From 5bff398b174c289233c28163cf6e5cdbf3cfb12a Mon Sep 17 00:00:00 2001 From: mcramer Date: Fri, 6 Sep 2013 17:56:07 +0000 Subject: [PATCH] This is a big change, so please be cautious - Added: First version of client api access with client user credentials - Changed: - merged remoting_lib and tform into one new base file where appropriate - moved some methods into helper methods only those methods remain in remoting_lib or tform that are completely different in these files or are only used in one of them - Changed: added check of _GET array in json api handler --- interface/lib/classes/json_handler.inc.php | 6 +- interface/lib/classes/remoting.inc.php | 97 +- interface/lib/classes/remoting_lib.inc.php | 757 +---------- interface/lib/classes/tform.inc.php | 1296 +------------------ interface/lib/classes/tform_base.inc.php | 1356 ++++++++++++++++++++ 5 files changed, 1480 insertions(+), 2032 deletions(-) create mode 100644 interface/lib/classes/tform_base.inc.php diff --git a/interface/lib/classes/json_handler.inc.php b/interface/lib/classes/json_handler.inc.php index b435947b1..9f3452207 100644 --- a/interface/lib/classes/json_handler.inc.php +++ b/interface/lib/classes/json_handler.inc.php @@ -82,7 +82,11 @@ class ISPConfigJSONHandler { public function run() { - $method = reset(array_keys($_GET)); + if(!isset($_GET) || !is_array($_GET) || count($_GET) < 1) { + $this->_return_json('invalid_method', 'Method not provided in json call'); + } + $keys = array_keys($_GET); + $method = reset($keys); $params = array(); if(is_array($_POST)) { diff --git a/interface/lib/classes/remoting.inc.php b/interface/lib/classes/remoting.inc.php index ec5e82b60..a6a6ddcdd 100644 --- a/interface/lib/classes/remoting.inc.php +++ b/interface/lib/classes/remoting.inc.php @@ -59,14 +59,15 @@ class remoting { $app->uses('remoting_lib'); $this->_methods = $methods; - /* + + /* $this->app = $app; $this->conf = $conf; */ } //* remote login function - public function login($username, $password) + public function login($username, $password, $client_login = false) { global $app, $conf; @@ -95,24 +96,74 @@ class remoting { $username = $app->db->quote($username); $password = $app->db->quote($password); - $sql = "SELECT * FROM remote_user WHERE remote_username = '$username' and remote_password = md5('$password')"; - $remote_user = $app->db->queryOneRecord($sql); - if($remote_user['remote_userid'] > 0) { - //* Create a remote user session - srand ((double)microtime()*1000000); - $remote_session = md5(rand()); - $remote_userid = $remote_user['remote_userid']; - $remote_functions = $remote_user['remote_functions']; - $tstamp = time() + $this->session_timeout; - $sql = 'INSERT INTO remote_session (remote_session,remote_userid,remote_functions,tstamp' + if($client_login == true) { + $sql = "SELECT * FROM sys_user WHERE USERNAME = '$username'"; + $user = $app->db->queryOneRecord($sql); + if($user) { + $saved_password = stripslashes($user['passwort']); + + if(substr($saved_password,0,3) == '$1$') { + //* The password is crypt-md5 encrypted + $salt = '$1$'.substr($saved_password,3,8).'$'; + + if(crypt(stripslashes($password),$salt) != $saved_password) { + throw new SoapFault('client_login_failed', 'The login failed. Username or password wrong.'); + return false; + } + } else { + //* The password is md5 encrypted + if(md5($password) != $saved_password) { + throw new SoapFault('client_login_failed', 'The login failed. Username or password wrong.'); + return false; + } + } + } else { + throw new SoapFault('client_login_failed', 'The login failed. Username or password wrong.'); + return false; + } + if($user['active'] != 1) { + throw new SoapFault('client_login_failed', 'The login failed. User is blocked.'); + return false; + } + + // now we need the client data + $client = $app->db->queryOneRecord("SELECT client.can_use_api FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = " . $app->functions->intval($user['default_group'])); + if(!$client || $client['can_use_api'] != 'y') { + throw new SoapFault('client_login_failed', 'The login failed. Client may not use api.'); + return false; + } + + //* Create a remote user session + //srand ((double)microtime()*1000000); + $remote_session = md5(mt_rand().uniqid('ispco')); + $remote_userid = $user['userid']; + $remote_functions = ''; + $tstamp = time() + $this->session_timeout; + $sql = 'INSERT INTO remote_session (remote_session,remote_userid,remote_functions,client_login,tstamp' .') VALUES (' - ." '$remote_session',$remote_userid,'$remote_functions',$tstamp)"; - $app->db->query($sql); - return $remote_session; + ." '$remote_session',$remote_userid,'$remote_functions',1,$tstamp)"; + $app->db->query($sql); + return $remote_session; } else { - throw new SoapFault('login_failed', 'The login failed. Username or password wrong.'); - return false; - } + $sql = "SELECT * FROM remote_user WHERE remote_username = '$username' and remote_password = md5('$password')"; + $remote_user = $app->db->queryOneRecord($sql); + if($remote_user['remote_userid'] > 0) { + //* Create a remote user session + //srand ((double)microtime()*1000000); + $remote_session = md5(mt_rand().uniqid('ispco')); + $remote_userid = $remote_user['remote_userid']; + $remote_functions = $remote_user['remote_functions']; + $tstamp = time() + $this->session_timeout; + $sql = 'INSERT INTO remote_session (remote_session,remote_userid,remote_functions,tstamp' + .') VALUES (' + ." '$remote_session',$remote_userid,'$remote_functions',$tstamp)"; + $app->db->query($sql); + return $remote_session; + } else { + throw new SoapFault('login_failed', 'The login failed. Username or password wrong.'); + return false; + } + } } @@ -389,6 +440,16 @@ class remoting { return false; } + $_SESSION['client_login'] = $session['client_login']; + if($session['client_login'] == 1) { + // permissions are checked at an other place + $_SESSION['client_sys_userid'] = $session['remote_userid']; + $app->remoting_lib->loadUserProfile(); // load the profile - we ALWAYS need this on client logins! + return true; + } else { + $_SESSION['client_sys_userid'] = 0; + } + $dobre= str_replace(';',',',$session['remote_functions']); $check = in_array($function_name, explode(',', $dobre) ); if(!