CVE-2020-13795: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: An issue was discovered in Navigate CMS through 2.8.7. It allows Directory Traversal because lib/packages/templates/template.class.php mishandles ../ and ..\ substrings.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2020-06-03T22:15Z
Repository: https://github.com/NavigateCMS/Navigate-CMS
Language: PHP
Files changed: lib/packages/templates/template.class.php, lib/packages/templates/templates.php, lib/packages/themes/themes.php
Commit date: 2020-05-09 08:50:51 +0200
Commit message: * template.class: filter file location path

Diff: diff --git a/lib/packages/templates/template.class.php b/lib/packages/templates/template.class.php
index 5d2f9521..13783b93 100644
--- a/lib/packages/templates/template.class.php
+++ b/lib/packages/templates/template.class.php
@@ -46,11 +46,11 @@ class template
 		$main = $rs[0];
 		
 		$this->id			= $main->id;
 		$this->website		= $main->website;		
 		$this->title  		= $main->title;
-		$this->file			= $main->file;
+		$this->file			= str_replace(array('../', '..\\'), '', $main->file);
 		$this->sections		= mb_unserialize($main->sections);
 		$this->gallery		= $main->gallery;
 		$this->comments		= $main->comments;		
 		$this->tags			= $main->tags;		
 		$this->statistics	= $main->statistics;						
@@ -72,14 +72,19 @@ class template
 
 		$template = NULL;
 		for($t=0; $t < count($ws_theme->templates); $t++)
 		{
 			if($ws_theme->templates[$t]->type == $id)
-				$template = $ws_theme->templates[$t];
+            {
+                $template = $ws_theme->templates[$t];
+            }
 		}
 
-		if(!$template) return;
+		if(!$template)
+        {
+            return;
+        }
 
         $defaults = array(
             'sections' => array(
                 0 => array(
                     'id' => 'main',
@@ -95,10 +100,13 @@ class template
             'permission' => 0,
             'enabled' => 1,
             'properties' => array()
         );
 
+        // filter file path
+        $template->file = str_replace(array('../', '..\\'), '', $template->file);
+
 		$this->id			= $template->type;
 		$this->website		= $website->id;
 		$this->title  		= $ws_theme->template_title($template->type);
 		$this->file			= NAVIGATE_PATH.'/themes/'.$ws_theme->name.'/'.$template->file;
 		$this->sections		= (isset($template->sections)? json_decode(json_encode($template->sections), true) : $defaults['sections']);
@@ -115,29 +123,34 @@ class template
         {
             if($this->properties[$p]->type == 'option')
             {
                 $poptions = array();
                 foreach($this->properties[$p]->options as $key => $value)
+                {
                     $poptions[$key] = $ws_theme->t($value);
+                }
 
                 $this->properties[$p]->options = $poptions;
             }
         }
 	}
 	
 	public function load_from_post()
 	{
 		$this->title  		= $_REQUEST['title'];
-		$this->file			= $_REQUEST['file'];
+		$this->file			= str_replace(array('../', '..\\'), '', $_REQUEST['file']);
 		$this->permission	= intval($_REQUEST['permission']);
 		$this->enabled		= intval($_REQUEST['enabled']);	
 		
 		// sections
 		$this->sections		= array();
 		for($s = 0; $s < count($_REQUEST['template-sections-code']); $s++)
 		{
-			if(empty($_REQUEST['template-sections-code'][$s])) continue;
+			if(empty($_REQUEST['template-sections-code'][$s]))
+            {
+                continue;
+            }
 			$this->sections[] = array(
 			    'code' => $_REQUEST['template-sections-code'][$s],
 				'name' => $_REQUEST['template-sections-name'][$s],
 				'editor' => $_REQUEST['template-sections-editor'][$s],
 				'width' => $_REQUEST['template-sections-width'][$s]
@@ -163,13 +176,17 @@ class template
 	
 	
 	public function save()
 	{
 		if(!empty($this->id))
-			return $this->update();
+        {
+            return $this->update();
+        }
 		else
-			return $this->insert();			
+        {
+            return $this->insert();
+        }
 	}
 	
 	public function delete()
 	{
 		global $DB;
diff --git a/lib/packages/templates/templates.php b/lib/packages/templates/templates.php
index 6ccc1366..9fb2a656 100644
--- a/lib/packages/templates/templates.php
+++ b/lib/packages/templates/templates.php
@@ -275,31 +275,40 @@ function templates_form($item)
 	
 	$navibars = new navibars();
 	$naviforms = new naviforms();
 	
 	if(empty($item->id))
-		$navibars->title(t(20, 'Templates').' / '.t(38, 'Create'));	
+    {
+        $navibars->title(t(20, 'Templates').' / '.t(38, 'Create'));
+    }
 	else
-		$navibars->title(t(20, 'Templates').' / '.t(170, 'Edit').' ['.$item->id.']');		
+    {
+        $navibars->title(t(20, 'Templates').' / '.t(170, 'Edit').' ['.$item->id.']');
+    }
 
