From fe9a23f542bc56c1c0b6dc30257418e38ff7bd3a Mon Sep 17 00:00:00 2001
From: ftimme <ft@falkotimme.com>
Date: Sat, 08 Jun 2013 18:57:40 -0400
Subject: [PATCH] - Fixed FS#2936 - Please check and limit username input length.
---
interface/web/dns/dns_slave_edit.php | 61 ++++++++++++++++++++----------
1 files changed, 40 insertions(+), 21 deletions(-)
diff --git a/interface/web/dns/dns_slave_edit.php b/interface/web/dns/dns_slave_edit.php
index 9ffbf83..2a5247a 100644
--- a/interface/web/dns/dns_slave_edit.php
+++ b/interface/web/dns/dns_slave_edit.php
@@ -72,15 +72,15 @@
// If user is admin, we will allow him to select to whom this record belongs
if($_SESSION["s"]["user"]["typ"] == 'admin') {
// Getting Domains of the user
- $sql = "SELECT groupid, name FROM sys_group WHERE client_id > 0 ORDER by name";
+ $sql = "SELECT sys_group.groupid, sys_group.name, CONCAT(client.company_name,' :: ',client.contact_name) as contactname FROM sys_group, client WHERE sys_group.client_id = client.client_id AND sys_group.client_id > 0 ORDER BY sys_group.name";
$clients = $app->db->queryAllRecords($sql);
$client_select = '';
if($_SESSION["s"]["user"]["typ"] == 'admin') $client_select .= "<option value='0'></option>";
- $tmp_data_record = $app->tform->getDataRecord($this->id);
+ //$tmp_data_record = $app->tform->getDataRecord($this->id);
if(is_array($clients)) {
foreach( $clients as $client) {
- $selected = ($client["groupid"] == @$tmp_data_record["sys_groupid"])?'SELECTED':'';
- $client_select .= "<option value='$client[groupid]' $selected>$client[name]</option>\r\n";
+ $selected = @(is_array($this->dataRecord) && ($client["groupid"] == $this->dataRecord['client_group_id'] || $client["groupid"] == $this->dataRecord['sys_groupid']))?'SELECTED':'';
+ $client_select .= "<option value='$client[groupid]' $selected>$client[name] :: $client[contactname]</option>\r\n";
}
}
$app->tpl->setVar("client_group_id",$client_select);
@@ -88,22 +88,30 @@
// Get the limits of the client
$client_group_id = $_SESSION["s"]["user"]["default_group"];
- $client = $app->db->queryOneRecord("SELECT client.client_id, client.contact_name FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
+ $client = $app->db->queryOneRecord("SELECT client.client_id, sys_group.name, client.contact_name, CONCAT(client.company_name,' :: ',client.contact_name) as contactname FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
// Fill the client select field
- $sql = "SELECT groupid, name FROM sys_group, client WHERE sys_group.client_id = client.client_id AND client.parent_client_id = ".$client['client_id']." ORDER BY name";
+ $sql = "SELECT sys_group.groupid, sys_group.name, CONCAT(client.company_name,' :: ',client.contact_name) as contactname FROM sys_group, client WHERE sys_group.client_id = client.client_id AND client.parent_client_id = ".$client['client_id']." ORDER BY sys_group.name";
$clients = $app->db->queryAllRecords($sql);
$tmp = $app->db->queryOneRecord("SELECT groupid FROM sys_group WHERE client_id = ".$client['client_id']);
- $client_select = '<option value="'.$tmp['groupid'].'">'.$client['contact_name'].'</option>';
- $tmp_data_record = $app->tform->getDataRecord($this->id);
+ $client_select = '<option value="'.$tmp['groupid'].'">'.$client['name'].' :: '.$client['contactname'].'</option>';
+ //$tmp_data_record = $app->tform->getDataRecord($this->id);
if(is_array($clients)) {
foreach( $clients as $client) {
- $selected = @($client["groupid"] == $tmp_data_record["sys_groupid"])?'SELECTED':'';
- $client_select .= "<option value='$client[groupid]' $selected>$client[name]</option>\r\n";
+ $selected = @(is_array($this->dataRecord) && ($client["groupid"] == $this->dataRecord['client_group_id'] || $client["groupid"] == $this->dataRecord['sys_groupid']))?'SELECTED':'';
+ $client_select .= "<option value='$client[groupid]' $selected>$client[name] :: $client[contactname]</option>\r\n";
}
}
$app->tpl->setVar("client_group_id",$client_select);
+ }
+
+ if($this->id > 0) {
+ //* we are editing a existing record
+ $app->tpl->setVar("edit_disabled", 1);
+ $app->tpl->setVar("server_id_value", $this->dataRecord["server_id"]);
+ } else {
+ $app->tpl->setVar("edit_disabled", 0);
}
parent::onShowEnd();
@@ -120,7 +128,7 @@
// When the record is updated
if($this->id > 0) {
// restore the server ID if the user is not admin and record is edited
- $tmp = $app->db->queryOneRecord("SELECT server_id FROM dns_slave WHERE id = ".intval($this->id));
+ $tmp = $app->db->queryOneRecord("SELECT server_id FROM dns_slave WHERE id = ".$app->functions->intval($this->id));
$this->dataRecord["server_id"] = $tmp["server_id"];
unset($tmp);
// When the record is inserted
@@ -129,11 +137,11 @@
$this->dataRecord["server_id"] = $client["default_dnsserver"];
// Check if the user may add anoter secondary domain.
