diff --git a/.htaccess b/.htaccess index 3293165..31ad65c 100644 --- a/.htaccess +++ b/.htaccess @@ -59,5 +59,10 @@ AddDefaultCharset UTF-8 Satisfy All +# Allow read files. + + Allow from all + + # Don't show directory listings for URLs which map to a directory. Options -Indexes diff --git a/CHANGELOG.md b/CHANGELOG.md index d1cc771..989d045 100755 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,11 @@ +Monstra 3.0.4, 2016-04-05 +------------------------ +- Fixed User Security by adding a check that compares POST id with SESSION +id for none admin edits +- Fixed ability to read robots.txt +- Stylesheet: Changed minified URIs to eliminate query strings + + Monstra 3.0.3, 2016-01-29 ------------------------ - Improved Monstra Security diff --git a/engine/Monstra.php b/engine/Monstra.php index 3f26cc8..b1a50fb 100644 --- a/engine/Monstra.php +++ b/engine/Monstra.php @@ -31,7 +31,7 @@ class Monstra /** * The version of Monstra */ - const VERSION = '3.0.3'; + const VERSION = '3.0.4'; /** diff --git a/engine/Plugin/Javascript.php b/engine/Plugin/Javascript.php index 57072c8..5126f98 100644 --- a/engine/Plugin/Javascript.php +++ b/engine/Plugin/Javascript.php @@ -59,7 +59,7 @@ class Javascript public static function load() { $backend_site_js_path = MINIFY . DS . 'backend_site.minify.js'; - $frontend_site_js_path = MINIFY . DS . 'frontend_site.minify.js'; + $frontend_site_js_path = MINIFY . DS . 'frontend_site.minify.'.Option::get('javascript_version').'.js'; // Load javascripts if (count(Javascript::$javascripts) > 0) { @@ -122,7 +122,7 @@ class Javascript if (BACKEND) { echo ''; } else { - echo ''."\n"; + echo ''."\n"; } } } diff --git a/engine/Plugin/Stylesheet.php b/engine/Plugin/Stylesheet.php index 214374d..4907805 100644 --- a/engine/Plugin/Stylesheet.php +++ b/engine/Plugin/Stylesheet.php @@ -59,7 +59,7 @@ class Stylesheet public static function load() { $backend_site_css_path = MINIFY . DS . 'backend_site.minify.css'; - $frontend_site_css_path = MINIFY . DS . 'frontend_site.minify.css'; + $frontend_site_css_path = MINIFY . DS . 'frontend_site.minify.'.Option::get('styles_version').'.css'; // Load stylesheets if (count(Stylesheet::$stylesheets) > 0) { @@ -124,7 +124,7 @@ class Stylesheet if (BACKEND) { echo ''; } else { - echo ''."\n"; + echo ''."\n"; } } } diff --git a/plugins/box/users/users.plugin.php b/plugins/box/users/users.plugin.php index 2ff9a2a..b41520c 100644 --- a/plugins/box/users/users.plugin.php +++ b/plugins/box/users/users.plugin.php @@ -228,27 +228,32 @@ class Users extends Frontend // Check csrf if (Security::check(Request::post('csrf'))) { - - if (Security::safeName(Request::post('login')) != '') { - if (Users::$users->update(Request::post('user_id'), - array('login' => Security::safeName(Request::post('login')), - 'firstname' => Request::post('firstname'), - 'lastname' => Request::post('lastname'), - 'email' => Request::post('email'), - 'skype' => Request::post('skype'), - 'about_me' => Request::post('about_me'), - 'twitter' => Request::post('twitter')))) { - - // Change password - if (trim(Request::post('new_password')) != '') { - Users::$users->update(Request::post('user_id'), array('password' => Security::encryptPassword(trim(Request::post('new_password'))))); + + // Check for POST data manipulation + if( ((int) Session::get('user_id') == (int) Request::post('user_id')) or (in_array(Session::get('user_role'), array('admin'))) ) { + + if (Security::safeName(Request::post('login')) != '') { + if (Users::$users->update(Request::post('user_id'), + array('login' => Security::safeName(Request::post('login')), + 'firstname' => Request::post('firstname'), + 'lastname' => Request::post('lastname'), + 'email' => Request::post('email'), + 'skype' => Request::post('skype'), + 'about_me' => Request::post('about_me'), + 'twitter' => Request::post('twitter')))) { + + // Change password + if (trim(Request::post('new_password')) != '') { + Users::$users->update(Request::post('user_id'), array('password' => Security::encryptPassword(trim(Request::post('new_password'))))); + } + + Notification::set('success', __('Your changes have been saved.', 'users')); + Request::redirect(Site::url().'/users/'.$user['id']); } - - Notification::set('success', __('Your changes have been saved.', 'users')); - Request::redirect(Site::url().'/users/'.$user['id']); - } - } else { } - + } else { } + + } else { die('Monstra says: This is not your profile...'); } + } else { die('Request was denied because it contained an invalid security token. Please refresh the page and try again.'); } }