Acasă Explorează Ajutor
Autentificare
yosoyhendrix
/
OGP-Website
oglindă de https://github.com/OpenGamePanel/OGP-Website
1
0
Bifurcare 0
Fisiere Probleme 0 Wiki
Răsfoiți Sursa

Fixes for Lang Check (#638)

* Fixes for Lang Check

* Fixes for Lang Check
OwN-3m-All 1 an în urmă
părinte
62548577d2
comite
8f6e83d61c
3 a modificat fișierele cu 56 adăugiri și 22 ștergeri
Vedere unificată Arată Statisticile Diff
  1. 43 19
      lang/lang-check.php
  2. 5 1
      modules/litefm/fm_dir.php
  3. 8 2
      modules/lostpwd/lostpwd.php

+ 43 - 19
lang/lang-check.php
Vizualizați fișierul 

@@ -35,33 +35,59 @@ require_once CONFIG_FILE;
 
 // Connect to the database server and select database.
 
 // Connect to the database server and select database.
 
 $db = createDatabaseConnection($db_type, $db_host, $db_user, $db_pass, $db_name, $table_prefix);
 
 $db = createDatabaseConnection($db_type, $db_host, $db_user, $db_pass, $db_name, $table_prefix);
 
 
 
-startSession();
 
-
 
-if(!isset($_SESSION['user_id']) || !$db->isAdmin($_SESSION['user_id'])){
 
-	die("You must be logged in and an admin user to use this page!");
 
-}
 
-
 
 function curPageURL() {
 
 function curPageURL() {
 
 	$pageURL = ( isset($_SERVER['HTTPS']) and  get_true_boolean($_SERVER['HTTPS']) ) ? "https://" : "http://";
 
 	$pageURL = ( isset($_SERVER['HTTPS']) and  get_true_boolean($_SERVER['HTTPS']) ) ? "https://" : "http://";
 
+	$serverName = $_SERVER["SERVER_NAME"];
 
+	if($serverName == "_"){
 
+		$serverName = "localhost";
 
+	}
 
 	if ($_SERVER["SERVER_PORT"] != "80")
 
 	if ($_SERVER["SERVER_PORT"] != "80")
 
-		$pageURL .= $_SERVER["SERVER_NAME"].":".$_SERVER["SERVER_PORT"].$_SERVER["REQUEST_URI"];
 
+		$pageURL .= $serverName.":".$_SERVER["SERVER_PORT"].$_SERVER["REQUEST_URI"];
 
 	else
 
 	else
 
-		$pageURL .= $_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
 
+		$pageURL .= $serverName.$_SERVER["REQUEST_URI"];
 
 	return $pageURL;
 
 	return $pageURL;
 
 }
 
 }
 
 
 
-if(isset($_GET['file'])) // Don't allow remote URLs
 
+if(isset($_GET['file']) && isset($_GET['apiKey']) && isset($_GET['userId'])) // Don't allow remote URLs
 
 {
 
 {
 
-	if(!filter_var($_GET['file'], FILTER_VALIDATE_URL)){
 
-		$file = urldecode($_GET['file']);
 
-		include($file);
 
-		$constants = get_defined_constants(true);
 
-		echo base64_encode(serialize($constants['user']));
 
-		exit();
 
+	// Check API key
 
+	$isAdminUser = $db->isAdmin($_GET['userId']);
 
+	$apiKey = $db->getApiToken($_GET['userId']);
 
+	if($isAdminUser){
 
+		if($apiKey == $_GET['apiKey']){
 
+			if(!filter_var($_GET['file'], FILTER_VALIDATE_URL)){
 
+				$file = urldecode($_GET['file']);
 
+				if(file_exists(__dir__ . "/" . $file)){
 
+					include(__dir__ . "/" . $file);
 
+					$constants = get_defined_constants(true);
 
+					echo base64_encode(serialize($constants['user']));
 
+					exit();
 
+				}else{
 
+					echo "FILE DOESNT EXIST " . $file;
 
+					exit();
 
+				}
 
+			}else{
 
+				echo "FILE IS URL - NOT ALLOWED";
 
+				exit();
 
+			}
 
+		}else{
 
+			echo "NO MATCH";
 
+			exit();
 
+		}
 
 	}else{
 
 	}else{
 
+		echo "NOT ADMIN";
 
 		exit();
 
 		exit();
 
 	}
 
 	}
 
 }
 
 }
 
+
 
+startSession();
 
+
 
+if(!isset($_SESSION['user_id']) || !$db->isAdmin($_SESSION['user_id'])){
 
+	die("You must be logged in and an admin user to use this page!");
 
+}else{
 
+	$apiKey = $db->getApiToken($_SESSION['user_id']);
 
+}
 
+
 
 ?>
 
 ?>
 
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 
 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 
 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 
@@ -152,8 +178,6 @@ foreach ($locale_files as $lang_name)
 
 }
 
 }
 
 echo "</ul>";
 
 echo "</ul>";
 
 
 
-startSession();
 
-
 
 if ( isset($_SESSION['users_login']) )
 
 if ( isset($_SESSION['users_login']) )
 
