/** * sanitize URL (remove '/./', '/../', '//') **/ function sanitize_url($href) { return CAT_Helper_Validate::sanitize_url($href); }
/** * returns the items of static array $jquery * * @access public * @return HTML **/ public static function getJQuery($for = 'header') { if ($for == 'header') { $static =& CAT_Helper_Page::$jquery; } else { $static =& CAT_Helper_Page::$f_jquery; } if ($for == 'footer' && count(CAT_Helper_Page::$css)) { if (!CAT_Helper_Page::$jquery_core) { array_unshift($static, CAT_Helper_Page::$space . '<script type="text/javascript" src="' . CAT_Helper_Validate::sanitize_url(CAT_URL . '/modules/lib_jquery/jquery-core/jquery-core.min.js') . '"></script>' . "\n"); CAT_Helper_Page::$jquery_core = true; } } if (count($static)) { return implode($static); } return NULL; }
/** * **/ function export_droplets() { global $parser, $val, $backend; $groups = CAT_Users::get_groups_id(); if (!CAT_Helper_Droplet::is_allowed('export_droplets', $groups)) { $backend->print_error($backend->lang()->translate("You don't have the permission to do this")); } $info = array(); // get all marked droplets $marked = isset($_POST['markeddroplet']) ? $_POST['markeddroplet'] : array(); if (isset($marked) && !is_array($marked)) { $marked = array($marked); } if (!count($marked)) { return $backend->lang()->translate('Please mark some Droplets to export'); } $temp_dir = CAT_PATH . '/temp/droplets/'; // make the temporary working directory @mkdir($temp_dir); foreach ($marked as $id) { $droplet = CAT_Helper_Droplet::getDroplet($id); $name = $droplet["name"]; $usage = preg_replace('/[\\x00-\\x1F\\x7F]/', "\n//", $droplet['comments']); if (substr($usage, -2, 2) == '//') { $usage = substr($usage, 0, -3); } $info[] = 'Droplet: ' . $name . '.php<br />'; $sFile = $temp_dir . $name . '.php'; $fh = fopen($sFile, 'w'); fwrite($fh, '//:' . $droplet['description'] . "\n"); fwrite($fh, '//:' . $usage . "\n"); fwrite($fh, $droplet['code']); fclose($fh); $file = NULL; // look for a data file if (file_exists(dirname(__FILE__) . '/data/' . $droplet['name'] . '.txt')) { $file = CAT_Helper_Directory::sanitizePath(dirname(__FILE__) . '/data/' . $droplet['name'] . '.txt'); } elseif (file_exists(dirname(__FILE__) . '/data/' . strtolower($droplet['name']) . '.txt')) { $file = CAT_Helper_Directory::sanitizePath(dirname(__FILE__) . '/data/' . strtolower($droplet['name']) . '.txt'); } elseif (file_exists(dirname(__FILE__) . '/data/' . strtoupper($droplet['name']) . '.txt')) { $file = CAT_Helper_Directory::sanitizePath(dirname(__FILE__) . '/data/' . strtoupper($droplet['name']) . '.txt'); } if ($file) { if (!file_exists($temp_dir . '/data')) { @mkdir($temp_dir . '/data'); } copy($file, $temp_dir . '/data/' . basename($file)); } } $filename = 'droplets'; // if there's only a single droplet to export, name the zip-file after this droplet if (count($marked) === 1) { $filename = 'droplet_' . $name; } // add current date to filename $filename .= '_' . date('Y-m-d'); // while there's an existing file, add a number to the filename if (file_exists(CAT_PATH . '/modules/droplets/export/' . $filename . '.zip')) { $n = 1; while (file_exists(CAT_PATH . '/modules/droplets/export/' . $filename . '_' . $n . '.zip')) { $n++; } $filename .= '_' . $n; } $temp_file = CAT_Helper_Directory::sanitizePath(CAT_PATH . '/temp/' . $filename . '.zip'); // create zip $archive = CAT_Helper_Zip::getInstance($temp_file)->config('removePath', $temp_dir); $file_list = $archive->create($temp_dir); if ($file_list == 0 && !CAT_Helper_Validate::sanitizeGet('ajax')) { list_droplets($backend->lang()->translate("Packaging error") . ' - ' . $archive->errorInfo(true)); } else { $export_dir = CAT_Helper_Directory::sanitizePath(CAT_PATH . '/modules/droplets/export'); // create the export folder if it doesn't exist if (!file_exists($export_dir)) { mkdir($export_dir, 0777); } if (!copy($temp_file, $export_dir . '/' . $filename . '.zip') && !CAT_Helper_Validate::sanitizeGet('ajax')) { echo '<div class="drfail">', $backend->lang()->translate('Unable to move the exported ZIP-File!'), '</div>'; $download = CAT_URL . '/temp/' . $filename . '.zip'; } else { unlink($temp_file); $download = CAT_Helper_Validate::sanitize_url(CAT_URL . '/modules/droplets/export/' . $filename . '.zip'); } } CAT_Helper_Directory::removeDirectory($temp_dir); if (CAT_Helper_Validate::sanitizeGet('ajax')) { return true; } return $backend->lang()->translate('Backup created') . '<br /><br />' . implode("\n", $info) . '<br /><br /><a href="' . $download . '">Download</a>'; }
$root .= "../"; $level += 1; } if (file_exists($root . '/framework/class.secure.php')) { include $root . '/framework/class.secure.php'; } else { trigger_error(sprintf("[ <b>%s</b> ] Can't include class.secure.php!", $_SERVER['SCRIPT_NAME']), E_USER_ERROR); } } $backend = CAT_Backend::getInstance('pages', 'pages_modify'); $update_when_modified = true; // Tells script to update when this page was last updated require CAT_PATH . '/modules/admin.php'; // Update the mod_wrapper table with the contents if (isset($_POST['url'])) { $url = CAT_Helper_Validate::sanitize_url($_POST['url']); $height = isset($_POST['height']) ? $_POST['height'] : '400px'; $width = isset($_POST['width']) ? $_POST['width'] : '100%'; $type = isset($_POST['wrapper_type']) ? $_POST['wrapper_type'] : 'object'; if (is_numeric($height)) { $height .= 'px'; } if (is_numeric($width)) { $width .= 'px'; } $query = "UPDATE `:prefix:mod_wrapper` SET `url`=:url,`height`=:height,`width`=:width,`wtype`=:wtype WHERE `section_id`=:sec"; $database->query($query, array('url' => $url, 'height' => $height, 'width' => $width, 'wtype' => $type, 'sec' => $section_id)); } // Check if there is a database error, otherwise say successful if ($database->isError()) { $admin->print_error($database->getError(), $js_back);