From 80e7b0d7d17b0e9581fa56be484b8772d82261de Mon Sep 17 00:00:00 2001
From: tbrehm <t.brehm@ispconfig.org>
Date: Wed, 18 Nov 2009 11:19:42 -0500
Subject: [PATCH] Added code to delete old remote sessions.
---
interface/lib/classes/tform.inc.php | 639 +++++++++++++++++++++++++++++++++++++++++++---------------
1 files changed, 474 insertions(+), 165 deletions(-)
diff --git a/interface/lib/classes/tform.inc.php b/interface/lib/classes/tform.inc.php
index bdcbaed..04104de 100644
--- a/interface/lib/classes/tform.inc.php
+++ b/interface/lib/classes/tform.inc.php
@@ -1,7 +1,7 @@
<?php
/*
-Copyright (c) 2005, Till Brehm, projektfarm Gmbh
+Copyright (c) 2007, Till Brehm, projektfarm Gmbh
All rights reserved.
Redistribution and use in source and binary forms, with or without modification,
@@ -31,43 +31,37 @@
/**
* Formularbehandlung
*
-* Funktionen zur Umwandlung von Formulardaten
-* sowie zum vorbereiten von HTML und SQL
-* Ausgaben
+* Functions to validate, display and save form values
*
-* Tabellendefinition
+* Database table field definitions
*
-* Datentypen:
-* - INTEGER (Wandelt Ausdr�cke in Int um)
+* Datatypes:
+* - INTEGER (Converts data to int automatically)
* - DOUBLE
-* - CURRENCY (Formatiert Zahlen nach W�hrungsnotation)
-* - VARCHAR (kein weiterer Format Check)
-* - DATE (Datumsformat, Timestamp Umwandlung)
+* - CURRENCY (Formats digits in currency notation)
+* - VARCHAR (No format check)
+* - DATE (Date format, converts from and to linux timestamps automatically)
*
* Formtype:
-* - TEXT (normales Textfeld)
-* - PASSWORD (Feldinhalt wird nicht angezeigt)
-* - SELECT (Gibt Werte als option Feld aus)
-* - MULTIPLE (Select-Feld mit nehreren Werten)
+* - TEXT (Normal text field)
+* - PASSWORD (password field, the content will not be displayed again to the user)
+* - SELECT (Option fiield)
+* - MULTIPLE (Allows selection of multiple values)
*
* VALUE:
-* - Wert oder Array
+* - Value or array
*
* SEPARATOR
-* - Trennzeichen f�r multiple Felder
+* - separator char used for fileds with multiple values
*
-* Hinweis:
-* Das ID-Feld ist nicht bei den Table Values einzuf�gen.
+* Hint: The auto increment (ID) filed of the table has not be be definied eoarately.
*
-* @package form
-* @author Till Brehm
-* @version 1.1
*/
class tform {
/**
- * Definition der Tabelle (array)
+ * Table definition (array)
* @var tableDef
*/
var $tableDef;
@@ -79,26 +73,25 @@
var $action;
/**
- * Tabellenname (String)
+ * Table name (String)
* @var table_name
*/
var $table_name;
/**
- * Debug Variable
+ * Enable debigging
* @var debug
*/
var $debug = 0;
/**
- * name des primary Field der Tabelle (string)
+ * name of the primary field of the datbase table (string)
* @var table_index
*/
var $table_index;
/**
- * enth�lt die Fehlermeldung bei �berpr�fung
- * der Variablen mit Regex
+ * contains the error message
* @var errorMessage
*/
var $errorMessage = '';
@@ -111,9 +104,9 @@
var $diffrec = array();
/**
- * Laden der Tabellendefinition
+ * Loading of the table definition
*
- * @param file: Pfad zur Tabellendefinition
+ * @param file: path to the form definition file
* @return true
*/
/*
@@ -135,10 +128,17 @@
$this->formDef = $form;
$this->module = $module;
+ $wb = array();
+
+ include_once(ISPC_ROOT_PATH.'/lib/lang/'.$_SESSION['s']['language'].'.lng');
if($module == '') {
- include_once("lib/lang/".$_SESSION["s"]["language"]."_".$this->formDef["name"].".lng");
+ $lng_file = "lib/lang/".$_SESSION["s"]["language"]."_".$this->formDef["name"].".lng";
+ if(!file_exists($lng_file)) $lng_file = "lib/lang/en_".$this->formDef["name"].".lng";
+ include($lng_file);
} else {
- include_once("../$module/lib/lang/".$_SESSION["s"]["language"]."_".$this->formDef["name"].".lng");
+ $lng_file = "../$module/lib/lang/".$_SESSION["s"]["language"]."_".$this->formDef["name"].".lng";
+ if(!file_exists($lng_file)) $lng_file = "../$module/lib/lang/en_".$this->formDef["name"].".lng";
+ include($lng_file);
}
$this->wordbook = $wb;
@@ -147,24 +147,24 @@
/**
- * Konvertiert die Daten des �bergebenen assoziativen
- * Arrays in "menschenlesbare" Form.
- * Datentyp Konvertierung, z.B. f�r Ausgabe in Listen.
