Home Explore Help
Sign In
richard
/
sorbetcms
Watch 1
Star 0
Fork 1
Code Issues 0 Pull Requests 0 Commits 290 Releases 0 Wiki
Browse Source

Security fix, issue 51 - checking for entry

mheitzenroder@gmail.com 18 years ago
parent
2b04a0339c
commit
8dabf4065d
32 changed files with 453 additions and 332 deletions
Split View Show Diff Stats
  1. 3 6
      admin/admin.php
  2. 1 0
      admin/ajax.php
  3. 5 9
      admin/close.php
  4. 2 9
      admin/comments.php
  5. 7 14
      admin/index.php
  6. 2 5
      admin/options.php
  7. 3 7
      admin/settings.php
  8. 1 1
      admin/user.php
  9. 1 0
      api.php
  10. 1 4
      classes/comments.class.php
  11. 2 0
      classes/configuration.class.php
  12. 1 0
      classes/functions.php
  13. 1 0
      classes/gelato.class.php
  14. 2 0
      classes/gettext.class.php
  15. 1 0
      classes/imgsize.php
  16. 280 0
      classes/install.class.php
  17. 1 0
      classes/lang.functions.php
  18. 1 0
      classes/mysql_connection.class.php
  19. 2 0
      classes/pagination.class.php
  20. 2 0
      classes/streams.class.php
  21. 2 0
      classes/templates.class.php
  22. 1 1
      classes/textile.class.php
  23. 31 30
      classes/user.class.php
  24. 1 0
      comments.php
  25. 1 0
      config-sample.php
  26. 51 0
      entry.php
  27. 10 27
      index.php
  28. 27 208
      install.php
  29. 7 10
      login.php
  30. 1 0
      rss.php
  31. 1 0
      update.php
  32. 1 1
      uploads/index.php

+ 3 - 6
admin/admin.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry')) define('entry',true);
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

@@ -9,15 +10,11 @@
9 10 
   Copyright (C) 2007 by Pedro Santana <pecesama at gmail dot com>
10 11
11 12 
   =========================== */
12 
-?>
13 
-<?php
14 
-require_once('../config.php');
13 
+
15 14 
 include("../classes/user.class.php");
16 15 
 include("../classes/functions.php");
17 16 
 require_once("../classes/configuration.class.php");
18 
-
19 
-$user = new user();
20 
-$conf = new configuration();
17 
+require_once('../entry.php');
21 18
22 19 
 if ($user->isAdmin()) {
23 20

+ 1 - 0
admin/ajax.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry'))define('entry', true);
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

+ 5 - 9
admin/close.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry'))define('entry', true);
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

@@ -11,15 +12,10 @@
11 12 
   =========================== */
12 13 
 ?>
13 14 
 <?php
14 
-require_once('../config.php');
15 
-include("../classes/functions.php");
16 
-include("../classes/user.class.php");
17 
-require_once("../classes/configuration.class.php");
15 
+require('../entry.php');
16 
+global $user;
17 
+$closed = $user->closeSession();
18 18
19 
-session_start();
20 
-$user = new user();
21 
-$conf = new configuration();
22 
-$user->closeSession()
23 19 
 ?>
24 20 
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
25 21 
 	<html xmlns="http://www.w3.org/1999/xhtml">

@@ -52,7 +48,7 @@ $user->closeSession()
52 48 
 					<div class="tabla">
53 49 
 						<p>
54 50 
 <?php
55 
-						if (@session_destroy()) {
51 
+						if ($closed) {
56 52 
 ?>
57 53 
 							<h2><?php echo __("Ending session...")?></h2>
58 54 
 <?php

+ 2 - 9
admin/comments.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry')) define('entry',true);
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

@@ -11,17 +12,9 @@
11 12 
   =========================== */
12 13 
 ?>
13 14 
 <?php
14 
-require_once('../config.php');
15 
-include("../classes/functions.php");
16 
-include("../classes/user.class.php");
17 
-include("../classes/comments.class.php");
18 
-include("../classes/templates.class.php");
19 
-include("../classes/pagination.class.php");
20 
-require_once("../classes/configuration.class.php");
15 
+require_once('../entry.php');
21 16
22 
-$user = new user();
23 17 
 $comment = new comments();
24 
-$conf = new configuration();
25 18 
 $template = new plantillas("admin");
26 19 
 $isAdmin = $user->isAdmin();
27 20 
 $isEdition = isset($_GET["edit"]);

+ 7 - 14
admin/index.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry'))define('entry', true);
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

@@ -11,18 +12,10 @@
11 12 
   =========================== */
12 13 
 ?>
13 14 
 <?php
14 
-require_once('../config.php');
15 
-include("../classes/functions.php");
16 
-include("../classes/user.class.php");
17 
-include("../classes/pagination.class.php");
18 
-include("../classes/gelato.class.php");
19 
-include("../classes/textile.class.php");
20 
-include("../classes/templates.class.php");
21 
-require_once("../classes/configuration.class.php");
22 15
23 
-$user = new user();
24 
-$tumble = new gelato();
25 
-$conf = new configuration();
16 
+
17 
+require('../entry.php');
18 
+global $user, $conf, $tumble;
26 19 
 $template = new plantillas("admin");
27 20
28 21 
 $isEdition = (isset($_GET["edit"])) ? true : false;

@@ -144,7 +137,7 @@ if ($user->isAdmin()) {
144 137 
 				<h1><a href="<?php echo $conf->urlGelato;?>/admin/index.php" title="gelato :: <?php echo __("home")?>">gelato cms</a></h1>
145 138 
 				<ul id="nav">
146 139 
 					<li><a href="<?php echo $conf->urlGelato;?>/" title="<?php echo __("Take me to the tumblelog")?>"><?php echo __("View Tumblelog")?></a></li>
147 
-					<li><a href="close.php" title="Log off" onclick="return exit('div-process','<?php echo $conf->urlGelato;?>/admin/ajax.php?action=close');"><?php echo __("Log out")?></a></li>
140 
+					<li><a href="close.php" title="Log off" ><?php echo __("Log out")?></a></li>
148 141 
 			  	</ul>
149 142 
 			</div>
150 143 
 			<div id="main">

