diff --git a/README.md b/README.md
index a4f1893..22cea1d 100755
--- a/README.md
+++ b/README.md
@@ -60,3 +60,7 @@
## desktop
+
+
+#### *Security :
+#####This Application has been fixed and secured by Ben Khlifa Fahmi (https://www.benkhlifa.com/) , From the Tunisian Whitehats Security Team.
diff --git a/controller/app.class.php b/controller/app.class.php
index 7032b76..d13c932 100755
--- a/controller/app.class.php
+++ b/controller/app.class.php
@@ -4,6 +4,7 @@
* @author warlee | e-mail:kalcaddle@qq.com
* @copyright warlee 2014.(Shanghai)Co.,Ltd
* @license http://kalcaddle.com/tools/licenses/license.txt
+* @Secured by Ben Khlifa Fahmi
*/
class app extends Controller{
@@ -81,9 +82,13 @@ class app extends Controller{
* 添加
*/
public function add() {
- $res=$this->sql->add(rawurldecode($this->in['name']),$this->_init());
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]) {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest') {
+ $res=$this->sql->add(rawurldecode($this->in['name']),$this->_init());
if($res) show_json($this->L['success']);
- show_json($this->L['error_repeat'],false);
+ show_json($this->L['error_repeat'],false);}}else{
+ header('Location: 403.php');
+}
}
/**
@@ -91,21 +96,28 @@ class app extends Controller{
*/
public function edit() {
//查找到一条记录，修改为该数组
- if($this->sql->replace_update(
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]) {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest') {
+if($this->sql->replace_update(
rawurldecode($this->in['old_name']),
rawurldecode($this->in['name']),$this->_init())){
show_json($this->L['success']);
}
- show_json($this->L['error_repeat'],false);
+ show_json($this->L['error_repeat'],false);}}else{
+header('Location: 403.php');}
}
/**
* 删除
*/
public function del() {
- if($this->sql->delete(rawurldecode($this->in['name']))){
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]) {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest') {
+ if($this->sql->delete(rawurldecode($this->in['name']))){
show_json($this->L['success']);
}
- show_json($this->L['error'],false);
+ show_json($this->L['error'],false);}}else{
+ header('Location: 403.php');
+ }
}
public function get_url_title(){
diff --git a/controller/editor.class.php b/controller/editor.class.php
index 1d30dbe..ca16e8e 100755
--- a/controller/editor.class.php
+++ b/controller/editor.class.php
@@ -4,6 +4,7 @@
* @author warlee | e-mail:kalcaddle@qq.com
* @copyright warlee 2014.(Shanghai)Co.,Ltd
* @license http://kalcaddle.com/tools/licenses/license.txt
+* @secured by Ben Khlifa Fahmi
*/
class editor extends Controller{
@@ -43,7 +44,9 @@ class editor extends Controller{
show_json($data);
}
public function fileSave(){
- $filestr = rawurldecode($this->in['filestr']);
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]) {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest') {
+ $filestr = rawurldecode($this->in['filestr']);
$charset = $this->in['charset'];
$path =_DIR($this->in['path']);
if (!is_writable($path)) show_json($this->L['no_permission_write_file'],false);
@@ -55,6 +58,9 @@ class editor extends Controller{
fwrite($fp,$filestr);
fclose($fp);
show_json($this->L['save_success']);
+}}else{
+ header('Location: index.php');
+}
}
/*
@@ -120,4 +126,4 @@ class editor extends Controller{
if ($charset == 'ascii') $charset = 'utf-8';
return strtolower($charset);
}
-}
\ No newline at end of file
+}
diff --git a/controller/explorer.class.php b/controller/explorer.class.php
index 8297dcc..f0f9b90 100755
--- a/controller/explorer.class.php
+++ b/controller/explorer.class.php
@@ -4,6 +4,7 @@
* @author warlee | e-mail:kalcaddle@qq.com
* @copyright warlee 2014.(Shanghai)Co.,Ltd
* @license http://kalcaddle.com/tools/licenses/license.txt
+* @secured by Ben Khlifa Fahmi
*/
class explorer extends Controller{
@@ -50,6 +51,10 @@ class explorer extends Controller{
}
public function pathChmod(){
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"])
+ {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest')
+ {
$info_list = json_decode($this->in['list'],true);
$mod = octdec('0'.$this->in['mod']);
$success=0;$error=0;
@@ -67,6 +72,9 @@ class explorer extends Controller{
$info = $this->L['success'];
}
show_json($info,$state);
+}}else{
+header('Location: 403.php');
+}
}
private function _pathAllow($path){
@@ -79,7 +87,11 @@ class explorer extends Controller{
}
}
public function pathRname(){
- if (!is_writable($this->path)) {
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"])
+ {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest')
+ {
+if (!is_writable($this->path)) {
show_json($this->L['no_permission_write_all'],false);
}
$rname_to=_DIR($this->in['rname_to']);
@@ -89,6 +101,9 @@ class explorer extends Controller{
}
rename($this->path,$rname_to);
show_json($this->L['rname_success']);
+}}else{
+ header('Location: 403.php');
+}
}
public function pathList(){
load_class('history');
@@ -249,7 +264,9 @@ class explorer extends Controller{
}
}
public function pathDelete(){
- $list = json_decode($this->in['list'],true);
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]) {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest') {
+$list = json_decode($this->in['list'],true);
if (!is_writable(USER_RECYCLE)) show_json($this->L['no_permission_write'],false);
$success=0;$error=0;
foreach ($list as $val) {
@@ -268,9 +285,15 @@ class explorer extends Controller{
$info = $this->L['remove_success'];
}
show_json($info,$state);
+ }}else{
+ header('Location: 403.php');
+ }
}
public function pathDeleteRecycle(){
- if(!isset($this->in['list'])){
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"])
+ {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest')
+ { if(!isset($this->in['list'])){
if (!del_dir(USER_RECYCLE)) {
show_json($this->L['remove_fali'],false);
}else{
@@ -297,10 +320,12 @@ class explorer extends Controller{
}else{
$code = $error==0?true:false;
show_json($this->L['remove_success'].$success.'success,'.$error.'error',$code);
- }
+ } }}else{header('Location: 403.php');}
}
public function mkfile(){
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]) {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest') {
$new= rtrim($this->path,'/');
$this->_pathAllow($new);
if(touch($new)){
@@ -311,10 +336,17 @@ class explorer extends Controller{
show_json($this->L['create_success'],true,get_path_this($new));
}else{
show_json($this->L['create_error'],false);
- }
+ }}
+}else{
+ header("Location: 403.php");
+}
}
public function mkdir(){
- $new = rtrim($this->path,'/');
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"])
+ {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest')
