Merge branch 'seeddms-5.1.x' into seeddms-6.0.x

CHANGELOG

@@ -190,6 +190,7 @@
 --------------------------------------------------------------------------------
 - remove document/folder from index before adding a new one after editing the
   meta data
+- fix potential clickjacking attack with manipulated email address of a user
 
 --------------------------------------------------------------------------------
                      Changes in version 5.1.21

inc/inc.ClassExtensionMgr.php

@@ -301,6 +301,28 @@ class SeedDMS_Extension_Mgr {
 		return $tmpfile;
 	} /* }}} */
 
+	/**
+	 * Migrate database tables of extension if one exists
+	 *
+	 * @param string $extname name of extension
+	 * @param SeedDMS_Core_DMS $dms
+	 * @return boolean true on success, false on error
+	 */
+	public function migrate($extname, $dms) { /* {{{ */
+		if(!isset($this->extconf[$extname]))
+			return false;
+		$extconf = $this->extconf[$extname];
+		if(isset($extconf['class']) && isset($extconf['class']['file']) && isset($extconf['class']['name'])) {
+			$classfile = $settings->_rootDir."/ext/".$extname."/".$extconf['class']['file'];
+			if(file_exists($classfile)) {
+				include($classfile);
+				$obj = new $extconf['class']['name']($settings);
+				if(method_exists($obj, 'migrate'))
+					$obj->migrate(isset($settings->_extensions[$extname]) ? $settings->_extensions[$extname] : null);
+			}
+		}
+	} /* }}} */
+
 	/**
 	 * Check content of extension directory or configuration of extension
 	 *

op/op.ExtensionMgr.php

@@ -43,8 +43,8 @@ else $action=NULL;
 if (isset($_POST["currenttab"])) $currenttab=$_POST["currenttab"];
 else $currenttab=NULL;
 
-// add new attribute definition ---------------------------------------------
+// Download extension -------------------------------------------------------
-if ($action == "download") {
+if ($action == "download") { /* {{{ */
 	if (!isset($_POST["extname"])) {
 		UI::exitError(getMLText("admin_tools"),getMLText("unknown_id"));
 	}
@@ -128,7 +128,8 @@ elseif ($action == "getlist") { /* {{{ */
 	}
 	add_log_line();
 	header("Location:../out/out.ExtensionMgr.php?currenttab=".$currenttab);
-}	elseif ($action == "toggle") { /* {{{ */
+} /* }}} */
+elseif ($action == "toggle") { /* {{{ */
 	if (!isset($_POST["extname"])) {
 		echo json_encode(array('success'=>false, 'msg'=>'Could not toggle extension'));
 	}

out/out.ImportUsers.php

@@ -34,7 +34,11 @@ if (!$user->isAdmin()) {
 	UI::exitError(getMLText("admin_tools"),getMLText("access_denied"));
 }
 
+/* Also have a look at op/op.ImportUsers.php which calls the view as well. */
 if($view) {
+	$view->setParam('log', array());
+	$view->setParam('newusers', array());
+	$view->setParam('colmap', array());
 	$view($_GET);
 	exit;
 }

views/bootstrap/class.DocumentVersionDetail.php

@@ -170,7 +170,7 @@ class SeedDMS_View_DocumentVersionDetail extends SeedDMS_Bootstrap_Style {
 <td>
 <?php
 		$owner = $document->getOwner();
-		print "<a class=\"infos\" href=\"mailto:".$owner->getEmail()."\">".htmlspecialchars($owner->getFullName())."</a>";
+		print "<a class=\"infos\" href=\"mailto:".htmlspecialchars($owner->getEmail())."\">".htmlspecialchars($owner->getFullName())."</a>";
 ?>
 </td>
 </tr>
@@ -278,7 +278,7 @@ class SeedDMS_View_DocumentVersionDetail extends SeedDMS_Bootstrap_Style {
 		else print "<li><span class=\"warning\">".getMLText("document_deleted")."</span></li>";
 
 		$updatingUser = $version->getUser();
-		print "<li>".getMLText("uploaded_by")." <a href=\"mailto:".$updatingUser->getEmail()."\">".htmlspecialchars($updatingUser->getFullName())."</a></li>";
+		print "<li>".getMLText("uploaded_by")." <a href=\"mailto:".htmlspecialchars($updatingUser->getEmail())."\">".htmlspecialchars($updatingUser->getFullName())."</a></li>";
 		print "<li>".getLongReadableDate($version->getDate())."</li>";
 
 		print "</ul>\n";
@@ -514,7 +514,7 @@ class SeedDMS_View_DocumentVersionDetail extends SeedDMS_Bootstrap_Style {
 					print "<li>".SeedDMS_Core_File::format_filesize(filesize($dms->contentDir . $file->getPath())) ." bytes, ".htmlspecialchars($file->getMimeType())."</li>";
 				else print "<li>".htmlspecialchars($file->getMimeType())." - <span class=\"warning\">".getMLText("document_deleted")."</span></li>";
 
