aboutsummaryrefslogtreecommitdiffstats
path: root/admin
diff options
context:
space:
mode:
Diffstat (limited to 'admin')
-rw-r--r--admin/include/functions_plugins.inc.php21
-rw-r--r--admin/plugin.php20
2 files changed, 30 insertions, 11 deletions
diff --git a/admin/include/functions_plugins.inc.php b/admin/include/functions_plugins.inc.php
index f5b43a6af..80027b6e2 100644
--- a/admin/include/functions_plugins.inc.php
+++ b/admin/include/functions_plugins.inc.php
@@ -70,13 +70,24 @@ function get_fs_plugins()
/**
* Retrieves an url for a plugin page.
- * @param string plugin_id
- * @param string page - the php script file name (without .php extension)
+ * @param string file - php script full name
*/
-function get_admin_plugin_menu_link($plugin_id, $page)
+function get_admin_plugin_menu_link($file)
{
- $url = get_root_url().'admin.php?page=plugin&section='
- .urlencode($plugin_id .'~'. $page);
+ global $page;
+ $real_file = realpath($file);
+ $url = get_root_url().'admin.php?page=plugin';
+ if (false!==$real_file)
+ {
+ $real_plugin_path = realpath(PHPWG_PLUGINS_PATH);
+ $file = substr($real_file, strlen($real_plugin_path)+1);
+ $file = str_replace('\\', '/', $file);//Windows
+ $url .= '&section='.urlencode($file);
+ }
+ else if (isset($page['errors']))
+ {
+ array_push($page['errors'], 'PLUGIN ERROR: "'.$file.'" is not a valid file');
+ }
return $url;
}
diff --git a/admin/plugin.php b/admin/plugin.php
index a057e87c8..1657f10c8 100644
--- a/admin/plugin.php
+++ b/admin/plugin.php
@@ -33,27 +33,35 @@ if( !defined("PHPWG_ROOT_PATH") )
include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
check_status(ACCESS_ADMINISTRATOR);
-$section = explode('~', $_GET['section'] );
-if (count($section)!=2)
+$sections = explode('/', $_GET['section'] );
+for ($i=0; $i<count($sections); $i++)
+{
+ if (empty($sections[$i]) or $sections[$i]=='..')
+ {
+ unset($sections[$i]);
+ $i--;
+ }
+}
+
+if (count($sections)<2)
{
die('Invalid plugin URL');
}
-$plugin_id = $section[0];
+$plugin_id = $sections[0];
$check_db_plugin = get_db_plugins('active', $plugin_id );
if (empty($check_db_plugin))
{
die('Invalid URL - plugin '.$plugin_id.' not active');
}
-$section[1]=str_replace('./', '', $section[1]); // no up in dir structure
-$filename = PHPWG_PLUGINS_PATH.$plugin_id.'/'.$section[1].'.php';
+$filename = PHPWG_PLUGINS_PATH.implode('/', $sections);
if (is_file($filename))
{
include_once($filename);
}
else
{
- die('Missing '.$filename);
+ die('Missing file '.$filename);
}
?> \ No newline at end of file