$tmpconf=$this->db->queryOneRecord("SELECT `value` FROM `sys_config` WHERE `group` = '".$this->db->quote($plugin)."' AND `name` = '".$this->db->quote($key)."'");
$tmpconf=$this->db->queryOneRecord("SELECT `value` FROM `sys_config` WHERE `group` = ? AND `name` = ?",$plugin,$key);
if($tmpconf)return$tmpconf['value'];
elsereturnnull;
}else{
if($value===false){
$this->db->query("DELETE FROM `sys_config` WHERE `group` = '".$this->db->quote($plugin)."' AND `name` = '".$this->db->quote($key)."'");
$this->db->query("DELETE FROM `sys_config` WHERE `group` = ? AND `name` = ?",$plugin,$key);
returnnull;
}else{
$this->db->query("REPLACE INTO `sys_config` (`group`, `name`, `value`) VALUES ('".$this->db->quote($plugin)."', '".$this->db->quote($key)."', '".$this->db->quote($value)."')");
$this->db->query("REPLACE INTO `sys_config` (`group`, `name`, `value`) VALUES (?, ?, ?)",$plugin,$key,$value);
return$value;
}
}
...
...
@@ -179,8 +179,8 @@ class app {
$server_id=0;
$priority=$this->functions->intval($priority);
$tstamp=time();
$msg=$this->db->quote('[INTERFACE]: '.$msg);
$this->db->query("INSERT INTO sys_log (server_id,datalog_id,loglevel,tstamp,message) VALUES ($server_id,0,$priority,$tstamp,'$msg')");
$msg='[INTERFACE]: '.$msg;
$this->db->query("INSERT INTO sys_log (server_id,datalog_id,loglevel,tstamp,message) VALUES (?, 0, ?, ?, ?)",$server_id,$priority,$tstamp,$msg);
/*
if (is_writable($this->_conf['log_file'])) {
if (!$fp = fopen ($this->_conf['log_file'], 'a')) {
$result=$app->db->queryOneRecord('SELECT id FROM aps_instances WHERE '.$sql_ext.' id = '.$app->db->quote($id).';');
$params=array();
$sql_ext='';
if(!$is_admin){
$sql_ext='customer_id = ? AND ';
$params[]=$client_id;
}
$params[]=$id;
$result=$app->db->queryOneRecord('SELECT id FROM aps_instances WHERE '.$sql_ext.' id = ?',true,$params);
if(!$result)returnfalse;
returntrue;
...
...
@@ -226,7 +232,7 @@ class ApsGUIController extends ApsBase
unset($tmp);
// get information if the webserver is a db server, too
$web_server=$app->db->queryOneRecord("SELECT server_id,server_name,db_server FROM server WHERE server_id = ".$app->functions->intval($websrv['server_id']));
$web_server=$app->db->queryOneRecord("SELECT server_id,server_name,db_server FROM server WHERE server_id = ?",$websrv['server_id']);
@@ -235,7 +241,7 @@ class ApsGUIController extends ApsBase
$mysql_db_remote_ips='';
}else{
//* get the default database server of the client
$client=$app->db->queryOneRecord("SELECT default_dbserver FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = ".$app->functions->intval($websrv['sys_groupid']));
$client=$app->db->queryOneRecord("SELECT default_dbserver FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = ?",$websrv['sys_groupid']);
$tmp=$app->db->queryOneRecord("SELECT count(database_user_id) as number FROM web_database_user WHERE database_user = '".$app->db->quote($mysql_db_user)."'");
$tmp=$app->db->queryOneRecord("SELECT count(database_user_id) as number FROM web_database_user WHERE database_user = ?",$mysql_db_user);
if($tmp['number']==0)break;
}
$settings['main_database_login']=$mysql_db_user;
}
//* Create the mysql database user if not existing
$tmp=$app->db->queryOneRecord("SELECT database_user_id FROM web_database_user WHERE database_user = '".$app->db->quote($settings['main_database_login'])."'");
$tmp=$app->db->queryOneRecord("SELECT database_user_id FROM web_database_user WHERE database_user = ?",$settings['main_database_login']);
@@ -288,7 +294,7 @@ class ApsGUIController extends ApsBase
else$mysql_db_user_id=$tmp['database_user_id'];
//* Create the mysql database if not existing
$tmp=$app->db->queryOneRecord("SELECT count(database_id) as number FROM web_database WHERE database_name = '".$app->db->quote($settings['main_database_name'])."'");
$tmp=$app->db->queryOneRecord("SELECT count(database_id) as number FROM web_database WHERE database_name = ?",$settings['main_database_name']);
$sql="SELECT web_database.database_id as database_id, web_database.database_user_id as `database_user_id` FROM aps_instances_settings, web_database WHERE aps_instances_settings.value = web_database.database_name AND aps_instances_settings.name = 'main_database_name' AND aps_instances_settings.instance_id = ".$instanceid." LIMIT 0,1";
$tmp=$app->db->queryOneRecord($sql);
$sql="SELECT web_database.database_id as database_id, web_database.database_user_id as `database_user_id` FROM aps_instances_settings, web_database WHERE aps_instances_settings.value = web_database.database_name AND aps_instances_settings.name = 'main_database_name' AND aps_instances_settings.instance_id = ? LIMIT 0,1";
$tmp=$app->db->queryOneRecord("SELECT COUNT(*) as `cnt` FROM `web_database` WHERE `database_user_id` = '".$app->functions->intval($database_user)."' OR `database_ro_user_id` = '".$app->functions->intval($database_user)."'");
$tmp=$app->db->queryOneRecord("SELECT COUNT(*) as `cnt` FROM `web_database` WHERE `database_user_id` = ? OR `database_ro_user_id` = ?",$database_user,$database_user);
$client=$app->db->queryOneRecord("SELECT client.limit_client FROM sys_user, client WHERE sys_user.userid = $userid AND sys_user.client_id = client.client_id");
$client=$app->db->queryOneRecord("SELECT client.limit_client FROM sys_user, client WHERE sys_user.userid = ? AND sys_user.client_id = client.client_id",$userid);
if($client['limit_client']!=0){
returntrue;
}else{
...
