mozilla
/
pjs
зеркало из https://github.com/mozilla/pjs.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Bug 276682 improve password handling 

patch by jens.b@web.de, r=alanjstr
This commit is contained in:
cst%andrew.cmu.edu 2005-01-17 02:25:39 +00:00
Родитель 0353609af7
Коммит 028bcd368f
1 изменённых файлов: 28 добавлений и 22 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

50
webtools/update/developers/usermanager.php
Просмотреть файл

@ -24,29 +24,35 @@ include"inc_sidebar.php";
<?php <?php
//Security Check for EditUser/ChangePassword function. //Security Check for EditUser/ChangePassword function.
if ($function=="edituser" or $function=="changepassword") { if ($function=="edituser" or $function=="changepassword") {
$postuid = escape_string($_GET["userid"]); $postuid = escape_string($_GET["userid"]);
$userid = escape_string($_SESSION["uid"]); $userid = escape_string($_SESSION["uid"]);
if ($_SESSION["level"] !=="admin" and $postuid != $userid) { // All users users may change their own accounts, check when trying to change other accounts
//This user isn't an admin, verify the id of the record they're working with is ok. if ($postuid and $postuid != $userid) {
$sql = "SELECT `UserID` from `userprofiles` WHERE "; $allowed = false;
if ($_SESSION["level"]=="user") { $sql .="`UserID` = '$userid'"; if ($_SESSION["level"] == "admin") {
} else if ($_SESSION["level"]=="editor") {$sql .="`UserMode`='U' and `UserID`='$postuid'"; // Admins may change any account
} else { $sql .=" 0"; } $allowed = true;
$sql .=" LIMIT 1"; } else if ($_SESSION["level"]=="editor") {
$sql_result = mysql_query($sql, $connection) or trigger_error("<FONT COLOR=\"#FF0000\"><B>MySQL Error ".mysql_errno().": ".mysql_error()."</B></FONT>", E_USER_NOTICE); // Editors may only change regular users, not editors or admins
if (mysql_num_rows($sql_result)=="0") { $sql = "SELECT `UserID` from `userprofiles` WHERE " .
echo"<h1>Error Accessing Record</h1>\n"; "`UserMode`='U' and `UserID`='$postuid'" .
echo"You do not appear to have permission to edit this record.<br>\n"; " LIMIT 1";
echo"<a href=\"?function=\">&#171;&#171; Go Back</a>\n"; $sql_result = mysql_query($sql, $connection) or trigger_error("<FONT COLOR=\"#FF0000\"><B>MySQL Error ".mysql_errno().": ".mysql_error()."</B></FONT>", E_USER_NOTICE);
include"$page_footer"; if (mysql_num_rows($sql_result) == 1) {
echo"</body>\n<html>\n"; $allowed = true;
exit; }
} else { }
$row = mysql_fetch_array($sql_result);
$userid = $row["UserID"]; if ($allowed == false) {
echo"<h1>Error Accessing Record</h1>\n";
echo"You do not appear to have permission to edit this record.<br>\n";
echo"<a href=\"?function=\">&#171;&#171; Go Back</a>\n";
include"$page_footer";
echo"</body>\n<html>\n";
exit;
} else {
$userid = $postuid;
} }
} else {
$userid = escape_string($_GET["userid"]);
} }
} }
?> ?>