MDL-20916 protect the whole xmldb editor with sesskey. Backported from 19_STABLE

This commit is contained in:
Eloy Lafuente
2009-11-20 15:07:18 +00:00
parent df09d649ab
commit 5aa2b2e943
36 changed files with 95 additions and 41 deletions
+10 -2
View File
@@ -47,6 +47,8 @@ class XMLDBAction {
var $postaction; //Action to execute at the end of the invoke script
var $sesskey_protected; // Actions must be protected by sesskey mechanishm
/**
* Constructor
*/
@@ -72,6 +74,7 @@ class XMLDBAction {
$this->output = NULL;
$this->errormsg = NULL;
$this->subaction = NULL;
$this->sesskey_protected = true;
}
/**
@@ -130,13 +133,18 @@ class XMLDBAction {
}
/**
* main invoke method, it simply sets the postaction attribute
* if possible
* main invoke method, it sets the postaction attribute
* if possible and checks sesskey_protected if needed
*/
function invoke() {
global $SESSION;
/// Sesskey protection
if ($this->sesskey_protected) {
require_sesskey();
}
/// If we are used any dir, save it in the lastused session object
/// Some actions can use it to perform positioning
if ($lastused = optional_param ('dir', NULL, PARAM_PATH)) {
@@ -94,7 +94,7 @@ class check_indexes extends XMLDBAction {
$o.= ' <p class="centerpara">' . $this->str['confirmcheckindexes'] . '</p>';
$o.= ' <table class="boxaligncenter" cellpadding="20"><tr><td>';
$o.= ' <div class="singlebutton">';
$o.= ' <form action="index.php?action=check_indexes&amp;confirmed=yes" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <form action="index.php?action=check_indexes&amp;sesskey=' . sesskey() . '&amp;confirmed=yes" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
$o.= ' </td><td>';
$o.= ' <div class="singlebutton">';
@@ -77,7 +77,7 @@ class delete_field extends XMLDBAction {
$o.= ' <p class="centerpara">' . $this->str['confirmdeletefield'] . '<br /><br />' . $fieldparam . '</p>';
$o.= ' <table class="boxaligncenter" cellpadding="20"><tr><td>';
$o.= ' <div class="singlebutton">';
$o.= ' <form action="index.php?action=delete_field&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <form action="index.php?action=delete_field&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
$o.= ' </td><td>';
$o.= ' <div class="singlebutton">';
@@ -77,7 +77,7 @@ class delete_index extends XMLDBAction {
$o.= ' <p class="centerpara">' . $this->str['confirmdeleteindex'] . '<br /><br />' . $indexparam . '</p>';
$o.= ' <table class="boxaligncenter" cellpadding="20"><tr><td>';
$o.= ' <div class="singlebutton">';
$o.= ' <form action="index.php?action=delete_index&amp;confirmed=yes&amp;postaction=edit_table&amp;index=' . $indexparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <form action="index.php?action=delete_index&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;index=' . $indexparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
$o.= ' </td><td>';
$o.= ' <div class="singlebutton">';
@@ -77,7 +77,7 @@ class delete_key extends XMLDBAction {
$o.= ' <p class="centerpara">' . $this->str['confirmdeletekey'] . '<br /><br />' . $keyparam . '</p>';
$o.= ' <table class="boxaligncenter" cellpadding="20"><tr><td>';
$o.= ' <div class="singlebutton">';
$o.= ' <form action="index.php?action=delete_key&amp;confirmed=yes&amp;postaction=edit_table&amp;key=' . $keyparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <form action="index.php?action=delete_key&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;key=' . $keyparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
$o.= ' </td><td>';
$o.= ' <div class="singlebutton">';
@@ -77,7 +77,7 @@ class delete_sentence extends XMLDBAction {
$o.= ' <p class="centerpara">' . $this->str['confirmdeletesentence'] . '</p>';
$o.= ' <table class="boxaligncenter" cellpadding="20"><tr><td>';
$o.= ' <div class="singlebutton">';
$o.= ' <form action="index.php?action=delete_sentence&amp;confirmed=yes&amp;postaction=edit_statement&amp;sentence=' . $sentenceparam . '&amp;statement=' . urlencode($statementparam) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <form action="index.php?action=delete_sentence&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_statement&amp;sentence=' . $sentenceparam . '&amp;statement=' . urlencode($statementparam) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
$o.= ' </td><td>';
$o.= ' <div class="singlebutton">';
@@ -76,7 +76,7 @@ class delete_statement extends XMLDBAction {
$o.= ' <p class="centerpara">' . $this->str['confirmdeletestatement'] . '<br /><br />' . $statementparam . '</p>';
$o.= ' <table class="boxaligncenter" cellpadding="20"><tr><td>';
$o.= ' <div class="singlebutton">';