+ * Converts the data in the array to human readable format
+ * Datatype conversion e.g. to show the data in lists
*
* @param record
* @return record
*/
function decode($record,$tab) {
- if(!is_array($this->formDef['tabs'][$tab])) $app->error("Tab ist leer oder existiert nicht (TAB: $tab).");
- if(is_array($record)) {
+ if(!is_array($this->formDef['tabs'][$tab])) $app->error("Tab does not exist or the tab is empty (TAB: $tab).");
+ $new_record = '';
+ if(is_array($record)) {
foreach($this->formDef['tabs'][$tab]['fields'] as $key => $field) {
switch ($field['datatype']) {
case 'VARCHAR':
- $new_record[$key] = stripslashes($record[$key]);
+ $new_record[$key] = $record[$key];
break;
case 'TEXT':
- $new_record[$key] = stripslashes($record[$key]);
+ $new_record[$key] = $record[$key];
break;
case 'DATE':
@@ -186,11 +186,12 @@
break;
default:
- $new_record[$key] = stripslashes($record[$key]);
+ $new_record[$key] = $record[$key];
}
}
}
+
return $new_record;
}
@@ -216,7 +217,11 @@
$querystring = str_replace("{GROUPID}",$_SESSION["s"]["user"]["default_group"],$querystring);
$querystring = str_replace("{GROUPS}",$_SESSION["s"]["user"]["groups"],$querystring);
$table_idx = $this->formDef['db_table_idx'];
- $querystring = str_replace("{RECORDID}",$record[$table_idx],$querystring);
+
+ $tmp_recordid = (isset($record[$table_idx]))?$record[$table_idx]:0;
+ $querystring = str_replace("{RECORDID}",$tmp_recordid,$querystring);
+ unset($tmp_recordid);
+
$querystring = str_replace("{AUTHSQL}",$this->getAuthSQL('r'),$querystring);
// Getting the records
@@ -240,17 +245,83 @@
$app->uses($datasource_class);
$values = $app->$datasource_class->$datasource_function($field, $record);
} else {
- $this->errorMessage .= "Custom datasource class or function is empty<br>\r\n";
+ $this->errorMessage .= "Custom datasource class or function is empty<br />\r\n";
}
}
return $values;
}
+
+ //* If the parameter 'valuelimit' is set
+ function applyValueLimit($limit,$values) {
+
+ global $app;
+
+ $limit_parts = explode(':',$limit);
+
+ //* values are limited to a comma separated list
+ if($limit_parts[0] == 'list') {
+ $allowed = explode(',',$limit_parts[1]);
+ }
+
+ //* values are limited to a field in the client settings
+ if($limit_parts[0] == 'client') {
+ if($_SESSION["s"]["user"]["typ"] == 'admin') {
+ return $values;
+ } else {
+ $client_group_id = $_SESSION["s"]["user"]["default_group"];
+ $client = $app->db->queryOneRecord("SELECT ".$limit_parts[1]." as lm FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
+ $allowed = explode(',',$client['lm']);
+ }
+ }
+
+ //* values are limited to a field in the reseller settings
+ if($limit_parts[0] == 'reseller') {
+ if($_SESSION["s"]["user"]["typ"] == 'admin') {
+ return $values;
+ } else {
+ //* Get the limits of the client that is currently logged in
+ $client_group_id = $_SESSION["s"]["user"]["default_group"];
+ $client = $app->db->queryOneRecord("SELECT parent_client_id FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
+ //echo "SELECT parent_client_id FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id";
+ //* If the client belongs to a reseller, we will check against the reseller Limit too
+ if($client['parent_client_id'] != 0) {
+
+ //* first we need to know the groups of this reseller
+ $tmp = $app->db->queryOneRecord("SELECT userid, groups FROM sys_user WHERE client_id = ".$client['parent_client_id']);
+ $reseller_groups = $tmp["groups"];
+ $reseller_userid = $tmp["userid"];
+
+ // Get the limits of the reseller of the logged in client
+ $client_group_id = $_SESSION["s"]["user"]["default_group"];
+ $reseller = $app->db->queryOneRecord("SELECT ".$limit_parts[1]." as lm FROM client WHERE client_id = ".$client['parent_client_id']);
+ $allowed = explode(',',$reseller['lm']);
+ } else {
+ return $values;
+ }
+ } // end if admin
+ } // end if reseller
+
+ //* values are limited to a field in the system settings
+ if($limit_parts[0] == 'system') {
+ $app->uses('getconf');
+ $tmp_conf = $app->getconf->get_global_config($limit_parts[1]);
+ $tmp_key = $limit_parts[2];
+ $allowed = $tmp_conf[$tmp_key];
+ }
+
+ $values_new = array();
+ foreach($values as $key => $val) {
+ if(in_array($key,$allowed)) $values_new[$key] = $val;
+ }
+
+ return $values_new;
+ }
/**
- * Record f�r Ausgabe in Formularen vorbereiten.
+ * Prepare the data record to show the data in a form.
