diff --git a/addons/counter/counter.addon.php b/addons/counter/counter.addon.php index 67ed706ab..65d665bd5 100644 --- a/addons/counter/counter.addon.php +++ b/addons/counter/counter.addon.php @@ -10,7 +10,7 @@ if(!defined('__XE__')) * @brief Counter add-on */ // Execute if called_position is before_display_content -if($called_position == 'before_module_init' && Context::get('module') != 'admin' && Context::getResponseMethod() == 'HTML' && Context::isInstalled()) +if($called_position == 'before_module_init' && Context::get('module') != 'admin' && Context::getResponseMethod() == 'HTML' && Context::isInstalled() && !isCrawler()) { $oCounterController = getController('counter'); $oCounterController->counterExecute(); diff --git a/classes/context/Context.class.php b/classes/context/Context.class.php index ae3bc20eb..e90a83858 100644 --- a/classes/context/Context.class.php +++ b/classes/context/Context.class.php @@ -337,11 +337,9 @@ class Context array(&$oSessionController, 'open'), array(&$oSessionController, 'close'), array(&$oSessionModel, 'read'), array(&$oSessionController, 'write'), array(&$oSessionController, 'destroy'), array(&$oSessionController, 'gc') ); } + + if($sess = $_POST[session_name()]) session_id($sess); session_start(); - if($sess = $_POST[session_name()]) - { - session_id($sess); - } // set authentication information in Context and session if(self::isInstalled()) @@ -1283,15 +1281,17 @@ class Context $val = array($val); } + $result = array(); foreach($val as $k => $v) { + $k = htmlentities($k); if($key === 'page' || $key === 'cpage' || substr_compare($key, 'srl', -3) === 0) { - $val[$k] = !preg_match('/^[0-9,]+$/', $v) ? (int) $v : $v; + $result[$k] = !preg_match('/^[0-9,]+$/', $v) ? (int) $v : $v; } elseif($key === 'mid' || $key === 'vid' || $key === 'search_keyword') { - $val[$k] = htmlspecialchars($v, ENT_COMPAT | ENT_HTML401, 'UTF-8', FALSE); + $result[$k] = htmlspecialchars($v, ENT_COMPAT | ENT_HTML401, 'UTF-8', FALSE); } else { @@ -1302,12 +1302,12 @@ class Context if(!is_array($v)) { - $val[$k] = trim($v); + $result[$k] = trim($v); } } } - return $isArray ? $val : $val[0]; + return $isArray ? $result : $result[0]; } /** diff --git a/classes/db/DB.class.php b/classes/db/DB.class.php index 25a7cdb10..849f6ea3a 100644 --- a/classes/db/DB.class.php +++ b/classes/db/DB.class.php @@ -447,7 +447,8 @@ class DB $log['act'] = Context::get('act'); $log['time'] = date('Y-m-d H:i:s'); - $bt = debug_backtrace(); + $bt = version_compare(PHP_VERSION, '5.3.6', '>=') ? debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS) : debug_backtrace(); + foreach($bt as $no => $call) { if($call['function'] == 'executeQuery' || $call['function'] == 'executeQueryArray') @@ -455,6 +456,7 @@ class DB $call_no = $no; $call_no++; $log['called_file'] = $bt[$call_no]['file'].':'.$bt[$call_no]['line']; + $log['called_file'] = str_replace(_XE_PATH_ , '', $log['called_file']); $call_no++; $log['called_method'] = $bt[$call_no]['class'].$bt[$call_no]['type'].$bt[$call_no]['function']; break; @@ -487,20 +489,12 @@ class DB $this->setQueryLog($log); - // if __LOG_SLOW_QUERY__ if defined, check elapsed time and leave query log - if(__LOG_SLOW_QUERY__ > 0 && $elapsed_time > __LOG_SLOW_QUERY__) - { - $buff = ''; - $log_file = _XE_PATH_ . 'files/_db_slow_query.php'; - if(!file_exists($log_file)) - { - $buff = '' . "\n"; - } - - $buff .= sprintf("%s\t%s\n\t%0.6f sec\tquery_id:%s\n\n", date("Y-m-d H:i"), $this->query, $elapsed_time, $this->query_id); - - @file_put_contents($log_file, $buff, FILE_APPEND|LOCK_EX); - } + $log_args = new stdClass; + $log_args->query = $this->query; + $log_args->query_id = $this->query_id; + $log_args->caller = $log['called_method'] . '() in ' . $log['called_file']; + $log_args->connection = $log['connection']; + writeSlowlog('query', $elapsed_time, $log_args); } /** diff --git a/classes/module/ModuleHandler.class.php b/classes/module/ModuleHandler.class.php index fde57e049..0bde1b8bc 100644 --- a/classes/module/ModuleHandler.class.php +++ b/classes/module/ModuleHandler.class.php @@ -380,6 +380,22 @@ class ModuleHandler extends Handler $kind = 'admin'; } + if($kind == 'admin') + { + $oMemberController = ModuleHandler::getModuleInstance('member', 'controller'); + $validate_session = $oMemberController->validateSession(); + $oMemberController->regenerateSession(); + if(!$validate_session) + { + $this->error = 'security_invalid_session'; + $oMessageObject = ModuleHandler::getModuleInstance('message', 'view'); + $oMessageObject->setError(-1); + $oMessageObject->setMessage($this->error); + $oMessageObject->dispMessage(); + return $oMessageObject; + } + } + // check REQUEST_METHOD in controller if($type == 'controller') { @@ -579,7 +595,7 @@ class ModuleHandler extends Handler if($kind == 'admin') { $grant = $oModuleModel->getGrant($this->module_info, $logged_info); - if(!