Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 1d02596

Browse files
authored
Merge pull request #72 from flatCore/develop
Merge Develop Branch
2 parents 547ba7c + 40ea2c5 commit 1d02596

File tree

165 files changed

+4280
-4664
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

165 files changed

+4280
-4664
lines changed

.gitignore

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,15 @@ release-notes.html
3030

3131
# styles, except default #
3232
/styles/**/*
33-
!/styles/default/*
3433
/styles/default/.DS_Store
3534

35+
!/styles/default/*
36+
!/styles/default/**/*
37+
!/styles/default/php/*
38+
3639
!index.html
3740

3841
config_database.php
3942

4043
/content/SQLite/.DS_Store
44+
acp/theme/config.codekit3

.htaccess

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,9 @@ RewriteCond %{REQUEST_FILENAME} !-f
66
RewriteCond %{REQUEST_FILENAME} !-d
77
RewriteRule ^(.*)$ index.php?query=$1 [L,QSA]
88

9-
</IfModule>
9+
</IfModule>
10+
11+
<FilesMatch "\.(pdf|doc|docx|xls|xlsx|xlsm)$" >
12+
ForceType application/octet-stream
13+
Header add Content-Disposition "attachment"
14+
</FilesMatch>

_htaccess

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,9 @@ RewriteCond %{REQUEST_FILENAME} !-f
66
RewriteCond %{REQUEST_FILENAME} !-d
77
RewriteRule ^(.*)$ index.php?query=$1 [L,QSA]
88

9-
</IfModule>
9+
</IfModule>
10+
11+
<FilesMatch "\.(pdf|doc|docx|xls|xlsx|xlsm)$" >
12+
ForceType application/octet-stream
13+
Header add Content-Disposition "attachment"
14+
</FilesMatch>

acp/acp.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -982,12 +982,13 @@ function expandHelpSidebar(){
982982
$('.page-info-btn').click(function(){
983983

984984
var pageid = $(this).data('id');
985+
var csrf_token = $(this).data('token');
985986

986987
// AJAX request
987988
$.ajax({
988989
url: 'core/pages.info.php',
989990
type: 'post',
990-
data: {pageid: pageid},
991+
data: {pageid: pageid, csrf_token: csrf_token},
991992
success: function(response){
992993
// Add response in Modal body
993994
$('#pageInfoModal .modal-body').html(response);

acp/core/access.php

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,12 +96,17 @@ function fc_start_user_session($ud) {
9696
die('Error: CSRF Token is invalid');
9797
}
9898

99+
/* stop all $_POST actions if csrf token is empty or invalid */
99100

100-
if(sizeof($_POST)>1) {
101+
if(!empty($_POST)) {
102+
if(empty($_POST['csrf_token'])) {
103+
die('Error: CSRF Token is empty');
104+
}
101105
if($_POST['csrf_token'] !== $_SESSION['token']) {
102106
die('Error: CSRF Token is invalid');
103107
}
104108
}
105109

110+
$hidden_csrf_token = '<input type="hidden" name="csrf_token" value="'.$_SESSION['token'].'">';
106111

107112
?>

acp/core/dashboard.top.php

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,12 @@
33
//prohibit unauthorized access
44
require 'core/access.php';
55

6-
if(isset($_GET['a'])) {
7-
8-
if($_GET['a'] == 'delete_cache') {
9-
fc_delete_smarty_cache('all');
10-
}
11-
if($_GET['a'] == 'update_index') {
12-
fc_update_bulk_page_index();
13-
}
14-
6+
if(isset($_POST['delete_cache'])) {
7+
fc_delete_smarty_cache('all');
8+
}
9+
10+
if(isset($_POST['update_index'])) {
11+
fc_update_bulk_page_index();
1512
}
1613

1714

@@ -64,15 +61,22 @@
6461
if($user_result[$i]['user_class'] == "deleted"){
6562
$user_nick = "<strike>$user_nick</strike>";
6663
}
67-
$user_latest5 .= '<a href="acp.php?tn=user&sub=edit&edituser='.$user_id.'" class="list-group-item list-group-item-ghost list-group-item-action flex-column align-items-start">';
64+
65+
$user_latest5 .= '<div class="list-group-item list-group-item-ghost list-group-item-action flex-column align-items-start">';
6866
$user_latest5 .= '<div class="d-flex w-100 justify-content-between">';
67+
6968
$user_latest5 .= '<div>';
7069
$user_latest5 .= '<h6 class="mb-0">'.$user_nick.'</h6>';
7170
$user_latest5 .= '<small>'.$user_name.'</small>';
72-
$user_latest5 .= '</div>';
7371
$user_latest5 .= '<small>'.$user_registerdate.'</small>';
7472
$user_latest5 .= '</div>';
75-
$user_latest5 .= '</a>';
73+
$user_latest5 .= '<form class="inline" action="?tn=user&sub=edit" method="POST">';
74+
$user_latest5 .= '<button name="edituser" value='.$user_id.'" class="btn btn-fc btn-sm">'.$icon['edit'].'</button>';
75+
$user_latest5 .= $hidden_csrf_token;
76+
$user_latest5 .= '</form>';
77+
78+
$user_latest5 .= '</div>';
79+
$user_latest5 .= '</div>';
7680
}
7781