     $readonly = false;
     if(!empty($item->id) && !is_numeric($item->id))
     {
         $layout->navigate_notification(t(432, "Read only mode"), false, true);
         $readonly = true;
     }
 	else if(empty($item->id))
 	{
-		$navibars->add_actions(		array(	'<a href="#" onclick="navigate_tabform_submit(1);"><img height="16" align="absmiddle" width="16" src="img/icons/silk/accept.png"> '.t(34, 'Save').'</a>'	)
-									);
+		$navibars->add_actions(
+		    array(
+		        '<a href="#" onclick="navigate_tabform_submit(1);"><img height="16" align="absmiddle" width="16" src="img/icons/silk/accept.png"> '.t(34, 'Save').'</a>'
+            )
+        );
 	}
 	else
 	{
-		$navibars->add_actions(		array(	'<a href="#" onclick="navigate_tabform_submit(1);"><img height="16" align="absmiddle" width="16" src="img/icons/silk/accept.png"> '.t(34, 'Save').'</a>',
-											'<a href="#" onclick="navigate_delete_dialog();"><img height="16" align="absmiddle" width="16" src="img/icons/silk/cancel.png"> '.t(35, 'Delete').'</a>'
-										)
-									);		
+		$navibars->add_actions(
+		    array(
+		        '<a href="#" onclick="navigate_tabform_submit(1);"><img height="16" align="absmiddle" width="16" src="img/icons/silk/accept.png"> '.t(34, 'Save').'</a>',
+                '<a href="#" onclick="navigate_delete_dialog();"><img height="16" align="absmiddle" width="16" src="img/icons/silk/cancel.png"> '.t(35, 'Delete').'</a>'
+            )
+        );
 		
 		$delete_html = array();
 		$delete_html[] = '<div id="navigate-delete-dialog" class="hidden">'.t(57, 'Do you really want to delete this item?').'</div>';
 		$delete_html[] = '<script language="javascript" type="text/javascript">';
 		$delete_html[] = 'function navigate_delete_dialog()';		
@@ -325,33 +334,47 @@ function templates_form($item)
 		$delete_html[] = '</script>';						
 									
 		$navibars->add_content(implode("\n", $delete_html));
 	}
 	
-	$navibars->add_actions(	array(	(!empty($item->id)? '<a href="?fid=templates&act=2"><img height="16" align="absmiddle" width="16" src="img/icons/silk/add.png"> '.t(38, 'Create').'</a>' : ''),
-									'<a href="?fid=templates&act=0"><img height="16" align="absmiddle" width="16" src="img/icons/silk/application_view_list.png"> '.t(39, 'List').'</a>',
-									'search_form' ));
+	$navibars->add_actions(
+	    array(
+	        (!empty($item->id)? '<a href="?fid=templates&act=2"><img height="16" align="absmiddle" width="16" src="img/icons/silk/add.png"> '.t(38, 'Create').'</a>' : ''),
+            '<a href="?fid=templates&act=0"><img height="16" align="absmiddle" width="16" src="img/icons/silk/application_view_list.png"> '.t(39, 'List').'</a>',
+			'search_form'
+        )
+    );
 
 	$navibars->form();
 
 	$navibars->add_tab(t(43, "Main"));
 	
 	$navibars->add_tab_content($naviforms->hidden('form-sent', 'true'));
 	$navibars->add_tab_content($naviforms->hidden('id', $item->id));	
 	
-	$navibars->add_tab_content_row(array(	'<label>ID</label>',
-											'<span>'.(!empty($item->id)? $item->id : t(52, '(new)')).'</span>' ));
+	$navibars->add_tab_content_row(
+	    array(
+	        '<label>ID</label>',
+			'<span>'.(!empty($item->id)? $item->id : t(52, '(new)')).'</span>'
+        )
+    );
 
-	$navibars->add_tab_content_row(array(	'<label>'.t(67, 'Title').'</label>',
-											$naviforms->textfield('title', $item->title),
-										));		
+	$navibars->add_tab_content_row(
+	    array(
+	        '<label>'.t(67, 'Title').'</label>',
+			$naviforms->textfield('title', $item->title),
+        )
+    );
 
     if($readonly)
     {
-        $navibars->add_tab_content_row(array(	'<label>'.t(82, 'File').'</label>',
-                                                        '<span>'.$item->file.'</span>'
-                                                    ));
+        $navibars->add_tab_content_row(
+            array(
+                '<label>'.t(82, 'File').'</label>',
+                '<span>'.$item->file.'</span>'
+            )
+        );
     }
     else
     {
         $navibars->add_tab_content_row(
             array(
@@ -443,42 +466,51 @@ function templates_form($item)
 				maximizable: true
 			});
 		}
 	');
 																				
