CW Cyrix's Git Repository Mirror
Browse code

Old XSS fix from 2012/03/14; somehow evaded getting updated!

Clarissa Walker authored on 2015/09/09 23:38:09
Showing 1 changed files
css.php
History View file @ 2d3ada6
... ... 
@@ -78,12 +78,17 @@ elseif (isset($_POST["create_css"]))
78 78 
 	{
79 79 
 		if (!file_exists("./css/" . filterData($_POST["create_css"])))
80 80 
 		{
81 
-			if (copy("./css/style.css", "./css/" . filterData($_POST["create_css"])))
82 
-				echo "<p class=\"success\">" . filterData($_POST["create_css"]) . ", was created successfuly</p>";
81 
+			if (filterData($_POST["create_css"]) == ".css")
82 
+			{
83 
+				echo errorMessage() . "Error: Should not create .css file with only an extension!</p>";
84 
+				exit();
85 
+			}
86 
+			elseif (copy("./css/style.css", "./css/" . filterData($_POST["create_css"])))
87 
+				echo "<p class=\"success\">" . filterData($_POST["create_css"]) . " was created successfully</p>";
83 88 
 			else
84 89 
 			{
85 90 
 				echo errorMessage() . "Error: Unable to create " . filterData($_POST["create_css"]) . ", are you sure the permissions are correct?</p>";
86 
-				exit();
91 
+				exit();
87 92 
 			}
88 93 
 		}
89 94 
 		else
... ... 
@@ -146,7 +151,7 @@ if (isset($_POST["create_css"]) || isset($_POST["edit_css"]))
146 151 
 	<h2>Editing File: <?php echo $filename;?></h2>
147 152 
 	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
148 153 
 	<input type="hidden" name="hidden_filename" value="<?php echo $filename;?>"/>
149 
-	<input type="hidden" name="current_css_file" value="<?php echo $_POST['current_css_file'];?>"/>
154 
+	<input type="hidden" name="current_css_file" value="<?php echo filterData($_POST['current_css_file']);?>"/>
150 155 
 	<textarea name="file_contents" cols="120" rows="20"><?php
151 156 
 	//open css file
152 157 
 	readfile("./css/" . $filename);
Browse code

Import from the old rivettracker git repository at sourceforge (amisaph/amisapphire branch)

Clarissa Walker (ami-sapphire) authored on 2014/01/24 14:02:23
Showing 1 changed files
css.php
History View file @ 1c8ad06
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,269 @@
1 
+<?php
2 
+
3 
+require ("config.php");
4 
+require ("funcsv2.php"); //required for errorMessage() function
5 
+//Check session
6 
+session_start();
7 
+
8 
+if (!$_SESSION['admin_logged_in'])
9 
+{
10 
+	//check fails
11 
+	header("Location: authenticate.php?status=session");
12 
+	exit();
13 
+}
14 
+
15 
+// Prep database, needed for cleaning function
16 
+if ($GLOBALS["persist"])
17 
+	$db = @mysql_pconnect($dbhost, $dbuser, $dbpass) or showError("Can't connect to database. Contact the webmaster.");
18 
+else
19 
+	$db = @mysql_connect($dbhost, $dbuser, $dbpass) or showError("Can't connect to database. Contact the webmaster.");
20 
+@mysql_select_db($database) or showError("Can't open database. Contact the webmaster");
21 
+
22 
+?>
23 
+
24 
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
25 
+
26 
+<html>
27 
+<head>
28 
+	<title>Change CSS File</title>
29 
+	<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
30 
+	<link rel="stylesheet" href="./css/style.css" type="text/css" />
31 
+	<style type="text/css">
32 
+		td.cell{
33 
+			width: 2%;
34 
+			}
35 
+	</style>
36 
+	<script type="text/javascript">
37 
+	function changeColor(color)
38 
+	{
39 
+		document.getElementById("color_box").value = color;
40 
+		document.getElementById("thecolor").style.backgroundColor = color;
41 
+	}
42 
+	</script>
43 
+</head>
44 
+<body>
45 
+<center>
46 
+<h1>Change CSS File</h1>
47 
+</center>
48 
+<br>
49 
+
50 
+<?php
51 
+
52 
+if (isset($_POST["set_css"]))
53 
+{
54 
+	//delete style.css file
55 
+	if (copy("./css/" . filterData($_POST["set_css"]), "./css/style.css"))
56 