+ {
+$new = rtrim($this->path,'/');
$this->_pathAllow($new);
if(mkdir($new,0777)){
chmod_path($new,0777);
@@ -322,6 +354,9 @@ class explorer extends Controller{
}else{
show_json($this->L['create_error'],false);
}
+ }}else{
+ header('Location: 403.php');
+}
}
public function pathCopy(){
session_start();//re start
@@ -593,6 +628,8 @@ class explorer extends Controller{
// 远程下载
public function serverDownload() {
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]) {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest') {
$uuid = 'download_'.$this->in['uuid'];
if ($this->in['type'] == 'percent') {//获取下载进度
//show_json($_SESSION[$uuid]);
@@ -643,6 +680,8 @@ class explorer extends Controller{
}
}else{
show_json($this->L['download_error_create'],false);
+ }}}else{
+ header('Location: 403.php');
}
}
@@ -797,4 +836,4 @@ class explorer extends Controller{
_DIR_OUT($list);
return $list;
}
-}
\ No newline at end of file
+}
diff --git a/controller/group.class.php b/controller/group.class.php
index 42d101f..538c90d 100755
--- a/controller/group.class.php
+++ b/controller/group.class.php
@@ -4,85 +4,147 @@
* @author warlee | e-mail:kalcaddle@qq.com
* @copyright warlee 2014.(Shanghai)Co.,Ltd
* @license http://kalcaddle.com/tools/licenses/license.txt
+* @secured : Ben Khlifa Fahmi
*/
+class group extends Controller
-class group extends Controller{
- private $sql;
- function __construct() {
- parent::__construct();
- $this->sql=new fileCache(USER_SYSTEM.'group.php');
- }
-
- public function get() {
- show_json($this->sql->get());
- }
- /**
- * 用户添加
- */
- public function add(){
- $group = $this->_init_data();
- if($this->sql->add($this->in['role'],$group)){
- show_json($this->L['success']);
- }
- show_json($this->L['error_repeat'],false);
- }
+ {
+ private $sql;
+ function __construct()
+ {
+ parent::__construct();
+ $this->sql = new fileCache(USER_SYSTEM . 'group.php');
+ }
- /**
- * 编辑
- */
- public function edit(){
- $group = $this->_init_data();
- $role_old = $this->in['role_old'];
- if (!$role_old) show_json($this->L["groupname_can_not_null"],false);
- if ($role_old == 'root') show_json($this->L['default_group_can_not_do'],false);
+ public
- if ($this->sql->replace_update($role_old,$this->in['role'],$group)){
- $member = new fileCache(USER_SYSTEM.'member.php');
- if ($member -> update('role',$this->in['role'],$role_old)) {
- show_json($this->L['success']);
- }
- show_json($this->L['group_move_user_error'],false);
- }
- show_json($this->L['error_repeat'],false);
- }
+ function get()
+ {
+ show_json($this->sql->get());
+ }
- /**
- * 删除
- */
- public function del() {
- $role = $this->in['role'];
- if (!$role) show_json($this->L["groupname_can_not_null"],false);
- if ($role == 'root') show_json($this->L['default_group_can_not_do'],false);
- if($this->sql->delete($role)){
- $member = new fileCache(USER_SYSTEM.'member.php');
- $member -> update('role','',$role);//改组用户设置为空
- show_json($this->L['success']);
- }
- show_json($this->L['error'],false);
- }
+ /**
+ * 用户添加
+ */
+ public
+ function add()
+ {
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"])
+ {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest')
+ {
+ $group = $this->_init_data();
+ if ($this->sql->add($this->in['role'], $group))
+ {
+ show_json($this->L['success']);
+ }
- //===========内部调用============
- /**
- * 初始化数据 get
- * 只传键即可 &ext_not_allow=''&explorer-mkfile&explorer-pathRname
- */
- private function _init_data(){
- if (strlen($this->in['role'])<1) show_json($this->L["groupname_can_not_null"],false);
- if (strlen($this->in['name'])<1) show_json($this->L["groupdesc_can_not_null"],false);
-
- $role_arr = array('role'=>$this->in['role'],'name'=>$this->in['name']);
- $role_arr['ext_not_allow'] = $this->in['ext_not_allow'];
- foreach ($this->config['role_setting'] as $key => $actions) {
- foreach ($actions as $action) {
- $k = $key.':'.$action;
- if (isset($this->in[$k])){
- $role_arr[$k] = 1;
- }else{
- $role_arr[$k] = 0;
+ show_json($this->L['error_repeat'], false);
+ }
+ }
+ else
+ {
+ header('Location: 403.php');
+ }
+ }
+
+ /**
+ * 编辑
+ */
+ public
+
+ function edit()
+ {
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"])
+ {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest')
+ {
+ $group = $this->_init_data();
+ $role_old = $this->in['role_old'];
+ if (!$role_old) show_json($this->L["groupname_can_not_null"], false);
+ if ($role_old == 'root') show_json($this->L['default_group_can_not_do'], false);
+ if ($this->sql->replace_update($role_old, $this->in['role'], $group))
+ {
+ $member = new fileCache(USER_SYSTEM . 'member.php');
+ if ($member->update('role', $this->in['role'], $role_old))
+ {
+ show_json($this->L['success']);
+ }
+
+ show_json($this->L['group_move_user_error'], false);
+ }
+
+ show_json($this->L['error_repeat'], false);
+ }
+ }
+ else
+ {
+ header('Location: 403.php');
+ }
+ }
+
+ /**
+ * 删除
+ */
+ public
+
+ function del()
+ {
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"])
+ {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest')
+ {
+ $role = $this->in['role'];
+ if (!$role) show_json($this->L["groupname_can_not_null"], false);
+ if ($role == 'root') show_json($this->L['default_group_can_not_do'], false);
+ if ($this->sql->delete($role))
+ {
+ $member = new fileCache(USER_SYSTEM . 'member.php');
+ $member->update('role', '', $role); //改组用户设置为空
+ show_json($this->L['success']);
+ }
+ show_json($this->L['error'], false);
}
}
+ else
+ {
+ header('Location: 403.php');
+ }
}
- return $role_arr;
- }
-}
\ No newline at end of file
+
+ // ===========内部调用============
+
+ /**
+ * 初始化数据 get
+ * 只传键即可 &ext_not_allow=''&explorer-mkfile&explorer-pathRname
+ */
+ private
+ function _init_data()
+ {
+ if (strlen($this->in['role']) < 1) show_json($this->L["groupname_can_not_null"], false);
+ if (strlen($this->in['name']) < 1) show_json($this->L["groupdesc_can_not_null"], false);
+ $role_arr = array(
+ 'role' => $this->in['role'],
+ 'name' => $this->in['name']
+ );
+ $role_arr['ext_not_allow'] = $this->in['ext_not_allow'];
+ foreach($this->config['role_setting'] as $key => $actions)
+ {
+ foreach($actions as $action)
+ {
+ $k = $key . ':' . $action;
+ if (isset($this->in[$k]))
+ {
+ $role_arr[$k] = 1;
+ }
+ else
+ {
+ $role_arr[$k] = 0;
+ }
+ }
+ }
+
+ return $role_arr;
+ }
+ }
diff --git a/controller/member.class.php b/controller/member.class.php
index 209a013..01f50f7 100755
--- a/controller/member.class.php
+++ b/controller/member.class.php
@@ -1,107 +1,138 @@
tpl = TEMPLATE.'member/';
- $this->sql=new fileCache(USER_SYSTEM.'member.php');
+ $this->tpl = TEMPLATE . 'member/';
