Ravens PHP Scripts: Forums
 

 
  Forum Index  •  Forum FAQ  •  Search  •  Memberlist  •  Usergroups  •  Profile  •  Log in to check your private messages  •  Log in

Guiki - PHPNuke Wiki
 View next topic
View previous topic
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Modules
Author Message
missdanni
Hangin' Around



Joined: Jul 06, 2005
Posts: 25
PostPosted: Sat Sep 17, 2005 6:16 am Reply with quote
I've installed the Guiki module and it is working great except one issue ... anyone is abale to add, edit and/or delete.

The config asks for a user name and password and also asks that you set auth true or false.

CONFIG.PHP

Code:
<?


//Paths relative from dir with main phpnuke files


$TEMPLATE       = "modules/Guiki/templates/phpnuke";


$HOME           = "Home";


$USER           = "user";


$PASS           = "pass";


$USEAUTH        = true;


?>


The main index seems to be checking for logged in user, however anyone is granted access to do as they wish.

INDEX.PHP

Code:
<?php                     // Licence : GPL 


  /**


   * Guiki as PHP-Nuke module


   * A simple php wiki in one-page and a crossplatform WYSIWYG editor


   *


   */


if (!eregi("modules.php", $_SERVER['PHP_SELF'])) {


    die ("You can't access this file directly...");


}


require_once("mainfile.php");





$module_name = basename(dirname(__FILE__));


$index = 1;


//get_lang($module_name);             // no languages yet


$pagetitle = "$module_name";


global $prefix;


$prefix_guiki = $prefix."_guiki";


 


include("modules/$module_name/config.php");         // Get user set variables





$TPLT["EDIT"]   = "$TEMPLATE/edit.html";      // Set edit template


$TPLT["SHOW"]   = "$TEMPLATE/show.html";      // Set show template


$TPLT["SEARCH"]   = "$TEMPLATE/show.html";      // Set search template


$TPLT["INDEX"] = "$TEMPLATE/show.html";         // Set index template





$CONTENT   = $HTTP_POST_VARS["CONTENT"];      // Get content from edit page


$SEARCH      = $HTTP_POST_VARS["SEARCH"];      // Get search term


$MODE      = $HTTP_GET_VARS["MODE"];      // Get mode


$DOCPOST   = $HTTP_POST_VARS["docpost"];      // Testing out new editor delete me


$PAGE      = $HTTP_GET_VARS["PAGE"];      // Get page name





$CONTENT    = preg_replace("/<\?/","",$CONTENT);   // No PHP uploads


$SEARCH    = checkVars($SEARCH);         // No special chars


$PAGE       = checkVars($PAGE);         // No special chars


$MODE       = checkVars($MODE);         // No special chars





if (! $MODE)   {$MODE = "SHOW";}         // Set default mode


if (! $PAGE)   {$PAGE = $HOME;}         // Set default page





//include("header.php");





// override head for MODE=EDIT


function head() {


    global $slogan, $sitename, $banners, $nukeurl, $Version_Num, $artpage, $topic, $hlpfile, $user, $hr, $theme, $cookie, $bgcolor1, $bgcolor2, $bgcolor3, $bgcolor4, $textcolor1, $textcolor2, $forumpage, $adminpage, $userpage, $pagetitle;


    global $MODE, $PAGE, $TEMPLATE;


    $ThemeSel = get_theme();


    include("themes/$ThemeSel/theme.php");


    echo "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\">\n";


    echo "<html>\n";


    echo "<head>\n";


    echo "<title>$sitename: $pagetitle - $MODE Page $PAGE</title>\n";





    include("includes/meta.php");


    include("includes/javascript.php");





    if (file_exists("themes/$ThemeSel/images/favicon.ico")) {


   echo "<link REL=\"shortcut icon\" HREF=\"themes/$ThemeSel/images/favicon.ico\" TYPE=\"image/x-icon\">\n";


    }





    echo "<LINK REL=\"StyleSheet\" HREF=\"themes/$ThemeSel/style/style.css\" TYPE=\"text/css\">\n\n\n";


    include("includes/my_header.php");


        echo "\n\n\n</head>\n\n";


    themeheader();


}





online();


head();


include("includes/counter.php");


global $home;


if ($home == 1) {


    message_box();


    blocks(Center);


