andy/neoCMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 11 Wiki Activity

Backporting FOAG changes into Neo devstream

Browse Source
This commit is contained in:
Andy Dixon
2024-09-10 16:20:14 +01:00
parent 0875394e48
commit ac13bf95a7
27 changed files with 84 additions and 1979 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cms/backups/nothing.txt
View File
cms/core/createsession.php
-2
View File
@@ -26,6 +26,4 @@ if (!isset($_SESSION['neoCMSSess'])) {
} else $sessname = $_SESSION['neoCMSSess']; } else $sessname = $_SESSION['neoCMSSess'];
session_name($sessname);
session_cache_expire(240); // 4 hours
@session_start(); @session_start();
cms/core/fileload.php
+83 -84
View File
@@ -12,7 +12,6 @@ if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSses
$pageurl = $_SERVER['HTTP_REFERER']; //incoming page url $pageurl = $_SERVER['HTTP_REFERER']; //incoming page url
if (stristr($pageurl, $_SERVER['HTTP_HOST'])) { if (stristr($pageurl, $_SERVER['HTTP_HOST'])) {
$type = $_GET['type']; $type = $_GET['type'];
if ($type == 'img') $files = 'bmp,gif,jpeg,jpg,png,svg,svgx,webp'; if ($type == 'img') $files = 'bmp,gif,jpeg,jpg,png,svg,svgx,webp';
@@ -34,91 +33,10 @@ if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSses
$pattern = trim($pattern, '|') . ')/i'; $pattern = trim($pattern, '|') . ')/i';
function findfiles($path, $pattern)
{
global $matches, $pathdefault, $type;
$path = rtrim(str_replace("\\", "/", $path), '/') . '/'; $matches = findfiles('../../', $pattern);
print_r($matches);
$entries = array();
$dir = dir($path);
$neocmspath = "/\/" . $_SESSION['neoCMSPath'] . "\//";
while (false !== ($entry = $dir->read())) {
if (!preg_match($neocmspath, $path)) $entries[] = $entry;
}
$dir->close();
foreach ($entries as $entry) {
$fullname = $path . $entry;
$pathname = str_replace('../..', '', $path);
$exFolders = preg_replace('/,\s*/', '/|', $_SESSION['neoCMSExFolders']);
$exFolders = str_replace('-', '\-', $exFolders);
$exFolders = str_replace('.', '\.', $exFolders);
$exFolders = '/' . str_replace('/', '\/', $exFolders) . '\//';
if ($entry != '.' && $entry != '..' && is_dir($fullname) && is_readable($fullname) && (!preg_match($exFolders, $fullname) || $_SESSION['neoCMSExFolders'] == '')) findfiles($fullname, $pattern);
elseif ($entry != '.' && $entry != '..' && is_file($fullname) && preg_match($pattern, $entry)) {
if (!in_array($pathname, $matches)) {
if (preg_match('/\.html|\.htm|\.php|\.cfm|\.phtml|\.shtml|\.asp/', $fullname)) {
$content = file_get_contents($fullname);
if (checkContent($content)) $matches[] = $fullname;
} else $matches[] = $fullname;
}
}
}
}
function checkContent($content)
{
global $type;
if (stristr($content, '<?php') || stristr($content, '<%')) {
if (((!stristr($content, '<?php') && !strstr($content, '<%')) || (preg_match('/>[^<]+</', $content) || (preg_match('/<html/', $content))) || $type == 'pages')) {
if (strstr($content, 'neocms')) return true;
else return false;
} else return false;
} elseif (preg_match('/<html/', $content) || $type == 'pages') {
if (strstr($content, 'neocms')) return true;
}
}
function siteURL()
{
$purl = 'http';
$req = explode('/' . $_SESSION['neoCMSPath'] . '/', $_SERVER["REQUEST_URI"]);
$req = $req[0];
if ($_SERVER["HTTPS"] == "on") $purl .= "s";
$purl .= "://";
if ($_SERVER["SERVER_PORT"] != "80") $purl .= $_SERVER["SERVER_NAME"] . ":" . $_SERVER["SERVER_PORT"] . "$req/";
else $purl .= $_SERVER["SERVER_NAME"] . "$req/";
return strtolower($purl);
}
findfiles('../../', $pattern);
sort($matches); sort($matches);
$includes = array_unique($includes); $includes = array_unique($includes);
@@ -177,3 +95,84 @@ if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSses
} }
} }
function findfiles($path, $pattern)
{
$matches = [];
$path = rtrim(str_replace("\\", "/", $path), '/') . '/';
$entries = array();
$dir = dir($path);
$neocmspath = "/\/" . $_SESSION['neoCMSPath'] . "\//";
while (false !== ($entry = $dir->read())) {
if (!preg_match($neocmspath, $path)) $entries[] = $entry;
}
$dir->close();
foreach ($entries as $entry) {
$fullname = $path . $entry;
$pathname = str_replace('../..', '', $path);
$exFolders = preg_replace('/,\s*/', '/|', $_SESSION['neoCMSExFolders']);
$exFolders = str_replace('-', '\-', $exFolders);
$exFolders = str_replace('.', '\.', $exFolders);
$exFolders = '/' . str_replace('/', '\/', $exFolders) . '\//';
if ($entry != '.' && $entry != '..' && is_dir($fullname) && is_readable($fullname) && (!preg_match($exFolders, $fullname) || $_SESSION['neoCMSExFolders'] == '')) findfiles($fullname, $pattern);
elseif ($entry != '.' && $entry != '..' && is_file($fullname) && preg_match($pattern, $entry)) {
if (!in_array($pathname, $matches)) {
if (preg_match('/\.html|\.htm|\.php|\.cfm|\.phtml|\.shtml|\.asp/', $fullname)) {
$content = file_get_contents($fullname);
if (checkContent($content)) {
$matches[] = $fullname;
}
} else $matches[] = $fullname;
}
}
}
return $matches;
}
function checkContent($content)
{
global $type;
if (stristr($content, '<?php') || stristr($content, '<%')) {
if (((!stristr($content, '<?php') && !strstr($content, '<%')) || (preg_match('/>[^<]+</', $content) || (preg_match('/<html/', $content))) || $type == 'pages')) {
if (strstr($content, 'neocms')) return true;
else return false;
} else return false;
} elseif (preg_match('/<html/', $content) || $type == 'pages') {
if (strstr($content, 'neocms')) return true;
}
}
function siteURL()
{
$purl = 'http';
$req = explode('/' . $_SESSION['neoCMSPath'] . '/', $_SERVER["REQUEST_URI"]);
$req = $req[0];
if ($_SERVER["HTTPS"] == "on") $purl .= "s";
$purl .= "://";
if ($_SERVER["SERVER_PORT"] != "80") $purl .= $_SERVER["SERVER_NAME"] . ":" . $_SERVER["SERVER_PORT"] . "$req/";
else $purl .= $_SERVER["SERVER_NAME"] . "$req/";
return strtolower($purl);
}
cms/core/save.php
+1 -46
View File
@@ -426,50 +426,7 @@ if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSses
if (@file_exists($fkey)) { if (@file_exists($fkey)) {
if ($ftpconn) { if (is_writable($fkey)) {
$doc = tmpfile();
if (!$doc) {
$docp = tempnam(dirname(__FILE__) . '/../settings/tmp', 'Doc');
chmod($docp, 0777);
$doc = fopen($docp, 'w+');
}
$remotefile = '';
fwrite($doc, $fpost);
rewind($doc);
$incs = flatten($includes);
if (strstr($fkey, $_SERVER['DOCUMENT_ROOT'])) {
$nfkey = explode($_SERVER['DOCUMENT_ROOT'], $fkey);
$nfkey = $nfkey[1];
if (in_array($nfkey, $incs)) $remotefile = $ftpwd . $nfkey;
else {
$path = urldissect($_SERVER['SCRIPT_NAME'], false, 3);
$fkey = explode('../../', $fkey, 2);
$remotefile = $ftpwd . $path . $fkey[1];
}
} else {
$path = urldissect($_SERVER['SCRIPT_NAME'], false, 3);
$fkey = explode('../../', $fkey, 2);
$remotefile = $ftpwd . $path . $fkey[1];
}
if (ftp_fput($ftpconn, $remotefile, $doc, FTP_BINARY)) echo "Uploaded: $remotefile!\n\n";
else $message = '<strong>Error:</strong> neocms publish this page: <em>' . $remotefile . '</em>';
fclose($doc);
if (isset($docp)) unlink($docp);
} elseif (is_writable($fkey)) {
$doc = fopen($fkey, "w"); $doc = fopen($fkey, "w");