 {
 
 {
 
 	$userInfo = $db->getUser($_SESSION['users_login']);
 
 	$userInfo = $db->getUser($_SESSION['users_login']);
 
@@ -195,7 +219,7 @@ $current_url = curPageURL();
 
 foreach ($global_comparison_lang_files as $glf)
 
 foreach ($global_comparison_lang_files as $glf)
 
 {
 
 {
 
 	$file = $COMPARISON_LANG."/".$glf;
 
 	$file = $COMPARISON_LANG."/".$glf;
 
-	$contents = file_get_contents($current_url.'?file='.$file);
 
+	$contents = file_get_contents($current_url.'?file='.$file . '&apiKey=' . $apiKey . "&userId=" . $_SESSION['user_id']);
 
 	$lang[$glf] = unserialize(base64_decode($contents));
 
 	$lang[$glf] = unserialize(base64_decode($contents));
 
 }
 
 }
 
 
 
@@ -220,7 +244,7 @@ foreach ($locale_files as $lang_name)
 
 		}
 
 		}
 
 		
 		
 		$compare_lang = array();
 
 		$compare_lang = array();
 
-		$contents = file_get_contents("$current_url?file=$file");
 
+		$contents = file_get_contents($current_url . "?file=" . $file . "&apiKey=" . $apiKey . "&userId=" . $_SESSION['user_id']);
 
 		$compare_lang = unserialize(base64_decode($contents));
 
 		$compare_lang = unserialize(base64_decode($contents));
 
 		if(!is_array($compare_lang))
 
 		if(!is_array($compare_lang))
 
 			die("Errors where found at $file");
 
 			die("Errors where found at $file");

+ 5 - 1
modules/litefm/fm_dir.php
Vizualizați fișierul 

@@ -156,7 +156,11 @@ function exec_ogp_module()
 
 			$count = 0;
 
 			$count = 0;
 
 			$s = ( isset($_SERVER['HTTPS']) and  get_true_boolean($_SERVER['HTTPS']) ) ? "s" : "";
 
 			$s = ( isset($_SERVER['HTTPS']) and  get_true_boolean($_SERVER['HTTPS']) ) ? "s" : "";
 
 			$p = (isset($_SERVER['SERVER_PORT']) and $_SERVER['SERVER_PORT'] != "80") ? ":".$_SERVER['SERVER_PORT'] : "";
 
 			$p = (isset($_SERVER['SERVER_PORT']) and $_SERVER['SERVER_PORT'] != "80") ? ":".$_SERVER['SERVER_PORT'] : "";
 
-			$url = 'http'.$s.'://'.$_SERVER['SERVER_NAME'].$p.$_SERVER['SCRIPT_NAME'];
 
+			$serverName = $_SERVER["SERVER_NAME"];
 
+			if($serverName == "_"){
 
+				$serverName = "localhost";
 
+			}
 
+			$url = 'http'.$s.'://'.$serverName.$p.$_SERVER['SCRIPT_NAME'];
 
 			// loop all files
 
 			// loop all files
 
 			foreach ( $_FILES['files']['name'] as $i => $name )
 
 			foreach ( $_FILES['files']['name'] as $i => $name )
 
 			{
 
 			{

+ 8 - 2
modules/lostpwd/lostpwd.php
Vizualizați fișierul 

@@ -89,8 +89,14 @@ function exec_ogp_module() {
 
 					$ch_pass_uid = $user_info['users_passwd'];
 
 					$ch_pass_uid = $user_info['users_passwd'];
 
 					$subject = get_lang('confirm_change_subject');
 
 					$subject = get_lang('confirm_change_subject');
 
 					$s = ( isset($_SERVER['HTTPS']) and  get_true_boolean($_SERVER['HTTPS']) ) ? "s" : "";
 
 					$s = ( isset($_SERVER['HTTPS']) and  get_true_boolean($_SERVER['HTTPS']) ) ? "s" : "";
 
-					$recover_link = '<a href="http'.$s.'://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI']."&user_id=".$user_id.'&ch_pass_uid='.$ch_pass_uid.
 
-									'" >http'.$s.'://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI']."&user_id=".$user_id.'&ch_pass_uid='.$ch_pass_uid.'</a>';
 
+					
+					$serverName = $_SERVER["SERVER_NAME"];
 
+					if($serverName == "_"){
 
+						$serverName = "localhost";
 
+					}
 
+					
+					$recover_link = '<a href="http'.$s.'://'.$serverName.$_SERVER['REQUEST_URI']."&user_id=".$user_id.'&ch_pass_uid='.$ch_pass_uid.
 
+									'" >http'.$s.'://'.$serverName.$_SERVER['REQUEST_URI']."&user_id=".$user_id.'&ch_pass_uid='.$ch_pass_uid.'</a>';
 
 					$message = get_lang_f('confirm_change_password_message',$recover_link);
 
 					$message = get_lang_f('confirm_change_password_message',$recover_link);
 
 
 
 					if (mymail($email_address, $subject, $message, $settings) == TRUE)
 
 					if (mymail($email_address, $subject, $message, $settings) == TRUE)