62 die_friendly('Invalid action', '<p>The action "'.htmlspecialchars($_GET['do']).'" is not defined. Return to <a href="'.makeUrl($paths->page).'">viewing this page\'s text</a>.</p>'); |
62 die_friendly('Invalid action', '<p>The action "'.htmlspecialchars($_GET['do']).'" is not defined. Return to <a href="'.makeUrl($paths->page).'">viewing this page\'s text</a>.</p>'); |
63 break; |
63 break; |
64 case 'view': |
64 case 'view': |
65 // echo PageUtils::getpage($paths->page, true, ( (isset($_GET['oldid'])) ? $_GET['oldid'] : false )); |
65 // echo PageUtils::getpage($paths->page, true, ( (isset($_GET['oldid'])) ? $_GET['oldid'] : false )); |
66 $rev_id = ( (isset($_GET['oldid'])) ? intval($_GET['oldid']) : 0 ); |
66 $rev_id = ( (isset($_GET['oldid'])) ? intval($_GET['oldid']) : 0 ); |
67 $page = new PageProcessor( $paths->cpage['urlname_nons'], $paths->namespace, $rev_id ); |
67 $page = new PageProcessor( $paths->page_id, $paths->namespace, $rev_id ); |
68 $page->send_headers = true; |
68 $page->send_headers = true; |
69 $pagepass = ( isset($_REQUEST['pagepass']) ) ? sha1($_REQUEST['pagepass']) : ''; |
69 $pagepass = ( isset($_REQUEST['pagepass']) ) ? sha1($_REQUEST['pagepass']) : ''; |
70 $page->password = $pagepass; |
70 $page->password = $pagepass; |
71 $page->send(true); |
71 $page->send(true); |
72 break; |
72 break; |
77 { |
77 { |
78 case 'admin': |
78 case 'admin': |
79 default: |
79 default: |
80 $act = ( isset ($_GET['action']) ) ? $_GET['action'] : false; |
80 $act = ( isset ($_GET['action']) ) ? $_GET['action'] : false; |
81 $id = ( isset ($_GET['id']) ) ? intval($_GET['id']) : -1; |
81 $id = ( isset ($_GET['id']) ) ? intval($_GET['id']) : -1; |
82 echo PageUtils::comments_html($paths->cpage['urlname_nons'], $paths->namespace, $act, Array('id'=>$id)); |
82 echo PageUtils::comments_html($paths->page_id, $paths->namespace, $act, Array('id'=>$id)); |
83 break; |
83 break; |
84 case 'postcomment': |
84 case 'postcomment': |
85 if(empty($_POST['name']) || |
85 if(empty($_POST['name']) || |
86 empty($_POST['subj']) || |
86 empty($_POST['subj']) || |
87 empty($_POST['text']) |
87 empty($_POST['text']) |
88 ) { echo 'Invalid request'; break; } |
88 ) { echo 'Invalid request'; break; } |
89 $cid = ( isset($_POST['captcha_id']) ) ? $_POST['captcha_id'] : false; |
89 $cid = ( isset($_POST['captcha_id']) ) ? $_POST['captcha_id'] : false; |
90 $cin = ( isset($_POST['captcha_input']) ) ? $_POST['captcha_input'] : false; |
90 $cin = ( isset($_POST['captcha_input']) ) ? $_POST['captcha_input'] : false; |
91 PageUtils::addcomment($paths->cpage['urlname_nons'], $paths->namespace, $_POST['name'], $_POST['subj'], $_POST['text'], $cin, $cid); // All filtering, etc. is handled inside this method |
91 PageUtils::addcomment($paths->page_id, $paths->namespace, $_POST['name'], $_POST['subj'], $_POST['text'], $cin, $cid); // All filtering, etc. is handled inside this method |
92 echo PageUtils::comments_html($paths->cpage['urlname_nons'], $paths->namespace); |
92 echo PageUtils::comments_html($paths->page_id, $paths->namespace); |
93 break; |
93 break; |
94 case 'editcomment': |
94 case 'editcomment': |
95 if(!isset($_GET['id']) || ( isset($_GET['id']) && !preg_match('#^([0-9]+)$#', $_GET['id']) )) { echo '<p>Invalid comment ID</p>'; break; } |
