62 die_friendly('Invalid action', '<p>The action "'.htmlspecialchars($_GET['do']).'" is not defined. Return to <a href="'.makeUrl($paths->page).'">viewing this page\'s text</a>.</p>'); |
62 die_friendly('Invalid action', '<p>The action "'.htmlspecialchars($_GET['do']).'" is not defined. Return to <a href="'.makeUrl($paths->page).'">viewing this page\'s text</a>.</p>'); |
63 break; |
63 break; |
64 case 'view': |
64 case 'view': |
65 // echo PageUtils::getpage($paths->page, true, ( (isset($_GET['oldid'])) ? $_GET['oldid'] : false )); |
65 // echo PageUtils::getpage($paths->page, true, ( (isset($_GET['oldid'])) ? $_GET['oldid'] : false )); |
66 $rev_id = ( (isset($_GET['oldid'])) ? intval($_GET['oldid']) : 0 ); |
66 $rev_id = ( (isset($_GET['oldid'])) ? intval($_GET['oldid']) : 0 ); |
67 $page = new PageProcessor( $paths->cpage['urlname_nons'], $paths->namespace, $rev_id ); |
67 $page = new PageProcessor( $paths->page_id, $paths->namespace, $rev_id ); |
68 $page->send_headers = true; |
68 $page->send_headers = true; |
69 $pagepass = ( isset($_REQUEST['pagepass']) ) ? sha1($_REQUEST['pagepass']) : ''; |
69 $pagepass = ( isset($_REQUEST['pagepass']) ) ? sha1($_REQUEST['pagepass']) : ''; |
70 $page->password = $pagepass; |
70 $page->password = $pagepass; |
71 $page->send(true); |
71 $page->send(true); |
72 break; |
72 break; |
77 { |
77 { |
78 case 'admin': |
78 case 'admin': |
79 default: |
79 default: |
80 $act = ( isset ($_GET['action']) ) ? $_GET['action'] : false; |
80 $act = ( isset ($_GET['action']) ) ? $_GET['action'] : false; |
81 $id = ( isset ($_GET['id']) ) ? intval($_GET['id']) : -1; |
81 $id = ( isset ($_GET['id']) ) ? intval($_GET['id']) : -1; |
82 echo PageUtils::comments_html($paths->cpage['urlname_nons'], $paths->namespace, $act, Array('id'=>$id)); |
82 echo PageUtils::comments_html($paths->page_id, $paths->namespace, $act, Array('id'=>$id)); |
83 break; |
83 break; |
84 case 'postcomment': |
84 case 'postcomment': |
85 if(empty($_POST['name']) || |
85 if(empty($_POST['name']) || |
86 empty($_POST['subj']) || |
86 empty($_POST['subj']) || |
87 empty($_POST['text']) |
87 empty($_POST['text']) |
88 ) { echo 'Invalid request'; break; } |
88 ) { echo 'Invalid request'; break; } |
89 $cid = ( isset($_POST['captcha_id']) ) ? $_POST['captcha_id'] : false; |
89 $cid = ( isset($_POST['captcha_id']) ) ? $_POST['captcha_id'] : false; |
90 $cin = ( isset($_POST['captcha_input']) ) ? $_POST['captcha_input'] : false; |
90 $cin = ( isset($_POST['captcha_input']) ) ? $_POST['captcha_input'] : false; |
91 PageUtils::addcomment($paths->cpage['urlname_nons'], $paths->namespace, $_POST['name'], $_POST['subj'], $_POST['text'], $cin, $cid); // All filtering, etc. is handled inside this method |
91 PageUtils::addcomment($paths->page_id, $paths->namespace, $_POST['name'], $_POST['subj'], $_POST['text'], $cin, $cid); // All filtering, etc. is handled inside this method |
92 echo PageUtils::comments_html($paths->cpage['urlname_nons'], $paths->namespace); |
92 echo PageUtils::comments_html($paths->page_id, $paths->namespace); |
93 break; |
93 break; |
94 case 'editcomment': |
