- Fixed FS#2936 - Please check and limit username input length.

ftimme

2013-06-08 fe9a23f542bc56c1c0b6dc30257418e38ff7bd3a

 interface/lib/app.inc.php

old mode 100644
new mode 100755
@@ -28,12 +28,20 @@
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

//* Enable gzip compression for the interface
ob_start('ob_gzhandler');

//* Set timezone
if(isset($conf['timezone']) && $conf['timezone'] != '') date_default_timezone_set($conf['timezone']);

//* Set error reporting level when we are not on a developer system
if(DEVSYSTEM == 0) {
   @ini_set('error_reporting', E_ALL & ~E_NOTICE & ~E_DEPRECATED);
}

/*
    Application Class
*/

ob_start('ob_gzhandler');

class app {

   private $_language_inc = 0;
@@ -73,7 +81,12 @@
         if(empty($_SESSION['s']['language'])) $_SESSION['s']['language'] = $conf['language'];
      }

      $this->uses('auth,plugin,functions');
        $this->uses('functions'); // we need this before all others!
      $this->uses('auth,plugin');
   }
	
   public function __destruct() {
      session_write_close();
   }

   public function uses($classes) {
@@ -107,7 +120,7 @@
      if($priority >= $this->_conf['log_priority']) {
         // $server_id = $conf["server_id"];
         $server_id = 0;
         $priority = intval($priority);
         $priority = $this->functions->intval($priority);
         $tstamp = time();
         $msg = $this->db->quote('[INTERFACE]: '.$msg);
         $this->db->query("INSERT INTO sys_log (server_id,datalog_id,loglevel,tstamp,message) VALUES ($server_id,0,$priority,$tstamp,'$msg')");
@@ -157,12 +170,14 @@

   /** Translates strings in current language */
   public function lng($text) {
      global $conf;
      if($this->_language_inc != 1) {
         $language = (isset($_SESSION['s']['language']))?$_SESSION['s']['language']:$conf['language'];
         //* loading global Wordbook
         $this->load_language_file('/lib/lang/'.$_SESSION['s']['language'].'.lng');
         $this->load_language_file('lib/lang/'.$language.'.lng');
         //* Load module wordbook, if it exists
         if(isset($_SESSION['s']['module']['name']) && isset($_SESSION['s']['language'])) {
            $lng_file = '/web/'.$_SESSION['s']['module']['name'].'/lib/lang/'.$_SESSION['s']['language'].'.lng';
         if(isset($_SESSION['s']['module']['name'])) {
            $lng_file = 'web/'.$_SESSION['s']['module']['name'].'/lib/lang/'.$language.'.lng';
            if(!file_exists(ISPC_ROOT_PATH.'/'.$lng_file)) $lng_file = '/web/'.$_SESSION['s']['module']['name'].'/lib/lang/en.lng';
            $this->load_language_file($lng_file);
         }
@@ -198,15 +213,24 @@
      $this->tpl->setVar('app_title', $this->_conf['app_title']);
      if(isset($_SESSION['s']['user'])) {
         $this->tpl->setVar('app_version', $this->_conf['app_version']);
            // get pending datalog changes
            $datalog = $this->db->datalogStatus();
            $this->tpl->setVar('datalog_changes_txt', $this->lng('datalog_changes_txt'));
            $this->tpl->setVar('datalog_changes_end_txt', $this->lng('datalog_changes_end_txt'));
            $this->tpl->setVar('datalog_changes_count', $datalog['count']);
            $this->tpl->setLoop('datalog_changes', $datalog['entries']);
      } else {
         $this->tpl->setVar('app_version', '');
      }
      $this->tpl->setVar('app_link', $this->_conf['app_link']);
      /*
      if(isset($this->_conf['app_logo']) && $this->_conf['app_logo'] != '' && @is_file($this->_conf['app_logo'])) {
         $this->tpl->setVar('app_logo', '<img src="'.$this->_conf['app_logo'].'">');
      } else {
         $this->tpl->setVar('app_logo', '&nbsp;');
      }
      */
      $this->tpl->setVar('app_logo', $this->_conf['logo']);

      $this->tpl->setVar('phpsessid', session_id());

@@ -227,7 +251,21 @@
      /* Show username */
      if(isset($_SESSION['s']['user'])) {
         $this->tpl->setVar('cpuser', $_SESSION['s']['user']['username']);
         $this->tpl->setVar('logout_txt', $this->lng('logout_txt'));
         /* Show search field only for normal users, not mail users */
         if(stristr($_SESSION['s']['user']['username'],'@')){
            $this->tpl->setVar('usertype', 'mailuser');
         } else {
            $this->tpl->setVar('usertype', 'normaluser');
         }
      }
		
      /* Global Search */
      $this->tpl->setVar('globalsearch_resultslimit_of_txt', $this->lng('globalsearch_resultslimit_of_txt'));
      $this->tpl->setVar('globalsearch_resultslimit_results_txt', $this->lng('globalsearch_resultslimit_results_txt'));
      $this->tpl->setVar('globalsearch_noresults_text_txt', $this->lng('globalsearch_noresults_text_txt'));
      $this->tpl->setVar('globalsearch_noresults_limit_txt', $this->lng('globalsearch_noresults_limit_txt'));
      $this->tpl->setVar('globalsearch_searchfield_watermark_txt', $this->lng('globalsearch_searchfield_watermark_txt'));
   }

} // end class
@@ -236,4 +274,4 @@
//* possible future =  new app($conf);
$app = new app();

?>
?>