harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

code_allowed is a real mess. Start the cleanup by remving the account level code allow and limiting to specific channels only. This reduces the possibility of cross channel security issues coming into play. Then provide a single function for checking the code permission. This is only partially done as we often need to check against the observer or logged in channel as well as the resource owner to ensure that this only returns true for local channels which also own the requested resource.

Browse Source
This commit is contained in:
zotlabs
2017-03-13 16:19:47 -07:00
committed by Mario Vavti
parent 107083e3e4
commit 0f7832dc30
7 changed files with 28 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
include/text.php
View File

@@ -104,15 +104,11 @@ function z_input_filter($channel_id,$s,$type = 'text/bbcode') {
return $s;
}
$r = q("select account_id, account_roles, channel_pageflags from account left join channel on channel_account_id = account_id where channel_id = %d limit 1",
$r = q("select channel_pageflags from channel where channel_id = %d limit 1",
intval($channel_id)
);
if($r) {
if(($r[0]['account_roles'] & ACCOUNT_ROLE_ALLOWCODE) || ($r[0]['channel_pageflags'] & PAGE_ALLOWCODE)) {
if(local_channel() && (get_account_id() == $r[0]['account_id'])) {
return $s;
}
}
if(($r) && (local_channel() == $channel_id) && ($r[0]['channel_pageflags'] & PAGE_ALLOWCODE)) {
return $s;
}
if($type === 'text/html')
@@ -1812,23 +1808,9 @@ function mimetype_select($channel_id, $current = 'text/bbcode') {
);
if(App::$is_sys) {
if((App::$is_sys) || (channel_codeallowed($channel_id) && $channel_id == local_channel())){
$x[] = 'application/x-php';
}
else {
$r = q("select account_id, account_roles, channel_pageflags from account left join channel on account_id = channel_account_id where
channel_id = %d limit 1",
intval($channel_id)
);
if($r) {
if(($r[0]['account_roles'] & ACCOUNT_ROLE_ALLOWCODE) || ($r[0]['channel_pageflags'] & PAGE_ALLOWCODE)) {
if(local_channel() && get_account_id() == $r[0]['account_id']) {
$x[] = 'application/x-php';
}
}
}
}
foreach($x as $y) {
$selected = (($y == $current) ? ' selected="selected" ' : '');