Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Merge #128

Merged
merged 44 commits into from Nov 3, 2014
Merged

Merge #128

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
44 commits
Select commit Hold shift + click to select a range
ac02d03
Merge pull request #18 from osCommerce/master
acidvertigo Aug 23, 2014
f1dc40a
Merge pull request #20 from osCommerce/master
acidvertigo Aug 23, 2014
5b58085
Merge pull request #25 from osCommerce/master
acidvertigo Aug 23, 2014
9c36d44
Merge branch 'master' of https://github.com/acidvertigo/oscommerce2
acidvertigo Aug 25, 2014
74ccdc9
Merge branch 'master' of https://github.com/acidvertigo/oscommerce2
acidvertigo Aug 25, 2014
0b021ab
Merge branch 'master' of https://github.com/acidvertigo/oscommerce2
acidvertigo Aug 26, 2014
081e34f
Merge pull request #55 from osCommerce/master
acidvertigo Aug 27, 2014
888a7a9
Merge pull request #64 from osCommerce/master
acidvertigo Sep 2, 2014
8b156cc
Merge pull request #24 from osCommerce/master
gburton Sep 5, 2014
b6aaab3
Code clean
acidvertigo Sep 18, 2014
91425e1
Code clean
acidvertigo Sep 18, 2014
cdfb8b3
Code clean
acidvertigo Sep 18, 2014
07ed130
Code clean
acidvertigo Sep 18, 2014
68786fd
Code clean
acidvertigo Sep 18, 2014
5dec0f7
Clean $button string output
acidvertigo Sep 19, 2014
8f1f614
Fix typo
acidvertigo Sep 19, 2014
eebf0c1
Code Clean
acidvertigo Sep 19, 2014
754184c
REmove double check get and post parameters
acidvertigo Sep 19, 2014
4003258
Remove extra space
acidvertigo Sep 19, 2014
1837e45
Remove double check $_GET and $_POST variable
acidvertigo Sep 19, 2014
ec09e02
Remove double check $_GET and $_POST strings
acidvertigo Sep 19, 2014
cac26d8
Remove double check for $_GET and $_POST
acidvertigo Sep 19, 2014
64e6460
Merge pull request #92 from osCommerce/master
acidvertigo Oct 6, 2014
6ce470a
Merge pull request #97 from osCommerce/master
acidvertigo Oct 6, 2014
5daf61a
Merge pull request #98 from osCommerce/master
acidvertigo Oct 7, 2014
1e3d825
Merge pull request #112 from osCommerce/master
acidvertigo Oct 7, 2014
31bd372
Merge pull request #117 from acidvertigo/patch-21
acidvertigo Oct 7, 2014
a18dad4
Revert "Merge"
acidvertigo Oct 7, 2014
2727452
Merge pull request #118 from acidvertigo/revert-117-patch-21
acidvertigo Oct 7, 2014
00b6329
Add superglobals to admin
acidvertigo Oct 10, 2014
898325c
Remove globals
acidvertigo Oct 10, 2014
809236c
Delete compatibility.php
acidvertigo Oct 10, 2014
4b278b5
Remove check for register globals
acidvertigo Oct 10, 2014
1a8239d
Merge pull request #27 from osCommerce/master
gburton Oct 13, 2014
8161e88
Store Logo Update
gburton Oct 22, 2014
d5d50b7
Fix default time zone set
acidvertigo Oct 24, 2014
0ca2040
Update superglobals
acidvertigo Oct 25, 2014
7e8f722
Remove GLOBALS VARIABLE as we are checking for get and post superglobals
acidvertigo Oct 25, 2014
b29d3a8
Update standard documentation to remove the usage of deprecated globa…
acidvertigo Oct 25, 2014
b77e6ff
Update STANDARD docuemtnation
acidvertigo Oct 25, 2014
e157816
Update language.php superglobal
acidvertigo Oct 28, 2014
da06014
Update logger.php
acidvertigo Oct 28, 2014
0db1f72
Merge pull request #250 from acidvertigo/admin_superglobals
haraldpdl Nov 3, 2014
bb0824b
Merge pull request #252 from gburton/Store_Logo
haraldpdl Nov 3, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
28 changes: 14 additions & 14 deletions catalog/admin/action_recorder.php
View file
Open in desktop
Expand Up @@ -52,18 +52,18 @@
'text' => (is_object(${$modules['module']}) ? ${$modules['module']}->title : $modules['module']));
}

