this->page_id, '.2e') )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 405
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 406
$db->free_result();
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 407
$page_id = str_replace('.2e', '.', $this->page_id);
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 408
$q = $db->sql_query('SELECT page_text, char_tag FROM '.table_prefix.'page_text WHERE page_id=\'' . $page_id . '\' AND namespace=\'' . $this->namespace . '\';');
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 409
if ( !$q )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 410
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 411
$this->send_error('Error during SQL query.', true);
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 412
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 413
if ( $db->numrows() < 1 )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 414
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 415
$this->page_exists = false;
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 416
return 'err_no_text_rows';
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 417
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 418
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 419
else
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 420
{
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 421
$this->page_exists = false;
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 422
return 'err_no_text_rows';
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 423
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 424
}
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 425
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 426
$row = $db->fetchrow();
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 427
$db->free_result();
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 428
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 429
}
1
+ − 430
+ − 431
if ( !empty($row['char_tag']) )
+ − 432
{
+ − 433
// This page text entry uses the old text-escaping format
+ − 434
$from = array(
+ − 435
"{APOS:{$row['char_tag']}}",
+ − 436
"{QUOT:{$row['char_tag']}}",
+ − 437
"{SLASH:{$row['char_tag']}}"
+ − 438
);
+ − 439
$to = array("'", '"', '\\');
+ − 440
$row['page_text'] = str_replace($from, $to, $row['page_text']);
+ − 441
}
+ − 442
+ − 443
$this->text_cache = $row['page_text'];
+ − 444
+ − 445
return $row['page_text'];
+ − 446
+ − 447
}
+ − 448
+ − 449
/**
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 450
* Handles the extra overhead required for user pages.
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 451
* @access private
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 452
*/
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 453
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 454
function _handle_userpage()
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 455
{
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 456
global $db, $session, $paths, $template, $plugins; // Common objects
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 457
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 458
if ( $this->page_id == $paths->cpage['urlname_nons'] && $this->namespace == $paths->namespace )
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 459
{
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 460
$page_name = ( isset($paths->cpage['name']) ) ? $paths->cpage['name'] : $this->page_id;
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 461
}
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 462
else
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 463
{
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 464
$page_name = ( isset($paths->pages[$this->page_id]) ) ? $paths->pages[$this->page_id]['name'] : $this->page_id;
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 465
}
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 466
22
+ − 467
$target_username = strtr($page_name,
+ − 468
Array(
+ − 469
'_' => ' ',
+ − 470
'<' => '<',
+ − 471
'>' => '>'
+ − 472
));
+ − 473
+ − 474
$target_username = preg_replace('/^' . preg_quote($paths->nslist['User']) . '/', '', $target_username);
+ − 475
+ − 476
if ( ( $page_name == str_replace('_', ' ', $this->page_id) || $page_name == $paths->nslist['User'] . str_replace('_', ' ', $this->page_id) ) || !$this->page_exists )
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 477
{
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 478
$page_name = "$target_username's user page";
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 479
}
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 480
else
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 481
