From ed8fe6c27a39222604e65acdb09de27fd85fb0a2 Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Mon, 22 Jul 2013 17:51:13 -0400 Subject: Option to check public ban message by default --- templates/mod/ban_form.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'templates/mod') diff --git a/templates/mod/ban_form.html b/templates/mod/ban_form.html index edc1ab3b..6c7560ad 100644 --- a/templates/mod/ban_form.html +++ b/templates/mod/ban_form.html @@ -41,11 +41,11 @@ {% trans 'Message' %} - + ({% trans 'public; attached to post' %}) - {% if not config.additional_javascript_compile %} - {% for javascript in config.additional_javascript %}{% endfor %} - {% endif %} - {% endif %} - {% if config.recaptcha %}{% endif %} - - - {{ boardlist.top }} - {% if pm %}

You have an unread PM{% if pm.waiting > 0 %}, plus {{ pm.waiting }} more waiting{% endif %}.

{% endif %} - {% if config.url_banner %}{% endif %} -

{{ board.url }} - {{ board.title|e }}

- {% if board.subtitle %} - {{ board.subtitle|e }} - {% endif %} - {% if mod %}

{% trans %}Return to dashboard{% endtrans %}

{% endif %} -

- - - - {% include 'post_form.html' %} - - {% if config.blotter %}

{% endif %} -

- - [{% trans %}Return{% endtrans %}] - - {{ boardlist.bottom }} - - - - + {% if config.font_awesome %}{% endif %} + {% if not nojavascript %} + + {% if not config.additional_javascript_compile %} + {% for javascript in config.additional_javascript %}{% endfor %} + {% endif %} + {% endif %} + {% if config.recaptcha %}{% endif %} + + + {{ boardlist.top }} + {% if pm %}

You have an unread PM{% if pm.waiting > 0 %}, plus {{ pm.waiting }} more waiting{% endif %}.

