PHP COM_accessLog函数代码示例

/**
* Delete a block
*
* @param    string  $bid    id of block to delete
* @return   string          HTML redirect or error message
*
*/
function deleteBlock($bid)
{
    global $_CONF, $_TABLES, $_USER;
    $result = DB_query("SELECT owner_id,group_id,perm_owner,perm_group,perm_members,perm_anon FROM {$_TABLES['blocks']} WHERE bid ='{$bid}'");
    $A = DB_fetchArray($result);
    $access = SEC_hasAccess($A['owner_id'], $A['group_id'], $A['perm_owner'], $A['perm_group'], $A['perm_members'], $A['perm_anon']);
    if ($access < 3 || TOPIC_hasMultiTopicAccess('block', $bid) < 3) {
        COM_accessLog("User {$_USER['username']} tried to illegally delete block {$bid}.");
        return COM_refresh($_CONF['site_admin_url'] . '/block.php');
    }
    TOPIC_deleteTopicAssignments('block', $bid);
    DB_delete($_TABLES['blocks'], 'bid', $bid);
    $cacheInstance = 'block__' . $bid . '__';
    // remove any of this blocks instances if exists
    CACHE_remove_instance($cacheInstance);
    return COM_refresh($_CONF['site_admin_url'] . '/block.php?msg=12');
}

// |                                                                          |
// +--------------------------------------------------------------------------+
require_once '../lib-common.php';
require_once 'auth.inc.php';
require_once $_CONF['path_system'] . 'classes/menu.class.php';
require_once $_CONF['path_system'] . 'lib-menu.php';
USES_lib_admin();
$display = '';
$content = '';
$MenuElementAllowedHTML = "i[class|style],div[class|style],span[class|style],img[src|class|style],em,strong,del,ins,q,abbr,dfn,small";
// Only let admin users access this page
if (!SEC_hasRights('menu.admin')) {
    $display .= COM_siteHeader('menu', $MESSAGE[30]);
    $display .= COM_showMessageText($MESSAGE[37], $MESSAGE[30], true);
    $display .= COM_siteFooter();
    COM_accessLog("User {$_USER['username']} unauthorized user tried to access the menu editor screen.");
    echo $display;
    exit;
}
function MB_displayMenuList()
{
    global $_CONF, $_USER, $_TABLES, $LANG_MB01, $LANG_MB_ADMIN, $LANG_ADMIN, $LANG_MB_MENU_TYPES;
    $retval = '';
    $menuArray = array();
    $mbadmin = SEC_hasRights('menu.admin');
    $root = SEC_inGroup('Root');
    if (COM_isAnonUser()) {
        $uid = 1;
    } else {
        $uid = $_USER['uid'];
    }

// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the            |
// | GNU General Public License for more details.                             |
// |                                                                          |
// | You should have received a copy of the GNU General Public License        |
// | along with this program; if not, write to the Free Software Foundation,  |
// | Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.          |
// |                                                                          |
// +--------------------------------------------------------------------------+
require_once '../lib-common.php';
require_once 'auth.inc.php';
$display = '';
if (!SEC_hasrights('autotag.admin')) {
    $display .= COM_siteHeader('menu', $MESSAGE[30]);
    $display .= COM_showMessageText($MESSAGE[38], $MESSAGE[30], true);
    $display .= COM_siteFooter();
    COM_accessLog("User {$_USER['username']} attempted to access the autotag administration screen.");
    echo $display;
    exit;
}
USES_lib_install();
/**
* Main driver to handle the uploaded autotag
*
* Determines if a new style (supports automated installer) or
* an old style.
*
* @return   string              Formatted HTML containing the page body
*
*/
function processAutotagUpload()
{