*
* @param record = Datensatz als Array
* @param action = NEW oder EDIT
@@ -262,8 +333,8 @@
$this->action = $action;
- if(!is_array($this->formDef)) $app->error("Keine Formdefinition vorhanden.");
- if(!is_array($this->formDef['tabs'][$tab])) $app->error("Tab ist leer oder existiert nicht (TAB: $tab).");
+ if(!is_array($this->formDef)) $app->error("No form definition found.");
+ if(!is_array($this->formDef['tabs'][$tab])) $app->error("The tab is empty or does not exist (TAB: $tab).");
$new_record = array();
if($action == 'EDIT') {
@@ -273,14 +344,19 @@
$val = $record[$key];
// If Datasource is set, get the data from there
- if(is_array($field['datasource'])) {
+ if(isset($field['datasource']) && is_array($field['datasource'])) {
$field["value"] = $this->getDatasourceData($field, $record);
}
+
+ // If a limitation for the values is set
+ if(isset($field['valuelimit']) && is_array($field["value"])) {
+ $field["value"] = $this->applyValueLimit($field['valuelimit'],$field["value"]);
+ }
switch ($field['formtype']) {
case 'SELECT':
+ $out = '';
if(is_array($field['value'])) {
- $out = '';
foreach($field['value'] as $k => $v) {
$selected = ($k == $val)?' SELECTED':'';
$out .= "<option value='$k'$selected>$v</option>\r\n";
@@ -291,10 +367,10 @@
case 'MULTIPLE':
if(is_array($field['value'])) {
- // aufsplitten ergebnisse
+ // Split
$vals = explode($field['separator'],$val);
- // HTML schreiben
+ // write HTML
$out = '';
foreach($field['value'] as $k => $v) {
@@ -315,7 +391,7 @@
case 'CHECKBOX':
$checked = ($val == $field['value'][1])?' CHECKED':'';
- $new_record[$key] = "<input name=\"".$key."\" type=\"checkbox\" value=\"".$field['value'][1]."\" $checked>\r\n";
+ $new_record[$key] = "<input name=\"".$key."\" id=\"".$key."\" value=\"".$field['value'][1]."\" type=\"checkbox\" $checked />\r\n";
break;
case 'CHECKBOXARRAY':
@@ -332,8 +408,8 @@
foreach($vals as $tvl) {
if(trim($tvl) == trim($k)) $checked = ' CHECKED';
}
-
- $out .= "<input name=\"".$key."[]\" type=\"checkbox\" value=\"$k\" $checked>$v <br />\r\n";
+ // $out .= "<label for=\"".$key."[]\" class=\"inlineLabel\"><input name=\"".$key."[]\" id=\"".$key."[]\" value=\"$k\" type=\"checkbox\" $checked /> $v</label>\r\n";
+ $out .= "<input name=\"".$key."[]\" id=\"".$key."[]\" value=\"$k\" type=\"checkbox\" $checked /> $v \r\n";
}
}
$new_record[$key] = $out;
@@ -346,7 +422,8 @@
$out = '';
foreach($field['value'] as $k => $v) {
$checked = ($k == $val)?' CHECKED':'';
- $out .= "<input name='".$key."[]' type='radio' value='$k'$checked> $v<br>\r\n";
+ //$out .= "<label for=\"".$key."[]\" class=\"inlineLabel\"><input name=\"".$key."[]\" id=\"".$key."[]\" value=\"$k\" type=\"radio\" $checked/> $v</label>\r\n";
+ $out .= "<input name=\"".$key."[]\" id=\"".$key."[]\" value=\"$k\" type=\"radio\" $checked/> $v\r\n";
}
}
$new_record[$key] = $out;
@@ -362,20 +439,26 @@
foreach($this->formDef['tabs'][$tab]['fields'] as $key => $field) {
// If Datasource is set, get the data from there
- if(is_array($field['datasource'])) {
- $field["value"] = $this->getDatasourceData($field, $record);
+ if(@is_array($field['datasource'])) {
+ $field["value"] = $this->getDatasourceData($field, $record);
}
+
+ // If a limitation for the values is set
+ if(isset($field['valuelimit']) && is_array($field["value"])) {
+ $field["value"] = $this->applyValueLimit($field['valuelimit'],$field["value"]);
+ }
switch ($field['formtype']) {
case 'SELECT':
if(is_array($field['value'])) {
$out = '';
foreach($field['value'] as $k => $v) {
- $selected = ($k == $val)?' SELECTED':'';
- $out .= "<option value='$k'$selected>$v</option>\r\n";
+ //$selected = ($k == $val)?' SELECTED':'';
+ $selected = '';
+ $out .= "<option value='$k'$selected>$v</option>\r\n";
}
}
- $new_record[$key] = $out;
+ if(isset($out)) $new_record[$key] = $out;
break;
case 'MULTIPLE':
if(is_array($field['value'])) {
@@ -399,8 +482,8 @@
case 'CHECKBOX':
// $checked = (empty($field["default"]))?'':' CHECKED';
- $checked = ($field["default"] == $field['value'][1])?' CHECKED':'';
- $new_record[$key] = "<input name=\"".$key."\" type=\"checkbox\" value=\"".$field['value'][1]."\" $checked>\r\n";
+ $checked = ($field["default"] == $field['value'][1])?' CHECKED':'';
+ $new_record[$key] = "<input name=\"".$key."\" id=\"".$key."\" value=\"".$field['value'][1]."\" type=\"checkbox\" $checked />\r\n";
break;
case 'CHECKBOXARRAY':
@@ -417,8 +500,8 @@
foreach($vals as $tvl) {
if(trim($tvl) == trim($k)) $checked = ' CHECKED';
}
-
- $out .= "<input name=\"".$key."[]\" type=\"checkbox\" value=\"$k\" $checked> $v<br />\r\n";
+ // $out .= "<label for=\"".$key."[]\" class=\"inlineLabel\"><input name=\"".$key."[]\" id=\"".$key."[]\" value=\"$k\" type=\"checkbox\" $checked /> $v</label>\r\n";
+ $out .= "<input name=\"".$key."[]\" id=\"".$key."[]\" value=\"$k\" type=\"checkbox\" $checked /> $v \r\n";
}
}
$new_record[$key] = $out;
@@ -431,7 +514,8 @@
$out = '';
foreach($field['value'] as $k => $v) {
$checked = ($k == $field["default"])?' CHECKED':'';
- $out .= "<input name='".$key."[]' type='radio' value='$k'$checked> $v<br>\r\n";
+ //$out .= "<label for=\"".$key."[]\" class=\"inlineLabel\"><input name=\"".$key."[]\" id=\"".$key."[]\" value=\"$k\" type=\"radio\" $checked/> $v</label>\r\n";
+ $out .= "<input name=\"".$key."[]\" id=\"".$key."[]\" value=\"$k\" type=\"radio\" $checked/> $v\r\n";
}
}
$new_record[$key] = $out;
@@ -450,33 +534,34 @@
}
/**
- * Record in "maschinen lesbares" Format �berf�hren
- * und Werte gegen regul�re Ausdr�cke pr�fen.
