From: Andreas Gohr <gohr@cosmocode.de>
Date: Wed, 5 Dec 2007 10:22:21 +0000 (+0100)
Subject: better enforcement of the userlogreq option
X-Git-Tag: 0.7.1~30
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=957e03f1c6791f6275ecfdc5e954c673c930844e;p=contagged

better enforcement of the userlogreq option

darcs-hash:20071205102221-6e07b-344b2e45464c03670e7d745b02f2bdb18de76fd6.gz
---

diff --git a/ajax.php b/ajax.php
index d6bd6ae..2ccb52f 100644
--- a/ajax.php
+++ b/ajax.php
@@ -2,6 +2,13 @@
 require_once('inc/init.php');
 ldap_login();
 
+if ($conf['userlogreq'] && $user == ''){
+  header("HTTP/1.1 401 Access Denied");
+  echo '<h1>Access Denied</h1>';
+  exit();
+}
+
+
 $FIELD = preg_replace('/entry\[/','',$_REQUEST['field']);
 $FIELD = preg_replace('/\W+/','',$FIELD);
 
diff --git a/entry.php b/entry.php
index b79bc69..bb207ce 100644
--- a/entry.php
+++ b/entry.php
@@ -2,6 +2,11 @@
 require_once('inc/init.php');
 ldap_login();
 
+if ($conf['userlogreq'] && $user == ''){
+  header('Location: login.php');
+  exit();
+}
+
 $users = get_users();
 
 //select template to use
diff --git a/img.php b/img.php
index 3cdd23d..cb405cd 100644
--- a/img.php
+++ b/img.php
@@ -2,10 +2,18 @@
 require_once('inc/init.php');
 ldap_login();
 
+if ($conf['userlogreq'] && $user == ''){
+  header("HTTP/1.0 401 Access Denied");
+  echo '<h1>Access Denied</h1>';
+  exit();
+}
+
 $dn = $_REQUEST['dn'];
 
 $sr = ldap_search($LDAP_CON,$dn,'(objectClass=inetOrgPerson)',array($FIELDS['photo']));
 if(!ldap_count_entries($LDAP_CON,$sr)){
+  header("HTTP/1.0 404 Not Found");
+  echo '<h1>Not Found</h1>';
   exit;
 }
 $result = ldap_get_binentries($LDAP_CON, $sr);
diff --git a/import.php b/import.php
index 5521b4a..96579ef 100644
--- a/import.php
+++ b/import.php
@@ -3,7 +3,7 @@ require_once('inc/init.php');
 require_once('inc/Contact_Vcard_Parse.php');
 ldap_login();
 
-if(! $_SESSION['ldapab']['username'] ){
+if(!$user){
   header("Location: login.php");
   exit;
 }
diff --git a/index.php b/index.php
index e41237a..7fcf106 100644
--- a/index.php
+++ b/index.php
@@ -48,8 +48,9 @@
   $smarty->assign('org',$_REQUEST['org']);
   //display templates
   if(!empty($_REQUEST['export'])){
-    if ($conf['userlogreq'] == 1 && $user == ''){
-      header("HTTP/1.1 401 ACCESS DENIED");
+    if ($conf['userlogreq'] && $user == ''){
+      header("HTTP/1.1 401 Access Denied");
+      echo '<h1>Access Denied</h1>';
       exit();
     }
 
diff --git a/orgs.php b/orgs.php
index 7f256b8..f6ce288 100644
--- a/orgs.php
+++ b/orgs.php
@@ -2,6 +2,11 @@
   require_once('inc/init.php');
   ldap_login();
 
+  if ($conf['userlogreq'] && $user == ''){
+      header('Location: login.php');
+      exit();
+  }
+
   //prepare templates
   tpl_std();
   tpl_orgs();
diff --git a/tags.php b/tags.php
index 3b06df6..b81e50e 100644
--- a/tags.php
+++ b/tags.php
@@ -2,6 +2,11 @@
   require_once('inc/init.php');
   ldap_login();
 
+  if ($conf['userlogreq'] && $user == ''){
+    header('Location: login.php');
+    exit();
+  }
+
   //prepare templates
   tpl_std();
   $smarty->assign('tagcloud',tag_cloud());
diff --git a/templates/toolbar.tpl b/templates/toolbar.tpl
index a44c5e1..014348d 100644
--- a/templates/toolbar.tpl
+++ b/templates/toolbar.tpl
@@ -1,83 +1,85 @@
 <ul>
+  {if $user or !$conf.userlogreq}
 
-  <!-- company list -->
-  <li>
-    <a href="orgs.php" class="ed_orgs">{$lang.orgs}</a>
-  </li>
-
-  <li class="sep">&nbsp;</li>
-
-  {if $user} <!-- new contact -->
-    <li>
-      <a href="entry.php?mode=edit" class="ed_new">{$lang.new}</a>
-    </li>
-  {/if}
-
-  <li class="sep">&nbsp;</li>
-
-  {if $dn} <!-- begin contact page functions -->
+      <!-- company list -->
+      <li>
+          <a href="orgs.php" class="ed_orgs">{$lang.orgs}</a>
+      </li>
 
-    {if $user} <!-- begin editing functions -->
+      <li class="sep">&nbsp;</li>
 