$o.= ' <form action="index.php?action=delete_statement&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <form action="index.php?action=delete_statement&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
$o.= ' </td><td>';
$o.= ' <div class="singlebutton">';
@@ -76,7 +76,7 @@ class delete_table extends XMLDBAction {
$o.= ' <p class="centerpara">' . $this->str['confirmdeletetable'] . '<br /><br />' . $tableparam . '</p>';
$o.= ' <table class="boxaligncenter" cellpadding="20"><tr><td>';
$o.= ' <div class="singlebutton">';
$o.= ' <form action="index.php?action=delete_table&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <form action="index.php?action=delete_table&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
$o.= ' </td><td>';
$o.= ' <div class="singlebutton">';
@@ -75,7 +75,7 @@ class delete_xml_file extends XMLDBAction {
$o.= ' <p class="centerpara">' . $this->str['confirmdeletexmlfile'] . '<br /><br />' . $dirpath . '/install.php</p>';
$o.= ' <table class="boxaligncenter" cellpadding="20"><tr><td>';
$o.= ' <div class="singlebutton">';
$o.= ' <form action="index.php?action=delete_xml_file&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <form action="index.php?action=delete_xml_file&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
$o.= ' </td><td>';
$o.= ' <div class="singlebutton">';
@@ -35,6 +35,7 @@ class edit_field extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -103,6 +104,7 @@ class edit_field extends XMLDBAction {
$o.= ' <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
$o.= ' <input type="hidden" name ="table" value="' . $tableparam .'" />';
$o.= ' <input type="hidden" name ="field" value="' . $fieldparam .'" />';
$o.= ' <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
$o.= ' <input type="hidden" name ="action" value="edit_field_save" />';
$o.= ' <input type="hidden" name ="postaction" value="edit_table" />';
$o.= ' <table id="formelements" class="boxaligncenter">';
@@ -35,6 +35,7 @@ class edit_index extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -103,6 +104,7 @@ class edit_index extends XMLDBAction {
$o.= ' <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
$o.= ' <input type="hidden" name ="table" value="' . $tableparam .'" />';
$o.= ' <input type="hidden" name ="index" value="' . $indexparam .'" />';
$o.= ' <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
$o.= ' <input type="hidden" name ="action" value="edit_index_save" />';
$o.= ' <input type="hidden" name ="postaction" value="edit_table" />';
$o.= ' <table id="formelements" class="boxaligncenter">';
@@ -35,6 +35,7 @@ class edit_key extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -103,6 +104,7 @@ class edit_key extends XMLDBAction {
$o.= ' <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
$o.= ' <input type="hidden" name ="table" value="' . $tableparam .'" />';
$o.= ' <input type="hidden" name ="key" value="' . $keyparam .'" />';
$o.= ' <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
$o.= ' <input type="hidden" name ="action" value="edit_key_save" />';
$o.= ' <input type="hidden" name ="postaction" value="edit_table" />';
$o.= ' <table id="formelements" class="boxaligncenter">';
@@ -35,6 +35,7 @@ class edit_sentence extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -119,6 +120,7 @@ class edit_sentence extends XMLDBAction {
$o.= ' <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
$o.= ' <input type="hidden" name ="statement" value="' . $statementparam .'" />';
$o.= ' <input type="hidden" name ="sentence" value="' . $sentenceparam .'" />';
$o.= ' <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
$o.= ' <input type="hidden" name ="action" value="edit_sentence_save" />';
$o.= ' <input type="hidden" name ="postaction" value="edit_statement" />';
$o.= ' <table id="formelements" class="boxaligncenter">';
@@ -35,6 +35,7 @@ class edit_statement extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -106,6 +107,7 @@ class edit_statement extends XMLDBAction {
$o.= '<div>';
$o.= ' <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
$o.= ' <input type="hidden" name ="statement" value="' . $statementparam .'" />';
$o.= ' <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
$o.= ' <input type="hidden" name ="action" value="edit_statement_save" />';
$o.= ' <input type="hidden" name ="postaction" value="edit_statement" />';
$o.= ' <table id="formelements" class="boxaligncenter">';
@@ -129,7 +131,7 @@ class edit_statement extends XMLDBAction {
$b .= '&nbsp;[' . $this->str['viewedited'] . ']';
}
/// The new sentence button
$b .= '&nbsp;<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newsentence'] . ']</a>';