{
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 482
// User has a custom title for their userpage
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 483
$page_name = $paths->pages[ $paths->nslist[$this->namespace] . $this->page_id ]['name'];
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 484
}
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 485
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 486
$template->tpl_strings['PAGE_NAME'] = htmlspecialchars($page_name);
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 487
22
+ − 488
$q = $db->sql_query('SELECT u.username, u.user_id AS authoritative_uid, u.real_name, u.email, u.reg_time, x.*, COUNT(c.comment_id) AS n_comments
+ − 489
FROM '.table_prefix.'users u
+ − 490
LEFT JOIN '.table_prefix.'users_extra AS x
+ − 491
ON ( u.user_id = x.user_id OR x.user_id IS NULL )
+ − 492
LEFT JOIN '.table_prefix.'comments AS c
+ − 493
ON ( ( c.user_id=u.user_id AND c.approved=1 ) OR ( c.comment_id IS NULL AND c.approved IS NULL ) )
+ − 494
WHERE u.username=\'' . $db->escape($target_username) . '\'
+ − 495
GROUP BY u.user_id;');
+ − 496
if ( !$q )
+ − 497
$db->_die();
+ − 498
+ − 499
$user_exists = true;
+ − 500
+ − 501
if ( $db->numrows() < 1 )
+ − 502
{
+ − 503
$user_exists = false;
+ − 504
}
+ − 505
else
+ − 506
{
+ − 507
$userdata = $db->fetchrow();
+ − 508
if ( $userdata['authoritative_uid'] == 1 )
+ − 509
{
+ − 510
// Hide data for anonymous user
+ − 511
$user_exists = false;
+ − 512
unset($userdata);
+ − 513
}
+ − 514
}
+ − 515
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 516
$this->header();
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 517
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 518
// if ( $send_headers )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 519
// {
22
+ − 520
// display_page_headers();
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 521
// }
16
+ − 522
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 523
// Start left sidebar: basic user info, latest comments
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 524
22
+ − 525
if ( $user_exists ):
+ − 526
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 527
echo '<table border="0" cellspacing="4" cellpadding="0" style="width: 100%;">';
22
+ − 528
echo '<tr><td style="width: 150px;" valign="top">';
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 529
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 530
echo '<div class="tblholder">
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 531
<table border="0" cellspacing="1" cellpadding="4">';
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 532
22
+ − 533
//
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 534
// Main part of sidebar
22
+ − 535
//
+ − 536
+ − 537
// Basic user info
+ − 538
+ − 539
echo '<tr><th class="subhead">All about ' . htmlspecialchars($target_username) . '</th></tr>';
+ − 540
echo '<tr><td class="row3">Joined: ' . date('F d, Y h:i a', $userdata['reg_time']) . '</td></tr>';
+ − 541
echo '<tr><td class="row1">Total comments: ' . $userdata['n_comments'] . '</td></tr>';
+ − 542
+ − 543
if ( !empty($userdata['real_name']) )
+ − 544
{
+ − 545
echo '<tr><td class="row3">Real name: ' . htmlspecialchars($userdata['real_name']) . '</td></tr>';
+ − 546
}
+ − 547
+ − 548
// Comments
+ − 549
+ − 550
echo '<tr><th class="subhead">' . htmlspecialchars($target_username) . '\'s latest comments</th></tr>';
+ − 551
$q = $db->sql_query('SELECT page_id, namespace, subject, time FROM '.table_prefix.'comments WHERE name=\'' . $db->escape($target_username) . '\' AND approved=1 ORDER BY time DESC LIMIT 5;');
+ − 552
if ( !$q )
+ − 553
$db->_die();
+ − 554
+ − 555
$comments = Array();
+ − 556
$no_comments = false;
+ − 557
+ − 558
if ( $row = $db->fetchrow() )
+ − 559
{
+ − 560
do
+ − 561
{
+ − 562
$row['time'] = date('F d, Y', $row['time']);
+ − 563
$comments[] = $row;
+ − 564
}
+ − 565
while ( $row = $db->fetchrow() );
+ − 566
}
+ − 567
else
+ − 568
{
+ − 569
$no_comments = true;
+ − 570
}
+ − 571
+ − 572
echo '<tr><td class="row3">';
+ − 573
echo '<div style="border: 1px solid #000000; padding: 0px; margin: 0; max-height: 200px; clip: rect(0px,auto,auto,0px); overflow: auto; background-color: transparent;" class="tblholder">';
+ − 574
+ − 575
echo '<table border="0" cellspacing="1" cellpadding="4">';
+ − 576
$class = 'row1';
+ − 577
+ − 578
$tpl = '<tr>
+ − 579
<td class="{CLASS}">
+ − 580
<a href="{PAGE_LINK}" <!-- BEGINNOT page_exists -->class="wikilink-nonexistent"<!-- END page_exists -->>{PAGE}</a><br />
+ − 581
<small>Posted {DATE}<br /></small>
+ − 582
<b><a href="{COMMENT_LINK}">{SUBJECT}</a></b>
+ − 583
</td>
+ − 584
</tr>';
+ − 585
$parser = $template->makeParserText($tpl);
