PageRenderTime 67ms CodeModel.GetById 22ms RepoModel.GetById 14ms app.codeStats 0ms

/admin-dev/functions.php

https://gitlab.com/mtellezgalindo/PrestaShop
PHP | 570 lines | 398 code | 44 blank | 128 comment | 110 complexity | a30d5d11a545fdc7ecee042a0eadb5f7 MD5 | raw file
Possible License(s): CC-BY-SA-3.0, LGPL-3.0
  1. <?php
  2. /*
  3. * 2007-2014 PrestaShop
  4. *
  5. * NOTICE OF LICENSE
  6. *
  7. * This source file is subject to the Open Software License (OSL 3.0)
  8. * that is bundled with this package in the file LICENSE.txt.
  9. * It is also available through the world-wide-web at this URL:
  10. * http://opensource.org/licenses/osl-3.0.php
  11. * If you did not receive a copy of the license and are unable to
  12. * obtain it through the world-wide-web, please send an email
  13. * to license@prestashop.com so we can send you a copy immediately.
  14. *
  15. * DISCLAIMER
  16. *
  17. * Do not edit or add to this file if you wish to upgrade PrestaShop to newer
  18. * versions in the future. If you wish to customize PrestaShop for your
  19. * needs please refer to http://www.prestashop.com for more information.
  20. *
  21. * @author PrestaShop SA <contact@prestashop.com>
  22. * @copyright 2007-2014 PrestaShop SA
  23. * @license http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
  24. * International Registered Trademark & Property of PrestaShop SA
  25. */
  26. if (!defined('_PS_ADMIN_DIR_'))
  27. define('_PS_ADMIN_DIR_', getcwd());
  28. require_once(_PS_ADMIN_DIR_.'/../images.inc.php');
  29. function bindDatepicker($id, $time)
  30. {
  31. if ($time)
  32. echo '
  33. var dateObj = new Date();
  34. var hours = dateObj.getHours();
  35. var mins = dateObj.getMinutes();
  36. var secs = dateObj.getSeconds();
  37. if (hours < 10) { hours = "0" + hours; }
  38. if (mins < 10) { mins = "0" + mins; }
  39. if (secs < 10) { secs = "0" + secs; }
  40. var time = " "+hours+":"+mins+":"+secs;';
  41. echo '
  42. $(function() {
  43. $("#'.Tools::htmlentitiesUTF8($id).'").datepicker({
  44. prevText:"",
  45. nextText:"",
  46. dateFormat:"yy-mm-dd"'.($time ? '+time' : '').'});
  47. });';
  48. }
  49. /**
  50. * Deprecated since 1.5
  51. * Use Controller::addJqueryUi('ui.datepicker') instead
  52. *
  53. * @param int|array $id id can be a identifier or an array of identifiers
  54. * @param unknown_type $time
  55. */
  56. function includeDatepicker($id, $time = false)
  57. {
  58. Tools::displayAsDeprecated();
  59. echo '<script type="text/javascript" src="'.__PS_BASE_URI__.'js/jquery/ui/jquery.ui.core.min.js"></script>';
  60. echo '<link type="text/css" rel="stylesheet" href="'.__PS_BASE_URI__.'js/jquery/ui/themes/ui-lightness/jquery.ui.theme.css" />';
  61. echo '<link type="text/css" rel="stylesheet" href="'.__PS_BASE_URI__.'js/jquery/ui/themes/ui-lightness/jquery.ui.datepicker.css" />';
  62. $iso = Db::getInstance()->getValue('SELECT iso_code FROM '._DB_PREFIX_.'lang WHERE `id_lang` = '.(int)Context::getContext()->language->id);
  63. if ($iso != 'en')
  64. echo '<script type="text/javascript" src="'.__PS_BASE_URI__.'js/jquery/ui/i18n/jquery.ui.datepicker-'.Tools::htmlentitiesUTF8($iso).'.js"></script>';
  65. echo '<script type="text/javascript">';
  66. if (is_array($id))
  67. foreach ($id as $id2)
  68. bindDatepicker($id2, $time);
  69. else
  70. bindDatepicker($id, $time);
  71. echo '</script>';
  72. }
  73. /**
  74. * Generate a new settings file, only transmitted parameters are updated
  75. *
  76. * @param string $baseUri Base URI