$b .= '&nbsp;<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;sesskey=' . sesskey() . '&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newsentence'] . ']</a>';
/// The back to edit xml file button
$b .= '&nbsp;<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
$b .= '</p>';
@@ -157,10 +159,10 @@ class edit_statement extends XMLDBAction {
$b .= '<a href="index.php?action=edit_sentence&amp;sentence=' .$key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['edit'] . ']</a>';
$b .= '</td><td class="button cell">';
/// The duplicate button
$b .= '<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;basesentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['duplicate'] . ']</a>';
$b .= '<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;sesskey=' . sesskey() . '&amp;basesentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['duplicate'] . ']</a>';
$b .= '</td><td class="button cell">';
/// The delete button
$b .= '<a href="index.php?action=delete_sentence&amp;sentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
$b .= '<a href="index.php?action=delete_sentence&amp;sesskey=' . sesskey() . '&amp;sentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
$b .= '</td>';
/// Print table row
$o .= '<tr class="r' . $row . '"><td class="table cell">' . $p . $sentence . $b . '</tr>';
@@ -35,6 +35,7 @@ class edit_table extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -107,6 +108,7 @@ class edit_table extends XMLDBAction {
$o.= ' <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
$o.= ' <input type="hidden" name ="table" value="' . $tableparam .'" />';
$o.= ' <input type="hidden" name ="action" value="edit_table_save" />';
$o.= ' <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
$o.= ' <input type="hidden" name ="postaction" value="edit_table" />';
$o.= ' <table id="formelements" class="boxaligncenter">';
/// If the table is being used, we cannot rename it
@@ -134,11 +136,11 @@ class edit_table extends XMLDBAction {
$b .= '&nbsp;[' . $this->str['viewedited'] . ']';
}
/// The new field button
$b .= '&nbsp;<a href="index.php?action=new_field&amp;postaction=edit_field&amp;table=' . $tableparam . '&amp;field=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newfield'] . ']</a>';
$b .= '&nbsp;<a href="index.php?action=new_field&amp;sesskey=' . sesskey() . '&amp;postaction=edit_field&amp;table=' . $tableparam . '&amp;field=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newfield'] . ']</a>';
/// The new key button
$b .= '&nbsp;<a href="index.php?action=new_key&amp;postaction=edit_key&amp;table=' . $tableparam . '&amp;key=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newkey'] . ']</a>';
$b .= '&nbsp;<a href="index.php?action=new_key&amp;sesskey=' . sesskey() . '&amp;postaction=edit_key&amp;table=' . $tableparam . '&amp;key=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newkey'] . ']</a>';
/// The new index button
$b .= '&nbsp;<a href="index.php?action=new_index&amp;postaction=edit_index&amp;table=' . $tableparam . '&amp;index=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newindex'] . ']</a>';
$b .= '&nbsp;<a href="index.php?action=new_index&amp;sesskey=' . sesskey() . '&amp;postaction=edit_index&amp;table=' . $tableparam . '&amp;index=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newindex'] . ']</a>';
/// The back to edit xml file button
$b .= '&nbsp;<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
$b .= '</p>';
@@ -185,14 +187,14 @@ class edit_table extends XMLDBAction {
$b .= '</td><td class="button cell">';
/// The up button
if ($field->getPrevious()) {
$b .= '<a href="index.php?action=move_updown_field&amp;direction=up&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
$b .= '<a href="index.php?action=move_updown_field&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
} else {
$b .= '[' . $this->str['up'] . ']';
}
$b .= '</td><td class="button cell">';
/// The down button
if ($field->getNext()) {
$b .= '<a href="index.php?action=move_updown_field&amp;direction=down&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
$b .= '<a href="index.php?action=move_updown_field&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
} else {
$b .= '[' . $this->str['down'] . ']';
}
@@ -200,7 +202,7 @@ class edit_table extends XMLDBAction {
/// The delete button (if we have more than one and it isn't used
if (count($fields) > 1 &&
!$structure->getFieldUses($table->getName(), $field->getName())) {
$b .= '<a href="index.php?action=delete_field&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