-	$navibars->add_tab_content_row(array(	'<label>'.t(68, 'Status').'</label>',
-											$naviforms->selectfield('permission', 
-												array(
-														0 => 0,
-														1 => 1,
-														2 => 2
-													),
-												array(
-														0 => t(69, 'Published'),
-														1 => t(70, 'Private'),
-														2 => t(81, 'Hidden')
-													),
-												$item->permission,
-												'',
-												false,
-												array(
-														0 => t(360, 'Visible to everybody'),
-														1 => t(359, 'Visible only to Navigate CMS users'),
-														2 => t(358, 'Hidden to everybody')												
-												)
-											)
-										)
-									);						
+	$navibars->add_tab_content_row(
+	    array(
+	        '<label>'.t(68, 'Status').'</label>',
+			$naviforms->selectfield(
+			    'permission',
+                array(
+                        0 => 0,
+                        1 => 1,
+                        2 => 2
+                ),
+                array(
+                        0 => t(69, 'Published'),
+                        1 => t(70, 'Private'),
+                        2 => t(81, 'Hidden')
+                ),
+                $item->permission,
+                '',
+                false,
+                array(
+                        0 => t(360, 'Visible to everybody'),
+                        1 => t(359, 'Visible only to Navigate CMS users'),
+                        2 => t(358, 'Hidden to everybody')
+                )
+            )
+        )
+    );
 									
-	$navibars->add_tab_content_row(array(	'<label>'.t(62, 'Statistics').'</label>',
-											$naviforms->checkbox('statistics', $item->statistics),
-										));																									
+	$navibars->add_tab_content_row(
+	    array(
+	        '<label>'.t(62, 'Statistics').'</label>',
+			$naviforms->checkbox('statistics', $item->statistics),
+        )
+    );
 													
 										
-	$navibars->add_tab_content_row(array(	'<label>'.t(65, 'Enabled').'</label>',
-											$naviforms->checkbox('enabled', $item->enabled),
-										));	
+	$navibars->add_tab_content_row(
+	    array(
+	        '<label>'.t(65, 'Enabled').'</label>',
+			$naviforms->checkbox('enabled', $item->enabled),
+        )
+    );
 
 	if(!empty($item->id))
 	{											
 		$navibars->add_tab(t(236, "Sections"));																
 	
@@ -505,35 +537,50 @@ function templates_form($item)
 			$select_editor.= '	<option value="tinymce" '.$selected['tinymce'].'>TinyMCE</option>';
 			$select_editor.= '	<option value="html" '.$selected['html'].'>'.t(269, 'HTML code').'</option>';
 			$select_editor.= '	<option value="raw" '.$selected['raw'].'>'.t(268, 'Raw').'</option>';			
 			$select_editor.= '</select>';
 			
-			$table->addRow($p, array(
-					array('content' => '<input type="text" name="template-sections-code[]" value="'.$item->sections[$p]['code'].'" style="width: 140px;" />', 'align' => 'left'),			
-					array('content' => '<input type="text" name="template-sections-name[]" value="'.template::section_name($item->sections[$p]['name']).'" style="width: 290px;" />', 'align' => 'left'),
-					array('content' => $select_editor, 'align' => 'left'),
-					array('content' => '<div style=" white-space: nowrap; "><input type="text" name="template-sections-width[]" value="'.template::section_name($item->sections[$p]['width']).'" style="width: 40px;" /> px</div>', 'align' => 'left'),
-					array('content' => ((!empty($disabled) || $readonly)? '' : '<img src="'.NAVIGATE_URL.'/img/icons/silk/cancel.png" onclick="navigate_templates_sections_remove(this);" />'), 'align' => 'center')
-				));			
+			$table->addRow(
+                $p,
+                array(
+                    array('content' => '<input type="text" name="template-sections-code[]" value="'.$item->sections[$p]['code'].'" style="width: 140px;" />', 'align' => 'left'),
+                    array('content' => '<input type="text" name="template-sections-name[]" value="'.template::section_name($item->sections[$p]['name']).'" style="width: 290px;" />', 'align' => 'left'),
+                    array('content' => $select_editor, 'align' => 'left'),
+                    array('content' => '<div style=" white-space: nowrap; "><input type="text" name="template-sections-width[]" value="'.template::section_name($item->sections[$p]['width']).'" style="width: 40px;" /> px</div>', 'align' => 'left'),
+                    array('content' => ((!empty($disabled) || $readonly)? '' : '<img src="'.NAVIGATE_URL.'/img/icons/silk/cancel.png" onclick="navigate_templates_sections_remove(this);" />'), 'align' => 'center')
+                )
+            );
 		}
 