@@ -241,8 +234,8 @@ if ($user->isAdmin()) {
241 234 
 							$body = ($isEdition) ? stripslashes($post["description"]) : "";
242 235 
 							$url = ($isEdition) ? $post["url"] : "";
243 236
244 
-
245 
-							switch (isset($_GET["new"]) && $_GET["new"]) {
237 
+							if (!isset($_GET['new'])) $_GET['new'] = 'default';
238 
+							switch ($_GET["new"]) {
246 239 
 								case "post":
247 240 
 									$input = array("{type}", "{date}", "{id_user}", "{editTitle}", "{editBody}");
248 241 
 									$output = array("1", $date, $_SESSION['user_id'], $title, $body);

+ 2 - 5
admin/options.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry')) define('entry',true);
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

@@ -11,15 +12,11 @@
11 12 
   =========================== */
12 13 
 ?>
13 14 
 <?php
14 
-require_once('../config.php');
15 15 
 include("../classes/functions.php");
16 16 
 include("../classes/user.class.php");
17 17 
 include("../classes/gelato.class.php");
18 18 
 require_once("../classes/configuration.class.php");
19 
-
20 
-$user = new user();
21 
-$tumble = new gelato();
22 
-$conf = new configuration();
19 
+require_once('../entry.php');
23 20
24 21 
 if ($user->isAdmin()) {
25 22

+ 3 - 7
admin/settings.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry')) define('entry',true);
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

@@ -9,17 +10,12 @@
9 10 
   Copyright (C) 2007 by Pedro Santana <pecesama at gmail dot com>
10 11
11 12 
   =========================== */
12 
-?>
13 
-<?php
14 
-require_once('../config.php');
13 
+
15 14 
 include("../classes/functions.php");
16 15 
 include("../classes/user.class.php");
17 16 
 include("../classes/gelato.class.php");
18 17 
 require_once("../classes/configuration.class.php");
19 
-
20 
-$user = new user();
21 
-$tumble = new gelato();
22 
-$conf = new configuration();
18 
+require_once('../entry.php');
23 19
24 20 
 if ($user->isAdmin()) {
25 21

+ 1 - 1
admin/user.php View File 

@@ -1,5 +1,5 @@
1 1 
 <?php
2 
-/* ===========================
2 
+if(!defined('entry') || !entry) die('Not a valid page'); /* ===========================
3 3
4 4 
   gelato CMS - A PHP based tumblelog CMS
5 5 
   development version

+ 1 - 0
api.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry') || !entry) die('Not a valid page');
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

+ 1 - 4
classes/comments.class.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry') || !entry) die('Not a valid page');
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

@@ -9,10 +10,6 @@
9 10 
   Copyright (C) 2007 by Pedro Santana <pecesama at gmail dot com>
10 11
11 12 
   =========================== */
12 
-?>
13 
-<?php
14 
-require_once("configuration.class.php");
15 
-require_once("functions.php");
16 13
17 14 
 class comments extends Conexion_Mysql {
18 15 
 	var $conf;

+ 2 - 0
classes/configuration.class.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry') || !entry) die('Not a valid page');
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

@@ -12,6 +13,7 @@
12 13 
 ?>
13 14 
 <?php
14 15 
 require_once("lang.functions.php");
16 
+require_once('mysql_connection.class.php');
15 17 
 class configuration extends Conexion_Mysql {
16 18
17 19 
 	var $urlGelato;

+ 1 - 0
classes/functions.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry') || !entry) die('Not a valid page');
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

+ 1 - 0
classes/gelato.class.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry') || !entry) die('Not a valid page');
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

+ 2 - 0
classes/gettext.class.php View File 

@@ -1,4 +1,6 @@
1 1 
 <?php
2 
+ if(!defined('entry') || !entry) die('Not a valid page');
3 
+
2 4 
 /*
3 5 
    Copyright (c) 2003 Danilo Segan <danilo@kvota.net>.
4 6 
    Copyright (c) 2005 Nico Kaiser <nico@siriux.net>

+ 1 - 0
classes/imgsize.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+ if(!defined('entry') || !entry) die('Not a valid page');
2 3 
 header ("Content-type: image/jpeg");
3 4 
 header('Cache-Control: max-age=172800, must-revalidate');
4 5 
 header('Expires: ' . date('r', time()+120));