  77. * @param string $theme Theme name (eg. default)
  78. * @param array $arrayDB Parameters in order to connect to database
  79. */
  80. function rewriteSettingsFile($baseUrls = null, $theme = null, $arrayDB = null)
  81. {
  82. $defines = array();
  83. $defines['_PS_CACHING_SYSTEM_'] = _PS_CACHING_SYSTEM_;
  84. $defines['_PS_CACHE_ENABLED_'] = _PS_CACHE_ENABLED_;
  85. $defines['_DB_NAME_'] = (($arrayDB && isset($arrayDB['_DB_NAME_'])) ? $arrayDB['_DB_NAME_'] : _DB_NAME_);
  86. $defines['_MYSQL_ENGINE_'] = (($arrayDB && isset($arrayDB['_MYSQL_ENGINE_'])) ? $arrayDB['_MYSQL_ENGINE_'] : _MYSQL_ENGINE_);
  87. $defines['_DB_SERVER_'] = (($arrayDB && isset($arrayDB['_DB_SERVER_'])) ? $arrayDB['_DB_SERVER_'] : _DB_SERVER_);
  88. $defines['_DB_USER_'] = (($arrayDB && isset($arrayDB['_DB_USER_'])) ? $arrayDB['_DB_USER_'] : _DB_USER_);
  89. $defines['_DB_PREFIX_'] = (($arrayDB && isset($arrayDB['_DB_PREFIX_'])) ? $arrayDB['_DB_PREFIX_'] : _DB_PREFIX_);
  90. $defines['_DB_PASSWD_'] = (($arrayDB && isset($arrayDB['_DB_PASSWD_'])) ? $arrayDB['_DB_PASSWD_'] : _DB_PASSWD_);
  91. $defines['_COOKIE_KEY_'] = addslashes(_COOKIE_KEY_);
  92. $defines['_COOKIE_IV_'] = addslashes(_COOKIE_IV_);
  93. $defines['_PS_CREATION_DATE_'] = addslashes(_PS_CREATION_DATE_);
  94. if (defined('_RIJNDAEL_KEY_'))
  95. $defines['_RIJNDAEL_KEY_'] = addslashes(_RIJNDAEL_KEY_);
  96. if (defined('_RIJNDAEL_IV_'))
  97. $defines['_RIJNDAEL_IV_'] = addslashes(_RIJNDAEL_IV_);
  98. $defines['_PS_VERSION_'] = addslashes(_PS_VERSION_);
  99. $content = "<?php\n\n";
  100. foreach ($defines as $k => $value)
  101. {
  102. if ($k == '_PS_VERSION_')
  103. $content .= 'if (!defined(\''.$k.'\'))'."\n\t";
  104. $content .= 'define(\''.$k.'\', \''.addslashes($value).'\');'."\n";
  105. }
  106. copy(_PS_ADMIN_DIR_.'/../config/settings.inc.php', _PS_ADMIN_DIR_.'/../config/settings.old.php');
  107. if ($fd = fopen(_PS_ADMIN_DIR_.'/../config/settings.inc.php', 'w'))
  108. {
  109. fwrite($fd, $content);
  110. fclose($fd);
  111. return true;
  112. }
  113. return false;
  114. }
  115. /**
  116. * Display SQL date in friendly format
  117. *
  118. * @param string $sqlDate Date in SQL format (YYYY-MM-DD HH:mm:ss)
  119. * @param boolean $withTime Display both date and time
  120. * @todo Several formats (french : DD-MM-YYYY)
  121. */
  122. function displayDate($sqlDate, $withTime = false)
  123. {
  124. return strftime('%Y-%m-%d'.($withTime ? ' %H:%M:%S' : ''), strtotime($sqlDate));
  125. }
  126. /**
  127. * Return path to a product category
  128. *
  129. * @param string $urlBase Start URL
  130. * @param integer $id_category Start category
  131. * @param string $path Current path
  132. * @param string $highlight String to highlight (in XHTML/CSS)
  133. * @param string $type Category type (products/cms)
  134. */
  135. function getPath($urlBase, $id_category, $path = '', $highlight = '', $categoryType = 'catalog', $home = false)
  136. {
  137. $context = Context::getContext();
  138. if ($categoryType == 'catalog')
  139. {
  140. $category = Db::getInstance()->getRow('
  141. SELECT id_category, level_depth, nleft, nright
  142. FROM '._DB_PREFIX_.'category
  143. WHERE id_category = '.(int)$id_category);
  144. if (isset($category['id_category']))
  145. {
  146. $sql = 'SELECT c.id_category, cl.name, cl.link_rewrite
  147. FROM '._DB_PREFIX_.'category c
  148. LEFT JOIN '._DB_PREFIX_.'category_lang cl ON (cl.id_category = c.id_category'.Shop::addSqlRestrictionOnLang('cl').')
