PHP require_privs函数代码示例

function article_event($event, $step)
{
    require_privs('article');
    $save = gps('save');
    if ($save) {
        $step = 'save';
    }
    $publish = gps('publish');
    if ($publish) {
        $step = 'publish';
    }
    switch (strtolower($step)) {
        case "":
            article_edit();
            break;
        case "create":
            article_edit();
            break;
        case "publish":
            article_post();
            break;
        case "edit":
            article_edit();
            break;
        case "save":
            article_save();
            break;
    }
}

function send_password($RealName, $name, $email, $password)
{
    global $sitename;
    require_privs('admin.edit');
    $message = gTxt('greeting') . ' ' . $RealName . ',' . n . n . gTxt('you_have_been_registered') . ' ' . $sitename . n . n . gTxt('your_login_is') . ': ' . $name . n . gTxt('your_password_is') . ': ' . $password . n . n . gTxt('log_in_at') . ': ' . hu . 'textpattern/index.php';
    return txpMail($email, "[{$sitename}] " . gTxt('your_login_info'), $message);
}

 /**
  * Dispatch the invoked handler by looking into the global $step
  */
 static function dispatch()
 {
     global $step;
     require_privs(__CLASS__);
     switch ($step) {
         case 'my_name_is':
             self::my_name_is();
             break;
         case 'say_hi':
             self::say_hi();
             break;
         default:
             self::ui();
             break;
     }
 }

function _sed_article_copyright_callback($event, $step)
{
    if (!empty($event) and $event != 'article') {
        return;
    }
    require_privs('article');
    $save = gps('save');
    if ($save) {
        $step = 'save';
    }
    $publish = gps('publish');
    if ($publish) {
        $step = 'publish';
    }
    switch (strtolower($step)) {
        case 'publish':
        case 'delete':
        case 'save':
            _update_cache();
    }
}

/**
 * Emails a new user with account details and requests they set a password.
 *
 * @param  string $name     The login name
 * @return bool FALSE on error.
 */
function send_account_activation($name)
{
    global $sitename;
    require_privs('admin.edit');
    $rs = safe_row("user_id, email, nonce, RealName, pass", 'txp_users', "name = '" . doSlash($name) . "'");
    if ($rs) {
        extract($rs);
        $uid = assert_int($user_id);
        // The selector becomes an indirect reference to the txp_users row,
        // which does not leak information.
        $selector = Txp::get('\\Textpattern\\Password\\Random')->generate(12);
        $expiryTimestamp = time() + 60 * 60 * ACTIVATION_EXPIRY_HOURS;
        $expiryYear = safe_strftime('%Y', $expiryTimestamp);
        $expiryMonth = safe_strftime('%B', $expiryTimestamp);
        $expiryDay = safe_strftime('%Oe', $expiryTimestamp);
        $expiryTime = safe_strftime('%H:%M', $expiryTimestamp);
        $expiry = strftime('%Y-%m-%d %H:%M:%S', $expiryTimestamp);
        // Use a hash of the nonce, selector and (temporary, already discarded) password.
        // This ensures that activation requests expire automatically when:
        //  a) The person logs in, or
        //  b) They successfully set their password
        // Using the selector in the hash just injects randomness, otherwise two requests
        // back-to-back would generate the same activation code.
        // Old activation tokens for the same user id are purged when password is set.
        $token = bin2hex(pack('H*', substr(hash(HASHING_ALGORITHM, $nonce . $selector . $pass), 0, SALT_LENGTH)));
        $activation_code = $token . $selector;
        // Remove any previous activation tokens and insert the new one.
        safe_delete("txp_token", "reference_id = {$uid} AND type = 'account_activation'");
        safe_insert("txp_token", "reference_id = {$uid},\n                type = 'account_activation',\n                selector = '" . doSlash($selector) . "',\n                token = '" . doSlash($token) . "',\n                expires = '" . doSlash($expiry) . "'\n            ");
        $message = gTxt('salutation', array('{name}' => $RealName)) . n . n . gTxt('you_have_been_registered') . ' ' . $sitename . n . n . gTxt('your_login_is') . ': ' . $name . n . n . gTxt('account_activation_confirmation') . n . hu . 'textpattern/index.php?activate=' . $activation_code . n . n . gTxt('link_expires', array('{year}' => $expiryYear, '{month}' => $expiryMonth, '{day}' => $expiryDay, '{time}' => $expiryTime));
        if (txpMail($email, "[{$sitename}] " . gTxt('account_activation'), $message)) {
            return gTxt('login_sent_to', array('{email}' => $email));
        } else {
            return array(gTxt('could_not_mail'), E_ERROR);
        }
    }
}