+ − 586
+ − 587
if ( count($comments) > 0 )
+ − 588
{
+ − 589
foreach ( $comments as $comment )
+ − 590
{
+ − 591
$c_page_id = $paths->nslist[ $comment['namespace'] ] . sanitize_page_id($comment['page_id']);
+ − 592
if ( isset($paths->pages[ $c_page_id ]) )
+ − 593
{
+ − 594
$parser->assign_bool(array(
+ − 595
'page_exists' => true
+ − 596
));
+ − 597
$page_title = $paths->pages[ $c_page_id ]['name'];
+ − 598
}
+ − 599
else
+ − 600
{
+ − 601
$parser->assign_bool(array(
+ − 602
'page_exists' => false
+ − 603
));
+ − 604
$page_title = htmlspecialchars(dirtify_page_id($c_page_id));
+ − 605
}
+ − 606
$parser->assign_vars(array(
+ − 607
'CLASS' => $class,
+ − 608
'PAGE_LINK' => makeUrlNS($comment['namespace'], sanitize_page_id($comment['page_id'])),
+ − 609
'PAGE' => $page_title,
+ − 610
'SUBJECT' => $comment['subject'],
+ − 611
'DATE' => $comment['time'],
+ − 612
'COMMENT_LINK' => makeUrlNS($comment['namespace'], sanitize_page_id($comment['page_id']), 'do=comments', true)
+ − 613
));
+ − 614
$class = ( $class == 'row3' ) ? 'row1' : 'row3';
+ − 615
echo $parser->run();
+ − 616
}
+ − 617
}
+ − 618
else
+ − 619
{
+ − 620
echo '<tr><td class="' . $class . '">This user has not posted any comments.</td></tr>';
+ − 621
}
+ − 622
echo '</table>';
+ − 623
+ − 624
echo '</div>';
+ − 625
echo '</td></tr>';
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 626
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 627
echo ' </table>
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 628
</div>';
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 629
22
+ − 630
echo '</td><td valign="top" style="padding: 0 10px;">';
+ − 631
+ − 632
else:
+ − 633
+ − 634
// Nothing for now
+ − 635
+ − 636
endif;
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 637
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 638
// User's own content
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 639
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 640
$send_headers = $this->send_headers;
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 641
$this->send_headers = false;
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 642
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 643
if ( $this->page_exists )
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 644
{
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 645
$this->render();
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 646
}
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 647
else
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 648
{
22
+ − 649
$this->err_page_not_existent(true);
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 650
}
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 651
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 652
// Right sidebar
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 653
22
+ − 654
if ( $user_exists ):
+ − 655
+ − 656
echo '</td><td style="width: 150px;" valign="top">';
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 657
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 658
echo '<div class="tblholder">
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 659
<table border="0" cellspacing="1" cellpadding="4">';
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 660
22
+ − 661
//
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 662
// Main part of sidebar
22
+ − 663
//
+ − 664
+ − 665
// Contact information
+ − 666
+ − 667
echo '<tr><th class="subhead">Get in touch</th></tr>';
+ − 668
+ − 669
$class = 'row3';
+ − 670
+ − 671
if ( $userdata['email_public'] == 1 )
+ − 672
{
+ − 673
$class = ( $class == 'row1' ) ? 'row3' : 'row1';
+ − 674
global $email;
+ − 675
$email_link = $email->encryptEmail($userdata['email']);
+ − 676
echo '<tr><td class="'.$class.'">E-mail address: ' . $email_link . '</td></tr>';
+ − 677
}
+ − 678
+ − 679
$class = ( $class == 'row1' ) ? 'row3' : 'row1';
+ − 680
if ( $session->user_logged_in )
+ − 681
{
+ − 682
echo '<tr><td class="'.$class.'">Send ' . htmlspecialchars($target_username) . ' a <a href="' . makeUrlNS('Special', 'PrivateMessages/Compose/to/' . $this->page_id, false, true) . '">Private Message</a>!</td></tr>';
+ − 683
}
+ − 684
else
+ − 685
{
+ − 686
echo '<tr><td class="'.$class.'">You could send ' . htmlspecialchars($target_username) . ' a private message if you were <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist[$this->namespace] . $this->page_id) . '">logged in</a>.</td></tr>';
+ − 687
}
+ − 688
+ − 689
if ( !empty($userdata['user_aim']) )
+ − 690
{
+ − 691
$class = ( $class == 'row1' ) ? 'row3' : 'row1';
+ − 692
echo '<tr><td class="'.$class.'">AIM: ' . htmlspecialchars($userdata['user_aim']) . '</td></tr>';
+ − 693
}
+ − 694
+ − 695