94 case 'editcomment': |
95 if(!isset($_GET['id']) || ( isset($_GET['id']) && !preg_match('#^([0-9]+)$#', $_GET['id']) )) { echo '<p>Invalid comment ID</p>'; break; } |
95 if(!isset($_GET['id']) || ( isset($_GET['id']) && !preg_match('#^([0-9]+)$#', $_GET['id']) )) { echo '<p>Invalid comment ID</p>'; break; } |
96 $q = $db->sql_query('SELECT subject,comment_data,comment_id FROM '.table_prefix.'comments WHERE comment_id='.$_GET['id']); |
96 $q = $db->sql_query('SELECT subject,comment_data,comment_id FROM '.table_prefix.'comments WHERE comment_id='.$_GET['id']); |
97 if(!$q) $db->_die('The comment data could not be selected.'); |
97 if(!$q) $db->_die('The comment data could not be selected.'); |
106 </table></div>"; |
106 </table></div>"; |
107 echo '</form>'; |
107 echo '</form>'; |
108 break; |
108 break; |
109 case 'savecomment': |
109 case 'savecomment': |
110 if(empty($_POST['subj']) || empty($_POST['text'])) { echo '<p>Invalid request</p>'; break; } |
110 if(empty($_POST['subj']) || empty($_POST['text'])) { echo '<p>Invalid request</p>'; break; } |
111 $r = PageUtils::savecomment_neater($paths->cpage['urlname_nons'], $paths->namespace, $_POST['subj'], $_POST['text'], (int)$_POST['id']); |
111 $r = PageUtils::savecomment_neater($paths->page_id, $paths->namespace, $_POST['subj'], $_POST['text'], (int)$_POST['id']); |
112 if($r != 'good') { echo "<pre>$r</pre>"; break; } |
112 if($r != 'good') { echo "<pre>$r</pre>"; break; } |
113 echo PageUtils::comments_html($paths->cpage['urlname_nons'], $paths->namespace); |
113 echo PageUtils::comments_html($paths->page_id, $paths->namespace); |
114 break; |
114 break; |
115 case 'deletecomment': |
115 case 'deletecomment': |
116 if(!empty($_GET['id'])) |
116 if(!empty($_GET['id'])) |
117 { |
117 { |
118 PageUtils::deletecomment_neater($paths->cpage['urlname_nons'], $paths->namespace, (int)$_GET['id']); |
118 PageUtils::deletecomment_neater($paths->page_id, $paths->namespace, (int)$_GET['id']); |
119 } |
119 } |
120 echo PageUtils::comments_html($paths->cpage['urlname_nons'], $paths->namespace); |
120 echo PageUtils::comments_html($paths->page_id, $paths->namespace); |
121 break; |
121 break; |
122 } |
122 } |
123 $template->footer(); |
123 $template->footer(); |
124 break; |
124 break; |
125 case 'edit': |
125 case 'edit': |
128 redirect(makeUrl($paths->page), '', '', 0); |
128 redirect(makeUrl($paths->page), '', '', 0); |
129 break; |
129 break; |
130 } |
130 } |
131 if(isset($_POST['_save'])) |
131 if(isset($_POST['_save'])) |
132 { |
132 { |
133 $e = PageUtils::savepage($paths->cpage['urlname_nons'], $paths->namespace, $_POST['page_text'], $_POST['edit_summary'], isset($_POST['minor'])); |
133 $e = PageUtils::savepage($paths->page_id, $paths->namespace, $_POST['page_text'], $_POST['edit_summary'], isset($_POST['minor'])); |
134 if ( $e == 'good' ) |
134 if ( $e == 'good' ) |
135 { |
135 { |
136 redirect(makeUrl($paths->page), $lang->get('editor_msg_save_success_title'), $lang->get('editor_msg_save_success_body'), 3); |
136 redirect(makeUrl($paths->page), $lang->get('editor_msg_save_success_title'), $lang->get('editor_msg_save_success_body'), 3); |
