Changeset 727 for trunk/phpbms/modules

Timestamp:

01/07/10 11:16:05 (2 years ago)

Author:

brieb

Message:

• Added more rights look ups to certain pages
• Fixed several path disclosure errors

Location:

trunk/phpbms/modules

Files:

• base/adminsettings_ajax.php (modified) (1 diff)
• base/files_addedit.php (modified) (1 diff)
• base/notes_addedit.php (modified) (2 diffs)
• base/scheduler_delete_logs.php (modified) (1 diff)
• base/scheduler_delete_tempimport.php (modified) (1 diff)
• base/tabledefs_columns.php (modified) (1 diff)
• base/tabledefs_custom.php (modified) (1 diff)
• base/tabledefs_groupings.php (modified) (1 diff)
• base/tabledefs_options.php (modified) (1 diff)
• base/tabledefs_searchfields.php (modified) (1 diff)
• recurringinvoices/scheduler_recurr.php (modified) (1 diff)

trunk/phpbms/modules/base/adminsettings_ajax.php

@@ -97 +97 @@
 
 }//end class
-/*--[Processing]-------------------------------------------------------------*/
-/*---------------------------------------------------------------------------*/
-if(!isset($_GET["m"]))
-    exit;
-require_once("../../include/session.php");
 
-$checkUpdate = new checkUpdate($db);
-$response = array();
-if($checkUpdate->needUpdateCheck($_GET["m"])){
-    $response = $checkUpdate->checkForUpdate();
-}else{
-    $response["checked"] = false;
-    $response = json_encode($response);
-}//end if
 
-echo $response;
+/**
+ * Processing ==================================================================
+ */
+if(!isset($noOutput)){
+
+    require_once("../../include/session.php");
+
+    $db->errorFormat = "json";
+
+    if(!isset($_GET["m"]))
+        $error = new appError(200, "invalid passed paramaters", "", true, true, "json");
+
+    if(!$_SESSION["userinfo"]["admin"])
+        $error = new appError(970, "no rights to function", "", true, true, "json");
+
+    $checkUpdate = new checkUpdate($db);
+    $response = array();
+
+    if($checkUpdate->needUpdateCheck($_GET["m"]))
+        $response = $checkUpdate->checkForUpdate();
+    else{
+        $response["checked"] = false;
+        $response = json_encode($response);
+    }//end if
+
+    echo $response;
+
+}//endif
 ?>

trunk/phpbms/modules/base/files_addedit.php

@@ -60 +60 @@
 
         $therecord = $thetable->processAddEditPage();
+
+        if(!hasRights($therecord["roleid"]))
+            goURL("../../noaccess.php");
 
         if(isset($therecord["phpbmsStatus"]))

trunk/phpbms/modules/base/notes_addedit.php

@@ -37 +37 @@
  +-------------------------------------------------------------------------+
 */
-//var_dump($_POST);
-//exit;
+
         require_once("../../include/session.php");
         require_once("include/fields.php");
@@ -58 +57 @@
         $thetable = new notes($db, "tbld:a4cdd991-cf0a-916f-1240-49428ea1bdd1", $backurl);
         $therecord = $thetable->processAddEditPage();
+
+        if($therecord["private"] && $therecord["createdby"] != $_SESSION["userinfo"]["id"] && !$_SESSION["userinfo"]["admin"])
+            goURL("../../noaccess.php");
 
         if(isset($therecord["phpbmsStatus"]))

trunk/phpbms/modules/base/scheduler_delete_logs.php

@@ -48 +48 @@
 }//end class --cleanImports--
 
-if(!isset($noProcess)){
-        $clean = new cleanSysLog($db);
-        $clean->removeExcessLogs();
+if(!isset($noOutput) && isset($db)){
+
+    $clean = new cleanSysLog($db);
+    $clean->removeExcessLogs();
+
 }//end if
 ?>

trunk/phpbms/modules/base/scheduler_delete_tempimport.php

@@ -29 +29 @@
 }//end class --cleanImports--
 
-if(!isset($noProcess)){
-        $clean = new cleanImports($db);
-        $clean->removeTempCSV();
+if(!isset($noOutput) && isset($db)){
+
+    $clean = new cleanImports($db);
+    $clean->removeTempCSV();
+
 }//end if
 ?>

trunk/phpbms/modules/base/tabledefs_columns.php

@@ -47 +47 @@
 
         if(!isset($_GET["id"]))
-                $error = new appError(-200, "Passed parameter missing", "Invalid request", true);
+                $error = new appError(200, "Passed parameter missing", "Invalid request", true);
 
         $columns = new tableColumns($db, $_GET["id"]);

trunk/phpbms/modules/base/tabledefs_custom.php

@@ -45 +45 @@
         //Make sure table definition id is set
         if(!isset($_GET["id"]))
-            $error = new appError(300,"Passed variable not set (id)");
+            $error = new appError(200,"Passed variable not set");
+
+        if(!hasRights("Admin"))
+                goURL(APP_PATH."noaccess.php");
 
         $customFields = new customFields($db, ((int) $_GET["id"]));

trunk/phpbms/modules/base/tabledefs_groupings.php

@@ -43 +43 @@
         include("include/tablegroupings.php");
 
+        if(!hasRights("Admin"))
+                goURL(APP_PATH."noaccess.php");
+
+        if(!isset($_GET["id"]))
+                $error = new appError(-200, "Passed parameter missing", "Invalid request", true);
 
         //grab the table name

trunk/phpbms/modules/base/tabledefs_options.php

@@ -44 +44 @@
         if(!isset($_GET["id"]))
                 $error = new appError(100, "Passed Parameter not present.");
+
+        if(!hasRights("Admin"))
+                goURL(APP_PATH."noaccess.php");
 
         $options = new tableOptions($db, $_GET["id"]);

trunk/phpbms/modules/base/tabledefs_searchfields.php

@@ -42 +42 @@
         include("include/tabledefs_searchfields_include.php");
 
+        if(!hasRights("Admin"))
+                goURL(APP_PATH."noaccess.php");
+
+        if(!isset($_GET["id"]))
+                $error = new appError(-200, "Passed parameter missing", "Invalid request", true);
 
         $searchfields = new tableSearchFields($db, $_GET["id"]);

trunk/phpbms/modules/recurringinvoices/scheduler_recurr.php

@@ -415 +415 @@
 //PROCESSOR
 //=============================================================================================
-if(!isset($noProcess)){
+if(!isset($noOutput)){
         $recurr = new recurr($db);
         $invoiceArray = $recurr->getInvoicesToRepeat();