         if($readonly)
         {
-            $navibars->add_tab_content_row(array(	'<label>'.t(236, 'Sections').'</label>',
-                                                    '<div>'.$table->generate().'</div>'));
+            $navibars->add_tab_content_row(
+                array(
+                    '<label>'.t(236, 'Sections').'</label>',
+                    '<div>'.$table->generate().'</div>'
+                )
+            );
         }
         else
         {
-            $navibars->add_tab_content_row(array(	'<label>'.t(236, 'Sections').'</label>',
-                                                    '<div>'.$table->generate().'</div>',
-                                                    '<div class="subcomment">
-                                                        <img src="img/icons/silk/information.png" align="absmiddle" /> '.t(72, 'Drag any row to assign priorities').'.
-                                                         '.t(192, 'Double click any row to edit').'
-                                                    </div>' ));
-
-            $navibars->add_tab_content_row(array(	'<label>&nbsp;</label>',
-                                                    '<button id="templates-sections-create"><img src="img/icons/silk/add.png" align="absmiddle" style="cursor:pointer;" /> '.t(38, 'Create').'</button>'));
+            $navibars->add_tab_content_row(
+                array(
+                    '<label>'.t(236, 'Sections').'</label>',
+                    '<div>'.$table->generate().'</div>',
+                    '<div class="subcomment">
+                        <img src="img/icons/silk/information.png" align="absmiddle" /> '.t(72, 'Drag any row to assign priorities').'.
+                         '.t(192, 'Double click any row to edit').'
+                    </div>'
+                )
+            );
+
+            $navibars->add_tab_content_row(
+                array(
+                    '<label>&nbsp;</label>',
+                    '<button id="templates-sections-create"><img src="img/icons/silk/add.png" align="absmiddle" style="cursor:pointer;" /> '.t(38, 'Create').'</button>'
+                )
+            );
 		
         }
 
 		$navibars->add_content('
 			<form id="templates-sections-edit-dialog" style="display: none;">
@@ -544,11 +591,12 @@ function templates_form($item)
 				</div>
 				<div class="navigate-form-row">
 					<label>'.t(237, 'Code').'</label>
 					'.$naviforms->textfield('section-code', '').'					
 				</div>			
-			</form>');
+			</form>'
+        );
 			
 		
 		$section_widths = templates_section_widths();
 		
 		$layout->add_script('
@@ -592,21 +640,30 @@ function templates_form($item)
 			{
 				$(this).autocomplete( "search" , $(this).val());
 			});
 		');
 		
-		$navibars->add_tab_content_row(array(	'<label>'.t(210, 'Gallery').'</label>',
-												$naviforms->checkbox('gallery', $item->gallery),
-											));	
+		$navibars->add_tab_content_row(
+		    array(
+		        '<label>'.t(210, 'Gallery').'</label>',
+				$naviforms->checkbox('gallery', $item->gallery),
+            )
+        );
 											
-		$navibars->add_tab_content_row(array(	'<label>'.t(250, 'Comments').'</label>',
-												$naviforms->checkbox('comments', $item->comments),
-											));	
+		$navibars->add_tab_content_row(
+		    array(
+		        '<label>'.t(250, 'Comments').'</label>',
+				$naviforms->checkbox('comments', $item->comments),
+            )
+        );
 											
-		$navibars->add_tab_content_row(array(	'<label>'.t(265, 'Tags').'</label>',
-												$naviforms->checkbox('tags', $item->tags),
-											));												
+		$navibars->add_tab_content_row(
+		    array(
+		        '<label>'.t(265, 'Tags').'</label>',
+				$naviforms->checkbox('tags', $item->tags),
+            )
+        );
 
 
 		$navibars->add_tab(t(77, "Properties"));
 	
 		$table = new naviorderedtable("template_properties_table");
@@ -622,40 +679,57 @@ function templates_form($item)
 		$table->addHeaderColumn(t(65, 'Enabled'), 50);	
 
         $properties = property::elements($item->id);
 		$types		= property::types();
 
-        $element_types = array(	'item'	=> 	t(180, 'Item'),
-								'structure' => t(16, 'Structure')/*,
-								'product' => t(214, 'Product')*/);
+        $element_types = array(
+            'item'	=> 	t(180, 'Item'),
+			'structure' => t(16, 'Structure'),
+			'product' => t(214, 'Product')
+        );
 		
 		for($p=0; $p < count($properties); $p++)
 		{
-			$table->addRow($properties[$p]->id, array(
-					array('content' => $properties[$p]->name, 'align' => 'left'),
-					array('content' => $types[$properties[$p]->type], 'align' => 'left'),
-					array('content' => $element_types[$properties[$p]->element], 'align' => 'left'),					
-					array('content' => '<input type="checkbox" name="property-enabled[]" class="raw-checkbox" value="'.$properties[$p]->id.'" '.(($properties[$p]->enabled=='1'? ' checked=checked ' : '')).' />', 'align' => 'center'),
-				));
+			$table->addRow(
+                $properties[$p]->id,
+                array(
+                    array('content' => $properties[$p]->name, 'align' => 'left'),
+                    array('content' => $types[$properties[$p]->type], 'align' => 'left'),
+                    array('content' => $element_types[$properties[$p]->element], 'align' => 'left'),
+                    array('content' => '<input type="checkbox" name="property-enabled[]" class="raw-checkbox" value="'.$properties[$p]->id.'" '.(($properties[$p]->enabled=='1'? ' checked=checked ' : '')).' />', 'align' => 'center'),
+                )
+            );
 		}
 