function ign_manageUsers($event, $step)
{
    global $ign_user_db, $ign_user, $txp_user, $myprivs, $ign_levels;
    if ($event == 'ign_user_mgmt') {
        require_privs('article.publish');
        $myprivs = fetch('privs', 'txp_users', 'name', $txp_user);
        if (!$step or !in_array($step, array('ign_admin', 'ign_user_delete', 'ign_userList', 'ign_userSave', 'ign_userSaveNew', 'ign_changeEmail', 'ign_changePass', 'ign_update_prefs', 'ign_userChangePass'))) {
            ign_admin();
        } else {
            $step();
        }
    }
}

/**
 * Processes multi-edit actions.
 *
 * Accessing requires 'admin.edit' privileges.
 */
function admin_multi_edit()
{
    global $txp_user;
    require_privs('admin.edit');
    $selected = ps('selected');
    $method = ps('edit_method');
    $changed = array();
    $msg = '';
    if (!$selected or !is_array($selected)) {
        return author_list();
    }
    $names = safe_column('name', 'txp_users', "name IN (" . join(',', quote_list($selected)) . ") AND name != '" . doSlash($txp_user) . "'");
    if (!$names) {
        return author_list();
    }
    switch ($method) {
        case 'delete':
            $assign_assets = ps('assign_assets');
            if (!$assign_assets) {
                $msg = array('must_reassign_assets', E_ERROR);
            } elseif (in_array($assign_assets, $names)) {
                $msg = array('cannot_assign_assets_to_deletee', E_ERROR);
            } elseif (remove_user($names, $assign_assets)) {
                $changed = $names;
                callback_event('authors_deleted', '', 0, $changed);
                $msg = 'author_deleted';
            }
            break;
        case 'changeprivilege':
            if (change_user_group($names, ps('privs'))) {
                $changed = $names;
                $msg = 'author_updated';
            }
            break;
        case 'resetpassword':
            foreach ($names as $name) {
                $passwd = generate_password(PASSWORD_LENGTH);
                if (change_user_password($name, $passwd)) {
                    $email = safe_field('email', 'txp_users', "name = '" . doSlash($name) . "'");
                    if (send_new_password($passwd, $email, $name)) {
                        $changed[] = $name;
                        $msg = 'author_updated';
                    } else {
                        return author_list(array(gTxt('could_not_mail') . ' ' . txpspecialchars($name), E_ERROR));
                    }
                }
            }
            break;
    }
    if ($changed) {
        return author_list(gTxt($msg, array('{name}' => txpspecialchars(join(', ', $changed)))));
    }
    author_list($msg);
}

function admin_multi_edit()
{
    global $txp_user;
    require_privs('admin.edit');
    $selected = ps('selected');
    $method = ps('edit_method');
    $changed = array();
    if (!$selected or !is_array($selected)) {
        return author_list();
    }
    $names = safe_column('name', 'txp_users', "name IN ('" . join("','", doSlash($selected)) . "') AND name != '" . doSlash($txp_user) . "'");
    if (!$names) {
        return author_list();
    }
    switch ($method) {
        case 'delete':
            $assign_assets = ps('assign_assets');
            if ($assign_assets === '') {
                $msg = array('must_reassign_assets', E_ERROR);
            } elseif (in_array($assign_assets, $names)) {
                $msg = array('cannot_assign_assets_to_deletee', E_ERROR);
            } elseif (safe_delete('txp_users', "name IN ('" . join("','", doSlash($names)) . "')")) {
                $changed = $names;
                $assign_assets = doSlash($assign_assets);
                $names = join("','", doSlash($names));
                // delete private prefs
                safe_delete('txp_prefs', "user_name IN ('{$names}')");
                // assign dangling assets to their new owner
                $reassign = array('textpattern' => 'AuthorID', 'txp_file' => 'author', 'txp_image' => 'author', 'txp_link' => 'author');
                foreach ($reassign as $table => $col) {
                    safe_update($table, "{$col}='{$assign_assets}'", "{$col} IN ('{$names}')");
                }
                callback_event('authors_deleted', '', 0, $changed);
                $msg = 'author_deleted';
            }
            break;
        case 'changeprivilege':
            global $levels;
            $privilege = ps('privs');
            if (!isset($levels[$privilege])) {
                return author_list();
            }
            if (safe_update('txp_users', 'privs = ' . intval($privilege), "name IN ('" . join("','", doSlash($names)) . "')")) {
                $changed = $names;
                $msg = 'author_updated';
            }
            break;
        case 'resetpassword':
            $failed = array();
            foreach ($names as $name) {
                $passwd = generate_password(PASSWORD_LENGTH);
                $hash = doSlash(txp_hash_password($passwd));
                if (safe_update('txp_users', "pass = '{$hash}'", "name = '" . doSlash($name) . "'")) {
                    $email = safe_field('email', 'txp_users', "name = '" . doSlash($name) . "'");
                    if (send_new_password($passwd, $email, $name)) {
                        $changed[] = $name;
                        $msg = 'author_updated';
                    } else {
                        return author_list(array(gTxt('could_not_mail') . ' ' . txpspecialchars($name), E_ERROR));
                    }
                }
            }
            break;
    }
    if ($changed) {
        return author_list(gTxt($msg, array('{name}' => txpspecialchars(join(', ', $changed)))));
    }
    author_list($msg);
}

