From cef43c3602c38fe4b49e74bdfa429c66929ada0e Mon Sep 17 00:00:00 2001 From: Karl 'vollmerk' Vollmer Date: Thu, 19 Jun 2008 06:32:23 +0000 Subject: reorganize the menu a whole bunch and add a confirmation page to the catalog deletion --- admin/catalog.php | 13 +++++- admin/users.php | 30 +++++++------- docs/CHANGELOG | 2 + images/icon_plugin.png | Bin 0 -> 591 bytes lib/class/core.class.php | 51 +++++++++++++++++++++++ lib/ui.lib.php | 2 +- server/ajax.server.php | 24 ----------- server/index.ajax.php | 23 +++++++++++ templates/show_add_user.inc.php | 6 +-- templates/show_catalog_row.inc.php | 3 +- templates/show_confirmation.inc.php | 13 ++++-- templates/show_edit_user.inc.php | 6 +-- templates/sidebar.inc.php | 14 +++---- templates/sidebar_browse.inc.php | 75 ---------------------------------- templates/sidebar_home.inc.php | 48 +++++++++++----------- templates/sidebar_modules.inc.php | 54 ++++++++++++++++++++++++ templates/sidebar_preferences.inc.php | 8 +--- 17 files changed, 206 insertions(+), 166 deletions(-) create mode 100644 images/icon_plugin.png delete mode 100644 templates/sidebar_browse.inc.php create mode 100644 templates/sidebar_modules.inc.php diff --git a/admin/catalog.php b/admin/catalog.php index c9b470ff..fb23f7cf 100644 --- a/admin/catalog.php +++ b/admin/catalog.php @@ -103,12 +103,23 @@ switch ($_REQUEST['action']) { case 'delete_catalog': /* Make sure they aren't in demo mode */ if (Config::get('demo_mode')) { break; } + + if (!Core::form_verify('delete_catalog')) { + access_denied(); + exit; + } /* Delete the sucker, we don't need to check perms as thats done above */ - Catalog::delete($_REQUEST['catalog_id']); + Catalog::delete($_GET['catalog_id']); $next_url = Config::get('web_path') . '/admin/index.php'; show_confirmation(_('Catalog Deleted'),_('The Catalog and all associated records have been deleted'),$nexturl); break; + case 'show_delete_catalog': + $catalog_id = scrub_in($_GET['catalog_id']); + + $next_url = Config::get('web_path') . '/admin/catalog.php?action=delete_catalog'; + show_confirmation(_('Catalog Delete'),_('Confirm Deletion Request'),$nexturl,1,'delete_catalog'); + break; case 'remove_disabled': if (conf('demo_mode')) { break; } diff --git a/admin/users.php b/admin/users.php index a9a5039d..ea717bdb 100644 --- a/admin/users.php +++ b/admin/users.php @@ -33,19 +33,19 @@ switch ($_REQUEST['action']) { case 'update_user': if (Config::get('demo_mode')) { break; } - if (!$_SESSION['forms']['adminuser'] || $_SESSION['forms']['adminuser'] != $_POST['formkey']) { + if (!Core::form_verify('edit_user','post')) { access_denied(); exit; } /* Clean up the variables */ - $user_id = scrub_in($_REQUEST['user_id']); - $username = scrub_in($_REQUEST['username']); - $fullname = scrub_in($_REQUEST['fullname']); - $email = scrub_in($_REQUEST['email']); - $access = scrub_in($_REQUEST['access']); - $pass1 = scrub_in($_REQUEST['password_1']); - $pass2 = scrub_in($_REQUEST['password_2']); + $user_id = scrub_in($_POST['user_id']); + $username = scrub_in($_POST['username']); + $fullname = scrub_in($_POST['fullname']); + $email = scrub_in($_POST['email']); + $access = scrub_in($_POST['access']); + $pass1 = scrub_in($_POST['password_1']); + $pass2 = scrub_in($_POST['password_2']); /* Setup the temp user */ $client = new User($user_id); @@ -85,17 +85,17 @@ switch ($_REQUEST['action']) { case 'add_user': if (Config::get('demo_mode')) { break; } - if (!