         if($readonly)
         {
-            $navibars->add_tab_content_row(array(	'<label>'.t(77, 'Properties').'</label>',
-                                                    '<div>'.$table->generate().'</div>'));
+            $navibars->add_tab_content_row(
+                array(
+                    '<label>'.t(77, 'Properties').'</label>',
+                    '<div>'.$table->generate().'</div>'
+                )
+            );
         }
         else
         {
-            $navibars->add_tab_content_row(array(	'<label>'.t(77, 'Properties').'</label>',
-                                                    '<div>'.$table->generate().'</div>',
-                                                    '<div class="subcomment">
-                                                        <img src="img/icons/silk/information.png" align="absmiddle" /> '.t(72, 'Drag any row to assign priorities').'.
-                                                         '.t(192, 'Double click any row to edit').'
-                                                    </div>' ));
-
-            $navibars->add_tab_content_row(array(	'<label>&nbsp;</label>',
-                                                    '<button id="templates-properties-create"><img src="img/icons/silk/add.png" align="absmiddle" /> '.t(38, 'Create').'</button>'));
+            $navibars->add_tab_content_row(
+                array(
+                    '<label>'.t(77, 'Properties').'</label>',
+                    '<div>'.$table->generate().'</div>',
+                    '<div class="subcomment">
+                        <img src="img/icons/silk/information.png" align="absmiddle" /> '.t(72, 'Drag any row to assign priorities').'.
+                         '.t(192, 'Double click any row to edit').'
+                    </div>'
+                )
+            );
+
+            $navibars->add_tab_content_row(
+                array(
+                    '<label>&nbsp;</label>',
+                    '<button id="templates-properties-create"><img src="img/icons/silk/add.png" align="absmiddle" /> '.t(38, 'Create').'</button>'
+                )
+            );
         }
 	
 		$navibars->add_content('
 		<form id="templates-properties-edit-dialog" style="display: none;">
 			<div class="navigate-form-row">
@@ -954,22 +1028,28 @@ function templates_form($item)
 function templates_section_widths()
 {
 	global $DB;
 	global $website;
 	
-	$DB->query('SELECT sections
-				  FROM nv_templates
-				 WHERE website = '.intval($website->id),
-				'array');
+	$DB->query(
+	    'SELECT sections
+              FROM nv_templates
+             WHERE website = '.intval($website->id),
+
+        'array'
+    );
 				
 	$result = $DB->result();
 	
 	$widths = array();
 	foreach($result as $sections)
 	{
 		$sections = mb_unserialize($sections['sections']);
-		if(!is_array($sections)) $sections = array();
+		if(!is_array($sections))
+        {
+            $sections = array();
+        }
 		foreach($sections as $section)
 		{
 			if(!empty($section['width']) && !in_array($section['width'], $widths))
 				array_push($widths, $section['width']);
 		}
diff --git a/lib/packages/themes/themes.php b/lib/packages/themes/themes.php
index 92bf1b77..173aed25 100644
--- a/lib/packages/themes/themes.php
+++ b/lib/packages/themes/themes.php
@@ -97,19 +97,21 @@ function run()
             if(!empty($url) && $user->permission("themes.install")=="true")
             {
                 $error = false;
                 parse_str(parse_url($url, PHP_URL_QUERY), $query);
 
-                $tmp_file = sys_get_temp_dir().DIRECTORY_SEPARATOR.$query['code'].'.zip';
+                $tmp_file = sys_get_temp_dir() . DIRECTORY_SEPARATOR . $query['code'] . '.zip';
                 @core_file_curl($url, $tmp_file);
                 if(@filesize($tmp_file) == 0)
                 {
                     @unlink($tmp_file);
                     // core file curl failed, try using file_get_contents...
                     $tmp = @file_get_contents($url);
                     if(!empty($tmp))
+                    {
                         @file_put_contents($tmp_file, $tmp);
+                    }
                     unset($tmp);
                 }
 