<?php

/*
$HeadURL$
$LastChangedRevision$
*/
if (!defined('txpinterface')) {
    die('txpinterface is undefined.');
}
if ($event == 'css') {
    require_privs('css');
    switch ($step) {
        case '':
            css_edit();
            break;
        case 'css_edit_raw':
            css_edit();
            break;
        case 'css_edit_form':
            css_edit();
            break;
        case 'pour':
            css_edit();
            break;
        case 'css_save':
            css_save();
            break;
        case 'css_copy':
            css_copy();
            break;
        case 'css_save_as':

 *
 * You should have received a copy of the GNU General Public License
 * along with Textpattern. If not, see <http://www.gnu.org/licenses/>.
 */
/**
 * Languages panel.
 *
 * @package Admin\Lang
 * @since   4.6.0
 */
if (!defined('txpinterface')) {
    die('txpinterface is undefined.');
}
include_once txpath . '/lib/txplib_update.php';
if ($event == 'lang') {
    require_privs('lang');
    $available_steps = array('get_language' => true, 'get_textpack' => true, 'remove_language' => true, 'save_language' => true, 'list_languages' => false);
    if ($step && bouncer($step, $available_steps)) {
        $step();
    } else {
        list_languages();
    }
}
/**
 * Generate a &lt;select&gt; element of installed languages.
 *
 * @param  string $name The HTML name and ID to assign to the select control
 * @param  string $val  The currently active language identifier (en-gb, fr-fr, ...)
 * @return string HTML
 */
function languages($name, $val)

	This is Textpattern
	Copyright 2005 by Dean Allen
	www.textpattern.com
	All rights reserved
	Use of this software indicates acceptance of the Textpattern license agreement
$HeadURL: http://textpattern.googlecode.com/svn/development/4.0/textpattern/include/txp_form.php $
$LastChangedRevision: 3118 $
*/
if (!defined('txpinterface')) {
    die('txpinterface is undefined.');
}
global $vars;
$vars = array('Form', 'type', 'name', 'savenew', 'oldname');
$essential_forms = array('comments', 'comments_display', 'comment_form', 'default', 'Links', 'files');
if ($event == 'form') {
    require_privs('form');
    if (!$step or !in_array($step, array('form_list', 'form_create', 'form_delete', 'form_edit', 'form_multi_edit', 'form_save'))) {
        form_edit();
    } else {
        $step();
    }
}
// -------------------------------------------------------------
function form_list($curname)
{
    global $step, $essential_forms;
    $out[] = startTable('list');
    $out[] = tr(tda(sLink('form', 'form_create', gTxt('create_new_form')), ' colspan="3" style="height:30px"'));
    $out[] = assHead('form', 'type', '');
    $methods = array('delete' => gTxt('delete'));
    $rs = safe_rows_start("*", "txp_form", "1 order by type asc, name asc");

/*
	This is Textpattern
	Copyright 2005 by Dean Allen
	www.textpattern.com
	All rights reserved
	Use of this software indicates acceptance of
	the Textpattern license agreement
$HeadURL: https://textpattern.googlecode.com/svn/releases/4.4.0/source/textpattern/include/txp_log.php $
$LastChangedRevision: 3374 $
*/
if (!defined('txpinterface')) {
    die('txpinterface is undefined.');
}
if ($event == 'log') {
    require_privs('log');
    if (!$step or !in_array($step, array('log_list', 'log_change_pageby', 'log_multi_edit'))) {
        $step = 'log_list';
    }
    $step();
}
//-------------------------------------------------------------
function log_list($message = '')
{
    global $event, $log_list_pageby, $expire_logs_after;
    pagetop(gTxt('visitor_logs'), $message);
    extract(gpsa(array('page', 'sort', 'dir', 'crit', 'search_method')));
    if ($sort === '') {
        $sort = get_pref('log_sort_column', 'time');
    }
    if ($dir === '') {

