Changeset 727 for trunk/phpbms

Timestamp:

01/07/10 11:16:05 (2 years ago)

Author:

brieb

Message:

• Added more rights look ups to certain pages
• Fixed several path disclosure errors

Location:

trunk/phpbms

Files:

• include/createmodifiedby.php (modified) (3 diffs)
• include/tables.php (modified) (1 diff)
• install/generateuuids.php (modified) (1 diff)
• modules/base/adminsettings_ajax.php (modified) (1 diff)
• modules/base/files_addedit.php (modified) (1 diff)
• modules/base/notes_addedit.php (modified) (2 diffs)
• modules/base/scheduler_delete_logs.php (modified) (1 diff)
• modules/base/scheduler_delete_tempimport.php (modified) (1 diff)
• modules/base/tabledefs_columns.php (modified) (1 diff)
• modules/base/tabledefs_custom.php (modified) (1 diff)
• modules/base/tabledefs_groupings.php (modified) (1 diff)
• modules/base/tabledefs_options.php (modified) (1 diff)
• modules/base/tabledefs_searchfields.php (modified) (1 diff)
• modules/recurringinvoices/scheduler_recurr.php (modified) (1 diff)
• report/report_class.php (modified) (1 diff)

trunk/phpbms/include/createmodifiedby.php

@@ +1 @@
+<?php if(isset($db) && isset($therecord)){?>
 <div id="createmodifiedby" >
         <div id="savecancel2"><?php showSaveCancel(2)?></div>
@@ -6 +7 @@
                                 <input name="createdby" type="hidden" value="<?php $therecord["createdby"] ?>" />
                                 <input name="creationdate" type="hidden" value="<?php echo formatFromSQLDatetime($therecord["creationdate"]) ?>"/>
-                                created                 
+                                created
                         </td>
                         <td><?php echo htmlQuotes($phpbms->getUserName($therecord["createdby"]))?></td>
@@ -23 +24 @@
         </table>
 </div>
+<?php }//endif ?>

trunk/phpbms/include/tables.php

@@ -822 +822 @@
                     case "save":
 
+                        if(!hasRights($this->editroleid))
+                            goURL(APP_PATH."noaccess.php");
+                            
                         $variables = $this->prepareVariables($_POST);
                         $errorArray = $this->verifyVariables($variables);

trunk/phpbms/install/generateuuids.php

@@ -667 +667 @@
 //==============================================================================
 
-if(!isset($noProcess)){
+if(!isset($noOutput)){
     $genUUIDS = new generateUUIDS();
     echo $genUUIDS->process();

trunk/phpbms/modules/base/adminsettings_ajax.php

@@ -97 +97 @@
 
 }//end class
-/*--[Processing]-------------------------------------------------------------*/
-/*---------------------------------------------------------------------------*/
-if(!isset($_GET["m"]))
-    exit;
-require_once("../../include/session.php");
 
-$checkUpdate = new checkUpdate($db);
-$response = array();
-if($checkUpdate->needUpdateCheck($_GET["m"])){
-    $response = $checkUpdate->checkForUpdate();
-}else{
-    $response["checked"] = false;
-    $response = json_encode($response);
-}//end if
 
-echo $response;
+/**
+ * Processing ==================================================================
+ */
+if(!isset($noOutput)){
+
+    require_once("../../include/session.php");
+
+    $db->errorFormat = "json";
+
+    if(!isset($_GET["m"]))
+        $error = new appError(200, "invalid passed paramaters", "", true, true, "json");
+
+    if(!$_SESSION["userinfo"]["admin"])
+        $error = new appError(970, "no rights to function", "", true, true, "json");
+
+    $checkUpdate = new checkUpdate($db);
+    $response = array();
+
+    if($checkUpdate->needUpdateCheck($_GET["m"]))
+        $response = $checkUpdate->checkForUpdate();
+    else{
+        $response["checked"] = false;
+        $response = json_encode($response);
+    }//end if
+
+    echo $response;
+
+}//endif
 ?>

trunk/phpbms/modules/base/files_addedit.php

@@ -60 +60 @@
 
         $therecord = $thetable->processAddEditPage();
+
+        if(!hasRights($therecord["roleid"]))
+            goURL("../../noaccess.php");
 
         if(isset($therecord["phpbmsStatus"]))

trunk/phpbms/modules/base/notes_addedit.php

@@ -37 +37 @@
  +-------------------------------------------------------------------------+
 */
-//var_dump($_POST);
-//exit;
+
         require_once("../../include/session.php");
         require_once("include/fields.php");
@@ -58 +57 @@
         $thetable = new notes($db, "tbld:a4cdd991-cf0a-916f-1240-49428ea1bdd1", $backurl);
         $therecord = $thetable->processAddEditPage();
+
+        if($therecord["private"] && $therecord["createdby"] != $_SESSION["userinfo"]["id"] && !$_SESSION["userinfo"]["admin"])
+            goURL("../../noaccess.php");
 
