Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | Fix misplaced / missing db_unprotect() calls in the 'waliassetup' and 'setup_logo' pages. |
|---|---|
| Timelines: | family | ancestors | descendants | both | trunk |
| Files: | files | file ages | folders |
| SHA3-256: |
f273832a730808261859ff2ee3ee1805 |
| User & Date: | mistachkin 2020-09-10 21:51:20.039 |
Context
|
2020-09-10
| ||
| 22:15 | Fix typo in the 'admin_sql' page. check-in: e654b300f6 user: mistachkin tags: trunk | |
| 21:51 | Fix misplaced / missing db_unprotect() calls in the 'waliassetup' and 'setup_logo' pages. check-in: f273832a73 user: mistachkin tags: trunk | |
| 18:15 | Allow the setup pages to change email-send-method. check-in: 95e735165e user: drh tags: trunk | |
Changes
Changes to src/setup.c.
| ︙ | ︙ | |||
1270 1271 1272 1273 1274 1275 1276 |
}
login_check_credentials();
if( !g.perm.Admin ){
login_needed(0);
return;
}
db_begin_transaction();
| < > > > > | 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 |
}
login_check_credentials();
if( !g.perm.Admin ){
login_needed(0);
return;
}
db_begin_transaction();
if( !cgi_csrf_safe(1) ){
/* Allow no state changes if not safe from CSRF */
}else if( P("setlogo")!=0 && zLogoMime && zLogoMime[0] && szLogoImg>0 ){
Blob img;
Stmt ins;
blob_init(&img, aLogoImg, szLogoImg);
db_unprotect(PROTECT_CONFIG);
db_prepare(&ins,
"REPLACE INTO config(name,value,mtime)"
" VALUES('logo-image',:bytes,now())"
);
db_bind_blob(&ins, ":bytes", &img);
db_step(&ins);
db_finalize(&ins);
db_multi_exec(
"REPLACE INTO config(name,value,mtime) VALUES('logo-mimetype',%Q,now())",
zLogoMime
);
db_protect_pop();
db_end_transaction(0);
cgi_redirect("setup_logo");
}else if( P("clrlogo")!=0 ){
db_unprotect(PROTECT_CONFIG);
db_multi_exec(
"DELETE FROM config WHERE name IN "
"('logo-image','logo-mimetype')"
);
db_protect_pop();
db_end_transaction(0);
cgi_redirect("setup_logo");
}else if( P("setbg")!=0 && zBgMime && zBgMime[0] && szBgImg>0 ){
Blob img;
Stmt ins;
blob_init(&img, aBgImg, szBgImg);
db_unprotect(PROTECT_CONFIG);
|
| ︙ | ︙ | |||
1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 |
cgi_redirect("setup_logo");
}else if( P("clrbg")!=0 ){
db_unprotect(PROTECT_CONFIG);
db_multi_exec(
"DELETE FROM config WHERE name IN "
"('background-image','background-mimetype')"
);
db_end_transaction(0);
cgi_redirect("setup_logo");
}else if( P("seticon")!=0 && zIconMime && zIconMime[0] && szIconImg>0 ){
Blob img;
Stmt ins;
blob_init(&img, aIconImg, szIconImg);
db_unprotect(PROTECT_CONFIG);
| > | 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 |
cgi_redirect("setup_logo");
}else if( P("clrbg")!=0 ){
db_unprotect(PROTECT_CONFIG);
db_multi_exec(
"DELETE FROM config WHERE name IN "
"('background-image','background-mimetype')"
);
db_protect_pop();
db_end_transaction(0);
cgi_redirect("setup_logo");
}else if( P("seticon")!=0 && zIconMime && zIconMime[0] && szIconImg>0 ){
Blob img;
Stmt ins;
blob_init(&img, aIconImg, szIconImg);
db_unprotect(PROTECT_CONFIG);
|
| ︙ | ︙ | |||
1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 |
" VALUES('icon-mimetype',%Q,now())",
zIconMime
);
db_protect_pop();
