From e8064469454f49161e1ce05ba50ba5a278cc12a5 Mon Sep 17 00:00:00 2001
From: Benjamin Sonntag <benjamin@sonntag.fr>
Date: Thu, 26 May 2016 18:32:17 +0200
Subject: [PATCH] [wip] fixing most found bug during big test at
 https://pad.lqdn.fr/p/alternc-tests-secu201605

---
 bureau/admin/adm_domlock.php                 |  2 +-
 bureau/admin/adm_donosu.php                  |  2 +-
 bureau/admin/adm_dosu.php                    |  2 +-
 bureau/admin/adm_quotaedit.php               |  2 +-
 bureau/admin/dom_edit.php                    | 18 +++++--
 bureau/admin/dom_editdns.php                 |  2 +-
 bureau/admin/dom_subdel.php                  |  2 +-
 bureau/admin/dom_subedit.php                 |  2 +-
 bureau/admin/mail_edit.php                   |  2 +-
 bureau/admin/mem_cm.php                      |  7 +--
 bureau/class/m_mysql.php                     | 50 ++++++++++----------
 bureau/locales/fr_FR/LC_MESSAGES/messages.po |  2 +-
 12 files changed, 53 insertions(+), 40 deletions(-)

diff --git a/bureau/admin/adm_domlock.php b/bureau/admin/adm_domlock.php
index f418feae..02f8dd65 100644
--- a/bureau/admin/adm_domlock.php
+++ b/bureau/admin/adm_domlock.php
@@ -35,7 +35,7 @@ if (!$admin->enabled) {
 }
 
 $fields = array (
-	"domain"    => array ("post", "string", ""),
+	"domain"    => array ("request", "string", ""),
 );
 getFields($fields);
 
diff --git a/bureau/admin/adm_donosu.php b/bureau/admin/adm_donosu.php
index 25d12851..5c7b8791 100644
--- a/bureau/admin/adm_donosu.php
+++ b/bureau/admin/adm_donosu.php
@@ -35,7 +35,7 @@ if (!$admin->enabled) {
 }
 
 $fields = array (
-	"uid"    => array ("post", "integer", 0),
+	"uid"    => array ("request", "integer", 0),
 );
 getFields($fields);
 
diff --git a/bureau/admin/adm_dosu.php b/bureau/admin/adm_dosu.php
index 59944131..2357c685 100644
--- a/bureau/admin/adm_dosu.php
+++ b/bureau/admin/adm_dosu.php
@@ -35,7 +35,7 @@ if (!$admin->enabled) {
 }
 
 $fields = array (
-	"uid"    => array ("post", "integer", 0),
+	"uid"    => array ("request", "integer", 0),
 );
 getFields($fields);
 
diff --git a/bureau/admin/adm_quotaedit.php b/bureau/admin/adm_quotaedit.php
index 32d7c95c..51cc345d 100755
--- a/bureau/admin/adm_quotaedit.php
+++ b/bureau/admin/adm_quotaedit.php
@@ -37,7 +37,7 @@ if (!$admin->enabled) {
 }
 
 $fields = array (
-	"uid"    => array ("post", "integer", 0),
+	"uid"    => array ("request", "integer", 0),
 );
 getFields($fields);
 
diff --git a/bureau/admin/dom_edit.php b/bureau/admin/dom_edit.php
index 883d124a..23d41deb 100755
--- a/bureau/admin/dom_edit.php
+++ b/bureau/admin/dom_edit.php
@@ -301,6 +301,11 @@ if (!$r['noerase']) {
 	</form>
 
 </div>
+																					<?php } else { ?>
+<div id="tabsdom-params">  
+   <p class="alert alert-info"><?php __("This domain is locked, only a server administrator can unlock it."); ?></p>
+</div>
+ <?php } ?>
 
 <?php if ( $r["dns"] ) { ?>
 <div id="tabsdom-view">
@@ -308,14 +313,21 @@ if (!$r['noerase']) {
 <?php __("Here is the actual DNS zone running on the AlternC server. If you just made some changes, you have to wait for it."); ?>
 </p>
 