+ * Rewrite the record data to be stored in the database
+ * and check values with regular expressions.
*
* @param record = Datensatz als Array
* @return record
*/
function encode($record,$tab) {
-
- if(!is_array($this->formDef['tabs'][$tab])) $app->error("Tab ist leer oder existiert nicht (TAB: $tab).");
+ global $app;
+
+ if(!is_array($this->formDef['tabs'][$tab])) $app->error("Tab is empty or does not exist (TAB: $tab).");
//$this->errorMessage = '';
if(is_array($record)) {
foreach($this->formDef['tabs'][$tab]['fields'] as $key => $field) {
- if(is_array($field['validators'])) $this->validateField($key, $record[$key], $field['validators']);
+ if(isset($field['validators']) && is_array($field['validators'])) $this->validateField($key, (isset($record[$key]))?$record[$key]:'', $field['validators']);
switch ($field['datatype']) {
case 'VARCHAR':
- if(!is_array($record[$key])) {
- $new_record[$key] = addslashes($record[$key]);
+ if(!@is_array($record[$key])) {
+ $new_record[$key] = (isset($record[$key]))?$app->db->quote($record[$key]):'';
} else {
$new_record[$key] = implode($field['separator'],$record[$key]);
}
break;
case 'TEXT':
if(!is_array($record[$key])) {
- $new_record[$key] = addslashes($record[$key]);
+ $new_record[$key] = $app->db->quote($record[$key]);
} else {
$new_record[$key] = implode($field['separator'],$record[$key]);
}
@@ -490,12 +575,12 @@
}
break;
case 'INTEGER':
- $new_record[$key] = intval($record[$key]);
+ $new_record[$key] = (isset($record[$key]))?$record[$key]:0;
//if($new_record[$key] != $record[$key]) $new_record[$key] = $field['default'];
//if($key == 'refresh') die($record[$key]);
break;
case 'DOUBLE':
- $new_record[$key] = addslashes($record[$key]);
+ $new_record[$key] = $app->db->quote($record[$key]);
break;
case 'CURRENCY':
$new_record[$key] = str_replace(",",".",$record[$key]);
@@ -503,12 +588,12 @@
}
// The use of the field value is deprecated, use validators instead
- if($field['regex'] != '') {
+ if(isset($field['regex']) && $field['regex'] != '') {
// Enable that "." matches also newlines
$field['regex'] .= 's';
if(!preg_match($field['regex'], $record[$key])) {
$errmsg = $field['errmsg'];
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
}
}
@@ -531,6 +616,8 @@
global $app;
+ $escape = '`';
+
// loop trough the validators
foreach($validators as $validator) {
@@ -539,7 +626,11 @@
$validator['regex'] .= 's';
if(!preg_match($validator['regex'], $field_value)) {
$errmsg = $validator['errmsg'];
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ if(isset($this->wordbook[$errmsg])) {
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
+ } else {
+ $this->errorMessage .= $errmsg."<br />\r\n";
+ }
}
break;
case 'UNIQUE':
@@ -548,9 +639,9 @@
if($num_rec["number"] > 0) {
$errmsg = $validator['errmsg'];
if(isset($this->wordbook[$errmsg])) {
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
} else {
- $this->errorMessage .= $errmsg."<br>\r\n";
+ $this->errorMessage .= $errmsg."<br />\r\n";
}
}
} else {
@@ -558,9 +649,9 @@
if($num_rec["number"] > 0) {
$errmsg = $validator['errmsg'];
if(isset($this->wordbook[$errmsg])) {
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
} else {
- $this->errorMessage .= $errmsg."<br>\r\n";
+ $this->errorMessage .= $errmsg."<br />\r\n";
}
}
}
@@ -569,9 +660,9 @@
if(empty($field_value)) {
$errmsg = $validator['errmsg'];
if(isset($this->wordbook[$errmsg])) {
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
} else {
- $this->errorMessage .= $errmsg."<br>\r\n";
+ $this->errorMessage .= $errmsg."<br />\r\n";
}
}
break;
@@ -579,9 +670,9 @@
if(!preg_match("/^\w+[\w.-]*\w+@\w+[\w.-]*\w+\.[a-z]{2,10}$/i", $field_value)) {
$errmsg = $validator['errmsg'];
if(isset($this->wordbook[$errmsg])) {
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
} else {
- $this->errorMessage .= $errmsg."<br>\r\n";
+ $this->errorMessage .= $errmsg."<br />\r\n";
}
}
break;
@@ -590,9 +681,9 @@
if($tmpval === 0 and !empty($field_value)) {
$errmsg = $validator['errmsg'];
if(isset($this->wordbook[$errmsg])) {
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
} else {
- $this->errorMessage .= $errmsg."<br>\r\n";
+ $this->errorMessage .= $errmsg."<br />\r\n";
}
}
break;
@@ -600,11 +691,29 @@
if(!is_numeric($field_value) || $field_value <= 0){
$errmsg = $validator['errmsg'];
if(isset($this->wordbook[$errmsg])) {
- $this->errorMessage .= $this->wordbook[$errmsg]."<br>\r\n";
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
} else {
- $this->errorMessage .= $errmsg."<br>\r\n";
+ $this->errorMessage .= $errmsg."<br />\r\n";
}
}
+ break;
+ case 'ISIPV4':
+ $vip=1;
+ if(preg_match("/^[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}$/", $field_value)){
+ $groups=explode(".",$field_value);
+ foreach($groups as $group){
+ if($group<0 OR $group>255)
+ $vip=0;
+ }
+ }else{$vip=0;}
+ if($vip==0) {
+ $errmsg = $validator['errmsg'];
+ if(isset($this->wordbook[$errmsg])) {
+ $this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
+ } else {
+ $this->errorMessage .= $errmsg."<br />\r\n";
+ }
+ }
break;
case 'CUSTOM':
// Calls a custom class to validate this record
@@ -614,7 +723,7 @@
$app->uses($validator_class);
$this->errorMessage .= $app->$validator_class->$validator_function($field_name, $field_value, $validator);
} else {
- $this->errorMessage .= "Custom validator class or function is empty<br>\r\n";
+ $this->errorMessage .= "Custom validator class or function is empty<br />\r\n";
}
break;
default:
@@ -629,7 +738,7 @@
}
/**
- * SQL Statement f�r Record erzeugen.
