Newer
Older
unset($range_parts);
break;
case 'CUSTOM':
// Calls a custom class to validate this record
if($validator['class'] != '' and $validator['function'] != '') {
$validator_class = $validator['class'];
$validator_function = $validator['function'];
$app->uses($validator_class);
$this->errorMessage .= $app->$validator_class->$validator_function($field_name, $field_value, $validator);
} else {
$this->errorMessage .= "Custom validator class or function is empty<br />\r\n";
}
break;
default:
$this->errorMessage .= "Unknown Validator: ".$validator['type'];
break;
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
}
}
return true;
}
/**
* Create SQL statement
*
* @param record = Datensatz als Array
* @param action = INSERT oder UPDATE
* @param primary_id
* @return record
*/
function getSQL($record, $tab, $action = 'INSERT', $primary_id = 0, $sql_ext_where = '') {
global $app;
// If there are no data records on the tab, return empty sql string
if(count($this->formDef['tabs'][$tab]['fields']) == 0) return '';
// checking permissions
if($this->formDef['auth'] == 'yes' && $_SESSION["s"]["user"]["typ"] != 'admin') {
if($action == "INSERT") {
if(!$this->checkPerm($primary_id,'i')) $this->errorMessage .= "Insert denied.<br />\r\n";
} else {
if(!$this->checkPerm($primary_id,'u')) $this->errorMessage .= "Update denied.<br />\r\n";
}
}
$this->action = $action;
$this->primary_id = $primary_id;
$record = $this->encode($record,$tab,true);
$sql_insert_key = '';
$sql_insert_val = '';
$sql_update = '';
if(!is_array($this->formDef)) $app->error("Form definition not found.");
if(!is_array($this->formDef['tabs'][$tab])) $app->error("The tab is empty or does not exist (TAB: $tab).");
// go trough all fields of the tab
if(is_array($record)) {
foreach($this->formDef['tabs'][$tab]['fields'] as $key => $field) {
// Wenn es kein leeres Passwortfeld ist
if (!($field['formtype'] == 'PASSWORD' and $record[$key] == '')) {
// Erzeuge Insert oder Update Quelltext
if($action == "INSERT") {
if($field['formtype'] == 'PASSWORD') {
$sql_insert_key .= "`$key`, ";
if($field['encryption'] == 'CRYPT') {
$record[$key] = $app->auth->crypt_password(stripslashes($record[$key]));
$sql_insert_val .= "'".$app->db->quote($record[$key])."', ";
} elseif ($field['encryption'] == 'MYSQL') {
tbrehm
committed
$tmp = $app->db->queryOneRecord("SELECT PASSWORD('".$app->db->quote(stripslashes($record[$key]))."') as `crypted`");
$record[$key] = $tmp['crypted'];
$sql_insert_val .= "'".$app->db->quote($record[$key])."', ";
} elseif ($field['encryption'] == 'CLEARTEXT') {
$sql_insert_val .= "'".$app->db->quote($record[$key])."', ";
} else {
$record[$key] = md5(stripslashes($record[$key]));
$sql_insert_val .= "'".$app->db->quote($record[$key])."', ";
}
} elseif ($field['formtype'] == 'CHECKBOX') {
$sql_insert_key .= "`$key`, ";
if($record[$key] == '') {
// if a checkbox is not set, we set it to the unchecked value
$sql_insert_val .= "'".$field['value'][0]."', ";
$record[$key] = $field['value'][0];
} else {
$sql_insert_val .= "'".$record[$key]."', ";
}
} else {
$sql_insert_key .= "`$key`, ";
$sql_insert_val .= "'".$record[$key]."', ";
}
} else {
if($field['formtype'] == 'PASSWORD') {
if(isset($field['encryption']) && $field['encryption'] == 'CRYPT') {
$record[$key] = $app->auth->crypt_password(stripslashes($record[$key]));
$sql_update .= "`$key` = '".$app->db->quote($record[$key])."', ";
} elseif (isset($field['encryption']) && $field['encryption'] == 'MYSQL') {
tbrehm
committed
$tmp = $app->db->queryOneRecord("SELECT PASSWORD('".$app->db->quote(stripslashes($record[$key]))."') as `crypted`");
$record[$key] = $tmp['crypted'];
$sql_update .= "`$key` = '".$app->db->quote($record[$key])."', ";
} elseif (isset($field['encryption']) && $field['encryption'] == 'CLEARTEXT') {
$sql_update .= "`$key` = '".$app->db->quote($record[$key])."', ";
