|
@@ -35,15 +35,16 @@ class SettingsController extends Controller
|
|
if($request->isPost())
|
|
if($request->isPost())
|
|
{
|
|
{
|
|
$referer = $request->getHeader('HTTP_REFERER');
|
|
$referer = $request->getHeader('HTTP_REFERER');
|
|
- $uri = $request->getUri();
|
|
|
|
|
|
+ $uri = $request->getUri()->withUserInfo('');
|
|
$base_url = $uri->getBaseUrl();
|
|
$base_url = $uri->getBaseUrl();
|
|
|
|
|
|
- # security, users should not be able to fake post with settings from other typemill pages.
|
|
|
|
|
|
+ /* security, users should not be able to fake post with settings from other typemill pages.
|
|
if(!isset($referer[0]) OR $referer[0] !== $base_url . '/tm/settings' )
|
|
if(!isset($referer[0]) OR $referer[0] !== $base_url . '/tm/settings' )
|
|
{
|
|
{
|
|
$this->c->flash->addMessage('error', 'illegal referer');
|
|
$this->c->flash->addMessage('error', 'illegal referer');
|
|
return $response->withRedirect($this->c->router->pathFor('settings.show'));
|
|
return $response->withRedirect($this->c->router->pathFor('settings.show'));
|
|
}
|
|
}
|
|
|
|
+ */
|
|
|
|
|
|
$settings = \Typemill\Settings::getUserSettings();
|
|
$settings = \Typemill\Settings::getUserSettings();
|
|
$defaultSettings = \Typemill\Settings::getDefaultSettings();
|
|
$defaultSettings = \Typemill\Settings::getDefaultSettings();
|
|
@@ -316,15 +317,16 @@ class SettingsController extends Controller
|
|
if($request->isPost())
|
|
if($request->isPost())
|
|
{
|
|
{
|
|
$referer = $request->getHeader('HTTP_REFERER');
|
|
$referer = $request->getHeader('HTTP_REFERER');
|
|
- $uri = $request->getUri();
|
|
|
|
|
|
+ $uri = $request->getUri()->withUserInfo('');
|
|
$base_url = $uri->getBaseUrl();
|
|
$base_url = $uri->getBaseUrl();
|
|
|
|
|
|
- # users should not be able to fake post with settings from other typemill pages.
|
|
|
|
|
|
+ /* users should not be able to fake post with settings from other typemill pages.
|
|
if(!isset($referer[0]) OR $referer[0] !== $base_url . '/tm/themes' )
|
|
if(!isset($referer[0]) OR $referer[0] !== $base_url . '/tm/themes' )
|
|
{
|
|
{
|
|
$this->c->flash->addMessage('error', 'illegal referer');
|
|
$this->c->flash->addMessage('error', 'illegal referer');
|
|
return $response->withRedirect($this->c->router->pathFor('themes.show'));
|
|
return $response->withRedirect($this->c->router->pathFor('themes.show'));
|
|
}
|
|
}
|
|
|
|
+ */
|
|
|
|
|
|
$userSettings = \Typemill\Settings::getUserSettings();
|
|
$userSettings = \Typemill\Settings::getUserSettings();
|
|
$params = $request->getParams();
|
|
$params = $request->getParams();
|
|
@@ -413,16 +415,17 @@ class SettingsController extends Controller
|
|
if($request->isPost())
|
|
if($request->isPost())
|
|
{
|
|
{
|
|
$referer = $request->getHeader('HTTP_REFERER');
|
|
$referer = $request->getHeader('HTTP_REFERER');
|
|
- $uri = $request->getUri();
|
|
|
|
|
|
+ $uri = $request->getUri()->withUserInfo('');
|
|
$base_url = $uri->getBaseUrl();
|
|
$base_url = $uri->getBaseUrl();
|
|
|
|
|
|
- # security, users should not be able to fake post with settings from other typemill pages.
|
|
|
|
|
|
+ /* security, users should not be able to fake post with settings from other typemill pages.
