forked from PrestaShop/PrestaShop
-
Notifications
You must be signed in to change notification settings - Fork 0
/
index.php
158 lines (145 loc) · 6.2 KB
/
index.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
<?php
/*
* 2007-2011 PrestaShop
*
* NOTICE OF LICENSE
*
* This source file is subject to the Open Software License (OSL 3.0)
* that is bundled with this package in the file LICENSE.txt.
* It is also available through the world-wide-web at this URL:
* http://opensource.org/licenses/osl-3.0.php
* If you did not receive a copy of the license and are unable to
* obtain it through the world-wide-web, please send an email
* to [email protected] so we can send you a copy immediately.
*
* DISCLAIMER
*
* Do not edit or add to this file if you wish to upgrade PrestaShop to newer
* versions in the future. If you wish to customize PrestaShop for your
* needs please refer to http://www.prestashop.com for more information.
*
* @author PrestaShop SA <[email protected]>
* @copyright 2007-2011 PrestaShop SA
* @version Release: $Revision: 7451 $
* @license http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
* International Registered Trademark & Property of PrestaShop SA
*/
define('_PS_ADMIN_DIR_', getcwd());
include(_PS_ADMIN_DIR_.'/../config/config.inc.php');
include(_PS_ADMIN_DIR_.'/functions.php');
include(_PS_ADMIN_DIR_.'/init.php');
if (empty($tab) and !sizeof($_POST))
{
$tab = 'AdminHome';
$_POST['tab'] = 'AdminHome';
$_POST['token'] = Tools::getAdminTokenLite($tab);
}
if ($adminObj = checkingTab($tab))
{
// init is different for new tabs (AdminController) and old tabs (AdminTab)
if ($adminObj instanceof AdminController)
{
$adminObj->path = dirname($_SERVER["PHP_SELF"]);
$adminObj->run();
}
else
{
include(_PS_ADMIN_DIR_.'/header.inc.php');
$isoUser = Context::getContext()->language->id;
$tabs = array();
$tabs = recursiveTab($adminObj->id, $tabs);
$tabs = array_reverse($tabs);
$bread = '';
foreach ($tabs AS $key => $item)
$bread .= ' <img src="../img/admin/separator_breadcrum.png" style="margin-right:5px" alt=">" />
'.((sizeof($tabs) - 1 > $key)
? '<a href="?tab='.$item['class_name'].'&token='.Tools::getAdminToken($item['class_name'].intval($item['id_tab']).(int)Context::getContext()->employee->id).'">'
: '').'
'.$item['name'].((sizeof($tabs) - 1 > $key) ? '</a>' : '');
// @TODO : a way to desactivate this feature
echo'<script type="text/javascript">
$(function() {
$.ajax({
type: \'POST\',
url: \'ajax.php\',
data: \'helpAccess=1&item='.$item['class_name'].'&isoUser='.$isoUser.'&country='.Context::getContext()->country->iso_code.'&version='._PS_VERSION_.'\',
async : true,
success: function(msg) {
$("#help-button").html(msg);
$("#help-button").fadeIn("slow");
}
});
});</script>';
echo '<div class="path_bar">
<div id="help-button" class="floatr" style="display: none; font-family: Verdana; font-size: 10px; margin-right: 4px; margin-top: 4px;">
</div>
<a href="?token='.Tools::getAdminToken($tab.intval(Tab::getIdFromClassName($tab)).(int)Context::getContext()->employee->id).'">'.translate('Back Office').'</a>
'.$bread;
echo '
</div>';
if (Shop::isMultiShopActivated() && Context::shop() != Shop::CONTEXT_ALL)
{
echo '<div class="multishop_info">';
if (Context::shop() == Shop::CONTEXT_GROUP)
printf(translate('You are configuring your store for group shop %s'), '<b>'.Context::getContext()->shop->getGroup()->name.'</b>');
elseif (Context::shop() == Shop::CONTEXT_SHOP)
printf(translate('You are configuring your store for shop %s'), '<b>'.Context::getContext()->shop->name.'</b>');
echo '</div>';
}
if (Validate::isLoadedObject($adminObj))
{
if ($adminObj->checkToken())
{
/* Filter memorization */
if (isset($_POST) AND !empty($_POST) AND isset($adminObj->table))
foreach ($_POST AS $key => $value)
if (is_array($adminObj->table))
{
foreach ($adminObj->table AS $table)
if (strncmp($key, $table.'Filter_', 7) === 0 OR strncmp($key, 'submitFilter', 12) === 0)
$cookie->$key = !is_array($value) ? $value : serialize($value);
}
elseif (strncmp($key, $adminObj->table.'Filter_', 7) === 0 OR strncmp($key, 'submitFilter', 12) === 0)
$cookie->$key = !is_array($value) ? $value : serialize($value);
if (isset($_GET) AND !empty($_GET) AND isset($adminObj->table))
foreach ($_GET AS $key => $value)
if (is_array($adminObj->table))
{
foreach ($adminObj->table AS $table)
if (strncmp($key, $table.'OrderBy', 7) === 0 OR strncmp($key, $table.'Orderway', 8) === 0)
$cookie->$key = $value;
}
elseif (strncmp($key, $adminObj->table.'OrderBy', 7) === 0 OR strncmp($key, $adminObj->table.'Orderway', 12) === 0)
$cookie->$key = $value;
$adminObj->displayConf();
$adminObj->postProcess();
$adminObj->displayErrors();
$adminObj->display();
}
else
{
// If this is an XSS attempt, then we should only display a simple, secure page
ob_clean();
// ${1} in the replacement string of the regexp is required, because the token may begin with a number and mix up with it (e.g. $17)
$url = preg_replace('/([&?]token=)[^&]*(&.*)?$/', '${1}'.$adminObj->token.'$2', $_SERVER['REQUEST_URI']);
if (false === strpos($url, '?token=') AND false === strpos($url, '&token='))
$url .= '&token='.$adminObj->token;
$message = translate('Invalid security token');
echo '<html><head><title>'.$message.'</title></head><body style="font-family:Arial,Verdana,Helvetica,sans-serif;background-color:#EC8686">
<div style="background-color:#FAE2E3;border:1px solid #000000;color:#383838;font-weight:700;line-height:20px;margin:0 0 10px;padding:10px 15px;width:500px">
<img src="../img/admin/error2.png" style="margin:-4px 5px 0 0;vertical-align:middle">
'.$message.'
</div>';
echo '<a href="'.htmlentities($url).'" method="get" style="float:left;margin:10px">
<input type="button" value="'.Tools::htmlentitiesUTF8(translate('I understand the risks and I really want to display this page')).'" style="height:30px;margin-top:5px" />
</a>
<a href="index.php" method="get" style="float:left;margin:10px">
<input type="button" value="'.Tools::htmlentitiesUTF8(translate('Take me out of here!')).'" style="height:40px" />
</a>
</body></html>';
die;
}
}
include(_PS_ADMIN_DIR_.'/footer.inc.php');
}
}