From 9cb77e00c93ad86c95e23b9377bcf2f92da9c75a Mon Sep 17 00:00:00 2001
From: mcramer <m.cramer@pixcept.de>
Date: Thu, 01 Nov 2012 07:52:23 -0400
Subject: [PATCH] Fixed: - log parsing did not recognize lines with multiple recipients - spamfilter_users added to datalog status messages
---
interface/lib/classes/remoting_lib.inc.php | 413 ++++++++++++++++++++++++++++++++++++++++++++--------------
1 files changed, 314 insertions(+), 99 deletions(-)
diff --git a/interface/lib/classes/remoting_lib.inc.php b/interface/lib/classes/remoting_lib.inc.php
index 38d9010..2bb1897 100644
--- a/interface/lib/classes/remoting_lib.inc.php
+++ b/interface/lib/classes/remoting_lib.inc.php
@@ -37,39 +37,37 @@
/**
* Formularbehandlung
*
-* Funktionen zur Umwandlung von Formulardaten
-* sowie zum vorbereiten von HTML und SQL
-* Ausgaben
+* Functions to validate, display and save form values
*
-* Tabellendefinition
+* Database table field definitions
*
-* Datentypen:
-* - INTEGER (Wandelt Ausdr�cke in Int um)
+* Datatypes:
+* - INTEGER (Converts data to int automatically)
* - DOUBLE
-* - CURRENCY (Formatiert Zahlen nach W�hrungsnotation)
-* - VARCHAR (kein weiterer Format Check)
-* - DATE (Datumsformat, Timestamp Umwandlung)
+* - CURRENCY (Formats digits in currency notation)
+* - VARCHAR (No format check)
+* - DATE (Date format, converts from and to UNIX timestamps automatically)
*
* Formtype:
-* - TEXT (normales Textfeld)
-* - PASSWORD (Feldinhalt wird nicht angezeigt)
-* - SELECT (Gibt Werte als option Feld aus)
-* - MULTIPLE (Select-Feld mit nehreren Werten)
+* - TEXT (Normal text field)
+* - PASSWORD (password field, the content will not be displayed again to the user)
+* - SELECT (Option fiield)
+* - MULTIPLE (Allows selection of multiple values)
*
* VALUE:
-* - Wert oder Array
+* - Value or array
*
* SEPARATOR
-* - Trennzeichen f�r multiple Felder
+* - separator char used for fileds with multiple values
*
-* Hinweis:
-* Das ID-Feld ist nicht bei den Table Values einzuf�gen.
+* Hint: The auto increment (ID) filed of the table has not be be definied separately.
+*
*/
class remoting_lib {
/**
- * Definition of the database atble (array)
+ * Definition of the database table (array)
* @var tableDef
*/
private $tableDef;
@@ -115,13 +113,14 @@
var $sys_userid;
var $sys_default_group;
var $sys_groups;
+ var $client_id;
//* Load the form definition from file.
function loadFormDef($file) {
global $app,$conf;
- include_once($file);
+ include($file);
$this->formDef = $form;
unset($this->formDef['tabs']);
@@ -138,16 +137,17 @@
}
//* Load the user profile
- function loadUserProfile($client_id = 0) {
+ function loadUserProfile($client_id_param = 0) {
global $app,$conf;
- $client_id = intval($client_id);
+ $this->client_id = $app->functions->intval($client_id_param);
- if($client_id == 0) {
+ if($this->client_id == 0) {
$this->sys_username = 'admin';
$this->sys_userid = 1;
$this->sys_default_group = 1;
$this->sys_groups = 1;
+ $_SESSION["s"]["user"]["typ"] = 'admin';
} else {
//* load system user - try with sysuser and before with userid (workarrond)
/*
@@ -160,11 +160,14 @@
}
}*/
- $user = $app->db->queryOneRecord("SELECT * FROM sys_user WHERE client_id = $client_id");
+ $user = $app->db->queryOneRecord("SELECT * FROM sys_user WHERE client_id = $this->client_id");
$this->sys_username = $user['username'];
$this->sys_userid = $user['userid'];
$this->sys_default_group = $user['default_group'];
$this->sys_groups = $user['groups'];
+ // $_SESSION["s"]["user"]["typ"] = $user['typ'];
+ // we have to force admin priveliges for the remoting API as some function calls might fail otherwise.