- if($client["limit_slave_dns_zone"] >= 0) {
- $tmp = $app->db->queryOneRecord("SELECT count(id) as number FROM dns_slave WHERE sys_groupid = $client_group_id");
- if($tmp["number"] >= $client["limit_dns_slave_zone"]) {
- $app->error($app->tform->wordbook["limit_dns_slave_zone_txt"]);
- }
+ if(!$app->tform->checkClientLimit('limit_dns_slave_zone')) {
+ $app->error($app->tform->wordbook["limit_dns_slave_zone_txt"]);
+ }
+ if(!$app->tform->checkResellerLimit('limit_dns_slave_zone')) {
+ $app->error('Reseller: '.$app->tform->wordbook["limit_dns_slave_zone_txt"]);
}
}
}
@@ -150,16 +158,27 @@
parent::onSubmit();
}
+ function onInsert() {
+ global $app, $conf;
+
+ // Check if record is existing already
+ $duplicate_slave = $app->db->queryOneRecord("SELECT * FROM dns_slave WHERE origin = '".$this->dataRecord["origin"]."' AND server_id = ".$app->functions->intval($this->dataRecord["server_id"])." AND ".$app->tform->getAuthSQL('r'));
+
+ if(is_array($duplicate_slave) && !empty($duplicate_slave)) $app->error($app->tform->wordbook["origin_error_unique"]);
+
+ parent::onInsert();
+ }
+
function onAfterInsert() {
global $app, $conf;
// make sure that the record belongs to the client group and not the admin group when a dmin inserts it
if($_SESSION["s"]["user"]["typ"] == 'admin' && isset($this->dataRecord["client_group_id"])) {
- $client_group_id = intval($this->dataRecord["client_group_id"]);
+ $client_group_id = $app->functions->intval($this->dataRecord["client_group_id"]);
$app->db->query("UPDATE dns_slave SET sys_groupid = $client_group_id WHERE id = ".$this->id);
}
if($app->auth->has_clients($_SESSION['s']['user']['userid']) && isset($this->dataRecord["client_group_id"])) {
- $client_group_id = intval($this->dataRecord["client_group_id"]);
+ $client_group_id = $app->functions->intval($this->dataRecord["client_group_id"]);
$app->db->query("UPDATE dns_slave SET sys_groupid = $client_group_id WHERE id = ".$this->id);
}
@@ -172,17 +191,17 @@
// make sure that the record belongs to the client group and not the admin group when a dmin inserts it
if($_SESSION["s"]["user"]["typ"] == 'admin' && isset($this->dataRecord["client_group_id"])) {
- $client_group_id = intval($this->dataRecord["client_group_id"]);
+ $client_group_id = $app->functions->intval($this->dataRecord["client_group_id"]);
$app->db->query("UPDATE dns_slave SET sys_groupid = $client_group_id WHERE id = ".$this->id);
}
if($app->auth->has_clients($_SESSION['s']['user']['userid']) && isset($this->dataRecord["client_group_id"])) {
- $client_group_id = intval($this->dataRecord["client_group_id"]);
+ $client_group_id = $app->functions->intval($this->dataRecord["client_group_id"]);
$app->db->query("UPDATE dns_slave SET sys_groupid = $client_group_id WHERE id = ".$this->id);
}
//** When the client group has changed, change also the owner of the record if the owner is not the admin user
if($this->oldDataRecord["client_group_id"] != $this->dataRecord["client_group_id"] && $this->dataRecord["sys_userid"] != 1) {
- $client_group_id = intval($this->dataRecord["client_group_id"]);
+ $client_group_id = $app->functions->intval($this->dataRecord["client_group_id"]);
$tmp = $app->db->queryOneREcord("SELECT userid FROM sys_user WHERE default_group = ".$client_group_id);
if($tmp["userid"] > 0) {
$app->db->query("UPDATE dns_slave SET sys_userid = ".$tmp["userid"]." WHERE id = ".$this->id);
--
Gitblit v1.9.1