                 if(@filesize($tmp_file) > 0)
                 {

Vulnerable code: 		$this->file			= $main->file;
				$template = $ws_theme->templates[$t];
		if(!$template) return;
		$this->file			= $_REQUEST['file'];
			if(empty($_REQUEST['template-sections-code'][$s])) continue;
			return $this->update();
			return $this->insert();			
		$navibars->title(t(20, 'Templates').' / '.t(38, 'Create'));	
		$navibars->title(t(20, 'Templates').' / '.t(170, 'Edit').' ['.$item->id.']');		
		$navibars->add_actions(		array(	'<a href="#" onclick="navigate_tabform_submit(1);"><img height="16" align="absmiddle" width="16" src="img/icons/silk/accept.png"> '.t(34, 'Save').'</a>'	)
									);
		$navibars->add_actions(		array(	'<a href="#" onclick="navigate_tabform_submit(1);"><img height="16" align="absmiddle" width="16" src="img/icons/silk/accept.png"> '.t(34, 'Save').'</a>',
											'<a href="#" onclick="navigate_delete_dialog();"><img height="16" align="absmiddle" width="16" src="img/icons/silk/cancel.png"> '.t(35, 'Delete').'</a>'
										)
									);		
	$navibars->add_actions(	array(	(!empty($item->id)? '<a href="?fid=templates&act=2"><img height="16" align="absmiddle" width="16" src="img/icons/silk/add.png"> '.t(38, 'Create').'</a>' : ''),
									'<a href="?fid=templates&act=0"><img height="16" align="absmiddle" width="16" src="img/icons/silk/application_view_list.png"> '.t(39, 'List').'</a>',
									'search_form' ));
	$navibars->add_tab_content_row(array(	'<label>ID</label>',
											'<span>'.(!empty($item->id)? $item->id : t(52, '(new)')).'</span>' ));
	$navibars->add_tab_content_row(array(	'<label>'.t(67, 'Title').'</label>',
											$naviforms->textfield('title', $item->title),
										));		
        $navibars->add_tab_content_row(array(	'<label>'.t(82, 'File').'</label>',
                                                        '<span>'.$item->file.'</span>'
                                                    ));
	$navibars->add_tab_content_row(array(	'<label>'.t(68, 'Status').'</label>',
											$naviforms->selectfield('permission', 
												array(
														0 => 0,
														1 => 1,
														2 => 2
													),
												array(
														0 => t(69, 'Published'),
														1 => t(70, 'Private'),
														2 => t(81, 'Hidden')
													),
												$item->permission,
												'',
												false,
												array(
														0 => t(360, 'Visible to everybody'),
														1 => t(359, 'Visible only to Navigate CMS users'),
														2 => t(358, 'Hidden to everybody')												
												)
											)
										)
									);						
	$navibars->add_tab_content_row(array(	'<label>'.t(62, 'Statistics').'</label>',
											$naviforms->checkbox('statistics', $item->statistics),
										));																									
	$navibars->add_tab_content_row(array(	'<label>'.t(65, 'Enabled').'</label>',
											$naviforms->checkbox('enabled', $item->enabled),
										));	
			$table->addRow($p, array(
					array('content' => '<input type="text" name="template-sections-code[]" value="'.$item->sections[$p]['code'].'" style="width: 140px;" />', 'align' => 'left'),			
					array('content' => '<input type="text" name="template-sections-name[]" value="'.template::section_name($item->sections[$p]['name']).'" style="width: 290px;" />', 'align' => 'left'),
					array('content' => $select_editor, 'align' => 'left'),
					array('content' => '<div style=" white-space: nowrap; "><input type="text" name="template-sections-width[]" value="'.template::section_name($item->sections[$p]['width']).'" style="width: 40px;" /> px</div>', 'align' => 'left'),
					array('content' => ((!empty($disabled) || $readonly)? '' : '<img src="'.NAVIGATE_URL.'/img/icons/silk/cancel.png" onclick="navigate_templates_sections_remove(this);" />'), 'align' => 'center')
				));			
            $navibars->add_tab_content_row(array(	'<label>'.t(236, 'Sections').'</label>',
                                                    '<div>'.$table->generate().'</div>'));
            $navibars->add_tab_content_row(array(	'<label>'.t(236, 'Sections').'</label>',
                                                    '<div>'.$table->generate().'</div>',
                                                    '<div class="subcomment">
                                                        <img src="img/icons/silk/information.png" align="absmiddle" /> '.t(72, 'Drag any row to assign priorities').'.
                                                         '.t(192, 'Double click any row to edit').'
                                                    </div>' ));