{% endif %} + {% if config.url_banner %}{% endif %} +

{{ board.url }} - {{ board.title|e }}

+ {% if board.subtitle %} + {{ board.subtitle|e }} + {% endif %} + {% if mod %}

{% trans %}Return to dashboard{% endtrans %}

{% endif %} +

+ + + + {% include 'post_form.html' %} + + {% if config.blotter %}

{% endif %} +

+ + [{% trans %}Return{% endtrans %}] + + {{ boardlist.bottom }} + + + + -- cgit v1.3 From ea2b8cce077a092e0cbf136f9a45158668cc5ecf Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Wed, 31 Jul 2013 21:24:17 -0400 Subject: Bugfix: HTML injection in post editing (introduces and fixes yet another bug) --- inc/functions.php | 4 ++-- inc/mod/pages.php | 9 ++++++--- templates/mod/edit_post_form.html | 2 +- 3 files changed, 9 insertions(+), 6 deletions(-) (limited to 'templates/mod') diff --git a/inc/functions.php b/inc/functions.php index b40b40d2..9e1ce1fa 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -1420,7 +1420,7 @@ function markup(&$body, $track_cites = false) { $body = str_replace("\r", '', $body); $body = utf8tohtml($body); - if (preg_match_all('@<tinyboard ([\w\s]+)>(.+)</tinyboard>@um', $body, $modifiers, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) { + if (preg_match_all('@<tinyboard ([\w\s]+)>(.+?)</tinyboard>@um', $body, $modifiers, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) { $skip_chars = 0; $body_tmp = $body; $end_markup = false; @@ -1436,7 +1436,7 @@ function markup(&$body, $track_cites = false) { if ($modifier['type'] == 'ban message') { // Public ban message - $replacement = sprintf($config['mod']['ban_message'], $modifier['content']); + $replacement = sprintf($config['mod']['ban_message'], html_entity_decode($modifier['content'])); if ($end_markup) { $body .= $replacement; } diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 7edc0ee6..2808dc56 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -1222,7 +1222,7 @@ function mod_ban_post($board, $delete, $post, $token = false) { $_POST['message'] = str_replace('%LENGTH%', strtoupper($length_english), $_POST['message']); $query = prepare(sprintf('UPDATE `posts_%s` SET `body_nomarkup` = CONCAT(`body_nomarkup`, :body_nomarkup) WHERE `id` = :id', $board)); $query->bindValue(':id', $post); - $query->bindValue(':body_nomarkup', sprintf("\n%s", $_POST['message'])); + $query->bindValue(':body_nomarkup', sprintf("\n%s", utf8tohtml($_POST['message']))); $query->execute() or error(db_error($query)); rebuildPost($post); @@ -1298,10 +1298,13 @@ function mod_edit_post($board, $edit_raw_html, $postID) { header('Location: ?/' . sprintf($config['board_path'], $board) . $config['dir']['res'] . sprintf($config['file_page'], $post['thread'] ? $post['thread'] : $postID) . '#' . $postID, true, $config['redirect_http']); } else { if ($config['minify_html']) { - $post['body_nomarkup'] = str_replace("\n", ' ', $post['body_nomarkup']); - $post['body'] = str_replace("\n", ' ', $post['body']); + // $post['body_nomarkup'] = str_replace("\n", ' ', $post['body_nomarkup']); + // $post['body'] = str_replace("\n", ' ', $post['body']); } + // Minifying this page causes an issue with newlines in the textarea. This is a temporary solution. + $config['minify_html'] = false; + mod_page(_('Edit post'), 'mod/edit_post_form.html', array('token' => $security_token, 'board' => $board, 'raw' => $edit_raw_html, 'post' => $post)); } } diff --git a/templates/mod/edit_post_form.html b/templates/mod/edit_post_form.html index 146e725b..b9359c68 100644 --- a/templates/mod/edit_post_form.html +++ b/templates/mod/edit_post_form.html @@ -32,7 +32,7 @@ {% trans %}Comment{% endtrans %} - + -- cgit v1.3 From 6b6f32949df7be58c7a9125711aeab2c34cd1d54 Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Thu, 1 Aug 2013 15:20:25 -0400 Subject: Web config editor: Use a + {% elseif var.type == 'integer' and var.name.0 == 'mod' and (var.default in ['JANITOR', 'MOD', 'ADMIN', 'DISABLED'] or var.default|slice(0, 14) == "$config['mod']") and var.value <= constant('DISABLED') %} + {% elseif var.type == 'integer' %} {% elseif var.type == 'boolean' %} -- cgit v1.3 From 5a44c50811ba9a927add4d54604307692492df8a Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Thu, 1 Aug 2013 17:18:10 -0400 Subject: Simple file editor replacement for ?