+ 280 - 0
classes/install.class.php View File 

@@ -0,0 +1,280 @@
1 
+<?php
2 
+if(!defined('entry') || !entry) die('Not a valid page');
3 
+require('classes/mysql_connection.class.php');
4 
+
5 
+class Install {
6 
+	var $data = null;
7 
+	var $errors = null;
8 
+	var $showForm;
9 
+	var $errors_d = array();
10 
+
11 
+	function Install(){
12 
+		$this->errors_d[1]="The login field cannot be empty";
13 
+		$this->errors_d[2]="The password field cannot be empty";
14 
+		$this->errors_d[3]="Password does not match the confirm password";
15 
+		$this->errors_d[4]="The e-mail field cannot be empty";
16 
+		$this->errors_d[5]="The installation URL field cannot be empty";
17 
+		$this->errors_d[6]="Error establishing a database connection";
18 
+		$this->errors_d[7]="Please add a hostname for the database server";
19 
+		$this->errors_d[8]="Please name the database";
20 
+	}
21 
+
22 
+    function run() {
23 
+
24 
+    	if (empty($this->data)) false;
25 
+
26 
+    	if (!$this->create_config()) return false;
27 
+
28 
+    	$this->create_db();
29 
+
30 
+    	if (!$this->install_db()) return false;
31 
+
32 
+		return true;
33 
+    }
34 
+
35 
+    function create_db(){
36 
+
37 
+	    $link =  mysql_connect($this->data['db_host'], $this->data['db_login'], $this->data['db_password']);
38 
+		if (!$link) {
39 
+		    die('Could not connect: ' . mysql_error());
40 
+		}
41 
+
42 
+		$sql = 'CREATE DATABASE ' . $this->data['db_name'];
43 
+		if (!mysql_query($sql, $link)) {
44 
+			$link = mysql_close($link);
45 
+			return false;
46 
+		}
47 
+
48 
+		return true;
49 
+    }
50 
+
51 
+	function install_db(){
52 
+		require('config.php');
53 
+		$db = new Conexion_Mysql(DB_name, DB_Server, DB_User, DB_Password);
54 
+		$sqlStr = array();
55 
+
56 
+		$sqlStr[] = "CREATE TABLE `".Table_prefix."data` (
57 
+			  `id_post` int(11) NOT NULL auto_increment,
58 
+			  `title` text NULL,
59 
+			  `url` varchar(250)  default NULL,
60 
+			  `description` text NULL,
61 
+			  `type` tinyint(4) NOT NULL default '1',
62 
+			  `date` datetime NOT NULL,
63 
+			  `id_user` int(10) NOT NULL,
64 
+			  PRIMARY KEY  (`id_post`)
65 
+			) ENGINE = MYISAM ;";
66 
+
67 
+		$sqlStr[] = "CREATE TABLE `".Table_prefix."users` (
68 
+			  `id_user` int(10) unsigned NOT NULL auto_increment,
69 
+			  `name` varchar(100) default NULL,
70 
+			  `login` varchar(100) NOT NULL default '',
71 
+			  `password` varchar(64) NOT NULL default '',
72 
+			  `email` varchar(100) default NULL,
73 
+			  `website` varchar(150) default NULL,
74 
+			  `about` text,
75 
+			  PRIMARY KEY  (`id_user`)
76 
+			) ENGINE = MYISAM;";
77 
+
78 
+		$sqlStr[] = "CREATE TABLE `".Table_prefix."config` (
79 
+			  `posts_limit` int(3) NOT NULL,
80 
+			  `title` varchar(250) NOT NULL,
81 
+			  `description` text NOT NULL,
82 
+			  `lang` varchar(10) NOT NULL,
83 
+			  `template` varchar(100) NOT NULL,
84 
+			  `url_installation` varchar(250) NOT NULL,
85 
+			  PRIMARY KEY  (`title`)
86 
+			) ENGINE = MYISAM ;";
87 
+
88 
+
89 
+
90 
+		$sqlStr[] = "CREATE TABLE `".Table_prefix."options` (
91 
+		  `name` varchar(100) NOT NULL,
92 
+		  `val` varchar(255) NOT NULL,
93 
+		  PRIMARY KEY  (`name`)
94 
+		) ENGINE = MYISAM ;";
95 
+
96 
+
97 
+		$sqlStr[] = "CREATE TABLE `".Table_prefix."comments` (
98 
+		  `id_comment` int(11) NOT NULL auto_increment,
99 
+		  `id_post` int(11) NOT NULL,
100 
+		  `username` varchar(50) NOT NULL,
101 
+		  `email` varchar(100) NOT NULL,
102 
+		  `web` varchar(250) default NULL,
103 
+		  `content` text NOT NULL,
104 
+		  `ip_user` varchar(50) NOT NULL,
105 
+		  `comment_date` datetime NOT NULL,
106 
+		  `spam` tinyint(4) NOT NULL,
107 
+		  PRIMARY KEY  (`id_comment`)
108 
+		) ENGINE = MYISAM ;";
109 
+
110 
+		$sqlStr[] =  "INSERT INTO `".Table_prefix."config` VALUES (". $this->data['posts_limit'] .", '".$this->data['title']."', '".$this->data['description']."', '".$this->data['lang']."', '".$this->data['template']."', '".$this->data['url_installation']."');";
111 
+		$sqlStr[] =  "INSERT INTO `".Table_prefix."users` VALUES ('', '', '".$this->data['login']."', '".md5($this->data['password'])."', '".$this->data['email']."', '".$this->data['website']."', '".$this->data['about']."');";
112 
+		$sqlStr[] =  "INSERT INTO `".Table_prefix."options` VALUES ('url_friendly', '1');";
113 
+		$sqlStr[] =  "INSERT INTO `".Table_prefix."options` VALUES ('rich_text', '0');";
114 
+		$sqlStr[] = "INSERT INTO `".Table_prefix."options` VALUES ('allow_comments', '0');";
115 
+		$sqlStr[] =  "INSERT INTO `".Table_prefix."options` VALUES ('offset_city', '".$this->data['offset_city']."');";
116 
+		$sqlStr[] = "INSERT INTO `".Table_prefix."options` VALUES ('offset_time', '".$this->data['offset_time']."');";
117 
+
118 
+		foreach($sqlStr as $key => $query){
119 
+			if(!$db->ejecutarConsulta($query)){
120 
+				return false;
121 
+			}
122 
+		}
123 
+
124 
+		return true;
125 
+	}
126 
+
127 
+	function inerrors($n) {
128 
+		if ( strpos($this->errors,$n)===false) {
129 
+			return false;
130 
+		} else {
131 
+			return true;
132 
+		}
133 
+	}
134 
+
135 
+	function mostrarerror($n) {
136 
+		if ($this->inerrors($n)) {
137 
+			return '<span class="error">'.$this->errors_d[$n].'</span>';
138 
+		} else {
139 
+			return "";
140 
+		}
141 
+	}
142 
+
143 
+	function is_gelato_installed(){
144 
+		if (!$this->check_for_config()){
145 
+			return false;
146 
+		} else {/*
147 
+			if (!$this->is_db_installed()){
148 
+				return false;
149 
+			}
150 
+			*/
151 
+		}
152 
+
153 
+		return true;
154 
+	}
155 
+	/*
156 
+	function is_db_installed(){
157 
+
158 
+			global $db;
159 
+
160 
+			if (function_exists($db->ejecutarConsulta)){
161 
+				$sqlStr = "SELECT * FROM `".Table_prefix."config`";
162 
+				if($db->ejecutarConsulta($sqlStr)) {
163 
+					return ($db->contarRegistros() > 0);
164 
+				}
165 
+			} else {
166 
+				false;
167 
+			}
168 
+
169 
+	}
170 
+	*/
171 
+	function check_for_config(){
172 
+		if(!file_exists('config.php')) return false;
173 
+		if(!defined('DB_Server')) return false;
174 
+		if(!defined('DB_name')) return false;
175 
+		if(!defined('DB_User')) return false;
176 
+		if(!defined('DB_Password')) return false;
177 
+
178 
+		return true;
179 
+	}
180 
+
181 
+	function create_config(){
182 
+		$config = fopen("config.php", 'w+');
183 
+		$contents = '<?php
184 
+if(!defined(\'entry\') || !entry) die(\'Not a valid page\');
185 
+/* ===========================
186 
+
187 
+  gelato CMS - A PHP based tumblelog CMS
188 
+  development version
189 
+  http://www.gelatocms.com/
190 
+
191 
+  gelato CMS is a free software licensed under the GPL 2.0
192 
+  Copyright (C) 2007 by Pedro Santana <pecesama at gmail dot com>
193 
+
194 
+  =========================== */
195 
+
196 
+define(\'DB_Server\', \''. $this->data['db_host'] . '\');
197 
+define(\'DB_name\', \''. $this->data['db_name'] . '\');
198 
+define(\'DB_User\', \''. $this->data['db_login'] . '\');
199 
+define(\'DB_Password\', \''. $this->data['db_password'] . '\');
200 
+define(\'Table_prefix\', \'gel_\');
201 
+define(\'Absolute_Path\', dirname(__FILE__).DIRECTORY_SEPARATOR);
202 
+
203 
+?>';
204 
+
205 
+	    if (fwrite($config, $contents) === FALSE) {
206 
+	        $this->errors = "Could not write config file to directory";
207 
+	        return false;
208 
+	    }
209 
+	    fclose($config);
210 
+	    return true;
211 
+	}
212 
+
213 
+	function check_form(){
214 
+
215 
+		$action="";
216 
+
217 
+		if (isset($this->data['action'])){
218 
+			$action=$this->data['action'];
219 
+		}
220 
+
221 
+		if (!$this->is_gelato_installed()){
222 
+
223 
+		$this->showForm = true;
224 
+
225 
+
226 
+			if ($action=="config") {
227 
+
228 
+				$sep_err="";
229 
+				$this->errors = false;
230 
+
231 
+				if (!$this->data['login'] || !$this->data['db_login']) {
232 
+					$this->errors =$this->errors.$sep_err."1";
233 
+					$sep_err="|";
234 
+				}
235 
+				if (!$this->data['password'] ||  !$this->data['db_password']) {
236 
+					$this->errors=$this->errors.$sep_err."2";
237 
+					$sep_err="|";
238 
+				}
239 
+				if (!$this->data['email']) {
240 
+					$this->errors=$this->errors.$sep_err."4";
241 
+					$sep_err="|";
242 
+				}
243 
+				if (!$this->data['url_installation'] ) {
244 
+					$this->errors=$this->errors.$sep_err."5";
245 
+					$sep_err="|";
246 
+				}
247 
+				if (!$this->data['db_host'] ) {
248 
+					$this->errors=$this->errors.$sep_err."7";
249 
+					$sep_err="|";
250 
+				}
251 
+				if (!$this->data['db_name'] ) {
252 
+					$this->errors=$this->errors.$sep_err."8";
253 
+					$sep_err="|";
254 
+				}
255 
+				if ($this->data['password']!=$_POST['password2'] ||  $_POST['db_password']!=$_POST['db_password2'] ) {
256 
+					$this->errors=$this->errors.$sep_err."3";
257 
+					$sep_err="|";
258 
+				}
259 
+				$off_r= split("," , $this->data['time_offsets']);
260 
+				$this->data['offset_time'] = $off_r[0];
261 
+				$this->data['offset_city'] = $off_r[1];
262 
+				unset($this->data['time_offsets']);
263 
+
264 
+				if (!$this->errors) {
265 
+
266 
+					if ($this->run($this->data)) {
267 
+						$this->showForm=false;
268 
+					} else {
269 
+						$this->errors=$this->errors.$sep_err."6";
270 
+						$sep_err="|";
271 
+						$this->showForm=true;
272 
+					}
273 
+				} else {
274 
+					$this->showForm=true;
275 
+				}
276 
+			}
277 
+		}
278 
+	}
279 
+}
280 
+?>