-      <!-- edit/show, copy, delete -->
-      {if $smarty.request.mode == 'edit'}
+      {if $user} <!-- new contact -->
         <li>
-          <a href="entry.php?dn={$dn|escape:url}" class="ed_show">{$lang.show}</a>
-        </li>
-      {elseif $smarty.request.mode != 'copy'}
-        <li>
-          <a href="entry.php?dn={$dn|escape:url}&amp;mode=edit" class="ed_edit">{$lang.edit}</a>
-        </li>
-        <li>
-          <a href="entry.php?dn={$dn|escape:url}&amp;mode=copy" class="ed_copy">{$lang.copy}</a>
-        </li>
-        <li>
-          <a href="entry.php?dn={$dn|escape:url}&amp;del=1" onclick="return confirm('{$lang.msg_reallydel}');"
-             class="ed_delete">{$lang.delete}</a>
+          <a href="entry.php?mode=edit" class="ed_new">{$lang.new}</a>
         </li>
       {/if}
 
-    {/if} <!-- end editing functions -->
-
-    <!-- vcf export -->
-    <li>
-      <a href="entry.php?dn={$dn|escape:url}&amp;mode=vcf" class="ed_vcfexport">{$lang.vcfexport}</a>
-    </li>
-
-    <!-- show on map -->
-    {if $smarty.request.mode == 'map' && $conf.gmapkey}
+      <li class="sep">&nbsp;</li>
+
+      {if $dn} <!-- begin contact page functions -->
+
+        {if $user} <!-- begin editing functions -->
+
+          <!-- edit/show, copy, delete -->
+          {if $smarty.request.mode == 'edit'}
+            <li>
+              <a href="entry.php?dn={$dn|escape:url}" class="ed_show">{$lang.show}</a>
+            </li>
+          {elseif $smarty.request.mode != 'copy'}
+            <li>
+              <a href="entry.php?dn={$dn|escape:url}&amp;mode=edit" class="ed_edit">{$lang.edit}</a>
+            </li>
+            <li>
+              <a href="entry.php?dn={$dn|escape:url}&amp;mode=copy" class="ed_copy">{$lang.copy}</a>
+            </li>
+            <li>
+              <a href="entry.php?dn={$dn|escape:url}&amp;del=1" onclick="return confirm('{$lang.msg_reallydel}');"
+                 class="ed_delete">{$lang.delete}</a>
+            </li>
+          {/if}
+
+        {/if} <!-- end editing functions -->
+
+        <!-- vcf export -->
         <li>
-          <a href="entry.php?dn={$dn|escape:url}" class="ed_show">{$lang.show}</a>
+          <a href="entry.php?dn={$dn|escape:url}&amp;mode=vcf" class="ed_vcfexport">{$lang.vcfexport}</a>
         </li>
-    {elseif $conf.gmapkey}
+
+        <!-- show on map -->
+        {if $smarty.request.mode == 'map' && $conf.gmapkey}
+            <li>
+              <a href="entry.php?dn={$dn|escape:url}" class="ed_show">{$lang.show}</a>
+            </li>
+        {elseif $conf.gmapkey}
+            <li>
+              <a href="entry.php?dn={$dn|escape:url}&amp;mode=map" class="ed_map">{$lang.map}</a>
+            </li>
+        {/if}
+
+        <li class="sep">&nbsp;</li>
+      {/if} <!-- end contact page functions -->
+
+
+      {if $list} <!-- export -->
+        {if $smarty.request.export != 'map' && $conf.gmapkey}
+            <li>
+              <a href="index.php?filter={$filter|escape:url}&amp;marker={$marker|escape:url}&amp;search={$search|escape:url}&amp;org={$org|escape:url}&amp;export=map" class="ed_map">{$lang.map}</a>
+            </li>
+        {/if}
         <li>
-          <a href="entry.php?dn={$dn|escape:url}&amp;mode=map" class="ed_map">{$lang.map}</a>
+          <a href="index.php?filter={$filter|escape:url}&amp;marker={$marker|escape:url}&amp;search={$search|escape:url}&amp;org={$org|escape:url}&amp;export=csv"
+             class="ed_csvexport">{$lang.csvexport}</a>
         </li>
-    {/if}
-
-    <li class="sep">&nbsp;</li>
-  {/if} <!-- end contact page functions -->
-
+      {/if}
 
-  {if $list} <!-- export -->
-    {if $smarty.request.export != 'map' && $conf.gmapkey}
+      {if $user} <!-- import -->
         <li>
-          <a href="index.php?filter={$filter|escape:url}&amp;marker={$marker|escape:url}&amp;search={$search|escape:url}&amp;org={$org|escape:url}&amp;export=map" class="ed_map">{$lang.map}</a>
+          <a href="import.php" class="ed_vcfimport">{$lang.vcfimport}</a>
         </li>
-    {/if}
-    <li>
-      <a href="index.php?filter={$filter|escape:url}&amp;marker={$marker|escape:url}&amp;search={$search|escape:url}&amp;org={$org|escape:url}&amp;export=csv"
-         class="ed_csvexport">{$lang.csvexport}</a>
-    </li>
-  {/if}
+      {/if}
 
-  {if $user} <!-- import -->
-    <li>
-      <a href="import.php" class="ed_vcfimport">{$lang.vcfimport}</a>
-    </li>
   {/if}
 
-
   <!-- help -->
   <li class="right">
     <a href="help.php" class="ed_help">{$lang.help}</a>