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with Textpattern. If not, see <http://www.gnu.org/licenses/>.
 */
/**
 * Preferences panel user interface and interaction.
 *
 * @package Admin\Prefs
 */
if (!defined('txpinterface')) {
    die('txpinterface is undefined.');
}
if ($event == 'prefs') {
    require_privs('prefs');
    bouncer($step, array('prefs_save' => true, 'prefs_list' => false));
    switch (strtolower($step)) {
        case "":
        case "prefs_list":
            prefs_list();
            break;
        case "prefs_save":
            prefs_save();
            break;
    }
}
/**
 * Commits prefs to the database.
 */
function prefs_save()

   /___________)                               (___________\
	Textpattern Copyright 2004 by Dean Allen. All rights reserved.
	Use of this software denotes acceptance of the Textpattern license agreement
	"Mod File Upload" Copyright 2004 by Michael Manfre. All rights reserved.
	Use of this mod denotes acceptance of the Textpattern license agreement
$HeadURL$
$LastChangedRevision$
*/
if (!defined('txpinterface')) {
    die('txpinterface is undefined.');
}
$levels = array(1 => gTxt('private'), 0 => gTxt('public'));
global $file_statuses;
$file_statuses = array(2 => gTxt('hidden'), 3 => gTxt('pending'), 4 => gTxt('live'));
if ($event == 'file') {
    require_privs('file');
    if (!$step or !in_array($step, array('file_change_max_size', 'file_change_pageby', 'file_db_add', 'file_multi_edit', 'file_edit', 'file_insert', 'file_list', 'file_replace', 'file_save', 'file_reset_count', 'file_create'))) {
        file_list();
    } else {
        $step();
    }
}
// -------------------------------------------------------------
function file_list($message = '')
{
    global $txpcfg, $extensions, $file_base_path, $file_statuses, $file_list_pageby;
    pagetop(gTxt('file'), $message);
    extract($txpcfg);
    extract(gpsa(array('page', 'sort', 'dir', 'crit', 'search_method')));
    if (!is_dir($file_base_path) or !is_writeable($file_base_path)) {
        echo graf(gTxt('file_dir_not_writeable', array('{filedir}' => $file_base_path)), ' id="warning"');

/**
 * Processes multi-edit actions.
 *
 * Accessing requires 'admin.edit' privileges.
 */
function admin_multi_edit()
{
    global $txp_user;
    require_privs('admin.edit');
    $selected = ps('selected');
    $method = ps('edit_method');
    $changed = array();
    $msg = '';
    if (!$selected or !is_array($selected)) {
        return author_list();
    }
    $clause = '';
    if ($method === 'resetpassword') {
        $clause = " AND last_access IS NOT NULL";
    } elseif ($method === 'resendactivation') {
        $clause = " AND last_access IS NULL";
    }
    $names = safe_column("name", 'txp_users', "name IN (" . join(',', quote_list($selected)) . ") AND name != '" . doSlash($txp_user) . "'" . $clause);
    if (!$names) {
        return author_list();
    }
    switch ($method) {
        case 'delete':
            $assign_assets = ps('assign_assets');
            if (!$assign_assets) {
                $msg = array('must_reassign_assets', E_ERROR);
            } elseif (in_array($assign_assets, $names)) {
                $msg = array('cannot_assign_assets_to_deletee', E_ERROR);
            } elseif (remove_user($names, $assign_assets)) {
                $changed = $names;
                callback_event('authors_deleted', '', 0, $changed);
                $msg = 'author_deleted';
            }
            break;
        case 'changeprivilege':
            if (change_user_group($names, ps('privs'))) {
                $changed = $names;
                $msg = 'author_updated';
            }
            break;
        case 'resetpassword':
            foreach ($names as $name) {
                send_reset_confirmation_request($name);
                $changed[] = $name;
            }
            $msg = 'password_reset_confirmation_request_sent';
            break;
        case 'resendactivation':
            foreach ($names as $name) {
                send_account_activation($name);
                $changed[] = $name;
            }
            $msg = 'resend_activation_request_sent';
            break;
    }
    if ($changed) {
        return author_list(gTxt($msg, array('{name}' => txpspecialchars(join(', ', $changed)))));
    }
    author_list($msg);
}