+		echo "<p class=\"success\">style.css file has been replaced with " . filterData($_POST["set_css"]) . "</p>";
57 
+	else
58 
+	{
59 
+		echo errorMessage() . "Error: Unable to copy over style.css, are the permissions correct?</p>";
60 
+		exit();
61 
+	}
62 
+}
63 
+elseif (isset($_POST["delete_css"]))
64 
+{
65 
+	//delete css file
66 
+	if (unlink("./css/" . filterData($_POST["delete_css"])))
67 
+		echo "<p class=\"success\">" . filterData($_POST["delete_css"]) . " has been deleted</p>";
68 
+	else
69 
+	{
70 
+		echo errorMessage() . "Error: Unable to delete " . filterData($_POST["delete_css"]) . ", are you sure the permissions are correct?</p>";
71 
+		exit();
72 
+	}
73 
+}
74 
+elseif (isset($_POST["create_css"]))
75 
+{
76 
+	//create new css file by copying over style.css into new file
77 
+	if (substr($_POST["create_css"], -4) == ".css")
78 
+	{
79 
+		if (!file_exists("./css/" . filterData($_POST["create_css"])))
80 
+		{
81 
+			if (copy("./css/style.css", "./css/" . filterData($_POST["create_css"])))
82 
+				echo "<p class=\"success\">" . filterData($_POST["create_css"]) . ", was created successfuly</p>";
83 
+			else
84 
+			{
85 
+				echo errorMessage() . "Error: Unable to create " . filterData($_POST["create_css"]) . ", are you sure the permissions are correct?</p>";
86 
+				exit();
87 
+			}
88 
+		}
89 
+		else
90 
+		{
91 
+			echo errorMessage() . "Error: " . filterData($_POST["create_css"]) . " already exists, please choose a different name</p>";
92 
+			exit();
93 
+		}
94 
+	}
95 
+	else
96 
+	{
97 
+		echo errorMessage() . "Error: Your file doesn't end with .css</p>";
98 
+		exit();
99 
+	}
100 
+}
101 
+
102 
+if (isset($_POST["create_css"]) || isset($_POST["edit_css"]))
103 
+{
104 
+	//display color picker
105 
+	?>
106 
+	<h2>Color Picker:</h2>
107 
+	<table style="cursor: pointer;" border="0">
108 
+	<?php
109 
+	function rgbhex($red, $green, $blue)
110 
+	{
111 
+		return sprintf('#%02X%02X%02X', $red, $green, $blue);
112 
+	}
113 
+
114 
+	//create table of 216 web safe colors
115 
+	for ($red = 0; $red < 256; $red = $red + 51)
116 
+	{
117 
+		echo "<tr>";
118 
+		for ($green = 0; $green < 256; $green = $green + 51)
119 
+		{
120 
+			for ($blue = 0; $blue < 256; $blue = $blue + 51)
121 
+			{
122 
+				$hexcolor = rgbhex($red, $green, $blue);
123 
+				echo "<td bgcolor='" . $hexcolor . "' title='" . $hexcolor . "' class='cell' onClick=\"changeColor('" . $hexcolor . "')\">&nbsp;</td>\n";
124 
+			}
125 
+		}
126 
+		echo "</tr>";
127 
+	}
128 
+
129 
+	?>
130 
+	</table>
131 
+	<br>
132 
+	<b>Color:</b>
133 
+	<table border="0"><tr>
134 
+	<td id="thecolor" align="left" bgcolor="#000000"><input type="text" id="color_box" value="#000000"/>
135 
+	</td></tr>
136 
+	</table>
137 
+	<br>
138 
+	<?php
139 
+
140 
+	if (isset($_POST["create_css"]))
141 
+		$filename = filterData($_POST["create_css"]);
142 
+	if (isset($_POST["edit_css"]))
143 
+		$filename = filterData($_POST["edit_css"]);
144 
+	//display text box with css in it
145 
+	?>
146 
+	<h2>Editing File: <?php echo $filename;?></h2>
147 
+	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
148 
+	<input type="hidden" name="hidden_filename" value="<?php echo $filename;?>"/>
149 
+	<input type="hidden" name="current_css_file" value="<?php echo $_POST['current_css_file'];?>"/>
150 
+	<textarea name="file_contents" cols="120" rows="20"><?php
151 
+	//open css file
152 
+	readfile("./css/" . $filename);
153 
+	?></textarea>
154 
+	<br><br>
155 
+	<input type="submit" value="Save File"/>
156 
+	</form>
157 
+	<?php
158 
+
159 
+}
160 
+
161 
+if (isset($_POST["file_contents"]))
162 
+{
163 
+	//save previously edited text into file
164 
+	if (is_writable("./css/" . filterData($_POST["hidden_filename"])))
165 
+	{
166 
+		//open file
167 
+		$stream = fopen("./css/" . filterData($_POST["hidden_filename"]), "w");