+ * Create the SQL staement.
*
* @param record = Datensatz als Array
* @param action = INSERT oder UPDATE
@@ -646,9 +755,9 @@
// checking permissions
if($this->formDef['auth'] == 'yes' && $_SESSION["s"]["user"]["typ"] != 'admin') {
if($action == "INSERT") {
- if(!$this->checkPerm($primary_id,'i')) $this->errorMessage .= "Insert denied.<br>\r\n";
+ if(!$this->checkPerm($primary_id,'i')) $this->errorMessage .= "Insert denied.<br />\r\n";
} else {
- if(!$this->checkPerm($primary_id,'u')) $this->errorMessage .= "Update denied.<br>\r\n";
+ if(!$this->checkPerm($primary_id,'u')) $this->errorMessage .= "Update denied.<br />\r\n";
}
}
@@ -660,10 +769,10 @@
$sql_insert_val = '';
$sql_update = '';
- if(!is_array($this->formDef)) $app->error("Keine Formulardefinition vorhanden.");
- if(!is_array($this->formDef['tabs'][$tab])) $app->error("Tab ist leer oder existiert nicht (TAB: $tab).");
+ if(!is_array($this->formDef)) $app->error("Form definition not found.");
+ if(!is_array($this->formDef['tabs'][$tab])) $app->error("The tab is empty or does not exist (TAB: $tab).");
- // gehe durch alle Felder des Tabs
+ // go trough all fields of the tab
if(is_array($record)) {
foreach($this->formDef['tabs'][$tab]['fields'] as $key => $field) {
// Wenn es kein leeres Passwortfeld ist
@@ -673,15 +782,29 @@
if($field['formtype'] == 'PASSWORD') {
$sql_insert_key .= "`$key`, ";
if($field['encryption'] == 'CRYPT') {
- // $sql_insert_val .= "encrypt('".$record[$key]."'), ";
- $sql_insert_val .= "'".crypt($record[$key],substr(md5(time()),0,2))."', ";
+ $salt="$1$";
+ for ($n=0;$n<11;$n++) {
+ $salt.=chr(mt_rand(64,126));
+ }
+ $salt.="$";
+ // $salt = substr(md5(time()),0,2);
+ $record[$key] = crypt($record[$key],$salt);
+ $sql_insert_val .= "'".$app->db->quote($record[$key])."', ";
+ } elseif ($field['encryption'] == 'MYSQL') {
+ $sql_insert_val .= "PASSWORD('".$app->db->quote($record[$key])."'), ";
+ } elseif ($field['encryption'] == 'CLEARTEXT') {
+ $sql_insert_val .= "'".$app->db->quote($record[$key])."', ";
} else {
- $sql_insert_val .= "md5('".$record[$key]."'), ";
+ $record[$key] = md5($record[$key]);
+ $sql_insert_val .= "'".$app->db->quote($record[$key])."', ";
}
+
} elseif ($field['formtype'] == 'CHECKBOX') {
$sql_insert_key .= "`$key`, ";
if($record[$key] == '') {
+ // if a checkbox is not set, we set it to the unchecked value
$sql_insert_val .= "'".$field['value'][0]."', ";
+ $record[$key] = $field['value'][0];
} else {
$sql_insert_val .= "'".$record[$key]."', ";
}
@@ -691,15 +814,29 @@
}
} else {
if($field['formtype'] == 'PASSWORD') {
- if($field['encryption'] == 'CRYPT') {
- // $sql_update .= "`$key` = encrypt('".$record[$key]."'), ";
- $sql_update .= "`$key` = '".crypt($record[$key],substr(md5(time()),0,2))."', ";
+ if(isset($field['encryption']) && $field['encryption'] == 'CRYPT') {
+ $salt="$1$";
+ for ($n=0;$n<11;$n++) {
+ $salt.=chr(mt_rand(64,126));
+ }
+ $salt.="$";
+ // $salt = substr(md5(time()),0,2);
+ $record[$key] = crypt($record[$key],$salt);
+ $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', ";
+ } elseif (isset($field['encryption']) && $field['encryption'] == 'MYSQL') {
+ $sql_update .= "`$key` = PASSWORD('".$app->db->quote($record[$key])."'), ";
+ } elseif (isset($field['encryption']) && $field['encryption'] == 'CLEARTEXT') {
+ $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', ";
} else {
- $sql_update .= "`$key` = md5('".$record[$key]."'), ";
+ $record[$key] = md5($record[$key]);
+ $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', ";
}
+
} elseif ($field['formtype'] == 'CHECKBOX') {
if($record[$key] == '') {
+ // if a checkbox is not set, we set it to the unchecked value
$sql_update .= "`$key` = '".$field['value'][0]."', ";
+ $record[$key] = $field['value'][0];
} else {
$sql_update .= "`$key` = '".$record[$key]."', ";
}
@@ -707,12 +844,16 @@
$sql_update .= "`$key` = '".$record[$key]."', ";
}
}
- }
+ } else {
+ // we unset the password filed, if empty to tell the datalog function
+ // that the password has not been changed
+ unset($record[$key]);
+ }
}
}
- // F�ge Backticks nur bei unvollst�ndigen Tabellennamen ein