}


title("$sitename: $pagetitle - $MODE Page $PAGE");





if( $CONTENT )                  // Check to see it there is content 


   if (validate($USER,$PASS))         // Make sure they are logged in


      savePage($PAGE,$CONTENT);            // Save the data to the database





if( $DOCPOST )                  // Check to see it there is content 


   if (validate($USER,$PASS))         // Make sure they are logged in


      savePage($PAGE,$DOCPOST);            // Save the data to the database





if (! page_exists($PAGE))                 // Check if $PAGE is in database


   if ($MODE != "INDEX"&&$MODE != "SEARCH")// Make sure they are not searching or indexing


      $MODE = "EDIT";            // Go into edit mode





if ($MODE == "EDIT"||$MODE == "DELETE")         // If $MODE is edit or delete


   if (! validate($USER,$PASS))         // Challenge for user and password


      $MODE = "SHOW";            // Change to show if they dont know login


if ($MODE == "DELETE"){               // If mode is delete (AUTH done above)


   deletepage($PAGE);            // Delete the page


   $PAGE = "$HOME";            // Set $PAGE to default


   $MODE = "SHOW";               // Set $MODE to show


}


OpenTable();   





template($MODE,$PAGE,$DATA,$TPLT[$MODE],$SEARCH);   // Make replacements





CloseTable();   


include("footer.php"); 


//die();





/*


**  FUNCTIONS


*/


function template($MODE,$PAGE,$DATA,$TEMPLATE,$SEARCH){


   $OUTPUT       = implode( "", file($TEMPLATE) );


   if (page_exists($PAGE)){


      $CONTENT        = stripslashes(getpage($PAGE));


      $MODIFIED       = "Last Modified at ".date("H:i:s F d Y",pagemtime($PAGE));


   }


   if ($MODE == "SEARCH") 


      $CONTENT   = findPage($SEARCH);


        if ($MODE == "INDEX") 


      $CONTENT   = indexPage(); 


   $OUTPUT   = str_replace("<!--MODIFIED-->"   ,$MODIFIED      ,$OUTPUT);


   $OUTPUT   = str_replace("<!--REVERT-->"   ,showRevertLink()   ,$OUTPUT);


   $OUTPUT   = str_replace("<!--CANCEL-->"   ,showCancelLink()   ,$OUTPUT);


   $OUTPUT   = str_replace("<!--EDIT-->"   ,showEditLink()      ,$OUTPUT);


   $OUTPUT   = str_replace("<!--INDEX-->"   ,showIndexLink()      ,$OUTPUT);


   $OUTPUT   = str_replace("<!--DELETE-->"   ,showDeleteLink()   ,$OUTPUT);


   $OUTPUT   = str_replace("<!--PAGE-->"   ,$PAGE         ,$OUTPUT);


   $OUTPUT   = str_replace("<!--CONTENT-->"   ,$CONTENT      ,$OUTPUT);


   $OUTPUT   = str_replace("<!--TEMPLATE-->"   ,dirname($TEMPLATE)   ,$OUTPUT);


   if ($MODE == "SHOW") 


      //$OUTPUT = preg_replace("/a href=/i","a target='_blank' href="),$OUTPUT); // now working popup all external links


      $OUTPUT = preg_replace("/\[\[(.*?)\]\]/",writeLink("\\1"),$OUTPUT);


   writeHeaders();


   echo $OUTPUT;


}


function checkVars($DATA){


    return preg_replace("/[\`|\.|\\|\/|<\?]/","",$DATA);


}


function findPage($SEARCH) {


   $output = "<ul>\n";


   foreach (getDataFiles() as $page) {


      if (!preg_match("/.gif|.jpg|.png/i",$page)){


         $current = getpage($page);


         if (preg_match("/$SEARCH/i",$current) )


            $output .= "<li>".writeLink($page)."</li>\n";


      }


   }


   $output .= "</ul>\n";


   return $output;


}


function validate($user,$pass){


    if ($USEAUTH and !is_user($user)) {


   if ($_SERVER['PHP_AUTH_USER'] == $user)


      if ($_SERVER['PHP_AUTH_PW'] == $pass)


         return true;


   header('WWW-Authenticate: Basic realm="Guiki"');


   header('HTTP/1.0 401 Unauthorized');


   return false;


    } else {


        return true;


    }


}


function showCancelLink(){


    global $module_name;


    return "<a href=\"modules.php?name=$module_name&amp;MODE=SHOW&PAGE=<!--PAGE-->\">Cancel</a>";


