security issues with dangerous template

[moodle.git] / theme / chameleon / ui / css.php

<?php\r
\r
require_once('../../../config.php');\r
require_once('../config.php');\r
\r
\r
if (!isset($THEME->chameleonenabled) || !$THEME->chameleonenabled) {\r
    die('CHAMELEON_ERROR Editing this theme has been disabled');\r
}\r
\r
\r
$chameleon_id = isset($_GET['id']) ? (int) $_GET['id'] : 0;\r
if ($chameleon_id != 0) {\r
    if (!isteacher($chameleon_id)) {\r
        die('CHAMELEON_ERROR You are not logged in');\r
    }\r
} else if (!isadmin()) {\r
    die('CHAMELEON_ERROR You are not logged in');\r
}\r
\r
\r
require_once('ChameleonCSS.class.php');\r
require_once('ChameleonFileBrowser.class.php');\r
\r
\r
\r
if (isset($_GET['path'])) {\r
    $fm = new ChameleonFileBrowser;\r
    die($fm->readFiles());\r
}\r
\r
$chameleon = new ChameleonCSS('../', 'user_styles.css', 'temp_user_styles.css');\r
if (isset($_POST['css'])) {\r
    if (!isset($_GET['temp'])) {\r
        $chameleon->update('perm', $_POST['css']);\r
        $chameleon->update('temp');\r
    } else {\r
        $chameleon->update('temp', $_POST['css']);\r
    }\r
    \r
} else {\r
\r
    $css = $chameleon->read();\r
    if ($css === false) {\r
        echo 'CHAMELEON_ERROR ' . $chameleon->error;\r
    } else {\r
        echo $css;\r
    }\r
}\r
\r
\r
?>