+ $_SESSION["s"]["user"]["typ"] = 'admin';
}
return true;
@@ -172,7 +175,8 @@
/**
- * Converts data in human readable form
+ * Converts the data in the array to human readable format
+ * Datatype conversion e.g. to show the data in lists
*
* @param record
* @return record
@@ -190,14 +194,21 @@
$new_record[$key] = stripslashes($record[$key]);
break;
- case 'DATE':
+ case 'DATETSTAMP':
if($record[$key] > 0) {
$new_record[$key] = date($this->dateformat,$record[$key]);
}
break;
+
+ case 'DATE':
+ if($record[$key] != '' && $record[$key] != '0000-00-00') {
+ $tmp = explode('-',$record[$key]);
+ $new_record[$key] = date($this->dateformat,mktime(0, 0, 0, $tmp[1] , $tmp[2], $tmp[0]));
+ }
+ break;
case 'INTEGER':
- $new_record[$key] = intval($record[$key]);
+ $new_record[$key] = $app->functions->intval($record[$key]);
break;
case 'DOUBLE':
@@ -205,7 +216,7 @@
break;
case 'CURRENCY':
- $new_record[$key] = number_format($record[$key], 2, ',', '');
+ $new_record[$key] = $app->functions->currency_format($record[$key]);
break;
default:
@@ -246,7 +257,7 @@
unset($tmp_recordid);
$querystring = str_replace("{AUTHSQL}",$this->getAuthSQL('r'),$querystring);
-
+
// Getting the records
$tmp_records = $app->db->queryAllRecords($querystring);
if($app->db->errorMessage != '') die($app->db->errorMessage);
@@ -268,7 +279,7 @@
$app->uses($datasource_class);
$values = $app->$datasource_class->$datasource_function($field, $record);
} else {
- $this->errorMessage .= "Custom datasource class or function is empty<br>\r\n";
+ $this->errorMessage .= "Custom datasource class or function is empty<br />\r\n";
}
}
@@ -277,34 +288,44 @@
}
/**
- * Converts the data in a format to store it in the database table
+ /**
+ * Rewrite the record data to be stored in the database
+ * and check values with regular expressions.
*
* @param record = Datensatz als Array
* @return record
*/
- function encode($record) {
-
+ function encode($record,$dbencode = true) {
+ global $app;
if(is_array($record)) {
foreach($this->formDef['fields'] as $key => $field) {
- if(isset($field['validators']) && is_array($field['validators'])) $this->validateField($key, (isset($record[$key]))?$record[$key]:'', $field['validators']);
+ //* Apply filter to record value
+ if(isset($field['filters']) && is_array($field['filters'])) {
+ $record[$key] = $this->filterField($key, (isset($record[$key]))?$record[$key]:'', $field['filters'], 'SAVE');
+ }
+
+ //* Validate record value
+ if(isset($field['validators']) && is_array($field['validators'])) {
+ $this->validateField($key, (isset($record[$key]))?$record[$key]:'', $field['validators']);
+ }
switch ($field['datatype']) {
case 'VARCHAR':
if(!@is_array($record[$key])) {