}


function showRevertLink(){


    global $module_name;


    return "<a href=\"modules.php?name=$module_name&amp;MODE=EDIT&PAGE=<!--PAGE-->\">Revert</font>";


}


function showDeleteLink(){


    global $module_name;


    return "<a href=\"modules.php?name=$module_name&amp;MODE=DELETE&PAGE=<!--PAGE-->\"><font color='red'>Delete</font></a>";


}


function showEditLink(){


    global $module_name;


    return "<a href=\"modules.php?name=$module_name&amp;MODE=EDIT&PAGE=<!--PAGE-->\">Edit</a>";


}


function showIndexLink(){


    global $module_name;


    return "<a href=\"modules.php?name=$module_name&amp;MODE=INDEX&PAGE=Index\">Index</a>";


}


function savePage($PAGE,$CONTENT) {


    global $db, $prefix_guiki;


    $PAGE = addslashes($PAGE);


    $CONTENT = addslashes($CONTENT);


    if(page_exists($PAGE)){


       $db->sql_query("UPDATE $prefix_guiki SET content = '$CONTENT' WHERE page = '$PAGE'");


    }else{


       $db->sql_query("INSERT INTO $prefix_guiki VALUES('$PAGE','$CONTENT',0)");


    }


    //Update time


    $time=time();


    $db->sql_query("UPDATE $prefix_guiki SET modtime = $time WHERE page = '$PAGE'");      


}  


function writeHeaders() {


    header ("Expires: Mon, 26 Jul 1990 05:00:00 GMT");


    header ("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");


    header ("Cache-Control: no-cache, must-revalidate");


    header ("Pragma: no-cache");


}


function writeLink($PAGE) {


    global $module_name;


    if ( preg_match("/.gif|.jpg|.png/i",$PAGE)){ //not working mat


        return "<img src=\"modules/$module_name/data/$PAGE\">";  //data is hardcoded this is BAD


    } else {


        return "<a href=\"modules.php?name=$module_name&amp;MODE=SHOW&PAGE=$PAGE\">$PAGE</a>";


    }


}


function getDataFiles() {


    global $db, $prefix_guiki;


    $pagelist = $db->sql_query("SELECT page FROM $prefix_guiki ORDER BY page");


    //Convert to array


    while( $pagename = $db->sql_fetchrow($pagelist)){


            $allpages[] = $pagename['page'];


    }           


    return $allpages;


}


function getpage($PAGE){


   global $db, $prefix_guiki;


   $PAGE = addslashes($PAGE); 


   $sqlrow = $db->sql_fetchrow($db->sql_query("SELECT content from $prefix_guiki WHERE page = '$PAGE'"));


   return $sqlrow['content'];


}


function page_exists($PAGE){


   global $db, $prefix_guiki;


   $PAGE = addslashes($PAGE);


   return $db->sql_numrows($db->sql_query("SELECT page from $prefix_guiki WHERE page = '$PAGE'"));


}


function deletepage($PAGE){


   global $db, $prefix_guiki;


   $PAGE = addslashes($PAGE);


   return $db->sql_query("DELETE FROM $prefix_guiki WHERE page = '$PAGE'");


}


function pagemtime($PAGE){


   global $db, $prefix_guiki;


   $PAGE = addslashes($PAGE);


   $sqlrow = $db->sql_fetchrow($db->sql_query("SELECT modtime from $prefix_guiki WHERE page = '$PAGE'"));


   return $sqlrow['modtime'];


}


function indexpage(){


   global $db, $prefix_guiki;


   $output = "<ul>\n";


   foreach(getDataFiles() as $page){


      $output .= "<li>".writeLink($page)."</li>\n";


   }


   $output .= "</ul>\n";


   return $output;


}











// Local Variables:


// mode: php


// tab-width: 8


// c-basic-offset: 4


// c-hanging-comment-ender-p: nil


// indent-tabs-mode: nil


// End:


?>



Ideas/suggestions would be great. I only want to allow admins access to add, edit or delete.
 
View user's profile Send private message
hitwalker
Sells PC To Pay For Divorce



Joined:
Posts: 5661
PostPosted: Sat Sep 17, 2005 7:08 am Reply with quote
Hi,

I hate to disapoint you but if you read the mysql contents you should read the following :

Quote:

Known Bugs

There was a comment in here that I wanted to keep from the guy who hacked this in less than a minute but I lost it in a sync up with the dev box that said Insecure.

I think the problem has been fixed. (but I still wanted to leave the comment)

Still Have URL bugs...