$check) { diff --git a/interface/lib/classes/remoting_lib.inc.php b/interface/lib/classes/remoting_lib.inc.php index 0c40a8626..dda49e623 100644 --- a/interface/lib/classes/remoting_lib.inc.php +++ b/interface/lib/classes/remoting_lib.inc.php @@ -64,51 +64,11 @@ Copyright (c) Tri-Plex technology * */ -class remoting_lib { +$app->load('tform_base'); +class remoting_lib extends tform_base { - /** - * Definition of the database table (array) - * @var tableDef - */ - private $tableDef; - - /** - * Private - * @var action - */ - private $action; - - /** - * Table name (String) - * @var table_name - */ - private $table_name; - - /** - * Debug Variable - * @var debug - */ - private $debug = 0; - - /** - * name of the primary field of the database table (string) - * @var table_index - */ - var $table_index; - - /** - * contains the error messages - * @var errorMessage - */ - var $errorMessage = ''; - - var $dateformat = "d.m.Y"; - var $formDef = array(); - var $wordbook; - var $module; - var $primary_id; - var $diffrec = array(); - + + // additional class variables var $sys_username; var $sys_userid; var $sys_default_group; @@ -117,7 +77,7 @@ class remoting_lib { var $dataRecord; - //* Load the form definition from file. + //* Load the form definition from file. - special version for remoting function loadFormDef($file) { global $app,$conf; @@ -142,8 +102,18 @@ class remoting_lib { //* Load the user profile function loadUserProfile($client_id_param = 0) { global $app,$conf; - - $this->client_id = $app->functions->intval($client_id_param); + + $client_login = false; + if(isset($_SESSION['client_login']) && isset($_SESSION['client_sys_userid']) && $_SESSION['client_login'] == 1) { + $client_sys_userid = $app->functions->intval($_SESSION['client_sys_userid']); + + $client = $app->db->queryOneRecord("SELECT client.client_id FROM sys_user, client WHERE sys_user.client_id = client.client_id and sys_user.userid = " . $client_sys_userid); + + $this->client_id = $client['client_id']; + $client_login = true; + } else { + $this->client_id = $app->functions->intval($client_id_param); + } if($this->client_id == 0) { $this->sys_username = 'admin'; @@ -170,8 +140,14 @@ class remoting_lib { $this->sys_groups = $user['groups']; // $_SESSION["s"]["user"]["typ"] = $user['typ']; // we have to force admin priveliges for the remoting API as some function calls might fail otherwise. - $_SESSION["s"]["user"]["typ"] = 'admin'; + if($client_login == false) $_SESSION["s"]["user"]["typ"] = 'admin'; } + + $_SESSION["s"]["user"]["username"] = $this->sys_username; + $_SESSION["s"]["user"]["userid"] = $this->sys_userid; + $_SESSION["s"]["user"]["default_group"] = $this->sys_default_group; + $_SESSION["s"]["user"]["groups"] = $this->sys_groups; + $_SESSION["s"]["user"]["client_id"] = $this->client_id; return true; } @@ -185,51 +161,7 @@ class remoting_lib { * @return record */ function decode($record) { - $new_record = ''; - if(is_array($record)) { - foreach($this->formDef['fields'] as $key => $field) { - switch ($field['datatype']) { - case 'VARCHAR': - $new_record[$key] = stripslashes($record[$key]); - break; - - case 'TEXT': - $new_record[$key] = stripslashes($record[$key]); - break; - - case 'DATETSTAMP': - if($record[$key] > 0) { - $new_record[$key] = date($this->dateformat,$record[$key]); - } - break; - - case 'DATE': - if($record[$key] != '' && $record[$key] != '0000-00-00') { - $tmp = explode('-',$record[$key]); - $new_record[$key] = date($this->dateformat,mktime(0, 0, 0, $tmp[1] , $tmp[2], $tmp[0])); - } - break; - - case 'INTEGER': - $new_record[$key] = $app->functions->intval($record[$key]); - break; - - case 'DOUBLE': - $new_record[$key] = $record[$key]; - break; - - case 'CURRENCY': - $new_record[$key] = $app->functions->currency_format($record[$key]); - break; - - default: - $new_record[$key] = stripslashes($record[$key]); - } - } - - } - - return $new_record; + return $this->_decode($record, '', true); } /** @@ -241,53 +173,7 @@ class remoting_lib { */ function getDatasourceData($field, $record) { - global $app; - - $values = array(); - - if($field["datasource"]["type"] == 'SQL') { - - // Preparing SQL string. We will replace some - // common placeholders - $querystring = $field["datasource"]["querystring"]; - $querystring = str_replace("{USERID}",$this->sys_userid,$querystring); - $querystring = str_replace("{GROUPID}",$this->sys_default_group,$querystring); - $querystring = str_replace("{GROUPS}",$this->sys_groups,$querystring); - $table_idx = $this->formDef['db_table_idx']; - - $tmp_recordid = (isset($record[$table_idx]))?$record[$table_idx]:0; - $querystring = str_replace("{RECORDID}",$tmp_recordid,$querystring); - unset($tmp_recordid); - - $querystring = str_replace("{AUTHSQL}",$this->getAuthSQL('r'),$querystring); - - // Getting the records - $tmp_records = $app->db->queryAllRecords($querystring); - if($app->db->errorMessage != '') die($app->db->errorMessage); - if(is_array($tmp_records)) { - $key_field = $field["datasource"]["keyfield"]; - $value_field = $field["datasource"]["valuefield"]; - foreach($tmp_records as $tmp_rec) { - $tmp_id = $tmp_rec[$key_field]; - $values[$tmp_id] = $tmp_rec[$value_field]; - } - } - } - - if($field["datasource"]["type"] == 'CUSTOM') { - // Calls a custom class to validate this record - if($field["datasource"]['class'] != '' and $field["datasource"]['function'] != '') { - $datasource_class = $field["datasource"]['class']; - $datasource_function = $field["datasource"]['function']; - $app->uses($datasource_class); - $values = $app->$datasource_class->$datasource_function($field, $record); - } else { - $this->errorMessage .= "Custom datasource class or function is empty