$b .= '<a href="index.php?action=delete_field&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
} else {
$b .= '[' . $this->str['delete'] . ']';
}
@@ -234,21 +236,21 @@ class edit_table extends XMLDBAction {
$b .= '</td><td class="button cell">';
/// The up button
if ($key->getPrevious()) {
$b .= '<a href="index.php?action=move_updown_key&amp;direction=up&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
$b .= '<a href="index.php?action=move_updown_key&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
} else {
$b .= '[' . $this->str['up'] . ']';
}
$b .= '</td><td class="button cell">';
/// The down button
if ($key->getNext()) {
$b .= '<a href="index.php?action=move_updown_key&amp;direction=down&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
$b .= '<a href="index.php?action=move_updown_key&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
} else {
$b .= '[' . $this->str['down'] . ']';
}
$b .= '</td><td class="button cell">';
/// The delete button (if the key hasn't uses)
if (!$structure->getKeyUses($table->getName(), $key->getName())) {
$b .= '<a href="index.php?action=delete_key&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
$b .= '<a href="index.php?action=delete_key&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
} else {
$b .= '[' . $this->str['delete'] . ']';
}
@@ -274,20 +276,20 @@ class edit_table extends XMLDBAction {
$b .= '</td><td class="button cell">';
/// The up button
if ($index->getPrevious()) {
$b .= '<a href="index.php?action=move_updown_index&amp;direction=up&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
$b .= '<a href="index.php?action=move_updown_index&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
} else {
$b .= '[' . $this->str['up'] . ']';
}
$b .= '</td><td class="button cell">';
/// The down button
if ($index->getNext()) {
$b .= '<a href="index.php?action=move_updown_index&amp;direction=down&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
$b .= '<a href="index.php?action=move_updown_index&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
} else {
$b .= '[' . $this->str['down'] . ']';
}
$b .= '</td><td class="button cell">';
/// The delete button
$b .= '<a href="index.php?action=delete_index&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
$b .= '<a href="index.php?action=delete_index&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
/// The readable info
$r = '</td><td class="readableinfo cell">' . $index->readableInfo() . '</td>';
/// Print table row
@@ -35,6 +35,7 @@ class edit_xml_file extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -107,6 +108,7 @@ class edit_xml_file extends XMLDBAction {
$o.= ' <input type="hidden" name ="postaction" value="edit_xml_file" />';
$o.= ' <input type="hidden" name ="path" value="' . s($structure->getPath()) .'" />';
$o.= ' <input type="hidden" name ="version" value="' . s($structure->getVersion()) .'" />';
$o.= ' <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
$o.= ' <table id="formelements" class="boxaligncenter">';
$o.= ' <tr valign="top"><td>Path:</td><td>' . s($structure->getPath()) . '</td></tr>';
$o.= ' <tr valign="top"><td>Version:</td><td>' . s($structure->getVersion()) . '</td></tr>';
@@ -125,15 +127,15 @@ class edit_xml_file extends XMLDBAction {
$b .= '&nbsp;[' . $this->str['viewedited'] . ']';
}
/// The new table button
$b .= '&nbsp;<a href="index.php?action=new_table&amp;postaction=edit_table&amp;table=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtable'] . ']</a>';
$b .= '&nbsp;<a href="index.php?action=new_table&amp;sesskey=' . sesskey() . '&amp;postaction=edit_table&amp;table=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtable'] . ']</a>';
/// The new from MySQL button
if ($CFG->dbfamily == 'mysql') {
$b .= '&nbsp;<a href="index.php?action=new_table_from_mysql&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtablefrommysql'] . ']</a>';
$b .= '&nbsp;<a href="index.php?action=new_table_from_mysql&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtablefrommysql'] . ']</a>';
} else {
$b .= '&nbsp;[' . $this->str['newtablefrommysql'] . ']';
}
/// The new statement button
$b .= '&nbsp;<a href="index.php?action=new_statement&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newstatement'] . ']</a>';
$b .= '&nbsp;<a href="index.php?action=new_statement&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newstatement'] . ']</a>';
/// The back to main menu button
$b .= '&nbsp;<a href="index.php?action=main_view#lastused">[' . $this->str['backtomainview'] . ']</a>';
$b .= '</p>';
@@ -169,14 +171,14 @@ class edit_xml_file extends XMLDBAction {
$b .= '</td><td class="button cell">';
/// The up button