     if (!empty($file)) {
         DBADMIN_download($file);
         exit;
     }
     break;
 case 'delete':
     if (isset($_POST['delitem']) && SEC_checkToken()) {
         foreach ($_POST['delitem'] as $delfile) {
             $file = preg_replace('/[^a-zA-Z0-9\\-_\\.]/', '', COM_applyFilter($delfile));
             $file = str_replace('..', '', $file);
             if (!@unlink($_CONF['backup_path'] . $file)) {
                 COM_errorLog('Unable to remove backup file "' . $file . '"');
             }
         }
     } else {
         COM_accessLog("User {$_USER['username']} tried to illegally delete database backup(s) and failed CSRF checks.");
         echo COM_refresh($_CONF['site_admin_url'] . '/index.php');
     }
     break;
 case 'config':
     $view = 'config';
     break;
 case 'saveconfig':
     $items = array();
     // Get the excluded tables into a serialized string
     $tables = explode('|', $_POST['groupmembers']);
     $items['lglib_dbback_exclude'] = DB_escapeString(@serialize($tables));
     $items['lglib_dbback_files'] = (int) $_POST['db_backup_maxfiles'];
     if (isset($_POST['disable_cron'])) {
         $str = '-1';
     } else {

// | but WITHOUT ANY WARRANTY; without even the implied warranty of            |
// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the             |
// | GNU General Public License for more details.                              |
// |                                                                           |
// | You should have received a copy of the GNU General Public License         |
// | along with this program; if not, write to the Free Software Foundation,   |
// | Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.           |
// |                                                                           |
// +---------------------------------------------------------------------------+
require_once '../../../lib-common.php';
require_once '../../auth.inc.php';
require_once $_CONF['path'] . 'plugins/downloads/include/functions.php';
if (!SEC_hasRights('downloads.edit')) {
    $display = COM_showMessageText($MESSAGE[29], $MESSAGE[30]);
    $display = DLM_createHTMLDocument($display, array('pagetitle' => $MESSAGE[30]));
    COM_accessLog("User {$_USER['username']} tried to illegally access the downloads temporary file.");
    COM_output($display);
    exit;
}
COM_setArgNames(array('id'));
$lid = addslashes(COM_applyFilter(COM_getArgument('id')));
$result = DB_query("SELECT url, date FROM {$_TABLES['downloadsubmission']} WHERE lid='{$lid}'");
list($url, $date) = DB_fetchArray($result);
$filepath = $_DLM_CONF['path_filestore'] . 'tmp' . date('YmdHis', $date) . DLM_createSafeFileName($url);
if (file_exists($filepath)) {
    header('Content-Disposition: attachment; filename="' . $url . '"');
    header('Content-Type: application/octet-stream');
    header('Content-Description: File Transfer');
    header('Content-Transfer-Encoding: binary');
    header('Expires: 0');
    header('Cache-Control: must-revalidate, post-check=0, pre-check=0');

function links_delete_category($cid)
{
    global $_TABLES, $LANG_LINKS_ADMIN;
    $cid = addslashes($cid);
    if (DB_count($_TABLES['linkcategories'], 'cid', $cid) > 0) {
        // item exists so check access rights
        $result = DB_query("SELECT owner_id,group_id,perm_owner,perm_group,\n            perm_members,perm_anon FROM {$_TABLES['linkcategories']}\n            WHERE cid='{$cid}'");
        $A = DB_fetchArray($result);
        $access = SEC_hasAccess($A['owner_id'], $A['group_id'], $A['perm_owner'], $A['perm_group'], $A['perm_members'], $A['perm_anon']);
        if ($access > 2) {
            // has edit rights
            // Check for subfolders and sublinks
            $sf = DB_count($_TABLES['linkcategories'], 'pid', $cid);
            $sl = DB_count($_TABLES['links'], 'cid', $cid);
            if ($sf == 0 && $sl == 0) {
                // No subfolder/links so OK to delete
                DB_delete($_TABLES['linkcategories'], 'cid', $cid);
                PLG_itemDeleted($cid, 'links.category');
                return 13;
            } else {
                // Subfolders and/or sublinks exist so return a message
                return 14;
            }
        } else {
            // no access
            return 15;
            COM_accessLog(sprintf($LANG_LINKS_ADMIN[46], $_USER['username']));
        }
    } else {
        // no such category
        return 16;
    }
}

