Changeset 2490:a7398fa0bfeb for inc/admin

Timestamp:

10/25/13 00:53:21 (12 years ago)

Author:

Denis Jean-Chirstian <contact@…>

Branch:

2.6

Message:

Fix user perms on plugins and themes list. (plugins that use list behaviors must check their own rights), fixes #1815

File:

• inc/admin/lib.moduleslist.php (modified) (21 diffs)

inc/admin/lib.moduleslist.php

@@ -795 +795 @@
 
                     # Deactivate
-                    case 'activate': if ($module['root_writable']) {
+                    case 'activate': if ($this->core->auth->isSuperAdmin() && $module['root_writable']) {
                          $submits[] =
                          '<input type="submit" name="activate['.html::escapeHTML($id).']" value="'.__('Activate').'" />';
@@ -801 +801 @@
 
                     # Activate
-                    case 'deactivate': if ($module['root_writable']) {
+                    case 'deactivate': if ($this->core->auth->isSuperAdmin() && $module['root_writable']) {
                          $submits[] =
                          '<input type="submit" name="deactivate['.html::escapeHTML($id).']" value="'.__('Deactivate').'" class="reset" />';
@@ -807 +807 @@
 
                     # Delete
-                    case 'delete': if ($this->isDeletablePath($module['root'])) {
+                    case 'delete': if ($this->core->auth->isSuperAdmin() && $this->isDeletablePath($module['root'])) {
                          $dev = !preg_match('!^'.$this->path_pattern.'!', $module['root']) && defined('DC_DEV') && DC_DEV ? ' debug' : '';
                          $submits[] =
@@ -814 +814 @@
 
                     # Install (from store)
-                    case 'install': if ($this->path_writable) {
+                    case 'install': if ($this->core->auth->isSuperAdmin() && $this->path_writable) {
                          $submits[] =
                          '<input type="submit" name="install['.html::escapeHTML($id).']" value="'.__('Install').'" />';
@@ -820 +820 @@
 
                     # Update (from store)
-                    case 'update': if ($this->path_writable) {
+                    case 'update': if ($this->core->auth->isSuperAdmin() && $this->path_writable) {
                          $submits[] =
                          '<input type="submit" name="update['.html::escapeHTML($id).']" value="'.__('Update').'" />';
@@ -857 +857 @@
 
                     # Deactivate
-                    case 'activate': if ($this->path_writable) {
+                    case 'activate': if ($this->core->auth->isSuperAdmin() && $this->path_writable) {
                          $submits[] =
                          '<input type="submit" name="activate" value="'.($with_selection ?
@@ -866 +866 @@
 
                     # Activate
-                    case 'deactivate': if ($this->path_writable) {
+                    case 'deactivate': if ($this->core->auth->isSuperAdmin() && $this->path_writable) {
                          $submits[] =
                          '<input type="submit" name="deactivate" value="'.($with_selection ?
@@ -875 +875 @@
 
                     # Update (from store)
-                    case 'update': if ($this->path_writable) {
+                    case 'update': if ($this->core->auth->isSuperAdmin() && $this->path_writable) {
                          $submits[] =
                          '<input type="submit" name="update" value="'.($with_selection ?
@@ -909 +909 @@
      {
           if (empty($_POST) || !empty($_REQUEST['conf'])
-          || !$this->core->auth->isSuperAdmin() || !$this->isWritablePath()) {
+          || !$this->isWritablePath()) {
                return null;
           }
@@ -915 +915 @@
           $modules = !empty($_POST['modules']) && is_array($_POST['modules']) ? array_values($_POST['modules']) : array();
 
-          if (!empty($_POST['delete'])) {
+          if ($this->core->auth->isSuperAdmin() && !empty($_POST['delete'])) {
 
                if (is_array($_POST['delete'])) {
@@ -970 +970 @@
           }
 
-          elseif (!empty($_POST['install'])) {
+          elseif ($this->core->auth->isSuperAdmin() && !empty($_POST['install'])) {
 
                if (is_array($_POST['install'])) {
@@ -1008 +1008 @@
           }
 
-          elseif (!empty($_POST['activate'])) {
+          elseif ($this->core->auth->isSuperAdmin() && !empty($_POST['activate'])) {
 
                if (is_array($_POST['activate'])) {
@@ -1043 +1043 @@
           }
 
-          elseif (!empty($_POST['deactivate'])) {
+          elseif ($this->core->auth->isSuperAdmin() && !empty($_POST['deactivate'])) {
 
                if (is_array($_POST['deactivate'])) {
@@ -1091 +1091 @@
           }
 
-          elseif (!empty($_POST['update'])) {
+          elseif ($this->core->auth->isSuperAdmin() && !empty($_POST['update'])) {
 
                if (is_array($_POST['update'])) {
@@ -1633 +1633 @@
 
                     # Update (from store)
-                    case 'update': if ($this->path_writable) {
+                    case 'update': if ($this->core->auth->isSuperAdmin() && $this->path_writable) {
                          $submits[] =
                          '<input type="submit" name="update" value="'.($with_selection ?
@@ -1659 +1659 @@
      public function doActions()
      {
-          if (empty($_POST) || !empty($_REQUEST['conf'])
-          || !$this->core->auth->isSuperAdmin() || !$this->isWritablePath()) {
+          if (empty($_POST) || !empty($_REQUEST['conf']) || !$this->isWritablePath()) {
                return null;
           }
@@ -1686 +1685 @@
           }
 
-          elseif (!empty($_POST['activate'])) {
+          elseif ($this->core->auth->isSuperAdmin() && !empty($_POST['activate'])) {
 
                if (is_array($_POST['activate'])) {
@@ -1721 +1720 @@
           }
 
-          elseif (!empty($_POST['deactivate'])) {
+          elseif ($this->core->auth->isSuperAdmin() && !empty($_POST['deactivate'])) {
 
                if (is_array($_POST['deactivate'])) {
@@ -1769 +1768 @@
           }
 
-          elseif (!empty($_POST['delete'])) {
+          elseif ($this->core->auth->isSuperAdmin() && !empty($_POST['delete'])) {
 
                if (is_array($_POST['delete'])) {
@@ -1824 +1823 @@
           }
 
-          elseif (!empty($_POST['install'])) {
+          elseif ($this->core->auth->isSuperAdmin() && !empty($_POST['install'])) {
 
                if (is_array($_POST['install'])) {
@@ -1862 +1861 @@
           }
 
-          elseif (!empty($_POST['update'])) {
+          elseif ($this->core->auth->isSuperAdmin() && !empty($_POST['update'])) {
 
                if (is_array($_POST['update'])) {