ZaneYork
/
zoneminder
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
zoneminder/web/skins/classic/views/plugin.php

171 lines
5.1 KiB
PHP
Raw Normal View History

Migrate svn to git
2013-03-17 07:45:21 +08:00
<?php
//
// ZoneMinder web zone view file, $Date$, $Revision$
// Copyright (C) 2001-2008 Philip Coombes
//
// This program is free software; you can redistribute it and/or
// modify it under the terms of the GNU General Public License
// as published by the Free Software Foundation; either version 2
// of the License, or (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with this program; if not, write to the Free Software
update gpl 2 mailing address in source files
2016-12-26 23:23:16 +08:00
// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
Migrate svn to git
2013-03-17 07:45:21 +08:00
//
if ( !canView( 'Monitors' ) )
{
$view = "error";
return;
}
$mid = validInt($_REQUEST['mid']);
$zid = !empty($_REQUEST['zid'])?validInt($_REQUEST['zid']):0;
more updates
2013-12-18 01:53:15 +08:00
if ( $zid > 0 ) {
$newZone = dbFetchOne( 'SELECT * FROM Zones WHERE MonitorId = ? AND Id = ?', NULL, array( $mid, $zid) );
Migrate svn to git
2013-03-17 07:45:21 +08:00
} else {
$view = "error";
return;
}
$monitor = dbFetchMonitor ( $mid );
plugin.php: Fix XSS and directory traversal bugs. Fixes #2436 This view seems like dead code so maybe it should be removed instead.
2019-01-24 11:40:38 +08:00
// Only allow certain filename characters (not including a period) to prevent directory traversal.
$plugin = preg_replace('/[^-a-zA-Z0-9]/', '', $_REQUEST['pl']);
Migrate svn to git
2013-03-17 07:45:21 +08:00
$plugin_path = dirname(ZM_PLUGINS_CONFIG_PATH)."/".$plugin;
$focusWindow = true;
add translate function
2015-05-10 21:10:30 +08:00
xhtmlHeaders(__FILE__, translate('Plugin') );
Migrate svn to git
2013-03-17 07:45:21 +08:00
$pluginOptions=array(
'Enabled'=>array(
'Type'=>'select',
'Name'=>'Enabled',
'Choices'=>'yes,no',
'Value'=>'no'
)
);
$optionNames=array();
if(file_exists($plugin_path."/config.php"))
{
include_once($plugin_path."/config.php");
}
more updates
2013-12-18 01:53:15 +08:00
$sql='SELECT * FROM PluginsConfig WHERE MonitorId=? AND ZoneId=? AND pluginName=?';
foreach( dbFetchAll( $sql, NULL, array( $mid, $zid, $plugin ) ) as $popt )
Migrate svn to git
2013-03-17 07:45:21 +08:00
{
if(array_key_exists($popt['Name'], $pluginOptions)
&& $popt['Type']==$pluginOptions[$popt['Name']]['Type']
&& $popt['Choices']==$pluginOptions[$popt['Name']]['Choices']
)
{
$pluginOptions[$popt['Name']]=$popt;
array_push($optionNames, $popt['Name']);
} else {
more updates
2013-12-18 01:53:15 +08:00
dbQuery('DELETE FROM PluginsConfig WHERE Id=?', array( $popt['Id'] ) );
Migrate svn to git
2013-03-17 07:45:21 +08:00
}
}
foreach($pluginOptions as $name => $values)
{
if(!in_array($name, $optionNames))
{
$popt=$pluginOptions[$name];
more updates
2013-12-18 01:53:15 +08:00
$sql="INSERT INTO PluginsConfig VALUES ('',?,?,?,?,?,?,?)";
dbQuery($sql, array( $popt['Name'], $popt['Value'], $popt['Type'], $popt['Choices'], $mid, $zid, $plugin ) );
Migrate svn to git
2013-03-17 07:45:21 +08:00
}
}
$PLANG=array();
if(file_exists($plugin_path."/lang/".$user['Language'].".php")) {
include_once($plugin_path."/lang/".$user['Language'].".php");
}
function pLang($name)
{
global $PLANG;
if(array_key_exists($name, $PLANG))
return $PLANG[$name];
else
return $name;
}
?>
<body>
<div id="page">
<div id="header">
plugin.php: Fix XSS and directory traversal bugs. Fixes #2436 This view seems like dead code so maybe it should be removed instead.
