Changeset 501

Timestamp:

09/23/08 13:02:15 (15 years ago)

Author:

Moe

Message:

Subscribe to comments 1.2.2 :

• fixed bug with nonce, it's now checked only when it's necessary
• fixed typo

Location:

plugins/subscribeToComments

Files:

• _define.php (modified) (1 diff)
• _public.php (modified) (6 diffs)
• class.subscriber.php (modified) (2 diffs)

plugins/subscribeToComments/_define.php

@@ -30 +30 @@
      /* Description*/                "Subscribe to comments",
      /* Author */                    "Moe (http://gniark.net/)",
-     /* Version */                   '1.2.1',
+     /* Version */                   '1.2.2',
      /* Permissions */               'admin'
 );

plugins/subscribeToComments/_public.php

@@ -55 +55 @@
                $session_id = session_id();
                if (empty($session_id)) {session_start();}
-     
-               # from /dotclear/inc/admin/prepend.php, modified
-               # Check nonce from POST requests
-               if ((!empty($_POST)) AND (count($_POST) > 0))
-               {
-                    # post but no nonce : when someone post a comment in a post with 
-                    # subscribetocomments in the URL
-                    if ((empty($_POST['subscribeToCommentsNonce'])) ||
-                         ($_POST['subscribeToCommentsNonce'] != 
-                              crypt::hmac(DC_MASTER_KEY,session_id()))
-                    )
-                    {
-                         http::head(412);
-                         header('Content-Type: text/html');
-                         echo 'Precondition Failed';
-                         echo '<br /><a href="'.subscribeToComments::url().'">Reload the page</a>';
-                         exit;
-                    }
-               }
-               # /from /dotclear/inc/admin/prepend.php, modified
-          
+               
+               $_ctx =& $GLOBALS['_ctx'];
+
                try {
                     subscribeToComments::cleanKeys();
@@ -85 +67 @@
      
                     if (isset($_POST['logout'])) {
+                         subscriber::checkNonce();
                          subscriber::logout();
                          subscribeToComments::redirect('loggedout');
@@ -99 +82 @@
                     elseif ((isset($_POST['subscribe'])) AND (isset($_POST['post_id'])))
                     {
+                         subscriber::checkNonce();
                          if (isset($_POST['email']))
                          {
@@ -118 +102 @@
                     elseif ((isset($_POST['resend'])) AND (isset($_POST['email'])))
                     {
+                         subscriber::checkNonce();
                          subscribeToComments::checkEmail($_POST['email']);
                          subscriber::resendInformations($_POST['email']);
@@ -130 +115 @@
                          subscribeToComments::redirect('updatedemail');
                     }
-
-                    $_ctx =& $GLOBALS['_ctx'];
 
                     # messages
@@ -167 +150 @@
                     if (subscriber::checkCookie())
                     {
-                         $subscriber = new subscriber(
-                         subscriber::getCookie('email'));
+                         $subscriber = new subscriber(subscriber::getCookie('email'));
                          $_ctx->subscribeToCommentsEmail = $subscriber->email;
           
                          if ((isset($_POST['requestChangeEmail'])) AND (isset($_POST['new_email'])))
                          {
+                              subscriber::checkNonce();
                               subscribeToComments::checkEmail($_POST['new_email']);
                               $subscriber->requestUpdateEmail($_POST['new_email']);
                               subscribeToComments::redirect('requestsent');     
                          }
-                         elseif ((isset($_POST['remove'])) AND (isset($_POST['entries']))) {
+                         elseif ((isset($_POST['remove'])) AND (isset($_POST['entries'])))
+                         {
+                              subscriber::checkNonce();
                               $subscriber->removeSubscription($_POST['entries']);
                               subscribeToComments::redirect('removedsubscriptions');
                          }
                          elseif (isset($_POST['deleteAccount'])) {
+                              subscriber::checkNonce();
                               $subscriber->deleteAccount();
                               subscribeToComments::redirect('accountdeleted');
                          }
                          elseif (isset($_POST['blockEmails'])) {
+                              subscriber::checkNonce();
                               $subscriber->blockEmails(true);
                               subscribeToComments::redirect('emailsblocked');
                          }
                          elseif (isset($_POST['allowEmails'])) {
+                              subscriber::checkNonce();
                               $subscriber->blockEmails(false);
                               subscribeToComments::redirect('emailsallowed');

plugins/subscribeToComments/class.subscriber.php

@@ -149 +149 @@
           $post = subscribeToComments::getPost($post_id);
 
-          if (subscribeToComments::getPost($_ctx->posts->post_id) == false)
+          if (subscribeToComments::getPost($post_id) == false)
           {throw new Exception(__('Invalid post.'));}
 
@@ -371 +371 @@
 
      /**
+     check nonce when a action is requested with $_POST
+     */
+     public static function checkNonce()
+     {
+          # from /dotclear/inc/admin/prepend.php, modified
+          if ((empty($_POST['subscribeToCommentsNonce'])) OR
+               ($_POST['subscribeToCommentsNonce'] != 
+                    crypt::hmac(DC_MASTER_KEY,session_id()))
+          )
+          {
+               http::head(412);
+               header('Content-Type: text/html');
+               echo 'Precondition Failed';
+               echo '<br /><a href="'.subscribeToComments::url().'">Reload the page</a>';
+               exit;
+          }
+     }
+
+     /**
      if emails are blocked
      @return <b>boolean</b>   Emails are blocked