  149. WHERE c.nleft <= '.(int)$category['nleft'].'
  150. AND c.nright >= '.(int)$category['nright'].'
  151. AND cl.id_lang = '.(int)$context->language->id.
  152. ($home ? ' AND c.id_category='.(int)$id_category : '').'
  153. AND c.id_category != '.(int)Category::getTopCategory()->id.'
  154. GROUP BY c.id_category
  155. ORDER BY c.level_depth ASC
  156. LIMIT '.(!$home ? (int)($category['level_depth'] + 1) : 1);
  157. $categories = Db::getInstance()->executeS($sql);
  158. $fullPath = '';
  159. $n = 1;
  160. $nCategories = (int)sizeof($categories);
  161. foreach ($categories AS $category)
  162. {
  163. $link = Context::getContext()->link->getAdminLink('AdminCategories');
  164. $edit = '<a href="'.Tools::safeOutput($link.'&id_category='.(int)$category['id_category'].'&'.(($category['id_category'] == 1 || $home) ? 'viewcategory' : 'updatecategory')).'" title="'.($category['id_category'] == Category::getRootCategory()->id_category ? 'Home' : 'Modify').'"><i class="icon-'.(($category['id_category'] == Category::getRootCategory()->id_category || $home) ? 'home' : 'pencil').'"></i></a> ';
  165. $fullPath .= $edit.
  166. ($n < $nCategories ? '<a href="'.Tools::safeOutput($urlBase.'&id_category='.(int)$category['id_category'].'&viewcategory&token='.Tools::getAdminToken('AdminCategories'.(int)(Tab::getIdFromClassName('AdminCategories')).(int)$context->employee->id)).'" title="'.htmlentities($category['name'], ENT_NOQUOTES, 'UTF-8').'">' : '').
  167. (!empty($highlight) ? str_ireplace($highlight, '<span class="highlight">'.htmlentities($highlight, ENT_NOQUOTES, 'UTF-8').'</span>', $category['name']) : $category['name']).
  168. ($n < $nCategories ? '</a>' : '').
  169. (($n++ != $nCategories || !empty($path)) ? ' > ' : '');
  170. }
  171. return $fullPath.$path;
  172. }
  173. }
  174. elseif ($categoryType == 'cms')
  175. {
  176. $category = new CMSCategory($id_category, $context->language->id);
  177. if (!$category->id)
  178. return $path;
  179. $name = ($highlight != null) ? str_ireplace($highlight, '<span class="highlight">'.$highlight.'</span>', CMSCategory::hideCMSCategoryPosition($category->name)) : CMSCategory::hideCMSCategoryPosition($category->name);
  180. $edit = '<a href="'.Tools::safeOutput($urlBase.'&id_cms_category='.$category->id.'&addcategory&token=' . Tools::getAdminToken('AdminCmsContent'.(int)(Tab::getIdFromClassName('AdminCmsContent')).(int)$context->employee->id)).'">
  181. <i class="icon-pencil"></i></a> ';
  182. if ($category->id == 1)
  183. $edit = '<li><a href="'.Tools::safeOutput($urlBase.'&id_cms_category='.$category->id.'&viewcategory&token=' . Tools::getAdminToken('AdminCmsContent'.(int)(Tab::getIdFromClassName('AdminCmsContent')).(int)$context->employee->id)).'">
  184. <i class="icon-home"></i></a></li> ';
  185. $path = $edit.'<li><a href="'.Tools::safeOutput($urlBase.'&id_cms_category='.$category->id.'&viewcategory&token=' . Tools::getAdminToken('AdminCmsContent'.(int)(Tab::getIdFromClassName('AdminCmsContent')).(int)$context->employee->id)).'">
  186. '.$name.'</a></li> > '.$path;
  187. if ($category->id == 1)
  188. return substr($path, 0, strlen($path) - 3);
  189. return getPath($urlBase, $category->id_parent, $path, '', 'cms');
  190. }
  191. }
  192. function getDirContent($path)
  193. {
  194. $content = array();
  195. if (is_dir($path))
  196. {
  197. $d = dir($path);
  198. while (false !== ($entry = $d->read()))
  199. if ($entry{0} != '.')
