Skip to content

Commit

Permalink
Allow user to change Web Template (tpl modification)
Browse files Browse the repository at this point in the history
  • Loading branch information
@myvesta
myvesta committed Jun 1, 2018
1 parent 6c2f4e3 commit 01c1b54
Showing 1 changed file with 47 additions and 0 deletions.
47 changes: 47 additions & 0 deletions web/templates/user/edit_web.html
View file
Expand Up @@ -85,6 +85,53 @@
<textarea size="20" class="vst-textinput" name="v_aliases"><?=htmlentities(trim($v_aliases, "'"))?></textarea>
</td>
</tr>
<tr>
<td class="vst-text input-label">
<?php print __('Web Template') . "<span class='optional'>" .strtoupper($_SESSION['WEB_SYSTEM']) . "</span>";?>
</td>
</tr>
<tr>
<td>
<select class="vst-list" name="v_template">
<?php
foreach ($templates as $key => $value) {
echo "\t\t\t\t<option value=\"".htmlentities($value)."\"";
$svalue = "'".$value."'";
if ((!empty($v_template)) && ( $value == $v_template ) || ($svalue == $v_template)){
echo ' selected' ;
}
echo ">".htmlentities($value)."</option>\n";
}
?>
</select>
</td>
</tr>
<?php if (!empty($_SESSION['WEB_BACKEND'])) { ?>
<tr>
<td class="vst-text input-label">
<?php print __('Backend Template') . " <span class='optional'>" . strtoupper($_SESSION['WEB_BACKEND']) . "</span>";?>
</td>
</tr>
<tr>
<td>
<select class="vst-list" name="v_backend_template">
<?php
foreach ($backend_templates as $key => $value) {
echo "\t\t\t\t<option value=\"".$value."\"";
$svalue = "'".$value."'";
if ((!empty($v_backend_template)) && ( $value == $v_backend_template ) || ($svalue == $v_backend_template)){
echo ' selected' ;
}
if ((empty($v_backend_template)) && ($value == 'default')){
echo ' selected' ;
}
echo ">".htmlentities($value)."</option>\n";
}
?>
</select>
</td>
</tr>
<?php }?>
<?php if (!empty($_SESSION['PROXY_SYSTEM'])) { ?>
<tr>
<td class="vst-text step-top">
Expand Down

2 comments on commit 01c1b54

@vvcares
Copy link

@vvcares vvcares commented on 01c1b54 Feb 7, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel this is really a security flaw.
The normal USER should not able to change the WEB/PROXY templates.

https://forum.vestacp.com/viewtopic.php?t=13822

@ScIT-Raphael
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1, isnt a good idea and can break the nginx/apache2 processes. Removed with e5f16b8

Please sign in to comment.