build 2029

innovaphone · Aug 23, 2021 · e7aaab9 · e7aaab9
1 parent 1815f10
commit e7aaab9
Show file tree

Hide file tree

Showing 6 changed files with 21 additions and 12 deletions.
diff --git a/admin/admin.php b/admin/admin.php
@@ -420,8 +420,9 @@ function show(UpdateServerV2 $pi) {
 
 }
 
-if (isset($_REQUEST['show']))
-    $_REQUEST['mode'] = 'show'; // upward compat
+// upward compat
+if (isset($_REQUEST['show'])) $_REQUEST['mode'] = 'show';
+
 if (isset($_REQUEST['mode'])) {
     switch ($_REQUEST['mode']) {
         case 'show' :
@@ -487,3 +488,7 @@ function show(UpdateServerV2 $pi) {
     $page = new StatusPage($pi, "UpdateServerV2", "");
     $page->work();
 }
+
+// show build number
+$page = new InfoPage($pi, "UpdateServerV2", "Info");
+if (isset($page->env_field) && is_object($page->env_field) && is_readable(__DIR__.'/../build.txt')) echo '<span style="font-size: 11px; font-family: Arial; display: inline-block; margin-left: 5px; margin-top: -15px;">Build: '.file_get_contents(__DIR__.'/../build.txt').'</span>';
diff --git a/build.txt b/build.txt
@@ -0,0 +1 @@
+2028
diff --git a/classes/html.class.php b/classes/html.class.php
@@ -294,9 +294,9 @@ final public function legalFooter($email = "info", $extension = "0") {
 	return "<br>
 	    <hr>
 	    <span class='innologo'>innovaphone AG</span>
-	    <p class='innoslogan'>P&nbsp;U&nbsp;R&nbsp;E&nbsp;&nbsp;&nbsp;I&nbsp;P&nbsp;-&nbsp;C&nbsp;O&nbsp;M&nbsp;M&nbsp;U&nbsp;N&nbsp;I&nbsp;C&nbsp;A&nbsp;T&nbsp;I&nbsp;O&nbsp;N&nbsp;S</p>
+        <p class='innoslogan'>communicate. connect. collaborate.</p>
 	    <p>
-	    Böblinger Straße 76 | 71065 Sindelfingen | Germany<br>
+	    Umberto-Nobile-Straße 15 | 71063 Sindelfingen | Germany<br>
             Fon: + 49 (7031) 73009 $extension | Fax: + 49 (7031) 73009 99<br>
             E-Mail: $email@innovaphone.com | www.innovaphone.com<br>
 	    <hr>

diff --git a/classes/inputpage.class.php b/classes/inputpage.class.php
@@ -1320,8 +1320,8 @@ class InputPageZIPField extends InputPageStringField {
     public function InputPageZIPField($name, $prompt = "", $default = "", InputPageAction $button = null) {
         $this->__construct($name, $prompt, $default, $button);
         $this->setHint(tl::tl("A ZIP code is an optional country selector (such as 'DE-') followed by a natural number of at least 4 digits."));
-        $this->placeHolder = tl::tl("e.g.")." 71065";
-        $this->pattern = "^([a-zA-Z]{2,5}-)?[0-9A-Z ]{4,99}$";
+        $this->placeHolder = tl::tl("e.g.")." 71063";
+        $this->pattern = "^([a-zA-Z]{2,5}-)?[0-9A-Z -]{4,99}$";
     }
 
     public function valid() {
@@ -2723,6 +2723,11 @@ public function renderFieldSections(array $otherFieldsToRender, array $bottomFie
     public final function renderFields() {
         // this shall not be overridden
         $ret = "";
+
+        // add magic fields
+        if ($this->phase != null) $ret .= "<input type='hidden' name='_phase' value='{$this->phase}'/>";
+        if ($this->page != null) $ret .= "<input type='hidden' name='_page' value='{$this->page}'/>";
+
         // determine fields to display
         $leftFieldsToRender = array();
         $rightFieldsToRender = array();
@@ -2748,9 +2753,6 @@ public final function renderFields() {
 
         $ret .= $this->renderFieldSections($otherFieldsToRender, $bottomFieldsToRender, $topFieldsToRender, $rightFieldsToRender, $leftFieldsToRender);
 
-        // add magic fields
-        if ($this->phase != null) $ret .= "<input type='hidden' name='_phase' value='{$this->phase}'/>";
-        if ($this->page != null) $ret .= "<input type='hidden' name='_page' value='{$this->page}'/>";
         return $ret;
     }
 

diff --git a/classes/updateserverV2.class.php b/classes/updateserverV2.class.php
@@ -869,7 +869,7 @@ public function createPemFromDer($der, $derfile) {
     }
 
     public static function isNameInSubfolder($name) {
-        return !preg_match('@(/\.\.$)|(^\.\.$)|(^\.\./)|(/\.\./)@', $name);
+        return !preg_match('@(/\.\.$)|(^\.\.$)|(\\\.\\\.)|(^\.\./)|(/\.\./)|(\\\.\./)|(^\/)|(^\\\/)@', $name);
     }
 
     var $certdir = null;

diff --git a/update.php b/update.php
@@ -130,7 +130,7 @@ function dbgout($msg, $content) {
                 UpdateServerV2::bailout("need 'file' arg for mode=vardump, use ?file=filename");
             if (!UpdateServerV2::isNameInSubfolder($_REQUEST['file']))
                 UpdateServerV2::bailout("?file: filename must not point to external directory");
-            if (strtolower(pathinfo($_REQUEST['file'], PATHINFO_EXTENSION) == "php"))
+            if (in_array(strtolower(pathinfo($_REQUEST['file'], PATHINFO_EXTENSION)), array('php', 'sh', 'pl')))
                 UpdateServerV2::bailout("bad file name");
             if (($stream = fopen('php://input', "r")) !== FALSE) {
                 $content = (stream_get_contents($stream));
@@ -173,7 +173,7 @@ function dbgout($msg, $content) {
                 die("No File uploaded - use back button to continue");
             }
 
-            if (strtolower(pathinfo($_REQUEST['file'], PATHINFO_EXTENSION) == "php"))
+            if (in_array(strtolower(pathinfo($_REQUEST['file'], PATHINFO_EXTENSION)), array('php', 'sh', 'pl')))
                 UpdateServerV2::bailout("bad file name");
             foreach ($_FILES as $id => $f) {
                 if (strtolower($id) == strtolower("cert-{$_REQUEST['sn']}")) {
@@ -223,6 +223,7 @@ function rewriteUrl($usehttps = false, $usehttpsport = 443) {
                 // turn it off
                 notify("turn off fast polling");
                 print "mod cmd UP1 provision 0\r\n";
+                print "config rem UP1 /provision\r\n";
                 print "config add UP1 /poll " . $pi->getInterval() . "\r\n";
             } else {
                 // turn it on