+ // Add backticks for incomplete table names
if(stristr($this->formDef['db_table'],'.')) {
$escape = '';
} else {
@@ -722,7 +863,7 @@
if($action == "INSERT") {
if($this->formDef['auth'] == 'yes') {
- // Setze User und Gruppe
+ // Set user and group
$sql_insert_key .= "`sys_userid`, ";
$sql_insert_val .= ($this->formDef["auth_preset"]["userid"] > 0)?"'".$this->formDef["auth_preset"]["userid"]."', ":"'".$_SESSION["s"]["user"]["userid"]."', ";
$sql_insert_key .= "`sys_groupid`, ";
@@ -738,17 +879,27 @@
$sql_insert_val = substr($sql_insert_val,0,-2);
$sql = "INSERT INTO ".$escape.$this->formDef['db_table'].$escape." ($sql_insert_key) VALUES ($sql_insert_val)";
} else {
+ if($this->formDef['auth'] == 'yes') {
if($primary_id != 0) {
+ $sql_update = substr($sql_update,0,-2);
+ $sql = "UPDATE ".$escape.$this->formDef['db_table'].$escape." SET ".$sql_update." WHERE ".$this->getAuthSQL('u')." AND ".$this->formDef['db_table_idx']." = ".$primary_id;
+ if($sql_ext_where != '') $sql .= " and ".$sql_ext_where;
+ } else {
+ $app->error("Primary ID fehlt!");
+ }
+ } else {
+ if($primary_id != 0) {
$sql_update = substr($sql_update,0,-2);
$sql = "UPDATE ".$escape.$this->formDef['db_table'].$escape." SET ".$sql_update." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id;
if($sql_ext_where != '') $sql .= " and ".$sql_ext_where;
} else {
$app->error("Primary ID fehlt!");
}
+ }
+ //* return a empty string if there is nothing to update
+ if(trim($sql_update) == '') $sql = '';
}
-
- // Daten in History tabelle speichern
- if($this->errorMessage == '' and $this->formDef['db_history'] == 'yes') $this->datalogSave($action,$primary_id,$record);
+
return $sql;
}
@@ -773,30 +924,33 @@
$active_tab = $this->getNextTab();
- // definiere Tabs
+ // go trough the tabs
foreach( $this->formDef["tabs"] as $key => $tab) {
- $tab['name'] = $key;
+ $tab['name'] = $key;
if($tab['name'] == $active_tab) {
- // Wenn Modul gesetzt, dann setzte template pfad relativ zu modul.
- if($this->module != '') $tab["template"] = "../".$this->module."/".$tab["template"];
+ // If module is set, then set the template path relative to the module..
+ if($this->module != '') $tab["template"] = "../".$this->module."/".$tab["template"];
- // �berpr�fe, ob das Template existiert, wenn nicht
- // dann generiere das Template
- if(!is_file($tab["template"])) {
- $app->uses('tform_tpl_generator');
- $app->tform_tpl_generator->buildHTML($this->formDef,$tab['name']);
- }
+ // Generate the template if it does not exist yet.
+
+ // Translate the title of the tab
+ $tab['title'] = $this->lng($tab['title']);
+
+ if(!is_file($tab["template"])) {
+ $app->uses('tform_tpl_generator');
+ $app->tform_tpl_generator->buildHTML($this->formDef,$tab['name']);
+ }
- $app->tpl->setInclude('content_tpl',$tab["template"]);
+ $app->tpl->setInclude('content_tpl',$tab["template"]);
$tab["active"] = 1;
$_SESSION["s"]["form"]["tab"] = $tab['name'];
} else {
$tab["active"] = 0;
}
- // Die Datenfelder werden f�r die Tabs nicht ben�tigt
+ // Unset unused variables.
unset($tab["fields"]);
unset($tab["plugins"]);
@@ -811,62 +965,101 @@
$app->tpl->setVar('form_active_tab',$active_tab);
// Set form title
- $form_hint = '<b>'.$this->formDef["title"].'</b>';
- if($this->formDef["description"] != '') $form_hint .= '<br><br>'.$this->formDef["description"];
+ $form_hint = $this->lng($this->formDef["title"]);
+ if($this->formDef["description"] != '') $form_hint .= '<div class="pageForm_description">'.$this->lng($this->formDef["description"]).'</div>';
$app->tpl->setVar('form_hint',$form_hint);
// Set Wordbook for this form
$app->tpl->setVar($this->wordbook);
- }
+ }
+ function getDataRecord($primary_id) {
+ global $app;
+ $escape = '`';
+ $sql = "SELECT * FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id;
+ return $app->db->queryOneRecord($sql);
+ }
+
-
- function datalogSave($action,$primary_id,$record_new) {
+ function datalogSave($action,$primary_id, $record_old, $record_new) {
global $app,$conf;
- // F�ge Backticks nur bei unvollst�ndigen Tabellennamen ein
+ // Add backticks for incomplete table names.
