tinycm rev 93

Security improvment in cloud and community plugin
author Christophe Lincoln <pankso@slitaz.org>
date Fri Feb 17 13:06:47 2017 +0100 (2017-02-17)
parents 7edde907440f
children 5b8fd5ab20b7
files plugins/cloud/cloud.cgi plugins/community/community.cgi
line diff
     1.1 --- a/plugins/cloud/cloud.cgi	Fri Feb 17 12:44:05 2017 +0100
     1.2 +++ b/plugins/cloud/cloud.cgi	Fri Feb 17 13:06:47 2017 +0100
     1.3 @@ -50,13 +50,25 @@
     1.4  		d="Cloud activity"
     1.5  		[ ! check_auth ] && header "Location: $script"
     1.6  		# Clean-up logfile
     1.7 -		if [ "$(GET clean)" ]; then
     1.8 +		if [ "$(GET clean)" ] && admin_user; then
     1.9  			rm -f ${cloudlog} && touch ${cloudlog}
    1.10  			header "Location: $HTTP_REFERER"
    1.11  		fi
    1.12  		header
    1.13  		html_header
    1.14  		user_box
    1.15 +		cat << EOT
    1.16 +<div id="tools">
    1.17 +	<a href="$script?dashboard">Dashboard</a>
    1.18 +	<a href="$script?cloud">Cloud files</a>
    1.19 +	<a href="$script?cloudlog&amp;full">$(gettext "More activity")</a>
    1.20 +EOT
    1.21 +		if admin_user; then
    1.22 +			cat << EOT
    1.23 +<a href="$script?cloudlog&amp;clean">$(gettext "Clean logfile")</a>"
    1.24 +EOT
    1.25 +		fi
    1.26 +		echo "</div>"
    1.27  		echo "<h2>$(gettext "Cloud activity")</h2>"
    1.28  		echo '<pre>'
    1.29  		if [ "$(GET full)" ]; then
    1.30 @@ -65,13 +77,6 @@
    1.31  			tac ${cloudlog} | head -n 20
    1.32  		fi
    1.33  		echo '</pre>'
    1.34 -		cat << EOT
    1.35 -<div id="tools">
    1.36 -	<a href="$script?cloud">Cloud files</a>
    1.37 -	<a href="$script?cloudlog&amp;full">$(gettext "More activity")</a>
    1.38 -	<a href="$script?cloudlog&amp;clean">$(gettext "Clean logfile")</a>
    1.39 -</div>
    1.40 -EOT
    1.41  		html_footer && exit 0 ;;
    1.42  		
    1.43  	*\ cloud\ *)
    1.44 @@ -90,9 +95,9 @@
    1.45  		[ -f "$cloudlog" ] || mkdir -p $(dirname $cloudlog)
    1.46  		cat << EOT
    1.47  <div id="tools">
    1.48 +	<a href="$script?dashboard">Dashboard</a>
    1.49  	<a href="$script?cloudlog">Cloud activity</a>
    1.50  	<a href="$content/cloud">Raw files</a>
    1.51 -	<a href="$script?dashboard">Dashboard</a>
    1.52  </div>
    1.53  
    1.54  <h2>Cloud files</h2>
     2.1 --- a/plugins/community/community.cgi	Fri Feb 17 12:44:05 2017 +0100
     2.2 +++ b/plugins/community/community.cgi	Fri Feb 17 13:06:47 2017 +0100
     2.3 @@ -78,18 +78,23 @@
     2.4  			cat ${wall}/${m} | wiki_parser
     2.5  			echo "</p></div>"
     2.6  		done
     2.7 -		cat << EOT
     2.8 +		if check_auth; then
     2.9 +			cat << EOT
    2.10  <div id="tools">
    2.11  	<a href="$script?community">$(gettext "Community Tools")</a>
    2.12  </div>
    2.13  EOT
    2.14 +		fi
    2.15  		html_footer && exit 0 ;;
    2.16  	
    2.17 -	*\ community-config\ *)
    2.18 +	*\ communityconfig\ *)
    2.19  		d="Community plugin config"
    2.20  		header
    2.21  		html_header
    2.22  		user_box
    2.23 +		if ! admin_user; then
    2.24 +			header "Location: $script"
    2.25 +		fi
    2.26  		cat << EOT
    2.27  <div id="tools">
    2.28  	<a href="$script?dashboard">Dashboard</a>
    2.29 @@ -109,11 +114,15 @@
    2.30  		header
    2.31  		html_header
    2.32  		user_box
    2.33 +		echo '<div id="tools">'
    2.34 +		if check_auth; then
    2.35 +			echo "<a href='$script?dashboard'>Dashboard</a>"
    2.36 +		fi
    2.37 +		if admin_user; then
    2.38 +			echo "<a href='$script?communityconfig'>Plugin Config</a>"
    2.39 +		fi
    2.40  		cat << EOT
    2.41 -<div id="tools">
    2.42 -	<a href="$script?dashboard">Dashboard</a>
    2.43 -	<a href="$script?wall">Community Wall</a>
    2.44 -	<a href="$script?community-config">Plugin Config</a>
    2.45 +<a href="$script?wall">Community Wall</a>
    2.46  </div>
    2.47  <h2>$d</h2>
    2.48  <p>$SHORT_DESC</p>