fwrite($doc, $fpost); fwrite($doc, $fpost);
@@ -489,8 +446,6 @@ if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSses
output(); output();
} else output(); } else output();
if ($ftpconn) ftp_close($ftpconn);
} }
} else { } else {
$message = '<strong>Error:</strong> neocms is unable find your session.'; $message = '<strong>Error:</strong> neocms is unable find your session.';
cms/functions/checkbrand.php
-11
View File
@@ -1,11 +0,0 @@
<?php
error_reporting(E_ALL & ~E_NOTICE);
$doc = file_get_contents("./login.php", true);
$doc = stripslashes($doc);
$cb = true;
?>
cms/functions/checkpath.php
-66
View File
@@ -1,66 +0,0 @@
<?php
include_once('geturi.php');
$pageurl = $_SERVER['HTTP_REFERER']; //incoming page url
$scripturl = $_SERVER['HTTP_HOST'] . uri();
function rewriteurl($pageurl)
{
$rwurl = false;
$rewrites = array('/\/$/', '/.$/');
$exts = array("$0.php", "$0.html", "$0.htm", "$0.cfm", "$0.phtml", "$0.asp");
foreach ($rewrites as $rw) {
if (preg_match($rw, $pageurl)) {
foreach ($exts as $ext) {
if (@file_exists(preg_replace($rw, $ext, $pageurl))) {
$rwurl = preg_replace($rw, $ext, $pageurl);
break 2;
}
}
}
}
return $rwurl;
}
if (stristr($pageurl, $_SERVER['HTTP_HOST'])) {
$path = $_SESSION['neoCMSPath'];
$scripturl = explode("/$path/", $scripturl);
$pageurl = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? dirname(__FILE__) . str_replace("https://$scripturl[0]/", '/../../', $pageurl) : dirname(__FILE__) . str_replace("http://$scripturl[0]/", '/../../', $pageurl); // check for https protocol
$pagepath = explode('/', $pageurl);
array_pop($pagepath);
$pagepath = implode('/', $pagepath);
if (!@file_exists("$pageurl") && !is_dir($pageurl)) $pageurl = rewriteurl($pageurl);
elseif (is_dir($pageurl)) {
$fileendings = array("index.html", "index.shtml", "index.htm", "index.php", "index.cfm", "index.phtml", "index.asp", "default.html", "default.shtml", "default.htm", "default.php", "default.cfm", "default.phtml", "default.asp"); // edit this if you have a custom default page
foreach ($fileendings as $value) {
if (@file_exists("$pageurl$value")) {
$pageurl = "$pageurl$value";
break;
}
}
}
}
?>
cms/functions/cleaner.php
-109
View File
@@ -1,109 +0,0 @@
<?php
function thecleaner($stuff)
{
global $message, $encode, $doctype;
$code = array();
$phpreg = '/<\?(.|\n|\r)+?\?>/';
$aspreg = '/<%(.|\n|\r)+?\%>/';
$jsreg = '/<script\s[^>]*>\s*[^<](.|\n)*?<\/\s*script>/';
$prereg = '/<pre[^>]*>(.|\n)*?<\/\s*pre>/';
$codereg = '/<code[^>]*>(.|\n)*?<\/\s*code>/';
$cssreg = '/<style[^>]*>(.|\n)*?<\/\s*style>/';
$stufflen = strlen($stuff);
try {
//grab php
preg_match_all($phpreg, $stuff, $code['PHP']);
$stuff = preg_replace($phpreg, '----||PHPTagGoesH3r3||----', $stuff);
//grab asp
preg_match_all($aspreg, $stuff, $code['ASP']);
$stuff = preg_replace($aspreg, '----||ASPTagGoesH3r3||----', $stuff);
//grab on-page js
preg_match_all($jsreg, $stuff, $code['JS']);
$stuff = preg_replace($jsreg, '----||JSTagGoesH3r3||----', $stuff);
//grab on-page CSS
preg_match_all($cssreg, $stuff, $code['CSS']);
$stuff = preg_replace($cssreg, '----||CSSTagGoesH3r3||----', $stuff);
} catch (Exception $e) {
$message = '<strong>Error:</strong> There may be too much on-page Javascript or CSS. Please try moving them to external files and/or validating your HTML.';
output();
}
$stuff = stripslashes($stuff);
$stuff = trim($stuff);
//grab pre
preg_match_all($prereg, $stuff, $code['PRE']);
$stuff = preg_replace($prereg, '----||PreTagGoesH3r3||----', $stuff);
//grab code
preg_match_all($codereg, $stuff, $code['CODE']);
$stuff = preg_replace($codereg, '----||CodeTagGoesH3r3||----', $stuff);
//fix uppercase tags
$stuff = preg_replace_callback('/<(\/|)[A-Z]+[A-Z0-9]*\b/', function ($matches) {
return strtolower($matches[0]);
}, $stuff);
//fix attribute quotes
$stuff = preg_replace('/(<(?!meta)[^>]*\s[A-Za-z]+=)([^>\'\"\s]+)(\s*[^>]*)/', '$1"$2"$3', $stuff);
// fix self-closing tags
if (preg_match('/XHTML/', $doctype)) {
$stuff = preg_replace("/(<img[^>%]*[^\/%])(>)/i", "$1/>", $stuff);
$stuff = preg_replace("/<br\s*>/", "<br />", $stuff);
}
$nstuff = htmlentities($stuff, ENT_QUOTES, $encode);
if ($nstuff == '') $nstuff = htmlentities($stuff, ENT_QUOTES, 'ISO-8859-15');
$stuff = $nstuff;
$stuff = str_replace("&lt;", "<", $stuff);
$stuff = str_replace("&gt;", ">", $stuff);
$stuff = str_replace("&amp;", '&', $stuff);
$stuff = str_replace("&#039;", "'", $stuff);
$stuff = str_replace("&quot;", '"', $stuff);
// remove TinyMCE stuff
preg_match_all('/(?:<[^>]*)(_mce_[^=]+=(?:\"|\'|)[^\"]*(?:\"|\'|)\s*)/', $stuff, $mces);
foreach ($mces[1] as $mce) {
$stuff = str_replace($mce, "", $stuff);
}
// add back original code
$replace = array('CODE', 'PRE', 'CSS', 'JS', 'ASP', 'PHP');
foreach ($replace as $r) {
$rreg = '/\-\-\-\-\|\|' . $r . 'TagGoesH3r3\|\|\-\-\-\-/';
$c = 0;
preg_match_all($rreg, $stuff, $newcode);
foreach ($newcode[0] as $ncode) {
$stuff = preg_replace($rreg, $code[$r][0][$c], $stuff, 1);
$c++;
}
$c = 0;
}
// remove extra line breaks
$stuff = preg_replace("/\r\n/", "\n", $stuff);
if ($stuff != '' || $stufflen == 0) return $stuff;
else $message = '<strong>Error:</strong> Some characters couldn&rsquo;t be recognised. Try switching to UTF-8 encoding and be sure all special characters are properly encoded.';
}
?>
cms/functions/createsession.php
-35
View File
@@ -1,35 +0,0 @@
<?php
error_reporting(E_ALL & ~E_NOTICE);
$ssp = ini_get("session.save_path");
try {
if ($ssp != '') @ini_set("session.save_path", $ssp);
else @ini_set("session.save_path", '/');
} catch (Exception $e) {
@ini_set("session.save_path", '/');
}
ini_set("session.auto_start", 0);
ini_set("register_long_arrays", 0);
ini_set("session.cache_limiter", "private");
ini_set("open_basedir", dirname(__FILE__) . '/../../');
ini_set('memory_limit', '256M');
$sessname = '';
if (!isset($_SESSION['neoCMSSess'])) {
$sessname = "neoCMSsession" . uniqid('');
$_SESSION['neoCMSSess'] = $sessname;
} else $sessname = $_SESSION['neoCMSSess'];
@session_name($sessname);
@session_cache_expire(240); // 4 hours
@session_start();
$ver = 'NeoCMS 0.1';
?>
cms/functions/fileload.php
-181
View File
@@ -1,181 +0,0 @@
<?php
error_reporting(E_ALL & ~E_NOTICE);
@session_start();
if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSsession')) {
include_once('createsession.php');
if (isset($_SESSION['neoCMSUserid'])) {
$pageurl = $_SERVER['HTTP_REFERER']; //incoming page url
if (stristr($pageurl, $_SERVER['HTTP_HOST'])) {
$type = $_GET['type'];
if ($type == 'img') $files = 'bmp,gif,jpeg,jpg,png';
elseif ($type == 'pages') $files = 'html,htm,php,cfm,phtml,shtml,asp';
else $files = 'psd,pdf,swf,sit,tar,tgz,zip,gzip,bmp,gif,jpeg,jpg,jpe,png,txt,doc,docx,xl,xls,flv,mov,qt,mpg,mpeg,mp3,aiff,aif,aac,wav,ppt,rtf,html,shtml,htm,php,cfm,phtml,asp';
$files = explode(',', $files);
$pattern = '/(';
foreach ($files as $file) {
$pattern .= '\.' . $file . '|';
}
$matches = array();
$includes = array();
$pattern = trim($pattern, '|') . ')/i';