+ $this->sql = new fileCache(USER_SYSTEM . 'member.php');
}
/**
* 获取用户列表数据
*/
- public function get() {
+ public function get()
+ {
show_json($this->sql->get());
}
/**
* 用户添加
*/
- public function add(){
- if (!$this->in['name'] ||
- !$this->in['password'] ||
- !$this->in['role'] ) show_json($this->L["data_not_full"],false);
-
- $this->in['name'] = rawurldecode($this->in['name']);
- $this->in['password'] = rawurldecode($this->in['password']);
- $user = array(
- 'name' => rawurldecode($this->in['name']),
- 'password' => md5(rawurldecode($this->in['password'])),
- 'role' => $this->in['role'],
- 'status' => 0,
- );
- if ($this->sql->add($this->in['name'],$user)) {
- $this->_initUser($this->in['name']);
- show_json($this->L['success']);
+ public function add()
+ {
+ if (!$this->in['name'] || !$this->in['password'] || !$this->in['role'])
+ show_json($this->L["data_not_full"], false);
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]) {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest') {
+ $this->in['name'] = rawurldecode($this->in['name']);
+ $this->in['password'] = rawurldecode($this->in['password']);
+ $user = array(
+ 'name' => rawurldecode($this->in['name']),
+ 'password' => md5(rawurldecode($this->in['password'])),
+ 'role' => $this->in['role'],
+ 'status' => 0
+ );
+ if ($this->sql->add($this->in['name'], $user)) {
+ $this->_initUser($this->in['name']);
+ show_json($referer);
+ }
+ show_json($this->L['error_repeat'], false);
+ }
+ } else {
+ header('Location: 403.php');
}
- show_json($this->L['error_repeat'],false);
}
-
+
/**
* 编辑
*/
- public function edit() {
- if (!$this->in['name'] ||
- !$this->in['name_to'] ||
- !$this->in['role_to'] ) show_json($this->L["data_not_full"],false);
-
- $this->in['name'] = rawurldecode($this->in['name']);
- $this->in['name_to'] = rawurldecode($this->in['name_to']);
- $this->in['password_to'] = rawurldecode($this->in['password_to']);
- if ($this->in['name'] == 'admin') show_json($this->L['default_user_can_not_do'],false);
-
- //查找到一条记录，修改为该数组
- $user = $this->sql->get($this->in['name']);
- $user['name'] = $this->in['name_to'];
- $user['role'] = $this->in['role_to'];
-
- if (strlen($this->in['password_to'])>=1) {
- $user['password'] = md5($this->in['password_to']);
+ public function edit()
+ {
+ if (!$this->in['name'] || !$this->in['name_to'] || !$this->in['role_to'])
+ show_json($this->L["data_not_full"], false);
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]) {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest') {
+
+ $this->in['name'] = rawurldecode($this->in['name']);
+ $this->in['name_to'] = rawurldecode($this->in['name_to']);
+ $this->in['password_to'] = rawurldecode($this->in['password_to']);
+ if ($this->in['name'] == 'admin')
+ show_json($this->L['default_user_can_not_do'], false);
+
+ //查找到一条记录，修改为该数组
+ $user = $this->sql->get($this->in['name']);
+ $user['name'] = $this->in['name_to'];
+ $user['role'] = $this->in['role_to'];
+
+ if (strlen($this->in['password_to']) >= 1) {
+ $user['password'] = md5($this->in['password_to']);
+ }
+ if ($this->sql->replace_update($this->in['name'], $user['name'], $user)) {
+ rename(USER_PATH . $this->in['name'], USER_PATH . $this->in['name_to']);
+ show_json($this->L['success']);
+ }
+ show_json($this->L['error_repeat'], false);
+ }
+ } else {
+ header('Location: 403.php');
}
- if($this->sql->replace_update($this->in['name'],$user['name'],$user)){
- rename(USER_PATH.$this->in['name'],USER_PATH.$this->in['name_to']);
- show_json($this->L['success']);
- }
- show_json($this->L['error_repeat'],false);
}
-
+
/**
* 删除
*/
- public function del() {
+ public function del()
+ {
$name = $this->in['name'];
- if (!$name) show_json($this->L["username_can_not_null"],false);
- if ($name == 'admin') show_json($this->L['default_user_can_not_do'],false);
- if($this->sql->delete($name)){
- del_dir(USER_PATH.$name.'/');
- show_json($this->L['success']);
+ if (!$name)
+ show_json($this->L["username_can_not_null"], false);
+ if ($name == 'admin')
+ show_json($this->L['default_user_can_not_do'], false);
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]) {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest') {
+
+ if ($this->sql->delete($name)) {
+ del_dir(USER_PATH . $name . '/');
+ show_json($this->L['success']);
+ }
+ show_json($this->L['error'], false);
+ }
+ } else {
+ header('Location: 403.html');
}
- show_json($this->L['error'],false);
}
-
+
//============内部处理函数=============
/**
*初始化用户数据和配置。
- */
- public function _initUser($name){
- $root = array('home','recycle','data');
+ */
+ public function _initUser($name)
+ {
+ $root = array(
+ 'home',
+ 'recycle',
+ 'data'
+ );
$new_user_folder = $this->config['setting_system']['new_user_folder'];
- $home = explode(',',$new_user_folder);
-
- $user_path = USER_PATH.$name.'/';
+ $home = explode(',', $new_user_folder);
+
+ $user_path = USER_PATH . $name . '/';
mk_dir($user_path);
foreach ($root as $dir) {
- mk_dir($user_path.$dir);
+ mk_dir($user_path . $dir);
}
foreach ($home as $dir) {
- mk_dir($user_path.'home/'.$dir);
+ mk_dir($user_path . 'home/' . $dir);
}
- fileCache::save($user_path.'data/config.php',$this->config['setting_default']);
+ fileCache::save($user_path . 'data/config.php', $this->config['setting_default']);
}
-}
\ No newline at end of file
+}
diff --git a/controller/userShare.class.php b/controller/userShare.class.php
index 1de6f8c..a397f48 100755
--- a/controller/userShare.class.php
+++ b/controller/userShare.class.php
@@ -34,6 +34,9 @@ class userShare extends Controller{
* 编辑
*/
public function set(){
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]) {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest') {
+
$share_info = $this->_getData();
//含有sid则为更新，否则为插入
@@ -60,17 +63,26 @@ class userShare extends Controller{
show_json($this->L['error'],false);
}
show_json($this->L['error'],false);
+}}else{
+header('Location: 403.php');
+}
}
/**
* 删除
*/
public function del() {
- $list = json_decode($this->in['list'],true);
- foreach ($list as $val) {
- $this->sql->delete($val['path']);
+ if ($_SERVER['HTTP_REFERER'] != $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]) {
+ if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest') {
+ $list = json_decode($this->in['list'],true);
+ foreach ($list as $val) {
+ $this->sql->delete($val['path']);
+ }
+ show_json($this->L['success'],true);
+ }
+ }else{
+ header('Location: 403.php');
}
- show_json($this->L['success'],true);
}
public function _getData(){
diff --git a/static/js/app/src/setting/main.js b/static/js/app/src/setting/main.js
index 5b5e2f9..c56c57a 100755
--- a/static/js/app/src/setting/main.js
