Changeset 727 for trunk/phpbms/modules/base/adminsettings_ajax.php

Timestamp:

01/07/10 11:16:05 (2 years ago)

Author:

brieb

Message:

• Added more rights look ups to certain pages
• Fixed several path disclosure errors

Files:

• trunk/phpbms/modules/base/adminsettings_ajax.php (modified) (1 diff)

trunk/phpbms/modules/base/adminsettings_ajax.php

@@ -97 +97 @@
 
 }//end class
-/*--[Processing]-------------------------------------------------------------*/
-/*---------------------------------------------------------------------------*/
-if(!isset($_GET["m"]))
-    exit;
-require_once("../../include/session.php");
 
-$checkUpdate = new checkUpdate($db);
-$response = array();
-if($checkUpdate->needUpdateCheck($_GET["m"])){
-    $response = $checkUpdate->checkForUpdate();
-}else{
-    $response["checked"] = false;
-    $response = json_encode($response);
-}//end if
 
-echo $response;
+/**
+ * Processing ==================================================================
+ */
+if(!isset($noOutput)){
+
+    require_once("../../include/session.php");
+
+    $db->errorFormat = "json";
+
+    if(!isset($_GET["m"]))
+        $error = new appError(200, "invalid passed paramaters", "", true, true, "json");
+
+    if(!$_SESSION["userinfo"]["admin"])
+        $error = new appError(970, "no rights to function", "", true, true, "json");
+
+    $checkUpdate = new checkUpdate($db);
+    $response = array();
+
+    if($checkUpdate->needUpdateCheck($_GET["m"]))
+        $response = $checkUpdate->checkForUpdate();
+    else{
+        $response["checked"] = false;
+        $response = json_encode($response);
+    }//end if
+
+    echo $response;
+
+}//endif
 ?>