137 } |
137 } |
138 } |
138 } |
169 } |
169 } |
170 $template->footer(); |
170 $template->footer(); |
171 break; |
171 break; |
172 case 'viewsource': |
172 case 'viewsource': |
173 $template->header(); |
173 $template->header(); |
174 $text = RenderMan::getPage($paths->cpage['urlname_nons'], $paths->namespace, 0, false, false, false, false); |
174 $text = RenderMan::getPage($paths->page_id, $paths->namespace, 0, false, false, false, false); |
175 echo ' |
175 echo ' |
176 <form action="'.makeUrl($paths->page, 'do=edit').'" method="post"> |
176 <form action="'.makeUrl($paths->page, 'do=edit').'" method="post"> |
177 <br /> |
177 <br /> |
178 <textarea readonly="readonly" name="page_text" rows="20" cols="60" style="width: 97%;">'.$text.'</textarea>'; |
178 <textarea readonly="readonly" name="page_text" rows="20" cols="60" style="width: 97%;">'.$text.'</textarea>'; |
179 echo '<br /> |
179 echo '<br /> |
198 break; |
198 break; |
199 case 'catedit': |
199 case 'catedit': |
200 if(isset($_POST['__enanoSaveButton'])) |
200 if(isset($_POST['__enanoSaveButton'])) |
201 { |
201 { |
202 unset($_POST['__enanoSaveButton']); |
202 unset($_POST['__enanoSaveButton']); |
203 $val = PageUtils::catsave($paths->cpage['urlname_nons'], $paths->namespace, $_POST); |
203 $val = PageUtils::catsave($paths->page_id, $paths->namespace, $_POST); |
204 if($val == 'GOOD') |
204 if($val == 'GOOD') |
205 { |
205 { |
206 header('Location: '.makeUrl($paths->page)); echo '<html><head><title>Redirecting...</title></head><body>If you haven\'t been redirected yet, <a href="'.makeUrl($paths->page).'">click here</a>.'; break; |
206 header('Location: '.makeUrl($paths->page)); echo '<html><head><title>Redirecting...</title></head><body>If you haven\'t been redirected yet, <a href="'.makeUrl($paths->page).'">click here</a>.'; break; |
207 } else { |
207 } else { |
208 die_friendly('Error saving category information', '<p>'.$val.'</p>'); |
208 die_friendly('Error saving category information', '<p>'.$val.'</p>'); |
211 elseif(isset($_POST['__enanoCatCancel'])) |
211 elseif(isset($_POST['__enanoCatCancel'])) |
212 { |
212 { |
213 header('Location: '.makeUrl($paths->page)); echo '<html><head><title>Redirecting...</title></head><body>If you haven\'t been redirected yet, <a href="'.makeUrl($paths->page).'">click here</a>.'; break; |
213 header('Location: '.makeUrl($paths->page)); echo '<html><head><title>Redirecting...</title></head><body>If you haven\'t been redirected yet, <a href="'.makeUrl($paths->page).'">click here</a>.'; break; |
214 } |
214 } |
215 $template->header(); |
215 $template->header(); |
216 $c = PageUtils::catedit_raw($paths->cpage['urlname_nons'], $paths->namespace); |
216 $c = PageUtils::catedit_raw($paths->page_id, $paths->namespace); |
217 echo $c[1]; |
217 echo $c[1]; |
218 $template->footer(); |
218 $template->footer(); |
219 break; |
219 break; |
220 case 'moreoptions': |
220 case 'moreoptions': |
221 $template->header(); |
221 $template->header(); |
225 case 'protect': |
225 case 'protect': |
226 if (!isset($_REQUEST['level'])) die_friendly('Invalid request', '<p>No protection level specified</p>'); |