if ( !empty($userdata['user_yahoo']) )
+ − 696
{
+ − 697
$class = ( $class == 'row1' ) ? 'row3' : 'row1';
+ − 698
echo '<tr><td class="'.$class.'">Yahoo! IM: ' . htmlspecialchars($userdata['user_yahoo']) . '</td></tr>';
+ − 699
}
+ − 700
+ − 701
if ( !empty($userdata['user_msn']) )
+ − 702
{
+ − 703
$class = ( $class == 'row1' ) ? 'row3' : 'row1';
+ − 704
$email_link = $email->encryptEmail($userdata['user_msn']);
+ − 705
echo '<tr><td class="'.$class.'">WLM: ' . $email_link . '</td></tr>';
+ − 706
}
+ − 707
+ − 708
if ( !empty($userdata['user_xmpp']) )
+ − 709
{
+ − 710
$class = ( $class == 'row1' ) ? 'row3' : 'row1';
+ − 711
$email_link = $email->encryptEmail($userdata['user_xmpp']);
+ − 712
echo '<tr><td class="'.$class.'">XMPP/Jabber: ' . $email_link . '</td></tr>';
+ − 713
}
+ − 714
+ − 715
// Real life
+ − 716
+ − 717
echo '<tr><th class="subhead">' . htmlspecialchars($target_username) . ' in real life</th></tr>';
+ − 718
+ − 719
if ( !empty($userdata['user_location']) )
+ − 720
{
+ − 721
$class = ( $class == 'row1' ) ? 'row3' : 'row1';
+ − 722
echo '<tr><td class="'.$class.'">Location: ' . htmlspecialchars($userdata['user_location']) . '</td></tr>';
+ − 723
}
+ − 724
+ − 725
if ( !empty($userdata['user_job']) )
+ − 726
{
+ − 727
$class = ( $class == 'row1' ) ? 'row3' : 'row1';
+ − 728
echo '<tr><td class="'.$class.'">Job/occupation: ' . htmlspecialchars($userdata['user_job']) . '</td></tr>';
+ − 729
}
+ − 730
+ − 731
if ( !empty($userdata['user_hobbies']) )
+ − 732
{
+ − 733
$class = ( $class == 'row1' ) ? 'row3' : 'row1';
+ − 734
echo '<tr><td class="'.$class.'">Enjoys: ' . htmlspecialchars($userdata['user_hobbies']) . '</td></tr>';
+ − 735
}
+ − 736
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 737
echo ' </table>
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 738
</div>';
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 739
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 740
echo '</tr></table>';
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 741
22
+ − 742
else:
+ − 743
+ − 744
echo '<p>Additional information: user "' . htmlspecialchars($target_username) . '" does not exist.</p>';
+ − 745
+ − 746
endif;
+ − 747
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 748
// if ( $send_headers )
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 749
// {
22
+ − 750
// display_page_footers();
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 751
// }
16
+ − 752
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 753
$this->send_headers = $send_headers;
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 754
unset($send_headers);
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 755
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 756
$this->footer();
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 757
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 758
}
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 759
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 760
/**
1
+ − 761
* Send the error message to the user that the access to this page is denied.
+ − 762
* @access private
+ − 763
*/
+ − 764
+ − 765
function err_access_denied()
+ − 766
{
+ − 767
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 768
+ − 769
$ob = '';
+ − 770
$template->tpl_strings['PAGE_NAME'] = 'Access denied';
+ − 771
+ − 772
if ( $this->send_headers )
+ − 773
{
+ − 774
$ob .= $template->getHeader();
+ − 775
}
+ − 776
+ − 777
$ob .= '<div class="error-box"><b>Access to this page is denied.</b><br />This may be because you are not logged in or you have not met certain criteria for viewing this page.</div>';
+ − 778
+ − 779
if ( $this->send_headers )
+ − 780
{
+ − 781
$ob .= $template->getFooter();
+ − 782
}
+ − 783
echo $ob;
+ − 784
}
+ − 785
+ − 786
/**
+ − 787
* Send the error message to the user complaining that there weren't any rows.
+ − 788
* @access private
+ − 789
*/
+ − 790
+ − 791
function err_no_rows()
+ − 792
{
+ − 793
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 794
+ − 795
$title = 'No text rows';
+ − 796
$message = 'While the page\'s existence was verified, there were no rows in the database that matched the query for the text. This may indicate a bug with the software; ask the webmaster for more information. The offending query was:<pre>' . $db->latest_query . '</pre>';
+ − 797
if ( $this->send_headers )
+ − 798
{
+ − 799
$template->tpl_strings['PAGE_NAME'] = $title;
+ − 800
$template->header();
+ − 801
echo "<p>$message</p>";
+ − 802
$template->footer();
+ − 803
}
+ − 804
else
+ − 805
{
+ − 806
echo "<h2>$title</h2>
+ − 807
<p>$message</p>";
+ − 808
}
+ − 809
}
+ − 810
+ − 811
/**
+ − 812
* Tell the user the page doesn't exist, and present them with their options.