|
|
if(!isset($referer[0]) OR $referer[0] !== $base_url . '/tm/plugins' )
|
|
if(!isset($referer[0]) OR $referer[0] !== $base_url . '/tm/plugins' )
|
|
{
|
|
{
|
|
$this->c->flash->addMessage('error', 'illegal referer');
|
|
$this->c->flash->addMessage('error', 'illegal referer');
|
|
return $response->withRedirect($this->c->router->pathFor('plugins.show'));
|
|
return $response->withRedirect($this->c->router->pathFor('plugins.show'));
|
|
}
|
|
}
|
|
-
|
|
|
|
|
|
+ */
|
|
|
|
+
|
|
$userSettings = \Typemill\Settings::getUserSettings();
|
|
$userSettings = \Typemill\Settings::getUserSettings();
|
|
$pluginSettings = array();
|
|
$pluginSettings = array();
|
|
$userInput = $request->getParams();
|
|
$userInput = $request->getParams();
|
|
@@ -651,15 +654,16 @@ class SettingsController extends Controller
|
|
if($request->isPost())
|
|
if($request->isPost())
|
|
{
|
|
{
|
|
$referer = $request->getHeader('HTTP_REFERER');
|
|
$referer = $request->getHeader('HTTP_REFERER');
|
|
- $uri = $request->getUri();
|
|
|
|
|
|
+ $uri = $request->getUri()->withUserInfo('');
|
|
$base_url = $uri->getBaseUrl();
|
|
$base_url = $uri->getBaseUrl();
|
|
|
|
|
|
- # security, users should not be able to fake post with settings from other typemill pages.
|
|
|
|
|
|
+ /* security, users should not be able to fake post with settings from other typemill pages.
|
|
if(!isset($referer[0]) OR $referer[0] !== $base_url . '/tm/user/new' )
|
|
if(!isset($referer[0]) OR $referer[0] !== $base_url . '/tm/user/new' )
|
|
{
|
|
{
|
|
$this->c->flash->addMessage('error', 'illegal referer');
|
|
$this->c->flash->addMessage('error', 'illegal referer');
|
|
return $response->withRedirect($this->c->router->pathFor('user.new'));
|
|
return $response->withRedirect($this->c->router->pathFor('user.new'));
|
|
}
|
|
}
|
|
|
|
+ */
|
|
|
|
|
|
$params = $request->getParams();
|
|
$params = $request->getParams();
|
|
$user = new User();
|
|
$user = new User();
|
|
@@ -686,15 +690,16 @@ class SettingsController extends Controller
|
|
if($request->isPost())
|
|
if($request->isPost())
|
|
{
|
|
{
|
|
$referer = $request->getHeader('HTTP_REFERER');
|
|
$referer = $request->getHeader('HTTP_REFERER');
|
|
- $uri = $request->getUri();
|
|
|
|
|
|
+ $uri = $request->getUri()->withUserInfo('');
|
|
$base_url = $uri->getBaseUrl();
|
|
$base_url = $uri->getBaseUrl();
|
|
|
|
|
|
- # security, users should not be able to fake post with settings from other typemill pages.
|
|
|
|
|
|
+ /* security, users should not be able to fake post with settings from other typemill pages.
|
|
if(!isset($referer[0]) OR strpos($referer[0], $base_url . '/tm/user/') === false )
|
|
if(!isset($referer[0]) OR strpos($referer[0], $base_url . '/tm/user/') === false )
|
|
{
|
|
{
|
|
$this->c->flash->addMessage('error', 'illegal referer');
|
|
$this->c->flash->addMessage('error', 'illegal referer');
|
|
return $response->withRedirect($this->c->router->pathFor('user.list'));
|
|
return $response->withRedirect($this->c->router->pathFor('user.list'));
|
|
}
|
|
}
|
|
|
|
+ */
|
|
|
|
|
|
$params = $request->getParams();
|
|
$params = $request->getParams();
|
|
$user = new User();
|
|
$user = new User();
|
|
@@ -743,15 +748,16 @@ class SettingsController extends Controller
|
|
if($request->isPost())
|
|
if($request->isPost())
|
|
{
|
|
{
|
|
$referer = $request->getHeader('HTTP_REFERER');
|
|
$referer = $request->getHeader('HTTP_REFERER');
|
|
- $uri = $request->getUri();
|
|
|
|
|
|
+ $uri = $request->getUri()->withUserInfo('');
|
|
$base_url = $uri->getBaseUrl();
|
|
$base_url = $uri->getBaseUrl();
|
|
|
|
|
|
- # security, users should not be able to fake post with settings from other typemill pages.
|
|
|
|
|
|
+ /* security, users should not be able to fake post with settings from other typemill pages.
|
|
if(!isset($referer[0]) OR strpos($referer[0], $base_url . '/tm/user/') === false )
|
|
if(!isset($referer[0]) OR strpos($referer[0], $base_url . '/tm/user/') === false )
|
|
{
|
|
{
|
|
$this->c->flash->addMessage('error', 'illegal referer');
|
|
$this->c->flash->addMessage('error', 'illegal referer');
|
|
return $response->withRedirect($this->c->router->pathFor('user.list'));
|
|
return $response->withRedirect($this->c->router->pathFor('user.list'));
|
|
}
|
|
}
|
|
|
|
+ */
|
|
|
|
|
|
$params = $request->getParams();
|
|
$params = $request->getParams();
|
|
$validate = new Validation();
|
|
$validate = new Validation();
|