+++ b/static/js/app/src/setting/main.js
@@ -1,2 +1,1053 @@
-define("app/src/setting/main",["lib/jquery-lib","lib/util","lib/artDialog/jquery-artDialog","../../common/core","../../tpl/copyright.html","../../tpl/search.html","../../tpl/search_list.html","../../tpl/upload.html","./setting","./fav","./group","./member","./system"],function(e){e("lib/jquery-lib"),e("lib/util"),e("lib/artDialog/jquery-artDialog"),core=e("../../common/core"),Setting=e("./setting"),Fav=e("./fav"),Group=e("./group"),Member=e("./member"),System=e("./system"),Setting.init(),Fav.bindEvent(),Member.bindEvent(),Group.bindEvent(),System.bindEvent()}),define("app/common/core",[],function(require,exports){return{filetype:{image:["jpg","jpeg","png","bmp","gif","ico"],music:["mp3","wma","wav","mid","m4a","aac","midi"],movie:["avi","flv","f4v","wmv","3gp","mp4","wmv","asf","m4v","mov","mpg"],doc:["doc","docx","docm","xls","xlsx","xlsb","xlsm","ppt","pptx","pptm"],text:["oexe","inc","inf","csv","log","asc","tsv","lnk","url","webloc"],code:["abap","abc","as","ada","adb","htgroups","htpasswd","conf","htaccess","htgroups","htpasswd","asciidoc","asm","ahk","bat","cmd","c9search_results","cpp","c","cc","cxx","h","hh","hpp","cirru","cr","clj","cljs","CBL","COB","coffee","cf","cson","Cakefile","cfm","cs","css","curly","d","di","dart","diff","patch","Dockerfile","dot","dummy","dummy","e","ejs","ex","exs","elm","erl","hrl","frt","fs","ldr","ftl","gcode","feature",".gitignore","glsl","frag","vert","go","groovy","haml","hbs","handlebars","tpl","mustache","hs","hx","html","htm","xhtml","erb","rhtml","ini","cfg","prefs","io","jack","jade","java","js","jsm","json","jq","jsp","jsx","jl","tex","latex","ltx","bib","lean","hlean","less","liquid","lisp","ls","logic","lql","lsl","lua","lp","lucene","Makefile","GNUmakefile","makefile","OCamlMakefile","make","md","markdown","mask","matlab","mel","mc","mush","mysql","nix","m","mm","ml","mli","pas","p","pl","pm","pgsql","php","phtml","ps1","praat","praatscript","psc","proc","plg","prolog","properties","proto","py","r","Rd","Rhtml","rb","ru","gemspec","rake","Guardfile","Rakefile","Gemfile","rs","sass","scad","scala","scm","rkt","scss","sh","bash",".bashrc","sjs","smarty","tpl","snippets","soy","space","sql","styl","stylus","svg","tcl","tex","txt","textile","toml","twig","ts","typescript","str","vala","vbs","vb","vm","v","vh","sv","svh","vhd","vhdl","xml","rdf","rss","wsdl","xslt","atom","mathml","mml","xul","xbl","xaml","xq","yaml","yml","htm","xib","xsd","storyboard","plist","csproj"],bindary:["pdf","bin","zip","swf","gzip","rar","arj","tar","gz","cab","tbz","tbz2","lzh","uue","bz2","ace","exe","so","dll","chm","rtf","odp","odt","pages","class","psd","ttf","fla","7z","dmg","iso","dat","ipa"]},ico:function(e){var t=G.static_path+"images/file_16/",a=["folder","file","edit","search","up","setting","appStore","error","info","mp3","flv","pdf","doc","xls","ppt","html","swf"],i=$.inArray(e,a);return-1==i?t+"file.png":t+e+".png"},contextmenu:function(e){try{rightMenu.hidden()}catch(t){}var t=e||window.event;return t?t&&$(t.target).is("textarea")||$(t.target).is("input")||0!=$(t.target).parents(".topbar").length||0!=$(t.target).parents(".edit_body").length||0!=$(t.target).parents(".aui_state_focus").length?!0:!1:!0},pathThis:function(e){e=e.replace(/\\/g,"/");var t=e.split("/"),a=t[t.length-1];if(""==a&&(a=t[t.length-2]),0==a.search("fileProxy")){a=urlDecode(a.substr(a.search("&path=")));var t=a.split("/");a=t[t.length-1],""==a&&(a=t[t.length-2])}return a},pathFather:function(e){e=e.replace(/\\/g,"/");var t=e.lastIndexOf("/");return e.substr(0,t+1)},pathExt:function(e){e=e.replace(/\\/g,"/"),e=e.replace(/\/+/g,"/");var t=e.lastIndexOf(".");return e=e.substr(t+1),e.toLowerCase()},path2url:function(e){if("http"==e.substr(0,4))return e;if(e=e.replace(/\\/g,"/"),e=e.replace(/\/+/g,"/"),e=e.replace(/\/\.*\//g,"/"),G.is_root&&e.substring(0,G.web_root.length)==G.web_root)return G.web_host+e.replace(G.web_root,"");var t=G.app_host+"/index.php?explorer/fileProxy&path="+urlEncode(e);return G.share_page!==void 0&&(t=G.app_host+"/index.php?share/fileProxy&user="+G.user+"&sid="+G.sid+"&path="+urlEncode(e)),t},authCheck:function(e,t){return G.is_root?!0:AUTH.hasOwnProperty(e)?AUTH[e]?!0:(void 0==t&&(t=LNG.no_permission),core.tips.tips(t,!1),!1):!0},ajaxError:function(e){core.tips.close(LNG.system_error,!1);var t=e.responseText,a=''+t+"
",i=$.dialog.list.ajaxErrorDialog;return""==t.substr(0,17)?(FrameCall.goRefresh(),void 0):(i?i.content(a):$.dialog({id:"ajaxErrorDialog",padding:0,width:"60%",height:"50%",fixed:!0,resize:!0,ico:core.ico("error"),title:"ajax error",content:a}),void 0)},file_get:function(e,t){var a="./index.php?editor/fileGet&filename="+urlEncode2(e);G.share_page!==void 0&&(a="./index.php?share/fileGet&user="+G.user+"&sid="+G.sid+"&filename="+urlEncode2(e)),$.ajax({url:a,dataType:"json",beforeSend:function(){core.tips.loading(LNG.loading)},error:core.ajaxError,success:function(e){core.tips.close(LNG.success),"function"==typeof t&&t(e.data.content)}})},setting:function(e){void 0==e&&(e=G.is_root?"system":"user"),void 0==window.top.frames.Opensetting_mode?$.dialog.open("./index.php?setting#"+e,{id:"setting_mode",fixed:!0,ico:core.ico("setting"),resize:!0,title:LNG.setting,width:960,height:580}):($.dialog.list.setting_mode.display(!0),FrameCall.top("Opensetting_mode","Setting.setGoto",'"'+e+'"'))},copyright:function(){var e=require("../tpl/copyright.html"),t=template.compile(e),a=t({LNG:LNG,G:G});$.dialog({id:"copyright_dialog",bottom:0,right:0,simple:!0,resize:!1,title:LNG.about+" kod",width:425,padding:"0",fixed:!0,content:a})},appStore:function(){$.dialog.open("./index.php?app",{id:"app_store",fixed:!0,ico:core.ico("appStore"),resize:!0,title:LNG.app_store,width:900,height:550})},openIE:function(e){$.dialog.open(e,{fixed:!0,resize:!0,title:LNG.app_store,width:"80%",height:"70%"})},openApp:function(app){if("url"==app.type){var icon=app.icon;-1==app.icon.search(G.static_path)&&"http"!=app.icon.substring(0,4)&&(icon=G.static_path+"images/app/"+app.icon),"number"!=typeof app.width&&-1==app.width.search("%")&&(app.width=parseInt(app.width)),"number"!=typeof app.height&&-1==app.height.search("%")&&(app.height=parseInt(app.height)),$.dialog.open(app.content,{title:app.name,fixed:!0,ico:icon,resize:app.resize,simple:app.simple,title:app.name.replace(".oexe",""),width:app.width,height:app.height})}else{var exec=app.content;console.log(exec),eval("{"+exec+"}")}},update:function(){var e=base64_decode("aHR0cDovL3N0YXRpYy5rYWxjYWRkbGUuY29tL3VwZGF0ZS9tYWluLmpz")+"?a="+UUID();require.async(e,function(){try{}catch(e){}})},explorer:function(e,t){void 0==e&&(e=""),void 0==t&&(t=core.pathThis(e));var a="./index.php?