            $navibars->add_tab_content_row(array(	'<label>&nbsp;</label>',
                                                    '<button id="templates-sections-create"><img src="img/icons/silk/add.png" align="absmiddle" style="cursor:pointer;" /> '.t(38, 'Create').'</button>'));
			</form>');
		$navibars->add_tab_content_row(array(	'<label>'.t(210, 'Gallery').'</label>',
												$naviforms->checkbox('gallery', $item->gallery),
											));	
		$navibars->add_tab_content_row(array(	'<label>'.t(250, 'Comments').'</label>',
												$naviforms->checkbox('comments', $item->comments),
											));	
		$navibars->add_tab_content_row(array(	'<label>'.t(265, 'Tags').'</label>',
												$naviforms->checkbox('tags', $item->tags),
											));												
        $element_types = array(	'item'	=> 	t(180, 'Item'),
								'structure' => t(16, 'Structure')/*,
								'product' => t(214, 'Product')*/);
			$table->addRow($properties[$p]->id, array(
					array('content' => $properties[$p]->name, 'align' => 'left'),
					array('content' => $types[$properties[$p]->type], 'align' => 'left'),
					array('content' => $element_types[$properties[$p]->element], 'align' => 'left'),					
					array('content' => '<input type="checkbox" name="property-enabled[]" class="raw-checkbox" value="'.$properties[$p]->id.'" '.(($properties[$p]->enabled=='1'? ' checked=checked ' : '')).' />', 'align' => 'center'),
				));
            $navibars->add_tab_content_row(array(	'<label>'.t(77, 'Properties').'</label>',
                                                    '<div>'.$table->generate().'</div>'));
            $navibars->add_tab_content_row(array(	'<label>'.t(77, 'Properties').'</label>',
                                                    '<div>'.$table->generate().'</div>',
                                                    '<div class="subcomment">
                                                        <img src="img/icons/silk/information.png" align="absmiddle" /> '.t(72, 'Drag any row to assign priorities').'.
                                                         '.t(192, 'Double click any row to edit').'
                                                    </div>' ));

            $navibars->add_tab_content_row(array(	'<label>&nbsp;</label>',
                                                    '<button id="templates-properties-create"><img src="img/icons/silk/add.png" align="absmiddle" /> '.t(38, 'Create').'</button>'));
	$DB->query('SELECT sections
				  FROM nv_templates
				 WHERE website = '.intval($website->id),
				'array');
		if(!is_array($sections)) $sections = array();
                $tmp_file = sys_get_temp_dir().DIRECTORY_SEPARATOR.$query['code'].'.zip';
Fixed code: 		$this->file			= str_replace(array('../', '..\\'), '', $main->file);
            {
                $template = $ws_theme->templates[$t];
            }
		if(!$template)
        {
            return;
        }
        // filter file path
        $template->file = str_replace(array('../', '..\\'), '', $template->file);

                {
                }
		$this->file			= str_replace(array('../', '..\\'), '', $_REQUEST['file']);
			if(empty($_REQUEST['template-sections-code'][$s]))
            {
                continue;
            }
        {
            return $this->update();
        }
        {
            return $this->insert();
        }
    {
        $navibars->title(t(20, 'Templates').' / '.t(38, 'Create'));
    }
    {
        $navibars->title(t(20, 'Templates').' / '.t(170, 'Edit').' ['.$item->id.']');
    }
		$navibars->add_actions(
		    array(
		        '<a href="#" onclick="navigate_tabform_submit(1);"><img height="16" align="absmiddle" width="16" src="img/icons/silk/accept.png"> '.t(34, 'Save').'</a>'
            )
        );
		$navibars->add_actions(
		    array(
		        '<a href="#" onclick="navigate_tabform_submit(1);"><img height="16" align="absmiddle" width="16" src="img/icons/silk/accept.png"> '.t(34, 'Save').'</a>',
                '<a href="#" onclick="navigate_delete_dialog();"><img height="16" align="absmiddle" width="16" src="img/icons/silk/cancel.png"> '.t(35, 'Delete').'</a>'
            )
        );
	$navibars->add_actions(
	    array(
	        (!empty($item->id)? '<a href="?fid=templates&act=2"><img height="16" align="absmiddle" width="16" src="img/icons/silk/add.png"> '.t(38, 'Create').'</a>' : ''),
            '<a href="?fid=templates&act=0"><img height="16" align="absmiddle" width="16" src="img/icons/silk/application_view_list.png"> '.t(39, 'List').'</a>',
			'search_form'
        )
    );
	$navibars->add_tab_content_row(
	    array(
	        '<label>ID</label>',
			'<span>'.(!empty($item->id)? $item->id : t(52, '(new)')).'</span>'
        )
    );
	$navibars->add_tab_content_row(
	    array(
	        '<label>'.t(67, 'Title').'</label>',
			$naviforms->textfield('title', $item->title),
        )
    );
        $navibars->add_tab_content_row(
            array(
                '<label>'.t(82, 'File').'</label>',
                '<span>'.$item->file.'</span>'
            )
        );
	$navibars->add_tab_content_row(
	    array(
	        '<label>'.t(68, 'Status').'</label>',
			$naviforms->selectfield(
			    'permission',
                array(
                        0 => 0,
                        1 => 1,
                        2 => 2
                ),
                array(
                        0 => t(69, 'Published'),
                        1 => t(70, 'Private'),
                        2 => t(81, 'Hidden')
                ),
                $item->permission,
                '',
                false,
                array(
                        0 => t(360, 'Visible to everybody'),
                        1 => t(359, 'Visible only to Navigate CMS users'),
                        2 => t(358, 'Hidden to everybody')
                )
            )
        )
    );
	$navibars->add_tab_content_row(
	    array(
	        '<label>'.t(62, 'Statistics').'</label>',
			$naviforms->checkbox('statistics', $item->statistics),
        )
    );
	$navibars->add_tab_content_row(
	    array(
	        '<label>'.t(65, 'Enabled').'</label>',
			$naviforms->checkbox('enabled', $item->enabled),
        )
    );
			$table->addRow(
                $p,
                array(
                    array('content' => '<input type="text" name="template-sections-code[]" value="'.$item->sections[$p]['code'].'" style="width: 140px;" />', 'align' => 'left'),
                    array('content' => '<input type="text" name="template-sections-name[]" value="'.template::section_name($item->sections[$p]['name']).'" style="width: 290px;" />', 'align' => 'left'),
                    array('content' => $select_editor, 'align' => 'left'),
                    array('content' => '<div style=" white-space: nowrap; "><input type="text" name="template-sections-width[]" value="'.template::section_name($item->sections[$p]['width']).'" style="width: 40px;" /> px</div>', 'align' => 'left'),
                    array('content' => ((!empty($disabled) || $readonly)? '' : '<img src="'.NAVIGATE_URL.'/img/icons/silk/cancel.png" onclick="navigate_templates_sections_remove(this);" />'), 'align' => 'center')
                )
            );
            $navibars->add_tab_content_row(
                array(
                    '<label>'.t(236, 'Sections').'</label>',
                    '<div>'.$table->generate().'</div>'
                )
            );
            $navibars->add_tab_content_row(
                array(
                    '<label>'.t(236, 'Sections').'</label>',
                    '<div>'.$table->generate().'</div>',
                    '<div class="subcomment">
                        <img src="img/icons/silk/information.png" align="absmiddle" /> '.t(72, 'Drag any row to assign priorities').'.
                         '.t(192, 'Double click any row to edit').'
                    </div>'
                )
            );