2019-01-24 11:40:38 +08:00
<h2><?php echo translate('Monitor') ?> <?php echo $monitor['Name'] ?> - <?php echo translate('Zone') ?> <?php echo $newZone['Name'] ?> - <?php echo translate('Plugin') ?> <?php echo validHtmlStr($plugin) ?></h2>
Migrate svn to git
2013-03-17 07:45:21 +08:00
</div>
<div id="content">
Replace usage of PHP_SELF in views/. Fixes #2450
2019-02-10 13:39:19 +08:00
<form name="pluginForm" id="pluginForm" method="post" action="?">
Ran script to replace all Short open tags
2014-12-05 07:44:23 +08:00
<input type="hidden" name="view" value="<?php echo $view ?>"/>
Migrate svn to git
2013-03-17 07:45:21 +08:00
<input type="hidden" name="action" value="plugin"/>
Ran script to replace all Short open tags
2014-12-05 07:44:23 +08:00
<input type="hidden" name="mid" value="<?php echo $mid ?>"/>
<input type="hidden" name="zid" value="<?php echo $zid ?>"/>
plugin.php: Fix XSS and directory traversal bugs. Fixes #2436 This view seems like dead code so maybe it should be removed instead.
2019-01-24 11:40:38 +08:00
<input type="hidden" name="pl" value="<?php echo validHtmlStr($plugin) ?>"/>
Migrate svn to git
2013-03-17 07:45:21 +08:00
<div id="settingsPanel">
<table id="pluginSettings" cellspacing="0">
<tbody>
Found some old open tags left over
2015-04-08 18:11:26 +08:00
<?php
Migrate svn to git
2013-03-17 07:45:21 +08:00
foreach($pluginOptions as $name => $popt)
{
?>
Ran script to replace all Short open tags
2014-12-05 07:44:23 +08:00
<tr><th scope="row"><?php echo pLang($name) ?></th>
Found some old open tags left over
2015-04-08 18:11:26 +08:00
<?php
Migrate svn to git
2013-03-17 07:45:21 +08:00
switch($popt['Type'])
{
case "checkbox":
echo "CHECKBOX";
break;
case "select":
$pchoices=explode(',',$popt['Choices']);
?>
<td colspan="2">
Ran script to replace all Short open tags
2014-12-05 07:44:23 +08:00
<select name="pluginOpt[<?php echo $popt['Name'] ?>]" id="pluginOpt[<?php echo $popt['Name'] ?>]">
Found some old open tags left over
2015-04-08 18:11:26 +08:00
<?php
Migrate svn to git
2013-03-17 07:45:21 +08:00
foreach($pchoices as $pchoice)
{
$psel="";
if($popt['Value']==$pchoice)
$psel="selected";
?>
Ran script to replace all Short open tags
2014-12-05 07:44:23 +08:00
<option value="<?php echo $pchoice ?>" <?php echo $psel ?>><?php echo pLang($pchoice) ?></option>
Found some old open tags left over
2015-04-08 18:11:26 +08:00
<?php
Migrate svn to git
2013-03-17 07:45:21 +08:00
}
?>
</select>
plugin.php: Remove undefined onclick function reference and enforce CSP Also fix tag closing.
2019-01-24 11:45:57 +08:00
</td>
Found some old open tags left over
2015-04-08 18:11:26 +08:00
<?php
Migrate svn to git
2013-03-17 07:45:21 +08:00
break;
case "text":
default:
echo "DEFAULT";
}
?>
</tr>
Found some old open tags left over
2015-04-08 18:11:26 +08:00
<?php
Migrate svn to git
2013-03-17 07:45:21 +08:00
}
?>
</tbody>
</table>
plugin.php: Remove undefined onclick function reference and enforce CSP Also fix tag closing.
2019-01-24 11:45:57 +08:00
<input type="submit" id="submitBtn" name="submitBtn" value="<?php echo translate('Save') ?>" <?php if (!canEdit( 'Monitors' ) || (false && $selfIntersecting)) { ?> disabled="disabled"<?php } ?>/>
Add a CSP script-src policy with nonce-source and convert more inline event handlers (#2413) * Add Content-Security-Policy-Report-Only: script-src 'self' 'nonce-' policy * Use @data-on-click-this to attach inline click event handlers which expect being called with 'this' Only handle ones that don't return a value. * Use @data-on-click to attach inline click event handlers with no args and no return value * Use @data-on-click-true to attach inline click event handlers with 'true' as the only argument * Enforce a script-src CSP on views without inline JS * Convert some onchange attributes to data-on-change
2019-01-16 22:59:58 +08:00
<input type="button" value="<?php echo translate('Cancel') ?>" data-on-click="closeWindow"/>
Migrate svn to git
2013-03-17 07:45:21 +08:00
</div>
</form>
</div>
</div>
</body>
</html>