+ 1 - 0
classes/lang.functions.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry') || !entry) die('Not a valid page');
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

+ 1 - 0
classes/mysql_connection.class.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+ if(!defined('entry') || !entry) die('Not a valid page');
2 3 
 /**
3 4 
  * version 0.0.1
4 5 
  *

+ 2 - 0
classes/pagination.class.php View File 

@@ -1,4 +1,6 @@
1 1 
 <?php
2 
+ if(!defined('entry') || !entry) die('Not a valid page');
3 
+
2 4 
 class pagination{
3 5 
 /*
4 6 
 Script Name: *Digg Style Paginator Class

+ 2 - 0
classes/streams.class.php View File 

@@ -1,4 +1,6 @@
1 1 
 <?php
2 
+ if(!defined('entry') || !entry) die('Not a valid page');
3 
+
2 4 
 /*
3 5 
    Copyright (c) 2003, 2005 Danilo Segan <danilo@kvota.net>.
4 6

+ 2 - 0
classes/templates.class.php View File 

@@ -1,4 +1,6 @@
1 1 
 <?php
2 
+ if(!defined('entry') || !entry) die('Not a valid page');
3 
+
2 4 
 /**
3 5 
  * version 0.0.1
4 6 
  *

+ 1 - 1
classes/textile.class.php View File 

@@ -1,5 +1,5 @@
1 1 
 <?php
2 
-
2 
+ if(!defined('entry') || !entry) die('Not a valid page');
3 3 
 /**
4 4 
  * Example: get XHTML from a given Textile-markup string ($string)
5 5 
  *

+ 31 - 30
classes/user.class.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry') || !entry) die('Not a valid page');
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

