Changeset 415 for trunk/lib/PEdit.inc.php

Timestamp:

Jul 1, 2013 7:45:33 PM (11 years ago)

Author:

anonymous

Message:

Disabled MX record check for email validation. Updated PEdit to work better with AcceptPathInfo? enabled.

File:

• trunk/lib/PEdit.inc.php (modified) (3 diffs)

trunk/lib/PEdit.inc.php

@@ -168 +168 @@
         
         // The location of the data file. (i.e.: "COMMON_DIR/html/_pedit_data/news/index.xml")
-        $this->_data_file = sprintf('%s%s.xml', $this->getParam('data_dir'), $_SERVER['PHP_SELF']);
+        $this->_data_file = sprintf('%s%s.xml', $this->getParam('data_dir'), $_SERVER['SCRIPT_NAME']);
+        
+        // Make certain the evaluated path matches the assumed path (realpath will expand /../../); 
+        // if realpath returns FALSE we're not concerned because it means the file doesn't exist (_initializeDataFile() will create it).
+        if (false !== realpath($this->_data_file) && $this->_data_file !== realpath($this->_data_file)) {
+            $app->logMsg(sprintf('PEdit data file not a real path: %s', $this->_data_file), LOG_CRIT, __FILE__, __LINE__);
+            trigger_error(sprintf('PEdit data file not a real path: %s', $this->_data_file), E_USER_ERROR);
+        }
 
         // op is used throughout the script to determine state.
@@ -559 +566 @@
         // Ensure requested filename is within the pedit data dir.
         if (mb_strpos($filename, $this->getParam('data_dir')) === false) {
-            $app->logMsg(sprintf('Failed writing file outside pedit _data_dir: %s', $filename), LOG_ERR, __FILE__, __LINE__);
+            $app->logMsg(sprintf('Failed writing file outside pedit data_dir: %s', $filename), LOG_ERR, __FILE__, __LINE__);
             return false;
         }
@@ -565 +572 @@
         // Recursively create directories.
         $subdirs = preg_split('!/!', str_replace($this->getParam('data_dir'), '', dirname($filename)), -1, PREG_SPLIT_NO_EMPTY);
-        // Start with the pedit _data_dir base.
+        // Start with the pedit data_dir base.
         $curr_path = $this->getParam('data_dir');
         while (!empty($subdirs)) {