95 if(!isset($_GET['id']) || ( isset($_GET['id']) && !preg_match('#^([0-9]+)$#', $_GET['id']) )) { echo '<p>Invalid comment ID</p>'; break; } |
96 $q = $db->sql_query('SELECT subject,comment_data,comment_id FROM '.table_prefix.'comments WHERE comment_id='.$_GET['id']); |
96 $q = $db->sql_query('SELECT subject,comment_data,comment_id FROM '.table_prefix.'comments WHERE comment_id='.$_GET['id']); |
97 if(!$q) $db->_die('The comment data could not be selected.'); |
97 if(!$q) $db->_die('The comment data could not be selected.'); |
105 </table></div>"; |
105 </table></div>"; |
106 echo '</form>'; |
106 echo '</form>'; |
107 break; |
107 break; |
108 case 'savecomment': |
108 case 'savecomment': |
109 if(empty($_POST['subj']) || empty($_POST['text'])) { echo '<p>Invalid request</p>'; break; } |
109 if(empty($_POST['subj']) || empty($_POST['text'])) { echo '<p>Invalid request</p>'; break; } |
110 $r = PageUtils::savecomment_neater($paths->cpage['urlname_nons'], $paths->namespace, $_POST['subj'], $_POST['text'], (int)$_POST['id']); |
110 $r = PageUtils::savecomment_neater($paths->page_id, $paths->namespace, $_POST['subj'], $_POST['text'], (int)$_POST['id']); |
111 if($r != 'good') { echo "<pre>$r</pre>"; break; } |
111 if($r != 'good') { echo "<pre>$r</pre>"; break; } |
112 echo PageUtils::comments_html($paths->cpage['urlname_nons'], $paths->namespace); |
112 echo PageUtils::comments_html($paths->page_id, $paths->namespace); |
113 break; |
113 break; |
114 case 'deletecomment': |
114 case 'deletecomment': |
115 if(!empty($_GET['id'])) |
115 if(!empty($_GET['id'])) |
116 { |
116 { |
117 PageUtils::deletecomment_neater($paths->cpage['urlname_nons'], $paths->namespace, (int)$_GET['id']); |
117 PageUtils::deletecomment_neater($paths->page_id, $paths->namespace, (int)$_GET['id']); |
118 } |
118 } |
119 echo PageUtils::comments_html($paths->cpage['urlname_nons'], $paths->namespace); |
119 echo PageUtils::comments_html($paths->page_id, $paths->namespace); |
120 break; |
120 break; |
121 } |
121 } |
122 $template->footer(); |
122 $template->footer(); |
123 break; |
123 break; |
124 case 'edit': |
124 case 'edit': |
127 redirect(makeUrl($paths->page), '', '', 0); |
127 redirect(makeUrl($paths->page), '', '', 0); |
128 break; |
128 break; |
129 } |
129 } |
130 if(isset($_POST['_save'])) |
130 if(isset($_POST['_save'])) |
131 { |
131 { |
132 $e = PageUtils::savepage($paths->cpage['urlname_nons'], $paths->namespace, $_POST['page_text'], $_POST['edit_summary'], isset($_POST['minor'])); |
132 $e = PageUtils::savepage($paths->page_id, $paths->namespace, $_POST['page_text'], $_POST['edit_summary'], isset($_POST['minor'])); |
133 if ( $e == 'good' ) |
133 if ( $e == 'good' ) |
134 { |
134 { |
135 redirect(makeUrl($paths->page), 'Changes saved', 'Your changes to this page have been saved. Redirecting...', 3); |
135 redirect(makeUrl($paths->page), 'Changes saved', 'Your changes to this page have been saved. Redirecting...', 3); |
136 } |
136 } |
137 } |
137 } |
139 if(isset($_POST['_preview'])) |
139 if(isset($_POST['_preview'])) |
140 { |
140 { |
141 $text = $_POST['page_text']; |
141 $text = $_POST['page_text']; |
142 echo PageUtils::genPreview($_POST['page_text']); |
142 echo PageUtils::genPreview($_POST['page_text']); |
143 } |
143 } |
144 else $text = RenderMan::getPage($paths->cpage['urlname_nons'], $paths->namespace, 0, false, false, false, false); |
