<?php
/**
* This is the main dispatcher for the admin interface, a.k.a. The Back-Office.
*
* ---------------------------------------------------------------------------------------------------------------
* IF YOU ARE READING THIS IN YOUR WEB BROWSER, IT MEANS THAT YOU DID NOT LOAD THIS FILE THROUGH A PHP WEB SERVER.
* TO GET STARTED, GO TO THIS PAGE: http://b2evolution.net/man/getting-started
* ---------------------------------------------------------------------------------------------------------------
*
* This file is part of the evoCore framework - {@link http://evocore.net/}
* See also {@link https://github.com/b2evolution/b2evolution}.
*
* @license GNU GPL v2 - {@link http://b2evolution.net/about/gnu-gpl-license}
*
* @copyright (c)2003-2020 by Francois Planque - {@link http://fplanque.com/}
* Parts of this file are copyright (c)2004-2006 by Daniel HAHLER - {@link http://thequod.de/contact}.
* Parts of this file are copyright (c)2005-2006 by PROGIDISTRI - {@link http://progidistri.com/}.
*
* @package main
*/
/**
* Do the MAIN initializations:
*/
require_once dirname(__FILE__).'/conf/_config.php';
/**
* @global boolean Is this an admin page? Use {@link is_admin_page()} to query it, because it may change.
*/
$is_admin_page = true;
// user must be logged in and his/her account must be validated before access to admin
$login_required = true;
$validate_required = true;
require_once $inc_path.'_main.inc.php';
// Check global permission:
if( ! check_user_perm( 'admin', 'restricted' ) )
{ // No permission to access admin...
// asimo> This should always denied access, but we insert a hack to create a temporary solution
// We do allow comments and items actions, if the redirect is set to the front office! This way users without admin access may use the comments, and items controls.
$test_ctrl = param( 'ctrl', '/^[a-z0-9_]+$/', '', false );
$test_redirect_to = param( 'redirect_to', 'url', '', false );
$test_action = param_action();
// asimo> If we also would like to allow publish, deprecate and delete item/comment actions for users without admin access, we must uncomment the commented part below.
if( ( ( $test_ctrl !== 'comments' ) && ( $test_ctrl !== 'items' ) )
|| empty( $test_redirect_to ) || ( strpos( $test_redirect_to, $admin_url ) === 0 )
|| empty( $test_action ) || !in_array( $test_action, array( 'update', 'publish'/*, 'deprecate', 'delete'*/ ) ) )
{
require $adminskins_path.'_access_denied.main.php';
}
}
// Check user email is validated to make sure users can never has access to admin without a validated email address
if( ! check_user_status( 'can_access_admin' ) )
{
if( check_user_status( 'can_be_validated' ) )
{ // redirect back to the login page
$action = 'req_activate_email';
require $htsrv_path.'login.php';
}
else
{ // show access denied
require $adminskins_path.'_access_denied.main.php';
}
}
// Check that the request doesn't exceed the post max size
// This is required because another way not even the $ctrl param can be initialized and the request may freeze
check_post_max_size_exceeded();
/*
* Get the blog from param, defaulting to the last selected one for this user:
* we need it for quite a few of the menu urls
*/
if( isset($collections_Module) )
{
$user_selected_blog = (int)$UserSettings->get('selected_blog');
$BlogCache = & get_BlogCache();
if( param( 'blog', 'integer', NULL, true ) === NULL // We got no explicit blog choice (not even '0' for 'no blog'):
|| ( $blog > 0 && ! ( $Collection = $Blog = & $BlogCache->get_by_ID( $blog, false, false ) ) ) ) // or we requested a nonexistent blog
{ // Try the memorized blog from the previous action:
$blog = $user_selected_blog;
if( ! ( $Collection = $Blog = & $BlogCache->get_by_ID( $blog, false, false ) ) )
{ // That one doesn't exist either...