$grant->is_admin && !$grant->manager) + if(!$grant->manager) { $this->_setInputErrorToContext(); $this->error = 'msg_is_not_manager'; @@ -589,6 +605,19 @@ class ModuleHandler extends Handler $oMessageObject->dispMessage(); return $oMessageObject; } + else + { + if(!$grant->is_admin && $this->module != $this->orig_module->module && $xml_info->permission->{$this->act} != 'manager') + { + $this->_setInputErrorToContext(); + $this->error = 'msg_is_not_administrator'; + $oMessageObject = ModuleHandler::getModuleInstance('message', 'view'); + $oMessageObject->setError(-1); + $oMessageObject->setMessage($this->error); + $oMessageObject->dispMessage(); + return $oMessageObject; + } + } } } else if($xml_info->default_index_act && method_exists($oModule, $xml_info->default_index_act)) @@ -1152,7 +1181,7 @@ class ModuleHandler extends Handler $before_trigger_time = NULL; if(__LOG_SLOW_TRIGGER__> 0) { - $before_trigger_time = microtime(true); + $before_trigger_time = microtime(true); } foreach($triggers as $item) @@ -1160,12 +1189,6 @@ class ModuleHandler extends Handler $module = $item->module; $type = $item->type; $called_method = $item->called_method; - - $before_each_trigger_time = NULL; - if(__LOG_SLOW_TRIGGER__> 0) - { - $before_each_trigger_time = microtime(true); - } // todo why don't we call a normal class object ? $oModule = getModule($module, $type); @@ -1174,63 +1197,24 @@ class ModuleHandler extends Handler continue; } + $before_each_trigger_time = microtime(true); + $output = $oModule->{$called_method}($obj); + + $after_each_trigger_time = microtime(true); + $elapsed_time_trigger = $after_each_trigger_time - $before_each_trigger_time; + + $slowlog = new stdClass; + $slowlog->caller = $trigger_name . '.' . $called_position; + $slowlog->called = $module . '.' . $called_method; + $slowlog->called_extension = $module; + if($trigger_name != 'XE.writeSlowlog') writeSlowlog('trigger', $elapsed_time_trigger, $slowlog); + if(is_object($output) && method_exists($output, 'toBool') && !$output->toBool()) { return $output; } unset($oModule); - - //store after trigger call time - $after_each_trigger_time = NULL; - //init value to 0 - $elapsed_time_trigger = 0; - - if(__LOG_SLOW_TRIGGER__> 0) - { - $after_each_trigger_time = microtime(true); - $elapsed_time_trigger = ($after_each_trigger_time - $before_each_trigger_time) * 1000; - } - - // if __LOG_SLOW_TRIGGER__ is defined, check elapsed time and leave trigger time log - if(__LOG_SLOW_TRIGGER__> 0 && $elapsed_time_trigger > __LOG_SLOW_TRIGGER__) - { - $buff = ''; - $log_file = _XE_PATH_ . 'files/_db_slow_trigger.php'; - if(!file_exists($log_file)) - { - $buff = '' . "\n"; - } - - $buff .= sprintf("%s\t%s.%s.%s.%s(%s)\n\t%0.6f msec\n\n", date("Y-m-d H:i"), $item->trigger_name,$item->module,$item->called_method,$item->called_position,$item->type, $elapsed_time_trigger); - - @file_put_contents($log_file, $buff, FILE_APPEND|LOCK_EX); - } - } - - //store after trigger call time - $after_trigger_time = NULL; - //init value to 0 - $elapsed_time = 0; - if(__LOG_SLOW_TRIGGER__> 0) - { - $after_trigger_time = microtime(true); - $elapsed_time = ($after_trigger_time - $before_trigger_time) * 1000; - } - - // if __LOG_SLOW_TRIGGER__ is defined, check elapsed time and leave trigger time log - if(__LOG_SLOW_TRIGGER__> 0 && $elapsed_time > __LOG_SLOW_TRIGGER__) - { - $buff = ''; - $log_file = _XE_PATH_ . 'files/_slow_trigger.php'; - if(!file_exists($log_file)) - { - $buff = '' . "\n"; - } - - $buff .= sprintf("%s\t%s.totaltime\n\t%0.6f msec\n\n", date("Y-m-d H:i"), $trigger_name,$elapsed_time); - - @file_put_contents($log_file, $buff, FILE_APPEND|LOCK_EX); } return new Object(); diff --git a/common/js/common.js b/common/js/common.js index 498392750..d97620e1c 100644 --- a/common/js/common.js +++ b/common/js/common.js @@ -596,25 +596,14 @@ function doDocumentLoad(obj) { } /* 저장된 게시글의 선택 */ -function doDocumentSelect(document_srl, module) { +function doDocumentSelect(document_srl) { if(!opener || !opener.objForSavedDoc) { window.close(); return; } - if(module===undefined) { - module = 'document'; - } - // 게시글을 가져와서 등록하기 - switch(module) { - case 'page' : - opener.location.href = opener.current_url.setQuery('document_srl', document_srl).setQuery('act', 'dispPageAdminContentModify'); - break; - default : - opener.location.href = opener.current_url.setQuery('document_srl', document_srl).setQuery('act', 'dispBoardWrite'); - break; - } + opener.location.href = opener.current_url.setQuery('document_srl', document_srl).setQuery('act', 'dispBoardWrite'); window.close(); } @@ -911,7 +900,7 @@ function get_by_id(id) { jQuery(function($){ // display popup menu that contains member actions and document actions - $(document).on('click touchstart', function(evt) { + $(document).on('click', function(evt) { var $area = $('#popup_menu_area'); if(!$area.length) $area = $('