} else {
$record[$key] = md5(stripslashes($record[$key]));
$sql_update .= "`$key` = '".$app->db->quote($record[$key])."', ";
}
} elseif ($field['formtype'] == 'CHECKBOX') {
if($record[$key] == '') {
// if a checkbox is not set, we set it to the unchecked value
$sql_update .= "`$key` = '".$field['value'][0]."', ";
$record[$key] = $field['value'][0];
} else {
$sql_update .= "`$key` = '".$record[$key]."', ";
}
} else {
$sql_update .= "`$key` = '".$record[$key]."', ";
}
}
} else {
// we unset the password filed, if empty to tell the datalog function
// that the password has not been changed
unset($record[$key]);
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
}
}
// Add backticks for incomplete table names
if(stristr($this->formDef['db_table'],'.')) {
$escape = '';
} else {
$escape = '`';
}
if($action == "INSERT") {
if($this->formDef['auth'] == 'yes') {
// Set user and group
$sql_insert_key .= "`sys_userid`, ";
$sql_insert_val .= ($this->formDef["auth_preset"]["userid"] > 0)?"'".$this->formDef["auth_preset"]["userid"]."', ":"'".$_SESSION["s"]["user"]["userid"]."', ";
$sql_insert_key .= "`sys_groupid`, ";
$sql_insert_val .= ($this->formDef["auth_preset"]["groupid"] > 0)?"'".$this->formDef["auth_preset"]["groupid"]."', ":"'".$_SESSION["s"]["user"]["default_group"]."', ";
$sql_insert_key .= "`sys_perm_user`, ";
$sql_insert_val .= "'".$this->formDef["auth_preset"]["perm_user"]."', ";
$sql_insert_key .= "`sys_perm_group`, ";
$sql_insert_val .= "'".$this->formDef["auth_preset"]["perm_group"]."', ";
$sql_insert_key .= "`sys_perm_other`, ";
$sql_insert_val .= "'".$this->formDef["auth_preset"]["perm_other"]."', ";
}
$sql_insert_key = substr($sql_insert_key,0,-2);
$sql_insert_val = substr($sql_insert_val,0,-2);
$sql = "INSERT INTO ".$escape.$this->formDef['db_table'].$escape." ($sql_insert_key) VALUES ($sql_insert_val)";
} else {
if($this->formDef['auth'] == 'yes') {
if($primary_id != 0) {
$sql_update = substr($sql_update,0,-2);
$sql = "UPDATE ".$escape.$this->formDef['db_table'].$escape." SET ".$sql_update." WHERE ".$this->getAuthSQL('u')." AND ".$this->formDef['db_table_idx']." = ".$primary_id;
if($sql_ext_where != '') $sql .= " and ".$sql_ext_where;
} else {
$app->error("Primary ID fehlt!");
}
} else {
if($primary_id != 0) {
$sql_update = substr($sql_update,0,-2);
$sql = "UPDATE ".$escape.$this->formDef['db_table'].$escape." SET ".$sql_update." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id;
if($sql_ext_where != '') $sql .= " and ".$sql_ext_where;
} else {
$app->error("Primary ID fehlt!");
}
}
//* return a empty string if there is nothing to update
if(trim($sql_update) == '') $sql = '';
return $sql;
}
/**
* Debugging arrays.
*
* @param array_data
*/
function dbg($array_data) {
echo "<pre>";
print_r($array_data);
echo "</pre>";
function showForm() {
global $app,$conf;
if(!is_array($this->formDef)) die("Form Definition wurde nicht geladen.");
$active_tab = $this->getNextTab();
// go trough the tabs
foreach( $this->formDef["tabs"] as $key => $tab) {
$tab['name'] = $key;
// Translate the title of the tab
$tab['title'] = $this->lng($tab['title']);
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
if($tab['name'] == $active_tab) {
// If module is set, then set the template path relative to the module..
if($this->module != '') $tab["template"] = "../".$this->module."/".$tab["template"];
// Generate the template if it does not exist yet.
if(!is_file($tab["template"])) {
$app->uses('tform_tpl_generator');
$app->tform_tpl_generator->buildHTML($this->formDef,$tab['name']);
}
$app->tpl->setVar('readonly_tab', (isset($tab['readonly']) && $tab['readonly'] == true));
$app->tpl->setInclude('content_tpl',$tab["template"]);
$tab["active"] = 1;
$_SESSION["s"]["form"]["tab"] = $tab['name'];
} else {
$tab["active"] = 0;
}
// Unset unused variables.