7882
}
@@ -126,6 +130,7 @@
126130
$top5pages .= '</div>';
127131
$top5pages .= '<form class="inline" action="?tn=pages&sub=edit" method="POST">';
128132
$top5pages .= '<button class="btn btn-fc btn-sm" name="editpage" value="'.$allPages[$i]['page_id'].'">'.$icon['edit'].'</button>';
133+
$top5pages .= $hidden_csrf_token;
129134
$top5pages .= '</form>';
130135
$top5pages .= '</div>';
131136

@@ -172,6 +177,7 @@
172177
$top5posts .= '</div>';
173178
$top5posts .= '<form class="inline" action="?tn=posts&sub=edit" method="POST">';
174179
$top5posts .= '<button class="btn btn-fc btn-sm" name="post_id" value="'.$allPosts[$i]['post_id'].'">'.$icon['edit'].'</button>';
180+
$top5posts .= $hidden_csrf_token;
175181
$top5posts .= '</form>';
176182
$top5posts .= '</div>';
177183

@@ -210,6 +216,7 @@
210216
$top5comments .= '</div>';
211217
$top5comments .= '<form class="inline" action="?tn=comments&sub=list#comid'.$allComments[$i]['comment_id'].'" method="POST">';
212218
$top5comments .= '<button class="btn btn-fc btn-sm" name="editid" value="'.$allComments[$i]['comment_id'].'">'.$icon['edit'].'</button>';
219+
$top5comments .= $hidden_csrf_token;
213220
$top5comments .= '</form>';
214221
$top5comments .= '</div>';
215222
$top5comments .= '</div>';
@@ -286,12 +293,13 @@
286293

287294
$btn_page_overview = '<a href="acp.php?tn=pages" class="btn btn-fc btn-sm w-100">'.$icon['sitemap'].'</a>';
288295
$btn_new_page = '<a href="acp.php?tn=pages&sub=new" class="btn btn-fc btn-sm w-100">'.$icon['plus'].' '.$lang['new'].'</a>';
289-
$btn_update_index = '<a href="acp.php?tn=dashboard&a=update_index" class="btn btn-fc btn-sm w-100">'.$icon['sync_alt'].' Index</a>';
290-
$btn_delete_cache = '<a href="acp.php?tn=dashboard&a=delete_cache" class="btn btn-fc btn-sm w-100">'.$icon['trash_alt'].' Cache</a>';
296+
297+
$btn_update_index = '<form action="?tn=dashboard" method="POST" class="d-inline"><button name="update_index" class="btn btn-fc btn-sm w-100 text-nowrap">'.$icon['sync_alt'].' Index</button>'.$hidden_csrf_token.'</form>';
298+
$btn_delete_cache = '<form action="?tn=dashboard" method="POST"><button name="delete_cache" class="btn btn-fc btn-sm w-100 text-nowrap">'.$icon['trash_alt'].' Cache</button>'.$hidden_csrf_token.'</form>';
291299

292300
$btn_post_overview = '<a href="acp.php?tn=posts" class="btn btn-fc btn-sm w-100">'.$lang['tn_posts'].'</a>';
293301
$btn_new_post = '<a href="acp.php?tn=posts&sub=edit" class="btn btn-fc btn-sm w-100">'.$icon['plus'].' '.$lang['new'].'</a>';
294-
$btn_comments_overview = '<a href="acp.php?tn=comments" class="btn btn-fc btn-sm w-100">'.$lang['tn_comments'].'</a>';
302+
$btn_comments_overview = '<a href="acp.php?tn=reactions" class="btn btn-fc btn-sm w-100">'.$lang['tn_comments'].'</a>';
295303

296304
$btn_user_overview = '<a href="acp.php?tn=user" class="btn btn-fc btn-sm w-100">'.$lang['list_user'].'</a>';
297305
$btn_new_user = '<a href="acp.php?tn=user&sub=new" class="btn btn-fc btn-sm w-100">'.$icon['plus'].' '.$lang['new_user'].'</a>';

acp/core/files.browser.php

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -130,8 +130,9 @@
130130
}
131131
$select_dir .= '</optgroup>';
132132
$select_dir .= '</select>';
133-
$select_dir .= '</div>';
134-
$select_dir .= '</div>';
133+
$select_dir .= '</div>';
134+
$select_dir .= '</div>';
135+
$select_dir .= $hidden_csrf_token;
135136
$select_dir .= '</form>';
136137