...
@@ -73,12 +73,12 @@ class auth {
$groupid=$app->functions->intval($groupid);
if($userid>0&&$groupid>0){
$user=$app->db->queryOneRecord("SELECT * FROM sys_user WHERE userid = $userid");
$user=$app->db->queryOneRecord("SELECT * FROM sys_user WHERE userid = ?",$userid);
$sql="UPDATE sys_user SET groups = '$groups_string' WHERE userid = $userid";
$app->db->query($sql);
$sql="UPDATE sys_user SET groups = ? WHERE userid = ?";
$app->db->query($sql,$groups_string,$userid);
returntrue;
}else{
returnfalse;
...
...
@@ -95,7 +95,7 @@ class auth {
// simple query cache
if($this->client_limits===null)
$this->client_limits=$app->db->queryOneRecord("SELECT client.* FROM sys_user, client WHERE sys_user.userid = $userid AND sys_user.client_id = client.client_id");
$this->client_limits=$app->db->queryOneRecord("SELECT client.* FROM sys_user, client WHERE sys_user.userid = ? AND sys_user.client_id = client.client_id",$userid);
// isn't client -> no limit
if(!$this->client_limits)
...
...
@@ -114,13 +114,13 @@ class auth {
$groupid=$app->functions->intval($groupid);
if($userid>0&&$groupid>0){
$user=$app->db->queryOneRecord("SELECT * FROM sys_user WHERE userid = $userid");
$user=$app->db->queryOneRecord("SELECT * FROM sys_user WHERE userid = ",$userid);
$groups=explode(',',$user['groups']);
$key=array_search($groupid,$groups);
unset($groups[$key]);
$groups_string=implode(',',$groups);
$sql="UPDATE sys_user SET groups = '$groups_string' WHERE userid = $userid";
$app->db->query($sql);
$sql="UPDATE sys_user SET groups = ? WHERE userid = ?";
$in_db=$app->db->queryAllRecords('SELECT `assigned_template_id`, `client_template_id` FROM `client_template_assigned` WHERE `client_id` = '.$app->functions->intval($clientId));
$in_db=$app->db->queryAllRecords('SELECT `assigned_template_id`, `client_template_id` FROM `client_template_assigned` WHERE `client_id` = ?',$clientId);
// add new template to client (includes those from old-style without assigned_template_id)
for($i=$count;$i>0;$i--){
$app->db->query('INSERT INTO `client_template_assigned` (`client_id`, `client_template_id`) VALUES ('.$app->functions->intval($clientId).', '.$app->functions->intval($tpl_id).')');
$app->db->query('INSERT INTO `client_template_assigned` (`client_id`, `client_template_id`) VALUES (?, ?)',$clientId,$tpl_id);
}
}elseif($count<0){
// remove old ones
for($i=$count;$i<0;$i++){
$app->db->query('DELETE FROM `client_template_assigned` WHERE client_id = '.$app->functions->intval($clientId).' AND client_template_id = '.$app->functions->intval($tpl_id).' LIMIT 1');
$app->db->query('DELETE FROM `client_template_assigned` WHERE client_id = ? AND client_template_id = ? LIMIT 1',$clientId,$tpl_id);
}
}
}
}else{
// we have to take care of this in an other way
$in_db=$app->db->queryAllRecords('SELECT `assigned_template_id`, `client_template_id` FROM `client_template_assigned` WHERE `client_id` = '.$app->functions->intval($clientId));
$in_db=$app->db->queryAllRecords('SELECT `assigned_template_id`, `client_template_id` FROM `client_template_assigned` WHERE `client_id` = ?',$clientId);
if(is_array($in_db)&&count($in_db)>0){
// check which templates were removed from this client
// if there is no master template it makes NO SENSE adding sub templates.
// adding subtemplates are stored in client limits, so they would add up
...
...
@@ -136,11 +136,11 @@ class client_templates {
* if != -1)
*/
$addTpl=explode('/',$additionalTemplateStr);
$addTpls=$app->db->queryAllRecords('SELECT `client_template_id` FROM `client_template_assigned` WHERE `client_id` = '.$app->functions->intval($clientId));
$addTpls=$app->db->queryAllRecords('SELECT `client_template_id` FROM `client_template_assigned` WHERE `client_id` = ?',$clientId);
foreach($addTplsas$addTpl){
$item=$addTpl['client_template_id'];
$sql="SELECT * FROM client_template WHERE template_id = ".$app->functions->intval($item);
$addLimits=$app->db->queryOneRecord($sql);
$sql="SELECT * FROM client_template WHERE template_id = ?";
$addLimits=$app->db->queryOneRecord($sql,$item);
$app->log('Template processing subtemplate '.$item.' for client '.$clientId,LOGLEVEL_DEBUG);
/* maybe the template is deleted in the meantime */
if(is_array($addLimits)){
...
...
@@ -232,6 +232,7 @@ class client_templates {
* Write all back to the database
*/
$update='';
$update_values=array();
if(!$is_reseller)unset($limits['limit_client']);// Only Resellers may have limit_client set in template to ensure that we do not convert a client to reseller accidently.
