diff --git a/web/ajax/log.php b/web/ajax/log.php index e8caff6bd..2fd220578 100644 --- a/web/ajax/log.php +++ b/web/ajax/log.php @@ -19,7 +19,7 @@ switch ( $_REQUEST['task'] ) { else $line = NULL; - $levels = array_flip(Logger::$codes); + $levels = array_flip(ZM\Logger::$codes); if ( !isset($levels[$_POST['level']]) ) ZM\Panic("Unexpected logger level '".$_POST['level']."'"); $level = $levels[$_POST['level']]; @@ -322,7 +322,7 @@ switch ( $_REQUEST['task'] ) { $classLevel = ZM\Logger::FATAL; elseif ( $classLevel > ZM\Logger::DEBUG ) $classLevel = ZM\Logger::DEBUG; - $logClass = 'log-'.strtolower(Logger::$codes[$classLevel]); + $logClass = 'log-'.strtolower(ZM\Logger::$codes[$classLevel]); fprintf( $exportFP, " %s%s%s%d%s%s%s%s\n", $logClass, $log['DateTime'], $log['Component'], $log['Server'], $log['Pid'], $log['Code'], $log['Message'], $log['File'], $log['Line'] ); } fwrite( $exportFP, diff --git a/web/includes/Monitor.php b/web/includes/Monitor.php index dd1f81149..2030c9ec7 100644 --- a/web/includes/Monitor.php +++ b/web/includes/Monitor.php @@ -652,7 +652,8 @@ private $control_fields = array( } // end function Source public function UrlToIndex() { - return $this->Server()->UrlToIndex(ZM_MIN_STREAMING_PORT ? (ZM_MIN_STREAMING_PORT+$this->Id()) : null); + return $this->Server()->UrlToIndex(); + //ZM_MIN_STREAMING_PORT ? (ZM_MIN_STREAMING_PORT+$this->Id()) : null); } } // end class Monitor diff --git a/web/index.php b/web/index.php index c556a2171..f48ef03fb 100644 --- a/web/index.php +++ b/web/index.php @@ -38,7 +38,7 @@ if ( version_compare(phpversion(), '4.1.0', '<') ) { if ( false ) { ob_start(); phpinfo(INFO_VARIABLES); - $fp = fopen('/tmp/env.html', 'w'); + $fp = fopen('/tmp/env.html', 'w+'); fwrite($fp, ob_get_contents()); fclose($fp); ob_end_clean(); @@ -70,8 +70,15 @@ define('ZM_BASE_PROTOCOL', $protocol); // Use relative URL's instead define('ZM_BASE_URL', ''); -// Verify the system, php, and mysql timezones all match require_once('includes/functions.php'); +if ( $_SERVER['REQUEST_METHOD'] == 'OPTIONS' ) { + Logger::Debug("OPTIONS Method, only doing CORS"); + # Add Cross domain access headers + CORSHeaders(); + return; +} + +// Verify the system, php, and mysql timezones all match check_timezone(); if ( isset($_GET['skin']) ) { @@ -187,7 +194,7 @@ isset($view) || $view = NULL; isset($request) || $request = NULL; isset($action) || $action = NULL; -Logger::Debug("View: $view Request: $request Action: $action"); +Logger::Debug("View: $view Request: $request Action: $action User: " . ( isset($user) ? $user['Username'] : 'none' )); if ( ZM_ENABLE_CSRF_MAGIC && ( $action != 'login' ) && @@ -214,6 +221,12 @@ if ( $action ) { # If I put this here, it protects all views and popups, but it has to go after actions.php because actions.php does the actual logging in. if ( ZM_OPT_USE_AUTH and !isset($user) and ($view != 'login') ) { + /* AJAX check */ + if ( !empty($_SERVER['HTTP_X_REQUESTED_WITH']) + && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest' ) { + header('HTTP/1.1 401 Unauthorized'); + exit; + } Logger::Debug('Redirecting to login'); $view = 'none'; $redirect = ZM_BASE_URL.$_SERVER['PHP_SELF'].'?view=login'; diff --git a/web/skins/classic/includes/functions.php b/web/skins/classic/includes/functions.php index 37209b7d0..662856eb7 100644 --- a/web/skins/classic/includes/functions.php +++ b/web/skins/classic/includes/functions.php @@ -275,7 +275,6 @@ function getNavBarHTML($reload = null) { dbQuery('DELETE low_priority FROM Logs ORDER BY TimeKey ASC LIMIT ?', array($rows - ZM_LOG_DATABASE_LIMIT)); } } else if ( preg_match('/^\d\s*(hour|minute|day|week|month|year)$/', ZM_LOG_DATABASE_LIMIT, $matches) ) { - ZM\Logger::Debug("have interval ".$matches[1]); dbQuery('DELETE FROM Logs WHERE TimeKey < unix_timestamp( NOW() - interval '.ZM_LOG_DATABASE_LIMIT.') LIMIT 100'); } else { ZM\Error('Potentially invalid value for ZM_LOG_DATABASE_LIMIT: ' . ZM_LOG_DATABASE_LIMIT);