\r\n"; - } - } - - return $values; - + return $this->_getDatasourceData($field, $record, true); } /** @@ -299,366 +185,10 @@ class remoting_lib { * @return record */ function encode($record,$dbencode = true) { - global $app; - if(is_array($record)) { - foreach($this->formDef['fields'] as $key => $field) { - - //* Apply filter to record value - if(isset($field['filters']) && is_array($field['filters'])) { - $record[$key] = $this->filterField($key, (isset($record[$key]))?$record[$key]:'', $field['filters'], 'SAVE'); - } - - //* Validate record value - if(isset($field['validators']) && is_array($field['validators'])) { - $this->validateField($key, (isset($record[$key]))?$record[$key]:'', $field['validators']); - } - - switch ($field['datatype']) { - case 'VARCHAR': - if(!@is_array($record[$key])) { - $new_record[$key] = (isset($record[$key]))?$record[$key]:''; - } else { - $new_record[$key] = implode($field['separator'],$record[$key]); - } - break; - case 'TEXT': - if(!is_array($record[$key])) { - $new_record[$key] = $record[$key]; - } else { - $new_record[$key] = implode($field['separator'],$record[$key]); - } - break; - case 'DATETSTAMP': - if($record[$key] > 0) { - list($tag,$monat,$jahr) = explode('.',$record[$key]); - $new_record[$key] = mktime(0,0,0,$monat,$tag,$jahr); - } else { - $new_record[$key] = 0; - } - break; - case 'DATE': - if($record[$key] != '' && $record[$key] != '0000-00-00') { - if(function_exists('date_parse_from_format')) { - $date_parts = date_parse_from_format($this->dateformat,$record[$key]); - //list($tag,$monat,$jahr) = explode('.',$record[$key]); - $new_record[$key] = $date_parts['year'].'-'.$date_parts['month'].'-'.$date_parts['day']; - //$tmp = strptime($record[$key],$this->dateformat); - //$new_record[$key] = ($tmp['tm_year']+1900).'-'.($tmp['tm_mon']+1).'-'.$tmp['tm_mday']; - } else { - //$tmp = strptime($record[$key],$this->dateformat); - //$new_record[$key] = ($tmp['tm_year']+1900).'-'.($tmp['tm_mon']+1).'-'.$tmp['tm_mday']; - $tmp = strtotime($record[$key]); - $new_record[$key] = date('Y-m-d',$tmp); - } - } else { - $new_record[$key] = '0000-00-00'; - } - break; - case 'INTEGER': - $new_record[$key] = (isset($record[$key]))?$app->functions->intval($record[$key]):0; - //if($new_record[$key] != $record[$key]) $new_record[$key] = $field['default']; - //if($key == 'refresh') die($record[$key]); - break; - case 'DOUBLE': - $new_record[$key] = $record[$key]; - break; - case 'CURRENCY': - $new_record[$key] = str_replace(",",".",$record[$key]); - break; - - case 'DATETIME': - if (is_array($record[$key])) - { - $filtered_values = array_map(create_function('$item','return (int)$item;'), $record[$key]); - extract($filtered_values, EXTR_PREFIX_ALL, '_dt'); - - if ($_dt_day != 0 && $_dt_month != 0 && $_dt_year != 0) { - $new_record[$key] = date( 'Y-m-d H:i:s', mktime($_dt_hour, $_dt_minute, $_dt_second, $_dt_month, $_dt_day, $_dt_year) ); - } - } - break; - } - - // The use of the field value is deprecated, use validators instead - if(isset($field['regex']) && $field['regex'] != '') { - // Enable that "." matches also newlines - $field['regex'] .= 's'; - if(!preg_match($field['regex'], $record[$key])) { - $errmsg = $field['errmsg']; - $this->errorMessage .= $errmsg."\r\n"; - } - } - - //* Add slashes to all records, when we encode data which shall be inserted into mysql. - if($dbencode == true) $new_record[$key] = $app->db->quote($new_record[$key]); - } - } - if(isset($record['_ispconfig_pw_crypted'])) $new_record['_ispconfig_pw_crypted'] = $record['_ispconfig_pw_crypted']; // this one is not in form definitions! - return $new_record; - } - - /** - * process the filters for a given field. - * - * @param field_name = Name of the field - * @param field_value = value of the field - * @param filters = Array of filters - * @param filter_event = 'SAVE'or 'SHOW' - * @return record - */ - - function filterField($field_name, $field_value, $filters, $filter_event) { - - global $app; - $returnval = $field_value; - - //* Loop trough all filters - foreach($filters as $filter) { - if($filter['event'] == $filter_event) { - switch ($filter['type']) { - case 'TOLOWER': - $returnval = strtolower($field_value); - break; - case 'TOUPPER': - $returnval = strtoupper($field_value); - break; - case 'IDNTOASCII': - $returnval = $app->functions->idn_encode($field_value); - break; - case 'IDNTOUTF8': - $returnval = $app->functions->idn_decode($field_value); - break; - default: - $this->errorMessage .= "Unknown Filter: ".$filter['type']; - break; - } - } - } - - return $returnval; - } - - /** - * process the validators for a given field. - * - * @param field_name = Name of the field - * @param field_value = value of the field - * @param validatoors = Array of validators - * @return record - */ - - function validateField($field_name, $field_value, $validators) { - - global $app; - - $escape = '`'; - - // loop trough the validators - foreach($validators as $validator) { - - switch ($validator['type']) { - case 'REGEX': - $validator['regex'] .= 's'; - if(!preg_match($validator['regex'], $field_value)) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - break; - case 'UNIQUE': - if($validator['allowempty'] != 'y') $validator['allowempty'] = 'n'; - if($validator['allowempty'] == 'n' || ($validator['allowempty'] == 'y' && $field_value != '')){ - if($this->action == 'NEW') { - $num_rec = $app->db->queryOneRecord("SELECT count(*) as number FROM ".$escape.$this->formDef['db_table'].$escape. " WHERE $field_name = '".$app->db->quote($field_value)."'"); - if($num_rec["number"] > 0) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } else { - $num_rec = $app->db->queryOneRecord("SELECT count(*) as number FROM ".$escape.$this->formDef['db_table'].$escape. " WHERE $field_name = '".$app->db->quote($field_value)."' AND ".$this->formDef['db_table_idx']." != ".$this->primary_id); - if($num_rec["number"] > 0) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } - } - break; - case 'NOTEMPTY': - if(empty($field_value)) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - break; - case 'ISEMAIL': - if(function_exists('filter_var')) { - if(filter_var($field_value, FILTER_VALIDATE_EMAIL) === false) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } else { - if(!preg_match("/^\w+[\w\.\-\+]*\w{0,}@\w+[\w.-]*\w+\.