@@ -15,41 +16,46 @@ require_once("configuration.class.php");
15 16
16 17 
 class user extends Conexion_Mysql {
17 18 
 	var $conf;
19 
+	var $cookieString;
20 
+	var $cookieTime;
21 
+	var $persist = false;
22 
+
18 23
19 24 
 	function user() {
20 25 
 		parent::Conexion_Mysql(DB_name, DB_Server, DB_User, DB_Password);
26 
+		$this->cookie_life = 60*24*3600;
27 
+		$this->cookieTime = time();
21 28 
 		$this->conf = new configuration();
22 29 
 	}
23 30
24 31 
 	function isAdmin() {
25 
-		if(isset($_COOKIE["gelato_cookie"]) && $_COOKIE["gelato_cookie"] && $_COOKIE["gelato_cookie"]!="") {
26 
-			$galleta = explode(",",$_COOKIE["gelato_cookie"]);
27 
-			if ($this->validateUser($galleta[1],$galleta[2])) {
28 
-				$_SESSION["user_id"]=$galleta[0];
29 
-				$_SESSION["user_login"]=$galleta[1];
30 
-			} else {
31 
-				$_SESSION["user_id"]="";
32 
-				$_SESSION["user_login"]="";
33 
-				unset($_SESSION["user_id"]);
34 
-				unset($_SESSION["user_login"]);
35 
-			}
36 
-		}
37 
-		if (isset($_SESSION["user_id"]) && isset($_SESSION["user_login"])) {
32 
+
33 
+		if ((!empty($_SESSION["user_id"]) && !empty($_SESSION["user_login"]))  && (isset($_SESSION['authenticated'])  && $_SESSION['authenticated']==true)) {
38 34 
 			return true;
39 35 
 		}
36 
+
37 
+		if(isset($_COOKIE["PHPSESSID"]) && $_COOKIE["PHPSESSID"]!="") {
38 
+			if ((!empty($_SESSION["user_id"]) && !empty($_SESSION["user_login"]))  && (isset($_SESSION['authenticated'])  && $_SESSION['authenticated']==true)) {
39 
+				return true;
40 
+			}
41 
+		}
42 
+
40 43 
 		return false;
44 
+
41 45 
 	}
42 46
43 
-	function validateUser($user="", $password="") {
44 
-		if ($this->ejecutarConsulta("SELECT id_user, login, password  FROM ".$this->conf->tablePrefix."users WHERE login='".sql_escape($user)."' AND password='".$password."'")) {
47 
+	function validateUser($username="", $password="") {
48 
+
49 
+		if ($this->ejecutarConsulta("SELECT id_user, login, password  FROM ".$this->conf->tablePrefix."users WHERE login='".sql_escape($username)."' AND password='".$password."'")) {
45 50 
 			if ($this->contarRegistros()>0) {
46 51 
 				$register=$this->obtenerRegistro();
47 52 
 				$_SESSION['user_id']=$register["id_user"];
48 53 
 				$_SESSION['user_login']=$register["login"];
54 
+				$_SESSION['authenticated'] = true;
49 55 
 				if (isset($_POST["save_pass"])) {
50 
-					$cookie_life = 60*24*3600;
51 
-					setcookie("gelato_cookie",$register["id_user"].",".$register["login"].",".$register["password"],time()+$cookie_life);
52 
-				}
56 
+					$this->persist = true;
57 
+					setcookie("PHPSESSID",session_id(),$this->cookieTime+$this->cookie_life);
58 
+				}
53 59 
 				return true;
54 60 
 			} else {
55 61 
 				return false;

@@ -59,18 +65,9 @@ class user extends Conexion_Mysql {
59 65 
 		}
60 66 
 	}
61 67
62 
-	function closeSession() {
63 
-		$_SESSION = array();
64 
-		$_COOKIE["gelato_cookie"]="";
65 
-		setcookie("gelato_cookie","",time()-3600,'/','',0);
66 
-		setcookie("gelato_cookie","",0);
67 
-		unset($_COOKIE["gelato_cookie"]);
68 
-		unset($_COOKIE[session_name()]);
69 
-		if (session_destroy()) {
70 
-			return true;
71 
-		} else {
72 
-			return false;
73 
-		}
68 
+	function closeSession() {
69 
+		if (!$this->persist) session_destroy();
70 
+		return true;
74 71 
 	}
75 72
76 73 
 	function userExist($user="") {

@@ -82,6 +79,10 @@ class user extends Conexion_Mysql {
82 79 
 			}
83 80 
 		}
84 81 
 	}
82 
+
83 
+	function isAuthenticated(){
84 
+		return $this->isAdmin();
85 
+	}
85 86
86 87 
 	function addUser($fieldsArray) {
87 88 
 		if ($this->ejecutarConsulta("SELECT id_user FROM ".$this->conf->tablePrefix."users WHERE login='".$fieldsArray['login']."'")) {

+ 1 - 0
comments.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry') || !entry) die('Not a valid page');
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

+ 1 - 0
config-sample.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry') || !entry) die('Not a valid page');
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

+ 51 - 0
entry.php View File 

@@ -0,0 +1,51 @@
1 
+<?php
2 
+ if(!defined('entry') || !entry) die('Not a valid page');
3 
+/*
4 
+ * Created on Sep 15, 2007
5 
+ *
6 
+ * Known Entry Points
7 
+ * install.php
8 
+ * index.php
9 
+ * login.php
10 
+ * admin/index.php
11 
+ * admin/close.php
12 
+ * admin/ajax.php
13 
+ * admin/settings.php
14 
+ * admin/options.php
15 
+ * admin/admin.php
16 
+ * admin/comments.php
17 
+ */
18 
+
19 
+
20 
+// PHP settings specific to Gelato
21 
+ini_set('pcre.backtrack_limit', '10000');
22 
+
23 
+// Globals to be used throughout the application
24 
+$configFile = dirname(__FILE__).DIRECTORY_SEPARATOR."config.php";
25 
+
26 
+if (!file_exists($configFile)) {
27 
+	header("Location: install.php");
28 
+} else {
29 
+        require(dirname(__FILE__).DIRECTORY_SEPARATOR."config.php");
30 
+}
31 
+
32 
+require_once("classes/configuration.class.php");
33 
+require_once("classes/textile.class.php");
34 
+require_once("classes/gelato.class.php");
35 
+require_once("classes/templates.class.php");
36 
+require_once("classes/pagination.class.php");
37 
+require_once("classes/user.class.php");
38 
+require_once("classes/comments.class.php");
39 
+require_once(Absolute_Path.'classes'.DIRECTORY_SEPARATOR.'mysql_connection.class.php');
40 
+require_once(Absolute_Path.'classes'.DIRECTORY_SEPARATOR.'streams.class.php');
41 
+require_once(Absolute_Path.'classes'.DIRECTORY_SEPARATOR.'gettext.class.php');
42 
+require_once(Absolute_Path.'classes'.DIRECTORY_SEPARATOR.'lang.functions.php');
43 
+
44 
+$user = new user();
45 
+$conf = new configuration();
46 
+$tumble = new gelato();
47 
+
48 
+
49 
+session_start();
50 
+
51 
+?>