  200. $content[] = $entry;
  201. $d->close();
  202. }
  203. return $content;
  204. }
  205. function createDir($path, $rights)
  206. {
  207. if (file_exists($path))
  208. return true;
  209. return @mkdir($path, $rights);
  210. }
  211. function checkPSVersion()
  212. {
  213. $upgrader = new Upgrader();
  214. return $upgrader->checkPSVersion();
  215. }
  216. /**
  217. * Deprecated since > 1.5.4.1
  218. * Use Translate::getAdminTranslation($string) instead
  219. *
  220. * @param string $string
  221. */
  222. function translate($string)
  223. {
  224. Tools::displayAsDeprecated();
  225. global $_LANGADM;
  226. if (!is_array($_LANGADM))
  227. return str_replace('"', '&quot;', $string);
  228. $key = md5(str_replace('\'', '\\\'', $string));
  229. $str = (array_key_exists('index'.$key, $_LANGADM)) ? $_LANGADM['index'.$key] : ((array_key_exists('index'.$key, $_LANGADM)) ? $_LANGADM['index'.$key] : $string);
  230. return str_replace('"', '&quot;', stripslashes($str));
  231. }
  232. /**
  233. * Returns a new Tab object
  234. *
  235. * @param string $tab class name
  236. * @return mixed(AdminTab, bool) tab object or false if failed
  237. */
  238. function checkingTab($tab)
  239. {
  240. $tab = trim($tab);
  241. $tab_lowercase = strtolower($tab);
  242. if (!Validate::isTabName($tab))
  243. return false;
  244. $row = Db::getInstance(_PS_USE_SQL_SLAVE_)->getRow('SELECT id_tab, module, class_name FROM `'._DB_PREFIX_.'tab` WHERE class_name = \''.pSQL($tab).'\'');
  245. if (!$row['id_tab'])
  246. {
  247. if (isset(AdminTab::$tabParenting[$tab]))
  248. Tools::redirectAdmin('?tab='.AdminTab::$tabParenting[$tab].'&token='.Tools::getAdminTokenLite(AdminTab::$tabParenting[$tab]));
  249. echo sprintf(Tools::displayError('Page %s cannot be found..'),$tab);
  250. return false;
  251. }
  252. // Class file is included in Dispatcher::dispatch() function
  253. if (!class_exists($tab, false) || !$row['id_tab'])
  254. {
  255. echo sprintf(Tools::displayError('The class %s cannot be found.'),$tab);
  256. return false;
  257. }
  258. $adminObj = new $tab;
  259. if (!$adminObj->viewAccess() && ($adminObj->table != 'employee' || Context::getContext()->employee->id != Tools::getValue('id_employee') || !Tools::isSubmit('updateemployee')))
  260. {
  261. $adminObj->_errors = array(Tools::displayError('Access denied.'));
  262. echo $adminObj->displayErrors();
  263. return false;
  264. }
  265. return $adminObj;
  266. }
  267. /**
  268. * @TODO deprecate for Tab::checkTabRights()
  269. */
  270. function checkTabRights($id_tab)
  271. {
  272. static $tabAccesses = null;
  273. if ($tabAccesses === null)
  274. $tabAccesses = Profile::getProfileAccesses(Context::getContext()->employee->id_profile);
  275. if (isset($tabAccesses[(int)($id_tab)]['view']))
  276. return ($tabAccesses[(int)($id_tab)]['view'] === '1');
  277. return false;
  278. }
  279. /**
  280. * Converts a simpleXML element into an array. Preserves attributes and everything.