$action = (isset($HTTP_GET_VARS['action']) ? $HTTP_GET_VARS['action'] : '');
$action = (isset($_GET['action']) ? $_GET['action'] : '');

if (tep_not_null($action)) {
switch ($action) {
case 'expire':
$expired_entries = 0;

if (isset($HTTP_GET_VARS['module']) && in_array($HTTP_GET_VARS['module'], $modules_array)) {
if (is_object(${$HTTP_GET_VARS['module']})) {
$expired_entries += ${$HTTP_GET_VARS['module']}->expireEntries();
if (isset($_GET['module']) && in_array($_GET['module'], $modules_array)) {
if (is_object(${$_GET['module']})) {
$expired_entries += ${$_GET['module']}->expireEntries();
} else {
$delete_query = tep_db_query("delete from " . TABLE_ACTION_RECORDER . " where module = '" . tep_db_input($HTTP_GET_VARS['module']) . "'");
$delete_query = tep_db_query("delete from " . TABLE_ACTION_RECORDER . " where module = '" . tep_db_input($_GET['module']) . "'");
$expired_entries += tep_db_affected_rows();
}
} else {
Expand Down Expand Up @@ -110,7 +110,7 @@
</td>
</tr>
</table></td>
<td class="smallText" align="right"><?php echo tep_draw_button(IMAGE_DELETE, 'trash', tep_href_link(FILENAME_ACTION_RECORDER, 'action=expire' . (isset($HTTP_GET_VARS['module']) && in_array($HTTP_GET_VARS['module'], $modules_array) ? '&module=' . $HTTP_GET_VARS['module'] : '')), 'primary'); ?></td>
<td class="smallText" align="right"><?php echo tep_draw_button(IMAGE_DELETE, 'trash', tep_href_link(FILENAME_ACTION_RECORDER, 'action=expire' . (isset($_GET['module']) && in_array($_GET['module'], $modules_array) ? '&module=' . $_GET['module'] : '')), 'primary'); ?></td>
</tr>
</table></td>
</tr>
Expand All @@ -128,16 +128,16 @@
<?php
$filter = array();

if (isset($HTTP_GET_VARS['module']) && in_array($HTTP_GET_VARS['module'], $modules_array)) {
$filter[] = " module = '" . tep_db_input($HTTP_GET_VARS['module']) . "' ";
if (isset($_GET['module']) && in_array($_GET['module'], $modules_array)) {
$filter[] = " module = '" . tep_db_input($_GET['module']) . "' ";
}

if (isset($HTTP_GET_VARS['search']) && !empty($HTTP_GET_VARS['search'])) {
$filter[] = " identifier like '%" . tep_db_input($HTTP_GET_VARS['search']) . "%' ";
if (isset($_GET['search']) && !empty($_GET['search'])) {
$filter[] = " identifier like '%" . tep_db_input($_GET['search']) . "%' ";
}

$actions_query_raw = "select * from " . TABLE_ACTION_RECORDER . (!empty($filter) ? " where " . implode(" and ", $filter) : "") . " order by date_added desc";
$actions_split = new splitPageResults($HTTP_GET_VARS['page'], MAX_DISPLAY_SEARCH_RESULTS, $actions_query_raw, $actions_query_numrows);
$actions_split = new splitPageResults($_GET['page'], MAX_DISPLAY_SEARCH_RESULTS, $actions_query_raw, $actions_query_numrows);
$actions_query = tep_db_query($actions_query_raw);
while ($actions = tep_db_fetch_array($actions_query)) {
$module = $actions['module'];
Expand All @@ -147,7 +147,7 @@
$module_title = ${$module}->title;
}

if ((!isset($HTTP_GET_VARS['aID']) || (isset($HTTP_GET_VARS['aID']) && ($HTTP_GET_VARS['aID'] == $actions['id']))) && !isset($aInfo)) {
if ((!isset($_GET['aID']) || (isset($_GET['aID']) && ($_GET['aID'] == $actions['id']))) && !isset($aInfo)) {
$actions_extra_query = tep_db_query("select identifier from " . TABLE_ACTION_RECORDER . " where id = '" . (int)$actions['id'] . "'");
$actions_extra = tep_db_fetch_array($actions_extra_query);