/**
 * Return the current user status for a user.
 * NOTE:     May not return for banned/non-approved users.
 *
 * @param    int $userid Valid uid value.
 * @return   int            user status, 0-3
 */
function SEC_checkUserStatus($userid)
{
    global $_CONF, $_TABLES;
    // Check user status
    $status = DB_getItem($_TABLES['users'], 'status', "uid={$userid}");
    // only do redirects if we aren't on users.php in a valid mode (logout or
    // default)
    if (strpos($_SERVER['PHP_SELF'], 'users.php') === false) {
        $redirect = true;
    } else {
        if (empty($_REQUEST['mode']) || $_REQUEST['mode'] == 'logout') {
            $redirect = false;
        } else {
            $redirect = true;
        }
    }
    if ($status == USER_ACCOUNT_AWAITING_ACTIVATION) {
        DB_change($_TABLES['users'], 'status', USER_ACCOUNT_ACTIVE, 'uid', $userid);
    } elseif ($status == USER_ACCOUNT_AWAITING_APPROVAL) {
        // If we aren't on users.php with a default action then go to it
        if ($redirect) {
            COM_accessLog("SECURITY: Attempted Cookie Session login from user awaiting approval {$userid}.");
            COM_redirect($_CONF['site_url'] . '/users.php?msg=70');
        }
    } elseif ($status == USER_ACCOUNT_DISABLED) {
        if ($redirect) {
            COM_accessLog("SECURITY: Attempted Cookie Session login from banned user {$userid}.");
            COM_redirect($_CONF['site_url'] . '/users.php?msg=69');
        }
    }
    return $status;
}

/**
 * Delete an existing story
 *
 * @param   array   args    Contains all the data provided by the client
 * @param   string  &output OUTPUT parameter containing the returned text
 * @return  int         Response code as defined in lib-plugins.php
 */
function service_delete_story($args, &$output, &$svc_msg)
{
    global $_CONF, $_TABLES, $_USER;
    if (empty($args['sid']) && !empty($args['id'])) {
        $args['sid'] = $args['id'];
    }
    if ($args['gl_svc']) {
        $args['sid'] = COM_applyBasicFilter($args['sid']);
    }
    $sid = $args['sid'];
    $result = DB_query("SELECT owner_id,group_id,perm_owner,perm_group,perm_members,perm_anon FROM {$_TABLES['stories']} WHERE sid = '{$sid}'");
    $A = DB_fetchArray($result);
    $access = SEC_hasAccess($A['owner_id'], $A['group_id'], $A['perm_owner'], $A['perm_group'], $A['perm_members'], $A['perm_anon']);
    $access = min($access, TOPIC_hasMultiTopicAccess('article', $sid));
    if ($access < 3) {
        COM_accessLog("User {$_USER['username']} tried to illegally delete story {$sid}.");
        $output = COM_refresh($_CONF['site_admin_url'] . '/story.php');
        if ($_USER['uid'] > 1) {
            return PLG_RET_PERMISSION_DENIED;
        } else {
            return PLG_RET_AUTH_FAILED;
        }
    }
    STORY_doDeleteThisStoryNow($sid);
    $output = COM_refresh($_CONF['site_admin_url'] . '/story.php?msg=10');
    return PLG_RET_OK;
}