if ($table->getPrevious()) {
$b .= '<a href="index.php?action=move_updown_table&amp;direction=up&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
$b .= '<a href="index.php?action=move_updown_table&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
} else {
$b .= '[' . $this->str['up'] . ']';
}
$b .= '</td><td class="button cell">';
/// The down button
if ($table->getNext()) {
$b .= '<a href="index.php?action=move_updown_table&amp;direction=down&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
$b .= '<a href="index.php?action=move_updown_table&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
} else {
$b .= '[' . $this->str['down'] . ']';
}
@@ -185,7 +187,7 @@ class edit_xml_file extends XMLDBAction {
if (count($tables) > 1 &&
!$structure->getTableUses($table->getName())) {
///!$structure->getTableUses($table->getName())) {
$b .= '<a href="index.php?action=delete_table&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
$b .= '<a href="index.php?action=delete_table&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
} else {
$b .= '[' . $this->str['delete'] . ']';
}
@@ -214,20 +216,20 @@ class edit_xml_file extends XMLDBAction {
$b .= '</td><td class="button cell">';
/// The up button
if ($statement->getPrevious()) {
$b .= '<a href="index.php?action=move_updown_statement&amp;direction=up&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
$b .= '<a href="index.php?action=move_updown_statement&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
} else {
$b .= '[' . $this->str['up'] . ']';
}
$b .= '</td><td class="button cell">';
/// The down button
if ($statement->getNext()) {
$b .= '<a href="index.php?action=move_updown_statement&amp;direction=down&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
$b .= '<a href="index.php?action=move_updown_statement&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
} else {
$b .= '[' . $this->str['down'] . ']';
}
$b .= '</td><td class="button cell">';
/// The delete button
$b .= '<a href="index.php?action=delete_statement&amp;statement=' . $statement->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
$b .= '<a href="index.php?action=delete_statement&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
$b .= '</td>';
/// Print statement row
$o .= '<tr class="r' . $row . '"><td class="statement cell"><a href="index.php?action=view_statement_xml&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;statement=' . $statement->getName() . '&amp;select=edited">' . $statement->getName() . '</a>' . $b . '</tr>';
@@ -39,6 +39,7 @@ class get_db_directories extends XMLDBAction {
//$this->can_subaction = ACTION_HAVE_SUBACTIONS;
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -38,6 +38,7 @@ class load_xml_file extends XMLDBAction {
//$this->can_subaction = ACTION_HAVE_SUBACTIONS;
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -35,6 +35,7 @@ class main_view extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -84,9 +85,9 @@ class main_view extends XMLDBAction {
/// The reserved_words button
$b .= '&nbsp;<a href="index.php?action=view_reserved_words">[' . $this->str['reservedwords'] . ']</a>';
/// The test button
$b .= '&nbsp;<a href="index.php?action=test">[' . $this->str['test'] . ']</a>';
$b .= '&nbsp;<a href="index.php?action=test&amp;sesskey=' . sesskey() . '">[' . $this->str['test'] . ']</a>';
/// The check indexes button
$b .= '&nbsp;<a href="index.php?action=check_indexes">[' . $this->str['checkindexes'] . ']</a>';
$b .= '&nbsp;<a href="index.php?action=check_indexes&amp;sesskey=' . sesskey() . '">[' . $this->str['checkindexes'] . ']</a>';
$b .= '</p>';
/// Send buttons to output
$o .= $b;
@@ -126,7 +127,7 @@ class main_view extends XMLDBAction {
if ($dbdir->path_exists &&
!file_exists($key . '/install.xml') &&
is_writeable($key)) {
$b .= '<a href="index.php?action=create_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['create'] . ']</a>';
$b .= '<a href="index.php?action=create_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['create'] . ']</a>';
} else {
$b .= '[' . $this->str['create'] . ']';
}
@@ -159,7 +160,7 @@ class main_view extends XMLDBAction {
is_writeable($key) &&
!empty($dbdir->xml_loaded) &&
!empty($dbdir->xml_changed)) {
$b .= '<a href="index.php?action=save_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['save'] . ']</a>';
$b .= '<a href="index.php?action=save_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['save'] . ']</a>';
/// Check if the file has been manually edited while being modified in the editor
if ($dbdir->filemtime != filemtime($key . '/install.xml')) {
/// File manually modified. Add to errors.