if(stristr($this->formDef['db_table'],'.')) {
$escape = '';
} else {
$escape = '`';
}
- if($action == "UPDATE") {
- $sql = "SELECT * FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id;
- $record_old = $app->db->queryOneRecord($sql);
- } else {
- $record_old = array();
- }
-
- $diffrec = array();
-
- if(is_array($record_new)) {
+ $this->diffrec = array();
+ /*
+ if(is_array($record_new) && count($record_new) > 0) {
foreach($record_new as $key => $val) {
- if($record_old[$key] != $val) {
- // Datensatz hat sich ge�ndert
- $diffrec[$key] = array('old' => $record_old[$key],
- 'new' => $val);
+ if(@$record_old[$key] != $val) {
+ // Record has changed
+ $diffrec[$key] = array('old' => @$record_old[$key],
+ 'new' => $val);
+ }
+ }
+ } elseif(is_array($record_old)) {
+ foreach($record_old as $key => $val) {
+ if($record_new[$key] != $val) {
+ // Record has changed
+ $diffrec[$key] = array('new' => $record_new[$key],
+ 'old' => $val);
}
}
}
-
- // Insert the server_id, if the record has a server_id
- $server_id = ($record_old["server_id"] > 0)?$record_old["server_id"]:0;
- if(isset($record_new["server_id"])) $server_id = $record_new["server_id"];
-
$this->diffrec = $diffrec;
+ */
+
+ // Full diff records for ISPConfig, they have a different format then the simple diffrec
+ $diffrec_full = array();
- if(count($diffrec) > 0) {
-
- // We need the full records in ISPConfig, not only the diffs
- $diffrec = array( 'old' => $record_old,
- 'new' => $record_new);
-
- $diffstr = $app->db->quote(serialize($diffrec));
+ if(is_array($record_old) && count($record_old) > 0) {
+ foreach($record_old as $key => $val) {
+ //if(isset($record_new[$key]) && $record_new[$key] != $val) {
+ if(!isset($record_new[$key]) || $record_new[$key] != $val) {
+ // Record has changed
+ $diffrec_full['old'][$key] = $val;
+ $diffrec_full['new'][$key] = $record_new[$key];
+ $this->diffrec[$key] = array( 'new' => $record_new[$key],
+ 'old' => $val);
+ } else {
+ $diffrec_full['old'][$key] = $val;
+ $diffrec_full['new'][$key] = $val;
+ }
+ }
+ } elseif(is_array($record_new)) {
+ foreach($record_new as $key => $val) {
+ if(isset($record_new[$key]) && $record_old[$key] != $val) {
+ // Record has changed
+ $diffrec_full['new'][$key] = $val;
+ $diffrec_full['old'][$key] = $record_old[$key];
+ $this->diffrec[$key] = array( 'old' => @$record_old[$key],
+ 'new' => $val);
+ } else {
+ $diffrec_full['new'][$key] = $val;
+ $diffrec_full['old'][$key] = $val;
+ }
+ }
+ }
+
+ //$this->diffrec = $diffrec;
+ // Insert the server_id, if the record has a server_id
+ $server_id = (isset($record_old["server_id"]) && $record_old["server_id"] > 0)?$record_old["server_id"]:0;
+ if(isset($record_new["server_id"])) $server_id = $record_new["server_id"];
+
+ if(count($this->diffrec) > 0) {
+ $diffstr = addslashes(serialize($diffrec_full));
$username = $app->db->quote($_SESSION["s"]["user"]["username"]);
$dbidx = $this->formDef['db_table_idx'].":".$primary_id;
- $action = ($action == 'INSERT')?'i':'u';
+ // $action = ($action == 'INSERT')?'i':'u';
+
+ if($action == 'INSERT') $action = 'i';
+ if($action == 'UPDATE') $action = 'u';
+ if($action == 'DELETE') $action = 'd';
$sql = "INSERT INTO sys_datalog (dbtable,dbidx,server_id,action,tstamp,user,data) VALUES ('".$this->formDef['db_table']."','$dbidx','$server_id','$action','".time()."','$username','$diffstr')";
$app->db->query($sql);
}
@@ -879,9 +1072,10 @@
if($_SESSION["s"]["user"]["typ"] == 'admin') {
return '1';
} else {
- $sql = '(';
+ $groups = ( $_SESSION["s"]["user"]["groups"] ) ? $_SESSION["s"]["user"]["groups"] : 0;
+ $sql = '(';
$sql .= "(sys_userid = ".$_SESSION["s"]["user"]["userid"]." AND sys_perm_user like '%$perm%') OR ";
- $sql .= "(sys_groupid IN (".$_SESSION["s"]["user"]["groups"].") AND sys_perm_group like '%$perm%') OR ";
+ $sql .= "(sys_groupid IN (".$groups.") AND sys_perm_group like '%$perm%') OR ";
$sql .= "sys_perm_other like '%$perm%'";
$sql .= ')';
@@ -890,14 +1084,14 @@
}
/*
- Diese funktion �berpr�ft, ob ein User die Berechtigung $perm f�r den Datensatz mit der ID $record_id
- hat. It record_id = 0, dann wird gegen die user Defaults des Formulares getestet.
+ This function checks if a user has the parmissions $perm for the data record with the ID $record_id
+ If record_id = 0, the the permissions are tested against the defaults of the form file.
*/
function checkPerm($record_id,$perm) {
global $app;
if($record_id > 0) {
- // F�ge Backticks nur bei unvollst�ndigen Tabellennamen ein
+ // Add backticks for incomplete table names.
