mirror/php-e107
1
0
Fork 0
mirror of https://github.com/e107inc/e107.git synced 2025-07-31 20:00:37 +02:00
Code Issues Releases Wiki Activity

More user-setting checks.

Browse Source
This commit is contained in:
Cameron
2016-06-28 09:25:30 -07:00
parent b82cfaea92
commit 0af67301ea
2 changed files with 33 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
e107_handlers/user_handler.php
View File

@@ -54,7 +54,7 @@ class UserHandler
var $preferred = PASSWORD_DEFAULT_TYPE; // Preferred password format var $preferred = PASSWORD_DEFAULT_TYPE; // Preferred password format
var $passwordOpts = 0; // Copy of pref var $passwordOpts = 0; // Copy of pref
var $passwordEmail = false; // True if can use email address to log in var $passwordEmail = false; // True if can use email address to log in
var $otherFields = array(); private $otherFields = array();
private $passwordAPI = false; private $passwordAPI = false;
// Constructor // Constructor
@@ -179,6 +179,36 @@ class UserHandler
} }
/**
* Check if a user posted field is readonly (should not be user-editable) - used in usersettings.php
* @param array $posted
* @return bool
*/
public function hasReadonlyField($posted)
{
$restricted = array_keys($this->otherFields);
$pref = e107::getPref();
if(empty($pref['signup_option_class']))
{
$restricted[] = 'user_class';
}
foreach($posted as $k=>$v)
{
if(in_array($k,$restricted))
{
return true;
}
}
return false;
}
/** /**
* Given plaintext password and login name, generate password string to store in DB * Given plaintext password and login name, generate password string to store in DB
* *

4
usersettings.php
View File

@@ -352,8 +352,9 @@ elseif (isset($_POST['SaveValidatedInfo'])) // Next bit only valid if user editi
{ // Got some data confirmed with password entry { // Got some data confirmed with password entry
$new_data = base64_decode($_POST['updated_data']); $new_data = base64_decode($_POST['updated_data']);
// Should only happen if someone's fooling around // Should only happen if someone's fooling around
if (md5($new_data) != $_POST['updated_key'] || isset($new_data['user_admin']) || isset($new_data['user_perms'])) if (md5($new_data) != $_POST['updated_key'] || ($userMethods->hasReadonlyField($new_data) !==false))
{ {
echo LAN_USET_42.'<br />'; echo LAN_USET_42.'<br />';
exit(); exit();
@@ -812,7 +813,6 @@ function req($field)
} }
// Delete a file from the public directories. Return TRUE on success, FALSE on failure. // Delete a file from the public directories. Return TRUE on success, FALSE on failure.
// Also deletes from database if appropriate. // Also deletes from database if appropriate.
function delete_file($fname, $dir = 'avatars/') function delete_file($fname, $dir = 'avatars/')