@@ -178,7 +179,7 @@ class main_view extends XMLDBAction {
is_writeable($key) &&
!empty($dbdir->xml_loaded) &&
!empty($dbdir->xml_changed)) {
$b .= '<a href="index.php?action=revert_changes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['revert'] . ']</a>';
$b .= '<a href="index.php?action=revert_changes&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['revert'] . ']</a>';
} else {
$b .= '[' . $this->str['revert'] . ']';
}
@@ -200,7 +201,7 @@ class main_view extends XMLDBAction {
is_readable($key . '/install.xml') &&
is_writeable($key) &&
empty($dbdir->xml_loaded)) {
$b .= '<a href="index.php?action=delete_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['delete'] . ']</a>';
$b .= '<a href="index.php?action=delete_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['delete'] . ']</a>';
} else {
$b .= '[' . $this->str['delete'] . ']';
}
@@ -107,6 +107,7 @@ class new_statement extends XMLDBAction {
$o.= ' <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
$o.= ' <input type="hidden" name ="action" value="new_statement" />';
$o.= ' <input type="hidden" name ="postaction" value="edit_statement" />';
$o.= ' <input type="hidden" name ="sesskey" value="' . sesskey() . '" />';
$o.= ' <table id="formelements" class="boxaligncenter" cellpadding="5">';
$o.= ' <tr><td><label for="type" accesskey="t">' . $this->str['statementtype'] .' </label>' . choose_from_menu($typeoptions, 'type', '', 'choose', '', 0, true) . '<label for="table" accesskey="a">' . $this->str['statementtable'] . ' </label>' .choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '</td></tr>';
$o.= ' <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';
@@ -111,6 +111,7 @@ class new_table_from_mysql extends XMLDBAction {
$o.= ' <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
$o.= ' <input type="hidden" name ="action" value="new_table_from_mysql" />';
$o.= ' <input type="hidden" name ="postaction" value="edit_table" />';
$o.= ' <input type="hidden" name ="sesskey" value="' . sesskey() . '" />';
$o.= ' <table id="formelements" class="boxaligncenter" cellpadding="5">';
$o.= ' <tr><td><label for="table" accesskey="t">' . $this->str['createtable'] .' </label>' . choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '<label for="after" accesskey="a">' . $this->str['aftertable'] . ' </label>' .choose_from_menu($aftertables, 'after', '', 'choose', '', 0, true) . '</td></tr>';
$o.= ' <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';
@@ -75,7 +75,7 @@ class revert_changes extends XMLDBAction {
$o.= ' <p class="centerpara">' . $this->str['confirmrevertchanges'] . '<br /><br />' . $dirpath . '</p>';
$o.= ' <table class="boxaligncenter" cellpadding="20"><tr><td>';
$o.= ' <div class="singlebutton">';
$o.= ' <form action="index.php?action=revert_changes&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <form action="index.php?action=revert_changes&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
$o.= ' <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
$o.= ' </td><td>';
$o.= ' <div class="singlebutton">';
+14
View File
@@ -955,6 +955,20 @@ class test extends XMLDBAction {
$this->output = $o;
/// Finally drop all the potentially existing test tables
$table = new XMLDBTable('testtable');
if (table_exists($table)) {
$status = drop_table($table, true, false);
}
$table = new XMLDBTable ('anothertest');
if (table_exists($table)) {
$status = drop_table($table, true, false);
}
$table = new XMLDBTable ('newnameforthetable');
if (table_exists($table)) {
$status = drop_table($table, true, false);
}
/// Launch postaction if exists (leave this here!)
if ($this->getPostAction() && $result) {
return $this->launch($this->getPostAction());
@@ -35,6 +35,7 @@ class unload_xml_file extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -35,6 +35,7 @@ class view_field_xml extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -35,6 +35,7 @@ class view_index_xml extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -35,6 +35,7 @@ class view_key_xml extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -38,6 +38,7 @@ class view_reserved_words extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -35,6 +35,7 @@ class view_statement_xml extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -36,6 +36,7 @@ class view_structure_php extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -36,6 +36,7 @@ class view_structure_sql extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -35,6 +35,7 @@ class view_structure_xml extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -36,6 +36,7 @@ class view_table_php extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -36,6 +36,7 @@ class view_table_sql extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -35,6 +35,7 @@ class view_table_xml extends XMLDBAction {
parent::init();
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(
@@ -38,6 +38,7 @@ class view_xml extends XMLDBAction {
//$this->can_subaction = ACTION_HAVE_SUBACTIONS;
/// Set own custom attributes
$this->sesskey_protected = false; // This action doesn't need sesskey protection
/// Get needed strings
$this->loadStrings(array(