unset($tab["fields"]);
unset($tab["plugins"]);
$frmTab[] = $tab;
}
// setting form tabs
$app->tpl->setLoop("formTab", $frmTab);
// Set form action
$app->tpl->setVar('form_action',$this->formDef["action"]);
$app->tpl->setVar('form_active_tab',$active_tab);
// Set form title
$form_hint = $this->lng($this->formDef["title"]);
if($this->formDef["description"] != '') $form_hint .= '<div class="pageForm_description">'.$this->lng($this->formDef["description"]).'</div>';
$app->tpl->setVar('form_hint',$form_hint);
// Set Wordbook for this form
$app->tpl->setVar($this->wordbook);
}
function getDataRecord($primary_id) {
global $app;
$escape = '`';
$sql = "SELECT * FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id;
return $app->db->queryOneRecord($sql);
function datalogSave($action,$primary_id, $record_old, $record_new) {
global $app,$conf;
$app->db->datalogSave($this->formDef['db_table'], $action, $this->formDef['db_table_idx'], $primary_id, $record_old, $record_new);
return true;
// Add backticks for incomplete table names.
if(stristr($this->formDef['db_table'],'.')) {
$escape = '';
} else {
$escape = '`';
}
$this->diffrec = array();
// Full diff records for ISPConfig, they have a different format then the simple diffrec
$diffrec_full = array();
if(is_array($record_old) && count($record_old) > 0) {
foreach($record_old as $key => $val) {
//if(isset($record_new[$key]) && $record_new[$key] != $val) {
if(!isset($record_new[$key]) || $record_new[$key] != $val) {
// Record has changed
$diffrec_full['old'][$key] = $val;
$diffrec_full['new'][$key] = $record_new[$key];
$this->diffrec[$key] = array( 'new' => $record_new[$key],
'old' => $val);
} else {
$diffrec_full['old'][$key] = $val;
$diffrec_full['new'][$key] = $val;
}
}
} elseif(is_array($record_new)) {
foreach($record_new as $key => $val) {
if(isset($record_new[$key]) && $record_old[$key] != $val) {
// Record has changed
$diffrec_full['new'][$key] = $val;
$diffrec_full['old'][$key] = $record_old[$key];
$this->diffrec[$key] = array( 'old' => @$record_old[$key],
'new' => $val);
} else {
$diffrec_full['new'][$key] = $val;
$diffrec_full['old'][$key] = $val;
}
}
}
//$this->diffrec = $diffrec;
// Insert the server_id, if the record has a server_id
$server_id = (isset($record_old["server_id"]) && $record_old["server_id"] > 0)?$record_old["server_id"]:0;
if(isset($record_new["server_id"])) $server_id = $record_new["server_id"];
if(count($this->diffrec) > 0) {
$diffstr = addslashes(serialize($diffrec_full));
$username = $app->db->quote($_SESSION["s"]["user"]["username"]);
$dbidx = $this->formDef['db_table_idx'].":".$primary_id;
// $action = ($action == 'INSERT')?'i':'u';
if($action == 'INSERT') $action = 'i';
if($action == 'UPDATE') $action = 'u';
if($action == 'DELETE') $action = 'd';
$sql = "INSERT INTO sys_datalog (dbtable,dbidx,server_id,action,tstamp,user,data) VALUES ('".$this->formDef['db_table']."','$dbidx','$server_id','$action','".time()."','$username','$diffstr')";
$app->db->query($sql);
return true;
function getAuthSQL($perm, $table = '') {
if($_SESSION["s"]["user"]["typ"] == 'admin') {
return '1';
} else {
if ($table != ''){
$table = ' ' . $table . '.';
}
$groups = ( $_SESSION["s"]["user"]["groups"] ) ? $_SESSION["s"]["user"]["groups"] : 0;
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
$sql .= "(" . $table . "sys_userid = ".$_SESSION["s"]["user"]["userid"]." AND " . $table . "sys_perm_user like '%$perm%') OR ";
$sql .= "(" . $table . "sys_groupid IN (".$groups.") AND " . $table ."sys_perm_group like '%$perm%') OR ";
$sql .= $table . "sys_perm_other like '%$perm%'";
$sql .= ')';
return $sql;
}
}
/*
This function checks if a user has the parmissions $perm for the data record with the ID $record_id
If record_id = 0, the the permissions are tested against the defaults of the form file.