db_end_transaction(0);
cgi_redirect("setup_logo");
}else if( P("clricon")!=0 ){
db_multi_exec(
"DELETE FROM config WHERE name IN "
"('icon-image','icon-mimetype')"
);
db_end_transaction(0);
cgi_redirect("setup_logo");
}
style_header("Edit Project Logo And Background");
@ <p>The current project logo has a MIME-Type of <b>%h(zLogoMime)</b>
@ and looks like this:</p>
@ <blockquote><p><img src="%s(g.zTop)/logo/%z(zLogoMtime)" \
| > > | 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 |
" VALUES('icon-mimetype',%Q,now())",
zIconMime
);
db_protect_pop();
db_end_transaction(0);
cgi_redirect("setup_logo");
}else if( P("clricon")!=0 ){
db_unprotect(PROTECT_CONFIG);
db_multi_exec(
"DELETE FROM config WHERE name IN "
"('icon-image','icon-mimetype')"
);
db_protect_pop();
db_end_transaction(0);
cgi_redirect("setup_logo");
}
style_header("Edit Project Logo And Background");
@ <p>The current project logo has a MIME-Type of <b>%h(zLogoMime)</b>
@ and looks like this:</p>
@ <blockquote><p><img src="%s(g.zTop)/logo/%z(zLogoMtime)" \
|
| ︙ | ︙ | |||
1802 1803 1804 1805 1806 1807 1808 |
const char *zOldName,
const char *zNewName,
const char *zValue
){
if( !cgi_csrf_safe(1) ) return;
if( zNewName[0]==0 || zValue[0]==0 ){
if( zOldName[0] ){
| < < < < < < | 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 |
const char *zOldName,
const char *zNewName,
const char *zValue
){
if( !cgi_csrf_safe(1) ) return;
if( zNewName[0]==0 || zValue[0]==0 ){
if( zOldName[0] ){
blob_append_sql(pSql,
"DELETE FROM config WHERE name='walias:%q';\n",
zOldName);
}
return;
}
if( zOldName[0]==0 ){
blob_append_sql(pSql,
"INSERT INTO config(name,value,mtime) VALUES('walias:%q',%Q,now());\n",
zNewName, zValue);
return;
}
if( strcmp(zOldName, zNewName)!=0 ){
blob_append_sql(pSql,
"UPDATE config SET name='walias:%q', value=%Q, mtime=now()"
" WHERE name='walias:%q';\n",
zNewName, zValue, zOldName);
}else{
blob_append_sql(pSql,
"UPDATE config SET value=%Q, mtime=now()"
" WHERE name='walias:%q' AND value<>%Q;\n",
zValue, zOldName, zValue);
}
}
/*
** WEBPAGE: waliassetup
**
** Configure the URL aliases
*/
|
| ︙ | ︙ | |||
1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 |
blob_reset(&token);
}
sqlite3_snprintf(sizeof(zCnt), zCnt, "n%d", cnt);
zNewName = PD(zCnt,"");
sqlite3_snprintf(sizeof(zCnt), zCnt, "v%d", cnt);
zValue = PD(zCnt,"");
setup_update_url_alias(&sql, "", zNewName, zValue);
db_multi_exec("%s", blob_sql_text(&sql));
blob_reset(&sql);
blob_reset(&namelist);
cnt = 0;
}
db_prepare(&q,
"SELECT substr(name,8), value FROM config WHERE name GLOB 'walias:/*'"
" UNION ALL SELECT '', ''"
| > > | 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 |
blob_reset(&token);
}
sqlite3_snprintf(sizeof(zCnt), zCnt, "n%d", cnt);
zNewName = PD(zCnt,"");
sqlite3_snprintf(sizeof(zCnt), zCnt, "v%d", cnt);
zValue = PD(zCnt,"");
setup_update_url_alias(&sql, "", zNewName, zValue);
db_unprotect(PROTECT_CONFIG);
db_multi_exec("%s", blob_sql_text(&sql));
db_protect_pop();
blob_reset(&sql);
blob_reset(&namelist);
cnt = 0;
}
db_prepare(&q,
"SELECT substr(name,8), value FROM config WHERE name GLOB 'walias:/*'"
" UNION ALL SELECT '', ''"
|
| ︙ | ︙ |