function findfiles($path, $pattern)
{
global $matches, $pathdefault, $type;
$path = rtrim(str_replace("\\", "/", $path), '/') . '/';
$entries = array();
$dir = dir($path);
$neocmspath = "/\/" . $_SESSION['neoCMSPath'] . "\//";
while (false !== ($entry = $dir->read())) {
if (!preg_match($neocmspath, $path)) $entries[] = $entry;
}
$dir->close();
foreach ($entries as $entry) {
$fullname = $path . $entry;
$pathname = str_replace('../..', '', $path);
$exFolders = preg_replace('/,\s*/', '/|', $_SESSION['neoCMSExFolders']);
$exFolders = str_replace('-', '\-', $exFolders);
$exFolders = str_replace('.', '\.', $exFolders);
$exFolders = '/' . str_replace('/', '\/', $exFolders) . '\//';
if ($entry != '.' && $entry != '..' && is_dir($fullname) && is_readable($fullname) && (!preg_match($exFolders, $fullname) || $_SESSION['neoCMSExFolders'] == '')) findfiles($fullname, $pattern);
elseif ($entry != '.' && $entry != '..' && is_file($fullname) && preg_match($pattern, $entry)) {
if (!in_array($pathname, $matches)) {
if (preg_match('/\.html|\.htm|\.php|\.cfm|\.phtml|\.shtml|\.asp/', $fullname)) {
$content = file_get_contents($fullname);
if (checkContent($content)) $matches[] = $fullname;
} else $matches[] = $fullname;
}
}
}
}
function checkContent($content)
{
global $type;
if (stristr($content, '<?php') || stristr($content, '<%')) {
if (((!stristr($content, '<?php') && !strstr($content, '<%')) || (preg_match('/>[^<]+</', $content) || (preg_match('/<html/', $content))) || $type == 'pages')) {
if (strstr($content, 'neocms')) return true;
else return false;
} else return false;
} elseif (preg_match('/<html/', $content) || $type == 'pages') {
if (strstr($content, 'neocms')) return true;
}
}
function siteURL()
{
$purl = 'http';
$req = explode('/' . $_SESSION['neoCMSPath'] . '/', $_SERVER["REQUEST_URI"]);
$req = $req[0];
if ($_SERVER["HTTPS"] == "on") $purl .= "s";
$purl .= "://";
if ($_SERVER["SERVER_PORT"] != "80") $purl .= $_SERVER["SERVER_NAME"] . ":" . $_SERVER["SERVER_PORT"] . "$req/";
else $purl .= $_SERVER["SERVER_NAME"] . "$req/";
return strtolower($purl);
}
findfiles('../../', $pattern);
sort($matches);
$includes = array_unique($includes);
$pathreg = "/\/$pathdefault\//";
$imghtml = '';
$filehtml = '';
$pagehtml = '';
if (sizeof($matches) > 0) {
foreach ($matches as $match) {
$fname = str_replace('../../', '', $match);
$flink = siteURL() . $fname;
if (preg_match('/\.bmp|\.gif|\.jpeg|\.jpg|\.png/i', $fname)) {
if (!strstr($imghtml, 'neoCMSImgUL')) $imghtml = '<ul id="neoCMSImgUL" class="clearfix"></ul>';
if (($_SESSION['neoCMSImagePath'] == null || $_SESSION['neoCMSImagePath'] == '') || strstr($fname, $_SESSION['neoCMSImagePath'])) $imghtml = str_replace('</ul>', '<li><div class="mask"><img src="' . $flink . '" alt="' . $fname . ' Thumbnail"/></div><p>' . $fname . '</p></li></ul>', $imghtml);
} elseif (preg_match('/\.html|\.htm|\.php|\.phtml|\.cfm|\.shtml|\.asp/i', $fname)) {
if (!strstr($pagehtml, 'neoCMSPagesUL')) $pagehtml = '<ul id="neoCMSPagesUL" class="clearfix"></ul>';
$pagehtml = str_replace('</ul>', '<li href="' . $flink . '">' . $fname . '</li></ul>', $pagehtml);
} else {
if (!strstr($filehtml, 'neoCMSFileUL')) $filehtml = '<ul id="neoCMSFileUL" class="clearfix"></ul>';
if (($_SESSION['neoCMSFilePath'] == null || $_SESSION['neoCMSFilePath'] == '') || strstr($fname, $_SESSION['neoCMSFilePath'])) $filehtml = str_replace('</ul>', '<li href="' . $flink . '">' . $fname . '</li></ul>', $filehtml);
}
}
$matches = $imghtml . $pagehtml . $filehtml;
$script = "<script language='javascript' type='text/javascript'>window.top.window.fileOption('" . addslashes($matches) . "');</script>";
echo $script;
} else {
$script = '<script language="javascript" type="text/javascript">window.top.window.fileOption(\'<ul class="clearfix"><li>No Results Found</li></ul>\');</script>';
echo $script;
}
$endscript = "<script language='javascript' type='text/javascript'>window.top.window.destroyFileLoader('$type');</script>";
echo $endscript;
}
}
}
?>
cms/functions/folderload.php
-111
View File
@@ -1,111 +0,0 @@
<?php
error_reporting(E_ALL & ~E_NOTICE);
@session_start();
if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSsession') && $_GET['type'] != '') {
include_once('createsession.php');
if (isset($_SESSION['neoCMSUserid'])) {
$type = $_GET['type'];
$pageurl = $_SERVER['HTTP_REFERER']; //incoming page url
if (stristr($pageurl, $_SERVER['HTTP_HOST'])) {
$allfiles = 'psd,pdf,swf,sit,tar,tgz,zip,gzip,bmp,gif,jpeg,jpg,jpe,png,txt,doc,docx,xl,xls,flv,mov,qt,mpg,mpeg,mp3,aiff,aif,aac,wav,ppt';
$imgfiles = 'png,jpg,gif,jpeg,tiff,bmp';
$pathpatt = ($type == 'img') ? '/image|img/i' : '/upload|files/i';
$pathdefault = ($type == 'img') ? $_SESSION['neoCMSImagePath'] : $_SESSION['neoCMSFilePath'];
$files = ($type == 'img') ? $imgfiles : $allfiles;
$files = explode(',', $files);
$pattern = '/(';
foreach ($files as $file) {
$pattern .= '\.' . $file . '|';
}
$pattern = trim($pattern, '|') . ')/i';
$matches = array();
function findfiles($path, $pattern, $pathpatt)
{
global $matches;
$path = rtrim(str_replace("\\", "/", $path), '/') . '/';
$entries = array();
$dir = dir($path);
while (false !== ($entry = $dir->read())) {
if (!preg_match('/(\/neocms\-js\/|\/neocms\-images\/)/', $path)) $entries[] = $entry;
}
$dir->close();
foreach ($entries as $entry) {
$fullname = $path . $entry;
$pathname = str_replace('../..', '', $path);
$exFolders = preg_replace('/,\s*/', '|', $_SESSION['neoCMSExFolders']);
$exFolders = str_replace('-', '\-', $exFolders);
$exFolders = str_replace('.', '\.', $exFolders);
$exFolders = '/' . str_replace('/', '\/', $exFolders) . '/';
if ($entry != '.' && $entry != '..' && is_dir($fullname)) {
if (preg_match($pathpatt, $path) && !in_array($pathname, $matches) && is_writable($path)) $matches[] = $pathname;
if (!preg_match($exFolders, $fullname) || $_SESSION['neoCMSExFolders'] == '') findfiles($fullname, $pattern, $pathpatt);
} elseif (($entry == '.' || $entry == '..') && is_dir($fullname)) {
if (preg_match($pathpatt, $path) && !in_array($pathname, $matches) && is_writable($path)) $matches[] = $pathname;
} elseif (is_file($fullname) && preg_match($pattern, $entry)) {
if (!in_array($pathname, $matches) && is_writable($path)) $matches[] = $pathname;
}
}
}
findfiles("../../$pathdefault", $pattern, $pathpatt);
if (sizeof($matches) > 0) {
foreach ($matches as $match) {
$script = '<script language="javascript" type="text/javascript">window.top.window.folderOption("' . $match . '", "' . $type . '");</script>';
echo $script;
}
} else {
$script = '<script language="javascript" type="text/javascript">window.top.window.folderOption("/", "' . $type . '");</script>';
echo $script;
}
$endscript = '<script language="javascript" type="text/javascript">window.top.window.destroyFolderLoader();</script>';
echo $endscript;
}
}
}
?>
cms/functions/forgotpassword.php
-35
View File
@@ -1,35 +0,0 @@
<?php
error_reporting(E_ALL & ~E_NOTICE);
@session_start();
if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSsession')) {