Expand All @@ -173,8 +173,8 @@
<tr>
<td colspan="5"><table border="0" width="100%" cellspacing="0" cellpadding="2">
<tr>
<td class="smallText" valign="top"><?php echo $actions_split->display_count($actions_query_numrows, MAX_DISPLAY_SEARCH_RESULTS, $HTTP_GET_VARS['page'], TEXT_DISPLAY_NUMBER_OF_ENTRIES); ?></td>
<td class="smallText" align="right"><?php echo $actions_split->display_links($actions_query_numrows, MAX_DISPLAY_SEARCH_RESULTS, MAX_DISPLAY_PAGE_LINKS, $HTTP_GET_VARS['page'], (isset($HTTP_GET_VARS['module']) && in_array($HTTP_GET_VARS['module'], $modules_array) && is_object(${$HTTP_GET_VARS['module']}) ? 'module=' . $HTTP_GET_VARS['module'] : null) . '&' . (isset($HTTP_GET_VARS['search']) && !empty($HTTP_GET_VARS['search']) ? 'search=' . $HTTP_GET_VARS['search'] : null)); ?></td>
<td class="smallText" valign="top"><?php echo $actions_split->display_count($actions_query_numrows, MAX_DISPLAY_SEARCH_RESULTS, $_GET['page'], TEXT_DISPLAY_NUMBER_OF_ENTRIES); ?></td>
<td class="smallText" align="right"><?php echo $actions_split->display_links($actions_query_numrows, MAX_DISPLAY_SEARCH_RESULTS, MAX_DISPLAY_PAGE_LINKS, $_GET['page'], (isset($_GET['module']) && in_array($_GET['module'], $modules_array) && is_object(${$_GET['module']}) ? 'module=' . $_GET['module'] : null) . '&' . (isset($_GET['search']) && !empty($_GET['search']) ? 'search=' . $_GET['search'] : null)); ?></td>
</tr>
</table></td>
</tr>
Expand Down
30 changes: 15 additions & 15 deletions catalog/admin/administrators.php
View file
Open in desktop
Expand Up @@ -14,7 +14,7 @@

$htaccess_array = null;
$htpasswd_array = null;
$is_iis = stripos($HTTP_SERVER_VARS['SERVER_SOFTWARE'], 'iis');
$is_iis = stripos($_SERVER['SERVER_SOFTWARE'], 'iis');

$authuserfile_array = array('##### OSCOMMERCE ADMIN PROTECTION - BEGIN #####',
'AuthType Basic',
Expand Down Expand Up @@ -44,15 +44,15 @@
}
}

$action = (isset($HTTP_GET_VARS['action']) ? $HTTP_GET_VARS['action'] : '');
$action = (isset($_GET['action']) ? $_GET['action'] : '');

if (tep_not_null($action)) {
switch ($action) {
case 'insert':
require('includes/functions/password_funcs.php');

$username = tep_db_prepare_input($HTTP_POST_VARS['username']);
$password = tep_db_prepare_input($HTTP_POST_VARS['password']);
$username = tep_db_prepare_input($_POST['username']);
$password = tep_db_prepare_input($_POST['password']);

$check_query = tep_db_query("select id from " . TABLE_ADMINISTRATORS . " where user_name = '" . tep_db_input($username) . "' limit 1");

Expand All @@ -68,7 +68,7 @@
}
}

if (isset($HTTP_POST_VARS['htaccess']) && ($HTTP_POST_VARS['htaccess'] == 'true')) {
if (isset($_POST['htaccess']) && ($_POST['htaccess'] == 'true')) {
$htpasswd_array[] = $username . ':' . tep_crypt_apr_md5($password);
}

Expand Down Expand Up @@ -99,10 +99,10 @@
case 'save':
require('includes/functions/password_funcs.php');