*/
function checkPerm($record_id,$perm) {
global $app;
if($record_id > 0) {
// Add backticks for incomplete table names.
if(stristr($this->formDef['db_table'],'.')) {
$escape = '';
} else {
$escape = '`';
}
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
$sql = "SELECT ".$this->formDef['db_table_idx']." FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$this->formDef['db_table_idx']." = ".$record_id." AND ".$this->getAuthSQL($perm);
if($record = $app->db->queryOneRecord($sql)) {
return true;
} else {
return false;
}
} else {
$result = false;
if(@$this->formDef["auth_preset"]["userid"] == $_SESSION["s"]["user"]["userid"] && stristr($perm,$this->formDef["auth_preset"]["perm_user"])) $result = true;
if(@$this->formDef["auth_preset"]["groupid"] == $_SESSION["s"]["user"]["groupid"] && stristr($perm,$this->formDef["auth_preset"]["perm_group"])) $result = true;
if(@stristr($this->formDef["auth_preset"]["perm_other"],$perm)) $result = true;
// if preset == 0, everyone can insert a record of this type
if($this->formDef["auth_preset"]["userid"] == 0 AND $this->formDef["auth_preset"]["groupid"] == 0 AND (@stristr($this->formDef["auth_preset"]["perm_user"],$perm) OR @stristr($this->formDef["auth_preset"]["perm_group"],$perm))) $result = true;
return $result;
}
}
function getNextTab() {
// Which tab is shown
if($this->errorMessage == '') {
// If there is no error
if(isset($_REQUEST["next_tab"]) && $_REQUEST["next_tab"] != '') {
// If the next tab is known
$active_tab = $_REQUEST["next_tab"];
} else {
// else use the default tab
$active_tab = $this->formDef['tab_default'];
}
} else {
// Show the same tab again in case of an error
$active_tab = $_SESSION["s"]["form"]["tab"];
return $active_tab;
}
function getCurrentTab() {
return $_SESSION["s"]["form"]["tab"];
}
function isReadonlyTab($tab, $primary_id) {
global $app, $conf;
// Add backticks for incomplete table names.
if(stristr($this->formDef['db_table'],'.')) {
$escape = '';
} else {
$escape = '`';
}
$sql = "SELECT sys_userid FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id;
$record = $app->db->queryOneRecord($sql);
// return true if the readonly flag of the form is set and the current loggedin user is not the owner of the record.
if(isset($this->formDef['tabs'][$tab]['readonly']) && $this->formDef['tabs'][$tab]['readonly'] == true && $record['sys_userid'] != $_SESSION["s"]["user"]["userid"]) {
return true;
} else {
return false;
}
// translation function for forms, tries the form wordbook first and if this fails, it tries the global wordbook
function lng($msg) {
if(isset($this->wordbook[$msg])) {
return $this->wordbook[$msg];
} else {
return $app->lng($msg);
}
function checkClientLimit($limit_name,$sql_where = '') {
global $app;
$check_passed = true;
$limit_name = $app->db->quote($limit_name);
if($limit_name == '') $app->error('Limit name missing in function checkClientLimit.');
// Get the limits of the client that is currently logged in
$client_group_id = $_SESSION["s"]["user"]["default_group"];
$client = $app->db->queryOneRecord("SELECT $limit_name as number, parent_client_id FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
// Check if the user may add another item
if($client["number"] >= 0) {
$sql = "SELECT count(".$this->formDef['db_table_idx'].") as number FROM ".$this->formDef['db_table']." WHERE ".$this->getAuthSQL('u');
if($sql_where != '') $sql .= ' and '.$sql_where;
$tmp = $app->db->queryOneRecord($sql);
if($tmp["number"] >= $client["number"]) $check_passed = false;
}
return $check_passed;
}
function checkResellerLimit($limit_name,$sql_where = '') {
global $app;
$check_passed = true;
$limit_name = $app->db->quote($limit_name);
if($limit_name == '') $app->error('Limit name missing in function checkClientLimit.');
// Get the limits of the client that is currently logged in
$client_group_id = $_SESSION["s"]["user"]["default_group"];
$client = $app->db->queryOneRecord("SELECT parent_client_id FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
//* If the client belongs to a reseller, we will check against the reseller Limit too
