Skip to content

Commit ab2e802

Browse files
gn36gn36
committed
Edit permissions for pastebin, cleanup
1 parent 7bbd206 commit ab2e802

10 files changed

Lines changed: 336 additions & 108 deletions

File tree

‎composer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"type": "phpbb-extension",
44
"description": "Provides a pastebin including syntax highlighting",
55
"homepage": "https://www.phpbb.de/community/",
6-
"version": "1.0.0",
6+
"version": "1.0.0-dev",
77
"time": "2015-01-03",
88
"license": "GPL-2.0",
99
"authors": [

‎config/services.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,16 @@ parameters:
55
phpbbde.pastebin.cron.prune_interval: 86400
66
tables.phpbbde.pastebin.pastebin: %core.table_prefix%pastebin
77
services:
8+
phpbbde.pastebin.functions.utility:
9+
class: phpbbde\pastebin\functions\utility
10+
arguments:
11+
- %phpbbde.pastebin.geshilangs%
812
phpbbde.pastebin.functions.pastebin:
913
class: phpbbde\pastebin\functions\pastebin
1014
arguments:
11-
- %phpbbde.pastebin.geshilangs%
15+
- @dbal.conn
16+
- @user
17+
- %tables.phpbbde.pastebin.pastebin%
1218
phpbbde.pastebin.controller.main:
1319
class: phpbbde\pastebin\controller\main
1420
arguments:
@@ -21,6 +27,7 @@ services:
2127
- @user
2228
- @controller.helper
2329
- @captcha.factory
30+
- @phpbbde.pastebin.functions.utility
2431
- @phpbbde.pastebin.functions.pastebin
2532
- %core.root_path%
2633
- %core.php_ext%

‎controller/main.php‎

Lines changed: 69 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ class main
5454
/** @var \phpbbde\pastebin\functions\pastebin */
5555
protected $pastebin;
5656

57+
/** @var \phpbbde\pastebin\functions\utility */
58+
protected $util;
59+
5760
/** @var \phpbb\captcha\factory */
5861
protected $captcha_factory;
5962

@@ -77,10 +80,11 @@ class main
7780
* @param \phpbb\user $user
7881
* @param \phpbb\controller\helper $helper
7982
* @param \phpbbde\pastebin\functions\pastebin $pastebin
83+
* @param \phpbbde\pastebin\functions\utility $util
8084
* @param string $root_path
8185
* @param string $php_ext
8286
*/
83-
public function __construct(\phpbb\auth\auth $auth, \phpbb\cache\service $cache, \phpbb\config\config $config, \phpbb\request\request $request, \phpbb\db\driver\driver_interface $db, \phpbb\template\template $template, \phpbb\user $user, \phpbb\controller\helper $helper, \phpbb\captcha\factory $captcha_factory, \phpbbde\pastebin\functions\pastebin $pastebin, $root_path, $php_ext, $geshi_path, $geshi_lang, $pastebin_table)
87+
public function __construct(\phpbb\auth\auth $auth, \phpbb\cache\service $cache, \phpbb\config\config $config, \phpbb\request\request $request, \phpbb\db\driver\driver_interface $db, \phpbb\template\template $template, \phpbb\user $user, \phpbb\controller\helper $helper, \phpbb\captcha\factory $captcha_factory, \phpbbde\pastebin\functions\utility $util, \phpbbde\pastebin\functions\pastebin $pastebin, $root_path, $php_ext, $geshi_path, $geshi_lang, $pastebin_table)
8488
{
8589
$this->auth = $auth;
8690
$this->cache = $cache;
@@ -93,6 +97,7 @@ public function __construct(\phpbb\auth\auth $auth, \phpbb\cache\service $cache,
9397
$this->root_path = $root_path;
9498
$this->php_ext = $php_ext;
9599
$this->pastebin = $pastebin;
100+
$this->util = $util;
96101
$this->captcha_factory = $captcha_factory;
97102

98103
$this->geshi_path = $geshi_path;
@@ -140,7 +145,7 @@ private function table($name)
140145
*/
141146
private function display_pb()
142147
{
143-
$pastebin = $this->pastebin;
148+
$util = $this->util;
144149
$template = $this->template;
145150
$db = $this->db;
146151
$auth = $this->auth;
@@ -150,8 +155,43 @@ private function display_pb()
150155
$mode = $this->request->variable('mode', '');
151156
$confirm_id = $this->request->variable('confirm_id', '');
152157
$confirm_code = $this->request->variable('confirm_code', '');
158+
$snippet_id = $this->request->variable('s', 0);
153159
$submit = isset($_POST['submit']) ? true : false;
154160

