Security fix to my last commit.

[fa-stable.git] / frontaccounting.php

diff --git a/frontaccounting.php b/frontaccounting.php
index 246d8dc402171c7675aed3998451c4c81ba63311..7e2201882a74b9f954ca64cfa97c8f69c5df83c4 100644 (file)
--- a/frontaccounting.php
+++ b/frontaccounting.php
@@ -9,6 +9,8 @@
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
 ***********************************************************************/
+if (!isset($path_to_root) || isset($_GET['path_to_root']) || isset($_POST['path_to_root']))
+       die("Restricted access");
        include_once($path_to_root . '/applications/application.php');
        include_once($path_to_root . '/applications/customers.php');
        include_once($path_to_root . '/applications/suppliers.php');
@@ -18,6 +20,14 @@
        include_once($path_to_root . '/applications/generalledger.php');
        include_once($path_to_root . '/applications/setup.php');
        include_once($path_to_root . '/installed_extensions.php');
+       if (count($installed_extensions) > 0)
+       {
+               foreach ($installed_extensions as $ext)
+               {
+                       include_once($path_to_root."/".$ext['folder']."/".$ext['app_file']);
+               }
+       }       
+
        include_once($path_to_root . '/modules/installed_modules.php');
 
        class front_accounting
@@ -33,7 +43,7 @@
                {
                        //$this->renderer =& new renderer();
                }
-               function add_application($app)
+               function add_application(&$app)
                                {
                                                        $this->applications[$app->id] = &$app;
                                }
@@ -65,7 +75,7 @@
                }
                function init()
                {
-                       global $installed_extensions, $applications, $path_to_root;
+                       global $installed_extensions, $path_to_root;
                        $this->menu = new menu(_("Main  Menu"));
                        $this->menu->add_item(_("Main  Menu"), "index.php");
                        $this->menu->add_item(_("Logout"), "/account/access/logout.php");
@@ -82,7 +92,6 @@
                                {
                                        get_text::add_domain($_SESSION['language']->code, 
                                                $ext['folder']."/lang");
-                                       include_once($ext['folder']."/".$ext['app_file']);
                                        $class = $ext['name']."_app";
                                        $this->add_application(new $class());
                                        get_text::add_domain($_SESSION['language']->code,