if(stristr($this->formDef['db_table'],'.')) {
$escape = '';
} else {
@@ -912,8 +1106,8 @@
}
} else {
$result = false;
- if($this->formDef["auth_preset"]["userid"] == $_SESSION["s"]["user"]["userid"] && stristr($perm,$this->formDef["auth_preset"]["perm_user"])) $result = true;
- if($this->formDef["auth_preset"]["groupid"] == $_SESSION["s"]["user"]["groupid"] && stristr($perm,$this->formDef["auth_preset"]["perm_group"])) $result = true;
+ if(@$this->formDef["auth_preset"]["userid"] == $_SESSION["s"]["user"]["userid"] && stristr($perm,$this->formDef["auth_preset"]["perm_user"])) $result = true;
+ if(@$this->formDef["auth_preset"]["groupid"] == $_SESSION["s"]["user"]["groupid"] && stristr($perm,$this->formDef["auth_preset"]["perm_group"])) $result = true;
if(@stristr($this->formDef["auth_preset"]["perm_other"],$perm)) $result = true;
// if preset == 0, everyone can insert a record of this type
@@ -926,18 +1120,18 @@
}
function getNextTab() {
- // Welcher Tab wird angezeigt
+ // Which tab is shown
if($this->errorMessage == '') {
- // wenn kein Fehler vorliegt
- if($_REQUEST["next_tab"] != '') {
- // wenn n�chster Tab bekannt
+ // If there is no error
+ if(isset($_REQUEST["next_tab"]) && $_REQUEST["next_tab"] != '') {
+ // If the next tab is known
$active_tab = $_REQUEST["next_tab"];
} else {
- // ansonsten ersten tab nehmen
+ // else use the default tab
$active_tab = $this->formDef['tab_default'];
}
} else {
- // bei Fehlern den gleichen Tab nochmal anzeigen
+ // Show the same tab again in case of an error
$active_tab = $_SESSION["s"]["form"]["tab"];
}
@@ -947,6 +1141,121 @@
function getCurrentTab() {
return $_SESSION["s"]["form"]["tab"];
}
+
+ function isReadonlyTab($tab, $primary_id) {
+ global $app, $conf;
+
+ // Add backticks for incomplete table names.
+ if(stristr($this->formDef['db_table'],'.')) {
+ $escape = '';
+ } else {
+ $escape = '`';
+ }
+
+ $sql = "SELECT sys_userid FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id;
+ $record = $app->db->queryOneRecord($sql);
+
+ // return true if the readonly flag of the form is set and the current loggedin user is not the owner of the record.
+ if(isset($this->formDef['tabs'][$tab]['readonly']) && $this->formDef['tabs'][$tab]['readonly'] == true && $record['sys_userid'] != $_SESSION["s"]["user"]["userid"]) {
+ return true;
+ } else {
+ return false;
+ }
+ }
+
+
+ // translation function for forms, tries the form wordbook first and if this fails, it tries the global wordbook
+ function lng($msg) {
+ global $app;
+
+ if(isset($this->wordbook[$msg])) {
+ return $this->wordbook[$msg];
+ } else {
+ return $app->lng($msg);
+ }
+
+ }
+
+ function checkClientLimit($limit_name,$sql_where = '') {
+ global $app;
+
+ $check_passed = true;
+ $limit_name = $app->db->quote($limit_name);
+ if($limit_name == '') $app->error('Limit name missing in function checkClientLimit.');
+
+ // Get the limits of the client that is currently logged in
+ $client_group_id = $_SESSION["s"]["user"]["default_group"];
+ $client = $app->db->queryOneRecord("SELECT $limit_name as number, parent_client_id FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
+
+ // Check if the user may add another item
+ if($client["number"] >= 0) {
+ $sql = "SELECT count(".$this->formDef['db_table_idx'].") as number FROM ".$this->formDef['db_table']." WHERE ".$this->getAuthSQL('u');
+ if($sql_where != '') $sql .= ' and '.$sql_where;
+ $tmp = $app->db->queryOneRecord($sql);
+ if($tmp["number"] >= $client["number"]) $check_passed = false;
+ }
+
+ return $check_passed;
+ }
+
+ function checkResellerLimit($limit_name,$sql_where = '') {
+ global $app;
+
+ $check_passed = true;
+ $limit_name = $app->db->quote($limit_name);
+ if($limit_name == '') $app->error('Limit name missing in function checkClientLimit.');
+
+ // Get the limits of the client that is currently logged in
+ $client_group_id = $_SESSION["s"]["user"]["default_group"];
+ $client = $app->db->queryOneRecord("SELECT parent_client_id FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
+
+ //* If the client belongs to a reseller, we will check against the reseller Limit too
+ if($client['parent_client_id'] != 0) {
+
+ //* first we need to know the groups of this reseller
+ $tmp = $app->db->queryOneRecord("SELECT userid, groups FROM sys_user WHERE client_id = ".$client['parent_client_id']);
+ $reseller_groups = $tmp["groups"];
+ $reseller_userid = $tmp["userid"];
+
+ // Get the limits of the reseller of the logged in client
+ $client_group_id = $_SESSION["s"]["user"]["default_group"];
+ $reseller = $app->db->queryOneRecord("SELECT $limit_name as number FROM client WHERE client_id = ".$client['parent_client_id']);
+
+ // Check if the user may add another item
+ if($reseller["number"] >= 0) {
+ $sql = "SELECT count(".$this->formDef['db_table_idx'].") as number FROM ".$this->formDef['db_table']." WHERE (sys_groupid IN (".$reseller_groups.") or sys_userid = ".$reseller_userid.")";
+ if($sql_where != '') $sql .= ' and '.$sql_where;
+ $tmp = $app->db->queryOneRecord($sql);
+ if($tmp["number"] >= $reseller["number"]) $check_passed = false;
+ }
+ }
+
+ return $check_passed;
+ }
+
+ //* get the difference record of two arrays
+ function getDiffRecord($record_old,$record_new) {
+
+ if(is_array($record_new) && count($record_new) > 0) {
+ foreach($record_new as $key => $val) {
+ if(@$record_old[$key] != $val) {
+ // Record has changed
+ $diffrec[$key] = array( 'old' => @$record_old[$key],
+ 'new' => $val);
+ }
+ }
+ } elseif(is_array($record_old)) {
+ foreach($record_old as $key => $val) {
+ if($record_new[$key] != $val) {
+ // Record has changed
+ $diffrec[$key] = array( 'new' => $record_new[$key],
+ 'old' => $val);
+ }
+ }
+ }
+ return $diffrec;
+
+ }
}
--
Gitblit v1.9.1