[a-zA-Z0-9\-]{2,30}$/i", $field_value)) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } - break; - case 'ISINT': - if(function_exists('filter_var')) { - if($field_value != '' && filter_var($field_value, FILTER_VALIDATE_INT) === false) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } else { - $tmpval = $app->functions->intval($field_value); - if($tmpval === 0 and !empty($field_value)) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } - break; - case 'ISPOSITIVE': - if(!is_numeric($field_value) || $field_value <= 0){ - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - break; - case 'ISIPV4': - $vip=1; - if(preg_match("/^[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}$/", $field_value)){ - $groups=explode(".",$field_value); - foreach($groups as $group){ - if($group<0 OR $group>255) - $vip=0; - } - }else{$vip=0;} - if($vip==0) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - break; - case 'ISIP': - if($validator['allowempty'] != 'y') $validator['allowempty'] = 'n'; - if($validator['allowempty'] == 'y' && $field_value == '') { - //* Do nothing - } else { - //* Check if its a IPv4 or IPv6 address - if(isset($validator['separator']) && $validator['separator'] != '') { - //* When the field may contain several IP addresses, split them by the char defined as separator - $field_value_array = explode($validator['separator'],$field_value); - } else { - $field_value_array[] = $field_value; - } - foreach($field_value_array as $field_value) { - if(function_exists('filter_var')) { - if(!filter_var($field_value,FILTER_VALIDATE_IP)) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } else { - //* Check content with regex, if we use php < 5.2 - $ip_ok = 0; - if(preg_match("/^(\:\:([a-f0-9]{1,4}\:){0,6}?[a-f0-9]{0,4}|[a-f0-9]{1,4}(\:[a-f0-9]{1,4}){0,6}?\:\:|[a-f0-9]{1,4}(\:[a-f0-9]{1,4}){1,6}?\:\:([a-f0-9]{1,4}\:){1,6}?[a-f0-9]{1,4})(\/\d{1,3})?$/i", $field_value)){ - $ip_ok = 1; - } - if(preg_match("/^[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}$/", $field_value)){ - $ip_ok = 1; - } - if($ip_ok == 0) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } - } - } - break; - case 'RANGE': - //* Checks if the value is within the given range or above / below a value - //* Range examples: < 10 = ":10", between 2 and 10 = "2:10", above 5 = "5:". - $range_parts = explode(':',trim($validator['range'])); - $ok = true; - if($range_parts[0] != '' && $field_value < $range_parts[0]) { - $ok = false; - } - if($range_parts[1] != '' && $field_value > $range_parts[1]) { - $ok = false; - } - if($ok != true) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - unset($range_parts); - break; - case 'CUSTOM': - // Calls a custom class to validate this record - if($validator['class'] != '' and $validator['function'] != '') { - $validator_class = $validator['class']; - $validator_function = $validator['function']; - $app->uses($validator_class); - $this->errorMessage .= $app->$validator_class->$validator_function($field_name, $field_value, $validator); - } else { - $this->errorMessage .= "Custom validator class or function is empty
\r\n"; - } - break; - default: - $this->errorMessage .= "Unknown Validator: ".$validator['type']; - break; - } - - - } - - return true; + $new_record = $this->_encode($record, '', $dbencode, true); + if(isset($record['_ispconfig_pw_crypted'])) $new_record['_ispconfig_pw_crypted'] = $record['_ispconfig_pw_crypted']; // this one is not in form definitions! + + return $new_record; } /** @@ -673,132 +203,11 @@ class remoting_lib { global $app; - $this->action = $action; - $this->primary_id = $primary_id; - $this->dataRecord = $record; - - $record = $this->encode($record,true); - $sql_insert_key = ''; - $sql_insert_val = ''; - $sql_update = ''; - if(!is_array($this->formDef)) $app->error("Form definition not found."); - - // go trough all fields of the tab - if(is_array($record)) { - foreach($this->formDef['fields'] as $key => $field) { - // Wenn es kein leeres Passwortfeld ist - if (!($field['formtype'] == 'PASSWORD' and $record[$key] == '')) { - // Erzeuge Insert oder Update Quelltext - if($action == "INSERT") { - if($field['formtype'] == 'PASSWORD') { - $sql_insert_key .= "`$key`, "; - if ((isset($field['encryption']) && $field['encryption'] == 'CLEARTEXT') || (isset($record['_ispconfig_pw_crypted']) && $record['_ispconfig_pw_crypted'] == 1)) { - $sql_insert_val .= "'".$app->db->quote($record[$key])."', "; - } elseif(isset($field['encryption']) && $field['encryption'] == 'CRYPT') { - $record[$key] = $app->auth->crypt_password(stripslashes($record[$key])); - $sql_insert_val .= "'".$app->db->quote($record[$key])."', "; - } elseif (isset($field['encryption']) && $field['encryption'] == 'MYSQL') { - $tmp = $app->db->queryOneRecord("SELECT PASSWORD('".$app->db->quote(stripslashes($record[$key]))."') as `crypted`"); - $record[$key] = $tmp['crypted']; - $sql_insert_val .= "'".$app->db->quote($record[$key])."', "; - } else { - $record[$key] = md5(stripslashes($record[$key])); - $sql_insert_val .= "'".$app->db->quote($record[$key])."', "; - } - - } elseif ($field['formtype'] == 'CHECKBOX') { - $sql_insert_key .= "`$key`, "; - if($record[$key] == '') { - // if a checkbox is not set, we set it to the unchecked value - $sql_insert_val .= "'".$field['value'][0]."', "; - $record[$key] = $field['value'][0]; - } else { - $sql_insert_val .= "'".$record[$key]."', "; - } - } else { - $sql_insert_key .= "`$key`, "; - $sql_insert_val .= "'".$record[$key]."', "; - } - } else { - if($field['formtype'] == 'PASSWORD') { - if ((isset($field['encryption']) && $field['encryption'] == 'CLEARTEXT') || (isset($record['_ispconfig_pw_crypted']) && $record['_ispconfig_pw_crypted'] == 1)) { - $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', "; - } elseif(isset($field['encryption']) && $field['encryption'] == 'CRYPT') { - $record[$key] = $app->auth->crypt_password(stripslashes($record[$key])); - $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', "; - } elseif (isset($field['encryption']) && $field['encryption'] == 'MYSQL') { - $tmp = $app->db->queryOneRecord("SELECT PASSWORD('".$app->db->quote(stripslashes($record[$key]))."') as `crypted`"); - $record[$key] = $tmp['crypted']; - $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', "; - } else { - $record[$key] = md5(stripslashes($record[$key])); - $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', "; - } - - } elseif ($field['formtype'] == 'CHECKBOX') { - if($record[$key] == '') { - // if a checkbox is not set, we set it to the unchecked value - $sql_update .= "`$key` = '".$field['value'][0]."', "; - $record[$key] = $field['value'][0]; - } else { - $sql_update .= "`$key` = '".$record[$key]."', "; - } - } else { - $sql_update .= "`$key` = '".