include_once('createsession.php');
$forgotproxy = 'https://www.neogate.com/licencing/forgotpass-serv.php?';
if ($_POST && $_POST['neoCMSUsername']) {
include_once('getpath.php');
$forgotgets = 'neoCMSSess=' . urlencode($_SESSION['neoCMSSess']) . '&neoCMSPath=' . $path . '&neoCMSAcctUser=' . urlencode($_POST['neoCMSUsername']);
header("Location:$forgotproxy$forgotgets");
} elseif ($_GET && $_GET['neoCMSSess'] == $_SESSION['neoCMSSess']) {
$m = $_GET['neoCMSPassMessage'];
echo $m;
if ($m == '0') $getmessage = "Your password was reset and an email was sent.";
elseif ($m == '1') $getmessage = "There is no such user on this domain.";
$script = '<script type="text/javascript">window.top.window.forgotReset("' . $getmessage . '");</script>';
echo $script;
}
}
?>
cms/functions/ftpclear.php
-67
View File
@@ -1,67 +0,0 @@
<?php
error_reporting(E_ALL & ~E_NOTICE);
@session_start();
if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSsession')) {
include_once('urldissect.php');
include_once('createsession.php');
if (isset($_SESSION['neoCMSUserid']) && isset($_SESSION['neoCMSIsadmin']) && $_SESSION['neoCMSIsadmin'] == 'Y') {
$ftpconn = false;
$ftpvars = "<?php\n\n";
$ftpvars .= "\t" . '$ftpu = ' . "false;\n";
$ftpvars .= "\t" . '$ftpp = ' . "false;\n";
$ftpvars .= "\t" . '$ftps = ' . "false;\n";
$ftpvars .= "\t" . '$ftpwd = ' . "false;\n\n";
$ftpvars .= '?>';
$fftp = '';
include_once('ftpvars.php');
include_once('ftpconnect.php');
ftpconnect();
if ($ftpconn) {
$ftpdoc = tmpfile();
if (!$ftpdoc) {
$ftpdocp = tempnam(dirname(__FILE__) . '/../settings/tmp', 'Ftpdoc');
chmod($ftpdocp, 0777);
$ftpdoc = fopen($ftpdocp, 'w+');
}
fwrite($ftpdoc, $ftpvars);
rewind($ftpdoc);
$path = urldissect($_SERVER['SCRIPT_NAME'], false, 1);
$remotefile = $ftpwd . $path . 'ftpvars.php';
if (ftp_fput($ftpconn, $remotefile, $ftpdoc, FTP_BINARY)) {
$getmessage = "Your FTP information has been successfully cleared.";
$savescript = '<script type="text/javascript">window.top.window.userBar("' . $getmessage . '");</script>';
echo $savescript;
} else {
$getmessage = '<strong>Error:</strong> neocms could not find this page: <em>' . $remotefile . '</em>';
$savescript = '<script type="text/javascript">window.top.window.userBar("' . $getmessage . '");</script>';
echo $savescript;
}
fclose($ftpdoc);
if (isset($ftpdocp)) unlink($ftpdocp);
}
echo '<script type="text/javascript">window.top.window.clearFTPInfo();window.top.window.removeFrames();</script>';
}
}
?>
cms/functions/ftpconnect.php
-34
View File
@@ -1,34 +0,0 @@
<?php
function ftpconnect()
{
global $fftp, $ftpu, $ftpp, $ftps, $ftpwd, $ftpconn;
if ($ftpu && $ftpp && $ftps && $ftpwd) {
if ($ftpwd != '/') $ftpwd = rtrim($ftpwd, '/');
//start ftp connection
if (function_exists('ftp_connect')) {
$ftpconn = ftp_connect($ftps) or die("Couldn't connect to $ftps");
ftp_login($ftpconn, $ftpu, $ftpp);
ftp_pasv($ftpconn, true);
} else {
$ftpconn = false;
$getmessage = "<strong>Error:</strong> FTP is not enabled for your install of PHP. <a href='http://www.php.net/manual/en/ftp.setup.php' title='Installing FTP on PHP'>More info here.</a>";
$savescript = '<script type="text/javascript">window.top.window.userBar("' . $getmessage . '");</script>';
echo $savescript;
}
}
}
?>
cms/functions/ftpcreate.php
-82
View File
@@ -1,82 +0,0 @@
<?php
error_reporting(E_ALL & ~E_NOTICE);
@session_start();
if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSsession')) {
include_once('urldissect.php');
include_once('createsession.php');
if (isset($_SESSION['neoCMSUserid']) && isset($_SESSION['neoCMSIsadmin']) && $_SESSION['neoCMSIsadmin'] == 'Y') {
extract($_POST);
$ftpconn = false;
$ftpu = ($ftpu != '') ? $ftpu : false;
$ftpp = ($ftpp != '') ? $ftpp : false;
$ftps = ($ftps != '') ? $ftps : false;
$ftpwd = ($ftpwd != '') ? $ftpwd : false;
if ($ftpu && $ftpp && $ftps && $ftpwd) {
$ftpvars = "<?php\n\n";
$ftpvars .= "\t" . '$ftpu = "' . $ftpu . '"' . ";\n";
$ftpvars .= "\t" . '$ftpp = "' . $ftpp . '"' . ";\n";
$ftpvars .= "\t" . '$ftps = "' . $ftps . '"' . ";\n";
$ftpvars .= "\t" . '$ftpwd = "' . $ftpwd . '"' . "\n\n";
$ftpvars .= '?>';
include_once('ftpconnect.php');
ftpconnect();
if ($ftpconn) {
$ftpdoc = tmpfile();
if (!$ftpdoc) {
$ftpdocp = tempnam(dirname(__FILE__) . '/../settings/tmp', 'Ftpdoc');
chmod($ftpdocp, 0777);
$ftpdoc = fopen($ftpdocp, 'w+');
}
fwrite($ftpdoc, $ftpvars);
rewind($ftpdoc);
$path = urldissect($_SERVER['SCRIPT_NAME'], false, 1);
$remotefile = $ftpwd . $path . 'ftpvars.php';
if (ftp_fput($ftpconn, $remotefile, $ftpdoc, FTP_BINARY)) {
$getmessage = "Your FTP information was successfully saved.";
$savescript = '<script type="text/javascript">window.top.window.userBar("' . $getmessage . '");</script>';
echo $savescript;
} else {
$getmessage = "<strong>Error:</strong> There is an error in your FTP credentials. Please try entering them again.";
$savescript = '<script type="text/javascript">window.top.window.userBar("' . $getmessage . '");</script>';
echo $savescript;
}
fclose($ftpdoc);
if (isset($ftpdocp)) unlink($ftpdocp);
}
echo '<script type="text/javascript">window.top.window.removeFrames();</script>';
} else {
$getmessage = '<strong>Error:</strong> All fields are required.';
$savescript = '<script type="text/javascript">window.top.window.userBar("' . $getmessage . '");</script>';
echo $savescript;
echo '<script type="text/javascript">window.top.window.removeFrames();</script>';
}
}
}
?>
cms/functions/ftpstart.php
-10
View File
@@ -1,10 +0,0 @@
<?php
$ftpconn = false;
include_once('ftpvars.php');
include_once('ftpconnect.php');
ftpconnect($ftpu, $ftpp, $ftps, $ftpwd);
?>
cms/functions/ftpvars.php
-8
View File
@@ -1,8 +0,0 @@
<?php
$ftpu = false;
$ftpp = false;
$ftps = false;
$ftpwd = false;
?>
cms/functions/getpage.php
-13
View File
@@ -1,13 +0,0 @@
<?php
error_reporting(E_ALL & ~E_NOTICE);
@session_start();
if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSsession')) {
include_once('createsession.php');
if ($_POST['page']) $_SESSION['neoCMSCurpage'] = $_POST['page'];
}
?>
cms/functions/getpath.php
-27
View File
@@ -1,27 +0,0 @@
<?php
error_reporting(E_ALL & ~E_NOTICE);
@session_start();
if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSsession')) {
include_once('geturi.php');
include_once('createsession.php');
$pathproxy = 'https://www.neogate.com/licencing/prefs-serv.php?';
$scripturl = $_SERVER['HTTP_HOST'] . uri();
$path = explode('/', $scripturl);
$path = $path[sizeof($path) - 3];
if (isset($_SESSION['neoCMSPath']) && $_SESSION['neoCMSPath'] != $path) {
$pathgets = 'neoCMSUsername=' . urlencode($_SESSION['neoCMSUserid']) . '&neoCMSSess=' . urlencode($_SESSION['neoCMSSess']) . '&neoCMSPath=' . urlencode($_POST['neoCMSHTML']);
header("Location:$pathproxy$pathgets");
}
}
?>
cms/functions/getsaveprefs.php
-35
View File
@@ -1,35 +0,0 @@
<?php
error_reporting(E_ALL & ~E_NOTICE);
@session_start();
if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSsession')) {
include_once('createsession.php');