  281. * You can choose to get your elements either flattened, or stored in a custom index that
  282. * you define.
  283. * For example, for a given element
  284. * <field name="someName" type="someType"/>
  285. * if you choose to flatten attributes, you would get:
  286. * $array['field']['name'] = 'someName';
  287. * $array['field']['type'] = 'someType';
  288. * If you choose not to flatten, you get:
  289. * $array['field']['@attributes']['name'] = 'someName';
  290. * _____________________________________
  291. * Repeating fields are stored in indexed arrays. so for a markup such as:
  292. * <parent>
  293. * <child>a</child>
  294. * <child>b</child>
  295. * <child>c</child>
  296. * </parent>
  297. * you array would be:
  298. * $array['parent']['child'][0] = 'a';
  299. * $array['parent']['child'][1] = 'b';
  300. * ...And so on.
  301. * _____________________________________
  302. * @param simpleXMLElement $xml the XML to convert
  303. * @param boolean $flattenValues Choose wether to flatten values
  304. * or to set them under a particular index.
  305. * defaults to true;
  306. * @param boolean $flattenAttributes Choose wether to flatten attributes
  307. * or to set them under a particular index.
  308. * Defaults to true;
  309. * @param boolean $flattenChildren Choose wether to flatten children
  310. * or to set them under a particular index.
  311. * Defaults to true;
  312. * @param string $valueKey index for values, in case $flattenValues was set to
  313. * false. Defaults to "@value"
  314. * @param string $attributesKey index for attributes, in case $flattenAttributes was set to
  315. * false. Defaults to "@attributes"
  316. * @param string $childrenKey index for children, in case $flattenChildren was set to
  317. * false. Defaults to "@children"
  318. * @return array the resulting array.
  319. */
  320. function simpleXMLToArray ($xml, $flattenValues = true, $flattenAttributes = true, $flattenChildren = true, $valueKey = '@value', $attributesKey = '@attributes', $childrenKey = '@children')
  321. {
  322. $return = array();
  323. if (!($xml instanceof SimpleXMLElement))
  324. return $return;
  325. $name = $xml->getName();
  326. $_value = trim((string)$xml);
  327. if (strlen($_value) == 0)
  328. $_value = null;
  329. if ($_value !== null)
  330. {
  331. if (!$flattenValues)
  332. $return[$valueKey] = $_value;
  333. else
  334. $return = $_value;
  335. }
  336. $children = array();
  337. $first = true;
  338. foreach($xml->children() as $elementName => $child)
  339. {
  340. $value = simpleXMLToArray($child, $flattenValues, $flattenAttributes, $flattenChildren, $valueKey, $attributesKey, $childrenKey);
  341. if (isset($children[$elementName]))
  342. {
  343. if ($first)
  344. {
  345. $temp = $children[$elementName];
  346. unset($children[$elementName]);
  347. $children[$elementName][] = $temp;
  348. $first=false;
  349. }
  350. $children[$elementName][] = $value;
  351. }
  352. else
  353. $children[$elementName] = $value;
  354. }
  355. if (count($children) > 0 )
  356. {
  357. if (!$flattenChildren)
  358. $return[$childrenKey] = $children;
  359. else
  360. $return = array_merge($return, $children);
  361. }
  362. $attributes = array();
  363. foreach($xml->attributes() as $name => $value)
  364. $attributes[$name] = trim($value);
  365. if (count($attributes) > 0)
  366. {
  367. if (!$flattenAttributes)
  368. $return[$attributesKey] = $attributes;
  369. else
  370. $return = array_merge($return, $attributes);