         if(isset($therecord["phpbmsStatus"]))

trunk/phpbms/modules/base/scheduler_delete_logs.php

@@ -48 +48 @@
 }//end class --cleanImports--
 
-if(!isset($noProcess)){
-        $clean = new cleanSysLog($db);
-        $clean->removeExcessLogs();
+if(!isset($noOutput) && isset($db)){
+
+    $clean = new cleanSysLog($db);
+    $clean->removeExcessLogs();
+
 }//end if
 ?>

trunk/phpbms/modules/base/scheduler_delete_tempimport.php

@@ -29 +29 @@
 }//end class --cleanImports--
 
-if(!isset($noProcess)){
-        $clean = new cleanImports($db);
-        $clean->removeTempCSV();
+if(!isset($noOutput) && isset($db)){
+
+    $clean = new cleanImports($db);
+    $clean->removeTempCSV();
+
 }//end if
 ?>

trunk/phpbms/modules/base/tabledefs_columns.php

@@ -47 +47 @@
 
         if(!isset($_GET["id"]))
-                $error = new appError(-200, "Passed parameter missing", "Invalid request", true);
+                $error = new appError(200, "Passed parameter missing", "Invalid request", true);
 
         $columns = new tableColumns($db, $_GET["id"]);

trunk/phpbms/modules/base/tabledefs_custom.php

@@ -45 +45 @@
         //Make sure table definition id is set
         if(!isset($_GET["id"]))
-            $error = new appError(300,"Passed variable not set (id)");
+            $error = new appError(200,"Passed variable not set");
+
+        if(!hasRights("Admin"))
+                goURL(APP_PATH."noaccess.php");
 
         $customFields = new customFields($db, ((int) $_GET["id"]));

trunk/phpbms/modules/base/tabledefs_groupings.php

@@ -43 +43 @@
         include("include/tablegroupings.php");
 
+        if(!hasRights("Admin"))
+                goURL(APP_PATH."noaccess.php");
+
+        if(!isset($_GET["id"]))
+                $error = new appError(-200, "Passed parameter missing", "Invalid request", true);
 
         //grab the table name

trunk/phpbms/modules/base/tabledefs_options.php

@@ -44 +44 @@
         if(!isset($_GET["id"]))
                 $error = new appError(100, "Passed Parameter not present.");
+
+        if(!hasRights("Admin"))
+                goURL(APP_PATH."noaccess.php");
 
         $options = new tableOptions($db, $_GET["id"]);

trunk/phpbms/modules/base/tabledefs_searchfields.php

@@ -42 +42 @@
         include("include/tabledefs_searchfields_include.php");
 
+        if(!hasRights("Admin"))
+                goURL(APP_PATH."noaccess.php");
+
+        if(!isset($_GET["id"]))
+                $error = new appError(-200, "Passed parameter missing", "Invalid request", true);
 
         $searchfields = new tableSearchFields($db, $_GET["id"]);

trunk/phpbms/modules/recurringinvoices/scheduler_recurr.php

@@ -415 +415 @@
 //PROCESSOR
 //=============================================================================================
-if(!isset($noProcess)){
+if(!isset($noOutput)){
         $recurr = new recurr($db);
         $invoiceArray = $recurr->getInvoicesToRepeat();

trunk/phpbms/report/report_class.php

@@ -115 +115 @@
         $this->tabledefUUID = mysql_real_escape_string($tabledefUUID);
 
-        if($reportUUID)
-            $this->retrieveReportSettings();
+        $this->checkRights();
+
+        $this->retrieveReportSettings();
 
     }//end function init
 
+
+    /**
+     * function checkRight
+     *
+     * Checks report record and current user to make sure they have rights to run this report
+     */
+     function checkRights(){
+
+        $querystatement = "
+            SELECT
+                `roleid`
+            FROM
+                `reports`
+            WHERE
+                `uuid` = '".$this->reportUUID."'
+        ";
+
+        $queryresult = $this->db->query($querystatement);
+
+        if($this->db->numRows($queryresult)){
+
+            $therecord = $this->db->fetchArray($queryresult);
+
+            if(!hasRights($therecord["roleid"]))
+                goURL(APP_PATH."noaccess.php");
+
+        } else
+            $error = new appError(500, "Bad report uuid");
+
+     }//end function checkRights
 
     /**