BugTrack/2062 Remove Referer function config default page

[pukiwiki/pukiwiki.git] / plugin / diff.inc.php

diff --git a/plugin/diff.inc.php b/plugin/diff.inc.php
index 5002457..c9fd509 100644 (file)
--- a/plugin/diff.inc.php
+++ b/plugin/diff.inc.php
@@ -1,50 +1,113 @@
 <?php
-/////////////////////////////////////////////////
 // PukiWiki - Yet another WikiWikiWeb clone.
+// $Id: diff.inc.php,v 1.20 2011/01/25 15:01:01 henoheno Exp $
+// Copyright (C)
+//   2002-2005 PukiWiki Developers Team
+//   2002      Originally written by yu-ji
+// License: GPL v2 or (at your option) any later version
 //
-// $Id: diff.inc.php,v 1.1 2003/01/27 05:38:44 panda Exp $
-//
-//¥Ú¡¼¥¸¤Îº¹Ê¬¤òɽ¼¨¤¹¤ë
+// Showing colored-diff plugin
+
 function plugin_diff_action()
 {
-       global $script,$get,$hr;
-       global $_msg_notfound,$_msg_goto,$_msg_addline,$_msg_delline,$_title_diff;
-       
-       $r_page = rawurlencode($get['page']);
-       $s_page = htmlspecialchars($get['page']);
-       $s_name = strip_bracket($s_page);
-       
-       $msg = $_title_diff;
-       $body = '';
-       
-       if (is_page($get['page'])) {
-               $link = str_replace('$1',"<a href=\"$script?$r_page\">$s_name</a>",$_msg_goto);
-               $body = <<<EOD
+       global $vars;
+
+       $page = isset($vars['page']) ? $vars['page'] : '';
+       check_readable($page, true, true);
+
+       $action = isset($vars['action']) ? $vars['action'] : '';
+       switch ($action) {
+               case 'delete': $retval = plugin_diff_delete($page);     break;
+               default:       $retval = plugin_diff_view($page);       break;
+       }
+       return $retval;
+}
+
+function plugin_diff_view($page)
+{
+       global $script, $hr;
+       global $_msg_notfound, $_msg_goto, $_msg_deleted, $_msg_addline, $_msg_delline, $_title_diff;
+       global $_title_diff_delete;
+
+       $r_page = pagename_urlencode($page);
+       $s_page = htmlsc($page);
+
+       $menu = array(
+               '<li>' . $_msg_addline . '</li>',
+               '<li>' . $_msg_delline . '</li>'
+       );
+
+       $is_page = is_page($page);
+       if ($is_page) {
+               $menu[] = ' <li>' . str_replace('$1', '<a href="' . $script . '?' . $r_page . '">' .
+                       $s_page . '</a>', $_msg_goto) . '</li>';
+       } else {
+               $menu[] = ' <li>' . str_replace('$1', $s_page, $_msg_deleted) . '</li>';
+       }
+
+       $filename = DIFF_DIR . encode($page) . '.txt';
+       if (file_exists($filename)) {
+               if (! PKWK_READONLY) {
+                       $menu[] = '<li><a href="' . $script . '?cmd=diff&amp;action=delete&amp;page=' .
+                               $r_page . '">' . str_replace('$1', $s_page, $_title_diff_delete) . '</a></li>';
+               }
+               $msg = '<pre>' . diff_style_to_css(htmlsc(join('', file($filename)))) . '</pre>' . "\n";
+       } else if ($is_page) {
+               $diffdata = trim(htmlsc(join('', get_source($page))));
+               $msg = '<pre><span class="diff_added">' . $diffdata . '</span></pre>' . "\n";
+       } else {
+               return array('msg'=>$_title_diff, 'body'=>$_msg_notfound);
+       }
+
+       $menu = join("\n", $menu);
+       $body = <<<EOD
 <ul>
- <li>$_msg_addline</li>
- <li>$_msg_delline</li>
- <li>$link</li>
+$menu
 </ul>
 $hr
 EOD;
+
+       return array('msg'=>$_title_diff, 'body'=>$body . $msg);
+}
+
+function plugin_diff_delete($page)
+{
+       global $script, $vars;
+       global $_title_diff_delete, $_msg_diff_deleted;
+       global $_msg_diff_adminpass, $_btn_delete, $_msg_invalidpass;
+
+       $filename = DIFF_DIR . encode($page) . '.txt';
+       $body = '';
+       if (! is_pagename($page))     $body = 'Invalid page name';
+       if (! file_exists($filename)) $body = make_pagelink($page) . '\'s diff seems not found';
+       if ($body) return array('msg'=>$_title_diff_delete, 'body'=>$body);
+
+       if (isset($vars['pass'])) {
+               if (pkwk_login($vars['pass'])) {
+                       unlink($filename);
+                       return array(
+                               'msg'  => $_title_diff_delete,
+                               'body' => str_replace('$1', make_pagelink($page), $_msg_diff_deleted)
+                       );
+               } else {
+                       $body .= '<p><strong>' . $_msg_invalidpass . '</strong></p>' . "\n";
+               }
        }
-       
-       if (file_exists(DIFF_DIR.encode($get['page']).'.txt')) {
-               $diffdata = htmlspecialchars(join('',file(DIFF_DIR.encode($get['page']).'.txt')));
-               $diffdata = preg_replace('/^(\-)(.*)$/m','<span class="diff_removed"> $2</span>',$diffdata);
-               $diffdata = preg_replace('/^(\+)(.*)$/m','<span class="diff_added"> $2</span>',$diffdata);
-               $diffdata = trim($diffdata);
-               $body .= "<pre>$diffdata</pre>\n";
-       }
-       else if (is_page($get['page'])) {
-               $diffdata = trim(htmlspecialchars(join('',get_source($get['page']))));
-               $body .= "<pre><span class=\"diff_added\">$diffdata</span></pre>\n";
-       }
-       else {
-               $title = $s_name;
-               $body = $_msg_notfound;
-       }
-       
-       return array('msg'=>$msg,'body'=>$body);
+
+       $s_page = htmlsc($page);
+       $body .= <<<EOD
+<p>$_msg_diff_adminpass</p>
+<form action="$script" method="post">
+ <div>
+  <input type="hidden"   name="cmd"    value="diff" />
+  <input type="hidden"   name="page"   value="$s_page" />
+  <input type="hidden"   name="action" value="delete" />
+  <input type="password" name="pass"   size="12" />
+  <input type="submit"   name="ok"     value="$_btn_delete" />
+ </div>
+</form>
+EOD;
+
+       return array('msg'=>$_title_diff_delete, 'body'=>$body);
 }
-?>
+