$record[$key]."', "; - } - } - } else { - // we unset the password filed, if empty to tell the datalog function - // that the password has not been changed - unset($record[$key]); - } - } - } - - - // Add backticks for incomplete table names - if(stristr($this->formDef['db_table'],'.')) { - $escape = ''; - } else { - $escape = '`'; - } - - - if($action == "INSERT") { - if($this->formDef['auth'] == 'yes') { - // Set user and group - $sql_insert_key .= "`sys_userid`, "; - $sql_insert_val .= ($this->formDef["auth_preset"]["userid"] > 0)?"'".$this->formDef["auth_preset"]["userid"]."', ":"'".$this->sys_userid."', "; - $sql_insert_key .= "`sys_groupid`, "; - $sql_insert_val .= ($this->formDef["auth_preset"]["groupid"] > 0)?"'".$this->formDef["auth_preset"]["groupid"]."', ":"'".$this->sys_default_group."', "; - $sql_insert_key .= "`sys_perm_user`, "; - $sql_insert_val .= "'".$this->formDef["auth_preset"]["perm_user"]."', "; - $sql_insert_key .= "`sys_perm_group`, "; - $sql_insert_val .= "'".$this->formDef["auth_preset"]["perm_group"]."', "; - $sql_insert_key .= "`sys_perm_other`, "; - $sql_insert_val .= "'".$this->formDef["auth_preset"]["perm_other"]."', "; - } - $sql_insert_key = substr($sql_insert_key,0,-2); - $sql_insert_val = substr($sql_insert_val,0,-2); - $sql = "INSERT INTO ".$escape.$this->formDef['db_table'].$escape." ($sql_insert_key) VALUES ($sql_insert_val)"; - } else { - if($primary_id != 0) { - // update client permissions only if client_id > 0 - if($this->formDef['auth'] == 'yes' && $this->client_id > 0 && $this->sys_userid > 0 && $this->sys_default_group > 0) { - $sql_update .= '`sys_userid` = '.$this->sys_userid.', '; - $sql_update .= '`sys_groupid` = '.$this->sys_default_group.', '; - } - $sql_update = substr($sql_update,0,-2); - $sql = "UPDATE ".$escape.$this->formDef['db_table'].$escape." SET ".$sql_update." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id; - if($sql_ext_where != '') $sql .= " and ".$sql_ext_where; - } else { - $app->error("Primary ID fehlt!"); - } - } - - return $sql; - } + $this->dataRecord = $record; + + return $this->_getSQL($record, '', $action, $primary_id, $sql_ext_where, true); + } function getDeleteSQL($primary_id) { @@ -808,17 +217,15 @@ class remoting_lib { $escape = '`'; } - $sql = "DELETE FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id; + $sql = "DELETE FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id. " AND " . $this->getAuthSQL('d', $this->formDef['db_table']); return $sql; } - function getDataRecord($primary_id) { global $app; $escape = '`'; if(@is_numeric($primary_id)) { - $sql = "SELECT * FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id; - return $app->db->queryOneRecord($sql); + return parent::getDataRecord($primary_id); } elseif (@is_array($primary_id) || @is_object($primary_id)) { if(@is_object($primary_id)) $primary_id = get_object_vars($primary_id); // do not use cast (array)xxx because it returns private and protected properties! $sql_offset = 0; @@ -837,15 +244,13 @@ class remoting_lib { } $sql_where = substr($sql_where,0,-5); if($sql_where == '') $sql_where = '1'; - $sql = "SELECT * FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$sql_where; + $sql = "SELECT * FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$sql_where. " AND " . $this->getAuthSQL('r', $this->formDef['db_table']); if($sql_offset >= 0 && $sql_limit > 0) $sql .= ' LIMIT ' . $sql_offset . ',' . $sql_limit; - return $app->db->queryAllRecords($sql); + return $app->db->queryAllRecords($sql); } else { $this->errorMessage = 'The ID must be either an integer or an array.'; return array(); } - - } function ispconfig_sysuser_add($params,$insert_id){ @@ -904,92 +309,6 @@ class remoting_lib { $app->db->query($sql); } - function datalogSave($action,$primary_id, $record_old, $record_new) { - global $app,$conf; - - $app->db->datalogSave($this->formDef['db_table'], $action, $this->formDef['db_table_idx'], $primary_id, $record_old, $record_new); - return true; - - /* - // Add backticks for incomplete table names. - if(stristr($this->formDef['db_table'],'.')) { - $escape = ''; - } else { - $escape = '`'; - } - - $diffrec = array(); - - if(is_array($record_new) && count($record_new) > 0) { - foreach($record_new as $key => $val) { - if($record_old[$key] != $val) { - // Record has changed - $diffrec[$key] = array('old' => $record_old[$key], - 'new' => $val); - } - } - } elseif(is_array($record_old)) { - foreach($record_old as $key => $val) { - if($record_new[$key] != $val) { - // Record has changed - $diffrec[$key] = array('new' => $record_new[$key], - 'old' => $val); - } - } - } - $this->diffrec = $diffrec; - - - // Full diff records for ISPConfig, they have a different format then the simple diffrec - $diffrec_full = array(); - - if(is_array($record_old) && count($record_old) > 0) { - foreach($record_old as $key => $val) { - if(isset($record_new[$key]) && $record_new[$key] != $val) { - // Record has changed - $diffrec_full['old'][$key] = $val; - $diffrec_full['new'][$key] = $record_new[$key]; - } else { - $diffrec_full['old'][$key] = $val; - $diffrec_full['new'][$key] = $val; - } - } - } elseif(is_array($record_new)) { - foreach($record_new as $key => $val) { - if(isset($record_new[$key]) && $record_old[$key] != $val) { - // Record has changed - $diffrec_full['new'][$key] = $val; - $diffrec_full['old'][$key] = $record_old[$key]; - } else { - $diffrec_full['new'][$key] = $val; - $diffrec_full['old'][$key] = $val; - } - } - } - - - // Insert the server_id, if the record has a server_id - $server_id = (isset($record_old["server_id"]) && $record_old["server_id"] > 0)?$record_old["server_id"]:0; - if(isset($record_new["server_id"])) $server_id = $record_new["server_id"]; - - if(count($this->diffrec) > 0) { - $diffstr = $app->db->quote(serialize($diffrec_full)); - $username = $app->db->quote($this->sys_username); - $dbidx = $this->formDef['db_table_idx'].":".$primary_id; - // $action = ($action == 'INSERT')?'i':'u'; - - if($action == 'INSERT') $action = 'i'; - if($action == 'UPDATE') $action = 'u'; - if($action == 'DELETE') $action = 'd'; - $sql = "INSERT INTO sys_datalog (dbtable,dbidx,server_id,action,tstamp,user,data) VALUES ('".$this->formDef['db_table']."','$dbidx','$server_id','$action','".time()."','$username','$diffstr')"; - $app->db->query($sql); - } - - return true; - */ - - } - } ?