$_SESSION['forms']['adminuser'] || $_SESSION['forms']['adminuser'] != $_POST['formkey']) { + if (!Core::form_verify('add_user','post')) { access_denied(); exit; } - $username = scrub_in($_REQUEST['username']); - $fullname = scrub_in($_REQUEST['fullname']); - $email = scrub_in($_REQUEST['email']); - $access = scrub_in($_REQUEST['access']); - $pass1 = scrub_in($_REQUEST['password_1']); - $pass2 = scrub_in($_REQUEST['password_2']); + $username = scrub_in($_POST['username']); + $fullname = scrub_in($_POST['fullname']); + $email = scrub_in($_POST['email']); + $access = scrub_in($_POST['access']); + $pass1 = scrub_in($_POST['password_1']); + $pass2 = scrub_in($_POST['password_2']); if ($pass1 !== $pass2 || !strlen($pass1)) { Error::add('password',_("Error Passwords don't match")); diff --git a/docs/CHANGELOG b/docs/CHANGELOG index 658954a1..4b5d9a06 100755 --- a/docs/CHANGELOG +++ b/docs/CHANGELOG @@ -4,6 +4,8 @@ -------------------------------------------------------------------------- v.3.5-Alpha1 + - Added Confirmation Screen to Catalog Deletion + - Reorganized Menu System and Added Modules section - Fix an error if you try to add a shoutbox for an invalid object (Thx atrophic) - Fixed issue with art dump on jpeg files (Thx atrophic) diff --git a/images/icon_plugin.png b/images/icon_plugin.png new file mode 100644 index 00000000..6187b15a Binary files /dev/null and b/images/icon_plugin.png differ diff --git a/lib/class/core.class.php b/lib/class/core.class.php index bd0e422d..4818e39b 100644 --- a/lib/class/core.class.php +++ b/lib/class/core.class.php @@ -36,5 +36,56 @@ class Core { } // construction + /** + * form_register + * This registers a form with a SID, inserts it into the session variables + * and then returns a string for use in the HTML form + */ + public static function form_register($name) { + + // Make ourselves a nice little sid + $sid = md5(uniqid(rand(), true)); + + // Register it + $_SESSION['forms'][$name] = array('sid'=>$sid,'expire'=>time() + Config::get('session_length')); + + $string = ''; + + return $string; + + } // form_register + + /** + * form_verify + * This takes a form name and then compares it with the posted sid, if they don't match + * then it returns false and doesn't let the person continue + */ + public static function form_verify($name,$method='post') { + + switch ($method) { + case 'post': + $source = $_POST['form_validation']; + break; + case 'get': + $source = $_GET['form_validation']; + break; + case 'cookie': + $source = $_COOKIE['form_validation']; + break; + case 'request': + $source = $_REQUEST['form_validation']; + break; + } + + if ($source == $_SESSION['forms'][$name]['sid'] AND $_SESSION['forms'][$name]['expire'] > time()) { + unset($_SESSION['forms'][$name]); + return true; + } + + unset($_SESSION['forms'][$name]); + return false; + + } // form_verify + } // Core ?> diff --git a/lib/ui.lib.php b/lib/ui.lib.php index 68f92a50..1c2c480e 100644 --- a/lib/ui.lib.php +++ b/lib/ui.lib.php @@ -35,7 +35,7 @@ * $text The details of the message * $cancel T/F show a cancel button that uses return_referrer() */ -function show_confirmation($title,$text,$next_url,$cancel=0) { +function show_confirmation($title,$text,$next_url,$cancel=0,$form_name='confirmation') { if (substr_count($next_url,Config::get('web_path'))) { $path = $next_url; diff --git a/server/ajax.server.php b/server/ajax.server.php index 82539b6b..5e586895 100644 --- a/server/ajax.server.php +++ b/server/ajax.server.php @@ -345,30 +345,6 @@ switch ($_REQUEST['action']) { $results['browse_content'] = ob_get_contents(); ob_end_clean(); break; - case 