226 if (!isset($_REQUEST['level'])) die_friendly('Invalid request', '<p>No protection level specified</p>'); |
227 if(!empty($_POST['reason'])) |
227 if(!empty($_POST['reason'])) |
228 { |
228 { |
229 if(!preg_match('#^([0-2]*){1}$#', $_POST['level'])) die_friendly('Error protecting page', '<p>Request validation failed</p>'); |
229 if(!preg_match('#^([0-2]*){1}$#', $_POST['level'])) die_friendly('Error protecting page', '<p>Request validation failed</p>'); |
230 PageUtils::protect($paths->cpage['urlname_nons'], $paths->namespace, intval($_POST['level']), $_POST['reason']); |
230 PageUtils::protect($paths->page_id, $paths->namespace, intval($_POST['level']), $_POST['reason']); |
231 |
231 |
232 die_friendly($lang->get('page_protect_lbl_success_title'), '<p>' . $lang->get('page_protect_lbl_success_body', array( 'page_link' => makeUrl($paths->page) )) . '</p>'); |
232 die_friendly($lang->get('page_protect_lbl_success_title'), '<p>' . $lang->get('page_protect_lbl_success_body', array( 'page_link' => makeUrl($paths->page) )) . '</p>'); |
233 } |
233 } |
234 $template->header(); |
234 $template->header(); |
235 ?> |
235 ?> |
260 $template->footer(); |
260 $template->footer(); |
261 break; |
261 break; |
262 case 'rename': |
262 case 'rename': |
263 if(!empty($_POST['newname'])) |
263 if(!empty($_POST['newname'])) |
264 { |
264 { |
265 $r = PageUtils::rename($paths->cpage['urlname_nons'], $paths->namespace, $_POST['newname']); |
265 $r = PageUtils::rename($paths->page_id, $paths->namespace, $_POST['newname']); |
266 die_friendly($lang->get('page_rename_success_title'), '<p>'.nl2br($r).' <a href="'.makeUrl($paths->page).'">' . $lang->get('etc_return_to_page') . '</a>.</p>'); |
266 die_friendly($lang->get('page_rename_success_title'), '<p>'.nl2br($r).' <a href="'.makeUrl($paths->page).'">' . $lang->get('etc_return_to_page') . '</a>.</p>'); |
267 } |
267 } |
268 $template->header(); |
268 $template->header(); |
269 ?> |
269 ?> |
270 <form action="<?php echo makeUrl($paths->page, 'do=rename'); ?>" method="post"> |
270 <form action="<?php echo makeUrl($paths->page, 'do=rename'); ?>" method="post"> |
282 die_friendly($lang->get('etc_access_denied_short'), '<p>' . $lang->get('etc_access_denied') . '</p>'); |
282 die_friendly($lang->get('etc_access_denied_short'), '<p>' . $lang->get('etc_access_denied') . '</p>'); |
283 } |
283 } |
284 if(isset($_POST['_downthejohn'])) |
284 if(isset($_POST['_downthejohn'])) |
285 { |
285 { |
286 $template->header(); |
286 $template->header(); |
287 $result = PageUtils::flushlogs($paths->cpage['urlname_nons'], $paths->namespace); |
287 $result = PageUtils::flushlogs($paths->page_id, $paths->namespace); |
288 echo '<p>'.$result.' <a href="'.makeUrl($paths->page).'">' . $lang->get('etc_return_to_page') . '</a>.</p>'; |
288 echo '<p>'.$result.' <a href="'.makeUrl($paths->page).'">' . $lang->get('etc_return_to_page') . '</a>.</p>'; |
289 $template->footer(); |
289 $template->footer(); |
290 break; |
290 break; |
291 } |
291 } |
292 $template->header(); |
292 $template->header(); |
