WysiwygPro 2.22 Editor -> Limiting Uploading of Images to Publishers or Registered

mcpat · 15.04.2004, 03:38

when I open http://xxx.com/editors/wysiwygpro/impage.php

I can upload images...

How can I allow it for only publishers or registered users??

thx for help

cheers
patrick

X-F4CT0R · 15.04.2004, 03:39

if its not with mambo I dont think i can help you, bu if its mambo youchange that in the Main menu section when you create the menu items.

ejcdke · 15.04.2004, 23:10

Yeah, it's part of WYSIWYG Pro and I would love to make it so only publishers and editors and admins can upload pics, or delete, or rename. If anyone knows how to set this up in WYSIWYG Pro please help us out.

Thanks

SineMacula · 15.04.2004, 23:51

Afraid I don't have the answer, but have you tried the WysiwygPro support forums? http://www.wysiwygpro.com/support/

...just had another thought...

What about using an .htaccess file in that directory? At least then the upload page couldn't be accessed directly.

romanus · 16.04.2004, 04:56

Might want to consider some security precaustions using wysiwygpro. If someone knows the path to wysiwygpro in your site, they can actually use image.php to create directories and upload images without ever logging in.

all they have to know is the path

editor/wysiwygpro/

try it out for yourself

ejcdke · 16.04.2004, 22:04

I had noticed that while I was trying to figure things out. I ended up just giving users access to only upload images and disabled the rest. I figure that for now if I need to edit file names and such I can do it on the server. There can be things done to disable direct access to image.php, but what I'm really interested in is making that only work for special users while everyone else only gets the option to link to an image. Right now I only see it as being possible to make this change globally rather then for a group of users.

novocaine · 16.04.2004, 22:21

I made such a fix for my HTMLArea3 XTD but as I don't know wysiwygpro I can't tell where to do that best.

Here's what I did:

PHP Code:

  <?php

define( "_VALID_MOS", 1 );

$base_path = "../../..";

 
require( "../../../includes/auth.php" );

 
if (! $my->id) {

    require( "../../../administrator/includes/auth.php" );

} 

 
if ($my->id && ($my->gid == 2 || ($my->gid >= 19 && $my->gid <= 25))) {

//The upper line checks if user is in a group higher than a registered user (between 19 -> author and 25 -> super administrator)

 
    /*** The content of your image.php here ***/

 
}

?>

Hope this helps.

regards,
novocaine

ejcdke · 18.04.2004, 00:13

The first part get's rid of direct access if not logged in. That's a good start...so thank you for that info novocaine.

<?php
define( "_VALID_MOS", 1 );
$base_path = "../..";

require( "../../includes/auth.php" );

if (! $my->id) {
require( "../../administrator/includes/auth.php" );
}

I tried to put in some code to disallow direct access period, but apparently if you click on the image button, it's accessing the file directly and therefore that code just won't work. I think .htaccess file is the way to go. When I get some free time (probably not until after finals) I'll play with the rest of the code you gave an try to figure it out. If anyone else figures something out be sure to post it. I appreciate all the input.

Eric

mcpat · 18.04.2004, 23:14

I solved it...
(look at mamboserver forum )

image.php

PHP Code:

  //beginn

require_once('../../configuration.php');

$db = mysql_connect($mosConfig_host, $mosConfig_user, $mosConfig_password, $mosConfig_db, $mosConfig_dbprefix );

 mysql_select_db($mosConfig_db);

$sessioncookie = $_COOKIE['sessioncookie'];

$sessioncookie = md5($sessioncookie);

$result = mysql_query("SELECT gid FROM ".$mosConfig_dbprefix."session WHERE session_id = '$sessioncookie'"); 

$gid = mysql_result($result,0);

// end

include_once ('config.php');

include_once ('editor_functions.php');

config.php

PHP Code:

  if ($gid == "2" || $gid > 18) {

        $delete_files = true;

    $delete_directories = true;

    $create_directories = true;

    $rename_files = true;

    $rename_directories = true;

    $upload_files = true;

    $overwrite = true; 

} else {

        $delete_files = false;

    $delete_directories = false;

    $create_directories = false;

    $rename_files = false;

    $rename_directories = false;

    $upload_files = false;

    $overwrite = false; 

}

tell me please if my code is buggy or you solve it in a better way....

ejcdke · 19.04.2004, 00:01

Good work! I'll make a post if it causes any problems, but right now it seems to be doing the job. Thanks!

Eric