From 05e71c79c93801ab6a8262fbd93d1af3d5bdace4 Mon Sep 17 00:00:00 2001
From: pedro_morgan <pedro_morgan@ispconfig3>
Date: Sun, 19 Aug 2007 00:31:55 -0400
Subject: [PATCH] * Made login/index class php5 * Also replaces " with '
---
interface/lib/classes/tform.inc.php | 159 ++++++++++++++++++++++++++++++++++++++--------------
1 files changed, 115 insertions(+), 44 deletions(-)
diff --git a/interface/lib/classes/tform.inc.php b/interface/lib/classes/tform.inc.php
index bdcbaed..c36a451 100644
--- a/interface/lib/classes/tform.inc.php
+++ b/interface/lib/classes/tform.inc.php
@@ -539,7 +539,11 @@
$validator['regex'] .= 's';
if(!preg_match($validator['regex'], $field_value)) {
$errmsg = $validator['errmsg'];
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ if(isset($this->wordbook[$errmsg])) {
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ } else {
+ $this->errorMessage .= $errmsg."<br>\r\n";
+ }
}
break;
case 'UNIQUE':
@@ -673,15 +677,23 @@
if($field['formtype'] == 'PASSWORD') {
$sql_insert_key .= "`$key`, ";
if($field['encryption'] == 'CRYPT') {
- // $sql_insert_val .= "encrypt('".$record[$key]."'), ";
- $sql_insert_val .= "'".crypt($record[$key],substr(md5(time()),0,2))."', ";
+ $salt="$1$";
+ for ($n=0;$n<8;$n++) {
+ $salt.=chr(mt_rand(64,126));
+ }
+ $salt.="$";
+ // $salt = substr(md5(time()),0,2);
+ $record[$key] = crypt($record[$key],$salt);
} else {
- $sql_insert_val .= "md5('".$record[$key]."'), ";
+ $record[$key] = md5($record[$key]);
}
+ $sql_insert_val .= "'".$record[$key]."', ";
} elseif ($field['formtype'] == 'CHECKBOX') {
$sql_insert_key .= "`$key`, ";
if($record[$key] == '') {
+ // if a checkbox is not set, we set it to the unchecked value
$sql_insert_val .= "'".$field['value'][0]."', ";
+ $record[$key] = $field['value'][0];
} else {
$sql_insert_val .= "'".$record[$key]."', ";
}
@@ -691,15 +703,23 @@
}
} else {
if($field['formtype'] == 'PASSWORD') {
- if($field['encryption'] == 'CRYPT') {
- // $sql_update .= "`$key` = encrypt('".$record[$key]."'), ";
- $sql_update .= "`$key` = '".crypt($record[$key],substr(md5(time()),0,2))."', ";
+ if($field['encryption'] == 'CRYPT') {
+ $salt="$1$";
+ for ($n=0;$n<8;$n++) {
+ $salt.=chr(mt_rand(64,126));
+ }
+ $salt.="$";
+ // $salt = substr(md5(time()),0,2);
+ $record[$key] = crypt($record[$key],$salt);
} else {
- $sql_update .= "`$key` = md5('".$record[$key]."'), ";
+ $record[$key] = md5($record[$key]);
}
+ $sql_update .= "`$key` = '".$record[$key]."', ";
} elseif ($field['formtype'] == 'CHECKBOX') {
if($record[$key] == '') {
+ // if a checkbox is not set, we set it to the unchecked value
$sql_update .= "`$key` = '".$field['value'][0]."', ";
+ $record[$key] = $field['value'][0];
} else {
$sql_update .= "`$key` = '".$record[$key]."', ";
}
@@ -707,7 +727,11 @@
$sql_update .= "`$key` = '".$record[$key]."', ";
}
}
- }
+ } else {
+ // we unset the password filed, if empty to tell the datalog function
+ // that the password has not been changed
+ unset($record[$key]);
+ }
}
}
@@ -740,15 +764,13 @@
} else {
if($primary_id != 0) {
$sql_update = substr($sql_update,0,-2);
- $sql = "UPDATE ".$escape.$this->formDef['db_table'].$escape." SET ".$sql_update." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id;
+ $sql = "UPDATE ".$escape.$this->formDef['db_table'].$escape." SET ".$sql_update." WHERE ".$this->getAuthSQL('u')." AND ".$this->formDef['db_table_idx']." = ".$primary_id;
if($sql_ext_where != '') $sql .= " and ".$sql_ext_where;
} else {
$app->error("Primary ID fehlt!");
}
}
-
- // Daten in History tabelle speichern
- if($this->errorMessage == '' and $this->formDef['db_history'] == 'yes') $this->datalogSave($action,$primary_id,$record);
+
return $sql;
}
@@ -776,20 +798,21 @@
// definiere Tabs
foreach( $this->formDef["tabs"] as $key => $tab) {
- $tab['name'] = $key;
+ $tab['name'] = $key;
if($tab['name'] == $active_tab) {
- // Wenn Modul gesetzt, dann setzte template pfad relativ zu modul.
- if($this->module != '') $tab["template"] = "../".$this->module."/".$tab["template"];
+ // Wenn Modul gesetzt, dann setzte template pfad relativ zu modul.