332 die_friendly($lang->get('etc_access_denied_short'), '<p>' . $lang->get('etc_access_denied') . '</p>'); |
332 die_friendly($lang->get('etc_access_denied_short'), '<p>' . $lang->get('etc_access_denied') . '</p>'); |
333 } |
333 } |
334 if(isset($_POST['_youmaylivealittlelonger'])) |
334 if(isset($_POST['_youmaylivealittlelonger'])) |
335 { |
335 { |
336 $template->header(); |
336 $template->header(); |
337 $result = PageUtils::resetdelvotes($paths->cpage['urlname_nons'], $paths->namespace); |
337 $result = PageUtils::resetdelvotes($paths->page_id, $paths->namespace); |
338 echo '<p>'.$result.' <a href="'.makeUrl($paths->page).'">' . $lang->get('etc_return_to_page') . '</a>.</p>'; |
338 echo '<p>'.$result.' <a href="'.makeUrl($paths->page).'">' . $lang->get('etc_return_to_page') . '</a>.</p>'; |
339 $template->footer(); |
339 $template->footer(); |
340 break; |
340 break; |
341 } |
341 } |
342 $template->header(); |
342 $template->header(); |
359 if ( empty($reason) ) |
359 if ( empty($reason) ) |
360 $error = $lang->get('ajax_delete_prompt_reason'); |
360 $error = $lang->get('ajax_delete_prompt_reason'); |
361 else |
361 else |
362 { |
362 { |
363 $template->header(); |
363 $template->header(); |
364 $result = PageUtils::deletepage($paths->cpage['urlname_nons'], $paths->namespace, $reason); |
364 $result = PageUtils::deletepage($paths->page_id, $paths->namespace, $reason); |
365 echo '<p>'.$result.' <a href="'.makeUrl($paths->page).'">' . $lang->get('etc_return_to_page') . '</a>.</p>'; |
365 echo '<p>'.$result.' <a href="'.makeUrl($paths->page).'">' . $lang->get('etc_return_to_page') . '</a>.</p>'; |
366 $template->footer(); |
366 $template->footer(); |
367 break; |
367 break; |
368 } |
368 } |
369 } |
369 } |
388 $level = intval($_POST['level']); |
388 $level = intval($_POST['level']); |
389 if ( !in_array($level, array(0, 1, 2) ) ) |
389 if ( !in_array($level, array(0, 1, 2) ) ) |
390 { |
390 { |
391 die_friendly('Invalid request', '<p>Level not specified</p>'); |
391 die_friendly('Invalid request', '<p>Level not specified</p>'); |
392 } |
392 } |
393 $q = $db->sql_query('UPDATE '.table_prefix.'pages SET wiki_mode=' . $level . ' WHERE urlname=\'' . $db->escape($paths->cpage['urlname_nons']) . '\' AND namespace=\'' . $paths->namespace . '\';'); |
393 $q = $db->sql_query('UPDATE '.table_prefix.'pages SET wiki_mode=' . $level . ' WHERE urlname=\'' . $db->escape($paths->page_id) . '\' AND namespace=\'' . $paths->namespace . '\';'); |
394 if ( !$q ) |
394 if ( !$q ) |
395 $db->_die(); |
395 $db->_die(); |
396 redirect(makeUrl($paths->page), htmlspecialchars($paths->cpage['name']), $lang->get('page_wikimode_success_redirect'), 2); |
396 redirect(makeUrl($paths->page), htmlspecialchars($paths->cpage['name']), $lang->get('page_wikimode_success_redirect'), 2); |
397 } |
397 } |
398 else |
398 else |
424 $id1 = ( isset($_GET['diff1']) ) ? (int)$_GET['diff1'] : false; |
424 $id1 = ( isset($_GET['diff1']) ) ? (int)$_GET['diff1'] : false; |
425 $id2 = ( isset($_GET['diff2']) ) ? (int)$_GET['diff2'] : false; |
425 $id2 = ( isset($_GET['diff2']) ) ? (int)$_GET['diff2'] : false; |
426 if(!$id1 || !$id2) { echo '<p>Invalid request.</p>'; $template->footer(); break; } |