144 else $text = RenderMan::getPage($paths->page_id, $paths->namespace, 0, false, false, false, false); |
145 echo ' |
145 echo ' |
146 <form action="'.makeUrl($paths->page, 'do=edit').'" method="post" enctype="multipart/form-data"> |
146 <form action="'.makeUrl($paths->page, 'do=edit').'" method="post" enctype="multipart/form-data"> |
147 <br /> |
147 <br /> |
148 <textarea name="page_text" rows="20" cols="60" style="width: 97%;">'.$text.'</textarea><br /> |
148 <textarea name="page_text" rows="20" cols="60" style="width: 97%;">'.$text.'</textarea><br /> |
149 <br /> |
149 <br /> |
164 } |
164 } |
165 $template->footer(); |
165 $template->footer(); |
166 break; |
166 break; |
167 case 'viewsource': |
167 case 'viewsource': |
168 $template->header(); |
168 $template->header(); |
169 $text = RenderMan::getPage($paths->cpage['urlname_nons'], $paths->namespace, 0, false, false, false, false); |
169 $text = RenderMan::getPage($paths->page_id, $paths->namespace, 0, false, false, false, false); |
170 echo ' |
170 echo ' |
171 <form action="'.makeUrl($paths->page, 'do=edit').'" method="post"> |
171 <form action="'.makeUrl($paths->page, 'do=edit').'" method="post"> |
172 <br /> |
172 <br /> |
173 <textarea readonly="readonly" name="page_text" rows="20" cols="60" style="width: 97%;">'.$text.'</textarea>'; |
173 <textarea readonly="readonly" name="page_text" rows="20" cols="60" style="width: 97%;">'.$text.'</textarea>'; |
174 echo '<br /> |
174 echo '<br /> |
193 break; |
193 break; |
194 case 'catedit': |
194 case 'catedit': |
195 if(isset($_POST['__enanoSaveButton'])) |
195 if(isset($_POST['__enanoSaveButton'])) |
196 { |
196 { |
197 unset($_POST['__enanoSaveButton']); |
197 unset($_POST['__enanoSaveButton']); |
198 $val = PageUtils::catsave($paths->cpage['urlname_nons'], $paths->namespace, $_POST); |
198 $val = PageUtils::catsave($paths->page_id, $paths->namespace, $_POST); |
199 if($val == 'GOOD') |
199 if($val == 'GOOD') |
200 { |
200 { |
201 header('Location: '.makeUrl($paths->page)); echo '<html><head><title>Redirecting...</title></head><body>If you haven\'t been redirected yet, <a href="'.makeUrl($paths->page).'">click here</a>.'; break; |
201 header('Location: '.makeUrl($paths->page)); echo '<html><head><title>Redirecting...</title></head><body>If you haven\'t been redirected yet, <a href="'.makeUrl($paths->page).'">click here</a>.'; break; |
202 } else { |
202 } else { |
203 die_friendly('Error saving category information', '<p>'.$val.'</p>'); |
203 die_friendly('Error saving category information', '<p>'.$val.'</p>'); |
206 elseif(isset($_POST['__enanoCatCancel'])) |
206 elseif(isset($_POST['__enanoCatCancel'])) |
207 { |
207 { |
208 header('Location: '.makeUrl($paths->page)); echo '<html><head><title>Redirecting...</title></head><body>If you haven\'t been redirected yet, <a href="'.makeUrl($paths->page).'">click here</a>.'; break; |
208 header('Location: '.makeUrl($paths->page)); echo '<html><head><title>Redirecting...</title></head><body>If you haven\'t been redirected yet, <a href="'.makeUrl($paths->page).'">click here</a>.'; break; |
209 } |
209 } |
210 $template->header(); |
210 $template->header(); |
211 $c = PageUtils::catedit_raw($paths->cpage['urlname_nons'], $paths->namespace); |
211 $c = PageUtils::catedit_raw($paths->page_id, $paths->namespace); |