> diff --git a/interface/lib/classes/tform.inc.php b/interface/lib/classes/tform.inc.php index f4ea0d7de..cca554014 100644 --- a/interface/lib/classes/tform.inc.php +++ b/interface/lib/classes/tform.inc.php @@ -58,1300 +58,8 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * */ -class tform { - - /** - * Definition of the database table (array) - * @var tableDef - */ - var $tableDef; - - /** - * Private - * @var action - */ - var $action; - - /** - * Table name (String) - * @var table_name - */ - var $table_name; - - /** - * Debug Variable - * @var debug - */ - var $debug = 0; - - /** - * name of the primary field of the database table (string) - * @var table_index - */ - var $table_index; - - /** - * contains the error messages - * @var errorMessage - */ - var $errorMessage = ''; - - var $dateformat = "d.m.Y"; - var $formDef = array(); - var $wordbook; - var $module; - var $primary_id; - var $diffrec = array(); - - /** - * Loading of the table definition - * - * @param file: path to the form definition file - * @return true - */ - /* - function loadTableDef($file) { - global $app,$conf; - - include_once($file); - $this->tableDef = $table; - $this->table_name = $table_name; - $this->table_index = $table_index; - return true; - } - */ - - function loadFormDef($file,$module = '') { - global $app,$conf; - - include($file); - $this->formDef = $form; - - $this->module = $module; - $wb = array(); - - include_once(ISPC_ROOT_PATH.'/lib/lang/'.$_SESSION['s']['language'].'.lng'); - - if(is_array($wb)) $wb_global = $wb; - - if($module == '') { - $lng_file = "lib/lang/".$_SESSION["s"]["language"]."_".$this->formDef["name"].".lng"; - if(!file_exists($lng_file)) $lng_file = "lib/lang/en_".$this->formDef["name"].".lng"; - include($lng_file); - } else { - $lng_file = "../$module/lib/lang/".$_SESSION["s"]["language"]."_".$this->formDef["name"].".lng"; - if(!file_exists($lng_file)) $lng_file = "../$module/lib/lang/en_".$this->formDef["name"].".lng"; - include($lng_file); - } - - if(is_array($wb_global)) { - $wb = $app->functions->array_merge($wb_global,$wb); - } - if(isset($wb_global)) unset($wb_global); - - $this->wordbook = $wb; - - $this->dateformat = $app->lng('conf_format_dateshort'); - - return true; - } - - - /** - * Converts the data in the array to human readable format - * Datatype conversion e.g. to show the data in lists - * - * @param record - * @return record - */ - function decode($record,$tab) { - global $conf, $app; - if(!is_array($this->formDef['tabs'][$tab])) $app->error("Tab does not exist or the tab is empty (TAB: $tab)."); - $new_record = ''; - $table_idx = $this->formDef['db_table_idx']; - if(isset($record[$table_idx])) $new_record[$table_idx] = $app->functions->intval($record[$table_idx ]); - - if(is_array($record)) { - foreach($this->formDef['tabs'][$tab]['fields'] as $key => $field) { - - //* Apply filter to record value. - if(isset($field['filters']) && is_array($field['filters'])) { - $record[$key] = $this->filterField($key, (isset($record[$key]))?$record[$key]:'', $field['filters'], 'SHOW'); - } - - switch ($field['datatype']) { - case 'VARCHAR': - $new_record[$key] = $record[$key]; - break; - - case 'TEXT': - $new_record[$key] = $record[$key]; - break; - - case 'DATETSTAMP': - if($record[$key] > 0) { - $new_record[$key] = date($this->dateformat,$record[$key]); - } - break; - - case 'DATE': - if($record[$key] != '' && $record[$key] != '0000-00-00') { - $tmp = explode('-',$record[$key]); - $new_record[$key] = date($this->dateformat,mktime(0, 0, 0, $tmp[1] , $tmp[2], $tmp[0])); - } - break; - - case 'INTEGER': - $new_record[$key] = $app->functions->intval($record[$key]); - break; - - case 'DOUBLE': - $new_record[$key] = $record[$key]; - break; - - case 'CURRENCY': - $new_record[$key] = $app->functions->currency_format($record[$key]); - break; - - default: - $new_record[$key] = $record[$key]; - } - } - - } - - return $new_record; - } - - /** - * Get the key => value array of a form filled from a datasource definitiom - * - * @param field = array with field definition - * @param record = Dataset as array - * @return key => value array for the value field of a form - */ - - function getDatasourceData($field, $record) { - global $app; - - $values = array(); - - if($field["datasource"]["type"] == 'SQL') { - - // Preparing SQL string. We will replace some - // common placeholders - $querystring = $field["datasource"]["querystring"]; - $querystring = str_replace("{USERID}",$_SESSION["s"]["user"]["userid"],$querystring); - $querystring = str_replace("{GROUPID}",$_SESSION["s"]["user"]["default_group"],$querystring); - $querystring = str_replace("{GROUPS}",$_SESSION["s"]["user"]["groups"],$querystring); - $table_idx = $this->formDef['db_table_idx']; - - $tmp_recordid = (isset($record[$table_idx]))?$record[$table_idx]:0; - $querystring = str_replace("{RECORDID}",$tmp_recordid,$querystring); - unset($tmp_recordid); - - $querystring = str_replace("{AUTHSQL}",$this->getAuthSQL('r'),$querystring); - - // Getting the records - $tmp_records = $app->db->queryAllRecords($querystring); - if($app->db->errorMessage != '') die($app->db->errorMessage); - if(is_array($tmp_records)) { - $key_field = $field["datasource"]["keyfield"]; - $value_field = $field["datasource"]["valuefield"]; - foreach($tmp_records as $tmp_rec) { - $tmp_id = $tmp_rec[$key_field]; - $values[$tmp_id] = $tmp_rec[$value_field]; - } - } - } - - if($field["datasource"]["type"] == 'CUSTOM') { - // Calls a custom class to validate this record - if($field["datasource"]['class'] != '' and $field["datasource"]['function'] != '') { - $datasource_class = $field["datasource"]['class']; - $datasource_function = $field["datasource"]['function']; - $app->uses($datasource_class); - $values = $app->$datasource_class->$datasource_function($field, $record); - } else { - $this->errorMessage .= "Custom datasource class or function is empty