/explorer&type=iframe&path="+e;G.share_page!==void 0&&(a="./index.php?share/folder&type=iframe&user="+G.user+"&sid="+G.sid+"&path="+e),$.dialog.open(a,{resize:!0,fixed:!0,ico:core.ico("folder"),title:t,width:880,height:550})},explorerCode:function(e){void 0==e&&(e="");var t="index.php?/editor&project="+e;G.share_page!==void 0&&(t="./index.php?share/code_read&user="+G.user+"&sid="+G.sid+"&project="+e),$.dialog.open(t,{resize:!0,fixed:!0,ico:core.ico("folder"),title:core.pathThis(e),width:"80%",height:"70%"})},setSkin_finished:function(){var e=$(".setSkin_finished").attr("src");e&&($("#link_css_list").attr("href",e),$(".setSkin_finished").remove())},setSkin:function(e,t){var a=G.static_path+"style/skin/"+e+t;$("body").append(''+' ";return i},search:function(e,t){var a,i,n=require("../tpl/search.html"),o=require("../tpl/search_list.html"),s=function(){var o=template.compile(n);0==$(".dialog_do_search").length?(l(),i={search:e,path:t,is_content:void 0,is_case:void 0,ext:"",LNG:LNG},a=$.dialog({id:"dialog_do_search",padding:0,fixed:!0,ico:core.ico("search"),resize:!0,title:LNG.search,width:450,content:o(i)}),c(i),$("#search_ext").tooltip({placement:"bottom",html:!0}),$("#search_path").tooltip({placement:"bottom",html:!0,title:function(){return $("#search_path").val()}})):($("#search_value").val(e),$("#search_path").val(t),r(),$.dialog.list.dialog_do_search.display(!0))},r=function(){i={search:$("#search_value").val(),path:$("#search_path").val(),is_content:$("#search_is_content").attr("checked"),is_case:$("#search_is_case").attr("checked"),ext:$("#search_ext").val()},c(i)},l=function(){$("#search_value").die("keyup").live("keyup",function(){ui.path.setSearchByStr($(this).val())}),$("#search_value,#search_ext,#search_path").keyEnter(r),$(".search_header a.button").die("click").live("click",r),$(".search_result .list .name").die("click").live("click",function(){var e=$(this).find("a").html(),t=$(this).parent().find(".path a").html()+e;$(this).parent().hasClass("file")?ui.pathOpen.open(t):"explorer"==Config.pageApp?ui.path.list(t+"/","tips"):core.explorer(t+"/")}),$(".search_result .list .path a").die("click").live("click",function(){var e=$(this).html();"explorer"==Config.pageApp?ui.path.list(e,"tips"):core.explorer(e)})},c=function(e){var t=150;$("#search_value").focus(),$(".search_result .list").remove();var a=$(".search_result .message td");if(!e.search||!e.path)return a.hide().html(LNG.search_info).fadeIn(t),void 0;if(1>=e.search.length)return a.hide().html("too short!").fadeIn(t),void 0;var i="index.php?explorer/search";G.share_page!==void 0&&(i="index.php?share/search&user="+G.user+"&sid="+G.sid),$.ajax({url:i,dataType:"json",type:"POST",data:e,beforeSend:function(){a.hide().html(LNG.searching+''+'
'+core.pathThis(i)+" "+'
0b '+'
'+LNG.upload_ready+" "+'
'+'
'+'
'+core.pathThis(a)+" "+'
'+core.file_size(t.size)+" "+'
'+LNG.upload_ready+" "+'
'+'
\n
\n
\n
——{{LNG.kod_name_copyright}}
\n
\n
\n
{{#LNG.copyright_desc}}
\n
{{#LNG.copyright_contact}}
\n
{{#LNG.copyright_info}}
\n
\n
\n \n
\n
\n \n {{LNG.name}} \n {{LNG.type}} \n {{LNG.size}} \n {{LNG.path}} \n \n
\n
\n
\n {{v.name}} {{LNG.folder}} \n 0 \n {{v.path}} \n{{/each}}\n{{each filelist as v i}}\n\n {{v.name}} {{v.ext}} \n {{v.size_friendly}} \n {{v.path}} \n{{/each}}"),define("app/tpl/upload.html",[],"\n
\n
\n
\n
{{LNG.upload_select}}
\n
\n
\n
\n\n
\n
\n
\n
\n
{{LNG.download_address}}{{LNG.download}} \n
\n
\n
\n
\n
"+LNG.name+"("+LNG.can_not_repeat+") "+""+LNG.address+"("+LNG.absolute_path+") "+""+LNG.action+" "+""+" "+" "+LNG.button_save_edit+" "+" "+LNG.button_del+" "+" "+" ";if($("table#list").html(i),"fav&"==t.substring(0,4)){var o=t.split("&")[1].split("=")[1],s=t.split("&")[2].split("=")[1],r=" "+" "+LNG.button_save+" "+" "+LNG.button_cancel+" "+" "+" ";$(r).insertAfter("table#list tr:last")}},a=function(){var e=" "+LNG.button_save+" "+" "+LNG.button_cancel+" "+" "+" ";$(e).insertAfter("table#list tr:last")},i=function(){var e=$(this).parent().parent();$(e).detach()},n=function(){var t=$(this).parent().parent(),a=$(t).find("#sname").val(),i=$(t).find("#spath").val();return""==a||""==i?(tips(LNG.not_null,"error"),!1):($.ajax({url:e+"add&name="+a+"&path="+i,dataType:"json",success:function(e){if(tips(e),e.code){$(t).attr("name",a),$(t).attr("path",i);var n=""+LNG.button_save_edit+" "+""+LNG.button_del+" ";$(t).find("td.action").html(n),FrameCall.father("ui.tree.init",'""')}}}),void 0)},o=function(){var t=$(this).parent().parent(),a=$(t).attr("name"),i=$(t).find("#sname").val(),n=$(t).find("#spath").val();return""==i||""==n?(tips(LNG.not_null,"error"),!1):($.ajax({dataType:"json",url:e+"edit&name="+a+"&name_to="+i+"&path_to="+n,success:function(e){tips(e),e.code&&($(t).attr("name",i),FrameCall.father("ui.tree.init",'""'))}}),void 0)},s=function(){var t=$(this).parent().parent(),a=$(t).attr("name");$.ajax({url:e+"del&name="+a,dataType:"json",async:!1,success:function(e){tips(e),e.code&&($(t).detach(),FrameCall.father("ui.tree.init",'""'))}})},r=function(){$(".fav a.add").live("click",a),$(".fav a.addexit").live("click",i),$(".fav a.addsave").live("click",n),$(".fav a.edit").live("click",o),$(".fav a.del").live("click",s)};return{init:t,bindEvent:r}}),define("app/src/setting/group",[],function(){var e="index.php?group/",t={},a=function(){$.ajax({url:e+"get",dataType:"json",async:!1,success:function(e){if(!e.code)return tips(e),void 0;var a=e.data;t={};for(var n in a)t[a[n].role]=a[n];i(),Member.init()},error:function(){return!1}}),$(".group_editor .path_ext_tips").tooltip({placement:"bottom",html:!0}),$(".group_editor .warning").tooltip({placement:"bottom",html:!0,title:function(){return $(".group_tips").html()}})},i=function(){var e=""+LNG.group+" "+""+LNG.name+" "+""+LNG.action+" "+""+LNG.button_edit+" "+" "+LNG.button_del+" ";"root"==t[a].role&&(i=LNG.default_group_can_not_do),e+=""+" "+t[a].role+" "+" "+t[a].name+" "+i+" "}$(".group table#list").html(e)},n=function(){l($(".nav .group_status")),$(".group_editor #role").val("").focus(),$(".group_editor #name").val(""),$(".group_editor #ext_not_allow").val($(".group_editor #ext_not_allow").attr("default")),$(".group_editor .tag").removeClass("this"),$(".group_editor input").removeAttr("checked"),$(".group_editor .edit_save").addClass("hidden"),$(".group_editor .edit_exit").addClass("hidden"),$(".group_editor .add_save").removeClass("hidden"),$(".nav .group_status").html(LNG.setting_group_add)