212 echo $c[1]; |
212 echo $c[1]; |
213 $template->footer(); |
213 $template->footer(); |
214 break; |
214 break; |
215 case 'moreoptions': |
215 case 'moreoptions': |
216 $template->header(); |
216 $template->header(); |
220 case 'protect': |
220 case 'protect': |
221 if (!isset($_REQUEST['level'])) die_friendly('Invalid request', '<p>No protection level specified</p>'); |
221 if (!isset($_REQUEST['level'])) die_friendly('Invalid request', '<p>No protection level specified</p>'); |
222 if(!empty($_POST['reason'])) |
222 if(!empty($_POST['reason'])) |
223 { |
223 { |
224 if(!preg_match('#^([0-2]*){1}$#', $_POST['level'])) die_friendly('Error protecting page', '<p>Request validation failed</p>'); |
224 if(!preg_match('#^([0-2]*){1}$#', $_POST['level'])) die_friendly('Error protecting page', '<p>Request validation failed</p>'); |
225 PageUtils::protect($paths->cpage['urlname_nons'], $paths->namespace, intval($_POST['level']), $_POST['reason']); |
225 PageUtils::protect($paths->page_id, $paths->namespace, intval($_POST['level']), $_POST['reason']); |
226 die_friendly('Page protected', '<p>The protection setting has been applied. <a href="'.makeUrl($paths->page).'">Return to the page</a>.</p>'); |
226 die_friendly('Page protected', '<p>The protection setting has been applied. <a href="'.makeUrl($paths->page).'">Return to the page</a>.</p>'); |
227 } |
227 } |
228 $template->header(); |
228 $template->header(); |
229 ?> |
229 ?> |
230 <form action="<?php echo makeUrl($paths->page, 'do=protect'); ?>" method="post"> |
230 <form action="<?php echo makeUrl($paths->page, 'do=protect'); ?>" method="post"> |
254 $template->footer(); |
254 $template->footer(); |
255 break; |
255 break; |
256 case 'rename': |
256 case 'rename': |
257 if(!empty($_POST['newname'])) |
257 if(!empty($_POST['newname'])) |
258 { |
258 { |
259 $r = PageUtils::rename($paths->cpage['urlname_nons'], $paths->namespace, $_POST['newname']); |
259 $r = PageUtils::rename($paths->page_id, $paths->namespace, $_POST['newname']); |
260 die_friendly('Page renamed', '<p>'.nl2br($r).' <a href="'.makeUrl($paths->page).'">Return to the page</a>.</p>'); |
260 die_friendly('Page renamed', '<p>'.nl2br($r).' <a href="'.makeUrl($paths->page).'">Return to the page</a>.</p>'); |
261 } |
261 } |
262 $template->header(); |
262 $template->header(); |
263 ?> |
263 ?> |
264 <form action="<?php echo makeUrl($paths->page, 'do=rename'); ?>" method="post"> |
264 <form action="<?php echo makeUrl($paths->page, 'do=rename'); ?>" method="post"> |
273 case 'flushlogs': |
273 case 'flushlogs': |
274 if(!$session->get_permissions('clear_logs')) die_friendly('Access denied', '<p>Flushing the logs for a page <u>requires</u> administrative rights.</p>'); |
274 if(!$session->get_permissions('clear_logs')) die_friendly('Access denied', '<p>Flushing the logs for a page <u>requires</u> administrative rights.</p>'); |
275 if(isset($_POST['_downthejohn'])) |
275 if(isset($_POST['_downthejohn'])) |
276 { |
276 { |
277 $template->header(); |
277 $template->header(); |
278 $result = PageUtils::flushlogs($paths->cpage['urlname_nons'], $paths->namespace); |
278 $result = PageUtils::flushlogs($paths->page_id, $paths->namespace); |
279 echo '<p>'.$result.' <a href="'.makeUrl($paths->page).'">Return to the page</a>.</p>'; |