if (isset($_SESSION['neoCMSUserid'])) {
$prefproxy = 'https://www.neogate.com/licencing/prefs-serv.php?';
$_SESSION['neoCMSHTML'] = $gethtml = "";
$_SESSION['neoCMSPath'] = $getpath = "cms";
$_SESSION['neoCMSFiles'] = $getfile = 1;
$_SESSION['neoCMSFilePath'] = $getfilepath = "files";
$_SESSION['neoCMSImagePath'] = $getimagepath = "images";
$_SESSION['neoCMSExFolders'] = $getexfolders = "ext";
$_SESSION['neoCMSLatest'] = $_GET['neoCMSLatest'];
if ($_GET['neoCMSPrefSave'] == 'Y') {
$getmessage = "Your Preferences were successfully saved.";
$savescript = '<script type="text/javascript">window.top.window.userBar("' . $getmessage . '");</script>';
echo $savescript;
}
$script = '<script type="text/javascript">window.top.window.getGlobals("' . $getpath . '", "' . $gethtml . '", "' . $getfile . '", "' . $getfilepath . '", "' . $getexfolders . '", "' . $getimagepath . '");</script>';
echo $script;
}
}
cms/functions/getsaveusers.php
-98
View File
@@ -1,98 +0,0 @@
<?php
error_reporting(E_ALL & ~E_NOTICE);
@session_start();
if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSsession')) {
include_once('createsession.php');
if (isset($_SESSION['neoCMSUserid'])) {
$userproxy = 'https://www.neogate.com/licencing/users-serv.php?';
if ($_POST && $_POST['neoCMSAcctUser'] && $_POST['neoCMSAcctEmail'] && $_POST['neoCMSAcctUser-orig'] && $_POST['neoCMSAcctEmail-orig']) {
include_once('getpath.php');
$usergets = 'neoCMSUsername=' . urlencode($_SESSION['neoCMSUserid']) . '&neoCMSSess=' . urlencode($_SESSION['neoCMSSess']) . '&neoCMSPath=' . urlencode($path) . '&neoCMSAcctUser=' . urlencode($_POST['neoCMSAcctUser']) . '&neoCMSAcctEmail=' . urlencode($_POST['neoCMSAcctEmail']) . '&neoCMSOrigEmail=' . urlencode($_POST['neoCMSAcctEmail-orig']) . '&neoCMSOrigUser=' . urlencode($_POST['neoCMSAcctUser-orig']);
if ($_POST['neoCMSAcctName']) $usergets .= '&neoCMSAcctName=' . urlencode($_POST['neoCMSAcctName']);
if ($_POST['neoCMSAcctPass'] != '' && $_POST['neoCMSAcctPassConfirm'] != '') $usergets .= '&neoCMSAcctPass=' . urlencode($_POST['neoCMSAcctPass']) . '&neoCMSAcctPassConfirm=' . urlencode($_POST['neoCMSAcctPassConfirm']);
header("Location:$userproxy$usergets");
} elseif ($_POST && $_POST['neoCMSNewAcctUser'] && $_POST['neoCMSNewAcctEmail'] && $_POST['neoCMSNewAcctName'] && $_POST['neoCMSNewAcctPass'] && $_POST['neoCMSNewAcctPassConfirm']) {
include_once('getpath.php');
$usergets = 'neoCMSUsername=' . urlencode($_SESSION['neoCMSUserid']) . '&neoCMSSess=' . urlencode($_SESSION['neoCMSSess']) . '&neoCMSPath=' . urlencode($path) . '&neoCMSNewAcctUser=' . urlencode($_POST['neoCMSNewAcctUser']) . '&neoCMSNewAcctEmail=' . urlencode($_POST['neoCMSNewAcctEmail']) . '&neoCMSNewAcctName=' . urlencode($_POST['neoCMSNewAcctName']) . '&neoCMSNewAcctPass=' . urlencode($_POST['neoCMSNewAcctPass']) . '&neoCMSNewAcctPassConfirm=' . urlencode($_POST['neoCMSNewAcctPassConfirm']);
header("Location:$userproxy$usergets");
} elseif (empty($_GET)) {
include_once('getpath.php');
$usergets = 'neoCMSUsername=' . urlencode($_SESSION['neoCMSUserid']) . '&neoCMSSess=' . urlencode($_SESSION['neoCMSSess']) . '&neoCMSPath=' . urlencode($path);
header("Location:$userproxy$usergets");
} elseif ($_GET && $_GET['neoCMSDelUser']) {
include_once('getpath.php');
$usergets = 'neoCMSUsername=' . urlencode($_SESSION['neoCMSUserid']) . '&neoCMSSess=' . urlencode($_SESSION['neoCMSSess']) . '&neoCMSPath=' . urlencode($path) . '&neoCMSDelUser=' . urlencode($_GET['neoCMSDelUser']);
header("Location:$userproxy$usergets");
} elseif ($_GET && $_GET['neoCMSSess'] == $_SESSION['neoCMSSess']) {
$admin = array();
$users = array();
foreach ($_GET as $key => $val) {
if (strstr($key, '-A')) $admin[str_replace('-A', '', $key)] = $val;
elseif (!strstr($key, 'neoCMSSess') && !strstr($key, 'neoCMSUserMessage')) {
$num = explode('-', $key);
$users[$num[1]][$num[0]] = $val;
}
}
$adminscript = '<script type="text/javascript">window.top.window.adminUser("' . $admin['neoCMSName'] . '", "' . $admin['neoCMSUsername'] . '", "' . $admin['neoCMSEmail'] . '");</script>';
echo $adminscript;
foreach ($users as $user) {
$userscript = '<script type="text/javascript">window.top.window.buildUser("' . $user['neoCMSName'] . '", "' . $user['neoCMSUsername'] . '", "' . $user['neoCMSEmail'] . '", "' . $user['neoCMSId'] . '");</script>';
echo $userscript;
}
if ($_GET['neoCMSUserMessage'] != '0') {
$m = $_GET['neoCMSUserMessage'];
if ($m == '1') $getmessage = "Your account settings were successfully saved.";
elseif ($m == '2') $getmessage = "Your new account has been successfully created.";
elseif ($m == '3') $getmessage = "<strong>Error:</strong> This account has already been created.";
elseif ($m == '4') $getmessage = "Account successfully deleted.";
elseif ($m == '5') $getmessage = "<strong>Error:</strong> There was an error deleting this account.";
else $getmessage = "<strong>Error:</strong> There was an error saving.";
$savescript = '<script type="text/javascript">window.top.window.userBar("' . $getmessage . '");</script>';
echo $savescript;
$_SESSION['neoCMSUserid'] = $admin['neoCMSUsername'];
}
echo '<script type="text/javascript">window.top.window.removeFrames();</script>';
}
}
}
?>
cms/functions/geturi.php
-16
View File
@@ -1,16 +0,0 @@
<?php
function uri()
{
if (!empty($_SERVER['REQUEST_URI'])) return $_SERVER['REQUEST_URI'];
else $uri = $_SERVER['SCRIPT_NAME'];
if (!empty($_SERVER['QUERY_STRING'])) $uri .= '?' . $_SERVER['QUERY_STRING'];
$_SERVER['REQUEST_URI'] = $uri;
return $uri;
}
?>
cms/functions/login.php
-49
View File
@@ -1,49 +0,0 @@
<?php
error_reporting(E_ALL & ~E_NOTICE);
@session_start();
if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSsession')) {
include_once('createsession.php');
$loginproxy = 'https://www.neogate.com/licensing/login-serv.php?';
if ($_POST) {
include_once('getpath.php');
$logingets = 'neoCMSUsername=' . urlencode($_POST['neoCMSUsername']) . '&neoCMSPassword=' . urlencode($_POST['neoCMSPassword']) . '&neoCMSSess=' . urlencode($_SESSION['neoCMSSess']) . '&neoCMSPath=' . urlencode($path);
header("Location:$loginproxy$logingets");
} elseif (isset($_GET['neoCMSUsername']) && isset($_GET['neoCMSSess']) && $_GET['neoCMSSess'] == $_SESSION['neoCMSSess'] && isset($_GET['neoCMSURL']) && isset($_GET['isAdmin'])) {
$_SESSION['neoCMSUserid'] = $_GET['neoCMSUsername'];
$_SESSION['neoCMSUserurl'] = $_GET['neoCMSURL'];
$_SESSION['neoCMSIsadmin'] = $_GET['isAdmin'];
include_once('getsaveprefs.php');
if (isset($_SESSION['neoCMSUserid']) && $_SESSION['neoCMSUserid'] != '') {
$script = '<script type="text/javascript">window.top.window.location="../";</script>';
echo $script;
}
} elseif (isset($_GET['error'])) {
if ($_GET['error'] == 'login') $message = "Incorrect username or password";
elseif ($_GET['error'] == 'domain') $message = "Domain not registered. Please contact.";
$script = '<script type="text/javascript">window.top.window.loginIncorr("' . $message . '");</script>';
echo $script;
}
} else {