  371. }
  372. return $return;
  373. }
  374. /**
  375. * for retrocompatibility with old AdminTab, old index.php
  376. *
  377. * @return void
  378. */
  379. function runAdminTab($tab, $ajaxMode = false)
  380. {
  381. $ajaxMode = (bool)$ajaxMode;
  382. require_once(_PS_ADMIN_DIR_.'/init.php');
  383. $cookie = Context::getContext()->cookie;
  384. if (empty($tab) && !sizeof($_POST))
  385. {
  386. $tab = 'AdminDashboard';
  387. $_POST['tab'] = $tab;
  388. $_POST['token'] = Tools::getAdminTokenLite($tab);
  389. }
  390. // $tab = $_REQUEST['tab'];
  391. if ($adminObj = checkingTab($tab))
  392. {
  393. Context::getContext()->controller = $adminObj;
  394. // init is different for new tabs (AdminController) and old tabs (AdminTab)
  395. if ($adminObj instanceof AdminController)
  396. {
  397. if($ajaxMode)
  398. $adminObj->ajax = true;
  399. $adminObj->path = dirname($_SERVER["PHP_SELF"]);
  400. $adminObj->run();
  401. }
  402. else
  403. {
  404. if (!$ajaxMode)
  405. require_once(_PS_ADMIN_DIR_.'/header.inc.php');
  406. $isoUser = Context::getContext()->language->id;
  407. $tabs = array();
  408. $tabs = Tab::recursiveTab($adminObj->id, $tabs);
  409. $tabs = array_reverse($tabs);
  410. $bread = '';
  411. foreach ($tabs AS $key => $item)
  412. {
  413. $bread .= ' <img src="../img/admin/separator_breadcrumb.png" style="margin-right:5px" alt="&gt;" />';
  414. if (count($tabs) - 1 > $key)
  415. $bread .= '<a href="?tab='.$item['class_name'].'&token='.Tools::getAdminToken($item['class_name'].intval($item['id_tab']).(int)Context::getContext()->employee->id).'">';
  416. $bread .= $item['name'];
  417. if (count($tabs) - 1 > $key)
  418. $bread .= '</a>';
  419. }
  420. if (!$ajaxMode && Shop::isFeatureActive() && Shop::getContext() != Shop::CONTEXT_ALL && Context::getContext()->controller->multishop_context != Shop::CONTEXT_ALL)
  421. {
  422. echo '<div class="multishop_info">';
  423. if (Shop::getContext() == Shop::CONTEXT_GROUP)
  424. {
  425. $shop_group = new ShopGroup((int)Shop::getContextShopGroupID());
  426. printf(Translate::getAdminTranslation('You are configuring your store for group shop %s'), '<b>'.$shop_group->name.'</b>');
  427. }
  428. elseif (Shop::getContext() == Shop::CONTEXT_SHOP)
  429. printf(Translate::getAdminTranslation('You are configuring your store for shop %s'), '<b>'.Context::getContext()->shop->name.'</b>');
  430. echo '</div>';
  431. }
  432. if (Validate::isLoadedObject($adminObj))
  433. {
  434. if ($adminObj->checkToken())
  435. {
  436. if($ajaxMode)
  437. {
  438. // the differences with index.php is here
  439. $adminObj->ajaxPreProcess();
  440. $action = Tools::getValue('action');
  441. // no need to use displayConf() here
  442. if (!empty($action) && method_exists($adminObj, 'ajaxProcess'.Tools::toCamelCase($action)) )
  443. $adminObj->{'ajaxProcess'.Tools::toCamelCase($action)}();
  444. else
  445. $adminObj->ajaxProcess();
  446. // @TODO We should use a displayAjaxError
  447. $adminObj->displayErrors();
  448. if (!empty($action) && method_exists($adminObj, 'displayAjax'.Tools::toCamelCase($action)) )
  449. $adminObj->{'displayAjax'.$action}();
  450. else
  451. $adminObj->displayAjax();
  452. }
  453. else
  454. {
  455. /* Filter memorization */
  456. if (isset($_POST) && !empty($_POST) && isset($adminObj->table))
  457. foreach ($_POST AS $key => $value)
  458. if (is_array($adminObj->table))
  459. {
  460. foreach ($adminObj->table AS $table)
