jostreff/nsedit
1
0
Fork 0
mirror of https://github.com/tuxis-ie/nsedit.git synced 2025-04-18 19:59:30 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #195 from tuxis-ie/check-authdb-docroot

Browse source 
Simply check if authdb is in the docroot.
This commit is contained in:
Tuxis B.V 2020-12-23 13:14:48 +01:00 • committed by GitHub
commit 947ec4a67d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
index.php
View file

@ -4,11 +4,14 @@ include_once('includes/config.inc.php');
include_once('includes/session.inc.php');
include_once('includes/misc.inc.php');
$testpath = !empty(basename($_SERVER['REQUEST_URI'])) ? str_replace(basename($_SERVER['REQUEST_URI']), $authdb, $_SERVER['REQUEST_URI']) : '/' . $authdb;
$testurl = $_SERVER['REQUEST_SCHEME']."://".$_SERVER['HTTP_HOST'].$testpath;
global $errormsg, $blocklogin;
$docroot = $_SERVER['DOCUMENT_ROOT'];
if (preg_match("@$docroot@", $authdb) == 1) {
$blocklogin = TRUE;
$errormsg = "You authdb is in your document root and probably downloadable. Please move it to a safe location!";
}
if (isset($_GET['logout']) or isset($_POST['logout'])) {
logout();
header("Location: index.php");
@ -36,30 +39,6 @@ if (is_logged_in() and isset($_POST['formname']) and $_POST['formname'] === "cha
<html>
<head>
<title>NSEdit!</title>
<?php
if (is_logged_in()) {
?>
<script type="text/javascript">
var reader = new XMLHttpRequest();
var checkFor = "<?php echo $testpath; ?>";
reader.open('get', checkFor, true);
reader.onreadystatechange = checkReadyState;
function checkReadyState() {
if (reader.readyState === 4) {
//check to see whether request for the file failed or succeeded
if ((reader.status == 200) || (reader.status == 0)) {
alert('Your authdb is downloadable. Please secure your install');
} else {
return;
}
}
}
reader.send(null);
</script>
<?php
}
?>
<link href="jquery-ui/themes/base/all.css" rel="stylesheet" type="text/css"/>
<link href="jtable/lib/themes/metro/blue/jtable.min.css" rel="stylesheet" type="text/css"/>
<link href="css/base.css" rel="stylesheet" type="text/css"/>