mirror/php-e107
1
0
Fork 0
mirror of https://github.com/e107inc/e107.git synced 2025-08-01 04:10:38 +02:00
Code Issues Releases Wiki Activity

Fixed typo in prefs.php, which resulted in an empty pref post_scripts

Browse Source 
Added check&update for pref post_scripts in 2.1.8 update routine
This commit is contained in:
Achim Ennenbach
2018-07-13 22:45:41 +02:00
parent 26d72ff21e
commit 8fea5fa53e
2 changed files with 15 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
e107_admin/prefs.php
View File

@@ -1210,9 +1210,7 @@ if ($savePrefs) $core_pref->setPref($pref)->save(false, true);
<tr>
<td><label for='post-script'>".PRFLAN_215.":</label></td>
<td>
".//r_userclass('post_script',$pref['post_script'],'off','nobody,member,admin,main,classes')
$e_userclass->uc_dropdown('post_script',$pref['post_script'],'off','nobody,admin,main,classes,no-excludes')
."
".$e_userclass->uc_dropdown('post_script',$pref['post_script'],'nobody,admin,main,classes,no-excludes')."
<div class='smalltext field-help'>".PRFLAN_216."</div>
</td>
</tr>

15
e107_admin/update_routines.php
View File

@@ -584,12 +584,25 @@ function update_core_database($type = '')
}
//todo add check for post_html pref value.
// Make sure, that the pref "post_script" contains one of the allowed userclasses
// Close possible security hole
if (!array_key_exists(e107::getPref('post_script'), e107::getUserClass()->uc_required_class_list('nobody,admin,main,classes,no-excludes', true)))
{
if ($just_check)
{
return update_needed("Pref 'Class which can post < script > and similar tags' contains an invalid value"); // NO LAN.
}
else
{
e107::getConfig()->setPref('post_script', 255)->save(false, true);
}
}
return $just_check;
}