/config (optional). Issue #127 --- inc/config.php | 7 +++--- inc/mod/pages.php | 29 ++++++++++++++++++----- templates/mod/config-editor-php.html | 45 ++++++++++++++++++++++++++++++++++++ templates/mod/dashboard.html | 2 +- templates/mod/edit_post_form.html | 2 +- 5 files changed, 74 insertions(+), 11 deletions(-) create mode 100644 templates/mod/config-editor-php.html (limited to 'templates/mod') diff --git a/inc/config.php b/inc/config.php index d82ebfc6..bddb9e4c 100644 --- a/inc/config.php +++ b/inc/config.php @@ -929,6 +929,9 @@ // Automatically dismiss all reports regarding a thread when it is locked $config['mod']['dismiss_reports_on_lock'] = true; + // Replace ?/config with a simple text editor for editing inc/instance-config.php + $config['mod']['config_editor_php'] = false; + // Probably best not to change these: if (!defined('JANITOR')) { define('JANITOR', 0, true); @@ -999,7 +1002,7 @@ // Bypass flood check $config['mod']['flood'] = ADMIN; // Raw HTML posting - $config['mod']['rawhtml'] = DISABLED; + $config['mod']['rawhtml'] = ADMIN; /* Administration */ // View the report queue @@ -1077,8 +1080,6 @@ // Delete news entries $config['mod']['news_delete'] = ADMIN; - // View the current configuration - $config['mod']['show_config'] = ADMIN; // Edit the current configuration (via web interface) $config['mod']['edit_config'] = ADMIN; diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 1e0dc7c9..615e85c7 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -1304,13 +1304,12 @@ function mod_edit_post($board, $edit_raw_html, $postID) { header('Location: ?/' . sprintf($config['board_path'], $board) . $config['dir']['res'] . sprintf($config['file_page'], $post['thread'] ? $post['thread'] : $postID) . '#' . $postID, true, $config['redirect_http']); } else { if ($config['minify_html']) { - // $post['body_nomarkup'] = str_replace("\n", ' ', $post['body_nomarkup']); - // $post['body'] = str_replace("\n", ' ', $post['body']); + $post['body_nomarkup'] = str_replace("\n", ' ', utf8tohtml($post['body_nomarkup'])); + $post['body'] = str_replace("\n", ' ', utf8tohtml($post['body'])); + $post['body_nomarkup'] = str_replace("\r", '', $post['body_nomarkup']); + $post['body'] = str_replace("\r", '', $post['body']); } - - // Minifying this page causes an issue with newlines in the textarea. This is a temporary solution. - $config['minify_html'] = false; - + mod_page(_('Edit post'), 'mod/edit_post_form.html', array('token' => $security_token, 'board' => $board, 'raw' => $edit_raw_html, 'post' => $post)); } } @@ -1948,6 +1947,24 @@ function mod_config() { if (!hasPermission($config['mod']['edit_config'])) error($config['error']['noaccess']); + if ($config['mod']['config_editor_php']) { + $readonly = !is_writable('inc/instance-config.php'); + + if (!$readonly && isset($_POST['code'])) { + $code = $_POST['code']; + file_put_contents('inc/instance-config.php', $code); + header('Location: ?/config', true, $config['redirect_http']); + return; + } + + $instance_config = file_get_contents('inc/instance-config.php'); + $instance_config = str_replace("\n", ' ', utf8tohtml($instance_config)); + + mod_page(_('Config editor'), 'mod/config-editor-php.html', array('php' => $instance_config, 'readonly' => $readonly)); + return; + } + + require_once 'inc/mod/config-editor.php'; $conf = config_vars(); diff --git a/templates/mod/config-editor-php.html b/templates/mod/config-editor-php.html new file mode 100644 index 00000000..54c398e4 --- /dev/null +++ b/templates/mod/config-editor-php.html @@ -0,0 +1,45 @@ +{% if readonly %} +

