From 623dfa13845e34c85eae2a66c6aa855c3e059c38 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Mon, 9 Oct 2017 15:13:25 -0700 Subject: purify user-supplied filenames in some cases. Probably not needed but it's the right thing to do. --- Zotlabs/Render/Comanche.php | 3 +++ include/nav.php | 4 ++-- include/text.php | 6 ++++++ 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/Zotlabs/Render/Comanche.php b/Zotlabs/Render/Comanche.php index ca664cba6..675282962 100644 --- a/Zotlabs/Render/Comanche.php +++ b/Zotlabs/Render/Comanche.php @@ -457,6 +457,9 @@ class Comanche { } } + if(! purify_filename($name)) + return '' + $clsname = ucfirst($name); $nsname = "\\Zotlabs\\Widget\\" . $clsname; diff --git a/include/nav.php b/include/nav.php index 588104eda..718e7befa 100644 --- a/include/nav.php +++ b/include/nav.php @@ -275,8 +275,8 @@ EOT; } } - $c = theme_include('navbar_' . $template . '.css'); - $tpl = get_markup_template('navbar_' . $template . '.tpl'); + $c = theme_include('navbar_' . purify_filename($template) . '.css'); + $tpl = get_markup_template('navbar_' . purify_filename($template) . '.tpl'); if($c && $tpl) { head_add_css('navbar_' . $template . '.css'); diff --git a/include/text.php b/include/text.php index 80914747b..8a65be0d5 100644 --- a/include/text.php +++ b/include/text.php @@ -3156,3 +3156,9 @@ function ellipsify($s,$maxlen) { return mb_substr($s,0,$maxlen / 2) . '...' . mb_substr($s,mb_strlen($s) - ($maxlen / 2)); } + +function purify_filename($s) { + if(($s[0] === '.') || strpos($s,'/') !== false) + return ''; + return $s; +} -- cgit v1.2.3 From 89aa9a80c478bf83713138ee3a04130e8aa48fde Mon Sep 17 00:00:00 2001 From: zotlabs Date: Mon, 9 Oct 2017 15:51:30 -0700 Subject: typo --- Zotlabs/Render/Comanche.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Zotlabs/Render/Comanche.php b/Zotlabs/Render/Comanche.php index 675282962..c787b19ae 100644 --- a/Zotlabs/Render/Comanche.php +++ b/Zotlabs/Render/Comanche.php @@ -458,7 +458,7 @@ class Comanche { } if(! purify_filename($name)) - return '' + return ''; $clsname = ucfirst($name); $nsname = "\\Zotlabs\\Widget\\" . $clsname; -- cgit v1.2.3 From 335536bbbf0069442a445b9b641a5f51208fca86 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Mon, 9 Oct 2017 20:19:03 -0700 Subject: more custom navbar work --- view/css/bootstrap-red.css | 1 + view/css/navbar_tucson.css | 3 ++ view/tpl/navbar_tucson.tpl | 89 +++++++++++++++++++--------------------------- 3 files changed, 40 insertions(+), 53 deletions(-) create mode 100644 view/css/navbar_tucson.css diff --git a/view/css/bootstrap-red.css b/view/css/bootstrap-red.css index fb6ea911e..2dfc9e07b 100644 --- a/view/css/bootstrap-red.css +++ b/view/css/bootstrap-red.css @@ -19,6 +19,7 @@ nav .dropdown-menu { } } + @media screen and (max-width: 767px) { .navbar { padding: .5rem 7px; diff --git a/view/css/navbar_tucson.css b/view/css/navbar_tucson.css new file mode 100644 index 000000000..79f95fe63 --- /dev/null +++ b/view/css/navbar_tucson.css @@ -0,0 +1,3 @@ +#notifications { + display: none; +} diff --git a/view/tpl/navbar_tucson.tpl b/view/tpl/navbar_tucson.tpl index ace22a880..c160bec68 100755 --- a/view/tpl/navbar_tucson.tpl +++ b/view/tpl/navbar_tucson.tpl @@ -10,6 +10,9 @@ {{/if}} {{/if}} + + + {{if $userinfo}}
@@ -42,6 +45,7 @@ {{/if}}
{{/if}} + {{if ! $is_owner}} {{/if}} + + + +{{if $navbar_apps}} +
    +{{foreach $navbar_apps as $navbar_app}} +
  • +{{$navbar_app}} +
    • +{{/foreach}} +
+{{/if}} + +
+ {{if $nav.help.6}} {{/if}} + - {{if ! $experimental_notif}} + {{if $localuser || $nav.pubs}} {{/if}} - {{else}} - {{if $localuser || $nav.pubs}} - - {{/if}} - {{/if}} +
+ + + + + {{/if}} - {{if $nav.registrations}} - - {{/if}} {{if $nav.notifications}}
{{/if}} - {{if $nav.files}} - - {{/if}} + {{if $nav.login && !$userinfo}}
  • {{$nav.loginmenu.1.1}} @@ -193,33 +191,16 @@ {{$nav.alogout.1}}
    • {{/if}} - {{if $nav.pubs}} - - {{/if}} + - {{/if}} + + + + +