+ 10 - 27
index.php View File 

@@ -1,5 +1,6 @@
1 1 
 <?php
2 
-/* ===========================
2 
+if(!defined('entry'))define('entry', true);
3 
+ /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS
5 6 
   development version

@@ -11,32 +12,14 @@
11 12 
   =========================== */
12 13 
 ?>
13 14 
 <?php
15 
+
16 
+// Received a valid request, better start setting globals we'll need throughout the app in entry.php
17 
+require_once('entry.php');
18 
+global $user, $tumble, $conf, $db;
19 
+
20 
+$template = new plantillas($conf->template);
14 21 
         // My approach to MVC
15 
-
16 
-        $configFile = dirname(__FILE__).DIRECTORY_SEPARATOR."config.php";
17 
-
18 
-        if (!file_exists($configFile)) {
19 
-                $mensaje = "
20 
-                        <h3 class=\"important\">Error reading configuration file</h3>
21 
-                        <p>There doesn't seem to be a <code>config.php</code> file. I need this before we can get started.</p>
22 
-                        <p>This either means that you did not rename the <code>config-sample.php</code> file to <code>config.php</code>.</p>";
23 
-                die($mensaje);
24 
-        } else {
25 
-                require(dirname(__FILE__).DIRECTORY_SEPARATOR."config.php");
26 
-        }
27 
-
28 
-        include("classes/configuration.class.php");
29 
-        include("classes/textile.class.php");
30 
-        include("classes/gelato.class.php");
31 
-        include("classes/templates.class.php");
32 
-        include("classes/pagination.class.php");
33 
-        include("classes/user.class.php");
34 
-		include("classes/comments.class.php");
35 
-
36 
-        $user = new user();
37 
-        $conf = new configuration();
38 
-        $tumble = new gelato();
39 
-        $template = new plantillas($conf->template);
22 
+
40 23
41 24 
         if(isset($_SERVER['PATH_INFO'])) $param_url = explode("/",$_SERVER['PATH_INFO']);
42 25 
 

@@ -78,7 +61,7 @@
78 61 
         $template->cargarPlantilla($input, $output, "template_header");
79 62 
         $template->mostrarPlantilla();
80 63
81 
-        if ($user->isAdmin()) {
64 
+        if ($user->isAuthenticated()) {
82 65 
                 $input = array("{User}", "{URL_Tumble}");
83 66 
                 $output = array($_SESSION["user_login"], $conf->urlGelato);
84 67

+ 27 - 208
install.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry'))define('entry', true);
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

@@ -9,84 +10,15 @@
9 10 
   Copyright (C) 2007 by Pedro Santana <pecesama at gmail dot com>
10 11
11 12 
   =========================== */
12 
-?>
13 
-<?php
14 13
15 14 
 $configFile = dirname(__FILE__).DIRECTORY_SEPARATOR."config.php";
16 
-
17 
-if (!file_exists($configFile)) {
18 
-	$mensaje = "
19 
-			<h3 class=\"important\">Error reading configuration file</h3>
20 
-			<p>There doesn't seem to be a <code>config.php</code> file. I need this before we can get started.</p>
21 
-			<p>This either means that you did not rename the <code>config-sample.php</code> file to <code>config.php</code>.</p>";
22 
-	die($mensaje);
23 
-} else {
24 
-	require(dirname(__FILE__).DIRECTORY_SEPARATOR."config.php");
25 
-	$showForm = true;
26 
-}
27 15
28 
-
29 
-include("classes/functions.php");
16 
+include('classes/functions.php');
17 
+include('classes/install.class.php');
30 18
31 
-$errors_d=array();
32 
-$errors_d[1]="The login field cannot be empty";
33 
-$errors_d[2]="The password field cannot be empty";
34 
-$errors_d[3]="Password does not match the confirm password";
35 
-$errors_d[4]="The e-mail field cannot be empty";
36 
-$errors_d[5]="The installation URL field cannot be empty";
37 
-$errors_d[6]="Error establishing a database connection";
38 
-
39 
-$action="";
40 
-$errors="";
41 
-
42 
-if (isset($_POST['action'])){
43 
-	$action=$_POST['action'];
44 
-}
45 
-
46 
-if ($action=="config" && !is_db_installed()) {
47 
-
48 
-	$sep_err="";
49 
-
50 
-	if (!$_POST['login']) {
51 
-		$errors=$errors.$sep_err."1";
52 
-		$sep_err="|";
53 
-	}
54 
-	if (!$_POST['password']) {
55 
-		$errors=$errors.$sep_err."2";
56 
-		$sep_err="|";
57 
-	}
58 
-	if (!$_POST['email']) {
59 
-		$errors=$errors.$sep_err."4";
60 
-		$sep_err="|";
61 
-	}
62 
-	if (!$_POST['url_installation']) {
63 
-		$errors=$errors.$sep_err."5";
64 
-		$sep_err="|";
65 
-	}
66 
-	if ($_POST['password']!=$_POST['password2']) {
67 
-		$errors=$errors.$sep_err."3";
68 
-		$sep_err="|";
69 
-	}
70 
-	$off_r= split("," , $_POST['time_offsets']);
71 
-	$_POST['offset_time'] = $off_r[0];
72 
-	$_POST['offset_city'] = $off_r[1];
73 
-	unset($_POST['time_offsets']);
74 
-
75 
-	if (!$errors) {
76 
-		if (install_db($_POST['login'], $_POST['password'], $_POST['email'], $_POST['title'], $_POST['description'], $_POST['url_installation'], $_POST['posts_limit'], $_POST['lang'], $_POST['template'], $_POST['website'], $_POST['about'], $_POST['offset_city'], $_POST['offset_time'])) {
77 
-			$showForm=false;
78 
-		} else {
79 
-			$errors=$errors.$sep_err."6";
80 
-			$sep_err="|";
81 
-			$showForm=true;
82 
-		}
83 
-	} else {
84 
-		$showForm=true;
85 
-	}
86 
-}
87 
-
88 
-
89 
-	$showForm = (!is_db_installed());
19 
+$install = new Install();
20 
+$install->data = $_POST;
21 
+$install->check_form();
90 22
91 23 
 ?>
92 24 
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

@@ -110,7 +42,7 @@ if ($action=="config" && !is_db_installed()) {
110 42
111 43 
 <?php
112 44
113 
-	if ($showForm) {
45 
+	if ($install->showForm) {
114 46 
 ?>
115 47
116 48 
 	<div class="box">

