Security fix

git-svn-id: https://svn.sourceforge.jp/svnroot/nucleus-jp/nucleus-jp/trunk/utf8@234 1ca29b6e-896d-4ea0-84a5-967f57386b96

diff --git a/nucleus/libs/ADMIN.php b/nucleus/libs/ADMIN.php
index f33ede6..5175c13 100755 (executable)
--- a/nucleus/libs/ADMIN.php
+++ b/nucleus/libs/ADMIN.php
@@ -14,11 +14,12 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2007 The Nucleus Group
- * @version $Id: ADMIN.php,v 1.18 2007-03-19 10:21:41 shizuki Exp $
- * @version $NucleusJP: ADMIN.php,v 1.15 2007/02/09 02:47:47 kimitake Exp $
+ * @version $Id: ADMIN.php,v 1.19 2007-03-20 19:31:29 kmorimatsu Exp $
+ * @version $NucleusJP: ADMIN.php,v 1.18 2007/03/19 10:21:41 shizuki Exp $
  */
 
-require_once "showlist.php";
+if ( !function_exists('requestVar') ) exit;
+require_once dirname(__FILE__) . '/showlist.php';
 
 /**
  * Builds the admin area and executes admin actions

diff --git a/nucleus/libs/BLOG.php b/nucleus/libs/BLOG.php
index d338417..f6a51ad 100755 (executable)
--- a/nucleus/libs/BLOG.php
+++ b/nucleus/libs/BLOG.php
@@ -16,12 +16,12 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2007 The Nucleus Group
- * @version $Id: BLOG.php,v 1.10 2007-03-13 05:13:29 shizuki Exp $
- * $NucleusJP: BLOG.php,v 1.9 2007/02/17 04:39:29 shizuki Exp $
+ * @version $Id: BLOG.php,v 1.11 2007-03-20 19:31:29 kmorimatsu Exp $
+ * $NucleusJP: BLOG.php,v 1.10 2007/03/13 05:13:29 shizuki Exp $
  */
 
-// temporary: dirt way to separe class ITEMACTIONS from BLOG
-require_once $DIR_LIBS . 'ITEMACTIONS.php';
+if ( !function_exists('requestVar') ) exit;
+require_once dirname(__FILE__) . '/ITEMACTIONS.php';
 
 class BLOG {
 

diff --git a/nucleus/libs/COMMENTS.php b/nucleus/libs/COMMENTS.php
index c9004bc..001b175 100755 (executable)
--- a/nucleus/libs/COMMENTS.php
+++ b/nucleus/libs/COMMENTS.php
@@ -15,12 +15,12 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2007 The Nucleus Group
- * @version $Id: COMMENTS.php,v 1.8 2007-03-13 05:12:19 shizuki Exp $
- * $NucleusJP: COMMENTS.php,v 1.7 2007/02/04 06:28:46 kimitake Exp $
+ * @version $Id: COMMENTS.php,v 1.9 2007-03-20 19:31:29 kmorimatsu Exp $
+ * $NucleusJP: COMMENTS.php,v 1.8 2007/03/13 05:12:19 shizuki Exp $
  */
 
-// temporary: dirt way to separe class COMMENTACTIONS from COMMENTS
-require_once $DIR_LIBS . 'COMMENTACTIONS.php';
+if ( !function_exists('requestVar') ) exit;
+require_once dirname(__FILE__) . '/COMMENTACTIONS.php';
 
 class COMMENTS {
 

diff --git a/nucleus/libs/PARSER.php b/nucleus/libs/PARSER.php
index bae6085..fdef712 100755 (executable)
--- a/nucleus/libs/PARSER.php
+++ b/nucleus/libs/PARSER.php
@@ -12,12 +12,13 @@
 /**
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2007 The Nucleus Group
- * @version $Id: PARSER.php,v 1.6 2007-02-04 06:28:46 kimitake Exp $
- * $NucleusJP: PARSER.php,v 1.5 2006/07/12 07:11:47 kimitake Exp $
+ * @version $Id: PARSER.php,v 1.7 2007-03-20 19:31:29 kmorimatsu Exp $
+ * $NucleusJP: PARSER.php,v 1.6 2007/02/04 06:28:46 kimitake Exp $
  */
 
-// temporary: dirt way to separe class BaseActions from PARSER
-require_once $DIR_LIBS . 'BaseActions.php';
+if ( !function_exists('requestVar') ) exit;
+require_once dirname(__FILE__) . '/BaseActions.php';
+
 /**
  * This is the parser class of Nucleus. It is used for various things (skin parsing,
  * form generation, ...)