/**
* Delete a topic
*
* @param    string  $tid    Topic ID
* @return   string          HTML redirect
*
*/
function deleteTopic($tid)
{
    global $_CONF, $_TABLES, $_USER;
    $result = DB_query("SELECT owner_id,group_id,perm_owner,perm_group,perm_members,perm_anon FROM {$_TABLES['topics']} WHERE tid ='{$tid}'");
    $A = DB_fetchArray($result);
    $access = SEC_hasAccess($A['owner_id'], $A['group_id'], $A['perm_owner'], $A['perm_group'], $A['perm_members'], $A['perm_anon']);
    if ($access < 3) {
        COM_accessLog("User {$_USER['username']} tried to illegally delete topic {$tid}.");
        return COM_refresh($_CONF['site_admin_url'] . '/topic.php');
    }
    // don't delete topic blocks - assign them to 'all' and disable them
    DB_query("UPDATE {$_TABLES['blocks']} SET tid = 'all', is_enabled = 0 WHERE tid = '{$tid}'");
    // same with feeds
    DB_query("UPDATE {$_TABLES['syndication']} SET topic = '::all', is_enabled = 0 WHERE topic = '{$tid}'");
    // delete comments, trackbacks, images associated with stories in this topic
    $result = DB_query("SELECT sid FROM {$_TABLES['stories']} WHERE tid = '{$tid}'");
    $numStories = DB_numRows($result);
    for ($i = 0; $i < $numStories; $i++) {
        $A = DB_fetchArray($result);
        STORY_deleteImages($A['sid']);
        DB_delete($_TABLES['comments'], array('sid', 'type'), array($A['sid'], 'article'));
        DB_delete($_TABLES['trackback'], array('sid', 'type'), array($A['sid'], 'article'));
    }
    // delete these
    DB_delete($_TABLES['stories'], 'tid', $tid);
    DB_delete($_TABLES['storysubmission'], 'tid', $tid);
    DB_delete($_TABLES['topics'], 'tid', $tid);
    // update feed(s) and Older Stories block
    COM_rdfUpToDateCheck('article');
    COM_olderStuff();
    return COM_refresh($_CONF['site_admin_url'] . '/topic.php?msg=14');
}

            } else {
                $_POST['sp_centerblock'] = 0;
            }
            if ($sp_inblock == 'on') {
                $_POST['sp_inblock'] = 1;
            } else {
                $_POST['sp_inblock'] = 0;
            }
            $display .= PAGE_edit($sp_id, '', $editor);
            $display .= COM_siteFooter();
        }
        break;
    case 'delete':
        if (empty($sp_id) || is_numeric($sp_id) && $sp_id == 0) {
            COM_errorLog('Attempted to delete staticpage, sp_id empty or null, value =' . $sp_id);
            $display .= COM_refresh($_CONF['site_admin_url'] . '/plugins/staticpages/index.php');
        } elseif (SEC_checkToken()) {
            $args = array('sp_id' => $sp_id);
            PLG_invokeService('staticpages', 'delete', $args, $display, $svc_msg);
        } else {
            COM_accessLog("User {$_USER['username']} tried to illegally delete staticpage {$sp_id} and failed CSRF checks.");
            echo COM_refresh($_CONF['site_admin_url'] . '/index.php');
        }
        break;
    default:
        $display .= COM_siteHeader('menu', $LANG_STATIC['staticpagelist']);
        $display .= PAGE_list();
        $display .= COM_siteFooter();
        break;
}
echo $display;