$script = '<script type="text/javascript">window.top.window.loginIncorr("There was an error creating a session.");</script>';
echo $script;
}
?>
cms/functions/logout.php
-14
View File
@@ -1,14 +0,0 @@
<?php
error_reporting(E_ALL & ~E_NOTICE);
@session_start();
session_unset($_SESSION);
$_SESSION = array();
session_destroy();
@session_write_close();
exit;
?>
cms/functions/restore.php
-180
View File
@@ -1,180 +0,0 @@
<?php
error_reporting(E_ALL & ~E_NOTICE);
@session_start();
if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSsession')) {
include_once('createsession.php');
if (isset($_SESSION['neoCMSUserid'])) {
include_once('urldissect.php');
include_once('ftpstart.php');
include_once('checkpath.php');
$message = '<strong>Error:</strong> There was an error restoring your page. Please try again.';
if (@file_exists($pageurl)) {
function loadfile($url, $incpath, $inc)
{
global $message, $pagepath;
// read the file
$doc = fopen($url, "r");
$content = stream_get_contents($doc);
fclose($doc);
$reginclude = '/(?:include\b|include_once\b|require\b|require_once\b)(?:\s*\(*[^;\?>]*)(?:\"|\')([^\"\'<>]*)(?:(\"|\')\)*(;|[\s\t\r\n]*\?>))/i'; // php include regexp
if (!preg_match($reginclude, $content)) $reginclude = '/(?:<!--#include\s(?:virtual|file)\=)(?:\"|\')([^\"\'<>]*)(?:\"|\')(?:\s*-->)/i'; // SSI regexp
// read the backup
$pagename = (strstr($url, $_SERVER['DOCUMENT_ROOT'])) ? explode($_SERVER['DOCUMENT_ROOT'], $url) : explode('../../', $url);
$pagename = trim($pagename[1], '/');
$pagename = str_ireplace('/', '-', $pagename);
$pageext = explode('.', $pagename);
$pagename = preg_replace('/(\.php|\.asp|\.html|\.htm|\.phtml|\.shtml|\.cfm)/', '', $pagename);
$backup = dirname(__FILE__) . '/../backups/' . $pagename . '_Bak.' . $pageext[1];
if (@file_exists($backup)) {
$backdoc = fopen($backup, "r");
$backcontent = stream_get_contents($backdoc);
fclose($backdoc);
echo "File Found: $backup\n\n";
editfile($content, $backcontent, $url, $incpath, $inc);
}
if (preg_match($reginclude, $content)) {
preg_match_all($reginclude, $content, $includes);
foreach ($includes[1] as &$value) {
if (@file_exists($_SERVER['DOCUMENT_ROOT'] . $value) && $value != '') {
$incfile = $_SERVER['DOCUMENT_ROOT'] . $value;
$incpath = false;
} elseif (!stristr($value, 'http://')) {
$incfile = "$pagepath/$value";
if ($incpath) {
$incpathreg = preg_replace('/\//', '\/', $incpath);
$incpathreg = '/(^' . $incpathreg . '\/|\/' . $incpathreg . '\/)/';
$incorigpath = preg_replace($incpathreg, '', $value, 1);
$newinc = "$pagepath/$incpath/$incorigpath";
$incfile = (@file_exists($newinc)) ? $newinc : $incfile;
$incpatharr = explode('/', $incorigpath);
array_pop($incpatharr);
$incpath = (sizeof($incpatharr) > 0) ? $incpath . implode('/', $incpatharr) : false;
} else {
$incpatharr = explode('/', $value);
array_pop($incpatharr);
$incpath = (sizeof($incpatharr) > 0) ? $incpath . implode('/', $incpatharr) : false;
}
} else $incpath = false;
if (!preg_match('/\/$/', $incfile)) loadfile($incfile, $incpath, true);
}
}
}
function editfile($content, $backcontent, $url, $incpath, $inc)
{
global $ftpconn, $ftpwd;
if ($content != $backcontent && ((!stristr($content, '<?php') && !strstr($content, '<%')) || (preg_match('/>[^<]+</', $backcontent) || preg_match('/<html/', $backcontent)) && strstr($backcontent, 'neocms'))) {
if ($ftpconn) {
$restdoc = tmpfile();
if (!$restdoc) {
$restdocp = tempnam(dirname(__FILE__) . '/../settings/tmp', 'Rest');
chmod($restdocp, 0777);
$restdoc = fopen($restdocp, 'w+');
}
fwrite($restdoc, $backcontent);
rewind($restdoc);
if (strstr($url, $_SERVER['DOCUMENT_ROOT'])) {
$nfkey = explode($_SERVER['DOCUMENT_ROOT'], $url);
$nfkey = $nfkey[1];
if ($inc) $remotefile = $ftpwd . $nfkey;
else {
$path = urldissect($_SERVER['SCRIPT_NAME'], false, 3);
$filename = explode('../../', $url);
$filename = "$filename[1]";
$remotefile = $ftpwd . $path . $filename;
}
} else {
$path = urldissect($_SERVER['SCRIPT_NAME'], false, 3);
$filename = explode('../../', $url);
$filename = "$filename[1]";
$remotefile = $ftpwd . $path . $filename;
}
if (ftp_fput($ftpconn, $remotefile, $restdoc, FTP_BINARY)) echo "Uploaded: $remotefile\n\n";
else $message = '<strong>Error:</strong> neocms could not find this page: <em>' . $remotefile . '</em>';
fclose($restdoc);
if (isset($restdocp)) unlink($restdocp);
} elseif (is_writable($url)) {
//restores file
$restdoc = fopen($url, "w");
fputs($restdoc, $backcontent);
fclose($restdoc);
} else $message = "<strong>Error:</strong> You do not have permission to edit this page.";
}
}
loadfile($pageurl, false, false);
$message = 'Your page was successfully restored.';
$script = '<script language="javascript" type="text/javascript">window.top.window.ifrReload();window.top.window.saveFeedback("' . $message . '");</script>';
echo $script;
} else {
$message = '<strong>Error:</strong> neocms could not find this page: <em>' . $url . '</em>';
$script = '<script language="javascript" type="text/javascript">window.top.window.saveFeedback("' . $message . '");</script>';
echo $script;
}
if ($ftpconn) ftp_close($ftpconn);
}
}
?>
cms/functions/save.php
-525
View File
@@ -1,525 +0,0 @@
<?php
error_reporting(E_ALL & ~E_NOTICE);
@session_start();
include_once('createsession.php');
if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSsession')) {
if (isset($_SESSION['neoCMSUserid'])) {
include_once('urldissect.php');
include_once('ftpstart.php');
include_once('checkpath.php');
$message = 'Your page was successfully published.';
$encode = 'utf-8';
$doctype = 'xhtml';
$includes = $conArr = $filecon = array();
$edit = array();
$eles = array();
$inc = 0;
$count = 0;
if ($_POST) {
// begin functions
include_once('cleaner.php');
function cleanpost()
{
global $edit;
foreach ($_POST as $key => $post) {
$post = thecleaner($post);
if (preg_match("/^edit/", $key)) $edit[$key] = $post;
}
}
function loadfile($url, $incpath, $f)
{
global $message, $includes, $pagepath, $ftpconn, $ftpwd, $doctype, $encode, $edit;
$ssi = false;
$pagename = (strstr($url, $_SERVER['DOCUMENT_ROOT'])) ? explode($_SERVER['DOCUMENT_ROOT'], $url) : explode('../../', $url);
$pagename = trim($pagename[1], '/');
$pagename = str_ireplace('/', '-', $pagename);
$pagefile = $pagename;
if (@file_exists($url)) {
// read the file
$doc = fopen($url, "r");
$content = stream_get_contents($doc);
fclose($doc);
if ((!stristr($content, '<?php') && !strstr($content, '<%')) || ((preg_match('/>[^<]+</', $content) || preg_match('/<html/', $content)) && strstr($content, 'neocms'))) {
if (preg_match('/<!DOCTYPE[^>]*>/', $content)) {
preg_match_all('/<!DOCTYPE[^>]*>/', $content, $dtarr);
$doctype = $dtarr[0][0];
}
if (preg_match('/(?:<meta[^>]*charset=\"*)([^\"<]+)/', $stuff)) {
preg_match_all($charreg, $stuff, $enc);
$encode = $enc[1][0];
}
if ($f) cleanpost();
$elereg = '/<[^>]*class=(?:\"|\'|)[^>]*(\bneocms\b|\bneocmsRepeatArea\b)[^>]*?(?:\"|\'|)[^>]*>/';
$reginclude = '/(?:include\b|include_once\b|require\b|require_once\b)(?:\s*\(*[^;\?>]*)(?:\"|\')([^\"\'<>]*)(?:(\"|\')\)*(;|[\s\t\r\n]*\?>))/i'; // php include regexp
