SF.net SVN: postfixadmin: [137] trunk

[<chr...@us...>]

Revision: 137
          http://postfixadmin.svn.sourceforge.net/postfixadmin/?rev=137&view=rev
Author:   christian_boltz
Date:     2007-10-07 10:49:50 -0700 (Sun, 07 Oct 2007)

Log Message:
-----------
- force user to delete setup.php (which allows creation of superadmins now!)

  Note: Developers can use
  $CONF['configured'] == 'I_know_the_risk_of_not_deleting_setup.php'
  to avoid deletion of setup.php after every "svn up".

  WARNING:
  THIS ALLOWS NON-AUTHENTIFICATED USERS TO CREATE SUPERADMIN ACCOUNTS!

  Use this setting only on development systems, where the database is not
  used by postfix.

Modified Paths:
--------------
    trunk/index.php
    trunk/login.php

Modified: trunk/index.php
===================================================================
--- trunk/index.php	2007-10-07 17:41:29 UTC (rev 136)
+++ trunk/index.php	2007-10-07 17:49:50 UTC (rev 137)
@@ -21,7 +21,9 @@
  * Form POST \ GET Variables: -none-
  */
 
-if (!file_exists (realpath ("./setup.php")))
+$CONF['configured'] = FALSE;
+@include_once('config.inc.php'); # hide error message because only $CONF['configured'] is checked here
+if (!file_exists (realpath ("./setup.php")) || $CONF['configured'] == 'I_know_the_risk_of_not_deleting_setup.php')
 {
     header ("Location: login.php");
     exit;

Modified: trunk/login.php
===================================================================
--- trunk/login.php	2007-10-07 17:41:29 UTC (rev 136)
+++ trunk/login.php	2007-10-07 17:49:50 UTC (rev 137)
@@ -28,6 +28,19 @@
  */
 
 require_once('common.php');
+
+# force user to delete setup.php (allows creation of superadmins!)
+if (file_exists (realpath ("./setup.php"))) {
+   if (is_string($CONF['configured']) && $CONF['configured'] == 'I_know_the_risk_of_not_deleting_setup.php')
+   {
+   }
+   else
+   {
+      print "Please delete setup.php before using Postfix Admin!";
+      exit;
+   }
+}
+
 if ($_SERVER['REQUEST_METHOD'] == "GET")
 {
     include ("./templates/header.tpl");


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.