168 
+		fwrite($stream, filterData($_POST["file_contents"]));
169 
+		fclose($stream);
170 
+		echo "<p class=\"success\">" . filterData($_POST["hidden_filename"]) . ", was saved successfuly</p>";
171 
+	}
172 
+	else
173 
+	{
174 
+		echo errorMessage() . "Error: The file cannot be saved, check the permissions</p>";
175 
+		exit();
176 
+	}
177 
+	//if editing the current css file, replace that too
178 
+	if ($_POST["current_css_file"] == $_POST["hidden_filename"])
179 
+	{
180 
+		if (copy("./css/" . filterData($_POST["hidden_filename"]), "./css/style.css"))
181 
+			echo "<p class=\"success\">style.css file has been replaced with " . filterData($_POST["hidden_filename"]) . "</p>";
182 
+		else
183 
+		{
184 
+			echo errorMessage() . "Error: Unable to copy over style.css, are the permissions correct?</p>";
185 
+			exit();
186 
+		}
187 
+	}
188 
+}
189 
+
190 
+if (!isset($_POST["create_css"]) && !isset($_POST["edit_css"]) && !isset($_POST["delete_css"]) &&
191 
+!isset($_POST["set_css"]) && !isset($_POST["file_contents"]))
192 
+{
193 
+	//save all files in css directory to array
194 
+	$current_css_file = "";
195 
+	$css_style_md5 = md5_file("./css/style.css");
196 
+	$number_files = 0;
197 
+	if ($dh = opendir("./css/"))
198 
+	{
199 
+		while (($file = readdir($dh)) !== false)
200 
+		{
201 
+			if (filetype("./css/" . $file) == "file" && $file != "index.php" && $file != "style.css" && substr($file, -4) == ".css")
202 
+			{
203 
+				if (md5_file("./css/" . $file) == $css_style_md5)
204 
+					$current_css_file = $file;
205 
+				$files_array[$number_files] = $file;
206 
+				$number_files++;
207 
+			}
208 
+		}
209 
+		closedir($dh);
210 
+	}
211 
+	echo "<b>Currently Used CSS File: " . $current_css_file . "</b><br><br>";
212 
+	?>
213 
+
214 
+	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
215 
+	<b>Set CSS File:</b><select name="set_css">
216 
+	<?php
217 
+	for ($i = 0; $i < $number_files; $i++)
218 
+	{
219 
+		if ($files_array[$i] != $current_css_file) //no point setting it to itself...
220 
+			echo "<option value=\"" . $files_array[$i] . "\">" . $files_array[$i] . "</option>\n\t";
221 
+	}
222 
+	?>
223 
+	</select>
224 
+	<input type="submit" value="Set CSS File"/>
225 
+	</form>
226 
+	<br><br>
227 
+
228 
+	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
229 
+	<b>Delete CSS File:</b><select name="delete_css">
230 
+	<?php
231 
+	for ($i = 0; $i < $number_files; $i++)
232 
+	{
233 
+		if ($files_array[$i] != $current_css_file) //can't delete the file if it's already being used...
234 
+			echo "<option value=\"" . $files_array[$i] . "\">" . $files_array[$i] . "</option>\n\t";
235 
+	}
236 
+	?>
237 
+	</select>
238 
+	<input type="submit" value="Delete CSS File"/>
239 
+	</form>
240 
+	<br><br>
241 
+
242 
+	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
243 
+	<input type="hidden" name="current_css_file" value="<?php echo $current_css_file;?>"/>
244 
+	<b>Edit Existing CSS File:</b><select name="edit_css">
245 
+	<?php
246 
+	for ($i = 0; $i < $number_files; $i++)
247 
+	{
248 
+		echo "<option value=\"" . $files_array[$i] . "\">" . $files_array[$i] . "</option>\n\t";
249 
+	}
250 
+	?>
251 
+	</select>
252 
+	<input type="submit" value="Edit CSS File"/>
253 
+	</form>
254 
+	<br><br>
255 
+
256 
+	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
257 
+	<b>Create New CSS File (e.g. mycssfile.css):</b>
258 
+	<input type="text" size="40" name="create_css"/>
259 
+	<input type="submit" value="Create New CSS File"/>
260 
+	</form>
261 
+	<?php
262 
+}
263 
+?>
264 
+
265 
+<br>
266 
+<br>
267 
+<a href="admin.php"><img src="images/admin.png" border="0" class="icon" alt="Admin Page" title="Admin Page" /></a><a href="admin.php">Return to Admin Page</a>
268 
+</body>
269 
+</html>