  461. if (strncmp($key, $table.'Filter_', 7) === 0 || strncmp($key, 'submitFilter', 12) === 0)
  462. $cookie->$key = !is_array($value) ? $value : serialize($value);
  463. }
  464. elseif (strncmp($key, $adminObj->table.'Filter_', 7) === 0 || strncmp($key, 'submitFilter', 12) === 0)
  465. $cookie->$key = !is_array($value) ? $value : serialize($value);
  466. if (isset($_GET) && !empty($_GET) && isset($adminObj->table))
  467. foreach ($_GET AS $key => $value)
  468. if (is_array($adminObj->table))
  469. {
  470. foreach ($adminObj->table AS $table)
  471. if (strncmp($key, $table.'OrderBy', 7) === 0 || strncmp($key, $table.'Orderway', 8) === 0)
  472. $cookie->$key = $value;
  473. }
  474. elseif (strncmp($key, $adminObj->table.'OrderBy', 7) === 0 || strncmp($key, $adminObj->table.'Orderway', 12) === 0)
  475. $cookie->$key = $value;
  476. $adminObj->displayConf();
  477. $adminObj->postProcess();
  478. $adminObj->displayErrors();
  479. $adminObj->display();
  480. include(_PS_ADMIN_DIR_.'/footer.inc.php');
  481. }
  482. }
  483. else
  484. {
  485. if($ajaxMode)
  486. {
  487. // If this is an XSS attempt, then we should only display a simple, secure page
  488. if (ob_get_level() && ob_get_length() > 0)
  489. ob_clean();
  490. // ${1} in the replacement string of the regexp is required, because the token may begin with a number and mix up with it (e.g. $17)
  491. $url = preg_replace('/([&?]token=)[^&]*(&.*)?$/', '${1}'.$adminObj->token.'$2', $_SERVER['REQUEST_URI']);
  492. if (false === strpos($url, '?token=') && false === strpos($url, '&token='))
  493. $url .= '&token='.$adminObj->token;
  494. // we can display the correct url
  495. // die(Tools::jsonEncode(array(Translate::getAdminTranslation('Invalid security token'),$url)));
  496. die(Tools::jsonEncode(Translate::getAdminTranslation('Invalid security token')));
  497. }
  498. else
  499. {
  500. // If this is an XSS attempt, then we should only display a simple, secure page
  501. if (ob_get_level() && ob_get_length() > 0)
  502. ob_clean();
  503. // ${1} in the replacement string of the regexp is required, because the token may begin with a number and mix up with it (e.g. $17)
  504. $url = preg_replace('/([&?]token=)[^&]*(&.*)?$/', '${1}'.$adminObj->token.'$2', $_SERVER['REQUEST_URI']);
  505. if (false === strpos($url, '?token=') && false === strpos($url, '&token='))
  506. $url .= '&token='.$adminObj->token;
  507. $message = Translate::getAdminTranslation('Invalid security token');
  508. echo '<html><head><title>'.$message.'</title></head><body style="font-family:Arial,Verdana,Helvetica,sans-serif;background-color:#EC8686">
  509. <div style="background-color:#FAE2E3;border:1px solid #000000;color:#383838;font-weight:700;line-height:20px;margin:0 0 10px;padding:10px 15px;width:500px">
  510. <img src="../img/admin/error2.png" style="margin:-4px 5px 0 0;vertical-align:middle">
  511. '.$message.'
  512. </div>';
  513. echo '<a href="'.htmlentities($url).'" method="get" style="float:left;margin:10px">
  514. <input type="button" value="'.Tools::htmlentitiesUTF8(Translate::getAdminTranslation('I understand the risks and I really want to display this page')).'" style="height:30px;margin-top:5px" />
  515. </a>
  516. <a href="index.php" method="get" style="float:left;margin:10px">
  517. <input type="button" value="'.Tools::htmlentitiesUTF8(Translate::getAdminTranslation('Take me out of here!')).'" style="height:40px" />
  518. </a>
  519. </body></html>';
  520. die;
  521. }
  522. }
  523. }
  524. }
  525. }
  526. }