+<div>
 <pre><span class="petit" id="divdumpdns">
 <a target="_blank" href="dom_dnsdump.php?domain=<?php echo urlencode($domain) ?>"><?php __("Click here to view the dump");?></a>
 </span>
 </pre>
-<a href="javascript:force_update_dns_content();"><?php __("Refresh");?></a>
+</div>
+
+<p>&nbsp;</p>
+<p><a class="inb" href="javascript:force_update_dns_content();"><?php __("Refresh");?></a></p>
 
 </div>
 <?php } // if dns ?>
+    <?php
+if (!$r['noerase']) {
+?>
 
 <div id="tabsdom-delete">
   <h3><?php __("Domain removal"); ?></h3>
@@ -327,14 +339,14 @@ if (!$r['noerase']) {
     </p>
   </form>
 </div> <!-- tabsdom-delete -->
-</div> <!-- tabsdom -->
 <?php } else { // noerase 
   ?>
-<div id="tabsdom-params">  
+<div id="tabsdom-delete">  
    <p class="alert alert-info"><?php __("This domain is locked, only a server administrator can unlock it."); ?></p>
 </div>
     <?php
 } ?>
+</div> <!-- tabsdom -->
 <script type="text/javascript">
 //document.forms['main'].sub.focus(); // not with tabs
 
diff --git a/bureau/admin/dom_editdns.php b/bureau/admin/dom_editdns.php
index c23dc016..b88d4516 100644
--- a/bureau/admin/dom_editdns.php
+++ b/bureau/admin/dom_editdns.php
@@ -31,7 +31,7 @@ require_once("../class/config.php");
 include_once("head.php");
 
 $fields = array (
-	"domain"    => array ("post", "string", ""),
+	"domain"    => array ("request", "string", ""),
 	"dns"       => array ("post", "integer", 1),
 	"email"     => array ("post", "integer", 1),
 	"ttl"       => array ("post", "integer", 86400),
diff --git a/bureau/admin/dom_subdel.php b/bureau/admin/dom_subdel.php
index 3cad21c6..21c30c72 100755
--- a/bureau/admin/dom_subdel.php
+++ b/bureau/admin/dom_subdel.php
@@ -31,7 +31,7 @@ require_once("../class/config.php");
 include_once("head.php");
 
 $fields = array (
-  "sub_domain_id"       => array ("post", "integer", ""),
+  "sub_domain_id"       => array ("request", "integer", ""),
 );
 getFields($fields);
 
diff --git a/bureau/admin/dom_subedit.php b/bureau/admin/dom_subedit.php
index 7b6a107a..b6d33997 100644
--- a/bureau/admin/dom_subedit.php
+++ b/bureau/admin/dom_subedit.php
@@ -32,7 +32,7 @@ include_once("head.php");
 
 
 $fields = array (
-	"sub_domain_id"    => array ("post", "integer", ""),
+	"sub_domain_id"    => array ("request", "integer", ""),
 );
 getFields($fields);
 
diff --git a/bureau/admin/mail_edit.php b/bureau/admin/mail_edit.php
index 2252a95b..f65f3b2e 100755
--- a/bureau/admin/mail_edit.php
+++ b/bureau/admin/mail_edit.php
@@ -26,7 +26,7 @@ require_once("../class/config.php");
 include_once("head.php");
 
 $fields = array (
-	"mail_id" =>array ("post","integer",""),
+	"mail_id" =>array ("request","integer",""),
 	"pass" => array ("post","string",""),
 	"passconf" => array("post","string",""),
 	"quotamb" => array("post","integer",0),
diff --git a/bureau/admin/mem_cm.php b/bureau/admin/mem_cm.php
index b1756dd8..2dcae0b9 100644
--- a/bureau/admin/mem_cm.php
+++ b/bureau/admin/mem_cm.php
@@ -32,9 +32,9 @@ require_once("../class/config_nochk.php");
 include_once("head.php");
 
 $fields = array (
-	"usr" => array ("post", "integer", 0),
-	"cookie" => array ("post", "string", ""),
-	"cle" => array("post","string",""),
+	"usr" => array ("request", "integer", 0),
+	"cookie" => array ("request", "string", ""),
+	"cle" => array("request","string",""),
 );
 getFields($fields);
 
