diff --git a/phpBB/adm/admin_styles.php b/phpBB/adm/admin_styles.php index 0d3294056b..103b182812 100644 --- a/phpBB/adm/admin_styles.php +++ b/phpBB/adm/admin_styles.php @@ -19,6 +19,7 @@ if (!empty($setmodules)) define('IN_PHPBB', 1); // Include files $phpbb_root_path = '../'; +//$phpEx = substr(strrchr(basename($_SERVER['PATH_TRANSLATED']), '.'), 1); require($phpbb_root_path . 'extension.inc'); require('pagestart.' . $phpEx); @@ -54,6 +55,8 @@ else $error = array(); +$safe_mode = (@ini_get('safe_mode') && @strtolower(ini_get('safe_mode')) == 'on') ? true : false; + // What shall we do today then? switch ($mode) @@ -104,6 +107,11 @@ switch ($mode) $error[] = $user->lang['STYLE_ERR_NAME_LONG']; } + if (!preg_match('#^[a-z0-9_\-\+\. ]+$#i', $style_name)) + { + $error[] = $user->lang['STYLE_ERR_NAME_CHARS']; + } + if (strlen($style_copyright) > 60) { $error[] = $user->lang['STYLE_ERR_COPY_LONG']; @@ -1051,7 +1059,6 @@ function viewsource(url) ' : ''; } + // Do the update thang if (isset($_POST['update'])) { $sql_where = ($action == 'add') ? "WHERE theme_name = '" . $db->sql_escape($theme_name) . "'" : "WHERE theme_id <> $theme_id AND theme_name = '" . $db->sql_escape($theme_name) . "'"; @@ -1116,13 +1130,31 @@ function viewsource(url) } $db->sql_freeresult($result); + if (empty($theme_name)) + { + $error[] = $user->lang['THEME_ERR_STYLE_NAME']; + } + + if (strlen($theme_name) > 30) + { + $error[] = $user->lang['THEME_ERR_NAME_LONG']; + } + + if (!preg_match('#^[a-z0-9_\-\+\. ]+$#i', $theme_name)) + { + $error[] = $user->lang['THEME_ERR_NAME_CHARS']; + } + + if (strlen($theme_copyright) > 60) + { + $error[] = $user->lang['THEME_ERR_COPY_LONG']; + } if (!sizeof($error)) { // Replace any chars which may cause us problems with _ - $bad_chars = array(' ', '/', ':', '*', '?', '"', '<', '>', '|'); + $theme_path = str_replace(' ', '_', $theme_name); - $theme_path = str_replace($bad_chars, '_', $theme_name); if (file_exists($phpbb_root_path . 'styles/themes/' . $theme_path)) { for ($i = 1; $i < 100; $i++) @@ -1136,33 +1168,55 @@ function viewsource(url) } $css_storedb = 1; - if (!@ini_get('safe_mode') && @strtolower(ini_get('safe_mode')) != 'on' && is_writeable($phpbb_root_path . 'styles/themes') && $action == 'add') + $css_data = ''; + if (!$safe_mode && is_writeable($phpbb_root_path . 'styles/themes') && $action == 'add') { umask(0); - if (mkdir($phpbb_root_path . 'styles/themes/' . $theme_path, 0777)) + if (@mkdir($phpbb_root_path . 'styles/themes/' . $theme_path, 0777)) { $css_storedb = 0; - chmod($phpbb_root_path . 'styles/themes/' . $theme_path, 0777); + @chmod($phpbb_root_path . 'styles/themes/' . $theme_path, 0777); } - } - $css_data = ''; - if (!empty($_POST['theme_basis']) && $action == 'add') - { - $sql = 'SELECT theme_name, theme_path, css_storedb, css_data - FROM ' . STYLES_CSS_TABLE . ' - WHERE theme_id = ' . intval($_POST['theme_basis']); - $result = $db->sql_query($sql); - - if ($row = $db->sql_fetchrow($result)) + if (!empty($_POST['theme_basis']) && !