- $new_record[$key] = (isset($record[$key]))?mysql_real_escape_string($record[$key]):'';
+ $new_record[$key] = (isset($record[$key]))?$record[$key]:'';
} else {
$new_record[$key] = implode($field['separator'],$record[$key]);
}
break;
case 'TEXT':
if(!is_array($record[$key])) {
- $new_record[$key] = mysql_real_escape_string($record[$key]);
+ $new_record[$key] = $record[$key];
} else {
$new_record[$key] = implode($field['separator'],$record[$key]);
}
break;
- case 'DATE':
+ case 'DATETSTAMP':
if($record[$key] > 0) {
list($tag,$monat,$jahr) = explode('.',$record[$key]);
$new_record[$key] = mktime(0,0,0,$monat,$tag,$jahr);
@@ -312,16 +333,46 @@
$new_record[$key] = 0;
}
break;
+ case 'DATE':
+ if($record[$key] != '' && $record[$key] != '0000-00-00') {
+ if(function_exists('date_parse_from_format')) {
+ $date_parts = date_parse_from_format($this->dateformat,$record[$key]);
+ //list($tag,$monat,$jahr) = explode('.',$record[$key]);
+ $new_record[$key] = $date_parts['year'].'-'.$date_parts['month'].'-'.$date_parts['day'];
+ //$tmp = strptime($record[$key],$this->dateformat);
+ //$new_record[$key] = ($tmp['tm_year']+1900).'-'.($tmp['tm_mon']+1).'-'.$tmp['tm_mday'];
+ } else {
+ //$tmp = strptime($record[$key],$this->dateformat);
+ //$new_record[$key] = ($tmp['tm_year']+1900).'-'.($tmp['tm_mon']+1).'-'.$tmp['tm_mday'];
+ $tmp = strtotime($record[$key]);
+ $new_record[$key] = date('Y-m-d',$tmp);
+ }
+ } else {
+ $new_record[$key] = '0000-00-00';
+ }
+ break;
case 'INTEGER':
- $new_record[$key] = (isset($record[$key]))?intval($record[$key]):0;
+ $new_record[$key] = (isset($record[$key]))?$app->functions->intval($record[$key]):0;
//if($new_record[$key] != $record[$key]) $new_record[$key] = $field['default'];
//if($key == 'refresh') die($record[$key]);
break;
case 'DOUBLE':
- $new_record[$key] = mysql_real_escape_string($record[$key]);
+ $new_record[$key] = $record[$key];
break;
case 'CURRENCY':
$new_record[$key] = str_replace(",",".",$record[$key]);
+ break;
+
+ case 'DATETIME':
+ if (is_array($record[$key]))
+ {
+ $filtered_values = array_map(create_function('$item','return (int)$item;'), $record[$key]);
+ extract($filtered_values, EXTR_PREFIX_ALL, '_dt');
+
+ if ($_dt_day != 0 && $_dt_month != 0 && $_dt_year != 0) {
+ $new_record[$key] = date( 'Y-m-d H:i:s', mktime($_dt_hour, $_dt_minute, $_dt_second, $_dt_month, $_dt_day, $_dt_year) );
+ }
+ }
break;
}
@@ -334,11 +385,53 @@
$this->errorMessage .= $errmsg."\r\n";
}
}
-
-
+
+ //* Add slashes to all records, when we encode data which shall be inserted into mysql.
+ if($dbencode == true) $new_record[$key] = $app->db->quote($new_record[$key]);
}
}
return $new_record;
+ }
+
+ /**
+ * process the filters for a given field.