$username = tep_db_prepare_input($HTTP_POST_VARS['username']);
$password = tep_db_prepare_input($HTTP_POST_VARS['password']);
$username = tep_db_prepare_input($_POST['username']);
$password = tep_db_prepare_input($_POST['password']);

$check_query = tep_db_query("select id, user_name from " . TABLE_ADMINISTRATORS . " where id = '" . (int)$HTTP_GET_VARS['aID'] . "'");
$check_query = tep_db_query("select id, user_name from " . TABLE_ADMINISTRATORS . " where id = '" . (int)$_GET['aID'] . "'");
$check = tep_db_fetch_array($check_query);

// update username in current session if changed
Expand All @@ -121,7 +121,7 @@
}
}

tep_db_query("update " . TABLE_ADMINISTRATORS . " set user_name = '" . tep_db_input($username) . "' where id = '" . (int)$HTTP_GET_VARS['aID'] . "'");
tep_db_query("update " . TABLE_ADMINISTRATORS . " set user_name = '" . tep_db_input($username) . "' where id = '" . (int)$_GET['aID'] . "'");

if (tep_not_null($password)) {
// update password in htpasswd
Expand All @@ -134,13 +134,13 @@
}
}

if (isset($HTTP_POST_VARS['htaccess']) && ($HTTP_POST_VARS['htaccess'] == 'true')) {
if (isset($_POST['htaccess']) && ($_POST['htaccess'] == 'true')) {
$htpasswd_array[] = $username . ':' . tep_crypt_apr_md5($password);
}
}

tep_db_query("update " . TABLE_ADMINISTRATORS . " set user_password = '" . tep_db_input(tep_encrypt_password($password)) . "' where id = '" . (int)$HTTP_GET_VARS['aID'] . "'");
} elseif (!isset($HTTP_POST_VARS['htaccess']) || ($HTTP_POST_VARS['htaccess'] != 'true')) {
tep_db_query("update " . TABLE_ADMINISTRATORS . " set user_password = '" . tep_db_input(tep_encrypt_password($password)) . "' where id = '" . (int)$_GET['aID'] . "'");
} elseif (!isset($_POST['htaccess']) || ($_POST['htaccess'] != 'true')) {
if (is_array($htpasswd_array)) {
for ($i=0, $n=sizeof($htpasswd_array); $i<$n; $i++) {
list($ht_username, $ht_password) = explode(':', $htpasswd_array[$i], 2);
Expand Down Expand Up @@ -173,10 +173,10 @@
fclose($fp);
}

tep_redirect(tep_href_link(FILENAME_ADMINISTRATORS, 'aID=' . (int)$HTTP_GET_VARS['aID']));
tep_redirect(tep_href_link(FILENAME_ADMINISTRATORS, 'aID=' . (int)$_GET['aID']));
break;
case 'deleteconfirm':
$id = tep_db_prepare_input($HTTP_GET_VARS['aID']);
$id = tep_db_prepare_input($_GET['aID']);

$check_query = tep_db_query("select id, user_name from " . TABLE_ADMINISTRATORS . " where id = '" . (int)$id . "'");
$check = tep_db_fetch_array($check_query);
Expand Down Expand Up @@ -261,7 +261,7 @@
<?php
$admins_query = tep_db_query("select id, user_name from " . TABLE_ADMINISTRATORS . " order by user_name");
while ($admins = tep_db_fetch_array($admins_query)) {
if ((!isset($HTTP_GET_VARS['aID']) || (isset($HTTP_GET_VARS['aID']) && ($HTTP_GET_VARS['aID'] == $admins['id']))) && !isset($aInfo) && (substr($action, 0, 3) != 'new')) {
if ((!isset($_GET['aID']) || (isset($_GET['aID']) && ($_GET['aID'] == $admins['id']))) && !isset($aInfo) && (substr($action, 0, 3) != 'new')) {
$aInfo = new objectInfo($admins);
}

Expand Down
30 changes: 15 additions & 15 deletions catalog/admin/backup.php
View file
Open in desktop
Expand Up @@ -12,7 +12,7 @@

require('includes/application_top.php');