279 echo '<p>'.$result.' <a href="'.makeUrl($paths->page).'">Return to the page</a>.</p>'; |
280 $template->footer(); |
280 $template->footer(); |
281 break; |
281 break; |
282 } |
282 } |
283 $template->header(); |
283 $template->header(); |
318 case 'resetvotes': |
318 case 'resetvotes': |
319 if(!$session->get_permissions('vote_reset')) die_friendly('Access denied', '<p>Resetting the deletion votes against this page <u>requires</u> admin rights.</p>'); |
319 if(!$session->get_permissions('vote_reset')) die_friendly('Access denied', '<p>Resetting the deletion votes against this page <u>requires</u> admin rights.</p>'); |
320 if(isset($_POST['_youmaylivealittlelonger'])) |
320 if(isset($_POST['_youmaylivealittlelonger'])) |
321 { |
321 { |
322 $template->header(); |
322 $template->header(); |
323 $result = PageUtils::resetdelvotes($paths->cpage['urlname_nons'], $paths->namespace); |
323 $result = PageUtils::resetdelvotes($paths->page_id, $paths->namespace); |
324 echo '<p>'.$result.' <a href="'.makeUrl($paths->page).'">Return to the page</a>.</p>'; |
324 echo '<p>'.$result.' <a href="'.makeUrl($paths->page).'">Return to the page</a>.</p>'; |
325 $template->footer(); |
325 $template->footer(); |
326 break; |
326 break; |
327 } |
327 } |
328 $template->header(); |
328 $template->header(); |
342 if ( empty($reason) ) |
342 if ( empty($reason) ) |
343 $error = 'Please enter a reason for deleting this page.'; |
343 $error = 'Please enter a reason for deleting this page.'; |
344 else |
344 else |
345 { |
345 { |
346 $template->header(); |
346 $template->header(); |
347 $result = PageUtils::deletepage($paths->cpage['urlname_nons'], $paths->namespace, $reason); |
347 $result = PageUtils::deletepage($paths->page_id, $paths->namespace, $reason); |
348 echo '<p>'.$result.' <a href="'.makeUrl($paths->page).'">Return to the page</a>.</p>'; |
348 echo '<p>'.$result.' <a href="'.makeUrl($paths->page).'">Return to the page</a>.</p>'; |
349 $template->footer(); |
349 $template->footer(); |
350 break; |
350 break; |
351 } |
351 } |
352 } |
352 } |
371 $level = intval($_POST['level']); |
371 $level = intval($_POST['level']); |
372 if ( !in_array($level, array(0, 1, 2) ) ) |
372 if ( !in_array($level, array(0, 1, 2) ) ) |
373 { |
373 { |
374 die_friendly('Invalid request', '<p>Level not specified</p>'); |
374 die_friendly('Invalid request', '<p>Level not specified</p>'); |
375 } |
375 } |
376 $q = $db->sql_query('UPDATE '.table_prefix.'pages SET wiki_mode=' . $level . ' WHERE urlname=\'' . $db->escape($paths->cpage['urlname_nons']) . '\' AND namespace=\'' . $paths->namespace . '\';'); |
376 $q = $db->sql_query('UPDATE '.table_prefix.'pages SET wiki_mode=' . $level . ' WHERE urlname=\'' . $db->escape($paths->page_id) . '\' AND namespace=\'' . $paths->namespace . '\';'); |
377 if ( !$q ) |
377 if ( !$q ) |
378 $db->_die(); |
378 $db->_die(); |
379 redirect(makeUrl($paths->page), htmlspecialchars($paths->cpage['name']), 'Wiki mode for this page has been set. Redirecting you to the page...', 2); |
379 redirect(makeUrl($paths->page), htmlspecialchars($paths->cpage['name']), 'Wiki mode for this page has been set. Redirecting you to the page...', 2); |
380 } |
380 } |
381 else |
381 else |
411 $id1 = ( isset($_GET['diff1']) ) ? (int)$_GET['diff1'] : false; |