@@ -48,6 +48,7 @@ if (isset($error) && $error) {
 	}
 ?>
 <form method="post" action="mem_cm2.php">
+  <?php csrf_get(); ?>
 	<table border="1" cellspacing="0" cellpadding="4">
 		<tr><td colspan="2"><input type="hidden" name="usr" value="<?php ehe($usr); ?>" /><input type="hidden" name="cookie" value="<?php ehe($cookie); ?>" />
 <?php __("Change the email of the account"); ?><br />
diff --git a/bureau/class/m_mysql.php b/bureau/class/m_mysql.php
index 265e363c..c1118c3e 100644
--- a/bureau/class/m_mysql.php
+++ b/bureau/class/m_mysql.php
@@ -588,82 +588,82 @@ class m_mysql {
         $dbn = str_replace('_', '\_', $dbn);
         $this->dbus->query("Select * from mysql.db where Db= ? and User!= ? ;", array($dbn, $cuid."_myadm"));
 
-        if (!$db->num_rows()) {
+        if (!$this->dbus->num_rows()) {
             $err->raise("mysql",_("Database not found"));
             return false;
         }
-        while ($db->next_record()) {
-            $variable = $db->Record;
+        while ($this->dbus->next_record()) {
+            $variable = $this->dbus->Record;
             if ($variable['User'] == $dbu) {
-                $r['Host'] = $db->f('Host');
+                $r['Host'] = $this->dbus->f('Host');
 
-                if ($db->f('Select_priv') !== "Y") {
+                if ($this->dbus->f('Select_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Insert_priv') !== "Y") {
+                if ($this->dbus->f('Insert_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Update_priv') !== "Y") {
+                if ($this->dbus->f('Update_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Delete_priv') !== "Y") {
+                if ($this->dbus->f('Delete_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Create_priv') !== "Y") {
+                if ($this->dbus->f('Create_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Drop_priv') !== "Y") {
+                if ($this->dbus->f('Drop_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('References_priv') !== "Y") {
+                if ($this->dbus->f('References_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Index_priv') !== "Y") {
+                if ($this->dbus->f('Index_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Alter_priv') !== "Y") {
+                if ($this->dbus->f('Alter_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Create_tmp_table_priv') !== "Y") {
+                if ($this->dbus->f('Create_tmp_table_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Lock_tables_priv') !== "Y") {
+                if ($this->dbus->f('Lock_tables_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Create_view_priv') !== "Y") {
+                if ($this->dbus->f('Create_view_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Show_view_priv') !== "Y") {
+                if ($this->dbus->f('Show_view_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Create_routine_priv') !== "Y") {
+                if ($this->dbus->f('Create_routine_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Alter_routine_priv') !== "Y") {
+                if ($this->dbus->f('Alter_routine_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Execute_priv') !== "Y") {
+                if ($this->dbus->f('Execute_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Event_priv') !== "Y") {
+                if ($this->dbus->f('Event_priv') !== "Y") {
                     return $r;
                 }
-                if ($db->f('Trigger_priv') !== "Y") {
+                if ($this->dbus->f('Trigger_priv') !== "Y") {
                     return $r;
                 }
             }
         } //endwhile
         if (!count($r)) {
-            $err->raise("mysql",_("Database not found"));
+            $err->raise("mysql",_("Database not found")." (2)");
             return false;
         }
         if (!$db->query("SELECT name,password from dbusers where name= ? ;", array($dbu))) {
-            $err->raise("mysql",_("Database not found"));
+            $err->raise("mysql",_("Database not found")." (3)");
             return false;
         }
 
         if (!$db->num_rows()) {
-            $err->raise("mysql",_("Database not found"));
+            $err->raise("mysql",_("Database not found")." (4)");
             return false;
         }
         $db->next_record();
diff --git a/bureau/locales/fr_FR/LC_MESSAGES/messages.po b/bureau/locales/fr_FR/LC_MESSAGES/messages.po
index 4649e862..09e7510c 100644
--- a/bureau/locales/fr_FR/LC_MESSAGES/messages.po
+++ b/bureau/locales/fr_FR/LC_MESSAGES/messages.po
@@ -5230,7 +5230,7 @@ msgstr ""
 
 #: ../class/m_mysql.php:304
 msgid "An error occured. The database could not be created"
-msgstr "Une erreur est survenur, la base de données n'a pas pu être créée"
+msgstr "Une erreur est survenue, la base de données n'a pas pu être créée"
 
 #: ../class/m_mysql.php:322
 msgid "The database was not found. I can't delete it"