I have a text editor for CKFinder that I would like to share with everyone.
Please understand this depends on a typical install of CKFinder for ASP, you also may need to enable popups in your browser, as well as making some changes to paths, etc... but you should be able to figure this out.
Please note: This is not an official add-on for CKFinder, just another developer that needed something like this, so don't bug these guys if you need support for this, post a reply here if you need to, and I'll see what I can do.
Here is the code:
/default.asp:
/editor.asp:
Please understand this depends on a typical install of CKFinder for ASP, you also may need to enable popups in your browser, as well as making some changes to paths, etc... but you should be able to figure this out.
Please note: This is not an official add-on for CKFinder, just another developer that needed something like this, so don't bug these guys if you need support for this, post a reply here if you need to, and I'll see what I can do.
Here is the code:
/default.asp:
<!--#include virtual="/ckfinder/ckfinder.asp"--> <% Response.Write("<p>Please double click on your text files to edit them.</p>" & VbCrLf) Set objFileManager = New CKFinder objFileManager.BasePath = "/ckfinder/" ' The path for the installation of CKFinder (default = "/ckfinder/"). objFileManager.SelectFunction = "EditTextFile" objFileManager.Create Set objFileManager = Nothing %> <script type="text/javascript"> function EditTextFile(fileUrl, data) { var fileName = ""; fileName = data['fileUrl']; //<- Get the actual filename, from the fileUrl if (checkTextFiles(fileName)) { //<- Check to see if we can edit the file //You will need to change the first parameter in this next function call to match where you put "editor.asp" OpenCenWindow('/ckfinder/editor.asp?file=' + fileName + '', 800, 560, 'no', 'no'); } } function checkTextFiles(fName) { var fileExtArr = ""; var extArr = ""; var boolReturn = false; var ext = "js|asp|jsp|css|php|txt|inc|config|htm|html|shtml|vbs|asa|xml"; //<- Change these to match the file types you want to be able to edit fileExtArr = fName.split('.'); //<- Split the filename to grab the extension extArr = ext.split('|'); //<- Split the list of file types for (var i = 0; i < extArr.length; ++i) { if (extArr[i] == fileExtArr[1]) { //<- Check the file type agains our list and mark it true if valid boolReturn += true; } } return boolReturn; //<- Return the boolean value } //Popup a centered window function OpenCenWindow (url, width, height, scrollbar, resize) { var x = 0.5 *(window.screen.width - width); var y = 0.5 *(window.screen.height - height); var pStr = 'location=no, dependent=yes, resizable=no, status=no,width=' + width + ', height=' + height + ', scrollbars=' + scrollbar + ', resizable=' + resize + ', alwaysRaised=1, toolbar=no, menubar=no, status=no, left=' + x + ', top=' + y; window.open (url, 'iascpicwin', pStr); return false; } </script>
/editor.asp:
<% Dim objFSO, objFile, fArr, i Dim strFileName : strFileName = Request.QueryString("file") '<-Request the filename Dim strAbsFilePath : strAbsFilePath = Server.MapPath(strFileName) '<- Change this to match your site's physical path Set objFSO = CreateObject("Scripting.FileSystemObject") If Len(Request.Form) > 0 Then If objFSO.FileExists(strAbsFilePath) Then objFSO.DeleteFile strAbsFilePath, True End If Set objFile = objFSO.CreateTextFile(strAbsFilePath) fArr = split(Request.Form("frm_File"), VbCrLf) For i = 0 To UBound(fArr) objFile.WriteLine(fArr(i)) Next : i = Null Erase fArr Set objFile = Nothing Response.Write("You file has been updated!") End If Response.Write("<form name=""add"" action=""/ckfinder/editor.asp?file=" & strFileName & """ method=""post"">" & VbCrLf) Set objFile = objFSO.OpenTextFile(strAbsFilePath, , True) Response.Write(" <textarea cols=""95"" rows=""30"" name=""frm_File"">") Do While Not(objFile.AtEndOfStream) Response.Write(objFile.ReadLine) Loop Response.Write(" </textarea>" & VbCrLf) Set objFile = Nothing Response.Write(" <div style=""text-align:center;padding:5px;""><input type=""submit"" value=""Modify This File"" /></div>" & VbCrLf) Response.Write("</form>" & VbCrLf) Set objFSO = Nothing %>
Re: A Present For All :)
The proposed code lacks any kind of security measures, it allows anyone to edit any file, it can edit server files like .asp, .asa, .php etc...
If an attacker finds it, your server is infected in less than a minute.
Re: A Present For All :)