Once again it is possible to change the content of pages ,'m workin on it.

Authentication system not compatible with PHPNuke.

Not all data stored in database.


Im sure this gives enough answers to your why it doesnt work great.. Sad
 
View user's profile Send private message
missdanni
PostPosted: Sat Sep 17, 2005 7:18 am Reply with quote
hitwalker wrote:
Hi,

I hate to disapoint you but if you read the mysql contents you should read the following :

Quote:

Known Bugs

There was a comment in here that I wanted to keep from the guy who hacked this in less than a minute but I lost it in a sync up with the dev box that said Insecure.

I think the problem has been fixed. (but I still wanted to leave the comment)

Still Have URL bugs...

Once again it is possible to change the content of pages ,'m workin on it.

Authentication system not compatible with PHPNuke.

Not all data stored in database.


Im sure this gives enough answers to your why it doesnt work great.. Sad


I am aware that its not working, I want to fix it using normal admin check.
 
hitwalker
PostPosted: Sat Sep 17, 2005 7:34 am Reply with quote
Quote:
I am aware that its not working, I want to fix it using normal admin check

Well i didnt get that idea with what you posted...
The author worked on that authentication problem as well but didnt got it right yet...
 
missdanni
PostPosted: Sat Sep 17, 2005 8:17 am Reply with quote
Simple fix for now:

Code:
      $CONTENT   = indexPage(); 


   $OUTPUT   = str_replace("<!--MODIFIED-->"   ,$MODIFIED      ,$OUTPUT);


   global $admin; 


if (is_admin($admin)){ 


   $OUTPUT   = str_replace("<!--REVERT-->"   ,showRevertLink()   ,$OUTPUT);


   $OUTPUT   = str_replace("<!--CANCEL-->"   ,showCancelLink()   ,$OUTPUT);


   $OUTPUT   = str_replace("<!--EDIT-->"   ,showEditLink()      ,$OUTPUT);


   $OUTPUT   = str_replace("<!--DELETE-->"   ,showDeleteLink()   ,$OUTPUT);


   }


   $OUTPUT   = str_replace("<!--INDEX-->"   ,showIndexLink()      ,$OUTPUT);


   $OUTPUT   = str_replace("<!--PAGE-->"   ,$PAGE         ,$OUTPUT);


   $OUTPUT   = str_replace("<!--CONTENT-->"   ,$CONTENT      ,$OUTPUT);


   $OUTPUT   = str_replace("<!--TEMPLATE-->"   ,dirname($TEMPLATE)   ,$OUTPUT);


This will only show the edit options for admins.
 
hitwalker
PostPosted: Sat Sep 17, 2005 8:42 am Reply with quote
Well this will be usefull to who ever uses it.
searching googles shows a handfull users and not all are used or activated.
But some are used so members can edit..
Thats the whole idea behind the wiki,so people can participate in something...
So,....Smile....changing it so only admin can edit doesnt do any good to it.
 
missdanni
PostPosted: Sat Sep 17, 2005 2:47 pm Reply with quote
hitwalker wrote:
Well this will be usefull to who ever uses it.
searching googles shows a handfull users and not all are used or activated.
But some are used so members can edit..
Thats the whole idea behind the wiki,so people can participate in something...
So,....Smile....changing it so only admin can edit doesnt do any good to it.


It will do this situation just fine. Smile
 
hitwalker
PostPosted: Sat Sep 17, 2005 3:00 pm Reply with quote
good luck with it... Smile
 
Raven
Site Admin/Owner



Joined: Aug 27, 2002
Posts: 17088
PostPosted: Sat Sep 17, 2005 3:07 pm Reply with quote
Good job missdanni! As long as You, the admin, have the tools that You need, You are able to do the job that You need to do! Thanks for sharing this.
 
View user's profile Send private message
supersims
New Member
New Member



Joined: Nov 02, 2005
Posts: 1
PostPosted: Wed Nov 02, 2005 7:15 am Reply with quote
Hi, I am the author of Guiki(maintainer anyway). I've just finished the next version which only allows users with a certain amount of karma or less to edit the wiki. It also has history functionality so you can quickly restore any damage. This should solve part of your problem. It will probably be announced on phpnuke.org soon, or in any case you can find it in a couple of days on http://supersims.sourceforge.net/.
 
View user's profile Send private message
Display posts from previous:       
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Modules


 Jump to:   




View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2007 phpBB Group
All times are GMT - 6 Hours
 
Forums ©