-},o=function(e){var a;a=t[e],$(".group_editor .tag").removeClass("this"),$(".group_editor input").removeAttr("checked"),$(".group_editor .edit_save").removeClass("hidden"),$(".group_editor .edit_exit").removeClass("hidden"),$(".group_editor .add_save").addClass("hidden"),$(".nav .group_status").html(LNG.setting_group_edit),l($(".nav .group_status")),$(".group_editor #role").val(a.role).attr("data-before",a.role),$(".group_editor #name").val(a.name),$(".group_editor #ext_not_allow").val(a.ext_not_allow),$(".group_editor .tag").each(function(){var e=$(this),t=e.attr("data-role");t=t.split(";"),t=t[0],a[t]&&(e.addClass("this"),e.find("input").attr("checked",!0))})},s=function(){var t=$(".group_editor #role").val(),i=$(".group_editor #name").val(),o=$(".group_editor #ext_not_allow").val(),s={},r="",l="add";if(void 0==o&&(o=""),""==t||""==i)return tips(LNG.not_null,"error"),!1;if(escape(t).indexOf("%u")>=0)return tips("名称不能为中文！","warning"),!1;if($(".group_editor .tag.this").each(function(){for(var e=$(this).attr("data-role").split(";"),t=0;e.length>t;t++)s[e[t]]=1}),$(".group_editor .add_save").hasClass("hidden")){l="edit";var c=$(".group_editor #role").attr("data-before");r="edit&role_old="+c+"&role="+t+"&name="+i+"&ext_not_allow="+o}else r="add&role="+t+"&name="+i+"&ext_not_allow="+o;$.ajax({url:e+r,data:s,type:"POST",dataType:"json",success:function(e){tips(e),e.code&&(a(),"add"==l&&n())}})},r=function(){var t=$(this).parent().parent(),i=$(t).attr("role");$.dialog({fixed:!0,icon:"question",drag:!0,title:LNG.warning,content:LNG.if_remove+i+"? "+LNG.username+" "+""+LNG.group_name+" "+""+LNG.action+" "+""+r.name+" "}for(var o in e)t+=s(e[o].name,e[o].role);$(".member table#list").html(t)},s=function(e,t){void 0==e&&(e=""),void 0==t&&(t="");var a;i[t]?a=i[t].name:(a=LNG.group_not_exists,t="");var n=""+LNG.address+" "+""+LNG.button_edit+" "+""+LNG.button_del+" ";"admin"==e&&(n=LNG.default_group_can_not_do);var o=""+" "+e+" "+" "+a+" "+n+" "+" ";return o},r=function(e,t,i){void 0==t&&(t=""),void 0==i&&(i="");var n="";n="add"==e?{b1:"add_save'>"+LNG.member_add,b2:"add_exit'>"+LNG.button_cancel}:{b1:"edit_save'>"+LNG.button_save_edit,b2:"edit_exit'>"+LNG.button_cancel};var o=""+" "+LNG.username+":"+LNG.password+": "+" "+a+" "+" ' + t + "",
+ i = $.dialog.list.ajaxErrorDialog;
+ return "" == t.substr(0, 17) ? (FrameCall.goRefresh(), void 0) : (i ? i.content(a) : $.dialog({
+ id: "ajaxErrorDialog",
+ padding: 0,
+ width: "60%",
+ height: "50%",
+ fixed: !0,
+ resize: !0,
+ ico: core.ico("error"),
+ title: "ajax error",
+ content: a
+ }), void 0)
+ },
+ file_get: function(e, t) {
+ var a = "./index.php?editor/fileGet&filename=" + urlEncode2(e);
+ G.share_page !== void 0 && (a = "./index.php?share/fileGet&user=" + G.user + "&sid=" + G.sid + "&filename=" + urlEncode2(e)), $.ajax({
+ url: a,
+ dataType: "json",
+ beforeSend: function() {
+ core.tips.loading(LNG.loading)
+ },
+ error: core.ajaxError,
+ success: function(e) {
+ core.tips.close(LNG.success), "function" == typeof t && t(e.data.content)
+ }
+ })
+ },
+ setting: function(e) {
+ void 0 == e && (e = G.is_root ? "system" : "user"), void 0 == window.top.frames.Opensetting_mode ? $.dialog.open("./index.php?setting#" + e, {
+ id: "setting_mode",
+ fixed: !0,
+ ico: core.ico("setting"),
+ resize: !0,
+ title: LNG.setting,
+ width: 960,
+ height: 580
+ }) : ($.dialog.list.setting_mode.display(!0), FrameCall.top("Opensetting_mode", "Setting.setGoto", '"' + e + '"'))
+ },
+ copyright: function() {
+ var e = require("../tpl/copyright.html"),
+ t = template.compile(e),
+ a = t({
+ LNG: LNG,
+ G: G
+ });
+ $.dialog({
+ id: "copyright_dialog",
+ bottom: 0,
+ right: 0,
+ simple: !0,
+ resize: !1,
+ title: LNG.about + " kod",
+ width: 425,
+ padding: "0",
+ fixed: !0,
+ content: a
+ })
+ },
+ appStore: function() {
+ $.dialog.open("./index.php?app", {
+ id: "app_store",
+ fixed: !0,
+ ico: core.ico("appStore"),
+ resize: !0,
+ title: LNG.app_store,
+ width: 900,
+ height: 550
+ })
+ },
+ openIE: function(e) {
+ $.dialog.open(e, {
+ fixed: !0,
+ resize: !0,
+ title: LNG.app_store,
+ width: "80%",
+ height: "70%"
+ })
+ },
+ openApp: function(app) {
+ if ("url" == app.type) {
+ var icon = app.icon; - 1 == app.icon.search(G.static_path) && "http" != app.icon.substring(0, 4) && (icon = G.static_path + "images/app/" + app.icon), "number" != typeof app.width && -1 == app.width.search("%") && (app.width = parseInt(app.width)), "number" != typeof app.height && -1 == app.height.search("%") && (app.height = parseInt(app.height)), $.dialog.open(app.content, {
+ title: app.name,
+ fixed: !0,
+ ico: icon,
+ resize: app.resize,
+ simple: app.simple,
+ title: app.name.replace(".oexe", ""),
+ width: app.width,
+ height: app.height
+ })
+ } else {
+ var exec = app.content;
+ console.log(exec), eval("{" + exec + "}")
+ }
+ },
+ update: function() {
+ var e = base64_decode("aHR0cDovL3N0YXRpYy5rYWxjYWRkbGUuY29tL3VwZGF0ZS9tYWluLmpz") + "?a=" + UUID();
+ require.async(e, function() {
+ try {} catch (e) {}
+ })
+ },
+ explorer: function(e, t) {
+ void 0 == e && (e = ""), void 0 == t && (t = core.pathThis(e));
+ var a = "./index.php?/explorer&type=iframe&path=" + e;
+ G.share_page !== void 0 && (a = "./index.php?share/folder&type=iframe&user=" + G.user + "&sid=" + G.sid + "&path=" + e), $.dialog.open(a, {
+ resize: !0,
+ fixed: !0,
+ ico: core.ico("folder"),
+ title: t,
+ width: 880,
+ height: 550
+ })
+ },
+ explorerCode: function(e) {
+ void 0 == e && (e = "");
+ var t = "index.php?/editor&project=" + e;
+ G.share_page !== void 0 && (t = "./index.php?share/code_read&user=" + G.user + "&sid=" + G.sid + "&project=" + e), $.dialog.open(t, {
+ resize: !0,
+ fixed: !0,
+ ico: core.ico("folder"),
+ title: core.pathThis(e),
+ width: "80%",
+ height: "70%"
+ })
+ },
+ setSkin_finished: function() {
+ var e = $(".setSkin_finished").attr("src");
+ e && ($("#link_css_list").attr("href", e), $(".setSkin_finished").remove())
+ },
+ setSkin: function(e, t) {
+ var a = G.static_path + "style/skin/" + e + t;
+ $("body").append('' + ' ";
+ return i
+ },
+ search: function(e, t) {
+ var a, i, n = require("../tpl/search.html"),
+ o = require("../tpl/search_list.html"),
+ s = function() {
+ var o = template.compile(n);
+ 0 == $(".dialog_do_search").length ? (l(), i = {
+ search: e,
+ path: t,
+ is_content: void 0,
+ is_case: void 0,
+ ext: "",
+ LNG: LNG
+ }, a = $.dialog({
+ id: "dialog_do_search",
+ padding: 0,
+ fixed: !0,
+ ico: core.ico("search"),
+ resize: !0,
+ title: LNG.search,
+ width: 450,
+ content: o(i)
+ }), c(i), $("#search_ext").tooltip({
+ placement: "bottom",
+ html: !0
+ }), $("#search_path").tooltip({
+ placement: "bottom",
+ html: !0,
+ title: function() {