            $navibars->add_tab_content_row(
                array(
                    '<label>&nbsp;</label>',
                    '<button id="templates-sections-create"><img src="img/icons/silk/add.png" align="absmiddle" style="cursor:pointer;" /> '.t(38, 'Create').'</button>'
                )
            );
			</form>'
        );
		$navibars->add_tab_content_row(
		    array(
		        '<label>'.t(210, 'Gallery').'</label>',
				$naviforms->checkbox('gallery', $item->gallery),
            )
        );
		$navibars->add_tab_content_row(
		    array(
		        '<label>'.t(250, 'Comments').'</label>',
				$naviforms->checkbox('comments', $item->comments),
            )
        );
		$navibars->add_tab_content_row(
		    array(
		        '<label>'.t(265, 'Tags').'</label>',
				$naviforms->checkbox('tags', $item->tags),
            )
        );
        $element_types = array(
            'item'	=> 	t(180, 'Item'),
			'structure' => t(16, 'Structure'),
			'product' => t(214, 'Product')
        );
			$table->addRow(
                $properties[$p]->id,
                array(
                    array('content' => $properties[$p]->name, 'align' => 'left'),
                    array('content' => $types[$properties[$p]->type], 'align' => 'left'),
                    array('content' => $element_types[$properties[$p]->element], 'align' => 'left'),
                    array('content' => '<input type="checkbox" name="property-enabled[]" class="raw-checkbox" value="'.$properties[$p]->id.'" '.(($properties[$p]->enabled=='1'? ' checked=checked ' : '')).' />', 'align' => 'center'),
                )
            );
            $navibars->add_tab_content_row(
                array(
                    '<label>'.t(77, 'Properties').'</label>',
                    '<div>'.$table->generate().'</div>'
                )
            );
            $navibars->add_tab_content_row(
                array(
                    '<label>'.t(77, 'Properties').'</label>',
                    '<div>'.$table->generate().'</div>',
                    '<div class="subcomment">
                        <img src="img/icons/silk/information.png" align="absmiddle" /> '.t(72, 'Drag any row to assign priorities').'.
                         '.t(192, 'Double click any row to edit').'
                    </div>'
                )
            );

            $navibars->add_tab_content_row(
                array(
                    '<label>&nbsp;</label>',
                    '<button id="templates-properties-create"><img src="img/icons/silk/add.png" align="absmiddle" /> '.t(38, 'Create').'</button>'
                )
            );
	$DB->query(
	    'SELECT sections
              FROM nv_templates
             WHERE website = '.intval($website->id),

        'array'
    );
		if(!is_array($sections))
        {
            $sections = array();
        }
                $tmp_file = sys_get_temp_dir() . DIRECTORY_SEPARATOR . $query['code'] . '.zip';
                    {
                    }