Sentora Support Forums
Client Notice Manager - Printable Version

+- Sentora Support Forums (https://senforums.mach-hosting.com)
+-- Forum: Sentora Forum Archives (https://senforums.mach-hosting.com/forumdisplay.php?fid=5)
+--- Forum: Sentora Public Support Forums v1.0.x (https://senforums.mach-hosting.com/forumdisplay.php?fid=32)
+---- Forum: General Support Forum v1.0.x (https://senforums.mach-hosting.com/forumdisplay.php?fid=36)
+---- Thread: Client Notice Manager (/showthread.php?tid=2883)



Client Notice Manager - wormsunited - 06-07-2016

Hi there to all.

I need to make a few changes in the client notice manager for my hosting users, by checking some of the forum searches i found a post that provided me the location of the file, now i need to make it html and not just plain text, does anyone knows how? I paste there the code, any help will be much appreciated. 

Client Notice Manager:

Code:
<?php class ui_tpl_notice {    public static function Template() {        $user_array = ctrl_users::GetUserDetail();        global $zdbh;        $result = $zdbh->query("SELECT ac_notice_tx FROM x_accounts WHERE ac_id_pk = " . $user_array['resellerid'] . "")->Fetch();        if ($result) {            if ($result['ac_notice_tx'] <> "")                return ui_sysmessage::shout(                    runtime_xss::xssClean($result['ac_notice_tx']),                    'notice',                    'Notice:',                    true                );            return false;        } else {            return false;        }    } } ?>



RE: Client Notice Manager - Ron-e - 06-07-2016

http://forums.sentora.org/showthread.php?tid=2026&pid=12941#pid12941


RE: Client Notice Manager - TGates - 06-08-2016

SECURITY NOTICE: By disabling the check mentioned in the link, you may be vulnerable to malicious XSS and other possible security risks. Use at your own risk!


RE: Client Notice Manager - wormsunited - 06-24-2016

Thanks to you all, it really works and i managed to protect myself using some of my own php scripts Wink

Huge thanks to the community and special thanks to: @TGates and @Ron-e


RE: Client Notice Manager - Ron-e - 06-24-2016

(06-24-2016, 09:46 AM)wormsunited Wrote: Thanks to you all, it really works and i managed to protect myself using some of my own php scripts Wink

Can you post the solution you found, maybe other like to use it also or can work upon it.


RE: Client Notice Manager - wormsunited - 07-08-2016

I am so sorry for my delay folks.
Here is the code i used, made my edits and then i changed back, instructions provided in the comments (fully commented)

PHP Code:
<?php

/**
 * @copyright 2014-2015 Sentora Project (http://www.sentora.org/) 
 * Sentora is a GPL fork of the ZPanel Project whose original header follows:
 *
 * Generic template place holder class.
 * @package zpanelx
 * @subpackage dryden -> ui -> tpl
 * @version 1.1.0
 * @author Bobby Allen (ballen@bobbyallen.me)
 * @copyright ZPanel Project (http://www.zpanelcp.com/)
 * @link http://www.zpanelcp.com/
 * @license GPL (http://www.gnu.org/licenses/gpl.html)
 *
 *
 * File location: /etc/sentora/panel/dryden/ui/tpl/notice.class.php
 * Edited by wormsunited = Help Sentora, donate now (http://sentora.org/donate)
 * Remove the code on line 34 of this code
 * CODE: runtime_xss::xssClean($result['ac_notice_tx'] = To plain text
 * CODE: ($result['ac_notice_tx']                      = For HTML tags
 * 
 * ATTENTION: USE AT YOUR OWN RISK
 *
 */
class ui_tpl_notice {

 
   public static function Template() {
 
       $user_array ctrl_users::GetUserDetail();
 
       global $zdbh;
 
       $result $zdbh->query("SELECT ac_notice_tx FROM x_accounts WHERE ac_id_pk = " $user_array['resellerid'] . "")->Fetch();
 
       if ($result) {
 
           if ($result['ac_notice_tx'] <> "")
 
               return ui_sysmessage::shout(
 
                   ($result['ac_notice_tx']),
 
                   'notice',
 
                   // YOU CAN ADD LINKS AND MORE HERE TOO
 
                   'Visit my website: <a href="http://google.com" target="_blank">Click here</a>',
 
                   true
                
);
 
           return false;
 
       } else {
 
           return false;
 
       }
 
   }

}

?>


I hope this can help the community Wink


RE: Client Notice Manager - TGates - 07-09-2016

Confused  That's exactly what I had done. There is still no protection for XSS and harmful javascript. Need to add something like HTMLPurifier to clean/control the input.


RE: Client Notice Manager - wormsunited - 07-09-2016

Cant agree more, you are right! If we need to add extra protection we need to create a new module for it, and make it accessible only by Admin or Reselers in Sentora Module Admin.

I am working on this module tho... Wink


RE: Client Notice Manager - TGates - 07-12-2016

Cool, check into adding HTMLpurifier. I was doing the same thing but time has been limited. It should be very easy to do.
I have successfully added it to other projects.