'sidebar': - switch ($_REQUEST['button']) { - case 'home': - case 'browse': - case 'localplay': - case 'player': - case 'preferences': - $button = $_REQUEST['button']; - break; - case 'admin': - if ($GLOBALS['user']->has_access(100)) { $button = $_REQUEST['button']; } - else { exit; } - break; - default: - exit; - break; - } // end switch on button - - ob_start(); - $_SESSION['state']['sidebar_tab'] = $button; - require_once Config::get('prefix') . '/templates/sidebar.inc.php'; - $results['sidebar'] = ob_get_contents(); - ob_end_clean(); - break; default: $results['rfc3514'] = '0x1'; break; diff --git a/server/index.ajax.php b/server/index.ajax.php index 47d2b45f..e8029de2 100644 --- a/server/index.ajax.php +++ b/server/index.ajax.php @@ -34,6 +34,29 @@ switch ($_REQUEST['action']) { ob_end_clean(); } break; + case 'sidebar': + switch ($_REQUEST['button']) { + case 'home': + case 'modules': + case 'localplay': + case 'player': + case 'preferences': + $button = $_REQUEST['button']; + break; + case 'admin': + if (Access::check('interface','100')) { $button = $_REQUEST['button']; } + else { exit; } + break; + default: + exit; + break; + } // end switch on button + + ob_start(); + $_SESSION['state']['sidebar_tab'] = $button; + require_once Config::get('prefix') . '/templates/sidebar.inc.php'; + $results['sidebar'] = ob_get_contents(); + ob_end_clean(); default: $results['rfc3514'] = '0x1'; break; diff --git a/templates/show_add_user.inc.php b/templates/show_add_user.inc.php index e8656586..cfa30ab9 100644 --- a/templates/show_add_user.inc.php +++ b/templates/show_add_user.inc.php @@ -19,8 +19,6 @@ Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */ -$form_string = generate_password('32'); -$_SESSION['forms']['adminuser'] = $form_string; ?> @@ -83,8 +81,8 @@ $_SESSION['forms']['adminuser'] = $form_string;
- - + +
diff --git a/templates/show_catalog_row.inc.php b/templates/show_catalog_row.inc.php index faf9b406..37546b3a 100644 --- a/templates/show_catalog_row.inc.php +++ b/templates/show_catalog_row.inc.php @@ -28,6 +28,7 @@ $web_path = Config::get('web_path'); | | + | | - | + | diff --git a/templates/show_confirmation.inc.php b/templates/show_confirmation.inc.php index fb66ce4b..53bdd493 100644 --- a/templates/show_confirmation.inc.php +++ b/templates/show_confirmation.inc.php @@ -1,7 +1,7 @@
- +
+ + +
- "> +
+ + +
diff --git a/templates/show_edit_user.inc.php b/templates/show_edit_user.inc.php index 56ed7179..3ccd7e8d 100644 --- a/templates/show_edit_user.inc.php +++ b/templates/show_edit_user.inc.php @@ -1,7 +1,7 @@ @@ -85,7 +83,7 @@ $_SESSION['forms']['adminuser'] = $form_string;
- +
diff --git a/templates/sidebar.inc.php b/templates/sidebar.inc.php index 5d94e9b6..42f2b3bb 100644 --- a/templates/sidebar.inc.php +++ b/templates/sidebar.inc.php @@ -25,9 +25,9 @@ ${$class_name} = ' active'; // List of buttons ( id, title, icon, access level) $sidebar_items[] = array('id'=>'home', 'title'=>_('Home'), 'icon'=>'home', 'access'=>5); -//$sidebar_items[] = array('id'=>'browse', 'title'=>_('Browse'), 'icon'=>'browse', 'access'=>5); $sidebar_items[] = array('id'=>'localplay', 'title'=>_('Localplay'), 'icon'=>'volumeup', 'access'=>5); $sidebar_items[] = array('id'=>'preferences', 'title'=>_('Preferences'), 'icon'=>'edit', 'access'=>5); +$sidebar_items[] = array('id'=>'modules','title'=>_('Modules'),'icon'=>'plugin','access'=>5); $sidebar_items[] = array('id'=>'admin', 'title'=>_('Admin'), 'icon'=>'admin', 'access'=>100); @@ -38,18 +38,16 @@ $ajax_url = Config::get('ajax_url');