161+
if(in_array($mode, array('view', 'download', 'moderate')))
162+
{
163+
// for all of these we have to check if the entry exists
164+
165+
$sql = $db->sql_build_query('SELECT', array(
166+
'SELECT' => 'pb.*, u.user_id, u.username, u.user_colour',
167+
'FROM' => array(
168+
$this->table('pastebin') => 'pb',
169+
USERS_TABLE => 'u',
170+
),
171+
'WHERE' => "pb.snippet_author = u.user_id AND pb.snippet_id = $snippet_id",
172+
));
173+
$result = $db->sql_query($sql);
174+
$data = $db->sql_fetchrow($result);
175+
$db->sql_freeresult($result);
176+
177+
if (!$data)
178+
{
179+
$message = $user->lang['NO_VALID_SNIPPET'];
180+
$message .= '<br /><br />';
181+
$message .= sprintf($user->lang['RETURN_PASTEBIN'], '<a href="' . $this->helper->route('phpbbde_pastebin_main_controller') . '">', '</a>');
182+
183+
trigger_error($message);
184+
}
185+
186+
$this->pastebin->load_from_array($data);
187+
$snippet = $this->pastebin;
188+
189+
$this->template->assign_vars(array(
190+
'S_AUTH_EDIT' => ($auth->acl_get('m_pastebin_edit') || ($auth->acl_get('u_pastebin_edit') && $snippet['snippet_author'] == $this->user->data['user_id'])) ? true : false,
191+
'S_AUTH_DELETE' => ($auth->acl_get('m_pastebin_delete') || ($auth->acl_get('u_pastebin_delete') && $snippet['snippet_author'] == $this->user->data['user_id'])) ? true : false,
192+
));
193+
}
194+
155195
// Some default values
156196
$error = $s_hidden_fields = array();
157197

@@ -188,10 +228,9 @@ private function display_pb()
188228

189229
'S_AUTH_VIEW' => ($auth->acl_get('u_pastebin_view')) ? true : false,
190230
'S_AUTH_POST' => ($auth->acl_get('u_pastebin_post')) ? true : false,
191-
'S_AUTH_EDIT' => ($auth->acl_get('m_pastebin_edit')) ? true : false,
192-
'S_AUTH_DELETE' => ($auth->acl_get('m_pastebin_delete')) ? true : false,
193231
));
194232

233+
195234
// Now let's decide what to do
196235
switch ($mode)
197236
{
@@ -229,7 +268,7 @@ private function display_pb()
229268
$error[] = $user->lang['ERR_NO_TITLE'];
230269
}
231270

232-
if (!$pastebin->geshi_check($data['snippet_highlight']))
271+
if (!$util->geshi_check($data['snippet_highlight']))
233272
{
234273
$data['snippet_highlight'] = 'text';
235274
}
@@ -325,30 +364,9 @@ private function display_pb()
325364
case 'download':
326365
case 'moderate':
327366

328-
// for all of these we have to check if the entry exists
329367

330-
$snippet_id = $this->request->variable('s', 0);
331368

332-
$sql = $db->sql_build_query('SELECT', array(
333-
'SELECT' => 'pb.*, u.user_id, u.username, u.user_colour',
334-
'FROM' => array(
335-
$this->table('pastebin') => 'pb',
336-
USERS_TABLE => 'u',
337-
),
338-
'WHERE' => "pb.snippet_author = u.user_id AND pb.snippet_id = $snippet_id",
339-
));
340-
$result = $db->sql_query($sql);
341-
$data = $db->sql_fetchrow($result);
342-
$db->sql_freeresult($result);
343369

344-
if (!$data)
345-
{
346-
$message = $user->lang['NO_VALID_SNIPPET'];
347-
$message .= '<br /><br />';
348-
$message .= sprintf($user->lang['RETURN_PASTEBIN'], '<a href="' . $this->helper->route('phpbbde_pastebin_main_controller') . '">', '</a>');
349-
350-
trigger_error($message);
351-
}
352370

353371
if ($mode == 'view')
354372
{
@@ -363,7 +381,7 @@ private function display_pb()
363381

364382
$highlight = (isset($_REQUEST['highlight'])) ? $this->request->variable('highlight', '') : $data['snippet_highlight'];
365383

366-
if (!$pastebin->geshi_check($highlight))
384+
if (!$util->geshi_check($highlight))
367385
{
368386
$highlight = 'php';
369387
}
@@ -374,7 +392,7 @@ private function display_pb()
374392

375393
$code = htmlspecialchars_decode($snippet_text);
376394

377-
$geshi = new \GeSHi($code, $highlight, $pastebin->geshi_dir);
395+
$geshi = new \GeSHi($code, $highlight, $util->geshi_dir);
378396
$geshi->set_header_type(GESHI_HEADER_NONE);
379397
$geshi->enable_line_numbers(GESHI_NORMAL_LINE_NUMBERS, 100);
380398

@@ -400,7 +418,7 @@ private function display_pb()
400418
'SNIPPET_AUTHOR_FULL' => get_username_string('full', $data['user_id'], $data['username'], $data['user_colour']),
401419
'SNIPPET_DATE' => $user->format_date($data['snippet_time']),
402420