if($client['parent_client_id'] != 0) {
//* first we need to know the groups of this reseller
$tmp = $app->db->queryOneRecord("SELECT userid, groups FROM sys_user WHERE client_id = ".$client['parent_client_id']);
$reseller_groups = $tmp["groups"];
$reseller_userid = $tmp["userid"];
// Get the limits of the reseller of the logged in client
$client_group_id = $_SESSION["s"]["user"]["default_group"];
$reseller = $app->db->queryOneRecord("SELECT $limit_name as number FROM client WHERE client_id = ".$client['parent_client_id']);
// Check if the user may add another item
if($reseller["number"] >= 0) {
$sql = "SELECT count(".$this->formDef['db_table_idx'].") as number FROM ".$this->formDef['db_table']." WHERE (sys_groupid IN (".$reseller_groups.") or sys_userid = ".$reseller_userid.")";
if($sql_where != '') $sql .= ' and '.$sql_where;
$tmp = $app->db->queryOneRecord($sql);
if($tmp["number"] >= $reseller["number"]) $check_passed = false;
}
}
return $check_passed;
}
//* get the difference record of two arrays
function getDiffRecord($record_old,$record_new) {
if(is_array($record_new) && count($record_new) > 0) {
foreach($record_new as $key => $val) {
if(@$record_old[$key] != $val) {
// Record has changed
$diffrec[$key] = array( 'old' => @$record_old[$key],
'new' => $val);
}
}
} elseif(is_array($record_old)) {
foreach($record_old as $key => $val) {
if($record_new[$key] != $val) {
// Record has changed
$diffrec[$key] = array( 'new' => $record_new[$key],
'old' => $val);
}
}
}
return $diffrec;
/**
* Generate HTML for DATETIME fields.
* @access private
* @param string $form_element Name of the form element.
* @param string $default_value Selected value for fields.
* @param bool $display_secons Include seconds selection.
* @return string HTML
*/
function _getDateTimeHTML($form_element, $default_value, $display_seconds=false)
{
$_datetime = strtotime($default_value);
$_showdate = ($_datetime === false) ? false : true;
$dselect = array('day','month','year','hour','minute');
if ($display_seconds === true) {
$dselect[] = 'second';
}
$out = '';
foreach ($dselect as $dt_element)
{
$dt_options = array();
$dt_space = 1;
switch ($dt_element) {
case 'day':
for ($i = 1; $i <= 31; $i++) {
$dt_options[] = array('name' => sprintf('%02d', $i),
'value' => sprintf('%d', $i));
}
$selected_value = date('d', $_datetime);
case 'month':
for ($i = 1; $i <= 12; $i++) {
$dt_options[] = array('name' => strftime('%b', mktime(0, 0, 0, $i, 1, 2000)),
'value' => strftime('%m', mktime(0, 0, 0, $i, 1, 2000)));
}
$selected_value = date('n', $_datetime);
case 'year':
$start_year = strftime("%Y");
$years = range((int)$start_year, (int)($start_year+3));
foreach ($years as $year) {
$dt_options[] = array('name' => $year,
'value' => $year);
}
$selected_value = date('Y', $_datetime);
$dt_space = 2;
case 'hour':
foreach(range(0, 23) as $hour) {
$dt_options[] = array('name' => sprintf('%02d', $hour),
'value' => sprintf('%d', $hour));
}
$selected_value = date('G', $_datetime);
break;
case 'minute':
foreach(range(0, 59) as $minute) {
if (($minute % 5) == 0) {
$dt_options[] = array('name' => sprintf('%02d', $minute),
'value' => sprintf('%d', $minute));
}
}
$selected_value = (int)floor(date('i', $_datetime));
break;
case 'second':
foreach(range(0, 59) as $second) {
$dt_options[] = array('name' => sprintf('%02d', $second),
'value' => sprintf('%d', $second));
}
$selected_value = (int)floor(date('s', $_datetime));
break;
}
$out .= "<select name=\"".$form_element."[$dt_element]\" id=\"".$form_element."_$dt_element\" class=\"selectInput\" style=\"width: auto; float: none;\">";
if (!$_showdate) {
$out .= "<option value=\"-\" selected=\"selected\">--</option>" . PHP_EOL;
} else {
$out .= "<option value=\"-\">--</option>" . PHP_EOL;
}
foreach ($dt_options as $dt_opt) {
if ( $_showdate && ($selected_value == $dt_opt['value']) ) {
$out .= "<option value=\"{$dt_opt['value']}\" selected=\"selected\">{$dt_opt['name']}</option>" . PHP_EOL;
} else {
$out .= "<option value=\"{$dt_opt['value']}\">{$dt_opt['name']}</option>" . PHP_EOL;
}
}
$out .= '</select>' . str_repeat(' ', $dt_space);
}
return $out;
}