137138

@@ -612,6 +613,7 @@ function delete_folder($dir) {
612613
echo '<form class="inline pull-right" action="acp.php?tn=filebrowser&sub=browse&selected_folder='.dirname($disk).'" method="POST">';
613614
echo '<input type="submit" value="'.$lang['delete_folder'].'" class="btn btn-danger" onclick="return confirm(\''.$lang['confirm_delete_folder'].'\')">';
614615
echo '<input type="hidden" name="delete_folder" value="'.$disk.'">';
616+
echo $hidden_csrf_token;
615617
echo '</form>';
616618
echo '</div>';
617619
}
@@ -794,6 +796,7 @@ function delete_folder($dir) {
794796
echo '<div class="btn-group d-flex" role="group">';
795797
echo '<button class="btn btn-sm btn-fc w-100" type="submit" name="rebuild" value="database">Database '.$icon['wrench'].'</button>';
796798
echo '<button class="btn btn-sm btn-fc w-100" type="submit" name="clear_tmb">Thumbnails '.$icon['trash_alt'].'</button>';
799+
echo $hidden_csrf_token;
797800
echo '</div>';
798801
echo '</form>';
799802

acp/core/files.edit.php

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
$set_lang = $languagePack;
99
if(isset($_REQUEST['set_lang'])) {
1010
$set_lang = $_REQUEST['set_lang'];
11+
unset($media_data);
1112
}
1213

1314
$form_tpl = file_get_contents('templates/media-edit-form.tpl');
@@ -36,7 +37,7 @@
3637

3738

3839
if(isset($_POST['save'])) {
39-
$savedMedia = fc_write_media_data($_POST['realpath'],$_POST['title'],$_POST['notes'],$_POST['keywords'],$_POST['text'],$_POST['url'],$_POST['alt'],$set_lang,$_POST['credit'],$_POST['priority'],$_POST['license'],time(),$filesize,$_POST['version'],$_POST['media_labels']);
40+
$savedMedia = fc_write_media_data($_POST['realpath'],$_POST['title'],$_POST['notes'],$_POST['keywords'],$_POST['text'],$_POST['url'],$_POST['alt'],$_POST['set_lang'],$_POST['credit'],$_POST['priority'],$_POST['license'],time(),$filesize,$_POST['version'],$_POST['media_labels']);
4041
if($savedMedia == 'success') {
4142
$message = '<div class="alert alert-success alert-auto-close">'.$lang['db_changed'].'</div>';
4243
} else {
@@ -54,8 +55,8 @@
5455
echo '</div>';
5556

5657
$arr_lang = get_all_languages();
57-
$langSwitch = '<form action="?tn=filebrowser&sub=edit">';
58-
$langSwitch .= '<div class="btn-group" role="group">';
58+
59+
$langSwitch = '<div class="btn-group" role="group">';
5960
foreach($arr_lang as $langs) {
6061
$btn_status = '';
6162
if($langs['lang_sign'] == "$set_lang") { $btn_status = 'active'; }
@@ -64,7 +65,7 @@
6465
$langSwitch .= '</div>';
6566
$langSwitch .= '<input type="hidden" name="file" value="'.$media_filename.'">';
6667
$langSwitch .= '<input type="hidden" name="folder" value="'.$_REQUEST['folder'].'">';
67-
$langSwitch .= '</form>';
68+
6869

6970
$media_data = fc_get_media_data($realpath,$set_lang);
7071

acp/core/files.upload-script.php

Lines changed: 50 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -20,16 +20,13 @@
2020
$db_type = 'mysql';
2121

2222
$database = new Medoo([
23-
24-
'database_type' => 'mysql',
25-
'database_name' => "$database_name",
26-
'server' => "$database_host",
23+
'type' => 'mysql',
24+
'database' => "$database_name",
25+
'host' => "$database_host",
2726
'username' => "$database_user",
2827
'password' => "$database_psw",
29-
3028
'charset' => 'utf8',
3129
'port' => $database_port,
32-
3330
'prefix' => DB_PREFIX
3431
]);
3532

@@ -51,8 +48,8 @@
5148
define("CONTENT_DB", "$fc_db_content");
5249

5350
$db_content = new Medoo([
54-
'database_type' => 'sqlite',
55-
'database_file' => CONTENT_DB
51+
'type' => 'sqlite',
52+
'database' => CONTENT_DB
5653
]);
5754
}
5855