\r\n"; - } - } - - if(isset($field['filters']) && is_array($field['filters'])) { - $new_values = array(); - foreach($values as $index => $value) { - $new_index = $this->filterField($index, $index, $field['filters'], 'SHOW'); - $new_values[$new_index] = $this->filterField($index, (isset($values[$index]))?$values[$index]:'', $field['filters'], 'SHOW'); - } - $values = $new_values; - unset($new_values); - unset($new_index); - } - - return $values; - - } - - //* If the parameter 'valuelimit' is set - function applyValueLimit($limit,$values) { - - global $app; - - $limit_parts = explode(':',$limit); - - //* values are limited to a comma separated list - if($limit_parts[0] == 'list') { - $allowed = explode(',',$limit_parts[1]); - } - - //* values are limited to a field in the client settings - if($limit_parts[0] == 'client') { - if($_SESSION["s"]["user"]["typ"] == 'admin') { - return $values; - } else { - $client_group_id = $_SESSION["s"]["user"]["default_group"]; - $client = $app->db->queryOneRecord("SELECT ".$limit_parts[1]." as lm FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id"); - $allowed = explode(',',$client['lm']); - } - } - - //* values are limited to a field in the reseller settings - if($limit_parts[0] == 'reseller') { - if($_SESSION["s"]["user"]["typ"] == 'admin') { - return $values; - } else { - //* Get the limits of the client that is currently logged in - $client_group_id = $_SESSION["s"]["user"]["default_group"]; - $client = $app->db->queryOneRecord("SELECT parent_client_id FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id"); - //echo "SELECT parent_client_id FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id"; - //* If the client belongs to a reseller, we will check against the reseller Limit too - if($client['parent_client_id'] != 0) { - - //* first we need to know the groups of this reseller - $tmp = $app->db->queryOneRecord("SELECT userid, groups FROM sys_user WHERE client_id = ".$client['parent_client_id']); - $reseller_groups = $tmp["groups"]; - $reseller_userid = $tmp["userid"]; - - // Get the limits of the reseller of the logged in client - $client_group_id = $_SESSION["s"]["user"]["default_group"]; - $reseller = $app->db->queryOneRecord("SELECT ".$limit_parts[1]." as lm FROM client WHERE client_id = ".$client['parent_client_id']); - $allowed = explode(',',$reseller['lm']); - } else { - return $values; - } - } // end if admin - } // end if reseller - - //* values are limited to a field in the system settings - if($limit_parts[0] == 'system') { - $app->uses('getconf'); - $tmp_conf = $app->getconf->get_global_config($limit_parts[1]); - $tmp_key = $limit_parts[2]; - $allowed = $tmp_conf[$tmp_key]; - } - - $values_new = array(); - foreach($values as $key => $val) { - if(in_array($key,$allowed)) $values_new[$key] = $val; - } - - return $values_new; - } - - - /** - * Prepare the data record to show the data in a form. - * - * @param record = Datensatz als Array - * @param action = NEW oder EDIT - * @return record - */ - function getHTML($record, $tab, $action = 'NEW') { - - global $app; - - $this->action = $action; - - if(!is_array($this->formDef)) $app->error("No form definition found."); - if(!is_array($this->formDef['tabs'][$tab])) $app->error("The tab is empty or does not exist (TAB: $tab)."); - - $new_record = array(); - if($action == 'EDIT') { - $record = $this->decode($record,$tab); - if(is_array($record)) { - foreach($this->formDef['tabs'][$tab]['fields'] as $key => $field) { - - if(isset($record[$key])) { - $val = $record[$key]; - } else { - $val = ''; - } - - // If Datasource is set, get the data from there - if(isset($field['datasource']) && is_array($field['datasource'])) { - if(is_array($field["value"])) { - //$field["value"] = array_merge($field["value"],$this->getDatasourceData($field, $record)); - $field["value"] = $app->functions->array_merge($field["value"],$this->getDatasourceData($field, $record)); - } else { - $field["value"] = $this->getDatasourceData($field, $record); - } - } - - // If a limitation for the values is set - if(isset($field['valuelimit']) && is_array($field["value"])) { - $field["value"] = $this->applyValueLimit($field['valuelimit'],$field["value"]); - } - - switch ($field['formtype']) { - case 'SELECT': - $out = ''; - if(is_array($field['value'])) { - foreach($field['value'] as $k => $v) { - $selected = ($k == $val)?' SELECTED':''; - if(!empty($this->wordbook[$v])) - $v = $this->wordbook[$v]; - $out .= "\r\n"; - } - } - $new_record[$key] = $out; - break; - case 'MULTIPLE': - if(is_array($field['value'])) { - - // Split - $vals = explode($field['separator'],$val); - - // write HTML - $out = ''; - foreach($field['value'] as $k => $v) { - - $selected = ''; - foreach($vals as $tvl) { - if(trim($tvl) == trim($k)) $selected = ' SELECTED'; - } - - $out .= "\r\n"; - } - } - $new_record[$key] = $out; - break; - - case 'PASSWORD': - $new_record[$key] = ''; - break; - - case 'CHECKBOX': - $checked = ($val == $field['value'][1])?' CHECKED':''; - $new_record[$key] = "\r\n"; - break; - - case 'CHECKBOXARRAY': - if(is_array($field['value'])) { - - // aufsplitten ergebnisse - $vals = explode($field['separator'],$val); - - // HTML schreiben - $out = ''; - $elementNo = 0; - foreach($field['value'] as $k => $v) { - - $checked = ''; - foreach($vals as $tvl) { - if(trim($tvl) == trim($k)) $checked = ' CHECKED'; - } - // $out .= "\r\n"; - $out .= "
\r\n"; - $elementNo++; - } - } - $new_record[$key] = $out; - break; - - case 'RADIO': - if(is_array($field['value'])) { - - // HTML schreiben - $out = ''; - $elementNo = 0; - foreach($field['value'] as $k => $v) { - $checked = ($k == $val)?' CHECKED':''; - //$out .= "\r\n"; - $out .= "\r\n"; - $elementNo++; - } - } - $new_record[$key] = $out; - break; - - case 'DATETIME': - if (strtotime($val) !== false) { - $dt_value = $val; - } elseif ( isset($field['default']) && (strtotime($field['default']) !== false) ) { - $dt_value = $field['default']; - } else { - $dt_value = 0; - } - - $display_seconds = (isset($field['display_seconds']) && $field['display_seconds'] == true) ? true : false; - - $new_record[$key] = $this->_getDateTimeHTML($key, $dt_value, $display_seconds); - break; - - default: - if(isset($record[$key])) { - $new_record[$key] = htmlspecialchars($record[$key]); - } else { - $new_record[$key] = ''; - } - } - } - } - } else { - // Action: NEW - foreach($this->formDef['tabs'][$tab]['fields'] as $key => $field) { - - // If Datasource is set, get the data from there - if(@is_array($field['datasource'])) { - if(is_array($field["value"])) { - $field["value"] = $app->functions->array_merge($field["value"],$this->getDatasourceData($field, $record)); - } else { - $field["value"] = $this->getDatasourceData($field, $record); - } - } - - // If a limitation for the values is set - if(isset($field['valuelimit']) && is_array($field["value"])) { - $field["value"] = $this->applyValueLimit($field['valuelimit'],$field["value"]); - } - - switch ($field['formtype']) { - case 'SELECT': - if(is_array($field['value'])) { - $out = ''; - foreach($field['value'] as $k => $v) { - $selected = ($k == $field["default"])?' SELECTED':''; - $out .