Tinyboard does not have the required permissions to edit inc/instance-config.php. To make changes, you will need to change the file's permissions first or manually edit the code.

+{% endif %} + + +{% if not readonly %}{% endif %} + + \ No newline at end of file diff --git a/templates/mod/dashboard.html b/templates/mod/dashboard.html index 5f6585fc..e9fb7c9c 100644 --- a/templates/mod/dashboard.html +++ b/templates/mod/dashboard.html @@ -94,7 +94,7 @@ {% if mod|hasPermission(config.mod.rebuild) %}

{% trans 'Rebuild' %}

{% endif %} - {% if mod|hasPermission(config.mod.show_config) %} + {% if mod|hasPermission(config.mod.edit_config) %}

{% trans 'Configuration' %}

{% endif %} diff --git a/templates/mod/edit_post_form.html b/templates/mod/edit_post_form.html index b9359c68..a2980d35 100644 --- a/templates/mod/edit_post_form.html +++ b/templates/mod/edit_post_form.html @@ -32,7 +32,7 @@ {% trans %}Comment{% endtrans %} - + -- cgit v1.3 From 0d1bfa47f1f459b4893426e752ce2d3e9b2de030 Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Sat, 3 Aug 2013 05:41:01 -0400 Subject: Web config editor: Write "MOD", "JANITOR", etc. to instance-config instead of just int representations --- inc/mod/config-editor.php | 10 +++++++++- inc/mod/pages.php | 15 ++++++++++++++- templates/mod/config-editor.html | 2 +- 3 files changed, 24 insertions(+), 3 deletions(-) (limited to 'templates/mod') diff --git a/inc/mod/config-editor.php b/inc/mod/config-editor.php index d6cad8f0..caca5a0e 100644 --- a/inc/mod/config-editor.php +++ b/inc/mod/config-editor.php @@ -62,6 +62,13 @@ function config_vars() { } else { $var['type'] = gettype($temp); } + + if ($var['type'] == 'integer' && $var['name'][0] == 'mod' && + (in_array($var['default'], array('JANITOR', 'MOD', 'ADMIN', 'DISABLED')) || mb_strpos($var['default'], "\$config['mod']") === 0)) { + // Permissions variable + $var['permissions'] = true; + } + unset($var['default_temp']); if (!is_array($var['name']) || (end($var['name']) != '' && !in_array(reset($var['name']), array('stylesheets')))) { $already_exists = false; @@ -80,7 +87,8 @@ function config_vars() { 'comment' => array(), 'default' => false, 'default_temp' => false, - 'commented' => false + 'commented' => false, + 'permissions' => false, ); } diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 6c46a84f..13520871 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -2010,7 +2010,20 @@ function mod_config() { $config_append .= '[' . var_export($var['name'], true) . ']'; } - $config_append .= ' = ' . var_export($value, true) . ";\n"; + + $config_append .= ' = '; + if ($var['permissions'] && in_array($value, array(JANITOR, MOD, ADMIN, DISABLED))) { + $perm_array = array( + JANITOR => 'JANITOR', + MOD => 'MOD', + ADMIN => 'ADMIN', + DISABLED => 'DISABLED' + ); + $config_append .= $perm_array[$value]; + } else { + $config_append .= var_export($value, true); + } + $config_append .= ";\n"; } } diff --git a/templates/mod/config-editor.html b/templates/mod/config-editor.html index 41e01dad..d333e9a2 100644 --- a/templates/mod/config-editor.html +++ b/templates/mod/config-editor.html @@ -25,7 +25,7 @@ {% if var.type == 'string' %} - {% elseif var.type == 'integer' and var.name.0 == 'mod' and (var.default in ['JANITOR', 'MOD', 'ADMIN', 'DISABLED'] or var.default|slice(0, 14) == "$config['mod']") and var.value <= constant('DISABLED') %} + {% elseif var.permissions %}