@@ -164,51 +161,53 @@
164161
}
165162
}
166163

167-
/* upload files to /upload/plugins/ */
168-
if($_REQUEST['upload_type'] == 'plugin') {
169-
if(array_key_exists('file',$_FILES) && $_FILES['file']['error'] == 0 ){
170-
$tmp_name = $_FILES["file"]["tmp_name"];
171-
$org_name = $_FILES["file"]["name"];
172-
$suffix = strtolower(substr(strrchr($org_name,'.'),1));
173-
$prefix = basename($org_name,".$suffix");
174-
$files_name = clean_filename($prefix,$suffix);
175-
if(!is_dir('../../upload/plugins')) {
176-
mkdir("../../upload/plugins", 0777, true);
177-
}
178-
$target = "../../upload/plugins/$files_name";
179-
@move_uploaded_file($tmp_name, $target);
164+
if($fc_upload_addons === true) {
165+
/* upload files to /upload/plugins/ */
166+
if($_REQUEST['upload_type'] == 'plugin') {
167+
if(array_key_exists('file',$_FILES) && $_FILES['file']['error'] == 0 ){
168+
$tmp_name = $_FILES["file"]["tmp_name"];
169+
$org_name = $_FILES["file"]["name"];
170+
$suffix = strtolower(substr(strrchr($org_name,'.'),1));
171+
$prefix = basename($org_name,".$suffix");
172+
$files_name = clean_filename($prefix,$suffix);
173+
if(!is_dir('../../upload/plugins')) {
174+
mkdir("../../upload/plugins", 0777, true);
175+
}
176+
$target = "../../upload/plugins/$files_name";
177+
@move_uploaded_file($tmp_name, $target);
178+
}
180179
}
181-
}
182-
183-
/* upload files to /upload/themes/ */
184-
if($_REQUEST['upload_type'] == 'theme') {
185-
if(array_key_exists('file',$_FILES) && $_FILES['file']['error'] == 0 ){
186-
$tmp_name = $_FILES["file"]["tmp_name"];
187-
$org_name = $_FILES["file"]["name"];
188-
$suffix = strtolower(substr(strrchr($org_name,'.'),1));
189-
$prefix = basename($org_name,".$suffix");
190-
$files_name = clean_filename($prefix,$suffix);
191-
if(!is_dir('../../upload/themes')) {
192-
mkdir("../../upload/themes", 0777, true);
193-
}
194-
$target = "../../upload/themes/$files_name";
195-
@move_uploaded_file($tmp_name, $target);
180+
181+
/* upload files to /upload/themes/ */
182+
if($_REQUEST['upload_type'] == 'theme') {
183+
if(array_key_exists('file',$_FILES) && $_FILES['file']['error'] == 0 ){
184+
$tmp_name = $_FILES["file"]["tmp_name"];
185+
$org_name = $_FILES["file"]["name"];
186+
$suffix = strtolower(substr(strrchr($org_name,'.'),1));
187+
$prefix = basename($org_name,".$suffix");
188+
$files_name = clean_filename($prefix,$suffix);
189+
if(!is_dir('../../upload/themes')) {
190+
mkdir("../../upload/themes", 0777, true);
191+
}
192+
$target = "../../upload/themes/$files_name";
193+
@move_uploaded_file($tmp_name, $target);
194+
}
196195
}
197-
}
198-
199-
/* upload files to /upload/modules/ */
200-
if($_REQUEST['upload_type'] == 'module') {
201-
if(array_key_exists('file',$_FILES) && $_FILES['file']['error'] == 0 ){
202-
$tmp_name = $_FILES["file"]["tmp_name"];
203-
$org_name = $_FILES["file"]["name"];
204-
$suffix = strtolower(substr(strrchr($org_name,'.'),1));
205-
$prefix = basename($org_name,".$suffix");
206-
$files_name = clean_filename($prefix,$suffix);
207-
if(!is_dir('../../upload/modules')) {
208-
mkdir("../../upload/modules", 0777, true);
209-
}
210-
$target = "../../upload/modules/$files_name";
211-
@move_uploaded_file($tmp_name, $target);
196+
197+
/* upload files to /upload/modules/ */
198+
if($_REQUEST['upload_type'] == 'module') {
199+
if(array_key_exists('file',$_FILES) && $_FILES['file']['error'] == 0 ){
200+
$tmp_name = $_FILES["file"]["tmp_name"];
201+
$org_name = $_FILES["file"]["name"];
202+
$suffix = strtolower(substr(strrchr($org_name,'.'),1));
203+
$prefix = basename($org_name,".$suffix");
204+
$files_name = clean_filename($prefix,$suffix);
205+
if(!is_dir('../../upload/modules')) {
206+
mkdir("../../upload/modules", 0777, true);
207+
}
208+
$target = "../../upload/modules/$files_name";
209+
@move_uploaded_file($tmp_name, $target);
210+
}
212211
}
213212
}
214213

0 commit comments

Comments
 (0)