+ if($this->module != '') $tab["template"] = "../".$this->module."/".$tab["template"];
- // �berpr�fe, ob das Template existiert, wenn nicht
- // dann generiere das Template
- if(!is_file($tab["template"])) {
- $app->uses('tform_tpl_generator');
- $app->tform_tpl_generator->buildHTML($this->formDef,$tab['name']);
- }
+ // �berpr�fe, ob das Template existiert, wenn nicht
+ // dann generiere das Template
+
+ if(!is_file($tab["template"])) {
+ $app->uses('tform_tpl_generator');
+ $app->tform_tpl_generator->buildHTML($this->formDef,$tab['name']);
+ }
- $app->tpl->setInclude('content_tpl',$tab["template"]);
+ $app->tpl->setInclude('content_tpl',$tab["template"]);
$tab["active"] = 1;
$_SESSION["s"]["form"]["tab"] = $tab['name'];
} else {
@@ -818,11 +841,16 @@
// Set Wordbook for this form
$app->tpl->setVar($this->wordbook);
- }
+ }
+ function getDataRecord($primary_id) {
+ global $app;
+ $sql = "SELECT * FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id;
+ return $app->db->queryOneRecord($sql);
+ }
+
-
- function datalogSave($action,$primary_id,$record_new) {
+ function datalogSave($action,$primary_id, $record_old, $record_new) {
global $app,$conf;
// F�ge Backticks nur bei unvollst�ndigen Tabellennamen ein
@@ -831,42 +859,84 @@
} else {
$escape = '`';
}
-
- if($action == "UPDATE") {
+
+ /*
+ if($action == "UPDATE" or $action == "DELETE") {
$sql = "SELECT * FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id;
$record_old = $app->db->queryOneRecord($sql);
} else {
$record_old = array();
}
+ */
$diffrec = array();
-
- if(is_array($record_new)) {
+
+ if(is_array($record_new) && count($record_new) > 0) {
foreach($record_new as $key => $val) {
if($record_old[$key] != $val) {
- // Datensatz hat sich ge�ndert
+ // Record has changed
$diffrec[$key] = array('old' => $record_old[$key],
- 'new' => $val);
+ 'new' => $val);
+ }
+ }
+ } elseif(is_array($record_old)) {
+ foreach($record_old as $key => $val) {
+ if($record_new[$key] != $val) {
+ // Record has changed
+ $diffrec[$key] = array('new' => $record_new[$key],
+ 'old' => $val);
}
}
}
+ $this->diffrec = $diffrec;
+
+
+ // Full diff records for ISPConfig, they have a different format then the simple diffrec
+ $diffrec_full = array();
+
+ if(is_array($record_old) && count($record_old) > 0) {
+ foreach($record_old as $key => $val) {
+ if(isset($record_new[$key]) && $record_new[$key] != $val) {
+ // Record has changed
+ $diffrec_full['old'][$key] = $val;
+ $diffrec_full['new'][$key] = $record_new[$key];
+ } else {
+ $diffrec_full['old'][$key] = $val;
+ $diffrec_full['new'][$key] = $val;
+ }
+ }
+ } elseif(is_array($record_new)) {
+ foreach($record_new as $key => $val) {
+ if(isset($record_new[$key]) && $record_old[$key] != $val) {
+ // Record has changed
+ $diffrec_full['new'][$key] = $val;
+ $diffrec_full['old'][$key] = $record_old[$key];
+ } else {
+ $diffrec_full['new'][$key] = $val;
+ $diffrec_full['old'][$key] = $val;
+ }
+ }
+ }
+
+ /*
+ echo "<pre>";
+ print_r($diffrec_full);
+ echo "</pre>";
+ */
// Insert the server_id, if the record has a server_id
$server_id = ($record_old["server_id"] > 0)?$record_old["server_id"]:0;
if(isset($record_new["server_id"])) $server_id = $record_new["server_id"];
-
- $this->diffrec = $diffrec;
- if(count($diffrec) > 0) {
-
- // We need the full records in ISPConfig, not only the diffs
- $diffrec = array( 'old' => $record_old,
- 'new' => $record_new);
-
- $diffstr = $app->db->quote(serialize($diffrec));
+ if(count($this->diffrec) > 0) {
+ $diffstr = $app->db->quote(serialize($diffrec_full));
$username = $app->db->quote($_SESSION["s"]["user"]["username"]);
$dbidx = $this->formDef['db_table_idx'].":".$primary_id;
- $action = ($action == 'INSERT')?'i':'u';
+ // $action = ($action == 'INSERT')?'i':'u';
+
+ if($action == 'INSERT') $action = 'i';
+ if($action == 'UPDATE') $action = 'u';
+ if($action == 'DELETE') $action = 'd';
$sql = "INSERT INTO sys_datalog (dbtable,dbidx,server_id,action,tstamp,user,data) VALUES ('".$this->formDef['db_table']."','$dbidx','$server_id','$action','".time()."','$username','$diffstr')";
$app->db->query($sql);
}
@@ -879,9 +949,10 @@
if($_SESSION["s"]["user"]["typ"] == 'admin') {
return '1';
} else {
- $sql = '(';
+ $groups = ( $_SESSION["s"]["user"]["groups"] ) ? $_SESSION["s"]["user"]["groups"] : 0;
+ $sql = '(';
$sql .= "(sys_userid = ".$_SESSION["s"]["user"]["userid"]." AND sys_perm_user like '%$perm%') OR ";
- $sql .= "(sys_groupid IN (".$_SESSION["s"]["user"]["groups"].") AND sys_perm_group like '%$perm%') OR ";
+ $sql .= "(sys_groupid IN (".$groups.") AND sys_perm_group like '%$perm%') OR ";
$sql .= "sys_perm_other like '%$perm%'";
$sql .= ')';
--
Gitblit v1.9.1