+ return $("#search_path").val()
+ }
+ })) : ($("#search_value").val(e), $("#search_path").val(t), r(), $.dialog.list.dialog_do_search.display(!0))
+ },
+ r = function() {
+ i = {
+ search: $("#search_value").val(),
+ path: $("#search_path").val(),
+ is_content: $("#search_is_content").attr("checked"),
+ is_case: $("#search_is_case").attr("checked"),
+ ext: $("#search_ext").val()
+ }, c(i)
+ },
+ l = function() {
+ $("#search_value").die("keyup").live("keyup", function() {
+ ui.path.setSearchByStr($(this).val())
+ }), $("#search_value,#search_ext,#search_path").keyEnter(r), $(".search_header a.button").die("click").live("click", r), $(".search_result .list .name").die("click").live("click", function() {
+ var e = $(this).find("a").html(),
+ t = $(this).parent().find(".path a").html() + e;
+ $(this).parent().hasClass("file") ? ui.pathOpen.open(t) : "explorer" == Config.pageApp ? ui.path.list(t + "/", "tips") : core.explorer(t + "/")
+ }), $(".search_result .list .path a").die("click").live("click", function() {
+ var e = $(this).html();
+ "explorer" == Config.pageApp ? ui.path.list(e, "tips") : core.explorer(e)
+ })
+ },
+ c = function(e) {
+ var t = 150;
+ $("#search_value").focus(), $(".search_result .list").remove();
+ var a = $(".search_result .message td");
+ if (!e.search || !e.path) return a.hide().html(LNG.search_info).fadeIn(t), void 0;
+ if (1 >= e.search.length) return a.hide().html("too short!").fadeIn(t), void 0;
+ var i = "index.php?explorer/search";
+ G.share_page !== void 0 && (i = "index.php?share/search&user=" + G.user + "&sid=" + G.sid), $.ajax({
+ url: i,
+ dataType: "json",
+ type: "POST",
+ data: e,
+ beforeSend: function() {
+ a.hide().html(LNG.searching + '' + '
' + core.pathThis(i) + " " + '
0b ' + '
' + LNG.upload_ready + " " + '
' + '
' + '
' + core.pathThis(a) + " " + '
' + core.file_size(t.size) + " " + '
' + LNG.upload_ready + " " + '
' + '
\n
\n
\n
——{{LNG.kod_name_copyright}}
\n
\n
\n
{{#LNG.copyright_desc}}
\n
{{#LNG.copyright_contact}}
\n
{{#LNG.copyright_info}}
\n
\n
\n \n
\n
\n \n {{LNG.name}} \n {{LNG.type}} \n {{LNG.size}} \n {{LNG.path}} \n \n
\n
\n
\n {{v.name}} {{LNG.folder}} \n 0 \n {{v.path}} \n{{/each}}\n{{each filelist as v i}}\n\n {{v.name}} {{v.ext}} \n {{v.size_friendly}} \n {{v.path}} \n{{/each}}"), define("app/tpl/upload.html", [], "\n
\n
\n
\n
{{LNG.upload_select}}
\n
\n
\n
\n\n
\n
\n
\n
\n
{{LNG.download_address}}{{LNG.download}} \n
\n
\n
\n
\n
" + LNG.name + "(" + LNG.can_not_repeat + ") " + "" + LNG.address + "(" + LNG.absolute_path + ") " + "" + LNG.action + " " + "" + " " + " " + LNG.button_save_edit + " " + " " + LNG.button_del + " " + " " + " ";
+ if ($("table#list").html(i), "fav&" == t.substring(0, 4)) {
+ var o = t.split("&")[1].split("=")[1],
+ s = t.split("&")[2].split("=")[1],
+ r = " " + " " + LNG.button_save + " " + " " + LNG.button_cancel + " " + " " + " ";
+ $(r).insertAfter("table#list tr:last")
+ }
+ },
+ a = function() {
+ var e = " " + LNG.button_save + " " + " " + LNG.button_cancel + " " + " " + " ";
+ $(e).insertAfter("table#list tr:last")
+ },
+ i = function() {
+ var e = $(this).parent().parent();
+ $(e).detach()
+ },
+ n = function() {
+ var t = $(this).parent().parent(),
+ a = $(t).find("#sname").val(),
+ i = $(t).find("#spath").val();
+ return "" == a || "" == i ? (tips(LNG.not_null, "error"), !1) : ($.ajax({
+ url: e + "add&name=" + a + "&path=" + i,
+ dataType: "json",
+ success: function(e) {
+ if (tips(e), e.code) {
+ $(t).attr("name", a), $(t).attr("path", i);
+ var n = " " + LNG.button_save_edit + " " + "" + LNG.button_del + " ";
+ $(t).find("td.action").html(n), FrameCall.father("ui.tree.init", '""')
+ }
+ }
+ }), void 0)
+ },
+ o = function() {
+ var t = $(this).parent().parent(),
+ a = $(t).attr("name"),
+ i = $(t).find("#sname").val(),
+ n = $(t).find("#spath").val();
+ return "" == i || "" == n ? (tips(LNG.not_null, "error"), !1) : ($.ajax({
+ dataType: "json",
+ url: e + "edit&name=" + a + "&name_to=" + i + "&path_to=" + n,
+ success: function(e) {
+ tips(e), e.code && ($(t).attr("name", i), FrameCall.father("ui.tree.init", '""'))
+ }
+ }), void 0)
+ },
+ s = function() {
+ var t = $(this).parent().parent(),
+ a = $(t).attr("name");
+ $.ajax({
+ url: e + "del&name=" + a,
+ dataType: "json",
+ async: !1,
+ success: function(e) {
+ tips(e), e.code && ($(t).detach(), FrameCall.father("ui.tree.init", '""'))
+ }
+ })
+ },
+ r = function() {
+ $(".fav a.add").live("click", a), $(".fav a.addexit").live("click", i), $(".fav a.addsave").live("click", n), $(".fav a.edit").live("click", o), $(".fav a.del").live("click", s)
+ };
+ return {
+ init: t,
+ bindEvent: r
+ }
+}), define("app/src/setting/group", [], function() {
+ var e = "index.php?group/",
+ t = {},
+ a = function() {
+ $.ajax({
+ url: e + "get",
+ dataType: "json",
+ async: !1,
+ success: function(e) {
+ if (!e.code) return tips(e), void 0;
+ var a = e.data;
+ t = {};
+ for (var n in a) t[a[n].role] = a[n];
+ i(), Member.init()
+ },
+ error: function() {
+ return !1
+ }
+ }), $(".group_editor .path_ext_tips").tooltip({
+ placement: "bottom",
+ html: !0
+ }), $(".group_editor .warning").tooltip({
+ placement: "bottom",
+ html: !0,
+ title: function() {
+ return $(".group_tips").html()
+ }
+ })
+ },
+ i = function() {
+ var e = " " + LNG.group + " " + "" + LNG.name + " " + "" + LNG.action + " " + "" + LNG.button_edit + " " + " " + LNG.button_del + " ";
+ "root" == t[a].role && (i = LNG.default_group_can_not_do), e += "" + " " + t[a].role + " " + " " + t[a].name + " " + i + " "
+ }
+ $(".group table#list").html(e)
+ },
+ n = function() {
+ l($(".nav .group_status")), $(".group_editor #role").val("").focus(), $(".group_editor #name").val(""), $(".group_editor #ext_not_allow").val($(".group_editor #ext_not_allow").attr("default")), $(".group_editor .tag").removeClass("this"), $(".group_editor input").removeAttr("checked"), $(".group_editor .edit_save").addClass("hidden"), $(".group_editor .edit_exit").addClass("hidden"), $(".group_editor .add_save").removeClass("hidden"), $(".nav .group_status").html(LNG.setting_group_add)
+ },
+ o = function(e) {
+ var a;
+ a = t[e], $(".group_editor .tag").removeClass("this"), $(".group_editor input").removeAttr("checked"), $(".group_editor .edit_save").removeClass("hidden"), $(".group_editor .edit_exit").removeClass("hidden"), $(".group_editor .add_save").addClass("hidden"), $(".nav .group_status").html(LNG.setting_group_edit), l($(".nav .group_status")), $(".group_editor #role").val(a.role).attr("data-before", a.role), $(".group_editor #name").val(a.name), $(".group_editor #ext_not_allow").val(a.ext_not_allow), $(".group_editor .tag").each(function() {