411 $id1 = ( isset($_GET['diff1']) ) ? (int)$_GET['diff1'] : false; |
412 $id2 = ( isset($_GET['diff2']) ) ? (int)$_GET['diff2'] : false; |
412 $id2 = ( isset($_GET['diff2']) ) ? (int)$_GET['diff2'] : false; |
413 if(!$id1 || !$id2) { echo '<p>Invalid request.</p>'; $template->footer(); break; } |
413 if(!$id1 || !$id2) { echo '<p>Invalid request.</p>'; $template->footer(); break; } |
414 if(!preg_match('#^([0-9]+)$#', (string)$_GET['diff1']) || |
414 if(!preg_match('#^([0-9]+)$#', (string)$_GET['diff1']) || |
415 !preg_match('#^([0-9]+)$#', (string)$_GET['diff2'] )) { echo '<p>SQL injection attempt</p>'; $template->footer(); break; } |
415 !preg_match('#^([0-9]+)$#', (string)$_GET['diff2'] )) { echo '<p>SQL injection attempt</p>'; $template->footer(); break; } |
416 echo PageUtils::pagediff($paths->cpage['urlname_nons'], $paths->namespace, $id1, $id2); |
416 echo PageUtils::pagediff($paths->page_id, $paths->namespace, $id1, $id2); |
417 $template->footer(); |
417 $template->footer(); |
418 break; |
418 break; |
419 case 'detag': |
419 case 'detag': |
420 if ( $session->user_level < USER_LEVEL_ADMIN ) |
420 if ( $session->user_level < USER_LEVEL_ADMIN ) |
421 { |
421 { |
423 } |
423 } |
424 if ( $paths->page_exists ) |
424 if ( $paths->page_exists ) |
425 { |
425 { |
426 die_friendly('Invalid request', '<p>The detag action is only valid for pages that have been deleted in the past.</p>'); |
426 die_friendly('Invalid request', '<p>The detag action is only valid for pages that have been deleted in the past.</p>'); |
427 } |
427 } |
428 $q = $db->sql_query('DELETE FROM '.table_prefix.'tags WHERE page_id=\'' . $db->escape($paths->cpage['urlname_nons']) . '\' AND namespace=\'' . $paths->namespace . '\';'); |
428 $q = $db->sql_query('DELETE FROM '.table_prefix.'tags WHERE page_id=\'' . $db->escape($paths->page_id) . '\' AND namespace=\'' . $paths->namespace . '\';'); |
429 if ( !$q ) |
429 if ( !$q ) |
430 $db->_die('Detag query, index.php:'.__LINE__); |
430 $db->_die('Detag query, index.php:'.__LINE__); |
431 die_friendly('Page detagged', '<p>All stale tags have been removed from this page.</p>'); |
431 die_friendly('Page detagged', '<p>All stale tags have been removed from this page.</p>'); |
432 break; |
432 break; |
433 case 'aclmanager': |
433 case 'aclmanager': |
434 $data = ( isset($_POST['data']) ) ? $_POST['data'] : Array('mode' => 'listgroups'); |
434 $data = ( isset($_POST['data']) ) ? $_POST['data'] : Array('mode' => 'listgroups'); |
435 PageUtils::aclmanager($data); |
435 PageUtils::aclmanager($data); |
436 break; |
436 break; |
437 case 'sql_report': |
437 case 'sql_report': |
438 $rev_id = ( (isset($_GET['oldid'])) ? intval($_GET['oldid']) : 0 ); |
438 $rev_id = ( (isset($_GET['oldid'])) ? intval($_GET['oldid']) : 0 ); |
439 $page = new PageProcessor( $paths->cpage['urlname_nons'], $paths->namespace, $rev_id ); |
439 $page = new PageProcessor( $paths->page_id, $paths->namespace, $rev_id ); |
440 $page->send_headers = true; |
440 $page->send_headers = true; |
441 $pagepass = ( isset($_REQUEST['pagepass']) ) ? sha1($_REQUEST['pagepass']) : ''; |
441 $pagepass = ( isset($_REQUEST['pagepass']) ) ? sha1($_REQUEST['pagepass']) : ''; |
442 $page->password = $pagepass; |
442 $page->password = $pagepass; |
443 $page->send(true); |
443 $page->send(true); |
444 ob_end_clean(); |
444 ob_end_clean(); |