/** * Bitrix Framework * @package bitrix * @subpackage main * @copyright 2001-2013 Bitrix */ /** * Bitrix vars * @global CUser $USER * @global CMain $APPLICATION */ require_once($_SERVER["DOCUMENT_ROOT"]."/bitrix/modules/main/include/prolog_admin_before.php"); require_once($_SERVER["DOCUMENT_ROOT"].BX_ROOT."/modules/main/prolog.php"); define("HELP_FILE", "settings/sites/template_edit.php"); CModule::IncludeModule("fileman"); //Workaround for Chrome: http://code.google.com/p/chromium/issues/detail?id=79014 //"If the XSS auditor is blocking script that you mean to execute, you can disable it by sending a 'X-XSS-Protection: 0' header." header("X-XSS-Protection: 0"); ClearVars(); $edit_php = $USER->CanDoOperation('edit_php'); if(!$edit_php && !$USER->CanDoOperation('view_other_settings') && !$USER->CanDoOperation('lpa_template_edit')) $APPLICATION->AuthForm(GetMessage("ACCESS_DENIED")); $isEditingMessageThemePage = $APPLICATION->GetCurPage() == '/bitrix/admin/message_theme_edit.php'; IncludeModuleLangFile(__FILE__); $lpa = ($USER->CanDoOperation('lpa_template_edit') && !$edit_php); // Limit PHP access: for non admin users $lpa_view = !$USER->CanDoOperation('edit_other_settings') && !$USER->CanDoOperation('lpa_template_edit'); // $strError = ""; $strOK = ""; $bVarsFromForm = false; $codeEditorId = false; $ID = _normalizePath($_REQUEST["ID"] ?? ''); if($lpa && (!isset($_REQUEST['edit']) || $_REQUEST['edit'] != "Y") && $ID == '') // In lpa mode users can only edit existent templates $APPLICATION->AuthForm(GetMessage("ACCESS_DENIED")); $bEdit = false; $templFields = array(); $str_ID = ''; $str_NAME = ''; $str_DESCRIPTION = ''; $str_SORT = ''; $str_TYPE = ''; $str_CONTENT = ''; $str_STYLES = ''; $str_TEMPLATE_STYLES = ''; if($ID <> '' && (!isset($_REQUEST['edit']) || $_REQUEST['edit'] != "N")) { $templ = CSiteTemplate::GetByID($ID); if(($templFields = $templ->ExtractFields("str_"))) $bEdit = true; } $aTabs = array( array("DIV" => "edit1", "TAB" => GetMessage("MAIN_TAB1"), "ICON" => "template_edit", "TITLE" => ($isEditingMessageThemePage ? GetMessage("MAIN_TAB1_TITLE_THEME") : GetMessage("MAIN_TAB1_TITLE"))), array("DIV" => "edit2", "TAB" => GetMessage("MAIN_TAB2"), "ICON" => "template_edit", "TITLE" => GetMessage("MAIN_TAB2_TITLE")), array("DIV" => "edit3", "TAB" => GetMessage("MAIN_TAB4"), "ICON" => "template_edit", "TITLE" => GetMessage("MAIN_TAB4_TITLE")), ); if($bEdit) $aTabs[] = array("DIV" => "edit4", "TAB" => GetMessage("MAIN_TAB3"), "ICON" => "template_edit", "TITLE" => GetMessage("MAIN_TAB3_TITLE")); $tabControl = new CAdminTabControl("tabControl", $aTabs); if($_SERVER["REQUEST_METHOD"] == "POST" && (!empty($_POST['save']) || !empty($_POST['apply'])) && check_bitrix_sessid() && ($edit_php || $lpa)) { if ($lpa) { $CONTENT = LPA::Process($_POST["CONTENT"] ?? '', htmlspecialcharsback($str_CONTENT)); //Add ..->ShowPanel() and WORK_AREA $ucont = mb_strtolower($CONTENT); $sp = '$APPLICATION->ShowPanel();?>'; $body = '
'; $wa = '#WORK_AREA#'; $body_pos = mb_strpos($ucont, $body); $sp_pos = mb_strpos($ucont, mb_strtolower($sp)); $wa_pos = mb_strpos($ucont, mb_strtolower($wa), $body_pos); if ($body_pos !== false && $sp_pos === false) // Add $APPLICATION->ShowPanel(); $CONTENT = mb_substr($CONTENT, 0, $body_pos + mb_strlen($body)).$sp.mb_substr($CONTENT, $body_pos + mb_strlen($body)); if ($wa_pos === false) $CONTENT .= $wa; } else { $CONTENT = $_POST["CONTENT"] ?? ''; } if(class_exists('CFileMan') && method_exists("CFileMan", "CheckOnAllowedComponents")) { if (!CFileMan::CheckOnAllowedComponents($CONTENT)) { $str_err = $APPLICATION->GetException(); if($str_err && ($err = $str_err ->GetString())) $strError .= $err; $bVarsFromForm = true; } } if($strError == "") { $stylesDesc = array(); $maxind = $_POST['maxind'] ?? ''; for($i = 0; $i <= $maxind; $i++) { if(!isset($_POST["CODE_".$i]) || trim($_POST["CODE_".$i]) == '') continue; $code = ltrim($_POST["CODE_".$i], "."); $stylesDesc[$code] = $_POST["VALUE_".$i] ?? ''; } $ST = new CSiteTemplate(); $arFields = array( "ID" => $ID, "NAME" => $_POST["NAME"] ?? '', "DESCRIPTION" => $_POST["DESCRIPTION"] ?? '', "CONTENT" => $CONTENT, "STYLES" => $_POST["STYLES"] ?? '', "TEMPLATE_STYLES" => $_POST["TEMPLATE_STYLES"] ?? '', "SORT" => $_POST["SORT"] ?? '', "TYPE" => $_POST["TYPE"] ?? '', "STYLES_DESCRIPTION" => $stylesDesc, ); if (isset($_REQUEST['edit']) && $_REQUEST['edit']=="Y") $res = $ST->Update($ID, $arFields); else $res = ($ST->Add($arFields) <> ''); if(!$res) { $strError .= $ST->LAST_ERROR."