@@ -122,17 +54,32 @@ if ($action=="config" && !is_db_installed()) {
122 54
123 55 
 		<div class="tabla">
124 56 
 			<form action="install.php" method="post" id="config_form" autocomplete="off" class="newpost">
57 
+				<fieldset>
58 
+					<legend class="install">Database Settings</legend>
59 
+					<ul>
60 
+						<li><label for="login">User:</label>
61 
+							<input type="text" name="db_login" id="db_login" value="" class="txt"/><?php echo $install->mostrarerror("1")?></li>
62 
+						<li><label for="password">Password:</label>
63 
+							<input type="password" name="db_password" id="db_password" value="" class="txt"/><?php echo $install->mostrarerror("2")?></li>
64 
+						<li><label for="password2">Re-type password:</label>
65 
+							<input type="password" name="db_password2" id="db_password2" value="" class="txt"/><?php echo $install->mostrarerror("3")?></li>
66 
+						<li><label for="email">Database Host:</label>
67 
+							<input type="text" name="db_host" id="db_host" value="localhost" class="txt"/><?php echo $install->mostrarerror("7")?></li>
68 
+						<li><label for="email">Database Name:</label>
69 
+							<input type="text" name="db_name" id="db_name" value="gelatocms" class="txt"/><?php echo $install->mostrarerror("8")?></li>
70 
+					</ul>
71 
+				</fieldset><br  />
125 72 
 				<fieldset>
126 73 
 					<legend class="install">Admin user</legend>
127 74 
 					<ul>
128 75 
 						<li><label for="login">User:</label>
129 
-							<input type="text" name="login" id="login" value="" class="txt"/><?php echo mostrarerror($errors,$errors_d,"1")?></li>
76 
+							<input type="text" name="login" id="login" value="" class="txt"/><?php echo $install->mostrarerror("1")?></li>
130 77 
 						<li><label for="password">Password:</label>
131 
-							<input type="password" name="password" id="password" value="" class="txt"/><?php echo mostrarerror($errors,$errors_d,"2")?></li>
78 
+							<input type="password" name="password" id="password" value="" class="txt"/><?php echo $install->mostrarerror("2")?></li>
132 79 
 						<li><label for="password2">Re-type password:</label>
133 
-							<input type="password" name="password2" id="password2" value="" class="txt"/><?php echo mostrarerror($errors,$errors_d,"3")?></li>
80 
+							<input type="password" name="password2" id="password2" value="" class="txt"/><?php echo $install->mostrarerror("3")?></li>
134 81 
 						<li><label for="email">E-mail:</label>
135 
-							<input type="text" name="email" id="email" value="" class="txt"/><?php echo mostrarerror($errors,$errors_d,"4")?></li>
82 
+							<input type="text" name="email" id="email" value="" class="txt"/><?php echo $install->mostrarerror("4")?></li>
136 83 
 					</ul>
137 84 
 				</fieldset><br  />
138 85 
 				<fieldset>

@@ -143,7 +90,7 @@ if ($action=="config" && !is_db_installed()) {
143 90 
 						<li><label for="description">Description:</label>
144 91 
 							<input type="text" name="description" id="description" value="" class="txt"/></li>
145 92 
 						<li><label for="url_installation">Installation URL</label>
146 
-							<input type="text" name="url_installation" id="url_installation" value="" class="txt"/><?php echo mostrarerror($errors,$errors_d,"5")?></li>
93 
+							<input type="text" name="url_installation" id="url_installation" value="<?php print substr($_SERVER["SCRIPT_URI"], '0', '-12'); ?>" class="txt"/><?php echo $install->mostrarerror("5")?></li>
147 94 
 						<li><label for="posts_limit">Post limit:</label>
148 95 
 							<input type="text" name="posts_limit" id="posts_limit" value="10" class="txt"/></li>
149 96 
 						<li><label for="lang">Language:</label>

