From 5ca959fa688255a8de61f89fe2751eb4d24a6912 Mon Sep 17 00:00:00 2001
From: Florian Schaal <florian@schaal-24.de>
Date: Tue, 22 Mar 2016 09:22:07 -0400
Subject: [PATCH] fixed typo
---
interface/lib/classes/remoting.inc.php | 116 ++++++++++++++++++++++++++++++++++++++-------------------
1 files changed, 77 insertions(+), 39 deletions(-)
diff --git a/interface/lib/classes/remoting.inc.php b/interface/lib/classes/remoting.inc.php
index 58400e4..2ed5761 100644
--- a/interface/lib/classes/remoting.inc.php
+++ b/interface/lib/classes/remoting.inc.php
@@ -90,15 +90,12 @@
}
//* Delete old remoting sessions
- $sql = "DELETE FROM remote_session WHERE tstamp < ".time();
+ $sql = "DELETE FROM remote_session WHERE tstamp < UNIX_TIMESTAMP()";
$app->db->query($sql);
- $username = $app->db->quote($username);
- $password = $app->db->quote($password);
-
if($client_login == true) {
- $sql = "SELECT * FROM sys_user WHERE USERNAME = '$username'";
- $user = $app->db->queryOneRecord($sql);
+ $sql = "SELECT * FROM sys_user WHERE USERNAME = ?";
+ $user = $app->db->queryOneRecord($sql, $username);
if($user) {
$saved_password = stripslashes($user['passwort']);
@@ -127,7 +124,7 @@
}
// now we need the client data
- $client = $app->db->queryOneRecord("SELECT client.can_use_api FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = " . $app->functions->intval($user['default_group']));
+ $client = $app->db->queryOneRecord("SELECT client.can_use_api FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = ?", $user['default_group']);
if(!$client || $client['can_use_api'] != 'y') {
throw new SoapFault('client_login_failed', 'The login failed. Client may not use api.');
return false;
@@ -140,13 +137,12 @@
$remote_functions = '';
$tstamp = time() + $this->session_timeout;
$sql = 'INSERT INTO remote_session (remote_session,remote_userid,remote_functions,client_login,tstamp'
- .') VALUES ('
- ." '$remote_session',$remote_userid,'$remote_functions',1,$tstamp)";
- $app->db->query($sql);
+ .') VALUES (?, ?, ?, 1, $tstamp)';
+ $app->db->query($sql, $remote_session,$remote_userid,$remote_functions,$tstamp);
return $remote_session;
} else {
- $sql = "SELECT * FROM remote_user WHERE remote_username = '$username' and remote_password = md5('$password')";
- $remote_user = $app->db->queryOneRecord($sql);
+ $sql = "SELECT * FROM remote_user WHERE remote_username = ? and remote_password = md5(?)";
+ $remote_user = $app->db->queryOneRecord($sql, $username, $password);
if($remote_user['remote_userid'] > 0) {
//* Create a remote user session
//srand ((double)microtime()*1000000);
@@ -155,9 +151,8 @@
$remote_functions = $remote_user['remote_functions'];
$tstamp = time() + $this->session_timeout;
$sql = 'INSERT INTO remote_session (remote_session,remote_userid,remote_functions,tstamp'
- .') VALUES ('
- ." '$remote_session',$remote_userid,'$remote_functions',$tstamp)";
- $app->db->query($sql);
+ .') VALUES (?, ?, ?, ?)';
+ $app->db->query($sql, $remote_session,$remote_userid,$remote_functions,$tstamp);
return $remote_session;
} else {
throw new SoapFault('login_failed', 'The login failed. Username or password wrong.');
@@ -177,15 +172,15 @@
return false;
}
- $session_id = $app->db->quote($session_id);
-
- $sql = "DELETE FROM remote_session WHERE remote_session = '$session_id'";
- $app->db->query($sql);
- return $app->db->affectedRows() == 1;
+ $sql = "DELETE FROM remote_session WHERE remote_session = ?";
+ if($app->db->query($sql, $session_id) != false) {
+ return true;
+ } else {
+ return false;
+ }
}
//** protected functions -----------------------------------------------------------------------------------
-
protected function klientadd($formdef_file, $reseller_id, $params)
{
@@ -201,8 +196,8 @@
$sql = $app->remoting_lib->getSQL($params, 'INSERT', 0);
//* Check if no system user with that username exists
- $username = $app->db->quote($params["username"]);
- $tmp = $app->db->queryOneRecord("SELECT count(userid) as number FROM sys_user WHERE username = '$username'");
+ $username = $params["username"];
+ $tmp = $app->db->queryOneRecord("SELECT count(userid) as number FROM sys_user WHERE username = ?", $username);
if($tmp['number'] > 0) $app->remoting_lib->errorMessage .= "Duplicate username<br />";
//* Stop on error while preparing the sql query
@@ -236,7 +231,7 @@
/* copied from the client_edit php */
exec('ssh-keygen -t rsa -C '.$username.'-rsa-key-'.time().' -f /tmp/id_rsa -N ""');