+ *
+ * @param field_name = Name of the field
+ * @param field_value = value of the field
+ * @param filters = Array of filters
+ * @param filter_event = 'SAVE'or 'SHOW'
+ * @return record
+ */
+
+ function filterField($field_name, $field_value, $filters, $filter_event) {
+
+ global $app;
+ $returnval = $field_value;
+
+ //* Loop trough all filters
+ foreach($filters as $filter) {
+ if($filter['event'] == $filter_event) {
+ switch ($filter['type']) {
+ case 'TOLOWER':
+ $returnval = strtolower($field_value);
+ break;
+ case 'TOUPPER':
+ $returnval = strtoupper($field_value);
+ break;
+ case 'IDNTOASCII':
+ $returnval = $app->functions->idn_encode($field_value);
+ break;
+ case 'IDNTOUTF8':
+ $returnval = $app->functions->idn_decode($field_value);
+ break;
+ default:
+ $this->errorMessage .= "Unknown Filter: ".$filter['type'];
+ break;
+ }
+ }
+ }
+
+ return $returnval;
}
/**
@@ -365,21 +458,21 @@
if(!preg_match($validator['regex'], $field_value)) {
$errmsg = $validator['errmsg'];
if(isset($this->wordbook[$errmsg])) {
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
} else {
- $this->errorMessage .= $errmsg."<br>\r\n";
+ $this->errorMessage .= $errmsg."<br />\r\n";
}
}
break;
case 'UNIQUE':
- if($this->action == 'INSERT') {
+ if($this->action == 'NEW') {
$num_rec = $app->db->queryOneRecord("SELECT count(*) as number FROM ".$escape.$this->formDef['db_table'].$escape. " WHERE $field_name = '".$app->db->quote($field_value)."'");
if($num_rec["number"] > 0) {
$errmsg = $validator['errmsg'];
if(isset($this->wordbook[$errmsg])) {
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
} else {
- $this->errorMessage .= $errmsg."<br>\r\n";
+ $this->errorMessage .= $errmsg."<br />\r\n";
}
}
} else {
@@ -387,9 +480,9 @@
if($num_rec["number"] > 0) {
$errmsg = $validator['errmsg'];
if(isset($this->wordbook[$errmsg])) {
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
} else {
- $this->errorMessage .= $errmsg."<br>\r\n";
+ $this->errorMessage .= $errmsg."<br />\r\n";
}
}
}
@@ -398,42 +491,133 @@
if(empty($field_value)) {
$errmsg = $validator['errmsg'];
if(isset($this->wordbook[$errmsg])) {
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
} else {
- $this->errorMessage .= $errmsg."<br>\r\n";
+ $this->errorMessage .= $errmsg."<br />\r\n";
}
}
break;
case 'ISEMAIL':
- if(!preg_match("/^\w+[\w.-]*\w+@\w+[\w.-]*\w+\.[a-z]{2,10}$/i", $field_value)) {
+ if(function_exists('filter_var')) {
+ if(filter_var($field_value, FILTER_VALIDATE_EMAIL) === false) {
+ $errmsg = $validator['errmsg'];
+ if(isset($this->wordbook[$errmsg])) {
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
+ } else {
+ $this->errorMessage .= $errmsg."<br />\r\n";
+ }
+ }
+ } else {
+ if(!preg_match("/^\w+[\w\.\-\+]*\w{0,}@\w+[\w.-]*\w+\.[a-zA-Z0-9\-]{2,30}$/i", $field_value)) {
$errmsg = $validator['errmsg'];
if(isset($this->wordbook[$errmsg])) {
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
} else {
- $this->errorMessage .= $errmsg."<br>\r\n";
+ $this->errorMessage .= $errmsg."<br />\r\n";
}
}
+ }
break;
case 'ISINT':
- $tmpval = intval($field_value);
+ if(function_exists('filter_var')) {
+ if($field_value != '' && filter_var($field_value, FILTER_VALIDATE_INT) === false) {
+ $errmsg = $validator['errmsg'];
+ if(isset($this->wordbook[$errmsg])) {
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
+ } else {
+ $this->errorMessage .= $errmsg."<br />\r\n";
+ }
+ }
+ } else {
+ $tmpval = $app->functions->intval($field_value);
if($tmpval === 0 and !empty($field_value)) {
$errmsg = $validator['errmsg'];
if(isset($this->wordbook[$errmsg])) {