/**
* Saves the user's information back to the database
*
* @param    array   $A  User's data
* @return   string      HTML error message or meta redirect
*
*/
function saveuser($A)
{
    global $_CONF, $_TABLES, $_USER, $LANG04, $LANG24, $_US_VERBOSE;
    if ($_US_VERBOSE) {
        COM_errorLog('**** Inside saveuser in usersettings.php ****', 1);
    }
    $reqid = DB_getItem($_TABLES['users'], 'pwrequestid', "uid = {$_USER['uid']}");
    if ($reqid != $A['uid']) {
        DB_change($_TABLES['users'], 'pwrequestid', "NULL", 'uid', $_USER['uid']);
        COM_accessLog("An attempt was made to illegally change the account information of user {$_USER['uid']}.");
        return COM_refresh($_CONF['site_url'] . '/index.php');
    }
    if (!isset($A['cooktime'])) {
        // If not set or possibly removed from template - set to default
        $A['cooktime'] = $_CONF['default_perm_cookie_timeout'];
    } else {
        $A['cooktime'] = COM_applyFilter($A['cooktime'], true);
    }
    // If empty or invalid - set to user default
    // So code after this does not fail the user password required test
    if ($A['cooktime'] < 0) {
        // note that == 0 is allowed!
        $A['cooktime'] = $_USER['cookietimeout'];
    }
    // to change the password, email address, or cookie timeout,
    // we need the user's current password
    $current_password = DB_getItem($_TABLES['users'], 'passwd', "uid = {$_USER['uid']}");
    if (!empty($A['passwd']) || $A['email'] != $_USER['email'] || $A['cooktime'] != $_USER['cookietimeout']) {
        if (empty($A['old_passwd']) || SEC_encryptPassword($A['old_passwd']) != $current_password) {
            return COM_refresh($_CONF['site_url'] . '/usersettings.php?msg=83');
        } elseif ($_CONF['custom_registration'] && function_exists('CUSTOM_userCheck')) {
            $ret = CUSTOM_userCheck($A['username'], $A['email']);
            if (!empty($ret)) {
                // Need a numeric return for the default message handler
                // - if not numeric use default message
                if (!is_numeric($ret['number'])) {
                    $ret['number'] = 400;
                }
                return COM_refresh("{$_CONF['site_url']}/usersettings.php?msg={$ret['number']}");
            }
        }
    } elseif ($_CONF['custom_registration'] && function_exists('CUSTOM_userCheck')) {
        $ret = CUSTOM_userCheck($A['username'], $A['email']);
        if (!empty($ret)) {
            // Need a numeric return for the default message handler
            // - if not numeric use default message
            if (!is_numeric($ret['number'])) {
                $ret['number'] = 400;
            }
            return COM_refresh("{$_CONF['site_url']}/usersettings.php?msg={$ret['number']}");
        }
    }
    // no need to filter the password as it's encoded anyway
    if ($_CONF['allow_username_change'] == 1) {
        $A['new_username'] = COM_applyFilter($A['new_username']);
        if (!empty($A['new_username']) && $A['new_username'] != $_USER['username']) {
            $A['new_username'] = addslashes($A['new_username']);
            if (DB_count($_TABLES['users'], 'username', $A['new_username']) == 0) {
                if ($_CONF['allow_user_photo'] == 1) {
                    $photo = DB_getItem($_TABLES['users'], 'photo', "uid = {$_USER['uid']}");
                    if (!empty($photo)) {
                        $newphoto = preg_replace('/' . $_USER['username'] . '/', $A['new_username'], $photo, 1);
                        $imgpath = $_CONF['path_images'] . 'userphotos/';
                        if (rename($imgpath . $photo, $imgpath . $newphoto) === false) {
                            $display = COM_siteHeader('menu', $LANG04[21]);
                            $display .= COM_errorLog('Could not rename userphoto "' . $photo . '" to "' . $newphoto . '".');
                            $display .= COM_siteFooter();
                            return $display;
                        }
                        DB_change($_TABLES['users'], 'photo', addslashes($newphoto), "uid", $_USER['uid']);
                    }
                }
                DB_change($_TABLES['users'], 'username', $A['new_username'], "uid", $_USER['uid']);
            } else {
                return COM_refresh($_CONF['site_url'] . '/usersettings.php?msg=51');
            }
        }
    }
    // a quick spam check with the unfiltered field contents
    $profile = '<h1>' . $LANG04[1] . ' ' . $_USER['username'] . '</h1>' . '<p>' . COM_createLink($A['homepage'], $A['homepage']) . '<br' . XHTML . '>' . $A['location'] . '<br' . XHTML . '>' . $A['sig'] . '<br' . XHTML . '>' . $A['about'] . '<br' . XHTML . '>' . $A['pgpkey'] . '</p>';
    $result = PLG_checkforSpam($profile, $_CONF['spamx']);
    if ($result > 0) {
        COM_displayMessageAndAbort($result, 'spamx', 403, 'Forbidden');
    }
    $A['email'] = COM_applyFilter($A['email']);
    $A['email_conf'] = COM_applyFilter($A['email_conf']);
    $A['homepage'] = COM_applyFilter($A['homepage']);
    // basic filtering only
    $A['fullname'] = strip_tags(COM_stripslashes($A['fullname']));
    $A['location'] = strip_tags(COM_stripslashes($A['location']));
    $A['sig'] = strip_tags(COM_stripslashes($A['sig']));
    $A['about'] = strip_tags(COM_stripslashes($A['about']));
    $A['pgpkey'] = strip_tags(COM_stripslashes($A['pgpkey']));
//.........这里部分代码省略.........