$blog = 0;
// Unset $Blog because otherwise isset( $Blog ) returns true and it may cause issues later
unset( $Blog, $Collection );
}
}
elseif( $blog != $user_selected_blog )
{ // We have selected a new & valid blog. Update UserSettings for selected blog:
set_working_blog( $blog );
}
}
// bookmarklet, upload (upload actually means sth like: select img for post):
param( 'mode', 'string', '', true );
/*
* Get the Admin skin
* TODO: Allow setting through GET param (dropdown in backoffice), respecting a checkbox "Use different setting on each computer" (if cookie_state handling is ready)
*/
$admin_skin = $UserSettings->get( 'admin_skin' );
$admin_skin_path = $adminskins_path.'%s/_adminUI.class.php';
if( ! $admin_skin || ! file_exists( sprintf( $admin_skin_path, $admin_skin ) ) )
{ // there's no skin for the user
if( !$admin_skin )
{
$Debuglog->add( 'The user has no admin skin set.', 'skins' );
}
else
{
$Debuglog->add( 'The admin skin ['.$admin_skin.'] set by the user does not exist.', 'skins' );
}
$admin_skin = $Settings->get( 'admin_skin' );
if( !$admin_skin || !file_exists( sprintf( $admin_skin_path, $admin_skin ) ) )
{ // even the default skin does not exist!
if( !$admin_skin )
{
$Debuglog->add( 'There is no default admin skin set!', 'skins' );
}
else
{
$Debuglog->add( 'The default admin skin ['.$admin_skin.'] does not exist!', array('skin','error') );
}
// Get the first one available one:
$admin_skin_dirs = get_admin_skins();
if( $admin_skin_dirs === false )
{
$Debuglog->add( 'No admin skin found! Check that the path '.$adminskins_path.' exists.', array('skin','error') );
}
elseif( empty($admin_skin_dirs) )
{ // No admin skin directories found
$Debuglog->add( 'No admin skin found! Check that there are skins in '.$adminskins_path.'.', array('skin','error') );
}
else
{
$admin_skin = array_shift($admin_skin_dirs);
$Debuglog->add( 'Falling back to first available skin.', 'skins' );
}
}
}
if( ! $admin_skin )
{
$Debuglog->display( 'No admin skin available!', '', true, 'skins' );
die(1);
}
$Debuglog->add( 'Using admin skin «'.$admin_skin.'»', 'skins' );
/**
* Load the AdminUI class for the skin.
*/
require_once $adminskins_path.$admin_skin.'/_adminUI.class.php';
/**
* This is the Admin UI object which handles the UI for the backoffice.
*
* @global AdminUI
*/
$AdminUI = new AdminUI();
/*
* Pass over to controller...
*/
// Get requested controller and memorize it:
param( 'ctrl', '/^[a-z0-9_]+$/', $default_ctrl, true );
if( empty( $dont_request_controller ) || !$dont_request_controller )
{ // Don't request the controller if we want initialize only the admin configs above (Used on AJAX refreshing of results table)
// Redirect old-style URLs (e.g. /admin/plugins.php), if they come here because the webserver maps "/admin/" to "/evoadm.php"
// NOTE: this is just meant as a transformation from pre-1.8 to 1.8!
if( ! empty( $_SERVER['PATH_INFO'] ) && $_SERVER['PATH_INFO'] != $_SERVER['PHP_SELF'] ) // the "!= PHP_SELF" check seems needed by IIS..
{
// Try to find the appropriate controller (ctrl) setting
foreach( $ctrl_mappings as $k => $v )
{
if( preg_match( '~'.preg_quote( $_SERVER['PATH_INFO'], '~' ).'$~', $v ) )
{
$ctrl = $k;
break;
}
}
// Sanitize QUERY_STRING
if( ! empty( $_SERVER['QUERY_STRING'] ) )
{
$query_string = explode( '&', $_SERVER['QUERY_STRING'] );
foreach( $query_string as $k => $v )
{
$query_string[$k] = strip_tags($v);
}
$query_string = '&'.implode( '&', $query_string );
}
else
{
$query_string = '';
}
header_redirect( url_add_param( $admin_url, 'ctrl='.$ctrl.$query_string, '&' ), true );
exit(0);
}
// Check matching controller file:
if( !isset($ctrl_mappings[$ctrl]) )
{
debug_die( 'The requested controller ['.$ctrl.'] does not exist.' );
}
// Call the requested controller:
require $inc_path.$ctrl_mappings[$ctrl];
}
?>