if (!preg_match($reginclude, $content)) $reginclude = '/(?:<!--#include\s(?:virtual|file)\=)(?:\"|\')([^\"\'<>]*)(?:\"|\')(?:\s*-->)/i'; // SSI regexp
// create a backup
$pageext = explode('.', $pagename);
$pagename = preg_replace('/(\.php|\.asp|\.html|\.htm|\.phtml|\.shtml|\.cfm)/', '', $pagename);
$backup = dirname(__FILE__) . '/../backups/' . $pagename . '_Bak.' . $pageext[1];
if ($ftpconn) {
$backdoc = tmpfile();
if (!$backdoc) {
$backdocp = tempnam(dirname(__FILE__) . '/../settings/tmp', 'Back');
chmod($backdocp, 0777);
$backdoc = fopen($backdocp, 'w+');
}
fwrite($backdoc, $content);
rewind($backdoc);
$path = urldissect($_SERVER['SCRIPT_NAME'], false, 2);
$remotefile = $ftpwd . $path . 'backups/' . $pagename . '_Bak.' . $pageext[1];
echo "Backup File: $remotefile\n\n";
if (ftp_fput($ftpconn, $remotefile, $backdoc, FTP_BINARY)) echo "Uploaded Backup: $remotefile!\n\n";
else $message = '<strong>Error:</strong> neocms failed creating backup for: <em>' . $remotefile . '</em>';
fclose($backdoc);
if (isset($backdocp)) unlink($backdocp);
} elseif (is_writable($url)) {
$backdoc = fopen($backup, "w+");
fwrite($backdoc, $content);
fclose($backdoc);
} else $message = '<strong>Error:</strong> You do not have permission to edit this page: <em>' . $pagefile . "</em>. Try <a href='settings/ftpinfo.php' title='Enter your FTP info'>saving your FTP info here</a>.";
// clean up content
if (preg_match($reginclude, $content)) {
preg_match_all($reginclude, $content, $includes[$url]);
$incArr = preg_split($reginclude, $content);
$incfiles = $includes[$url][1];
$neoCon = array();
foreach ($incArr as $k => $v) {
$docroot = $_SERVER['DOCUMENT_ROOT'];
if (@file_exists($docroot . $incfiles[$k]) && $incfiles[$k] != '') {
$neoCon[$k] = $v;
$incfile = $docroot . $incfiles[$k];
$incpath = false;
} elseif (!stristr($incfiles[$k], 'http://')) {
$neoCon[$k] = $v;
$incfile = "$pagepath/$incfiles[$k]";
if ($incpath) {
$incpathreg = str_replace('/', '\/', $incpath);
$incpathreg = '/(^' . $incpathreg . '\/|\/' . $incpathreg . '\/)/';
$incorigpath = preg_replace($incpathreg, '', $incfiles[$k], 1);
$newinc = "$pagepath/$incpath/$incorigpath";
$incfile = (@file_exists($newinc)) ? $newinc : $incfile;
$incpatharr = explode('/', $incorigpath);
array_pop($incpatharr);
$incpath = (sizeof($incpatharr) > 0) ? $incpath . implode('/', $incpatharr) : false;
} else {
$incpatharr = explode('/', $incfiles[$k]);
array_pop($incpatharr);
$incpath = (sizeof($incpatharr) > 0) ? $incpath . implode('/', $incpatharr) : false;
}
} else $incpath = false;
if (!preg_match('/\/$/', $incfile)) $neoCon[$incfile] = loadfile($incfile, $incpath, false);
}
return $neoCon;
} else return $content;
}
} else return false;
}
function output()
{
global $message;
$script = '<script language="javascript" type="text/javascript">window.top.window.saveFeedback("' . $message . '");</script>';
echo $script;
}
function conArray($content)
{
$conArray = false;
foreach ($content as $con) {
if (is_array($con)) $conArray = true;
}
return conArray;
}
function makeEdits($conpost)
{
global $edit, $eles, $inc, $count;
$commreg = '/<!--(.|\n|\r)*?-->/';
preg_match_all($commreg, $conpost, $comments);
$conpost = preg_replace($commreg, '<!--!COMMENT!-->', $conpost);
$elereg = '/<[^>]*class\s*=\s*(?:\"|\'|)[^\"|\']*(\bneocms\b|\bneocmsRepeatArea\b)[^\"|\'|=]*?(?:\"|\'|)[^>]*>/';
preg_match_all($elereg, $conpost, $neocmseles);
if ($neocmseles[0]) {
$newsplice = '';
foreach ($neocmseles[0] as $neocmsele) {
$splice = explode($neocmsele, $conpost, 2);
$newsplice = $splice[0];
$post = $splice[1];
$rest = '';
preg_match_all("/^<([^>\s]*)\b/i", $neocmsele, $eleTag);
$eleTag = $eleTag[1][0];
if (stristr($eleTag, 'img')) {
if (isset($edit["editImg$count"])) {
$editStr = array();
$editIncom = $edit["editImg$count"];
$editIncom = explode(',', $editIncom);
foreach ($editIncom as $eikey => $eipost) {
$eipost = explode('::', $eipost);
$editStr[$eipost[0]] = $eipost[1];
}
$editContent = '';
if (isset($editStr['link']) && $editStr['link'] != '') {
if (preg_match('/(<a[^>]*>)$/', $newsplice)) {
preg_match_all('/(<a[^>]*href=(?:\"|\'))([^\"\s]*)((?:\"|\')[^>]*>)$/', $newsplice, $lastlink);
$newlink = $lastlink[1][0] . $editStr['link'];
if ($editStr['rel'] != '') $newlink .= '" rel="' . $editStr['rel'];
$newlink .= $lastlink[3][0];
$newsplice = preg_replace('/(<a[^>]*>)$/', "$newlink", $newsplice);
} else {
$newsplice .= '<a href="' . $editStr['link'] . '"';
if ($editStr['rel'] != '') $newsplice .= ' rel="' . $editStr['rel'] . '"';
$newsplice .= '>';
$post = '</a>' . $post;
}
} else {
if (preg_match('/(<a[^>]*>)$/', $newsplice)) $newsplice = preg_replace('/(<a[^>]*>)$/', '', $newsplice);
if (preg_match('/^(<\/a>)/', $post)) $post = preg_replace('/^(<\/a>)/', '', $post);
}
$editContent .= '<img src="' . $editStr['src'] . '" alt="' . $editStr['alt'] . '"';
if ($editStr['class'] != '') $editContent .= ' class="' . $editStr['class'] . '"';
if ($editStr['width'] != '') $editContent .= ' width="' . $editStr['width'] . '"';
if ($editStr['height'] != '') $editContent .= ' height="' . $editStr['height'] . '"';
$editContent .= '/>';
} else $editContent = '';
$post = $editContent . $post;
} else {
$eleTagReg = '/<\/*' . $eleTag . '[^>]*>/i';
preg_match_all($eleTagReg, $post, $tags);
$contents = preg_split($eleTagReg, $post);
$track = 1;
foreach ($tags[0] as $tag) {
if (strpos($tag, '</') === 0) $track--;
else $track++;
array_shift($contents);
if ($track == 0) break;
else array_shift($tags[0]);
}
if (sizeof($tags[0]) > 1) {
foreach ($tags[0] as $tag) {
if (isset($edit["editVid$count"])) $rest .= $contents[0];
else $rest .= $tag . $contents[0];
array_shift($contents);
}
} else {
if (isset($edit["editVid$count"])) $rest = $contents[0];
else $rest = $tags[0][0] . $contents[0];
}
}
$neocmsele = preg_replace('/neocms\b|neocmsRepeatArea\b/', '$0--D0n3--', $neocmsele);
if (isset($edit["edit$count"])) $newsplice .= $neocmsele . "\n" . $edit["edit$count"] . "\n" . $rest;
elseif (isset($edit["editImg$count"]) && stristr($eleTag, 'img')) $newsplice .= $post;
elseif (isset($edit["editVid$count"]) && (stristr($eleTag, 'embed') || stristr($eleTag, 'object'))) $newsplice .= "\n" . $edit["editVid$count"] . "\n" . $rest;
elseif (sizeof($splice) <= 1) $newsplice .= $post;
else $newsplice .= $neocmsele . $post;
$conpost = $newsplice;
$count++;
$rest = '';
}
$newsplice = preg_replace('/--D0n3--/', '', $newsplice);
} else $newsplice = $conpost;
foreach ($comments[0] as $com) {
$newsplice = preg_replace('/<!--!COMMENT!-->/', $com, $newsplice, 1);
}
return $newsplice;
}
function editFile($content, $url)
{
global $message, $includes, $edit, $inc;
$fileedits = array();
if (is_array($content)) {
foreach ($content as $conkey => $conpost) {
if (is_array($conpost)) $content[$conkey] = editFile($conpost, $conkey);
else $content[$conkey] = makeEdits($conpost);
}
foreach ($content as $ckey => $cpost) {
if (preg_match('/^(\d+)$/', $ckey)) {