-				print "<li>".getMLText("uploaded_by")." <a href=\"mailto:".$responsibleUser->getEmail()."\">".htmlspecialchars($responsibleUser->getFullName())."</a></li>";
+				print "<li>".getMLText("uploaded_by")." <a href=\"mailto:".htmlspecialchars($responsibleUser->getEmail())."\">".htmlspecialchars($responsibleUser->getFullName())."</a></li>";
 				print "<li>".getLongReadableDate($file->getDate())."</li>";
 				if($file->getVersion())
 					print "<li>".getMLText('linked_to_this_version')."</li>";

views/bootstrap/class.ExtensionMgr.php

@@ -212,7 +212,7 @@ class SeedDMS_View_ExtensionMgr extends SeedDMS_Bootstrap_Style {
 			echo "<td nowrap>".$extconf['version'];
 			echo "<br /><small>".$extconf['releasedate']."</small>";
 			echo "</td>";
-			echo "<td nowrap><a href=\"mailto:".$extconf['author']['email']."\">".$extconf['author']['name']."</a><br /><small>".$extconf['author']['company']."</small></td>";
+			echo "<td nowrap><a href=\"mailto:".htmlspecialchars($extconf['author']['email'])."\">".$extconf['author']['name']."</a><br /><small>".$extconf['author']['company']."</small></td>";
 			echo "<td nowrap>";
 			echo "<div class=\"list-action\">";
 			if(!empty($extconf['changelog']) && file_exists($extdir."/".$extname."/".$extconf['changelog'])) {

views/bootstrap/class.UserList.php

@@ -75,7 +75,7 @@ class SeedDMS_View_UserList extends SeedDMS_Bootstrap_Style {
 			echo "</td>";
 			echo "<td>";
 			echo htmlspecialchars($currUser->getFullName())." (".htmlspecialchars($currUser->getLogin()).")<br />";
-			echo "<a href=\"mailto:".$currUser->getEmail()."\">".htmlspecialchars($currUser->getEmail())."</a><br />";
+			echo "<a href=\"mailto:".htmlspecialchars($currUser->getEmail())."\">".htmlspecialchars($currUser->getEmail())."</a><br />";
 			echo "<small>".htmlspecialchars($currUser->getComment())."</small>";
 			echo "</td>";
 			echo "<td>";

views/bootstrap/class.UsrView.php

@@ -68,7 +68,7 @@ class SeedDMS_View_UsrView extends SeedDMS_Bootstrap_Style {
 			}
 			echo "<td>";
 			echo htmlspecialchars($currUser->getFullName())." (".htmlspecialchars($currUser->getLogin()).")<br />";
-			echo "<a href=\"mailto:".$currUser->getEmail()."\">".htmlspecialchars($currUser->getEmail())."</a><br />";
+			echo "<a href=\"mailto:".htmlspecialchars($currUser->getEmail())."\">".htmlspecialchars($currUser->getEmail())."</a><br />";
 			echo "<small>".htmlspecialchars($currUser->getComment())."</small>";
 			echo "</td>";
 			echo "</tr>";

views/bootstrap/class.ViewDocument.php

@@ -232,7 +232,7 @@ class SeedDMS_View_ViewDocument extends SeedDMS_Bootstrap_Style {
 		<td>
 <?php
 		$owner = $document->getOwner();
-		print "<a class=\"infos\" href=\"mailto:".$owner->getEmail()."\">".htmlspecialchars($owner->getFullName())."</a>";
+		print "<a class=\"infos\" href=\"mailto:".htmlspecialchars($owner->getEmail())."\">".htmlspecialchars($owner->getFullName())."</a>";
 ?>
 		</td>
 		</tr>
@@ -673,7 +673,7 @@ class SeedDMS_View_ViewDocument extends SeedDMS_Bootstrap_Style {
 		else print "<li><span class=\"warning\">".getMLText("document_deleted")."</span></li>";
 
 		$updatingUser = $latestContent->getUser();
-		print "<li>".getMLText("uploaded_by")." <a href=\"mailto:".$updatingUser->getEmail()."\">".htmlspecialchars($updatingUser->getFullName())."</a></li>";
+		print "<li>".getMLText("uploaded_by")." <a href=\"mailto:".htmlspecialchars($updatingUser->getEmail())."\">".htmlspecialchars($updatingUser->getFullName())."</a></li>";
 		print "<li>".getLongReadableDate($latestContent->getDate())."</li>";
 
 		print "</ul>\n";
@@ -1600,7 +1600,7 @@ class SeedDMS_View_ViewDocument extends SeedDMS_Bootstrap_Style {
 				if ($file_exists) print "<li>". SeedDMS_Core_File::format_filesize($version->getFileSize()) .", ".htmlspecialchars($version->getMimeType())."</li>";
 				else print "<li><span class=\"warning\">".getMLText("document_deleted")."</span></li>";
 				$updatingUser = $version->getUser();
-				print "<li>".getMLText("uploaded_by")." <a href=\"mailto:".$updatingUser->getEmail()."\">".htmlspecialchars($updatingUser->getFullName())."</a></li>";
+				print "<li>".getMLText("uploaded_by")." <a href=\"mailto:".htmlspecialchars($updatingUser->getEmail())."\">".htmlspecialchars($updatingUser->getFullName())."</a></li>";
 				print "<li>".getLongReadableDate($version->getDate())."</li>";
 				print "</ul>\n";
 				$txt = $this->callHook('showVersionComment', $version);
@@ -1723,7 +1723,7 @@ class SeedDMS_View_ViewDocument extends SeedDMS_Bootstrap_Style {
 					print "<li>".SeedDMS_Core_File::format_filesize(filesize($dms->contentDir . $file->getPath())) ." bytes, ".htmlspecialchars($file->getMimeType())."</li>";
 				else print "<li>".htmlspecialchars($file->getMimeType())." - <span class=\"warning\">".getMLText("document_deleted")."</span></li>";
 
-				print "<li>".getMLText("uploaded_by")." <a href=\"mailto:".$responsibleUser->getEmail()."\">".htmlspecialchars($responsibleUser->getFullName())."</a></li>";
+				print "<li>".getMLText("uploaded_by")." <a href=\"mailto:".htmlspecialchars($responsibleUser->getEmail())."\">".htmlspecialchars($responsibleUser->getFullName())."</a></li>";
 				print "<li>".getLongReadableDate($file->getDate())."</li>";
 				if($file->getVersion())
 					print "<li>".getMLText('linked_to_current_version')."</li>";