// | GNU General Public License for more details.                             |
// |                                                                          |
// | You should have received a copy of the GNU General Public License        |
// | along with this program; if not, write to the Free Software Foundation,  |
// | Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.          |
// |                                                                          |
// +--------------------------------------------------------------------------+
// Geeklog common function library
require_once '../lib-common.php';
// Security check to ensure user even belongs on this page
require_once 'auth.inc.php';
require_once $_CONF['path_system'] . 'lib-admin.php';
if (!SEC_inGroup('Root')) {
    $display .= COM_showMessageText($MESSAGE[29], $MESSAGE[30]);
    $display = COM_createHTMLDocument($display, array('pagetitle' => $MESSAGE[30]));
    COM_accessLog("User {$_USER['username']} tried to illegally access the log viewer screen.");
    COM_output($display);
    exit;
}
if (isset($_GET['log'])) {
    $log = COM_applyFilter($_GET['log']);
} elseif (isset($_POST['log'])) {
    $log = COM_applyFilter($_POST['log']);
} else {
    $log = '';
}
$log = COM_sanitizeFilename($log, true);
if (empty($log)) {
    $log = 'error.log';
}
$display = '';

/**
* Static Pages plugin administration page
*
* @package StaticPages
* @subpackage admin
*/
/**
* Geeklog common function library and Admin authentication
*/
require_once '../../../lib-common.php';
require_once '../../auth.inc.php';
$display = '';
if (!SEC_hasRights('staticpages.edit')) {
    $display .= COM_showMessageText($MESSAGE[29], $MESSAGE[30]);
    $display = COM_createHTMLDocument($display, array('pagetitle' => $MESSAGE[30]));
    COM_accessLog("User {$_USER['username']} tried to illegally access the static pages administration screen.");
    COM_output($display);
    exit;
}
/**
* Displays the static page editor form
*
* @param    array   $A      Data to display
* @return   string          HTML for the static page editor
*
*/
function staticpageeditor_form($A)
{
    global $_CONF, $_TABLES, $_USER, $_GROUPS, $_SP_CONF, $mode, $sp_id, $LANG21, $LANG_STATIC, $LANG_ACCESS, $LANG_ADMIN, $LANG01, $LANG24, $LANG_postmodes, $MESSAGE, $_IMAGE_TYPE, $_SCRIPTS;
    if (!empty($sp_id) && $mode == 'edit') {
        $access = SEC_hasAccess($A['owner_id'], $A['group_id'], $A['perm_owner'], $A['perm_group'], $A['perm_members'], $A['perm_anon']);

 /**
  * Returns a page for permission denied
  * 
  * @return  string HTML for permission denied page
  */
 function _UI_perm_denied()
 {
     global $_USER, $MESSAGE;
     $display = COM_siteHeader('menu', $MESSAGE[30]) . COM_showMessageText($MESSAGE[29], $MESSAGE[30]) . COM_siteFooter();
     COM_accessLog("User {$_USER['username']} tried to illegally access the config administration screen.");
     return $display;
 }

// +--------------------------------------------------------------------------+
// |                                                                          |
// | This program is free software; you can redistribute it and/or            |
// | modify it under the terms of the GNU General Public License              |
// | as published by the Free Software Foundation; either version 2           |
// | of the License, or (at your option) any later version.                   |
// |                                                                          |
// | This program is distributed in the hope that it will be useful,          |
// | but WITHOUT ANY WARRANTY; without even the implied warranty of           |
// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the            |
// | GNU General Public License for more details.                             |
// |                                                                          |
// | You should have received a copy of the GNU General Public License        |
// | along with this program; if not, write to the Free Software Foundation,  |
// | Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.          |
// |                                                                          |
// +--------------------------------------------------------------------------+
require_once '../lib-common.php';
$display = '';
if (!SEC_inGroup('Root')) {
    $display .= COM_showMessageText($MESSAGE[29], $MESSAGE[30]);
    $display = COM_createHTMLDocument($display, array('pagetitle' => $MESSAGE[30]));
    COM_accessLog("User {$_USER['username']} tried to illegally access the clear cache.");
    COM_output($display);
    exit;
}
/*
 * Main processing
 */
CTL_clearCache();
COM_redirect($_CONF['site_admin_url'] . '/index.php?msg=500');