' . $config_append . '

'; echo Element('page.html', $page); @@ -2048,12 +2062,18 @@ function mod_config() { } } - header('Location: ?/', true, $config['redirect_http']); + header('Location: ?/config', true, $config['redirect_http']); exit; } - mod_page(_('Config editor'), 'mod/config-editor.html', array('conf' => $conf)); + mod_page(_('Config editor') . ($board_config ? ': ' . sprintf($config['board_abbreviation'], $board_config) : ''), + 'mod/config-editor.html', array( + 'boards' => listBoards(), + 'board' => $board_config, + 'conf' => $conf, + 'file' => $config_file + )); } function mod_themes_list() { diff --git a/mod.php b/mod.php index ee05c349..742eeefb 100644 --- a/mod.php +++ b/mod.php @@ -21,64 +21,65 @@ if (get_magic_quotes_gpc()) { $query = isset($_SERVER['QUERY_STRING']) ? urldecode($_SERVER['QUERY_STRING']) : ''; $pages = array( - '' => ':?/', // redirect to dashboard - '/' => 'dashboard', // dashboard + '' => ':?/', // redirect to dashboard + '/' => 'dashboard', // dashboard '/confirm/(.+)' => 'confirm', // confirm action (if javascript didn't work) - '/logout' => 'logout', // logout + '/logout' => 'logout', // logout - '/users' => 'users', // manage users - '/users/(\d+)' => 'user', // edit user - '/users/(\d+)/(promote|demote)' => 'user_promote', // prmote/demote user + '/users' => 'users', // manage users + '/users/(\d+)' => 'user', // edit user + '/users/(\d+)/(promote|demote)' => 'user_promote', // prmote/demote user '/users/new' => 'user_new', // create a new user '/new_PM/([^/]+)' => 'new_pm', // create a new pm - '/PM/(\d+)(/reply)?' => 'pm', // read a pm - '/inbox' => 'inbox', // pm inbox + '/PM/(\d+)(/reply)?' => 'pm', // read a pm + '/inbox' => 'inbox', // pm inbox '/noticeboard' => 'noticeboard', // view noticeboard - '/noticeboard/(\d+)' => 'noticeboard', // view noticeboard - '/noticeboard/delete/(\d+)' => 'noticeboard_delete',// delete from noticeboard - '/log' => 'log', // modlog - '/log/(\d+)' => 'log', // modlog + '/noticeboard/(\d+)' => 'noticeboard', // view noticeboard + '/noticeboard/delete/(\d+)' => 'noticeboard_delete', // delete from noticeboard + '/log' => 'log', // modlog + '/log/(\d+)' => 'log', // modlog '/log:([^/]+)' => 'user_log', // modlog - '/log:([^/]+)/(\d+)' => 'user_log', // modlog - '/news' => 'news', // view news - '/news/(\d+)' => 'news', // view news - '/news/delete/(\d+)' => 'news_delete', // delete from news + '/log:([^/]+)/(\d+)' => 'user_log', // modlog + '/news' => 'news', // view news + '/news/(\d+)' => 'news', // view news + '/news/delete/(\d+)' => 'news_delete', // delete from news '/edit/(\%b)' => 'edit_board', // edit board details '/new-board' => 'new_board', // create a new board - '/rebuild' => 'rebuild', // rebuild static files - '/reports' => 'reports', // report queue - '/reports/(\d+)/dismiss(all)?' => 'report_dismiss', // dismiss a report + '/rebuild' => 'rebuild', // rebuild static files + '/reports' => 'reports', // report queue + '/reports/(\d+)/dismiss(all)?' => 'report_dismiss', // dismiss a report - '/IP/([\w.:]+)' => 'ip', // view ip address + '/IP/([\w.:]+)' => 'ip', // view ip address '/IP/([\w.:]+)/remove_note/(\d+)' => 'ip_remove_note', // remove note from ip address - '/bans' => 'bans', // ban list - '/bans/(\d+)' => 'bans', // ban list + '/bans' => 'bans', // ban list + '/bans/(\d+)' => 'bans', // ban list - '/search' => 'search_redirect', // search + '/search' => 'search_redirect', // search '/search/(posts|IP_notes|bans|log)/(.+)/(\d+)' => 'search', // search - '/search/(posts|IP_notes|bans|log)/(.+)' => 'search', // search + '/search/(posts|IP_notes|bans|log)/(.+)' => 'search', // search // CSRF-protected moderator actions - '/ban' => 'secure_POST ban', // new ban - '/(\%b)/ban(&delete)?/(\d+)' => 'secure_POST ban_post', // ban poster - '/(\%b)/move/(\d+)' => 'secure_POST move', // move thread + '/ban' => 'secure_POST ban', // new ban + '/(\%b)/ban(&delete)?/(\d+)' => 'secure_POST ban_post', // ban poster + '/(\%b)/move/(\d+)' => 'secure_POST move', // move thread '/(\%b)/edit(_raw)?/(\d+)' => 'secure_POST edit_post', // edit post - '/(\%b)/delete/(\d+)' => 'secure delete', // delete post - '/(\%b)/deletefile/(\d+)' => 'secure deletefile', // delete file from post + '/(\%b)/delete/(\d+)' => 'secure delete', // delete post + '/(\%b)/deletefile/(\d+)' => 'secure deletefile', // delete file from post '/(\%b)/deletebyip/(\d+)(/global)?' => 'secure deletebyip', // delete all posts by IP address - '/(\%b)/(un)?lock/(\d+)' => 'secure lock', // lock thread - '/(\%b)/(un)?sticky/(\d+)' => 'secure sticky', // sticky thread - '/(\%b)/bump(un)?lock/(\d+)' => 'secure bumplock', // "bumplock" thread + '/(\%b)/(un)?lock/(\d+)' => 'secure lock', // lock thread + '/(\%b)/(un)?sticky/(\d+)' => 'secure sticky', // sticky thread + '/(\%b)/bump(un)?lock/(\d+)' => 'secure bumplock', // "bumplock" thread - '/themes' => 'themes_list', // manage themes + '/themes' => 'themes_list', // manage themes '/themes/(\w+)' => 'theme_configure', // configure/reconfigure theme - '/themes/(\w+)/rebuild' => 'theme_rebuild', // rebuild theme - '/themes/(\w+)/uninstall' => 'theme_uninstall', // uninstall theme + '/themes/(\w+)/rebuild' => 'theme_rebuild', // rebuild theme + '/themes/(\w+)/uninstall' => 'theme_uninstall', // uninstall theme - '/config' => 'config', // config editor + '/config' => 'config', // config editor + '/config/(\%b)' => 'config', // config editor // these pages aren't listed in the dashboard without $config['debug'] '/debug/antispam' => 'debug_antispam', diff --git a/templates/mod/config-editor-php.html b/templates/mod/config-editor-php.html index 54c398e4..4f76b5dd 100644 --- a/templates/mod/config-editor-php.html +++ b/templates/mod/config-editor-php.html @@ -1,17 +1,35 @@ -{% if readonly %} -

Tinyboard does not have the required permissions to edit inc/instance-config.php. To make changes, you will need to change the file's permissions first or manually edit the code.

-{% endif %} - - -{% if not readonly %}

{% endif %} - +

+ Any changes you make here will simply be appended to {{ file }}. If you wish to make the most of Tinyboard's customizability, you can instead edit the file directly. This page is intended for making quick changes and for those who don't have a basic understanding of PHP code. +

+ {% if boards|count %} +

Edit site-wide config
+ Edit config for {{ config.board_abbreviation|sprintf(_board.uri) }} +

+ {% endif %} + + {% if readonly %} +

Tinyboard does not have the required permissions to edit {{ file }}. To make changes, you will need to change the file's permissions first or manually edit the code.

+ {% endif %} + -

-{% if not readonly %}{% endif %} + {% if not readonly %}{% endif %} +