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
} else {
- $this->errorMessage .= $errmsg."<br>\r\n";
+ $this->errorMessage .= $errmsg."<br />\r\n";
}
}
+ }
break;
case 'ISPOSITIVE':
if(!is_numeric($field_value) || $field_value <= 0){
$errmsg = $validator['errmsg'];
if(isset($this->wordbook[$errmsg])) {
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
} else {
- $this->errorMessage .= $errmsg."<br>\r\n";
+ $this->errorMessage .= $errmsg."<br />\r\n";
}
}
+ break;
+ case 'ISIPV4':
+ $vip=1;
+ if(preg_match("/^[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}$/", $field_value)){
+ $groups=explode(".",$field_value);
+ foreach($groups as $group){
+ if($group<0 OR $group>255)
+ $vip=0;
+ }
+ }else{$vip=0;}
+ if($vip==0) {
+ $errmsg = $validator['errmsg'];
+ if(isset($this->wordbook[$errmsg])) {
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
+ } else {
+ $this->errorMessage .= $errmsg."<br />\r\n";
+ }
+ }
+ break;
+ case 'ISIP':
+ //* Check if its a IPv4 or IPv6 address
+ if(function_exists('filter_var')) {
+ if(!filter_var($field_value,FILTER_VALIDATE_IP)) {
+ $errmsg = $validator['errmsg'];
+ if(isset($this->wordbook[$errmsg])) {
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
+ } else {
+ $this->errorMessage .= $errmsg."<br />\r\n";
+ }
+ }
+ } else {
+ //* Check content with regex, if we use php < 5.2
+ $ip_ok = 0;
+ if(preg_match("/^(\:\:([a-f0-9]{1,4}\:){0,6}?[a-f0-9]{0,4}|[a-f0-9]{1,4}(\:[a-f0-9]{1,4}){0,6}?\:\:|[a-f0-9]{1,4}(\:[a-f0-9]{1,4}){1,6}?\:\:([a-f0-9]{1,4}\:){1,6}?[a-f0-9]{1,4})(\/\d{1,3})?$/i", $field_value)){
+ $ip_ok = 1;
+ }
+ if(preg_match("/^[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}$/", $field_value)){
+ $ip_ok = 1;
+ }
+ if($ip_ok == 0) {
+ $errmsg = $validator['errmsg'];
+ if(isset($this->wordbook[$errmsg])) {
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
+ } else {
+ $this->errorMessage .= $errmsg."<br />\r\n";
+ }
+ }
+ }
+ break;
+ case 'RANGE':
+ //* Checks if the value is within the given range or above / below a value
+ //* Range examples: < 10 = ":10", between 2 and 10 = "2:10", above 5 = "5:".
+ $range_parts = explode(':',trim($validator['range']));
+ $ok = true;
+ if($range_parts[0] != '' && $field_value < $range_parts[0]) {
+ $ok = false;
+ }
+ if($range_parts[1] != '' && $field_value > $range_parts[1]) {
+ $ok = false;
+ }
+ if($ok != true) {
+ $errmsg = $validator['errmsg'];
+ if(isset($this->wordbook[$errmsg])) {
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
+ } else {
+ $this->errorMessage .= $errmsg."<br />\r\n";
+ }
+ }
+ unset($range_parts);
break;
case 'CUSTOM':
// Calls a custom class to validate this record
@@ -443,7 +627,7 @@
$app->uses($validator_class);
$this->errorMessage .= $app->$validator_class->$validator_function($field_name, $field_value, $validator);
} else {
- $this->errorMessage .= "Custom validator class or function is empty<br>\r\n";
+ $this->errorMessage .= "Custom validator class or function is empty<br />\r\n";
}
break;
default:
@@ -472,14 +656,14 @@
$this->action = $action;
$this->primary_id = $primary_id;
- $record = $this->encode($record,$tab);
+ $record = $this->encode($record,true);
$sql_insert_key = '';
$sql_insert_val = '';
$sql_update = '';
- if(!is_array($this->formDef)) $app->error("No form definition found.");
+ if(!is_array($this->formDef)) $app->error("Form definition not found.");
- // gehe durch alle Felder des Tabs
+ // go trough all fields of the tab
if(is_array($record)) {
foreach($this->formDef['fields'] as $key => $field) {