426 if(!$id1 || !$id2) { echo '<p>Invalid request.</p>'; $template->footer(); break; } |
427 if(!preg_match('#^([0-9]+)$#', (string)$_GET['diff1']) || |
427 if(!preg_match('#^([0-9]+)$#', (string)$_GET['diff1']) || |
428 !preg_match('#^([0-9]+)$#', (string)$_GET['diff2'] )) { echo '<p>SQL injection attempt</p>'; $template->footer(); break; } |
428 !preg_match('#^([0-9]+)$#', (string)$_GET['diff2'] )) { echo '<p>SQL injection attempt</p>'; $template->footer(); break; } |
429 echo PageUtils::pagediff($paths->cpage['urlname_nons'], $paths->namespace, $id1, $id2); |
429 echo PageUtils::pagediff($paths->page_id, $paths->namespace, $id1, $id2); |
430 $template->footer(); |
430 $template->footer(); |
431 break; |
431 break; |
432 case 'detag': |
432 case 'detag': |
433 if ( $session->user_level < USER_LEVEL_ADMIN ) |
433 if ( $session->user_level < USER_LEVEL_ADMIN ) |
434 { |
434 { |
436 } |
436 } |
437 if ( $paths->page_exists ) |
437 if ( $paths->page_exists ) |
438 { |
438 { |
439 die_friendly($lang->get('etc_invalid_request_short'), '<p>' . $lang->get('page_detag_err_page_exists') . '</p>'); |
439 die_friendly($lang->get('etc_invalid_request_short'), '<p>' . $lang->get('page_detag_err_page_exists') . '</p>'); |
440 } |
440 } |
441 $q = $db->sql_query('DELETE FROM '.table_prefix.'tags WHERE page_id=\'' . $db->escape($paths->cpage['urlname_nons']) . '\' AND namespace=\'' . $paths->namespace . '\';'); |
441 $q = $db->sql_query('DELETE FROM '.table_prefix.'tags WHERE page_id=\'' . $db->escape($paths->page_id) . '\' AND namespace=\'' . $paths->namespace . '\';'); |
442 if ( !$q ) |
442 if ( !$q ) |
443 $db->_die('Detag query, index.php:'.__LINE__); |
443 $db->_die('Detag query, index.php:'.__LINE__); |
444 die_friendly($lang->get('page_detag_success_title'), '<p>' . $lang->get('page_detag_success_body') . '</p>'); |
444 die_friendly($lang->get('page_detag_success_title'), '<p>' . $lang->get('page_detag_success_body') . '</p>'); |
445 break; |
445 break; |
446 case 'aclmanager': |
446 case 'aclmanager': |
447 $data = ( isset($_POST['data']) ) ? $_POST['data'] : Array('mode' => 'listgroups'); |
447 $data = ( isset($_POST['data']) ) ? $_POST['data'] : Array('mode' => 'listgroups'); |
448 PageUtils::aclmanager($data); |
448 PageUtils::aclmanager($data); |
449 break; |
449 break; |
450 case 'sql_report': |
450 case 'sql_report': |
451 $rev_id = ( (isset($_GET['oldid'])) ? intval($_GET['oldid']) : 0 ); |
451 $rev_id = ( (isset($_GET['oldid'])) ? intval($_GET['oldid']) : 0 ); |
452 $page = new PageProcessor( $paths->cpage['urlname_nons'], $paths->namespace, $rev_id ); |
452 $page = new PageProcessor( $paths->page_id, $paths->namespace, $rev_id ); |
453 $page->send_headers = true; |
453 $page->send_headers = true; |
454 $pagepass = ( isset($_REQUEST['pagepass']) ) ? sha1($_REQUEST['pagepass']) : ''; |
454 $pagepass = ( isset($_REQUEST['pagepass']) ) ? sha1($_REQUEST['pagepass']) : ''; |
455 $page->password = $pagepass; |
455 $page->password = $pagepass; |
456 $page->send(true); |
456 $page->send(true); |
457 ob_end_clean(); |
457 ob_end_clean(); |