Skip to content
Permalink
Browse files Browse the repository at this point in the history
Merge pull request #1699 from conejoninja/fixescve
some fixes
  • Loading branch information
conejoninja committed Sep 3, 2014
2 parents 778eff1 + e3e0278 commit c163bf5
Show file tree
Hide file tree
Showing 5 changed files with 45 additions and 18 deletions.
29 changes: 28 additions & 1 deletion oc-admin/appearance.php
Expand Up @@ -169,7 +169,34 @@ function doModel()
$this->redirectTo( osc_admin_base_url(true) . "?page=appearance" );
break;
case('render'):
$this->_exportVariableToView('file', osc_base_path() . Params::getParam("file"));
if(Params::existParam('route')) {
$routes = Rewrite::newInstance()->getRoutes();
$rid = Params::getParam('route');
$file = '../';
if(isset($routes[$rid]) && isset($routes[$rid]['file'])) {
$file = $routes[$rid]['file'];
}
} else {
// DEPRECATED: Disclosed path in URL is deprecated, use routes instead
// This will be REMOVED in 3.6
$file = Params::getParam('file');
// We pass the GET variables (in case we have somes)
if(preg_match('|(.+?)\?(.*)|', $file, $match)) {
$file = $match[1];
if(preg_match_all('|&([^=]+)=([^&]*)|', urldecode('&'.$match[2].'&'), $get_vars)) {
for($var_k=0;$var_k<count($get_vars[1]);$var_k++) {
Params::setParam($get_vars[1][$var_k], $get_vars[2][$var_k]);
}
}
} else {
$file = Params::getParam('file');
};
}

if(strpos($file, '../')!==false || !file_exists(osc_base_path() . $file)) {
osc_add_flash_warning_message(__('Error loading theme custom file'), 'admin');
};
$this->_exportVariableToView('file', osc_base_path() . $file);
$this->doView('appearance/view.php');
break;
default:
Expand Down
6 changes: 3 additions & 3 deletions oc-admin/themes/modern/appearance/view.php
Expand Up @@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/

$file = __get('file');
osc_add_hook('admin_page_header','customPageHeader');
function customPageHeader() { ?>
<h1><?php echo osc_apply_filter('custom_appearance_title', __('Appearance')); ?></h1>
Expand All @@ -30,8 +30,8 @@ function customPageTitle($string) {
<!-- theme files -->
<div class="theme-files">
<?php
if( file_exists(__get('file')) ) {
require_once __get('file');
if(strpos($file, '../')===false && file_exists($file)) {
require_once $file;
}
?>
</div>
Expand Down
6 changes: 3 additions & 3 deletions oc-admin/themes/modern/plugins/view.php
Expand Up @@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/

$file = __get('file');
osc_add_hook('admin_page_header','customPageHeader');
function customPageHeader() { ?>
<h1><?php echo osc_apply_filter('custom_plugin_title',__('Plugins')); ?></h1>
Expand All @@ -30,8 +30,8 @@ function customPageTitle($string) {
<!-- theme files -->
<div class="theme-files">
<?php
if( file_exists(__get('file')) ) {
require_once __get('file');
if(strpos($file, '../')===false && file_exists($file)) {
require_once $file;
}
?>
</div>
Expand Down
18 changes: 9 additions & 9 deletions oc-includes/osclass/classes/datatables/ItemsDataTable.php
Expand Up @@ -138,8 +138,8 @@ private function addTableHeader()
$this->addColumn('user', __('User'));
$this->addColumn('category', __('Category'));
$this->addColumn('location', __('Location'));
$this->addColumn('date', '<a href="'.$url_base.$arg_date.'">'.__('Date').'</a>');
$this->addColumn('expiration', '<a href="'.$url_base.$arg_expiration.'">'.__('Expiration date').'</a>');
$this->addColumn('date', '<a href="'.osc_esc_html($url_base.$arg_date).'">'.__('Date').'</a>');
$this->addColumn('expiration', '<a href="'.osc_esc_html($url_base.$arg_expiration).'">'.__('Expiration date').'</a>');

$dummy = &$this;
osc_run_hook("admin_items_table", $dummy);
Expand Down Expand Up @@ -197,13 +197,13 @@ private function addTableHeaderReported()
$this->addColumn('bulkactions', '<input id="check_all" type="checkbox" />');
$this->addColumn('title', __('Title'));
$this->addColumn('user', __('User'));
$this->addColumn('spam', '<a id="order_spam" href="'.$url_spam.'">'.__('Spam').'</a>');
$this->addColumn('bad', '<a id="order_bad" href="'.$url_bad.'">'.__('Misclassified').'</a>');
$this->addColumn('rep', '<a id="order_rep" href="'.$url_rep.'">'.__('Duplicated').'</a>');
$this->addColumn('exp', '<a id="order_exp" href="'.$url_exp.'">'.__('Expired').'</a>');
$this->addColumn('off', '<a id="order_off" href="'.$url_off.'">'.__('Offensive').'</a>');
$this->addColumn('date', '<a id="order_date" href="'.$url_date.'">'.__('Date').'</a>');
$this->addColumn('expiration', '<a id="order_expiration" href="'.$url_expiration.'">'.__('Expiration date').'</a>');
$this->addColumn('spam', '<a id="order_spam" href="'.osc_esc_html($url_spam).'">'.__('Spam').'</a>');
$this->addColumn('bad', '<a id="order_bad" href="'.osc_esc_html($url_bad).'">'.__('Misclassified').'</a>');
$this->addColumn('rep', '<a id="order_rep" href="'.osc_esc_html($url_rep).'">'.__('Duplicated').'</a>');
$this->addColumn('exp', '<a id="order_exp" href="'.osc_esc_html($url_exp).'">'.__('Expired').'</a>');
$this->addColumn('off', '<a id="order_off" href="'.osc_esc_html($url_off).'">'.__('Offensive').'</a>');
$this->addColumn('date', '<a id="order_date" href="'.osc_esc_html($url_date).'">'.__('Date').'</a>');
$this->addColumn('expiration', '<a id="order_expiration" href="'.osc_esc_html($url_expiration).'">'.__('Expiration date').'</a>');

$dummy = &$this;
osc_run_hook("admin_items_reported_table", $dummy);
Expand Down
4 changes: 2 additions & 2 deletions oc-includes/osclass/classes/datatables/MediaDataTable.php
Expand Up @@ -73,8 +73,8 @@ private function addTableHeader()
$this->addColumn('bulkactions', '<input id="check_all" type="checkbox" />');
$this->addColumn('file', __('File'));
$this->addColumn('action', __('Action'));
$this->addColumn('attached_to', '<a href="'.$url_base.$arg_item.'">'.__('Attached to').'</a>');
$this->addColumn('date', '<a href="'.$url_base.$arg_date.'">'.__('Date').'</a>');
$this->addColumn('attached_to', '<a href="'.osc_esc_html($url_base.$arg_item).'">'.__('Attached to').'</a>');
$this->addColumn('date', '<a href="'.osc_esc_html($url_base.$arg_date).'">'.__('Date').'</a>');

$dummy = &$this;
osc_run_hook("admin_media_table", $dummy);
Expand Down

0 comments on commit c163bf5

Please sign in to comment.