// Wenn es kein leeres Passwortfeld ist
@@ -489,17 +673,17 @@
if($field['formtype'] == 'PASSWORD') {
$sql_insert_key .= "`$key`, ";
if($field['encryption'] == 'CRYPT') {
- $salt="$1$";
- for ($n=0;$n<8;$n++) {
- $salt.=chr(mt_rand(64,126));
- }
- $salt.="$";
- // $salt = substr(md5(time()),0,2);
- $record[$key] = crypt($record[$key],$salt);
+ $record[$key] = $app->auth->crypt_password(stripslashes($record[$key]));
+ $sql_insert_val .= "'".$app->db->quote($record[$key])."', ";
+ } elseif ($field['encryption'] == 'MYSQL') {
+ $sql_insert_val .= "PASSWORD('".$app->db->quote($record[$key])."'), ";
+ } elseif ($field['encryption'] == 'CLEARTEXT') {
+ $sql_insert_val .= "'".$app->db->quote($record[$key])."', ";
} else {
- $record[$key] = md5($record[$key]);
+ $record[$key] = md5(stripslashes($record[$key]));
+ $sql_insert_val .= "'".$app->db->quote($record[$key])."', ";
}
- $sql_insert_val .= "'".$record[$key]."', ";
+
} elseif ($field['formtype'] == 'CHECKBOX') {
$sql_insert_key .= "`$key`, ";
if($record[$key] == '') {
@@ -515,18 +699,18 @@
}
} else {
if($field['formtype'] == 'PASSWORD') {
- if($field['encryption'] == 'CRYPT') {
- $salt="$1$";
- for ($n=0;$n<8;$n++) {
- $salt.=chr(mt_rand(64,126));
- }
- $salt.="$";
- // $salt = substr(md5(time()),0,2);
- $record[$key] = crypt($record[$key],$salt);
+ if(isset($field['encryption']) && $field['encryption'] == 'CRYPT') {
+ $record[$key] = $app->auth->crypt_password(stripslashes($record[$key]));
+ $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', ";
+ } elseif (isset($field['encryption']) && $field['encryption'] == 'MYSQL') {
+ $sql_update .= "`$key` = PASSWORD('".$app->db->quote($record[$key])."'), ";
+ } elseif (isset($field['encryption']) && $field['encryption'] == 'CLEARTEXT') {
+ $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', ";
} else {
- $record[$key] = md5($record[$key]);
+ $record[$key] = md5(stripslashes($record[$key]));
+ $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', ";
}
- $sql_update .= "`$key` = '".$record[$key]."', ";
+
} elseif ($field['formtype'] == 'CHECKBOX') {
if($record[$key] == '') {
// if a checkbox is not set, we set it to the unchecked value
@@ -548,7 +732,7 @@
}
-
+ // Add backticks for incomplete table names
if(stristr($this->formDef['db_table'],'.')) {
$escape = '';
} else {
@@ -558,7 +742,7 @@
if($action == "INSERT") {
if($this->formDef['auth'] == 'yes') {
- // Setze User und Gruppe
+ // Set user and group
$sql_insert_key .= "`sys_userid`, ";
$sql_insert_val .= ($this->formDef["auth_preset"]["userid"] > 0)?"'".$this->formDef["auth_preset"]["userid"]."', ":"'".$this->sys_userid."', ";
$sql_insert_key .= "`sys_groupid`, ";
@@ -575,7 +759,12 @@
$sql = "INSERT INTO ".$escape.$this->formDef['db_table'].$escape." ($sql_insert_key) VALUES ($sql_insert_val)";
} else {
if($primary_id != 0) {
- $sql_update = substr($sql_update,0,-2);
+ // update client permissions only if client_id > 0
+ if($this->formDef['auth'] == 'yes' && $this->client_id > 0) {
+ $sql_update .= '`sys_userid` = '.$this->sys_userid.', ';
+ $sql_update .= '`sys_groupid` = '.$this->sys_default_group.', ';
+ }
+ $sql_update = substr($sql_update,0,-2);
$sql = "UPDATE ".$escape.$this->formDef['db_table'].$escape." SET ".$sql_update." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id;
if($sql_ext_where != '') $sql .= " and ".$sql_ext_where;
} else {
@@ -610,7 +799,11 @@
foreach($primary_id as $key => $val) {
$key = $app->db->quote($key);
$val = $app->db->quote($val);
- $sql_where .= "$key = '$val' AND ";
+ if(stristr($val,'%')) {
+ $sql_where .= "$key like '$val' AND ";