+ − 813
* @access private
+ − 814
*/
+ − 815
22
+ − 816
function err_page_not_existent($userpage = false)
1
+ − 817
{
+ − 818
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 819
+ − 820
$this->header();
+ − 821
header('HTTP/1.1 404 Not Found');
22
+ − 822
if ( $userpage )
+ − 823
{
+ − 824
echo '<h3>There is no page with this title yet.</h3>
+ − 825
<p>This user has not created his or her user page yet.';
+ − 826
}
+ − 827
else
+ − 828
{
+ − 829
echo '<h3>There is no page with this title yet.</h3>
+ − 830
<p>You have requested a page that doesn\'t exist yet.';
+ − 831
}
1
+ − 832
if ( $session->get_permissions('create_page') )
+ − 833
{
+ − 834
echo ' You can <a href="'.makeUrlNS($this->namespace, $this->page_id, 'do=edit', true).'" onclick="ajaxEditor(); return false;">create this page</a>, or return to the <a href="'.makeUrl(getConfig('main_page')).'">homepage</a>.';
+ − 835
}
+ − 836
else
+ − 837
{
+ − 838
echo ' Return to the <a href="'.makeUrl(getConfig('main_page')).'">homepage</a>.</p>';
+ − 839
}
+ − 840
if ( $session->get_permissions('history_rollback') )
+ − 841
{
+ − 842
$e = $db->sql_query('SELECT * FROM ' . table_prefix . 'logs WHERE action=\'delete\' AND page_id=\'' . $this->page_id . '\' AND namespace=\'' . $this->namespace . '\' ORDER BY time_id DESC;');
+ − 843
if ( !$e )
+ − 844
{
+ − 845
$db->_die('The deletion log could not be selected.');
+ − 846
}
+ − 847
if ( $db->numrows() > 0 )
+ − 848
{
+ − 849
$r = $db->fetchrow();
+ − 850
echo '<p>This page also appears to have some log entries in the database - it seems that it was deleted on ' . $r['date_string'] . '. You can probably <a href="'.makeUrl($paths->page, 'do=rollback&id='.$r['time_id']).'" onclick="ajaxRollback(\''.$r['time_id'].'\'); return false;">roll back</a> the deletion.</p>';
+ − 851
}
+ − 852
$db->free_result();
+ − 853
}
+ − 854
echo '<p>
+ − 855
HTTP Error: 404 Not Found
+ − 856
</p>';
+ − 857
$this->footer();
+ − 858
}
+ − 859
+ − 860
/**
+ − 861
* PHP 4 constructor.
+ − 862
* @see PageProcessor::__construct()
+ − 863
*/
+ − 864
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 865
function PageProcessor( $page_id, $namespace, $revision_id = 0 )
1
+ − 866
{
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 867
$this->__construct($page_id, $namespace, $revision_id);
1
+ − 868
}
+ − 869
+ − 870
/**
21
663fcf528726
Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs
Dan
diff
changeset
+ − 871
* Send an error message and die. For debugging or critical technical errors only - nothing that would under normal circumstances be shown to the user.
1
+ − 872
* @var string Error message
+ − 873
* @var bool If true, send DBAL's debugging information as well
+ − 874
*/
+ − 875
+ − 876
function send_error($message, $sql = false)
+ − 877
{
+ − 878
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 879
+ − 880
$content = "<p>$message</p>";
+ − 881
$template->tpl_strings['PAGE_NAME'] = 'General error in page fetcher';
+ − 882
+ − 883
if ( $this->debug['works'] )
+ − 884
{
+ − 885
$content .= $this->debug['backtrace'];
+ − 886
}
+ − 887
+ − 888
header('HTTP/1.1 500 Internal Server Error');
+ − 889
+ − 890
$template->header();
+ − 891
echo $content;
+ − 892
$template->footer();
+ − 893
+ − 894
$db->close();
+ − 895
+ − 896
exit;
+ − 897
+ − 898
}
+ − 899
+ − 900
} // class PageProcessor
+ − 901
+ − 902
?>