DocMan Discussion

Tidy doesn’t cause any errors for me, and I deliberately emptied the database, so I know it’s empty. Try running the query directly in the sql box in phpmyadmin (or whatever mysql admin program you use) and see what error it actually gives.

Ok. I think it’s all fixed. (except for the error in "tidy" which I was unable to reproduce). Here’s the bugfixed version.

Again, latest on the downloads forum.


changes:

added code in categoryform.php, addform.php, updateform.php to check for existance of category 0 and insert it if it doesn’t exist, with error messages including the webmaster’s email if the insert/update queries fail.

removed "mysql_data_seek" line from categories.php.

removed pageID setting from menu.php; replaced it with the snippet-wide $docid variable.

did a bit of CSS tweaking to stabilize the look of the select boxes across forms.

Hmmm... interesting new bug after uploading the latest files. Every time I return to the Category page, it autmaically inserts a new "Any (x)" category, with "x" being an incremental serial number!

In helping ryan set this up on our server I’ve noticed a few security issues. It’s possible to bypass the login and directly access the functions by using an external form like this

[form method="post" action="http://whatever.com/assets/snippets/docman/delete.php"]
[input type="text" name="fileID" ]
[input type="submit" ]
[/form]

When I loaded that bit of html into my browser on my local machine I was able to delete files without any issues.

I only tested it on the delete.php page, but others may have a similar issue.

Include file 101: set a constant in the main file and check for it in all include files. >:( Will get on that right away.

Sorry for all the fumbling and bumbling. But I am persistant, and I will get it right eventually! The latest version of bugfixes is in the downloads area, and I’m using it on sottwell.com where the latest version is also. (filemanger/filemanager as usual).

Version 5: DB checks out OK and all files uploaded. Snippet re-set up as well.

All I get now is:

Illegal file access.

Must have put the wrong .snippet file in the zip. It needs a line in the variable assignment section near the top:

define("IN_DOCMAN", "true");

I think I will need a vacation after this. My nerves are shot.

Replaced the download zip with the (I do sincerely hope) correct one.

Welll, at least we know I fixed that security hole!

Question on the snippet creation form. I still have not used the "properties" tab. Now, those two variables that need to be edited according to your web group setup. Could those not be defined in the "properties" tab, instead of actually having to modify the variable assignments in the snippet code itself?

Yes you can use the Properties tab to do this

Consider the following string:

&os=Operating System;string;linux

The above can be considered as a single input variable. The & sign is used to separate multiple variable while the = sign is used to assign the variable it?s description, data type and default value. With this knowledge we could read the about as:

&name = Description;datatype;value

where:

name ? name of the variable to be used inside theplugin code
description ? A brief description of the input variable
datatype ? the type of input to accept from the user
value ? the values or list to be displayed.

Where data types can be one of the following:

int ? An integer. Use a textbox to accept numeric inputs
string ? This is the default data type. Uses a textbox to accept input values
list ? A list. Use a dropdown menu to display a list of values.

Example of a list input variable:
&color=Colors;list;Red,Blue,Green

Note: future versions will support more data types such as date, color, etc

See also "Creating a Plugin - The Developer’s Guide, page 9"