if (isset($includes[$url][0][$inc])) $fileedits[$url] .= $cpost . $includes[$url][0][$inc];
else $fileedits[$url] .= $cpost;
$inc++;
} else $fileedits["$ckey"] = $cpost;
}
} else $fileedits[$url] = makeEdits($content);
$inc = 0;
return $fileedits;
}
function cleanFilecon($files)
{
global $filecon;
foreach ($files as $fkey => $fpost) {
if (is_array($fpost)) cleanFilecon($fpost);
else {
if (!$filecon[$fkey]) $filecon[$fkey] = $fpost;
}
}
}
function flatten($ar)
{
$toflat = array($ar);
$res = array();
while (($r = array_shift($toflat)) !== NULL) {
foreach ($r as $v) {
if (is_array($v)) {
$toflat[] = $v;
} else {
$res[] = $v;
}
}
}
return $res;
}
$conArr = loadfile($pageurl, false, true);
if (is_array($conArr)) {
$missing = array_search(false, $conArr);
if ($conArr[$missing] == '') $missing = false;
} elseif ($conArr) $missing = false;
if ($missing === false) {
cleanFilecon(editFile($conArr, $pageurl));
if (preg_match('/successfully/', $message)) {
foreach ($filecon as $fkey => $fpost) {
if ($fpost != '') {
if (@file_exists($fkey)) {
if ($ftpconn) {
$doc = tmpfile();
if (!$doc) {
$docp = tempnam(dirname(__FILE__) . '/../settings/tmp', 'Doc');
chmod($docp, 0777);
$doc = fopen($docp, 'w+');
}
$remotefile = '';
fwrite($doc, $fpost);
rewind($doc);
$incs = flatten($includes);
if (strstr($fkey, $_SERVER['DOCUMENT_ROOT'])) {
$nfkey = explode($_SERVER['DOCUMENT_ROOT'], $fkey);
$nfkey = $nfkey[1];
if (in_array($nfkey, $incs)) $remotefile = $ftpwd . $nfkey;
else {
$path = urldissect($_SERVER['SCRIPT_NAME'], false, 3);
$fkey = explode('../../', $fkey, 2);
$remotefile = $ftpwd . $path . $fkey[1];
}
} else {
$path = urldissect($_SERVER['SCRIPT_NAME'], false, 3);
$fkey = explode('../../', $fkey, 2);
$remotefile = $ftpwd . $path . $fkey[1];
}
if (ftp_fput($ftpconn, $remotefile, $doc, FTP_BINARY)) echo "Uploaded: $remotefile!\n\n";
else $message = '<strong>Error:</strong> neocms publish this page: <em>' . $remotefile . '</em>';
fclose($doc);
if (isset($docp)) unlink($docp);
} elseif (is_writable($fkey)) {
$doc = fopen($fkey, "w");
fwrite($doc, $fpost);
fclose($doc);
} else $message = "<strong>Error:</strong> You do not have permission to edit this page.";
} else $message = '<strong>Error:</strong> neocms is unable find this page.';
}
}
}
} else $message = '<strong>Error:</strong> neocms is unable find this page: <em>' . $missing . '</em>';
output();
} else output();
if ($ftpconn) ftp_close($ftpconn);
}
} else {
$message = '<strong>Error:</strong> neocms is unable find your session.';
output();
}
?>
cms/functions/upload.php
-120
View File
@@ -1,120 +0,0 @@
<?php
//error_reporting (E_ALL & ~E_NOTICE);
@session_start();
if (isset($_SESSION['neoCMSSess']) && strstr($_SESSION['neoCMSSess'], 'neoCMSsession')) {
include_once('urldissect.php');
include_once('ftpstart.php');
include_once('createsession.php');
if (!empty($_POST) && isset($_SESSION['neoCMSUserid'])) {
if ($_GET['type'] == 'img') {
$file = $_FILES['neoCMSImgUpload'];
$uploaddir = ($_POST['neoCMSImgFolder']) ? '../..' . $_POST['neoCMSImgFolder'] : '../../';
$uploaddir = ($_SESSION['neoCMSImagePath']) ? '../../' . $_SESSION['neoCMSImagePath'] : $uploaddir;
$uploadfile = $uploaddir . basename($file['name']);
if (!@file_exists($uploadfile) || $_GET['over']) {
$fileName = $file['name'];
$fileSize = $file['size'];
$alert = "<strong>Error:</strong> There was an error uploading your image. Please try again.";
list($fileWidth, $fileHeight) = getimagesize($file['tmp_name']);
if (preg_match('/(.jpg|.png|.gif)$/i', $fileName) && $fileSize < 5000000) {
if (move_uploaded_file($file['tmp_name'], $uploadfile)) {
$alert = "Your file was successfully uploaded.";
} elseif ($ftpconn) {
$path = urldissect($_SERVER['SCRIPT_NAME'], false, 3);
$uploadfile = str_ireplace('../../', '', $uploadfile);
$remotefile = $ftpwd . $path . $uploadfile;
$tempfile = fopen($file['tmp_name'], 'r');
if (ftp_fput($ftpconn, $remotefile, $tempfile, FTP_BINARY)) $alert = "Your file was successfully uploaded.";
}
} else {
$alert = "<strong>Error:</strong> You may only upload <strong>.jpg</strong>, <strong>.gif</strong>, or <strong>.png</strong> image files, under <strong>5.0 MB</strong> in size.";
$fileName = "";
}
$script = '<script language="javascript" type="text/javascript">window.top.window.imageInfo("' . $fileSize . '", "' . $fileWidth . '", "' . $fileHeight . '", "' . $alert . '", "' . $fileName . '", "' . str_replace('../../', '', $uploaddir) . '" );</script>';
echo $script;
} else {
$script = '<script language="javascript" type="text/javascript">window.top.window.imageOverwritePrompt();</script>';
echo $script;
}
} else {
$file = $_FILES['neoCMSUpload'];
$uploaddir = ($_POST['neoCMSFolder']) ? '../..' . $_POST['neoCMSFolder'] : '../../';
$uploaddir = ($_SESSION['neoCMSFilePath']) ? '../../' . $_SESSION['neoCMSFilePath'] : $uploaddir;
$uploadfile = $uploaddir . basename($file['name']);
if (!@file_exists($uploadfile) || $_GET['over']) {
$fileName = $file['name'];
$fileSize = $file['size'];
$alert = "<strong>Error:</strong> There was an error uploading your image. Please try again.";
if (!preg_match('/(\.html|\.php|\.js|\.css|\.htm|\.shtml|\.asp|\.cfm|\.phtml)$/i', $fileName) && $fileSize < 100000000) {
if ($ftpconn) {
$path = urldissect($_SERVER['SCRIPT_NAME'], false, 3);
$uploadfile = str_ireplace('../../', '', $uploadfile);
$remotefile = $ftpwd . $path . $uploadfile;
$tempfile = fopen($file['tmp_name'], 'r');
if (ftp_fput($ftpconn, $remotefile, $tempfile, FTP_BINARY)) $alert = "Your file was successfully uploaded.";
else {
$alert = "<strong>Error:</strong> You do not have permission to upload files to this folder.";
$script = '<script language="javascript" type="text/javascript">window.top.window.fileInfo("", "' . $alert . '", "", "" );</script>';
echo $script;
}
} elseif (move_uploaded_file($file['tmp_name'], $uploadfile)) {
$alert = "Your file was successfully uploaded.";
} else {
$alert = "<strong>Error:</strong> You do not have permission to upload files to this folder.";
$fileName = "";
}
} else {
$alert = "<strong>Error:</strong> You may not upload <strong>.html</strong>, <strong>.htm</strong>, <strong>.php</strong>, <strong>.js</strong>, or <strong>.css</strong> files, under <strong>100 MB</strong> in size.";
$fileName = "";
}
$script = '<script language="javascript" type="text/javascript">window.top.window.fileInfo("' . $fileSize . '", "' . $alert . '", "' . $fileName . '", "' . str_replace('../../', '', $uploaddir) . '" );</script>';
echo $script;
} else {
$script = '<script language="javascript" type="text/javascript">window.top.window.filePrompt();</script>';
echo $script;
}
}
if ($ftpconn) ftp_close($ftpconn);
}
}
?>
cms/functions/urldissect.php
-21
View File
@@ -1,21 +0,0 @@
<?php
function urldissect($url, $file, $negoff)
{
$scr = $_SERVER['SCRIPT_NAME'];
$url = explode('/', $url);
if ($file) return array_pop($url);
elseif ($negoff) {
$i = 0;
while ($i < $negoff) {
array_pop($url);
$i++;
}
}
return implode('/', $url) . '/';
}
?>