@@ -254,131 +201,3 @@ if ($action=="config" && !is_db_installed()) {
254 201 
 </div>
255 202 
 </body>
256 203 
 </html>
257 
-
258 
-<?php
259 
-function install_db($login, $password, $email, $title, $description, $url_installation, $posts_limit, $lang, $template, $website, $about, $offset_city, $offset_time){
260 
-
261 
-		$db = new Conexion_Mysql(DB_name, DB_Server, DB_User, DB_Password);
262 
-
263 
-		$sqlStr = "CREATE TABLE `".Table_prefix."data` (
264 
-			  `id_post` int(11) NOT NULL auto_increment,
265 
-			  `title` text NULL,
266 
-			  `url` varchar(250)  default NULL,
267 
-			  `description` text NULL,
268 
-			  `type` tinyint(4) NOT NULL default '1',
269 
-			  `date` datetime NOT NULL,
270 
-			  `id_user` int(10) NOT NULL,
271 
-			  PRIMARY KEY  (`id_post`)
272 
-			) ENGINE = MYISAM ;";
273 
-
274 
-		$db->ejecutarConsulta($sqlStr);
275 
-
276 
-		$sqlStr = "CREATE TABLE `".Table_prefix."users` (
277 
-			  `id_user` int(10) unsigned NOT NULL auto_increment,
278 
-			  `name` varchar(100) default NULL,
279 
-			  `login` varchar(100) NOT NULL default '',
280 
-			  `password` varchar(64) NOT NULL default '',
281 
-			  `email` varchar(100) default NULL,
282 
-			  `website` varchar(150) default NULL,
283 
-			  `about` text,
284 
-			  PRIMARY KEY  (`id_user`)
285 
-			) ENGINE = MYISAM;";
286 
-
287 
-		$db->ejecutarConsulta($sqlStr);
288 
-
289 
-		$sqlStr = "CREATE TABLE `".Table_prefix."config` (
290 
-			  `posts_limit` int(3) NOT NULL,
291 
-			  `title` varchar(250) NOT NULL,
292 
-			  `description` text NOT NULL,
293 
-			  `lang` varchar(10) NOT NULL,
294 
-			  `template` varchar(100) NOT NULL,
295 
-			  `url_installation` varchar(250) NOT NULL,
296 
-			  PRIMARY KEY  (`title`)
297 
-			) ENGINE = MYISAM ;";
298 
-
299 
-		$db->ejecutarConsulta($sqlStr);
300 
-
301 
-		$sqlStr = "CREATE TABLE `".Table_prefix."options` (
302 
-		  `name` varchar(100) NOT NULL,
303 
-		  `val` varchar(255) NOT NULL,
304 
-		  PRIMARY KEY  (`name`)
305 
-		) ENGINE = MYISAM ;";
306 
-
307 
-		$db->ejecutarConsulta($sqlStr);
308 
-
309 
-		$sqlStr = "CREATE TABLE `".Table_prefix."comments` (
310 
-		  `id_comment` int(11) NOT NULL auto_increment,
311 
-		  `id_post` int(11) NOT NULL,
312 
-		  `username` varchar(50) NOT NULL,
313 
-		  `email` varchar(100) NOT NULL,
314 
-		  `web` varchar(250) default NULL,
315 
-		  `content` text NOT NULL,
316 
-		  `ip_user` varchar(50) NOT NULL,
317 
-		  `comment_date` datetime NOT NULL,
318 
-		  `spam` tinyint(4) NOT NULL,
319 
-		  PRIMARY KEY  (`id_comment`)
320 
-		) ENGINE = MYISAM ;";
321 
-
322 
-		$db->ejecutarConsulta($sqlStr);
323 
-
324 
-		$url_installation = (endsWith($url_installation, "/")) ? substr($url_installation, 0, strlen($url_installation)-1) : $url_installation ;
325 
-
326 
-		$sqlStr = "INSERT INTO `".Table_prefix."config` VALUES (".$posts_limit.", '".$title."', '".$description."', '".$lang."', '".$template."', '".$url_installation."');";
327 
-
328 
-		$db->ejecutarConsulta($sqlStr);
329 
-
330 
-		$sqlStr = "INSERT INTO `".Table_prefix."users` VALUES ('', '', '".$login."', '".md5($password)."', '".$email."', '".$website."', '".$about."');";
331 
-
332 
-		$db->ejecutarConsulta($sqlStr);
333 
-
334 
-		$sqlStr = "INSERT INTO `".Table_prefix."options` VALUES ('url_friendly', '1');";
335 
-
336 
-		$db->ejecutarConsulta($sqlStr);
337 
-
338 
-		$sqlStr = "INSERT INTO `".Table_prefix."options` VALUES ('rich_text', '0');";
339 
-
340 
-		$db->ejecutarConsulta($sqlStr);
341 
-
342 
-		$sqlStr = "INSERT INTO `".Table_prefix."options` VALUES ('allow_comments', '0');";
343 
-
344 
-		$db->ejecutarConsulta($sqlStr);
345 
-
346 
-		$sqlStr = "INSERT INTO `".Table_prefix."options` VALUES ('offset_city', '".$offset_city."');";
347 
-
348 
-		$db->ejecutarConsulta($sqlStr);
349 
-
350 
-		$sqlStr = "INSERT INTO `".Table_prefix."options` VALUES ('offset_time', '".$offset_time."');";
351 
-
352 
-		$db->ejecutarConsulta($sqlStr);
353 
-
354 
-		$db->cierraConexion();
355 
-		return true;
356 
-}
357 
-
358 
-function inerrors($errors,$n) {
359 
-	if (strpos($errors,$n)===false) {
360 
-		return false;
361 
-	} else {
362 
-		return true;
363 
-	}
364 
-}
365 
-
366 
-function mostrarerror($errors,$errors_d,$n) {
367 
-	if (inerrors($errors,$n)) {
368 
-		return '<span class="error">'.$errors_d[$n].'</span>';
369 
-	} else {
370 
-		return "";
371 
-	}
372 
-}
373 
-
374 
-function is_db_installed(){
375 
-
376 
-		$db = new Conexion_Mysql(DB_name, DB_Server, DB_User, DB_Password);
377 
-
378 
-		$sqlStr = "SELECT * FROM `".Table_prefix."config`";
379 
-
380 
-		$db->ejecutarConsulta($sqlStr);
381 
-
382 
-		return ($db->contarRegistros() > 0);
383 
-}
384 
-?>

+ 7 - 10
login.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry'))define('entry', true);
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

@@ -12,25 +13,21 @@
12 13 
 ?>
13 14 
 <?php
14 15 
 header("Cache-Control: no-cache, must-revalidate");
15 
-require( dirname(__FILE__) . '/config.php' );
16 
-include(dirname(__FILE__)."/classes/functions.php");
17 
-include(dirname(__FILE__)."/classes/user.class.php");
18 
-require_once(dirname(__FILE__)."/classes/configuration.class.php");
19 
-
20 
-$user = new user();
21 
-$conf = new configuration();
22 16
23 
-if ($user->isAdmin()) {
17 
+require_once('entry.php');
18 
+global $user, $conf;
19 
+
20 
+if ($user->isAuthenticated()) {
24 21 
 	header("Location: ".$conf->urlGelato."/admin/index.php");
25 22 
 } else {
26 23 
 	if (isset($_POST["pass"]) && isset($_POST["login"])) {
24 
+		//print "<pre>"; print_r($_SESSION); print "</pre>";die();
27 25 
 		if ($user->validateUser($_POST['login'], md5($_POST['pass']))) {
28 26 
 			header("Location: ".$conf->urlGelato."/admin/index.php");
29 27 
 		} else {
30 28 
 			header("Location: ".$conf->urlGelato."/login.php?error=1");
31 29 
 		}
32 
-	}
33 
-	else {
30 
+	} else {
34 31 
 ?>
35 32 
 	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
36 33 
 	<html xmlns="http://www.w3.org/1999/xhtml">

+ 1 - 0
rss.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry') || !entry) die('Not a valid page');
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

+ 1 - 0
update.php View File 

@@ -1,4 +1,5 @@
1 1 
 <?php
2 
+if(!defined('entry') || !entry) die('Not a valid page');
2 3 
 /* ===========================
3 4
4 5 
   gelato CMS - A PHP based tumblelog CMS

+ 1 - 1
uploads/index.php View File 

@@ -1,5 +1,5 @@
1 1 
 <?php
2 
-/* ===========================
2 
+if(!defined('entry') || !entry) die('Not a valid page'); /* ===========================
3 3
4 4 
   gelato CMS - A PHP based tumblelog CMS
5 5 
   development version