403-
'HIGHLIGHT_SELECT_MOD' => $pastebin->highlight_select($data['snippet_highlight']),
421+
'HIGHLIGHT_SELECT_MOD' => $util->highlight_select($data['snippet_highlight']),
404422
'DOWNLOAD_SNIPPET_EXPLAIN' => sprintf($user->lang['DOWNLOAD_SNIPPET_EXPLAIN'], '<a href="' . $snippet_download_url . '">', '</a>'),
405423

406424
'U_SNIPPET' => $this->helper->route('phpbbde_pastebin_main_controller', array("mode" => "view", "s" => $data['snippet_id'])),
@@ -453,11 +471,15 @@ private function display_pb()
453471
else if ($mode == 'moderate')
454472
{
455473
$delete = (isset($_POST['delete_snippet'])) ? true : false;
456-
$prunable = (isset($_POST['snippet_prunable'])) ? true : false;
457474
$highlight = $this->request->variable('snippet_highlight', '');
458-
$pruning_months = max(1, min(6, $this->request->variable('pruning_months', 0)));
475+
$pruning_months = $this->request->variable('pruning_months', 0);
476+
$prunable = $pruning_months != -1;
459477

460-
if (!$auth->acl_get('m_pastebin_edit') || ($delete && !$auth->acl_get('m_pastebin_delete')))
478+
$auth_edit = ($auth->acl_get('m_pastebin_edit') || ($auth->acl_get('u_pastebin_edit') && $this->user->data['user_id'] == $snippet['snippet_author']));
479+
$auth_delete = ($auth->acl_get('m_pastebin_delete') || ($auth->acl_get('u_pastebin_delete') && $this->user->data['user_id'] == $snippet['snippet_author']));
480+
481+
// Generic permissions check
482+
if (!$auth_edit && !$auth_delete)
461483
{
462484
trigger_error('PASTEBIN_AUTH_NO_VIEW');
463485
}
@@ -468,7 +490,7 @@ private function display_pb()
468490
redirect($this->helper->route('phpbbde_pastebin_main_controller', array("mode"=>"view","s"=>$snippet_id)));
469491
}
470492

471-
if ($delete)
493+
if ($delete && $auth_delete)
472494
{
473495
// Confirm box
474496
if (!confirm_box(true))
@@ -478,21 +500,25 @@ private function display_pb()
478500
}
479501
else
480502
{
481-
$sql = 'DELETE FROM ' . $this->table('pastebin') . '
482-
WHERE snippet_id = ' . $snippet_id;
503+
$snippet->delete();
483504
$redirect_append = array();
484505
}
485506
}
486-
else
507+
else if($auth_edit)
487508
{
488-
$sql = 'UPDATE ' . $this->table('pastebin') . ' SET ' . $db->sql_build_array('UPDATE', array(
489-
'snippet_prunable' => (int) $prunable,
490-
'snippet_highlight' => $highlight,
491-
'snippet_prune_on' => $row['snippet_time'] + ($pruning_months * $this::SECONDS_MONTH),
492-
)) . ' WHERE snippet_id = ' . $snippet_id;
509+
$snippet->load_from_array(array(
510+
'snippet_prunable' => (int) $prunable,
511+
'snippet_highlight' => $highlight,
512+
'snippet_prune_on' => $data['snippet_time'] + ($pruning_months * $this::SECONDS_MONTH),
513+
));
514+
$snippet->submit();
515+
493516
$redirect_append = array("mode"=>"view","s"=>$snippet_id);
494517
}
495-
$db->sql_query($sql);
518+
else
519+
{
520+
trigger_error('PASTEBIN_NOT_AUTH_EDIT');
521+
}
496522

497523
$redirect_url = $this->helper->route('phpbbde_pastebin_main_controller', $redirect_append);
498524

@@ -566,7 +592,7 @@ private function display_pb()
566592
{
567593
$highlight = isset($data['snippet_highlight']) ? $data['snippet_highlight'] : 'php';
568594
}
569-
$highlight_select = $pastebin->highlight_select($highlight);
595+
$highlight_select = $util->highlight_select($highlight);
570596

571597
add_form_key('pastebinform');
572598

‎event/acp_events.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ public function add_permissions($event)
5050
'u_pastebin_post' => array('lang' => 'ACL_U_PASTEBIN_POST', 'cat' => 'pastebin'),
5151
'u_pastebin_post_novc' => array('lang' => 'ACL_U_PASTEBIN_POST_NOVC', 'cat' => 'pastebin'),
5252
'u_pastebin_post_notlim' => array('lang' => 'ACL_U_PASTEBIN_POST_NOTLIM', 'cat' => 'pastebin'),
53+
'u_pastebin_edit' => array('lang' => 'ACL_U_PASTEBIN_EDIT', 'cat' => 'pastebin'),
54+
'u_pastebin_delete' => array('lang' => 'ACL_U_PASTEBIN_DELETE', 'cat' => 'pastebin'),
5355

5456
// Moderator perms
5557
'm_pastebin_edit' => array('lang' => 'ACL_M_PASTEBIN_EDIT', 'cat' => 'pastebin'),

0 commit comments

Comments
 (0)