diff --git a/nucleus/libs/SKIN.php b/nucleus/libs/SKIN.php
index 217fb47..126233a 100755 (executable)
--- a/nucleus/libs/SKIN.php
+++ b/nucleus/libs/SKIN.php
@@ -10,17 +10,18 @@
  * (see nucleus/documentation/index.html#license for more info)
  */
 
-// temporary: dirt way to separe class ACTIONS from SKIN
-require_once $DIR_LIBS . 'ACTIONS.php';
-
 /**
  * Class representing a skin
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2007 The Nucleus Group
- * @version $Id: SKIN.php,v 1.7 2007-02-04 06:28:46 kimitake Exp $
- * @version $NucleusJP: SKIN.php,v 1.6 2006/07/20 08:01:52 kimitake Exp $
+ * @version $Id: SKIN.php,v 1.8 2007-03-20 19:31:29 kmorimatsu Exp $
+ * @version $NucleusJP: SKIN.php,v 1.7 2007/02/04 06:28:46 kimitake Exp $
  */
+
+if ( !function_exists('requestVar') ) exit;
+require_once dirname(__FILE__) . '/ACTIONS.php';
+
 class SKIN {
 
        // after creating a SKIN object, evaluates to true when the skin exists

diff --git a/nucleus/media.php b/nucleus/media.php
index 332a4a5..3a0e8a2 100755 (executable)
--- a/nucleus/media.php
+++ b/nucleus/media.php
@@ -21,8 +21,8 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2007 The Nucleus Group
- * @version $Id: media.php,v 1.7 2007-02-04 06:28:45 kimitake Exp $
- * $NucleusJP: media.php,v 1.6 2006/07/17 20:01:39 kimitake Exp $
+ * @version $Id: media.php,v 1.8 2007-03-20 19:32:19 kmorimatsu Exp $
+ * $NucleusJP: media.php,v 1.7 2007/02/04 06:28:45 kimitake Exp $
  *
  */
 
@@ -34,7 +34,7 @@ $CONF = array();
 $CONF['MediaPerPage'] = 10;
 
 // include all classes and config data
-include('../config.php');
+require('../config.php');
 include($DIR_LIBS . 'MEDIA.php');      // media classes
 
 sendContentType('application/xhtml+xml', 'media');

diff --git a/nucleus/plugins/skinfiles/index.php b/nucleus/plugins/skinfiles/index.php
index dc89d0a..fd7a442 100644 (file)
--- a/nucleus/plugins/skinfiles/index.php
+++ b/nucleus/plugins/skinfiles/index.php
@@ -5,8 +5,8 @@
        *
        * Copyright 2005-2007 by Jeff MacMichael and Niels Leenheer
        *
-       * @version $Id: index.php,v 1.5 2007-02-04 06:28:46 kimitake Exp $
-       * @version $NucleusJP: index.php,v 1.4 2007/01/31 10:02:58 kimitake Exp $
+       * @version $Id: index.php,v 1.6 2007-03-20 19:32:47 kmorimatsu Exp $
+       * @version $NucleusJP: index.php,v 1.5 2007/02/04 06:28:46 kimitake Exp $
        *
        * ==========================================================================================
        * This program is free software and open source software; you can redistribute
@@ -27,7 +27,7 @@
        */
 
        $strRel = '../../../'; 
-       include($strRel . 'config.php');
+       require($strRel . 'config.php');
        include($DIR_LIBS . 'PLUGINADMIN.php');
 
        $language = ereg_replace( '[\\|/]', '', getLanguageName());

diff --git a/nucleus/xmlrpc/server.php b/nucleus/xmlrpc/server.php
index 4007b8e..623449a 100755 (executable)
--- a/nucleus/xmlrpc/server.php
+++ b/nucleus/xmlrpc/server.php
@@ -62,11 +62,11 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2007 The Nucleus Group
- * @version $Id: server.php,v 1.7 2007-02-04 06:28:46 kimitake Exp $
- * @version $NucleusJP: server.php,v 1.6 2006/07/17 20:03:45 kimitake Exp $
+ * @version $Id: server.php,v 1.8 2007-03-20 19:33:25 kmorimatsu Exp $
+ * @version $NucleusJP: server.php,v 1.7 2007/02/04 06:28:46 kimitake Exp $
  */
 $CONF = array();
-include("../../config.php");   // include Nucleus libs and code
+require("../../config.php");   // include Nucleus libs and code
 include($DIR_LIBS . "xmlrpc.inc.php");
 include($DIR_LIBS . "xmlrpcs.inc.php");