- $app->db->query("UPDATE client SET created_at = ".time().", id_rsa = '".$app->db->quote(@file_get_contents('/tmp/id_rsa'))."', ssh_rsa = '".$app->db->quote(@file_get_contents('/tmp/id_rsa.pub'))."' WHERE client_id = ".$this->id);
+ $app->db->query("UPDATE client SET created_at = UNIX_TIMESTAMP(), id_rsa = ?, ssh_rsa = ? WHERE client_id = ?", @file_get_contents('/tmp/id_rsa'), @file_get_contents('/tmp/id_rsa.pub'), $this->id);
exec('rm -f /tmp/id_rsa /tmp/id_rsa.pub');
@@ -249,10 +244,10 @@
$app->remoting_lib->ispconfig_sysuser_add($params, $insert_id);
if($reseller_id) {
- $client_group = $app->db->queryOneRecord("SELECT * FROM sys_group WHERE client_id = ".$insert_id);
- $reseller_user = $app->db->queryOneRecord("SELECT * FROM sys_user WHERE client_id = ".$reseller_id);
+ $client_group = $app->db->queryOneRecord("SELECT * FROM sys_group WHERE client_id = ?", $insert_id);
+ $reseller_user = $app->db->queryOneRecord("SELECT * FROM sys_user WHERE client_id = ?", $reseller_id);
$app->auth->add_group_to_user($reseller_user['userid'], $client_group['groupid']);
- $app->db->query("UPDATE client SET parent_client_id = ".$reseller_id." WHERE client_id = ".$insert_id);
+ $app->db->query("UPDATE client SET parent_client_id = ? WHERE client_id = ?", $reseller_id, $insert_id);
}
}
@@ -338,9 +333,22 @@
//* Load the form definition
$app->remoting_lib->loadFormDef($formdef_file);
+
+ //* get old record and merge with params, so only new values have to be set in $params
+ $old_rec = $app->remoting_lib->getDataRecord($primary_id);
+
+ foreach ($app->remoting_lib->formDef['fields'] as $fieldName => $fieldConf)
+ {
+ if ($fieldConf['formtype'] === 'PASSWORD' && empty($params[$fieldName])) {
+ unset($old_rec[$fieldName]);
+ }
+ }
+
+ $params = $app->functions->array_merge($old_rec,$params);
//* Get the SQL query
$sql = $app->remoting_lib->getSQL($params, 'UPDATE', $primary_id);
+
// throw new SoapFault('debug', $sql);
if($app->remoting_lib->errorMessage != '') {
throw new SoapFault('data_processing_error', $app->remoting_lib->errorMessage);
@@ -467,11 +475,8 @@
return false;
}
- $session_id = $app->db->quote($session_id);
-
- $now = time();
- $sql = "SELECT * FROM remote_session WHERE remote_session = '$session_id' AND tstamp >= $now";
- $session = $app->db->queryOneRecord($sql);
+ $sql = "SELECT * FROM remote_session WHERE remote_session = ? AND tstamp >= UNIX_TIMESTAMP()";
+ $session = $app->db->queryOneRecord($sql, $session_id);
if($session['remote_userid'] > 0) {
return $session;
} else {
@@ -480,17 +485,50 @@
}
}
- // needed from inside the remoting plugins
- public function server_get($session_id, $server_id, $section ='') {
+ public function server_get($session_id, $server_id = null, $section ='') {
global $app;
if(!$this->checkPerm($session_id, 'server_get')) {
- throw new SoapFault('permission_denied', 'You do not have the permissions to access this function.');
+ $this->server->fault('permission_denied', 'You do not have the permissions to access this function.');
return false;
}
- if (!empty($session_id) && !empty($server_id)) {
- $app->uses('remoting_lib , getconf');
- $section_config = $app->getconf->get_server_config($server_id, $section);
- return $section_config;
+ if (!empty($session_id)) {
+ if(!empty($server_id)) {
+ $app->uses('remoting_lib , getconf');
+ $section_config = $app->getconf->get_server_config($server_id, $section);
+ return $section_config;
+ } else {
+ $servers = array();
+ $sql = "SELECT server_id FROM server WHERE 1";
+ $all = $app->db->queryAllRecords($sql);
+ foreach($all as $s) {
+ $servers[$s['server_id']] = $app->getconf->get_server_config($s['server_id'], $section);
+ }
+ unset($all);
+ unset($s);
+ return $servers;
+ }
+ } else {
+ return false;
+ }
+ }
+
+ /**
+ Gets a list of all servers
+ @param int session_id
+ @param int server_name
+ @author Marius Cramer <m.cramer@pixcept.de> 2014
+ */
+ public function server_get_all($session_id)
+ {
+ global $app;
+ if(!$this->checkPerm($session_id, 'server_get')) {
+ $this->server->fault('permission_denied', 'You do not have the permissions to access this function.');
+ return false;
+ }
+ if (!empty($session_id)) {
+ $sql = "SELECT server_id, server_name FROM server WHERE 1";
+ $servers = $app->db->queryAllRecords($sql);
+ return $servers;
} else {
return false;
}
--
Gitblit v1.9.1