$css_storedb) { - $css_data = ($row['css_storedb']) ? $row['css_data'] : implode('', file($phpbb_root_path . 'styles/themes/' . $row['theme_path'] . '/' . $row['theme_path'] . '.css')); + $sql = 'SELECT theme_name, theme_path, css_storedb, css_data + FROM ' . STYLES_CSS_TABLE . ' + WHERE theme_id = ' . intval($_POST['theme_basis']); + $result = $db->sql_query($sql); - if (!$css_storedb) + if ($row = $db->sql_fetchrow($result)) { - if ($fp = @fopen("{$phpbb_root_path}styles/themes/$theme_path/$theme_path.css", 'wb')) + $css_data = ($row['css_storedb']) ? $row['css_data'] : implode('', file($phpbb_root_path . 'styles/themes/' . $row['theme_path'] . '/' . $row['theme_path'] . '.css')); + + if (!$css_storedb && ($fp = @fopen("{$phpbb_root_path}styles/themes/$theme_path/$theme_path.css", 'wb'))) { $css_storedb = (fwrite($fp, $css_data)) ? 0 : 1; + + if (!$css_storedb) + { + // Get a list of all files and folders in the basis themes folder + $filelist = filelist($phpbb_root_path . 'styles/themes/' . $row['theme_path'], '', '*'); + + // Copy every file, bar CVS and the original stylesheet + foreach ($filelist as $file_ary) + { + $path = $file_ary['path']; + $file = $file_ary['file']; + + if (strstr($path, 'CVS') || $file == $row['theme_path'] . '.css') + { + continue; + } + + if (!file_exists("{$phpbb_root_path}styles/themes/$theme_path/$path")) + { + @mkdir("{$phpbb_root_path}styles/themes/$theme_path/$path"); + } + @copy("{$phpbb_root_path}styles/themes/" . $row['theme_path'] . "/$path/$file", "{$phpbb_root_path}styles/themes/$theme_path/$path/$file"); + } + unset($filelist); + } } else { @@ -1170,8 +1224,8 @@ function viewsource(url) } @fclose($fp); } + $db->sql_freeresult($result); } - $db->sql_freeresult($result); } $sql_ary = array( @@ -1190,8 +1244,8 @@ function viewsource(url) $sql = ($action == 'add') ? 'INSERT INTO ' . STYLES_CSS_TABLE . ' ' . $db->sql_build_array('INSERT', $sql_ary) : 'UPDATE ' . STYLES_CSS_TABLE . ' SET ' . $db->sql_build_array('UPDATE', $sql_ary) . ' WHERE theme_id = ' . $theme_id; $db->sql_query($sql); - $message = ($action == 'add') ? (($storedb) ? 'THEME_DB_ADDED' : 'THEME_FS_ADDED') : 'THEME_DETAILS_UPDATE'; - $log = ($action == 'add') ? (($storedb) ? 'LOG_ADD_THEME_DB' : 'LOG_ADD_THEME_FS') : 'LOG_EDIT_THEME_DETAILS'; + $message = ($action == 'add') ? (($css_storedb) ? 'THEME_DB_ADDED' : 'THEME_FS_ADDED') : 'THEME_DETAILS_UPDATE'; + $log = ($action == 'add') ? (($css_storedb) ? 'LOG_ADD_THEME_DB' : 'LOG_ADD_THEME_FS') : 'LOG_EDIT_THEME_DETAILS'; add_log('admin', $log, $theme_name); trigger_error($user->lang[$message]); @@ -1199,6 +1253,10 @@ function viewsource(url) } + $css_storedb_no = (!$css_storedb) ? ' checked="checked"' : ''; + $css_storedb_yes = ($css_storedb) ? ' checked="checked"' : ''; + + // Output the page adm_page_header($user->lang['EDIT_THEME']); @@ -1235,20 +1293,35 @@ function viewsource(url)