+ var e = $(this),
+ t = e.attr("data-role");
+ t = t.split(";"), t = t[0], a[t] && (e.addClass("this"), e.find("input").attr("checked", !0))
+ })
+ },
+ s = function() {
+ var t = $(".group_editor #role").val(),
+ i = $(".group_editor #name").val(),
+ o = $(".group_editor #ext_not_allow").val(),
+ s = {},
+ r = "",
+ l = "add";
+ if (void 0 == o && (o = ""), "" == t || "" == i) return tips(LNG.not_null, "error"), !1;
+ if (escape(t).indexOf("%u") >= 0) return tips("名称不能为中文！", "warning"), !1;
+ if ($(".group_editor .tag.this").each(function() {
+ for (var e = $(this).attr("data-role").split(";"), t = 0; e.length > t; t++) s[e[t]] = 1
+ }), $(".group_editor .add_save").hasClass("hidden")) {
+ l = "edit";
+ var c = $(".group_editor #role").attr("data-before");
+ r = "edit&role_old=" + c + "&role=" + t + "&name=" + i + "&ext_not_allow=" + o
+ } else r = "add&role=" + t + "&name=" + i + "&ext_not_allow=" + o;
+ $.ajax({
+ url: e + r,
+ data: s,
+ type: "POST",
+ dataType: "json",
+ success: function(e) {
+ tips(e), e.code && (a(), "add" == l && n())
+ }
+ })
+ },
+ r = function() {
+ var t = $(this).parent().parent(),
+ i = $(t).attr("role");
+ $.dialog({
+ fixed: !0,
+ icon: "question",
+ drag: !0,
+ title: LNG.warning,
+ content: LNG.if_remove + i + "? " + LNG.username + " " + "" + LNG.group_name + " " + "" + LNG.action + " " + "" + r.name + " "
+ }
+ for (var o in e) t += s(e[o].name, e[o].role);
+ $(".member table#list").html(t)
+ },
+ s = function(e, t) {
+ void 0 == e && (e = ""), void 0 == t && (t = "");
+ var a;
+ i[t] ? a = i[t].name : (a = LNG.group_not_exists, t = "");
+ var n = "" + LNG.address + " " + "" + LNG.button_edit + " " + "" + LNG.button_del + " ";
+ "admin" == e && (n = LNG.default_group_can_not_do);
+ var o = "" + " " + urlEncode2(e) + " " + " " + a + " " + n + " " + " ";
+ return o
+ },
+ r = function(e, t, i) {
+ void 0 == t && (t = ""), void 0 == i && (i = "");
+ var n = "";
+ n = "add" == e ? {
+ b1: "add_save'>" + LNG.member_add,
+ b2: "add_exit'>" + LNG.button_cancel
+ } : {
+ b1: "edit_save'>" + LNG.button_save_edit,
+ b2: "edit_exit'>" + LNG.button_cancel
+ };
+ var o = "" + " " + LNG.username + ":" + LNG.password + ": " + " " + a + " " + "
-
+
-
').fadeIn(t)},error:core.ajaxError,success:function(e){if(!e.code)return a.hide().html(e.data).fadeIn(t),void 0;if(0==e.data.filelist.length&&0==e.data.folderlist.length)return a.hide().html(LNG.search_null).fadeIn(t),void 0;a.hide();var i=template.compile(o);e.data.LNG=LNG,$(i(e.data)).insertAfter(".search_result .message").fadeIn(t)}})};s()},server_dwonload:function(e){core.upload_check("explorer:serverDownload");var t=$(".download_box"),a=t.find("#download_list"),i=t.find("input").val();if(t.find("input").val(""),!i||"http"!=i.substr(0,4))return core.tips.tips("url false!",!1),void 0;var n=UUID(),o='
').fadeIn(t)
+ },
+ error: core.ajaxError,
+ success: function(e) {
+ if (!e.code) return a.hide().html(e.data).fadeIn(t), void 0;
+ if (0 == e.data.filelist.length && 0 == e.data.folderlist.length) return a.hide().html(LNG.search_null).fadeIn(t), void 0;
+ a.hide();
+ var i = template.compile(o);
+ e.data.LNG = LNG, $(i(e.data)).insertAfter(".search_result .message").fadeIn(t)
+ }
+ })
+ };
+ s()
+ },
+ server_dwonload: function(e) {
+ core.upload_check("explorer:serverDownload");
+ var t = $(".download_box"),
+ a = t.find("#download_list"),
+ i = t.find("input").val();
+ if (t.find("input").val(""), !i || "http" != i.substr(0, 4)) return core.tips.tips("url false!", !1), void 0;
+ var n = UUID(),
+ o = '';
+ a.find(".item").length > 0 ? $(o).insertBefore(a.find(".item:eq(0)")) : a.append(o);
+ var s, r, l, c = 0,
+ d = $("#" + n),
+ p = $("#" + n + " .state").text(LNG.download_ready),
+ u = $('
")
+ },
+ success: function(a) {
+ $(".main").css("display", "none"), $(".main").html(a), $(".main").fadeIn("fast"), "fav" == t && Fav.init(e), "member" == t && Group.init(), e = t
+ }
+ })
+ },
+ n = function() {
+ G.is_root ? $("ul.setting #system").show() : $("ul.setting #system").hide(), G.is_root || 1 == AUTH["member:get"] ? $("ul.setting #member").show() : $("ul.setting #member").hide(), e = location.hash.split("#", 2)[1], i(e), $("ul.setting li").hover(function() {
+ $(this).addClass("hover")
+ }, function() {
+ $(this).toggleClass("hover")
+ }).click(function() {
+ e = $(this).attr("id"), i(e)
+ }), $(".box .list").live("hover", function() {
+ $(this).addClass("listhover")
+ }, function() {
+ $(this).toggleClass("listhover")
+ }).live("click", function() {
+ var e = $(this),
+ a = e.parent();
+ switch (type = a.attr("data-type"), value = e.attr("data-value"), a.find(".this").removeClass("this"), e.addClass("this"), type) {
+ case "wall":
+ var i = G.static_path + "images/wall_page/" + value + ".jpg";
+ FrameCall.father("ui.setWall", '"' + i + '"');
+ break;
+ case "theme":
+ t(value);
+ break;
+ case "musictheme":
+ FrameCall.father("CMPlayer.changeTheme", '"music","' + value + '"');
+ break;
+ case "movietheme":
+ FrameCall.father("CMPlayer.changeTheme", '"movie","' + value + '"');
+ break;
+ default:
+ }
+ var n = "index.php?setting/set&k=" + type + "&v=" + value;
+ $.ajax({
+ url: n,
+ type: "json",
+ success: function(e) {
+ e.code ? tips(e) : core.authCheck("setting:set") ? tips(LNG.config_save_error_file, !1) : tips(LNG.config_save_error_auth, !1)
+ }
+ })
+ })
+ },
+ o = function() {
+ var e = $(".selected").attr("id");
+ switch (e) {
+ case "user":
+ var t = $("#password_now").val(),
+ a = $("#password_new").val();
+ if ("" == a || "" == t) {
+ tips(LNG.password_not_null, "error");
+ break
+ }
+ $.ajax({
+ url: "index.php?user/changePassword&password_now=" + t + "&password_new=" + a,
+ dataType: "json",
+ success: function(e) {
+ tips(e), e.code && (window.top.location.href = "./index.php?user/logout")
+ }
+ });
+ break;
+ case "wall":
+ var i = $("#wall_url").val();
+ if ("" == i) {
+ tips(LNG.picture_can_not_null, "error");
+ break
+ }
+ FrameCall.father("ui.setWall", '"' + i + '"'), $(".box").find(".this").removeClass("this");
+ var n = "index.php?setting/set&k=wall&v=" + urlEncode(i);
+ $.ajax({
+ url: n,
+ type: "json",
+ success: function(e) {
+ tips(e)
+ }
+ });
+ default:
+ }
+ };
+ return {
+ init: n,
+ setGoto: i,
+ tools: o,
+ setThemeSelf: a,
+ setTheme: t
+ }
+}), define("app/src/setting/fav", [], function() {
+ var e = "index.php?fav/",
+ t = function(t) {
+ var a;
+ $.ajax({
+ url: e + "get",
+ dataType: "json",
+ async: !1,
+ success: function(e) {
+ return e.code ? (a = e.data, void 0) : (tips(e), void 0)
+ },
+ error: function() {
+ return !1
+ }
+ });
+ var i = "