+ } else {
+ $sql_where .= "$key = '$val' AND ";
+ }
}
$sql_where = substr($sql_where,0,-5);
$sql = "SELECT * FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$sql_where;
@@ -624,42 +817,68 @@
}
function ispconfig_sysuser_add($params,$insert_id){
- global $app,$sql1;
+ global $conf,$app,$sql1;
$username = $app->db->quote($params["username"]);
$password = $app->db->quote($params["password"]);
- $modules = 'mail,sites,dns,tools';
- $startmodule = 'mail';
+ if(!isset($params['modules'])) {
+ $modules = $conf['interface_modules_enabled'];
+ } else {
+ $modules = $app->db->quote($params['modules']);
+ }
+ if(isset($params['limit_client']) && $params['limit_client'] > 0) {
+ $modules .= ',client';
+ }
+
+ if(!isset($params['startmodule'])) {
+ $startmodule = 'dashboard';
+ } else {
+ $startmodule = $app->db->quote($params["startmodule"]);
+ if(!preg_match('/'.$startmodule.'/',$modules)) {
+ $_modules = explode(',',$modules);
+ $startmodule=$_modules[0];
+ }
+ }
$usertheme = $app->db->quote($params["usertheme"]);
$type = 'user';
$active = 1;
- $insert_id = intval($insert_id);
+ $insert_id = $app->functions->intval($insert_id);
$language = $app->db->quote($params["language"]);
$groupid = $app->db->datalogInsert('sys_group', "(name,description,client_id) VALUES ('$username','','$insert_id')", 'groupid');
$groups = $groupid;
+ $password = $app->auth->crypt_password(stripslashes($password));
$sql1 = "INSERT INTO sys_user (username,passwort,modules,startmodule,app_theme,typ,active,language,groups,default_group,client_id)
- VALUES ('$username',md5('$password'),'$modules','$startmodule','$usertheme','$type','$active','$language',$groups,$groupid,$insert_id)";
+ VALUES ('$username','$password','$modules','$startmodule','$usertheme','$type','$active','$language',$groups,$groupid,$insert_id)";
$app->db->query($sql1);
}
function ispconfig_sysuser_update($params,$client_id){
global $app;
$username = $app->db->quote($params["username"]);
- $password = $app->db->quote($params["password"]);
- $client_id = intval($client_id);
- $sql = "UPDATE sys_user set username = '$username', passwort = md5('$password') WHERE client_id = $client_id";
+ $clear_password = $app->db->quote($params["password"]);
+ $client_id = $app->functions->intval($client_id);
+ $password = $app->auth->crypt_password(stripslashes($clear_password));
+ if ($clear_password) $pwstring = ", passwort = '$password'"; else $pwstring ="" ;
+ $sql = "UPDATE sys_user set username = '$username' $pwstring WHERE client_id = $client_id";
$app->db->query($sql);
}
function ispconfig_sysuser_delete($client_id){
global $app;
- $client_id = intval($client_id);
+ $client_id = $app->functions->intval($client_id);
$sql = "DELETE FROM sys_user WHERE client_id = $client_id";
+ $app->db->query($sql);
+ $sql = "DELETE FROM sys_group WHERE client_id = $client_id";
$app->db->query($sql);
}
function datalogSave($action,$primary_id, $record_old, $record_new) {
global $app,$conf;
-
+
+ $app->db->datalogSave($this->formDef['db_table'], $action, $this->formDef['db_table_idx'], $primary_id, $record_old, $record_new);
+ return true;
+
+ /*
+ // Add backticks for incomplete table names.
if(stristr($this->formDef['db_table'],'.')) {
$escape = '';
} else {
@@ -715,11 +934,6 @@
}
}
- /*
- echo "<pre>";
- print_r($diffrec_full);
- echo "</pre>";
- */
// Insert the server_id, if the record has a server_id
$server_id = (isset($record_old["server_id"]) && $record_old["server_id"] > 0)?$record_old["server_id"]:0;
@@ -739,6 +953,7 @@
}
return true;
+ */
}
--
Gitblit v1.9.1