Module: appdb
Branch: master
Commit: c71456d159643e84cd1d8a7a0dcd729dd195539a
URL: http://source.winehq.org/git/appdb.git/?a=commit;h=c71456d159643e84cd1d8a7a…
Author: Alexander Nicolaysen Sørnes <alex(a)thehandofagony.com>
Date: Thu Oct 25 00:07:05 2007 +0200
version: Fix ordering entries by id
---
include/version.php | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/include/version.php b/include/version.php
index 8d49bf3..9d97553 100644
--- a/include/version.php
+++ b/include/version.php
@@ -1482,7 +1482,7 @@ class version {
AND
appVersion.submitterId = '?'
AND
- appVersion.queued = '?' ORDER BY '?'$sLimit";
+ appVersion.queued = '?' ORDER BY ?$sLimit";
else
$sQuery = "SELECT appVersion.* FROM
appVersion, appMaintainers, appFamily WHERE
@@ -1508,7 +1508,7 @@ class version {
AND
appMaintainers.queued = 'false'
AND
- appVersion.queued = '?' ORDER BY '?'$sLimit";
+ appVersion.queued = '?' ORDER BY ?$sLimit";
if($sLimit)
{
@@ -1527,7 +1527,7 @@ class version {
AND
appFamily.queued = 'false'
AND
- appVersion.queued = '?' ORDER BY '?'$sLimit";
+ appVersion.queued = '?' ORDER BY ?$sLimit";
if($sLimit)
{
Module: appdb
Branch: master
Commit: fcd40be8a488d13f71b3832b3a1de78e8c719cca
URL: http://source.winehq.org/git/appdb.git/?a=commit;h=fcd40be8a488d13f71b3832b…
Author: Alexander Nicolaysen Sørnes <alex(a)thehandofagony.com>
Date: Wed Oct 24 17:54:13 2007 +0200
add objectManager::error_exit() and use it in application::display()
---
include/application.php | 2 +-
include/objectManager.php | 7 +++++++
2 files changed, 8 insertions(+), 1 deletions(-)
diff --git a/include/application.php b/include/application.php
index 386fd74..2e5291d 100644
--- a/include/application.php
+++ b/include/application.php
@@ -692,7 +692,7 @@ class Application {
{
/* is this user supposed to view this version? */
if(!$_SESSION['current']->canViewApplication($this))
- util_show_error_page_and_exit("Something went wrong with the application or version id");
+ objectManager::error_exit("You do not have permission to view this entry");
// cat display
$oCategory = new Category($this->iCatId);
diff --git a/include/objectManager.php b/include/objectManager.php
index c9ae56f..9350891 100644
--- a/include/objectManager.php
+++ b/include/objectManager.php
@@ -147,6 +147,13 @@ class ObjectManager
return TRUE;
}
+ public static function error_exit($shMessage)
+ {
+ echo '<div align="center"><p><font color="red"><b>'.$shMessage.'</b></font></p></div';
+ echo apidb_footer();
+ exit;
+ }
+
/* displays the list of entries */
public function display_table($aClean)
{
Module: appdb
Branch: master
Commit: b6f1f2219243a740492f4eb2e75a6e8501a3f574
URL: http://source.winehq.org/git/appdb.git/?a=commit;h=b6f1f2219243a740492f4eb2…
Author: Alexander Nicolaysen Sørnes <alex(a)thehandofagony.com>
Date: Wed Oct 24 10:59:22 2007 +0200
objectManager: Prevent changing variables prior to permission checks in form
processing
---
include/objectManager.php | 16 +++++++++++-----
1 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/include/objectManager.php b/include/objectManager.php
index 07a8d90..c9ae56f 100644
--- a/include/objectManager.php
+++ b/include/objectManager.php
@@ -519,14 +519,17 @@ class ObjectManager
$this->checkMethods(array("delete", "canEdit"));
$oObject = $this->getObject();
+ $oOriginalObject = new $this->sClass($this->iId); /* Prevent possible security hole if users change key
+ variables, making the permission checks run on
+ the wrong criteria */
- if(!$oObject->objectGetId())
+ if(!$oOriginalObject->objectGetId())
{
addmsg("No id defined", "red");
return FALSE;
}
- if(!$oObject->canEdit())
+ if(!$oOriginalObject->canEdit())
{
addmsg("You don’t have permission to delete this entry", "red");
return FALSE;
@@ -923,6 +926,9 @@ class ObjectManager
$this->iId = $this->getIdFromInput($aClean);
$oObject = new $this->sClass($this->iId);
+ $oOriginalObject = new $this->sClass($this->iId); /* Prevent possible security hole if users change key
+ variables, making the permission checks run on
+ the wrong criteria */
/* If it isn't implemented, that means there is no default text */
if(method_exists(new $this->sClass, "getDefaultReply"))
@@ -968,13 +974,13 @@ class ObjectManager
// otherwise we should create the entry in the 'else' case
if($this->iId)
{
- if(!$oObject->canEdit())
+ if(!$oOriginalObject->canEdit())
return FALSE;
if($this->bIsRejected)
$oObject->ReQueue();
- if($this->bIsQueue && !$oObject->mustBeQueued())
+ if($this->bIsQueue && !$oOriginalObject->mustBeQueued())
$oObject->unQueue();
$oObject->update();
@@ -987,7 +993,7 @@ class ObjectManager
break;
case "Reject":
- if(!$oObject->canEdit())
+ if(!$oOriginalObject->canEdit())
return FALSE;
$oObject->reject();