$action = (isset($HTTP_GET_VARS['action']) ? $HTTP_GET_VARS['action'] : '');
$action = (isset($_GET['action']) ? $_GET['action'] : '');

if (tep_not_null($action)) {
switch ($action) {
Expand Down Expand Up @@ -126,8 +126,8 @@

fclose($fp);

if (isset($HTTP_POST_VARS['download']) && ($HTTP_POST_VARS['download'] == 'yes')) {
switch ($HTTP_POST_VARS['compress']) {
if (isset($_POST['download']) && ($_POST['download'] == 'yes')) {
switch ($_POST['compress']) {
case 'gzip':
exec(LOCAL_EXE_GZIP . ' ' . DIR_FS_BACKUP . $backup_file);
$backup_file .= '.gz';
Expand All @@ -145,7 +145,7 @@

exit;
} else {
switch ($HTTP_POST_VARS['compress']) {
switch ($_POST['compress']) {
case 'gzip':
exec(LOCAL_EXE_GZIP . ' ' . DIR_FS_BACKUP . $backup_file);
break;
Expand All @@ -164,11 +164,11 @@
tep_set_time_limit(0);

if ($action == 'restorenow') {
$read_from = $HTTP_GET_VARS['file'];
$read_from = $_GET['file'];

if (file_exists(DIR_FS_BACKUP . $HTTP_GET_VARS['file'])) {
$restore_file = DIR_FS_BACKUP . $HTTP_GET_VARS['file'];
$extension = substr($HTTP_GET_VARS['file'], -3);
if (file_exists(DIR_FS_BACKUP . $_GET['file'])) {
$restore_file = DIR_FS_BACKUP . $_GET['file'];
$extension = substr($_GET['file'], -3);

if ( ($extension == 'sql') || ($extension == '.gz') || ($extension == 'zip') ) {
switch ($extension) {
Expand Down Expand Up @@ -281,15 +281,15 @@
tep_redirect(tep_href_link(FILENAME_BACKUP));
break;
case 'download':
$extension = substr($HTTP_GET_VARS['file'], -3);
$extension = substr($_GET['file'], -3);

if ( ($extension == 'zip') || ($extension == '.gz') || ($extension == 'sql') ) {
if ($fp = fopen(DIR_FS_BACKUP . $HTTP_GET_VARS['file'], 'rb')) {
$buffer = fread($fp, filesize(DIR_FS_BACKUP . $HTTP_GET_VARS['file']));
if ($fp = fopen(DIR_FS_BACKUP . $_GET['file'], 'rb')) {
$buffer = fread($fp, filesize(DIR_FS_BACKUP . $_GET['file']));
fclose($fp);

header('Content-type: application/x-octet-stream');
header('Content-disposition: attachment; filename=' . $HTTP_GET_VARS['file']);
header('Content-disposition: attachment; filename=' . $_GET['file']);

echo $buffer;

Expand All @@ -300,9 +300,9 @@
}
break;
case 'deleteconfirm':
if (strstr($HTTP_GET_VARS['file'], '..')) tep_redirect(tep_href_link(FILENAME_BACKUP));
if (strstr($_GET['file'], '..')) tep_redirect(tep_href_link(FILENAME_BACKUP));

tep_remove(DIR_FS_BACKUP . '/' . $HTTP_GET_VARS['file']);
tep_remove(DIR_FS_BACKUP . '/' . $_GET['file']);

if (!$tep_remove_error) {
$messageStack->add_session(SUCCESS_BACKUP_DELETED, 'success');
Expand Down Expand Up @@ -363,7 +363,7 @@

$check = 0;

if ((!isset($HTTP_GET_VARS['file']) || (isset($HTTP_GET_VARS['file']) && ($HTTP_GET_VARS['file'] == $entry))) && !isset($buInfo) && ($action != 'backup') && ($action != 'restorelocal')) {
if ((!isset($_GET['file']) || (isset($_GET['file']) && ($_GET['file'] == $entry))) && !isset($buInfo) && ($action != 'backup') && ($action != 'restorelocal')) {
$file_array['file'] = $entry;
$file_array['date'] = date(PHP_DATE_TIME_FORMAT, filemtime(DIR_FS_BACKUP . $entry));
$file_array['size'] = number_format(filesize(DIR_FS_BACKUP . $entry)) . ' bytes';
Expand Down