= "\r\n"; - } - } - if(isset($out)) $new_record[$key] = $out; - break; - case 'MULTIPLE': - if(is_array($field['value'])) { - - // aufsplitten ergebnisse - $vals = explode($field['separator'],$val); - - // HTML schreiben - $out = ''; - foreach($field['value'] as $k => $v) { - - $out .= "\r\n"; - } - } - $new_record[$key] = $out; - break; - - case 'PASSWORD': - //$new_record[$key] = ''; - $new_record[$key] = htmlspecialchars($field['default']); - break; - - case 'CHECKBOX': - // $checked = (empty($field["default"]))?'':' CHECKED'; - $checked = ($field["default"] == $field['value'][1])?' CHECKED':''; - $new_record[$key] = "\r\n"; - break; - - case 'CHECKBOXARRAY': - if(is_array($field['value'])) { - - // aufsplitten ergebnisse - $vals = explode($field['separator'],$field["default"]); - - // HTML schreiben - $out = ''; - $elementNo = 0; - foreach($field['value'] as $k => $v) { - - $checked = ''; - foreach($vals as $tvl) { - if(trim($tvl) == trim($k)) $checked = ' CHECKED'; - } - // $out .= "\r\n"; - $out .= "  \r\n"; - $elementNo++; - } - } - $new_record[$key] = $out; - break; - - case 'RADIO': - if(is_array($field['value'])) { - - // HTML schreiben - $out = ''; - $elementNo = 0; - foreach($field['value'] as $k => $v) { - $checked = ($k == $field["default"])?' CHECKED':''; - //$out .= "\r\n"; - $out .= "\r\n"; - $elementNo++; - } - } - $new_record[$key] = $out; - break; - - case 'DATETIME': - $dt_value = (isset($field['default'])) ? $field['default'] : 0; - $display_seconds = (isset($field['display_seconds']) && $field['display_seconds'] == true) ? true : false; - - $new_record[$key] = $this->_getDateTimeHTML($key, $dt_value, $display_seconds); - break; - - default: - $new_record[$key] = htmlspecialchars($field['default']); - } - } - - } - - if($this->debug == 1) $this->dbg($new_record); - - return $new_record; - } - - /** - * Rewrite the record data to be stored in the database - * and check values with regular expressions. - * - * @param record = Datensatz als Array - * @return record - */ - function encode($record,$tab,$dbencode = true) { - global $app; - - if(!is_array($this->formDef['tabs'][$tab])) $app->error("Tab is empty or does not exist (TAB: $tab)."); - //$this->errorMessage = ''; - - if(is_array($record)) { - foreach($this->formDef['tabs'][$tab]['fields'] as $key => $field) { - - //* Apply filter to record value - if(isset($field['filters']) && is_array($field['filters'])) { - $record[$key] = $this->filterField($key, (isset($record[$key]))?$record[$key]:'', $field['filters'], 'SAVE'); - } - //* Validate record value - if(isset($field['validators']) && is_array($field['validators'])) { - $this->validateField($key, (isset($record[$key]))?$record[$key]:'', $field['validators']); - } - - switch ($field['datatype']) { - case 'VARCHAR': - if(!@is_array($record[$key])) { - $new_record[$key] = (isset($record[$key]))?$record[$key]:''; - } else { - $new_record[$key] = implode($field['separator'],$record[$key]); - } - break; - case 'TEXT': - if(!is_array($record[$key])) { - $new_record[$key] = $record[$key]; - } else { - $new_record[$key] = implode($field['separator'],$record[$key]); - } - break; - case 'DATETSTAMP': - if($record[$key] > 0) { - list($tag,$monat,$jahr) = explode('.',$record[$key]); - $new_record[$key] = mktime(0,0,0,$monat,$tag,$jahr); - } else { - $new_record[$key] = 0; - } - break; - case 'DATE': - if($record[$key] != '' && $record[$key] != '0000-00-00') { - if(function_exists('date_parse_from_format')) { - $date_parts = date_parse_from_format($this->dateformat,$record[$key]); - //list($tag,$monat,$jahr) = explode('.',$record[$key]); - $new_record[$key] = $date_parts['year'].'-'.$date_parts['month'].'-'.$date_parts['day']; - //$tmp = strptime($record[$key],$this->dateformat); - //$new_record[$key] = ($tmp['tm_year']+1900).'-'.($tmp['tm_mon']+1).'-'.$tmp['tm_mday']; - } else { - //$tmp = strptime($record[$key],$this->dateformat); - //$new_record[$key] = ($tmp['tm_year']+1900).'-'.($tmp['tm_mon']+1).'-'.$tmp['tm_mday']; - $tmp = strtotime($record[$key]); - $new_record[$key] = date('Y-m-d',$tmp); - } - } else { - $new_record[$key] = '0000-00-00'; - } - break; - case 'INTEGER': - $new_record[$key] = (isset($record[$key]))?$app->functions->intval($record[$key]):0; - //if($new_record[$key] != $record[$key]) $new_record[$key] = $field['default']; - //if($key == 'refresh') die($record[$key]); - break; - case 'DOUBLE': - $new_record[$key] = $record[$key]; - break; - case 'CURRENCY': - $new_record[$key] = str_replace(",",".",$record[$key]); - break; - - case 'DATETIME': - if (is_array($record[$key])) - { - $filtered_values = array_map(create_function('$item','return (int)$item;'), $record[$key]); - extract($filtered_values, EXTR_PREFIX_ALL, '_dt'); - - if ($_dt_day != 0 && $_dt_month != 0 && $_dt_year != 0) { - $new_record[$key] = date( 'Y-m-d H:i:s', mktime($_dt_hour, $_dt_minute, $_dt_second, $_dt_month, $_dt_day, $_dt_year) ); - } - } - break; - } - - // The use of the field value is deprecated, use validators instead - if(isset($field['regex']) && $field['regex'] != '') { - // Enable that "." matches also newlines - $field['regex'] .= 's'; - if(!preg_match($field['regex'], $record[$key])) { - $errmsg = $field['errmsg']; - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } - } - - //* Add slashes to all records, when we encode data which shall be inserted into mysql. - if($dbencode == true) $new_record[$key] = $app->db->quote($new_record[$key]); - } - } - return $new_record; - } - - /** - * process the filters for a given field. - * - * @param field_name = Name of the field - * @param field_value = value of the field - * @param filters = Array of filters - * @param filter_event = 'SAVE'or 'SHOW' - * @return record - */ - - function filterField($field_name, $field_value, $filters, $filter_event) { - - global $app; - $returnval = $field_value; - - //* Loop trough all filters - foreach($filters as $filter) { - if($filter['event'] == $filter_event) { - switch ($filter['type']) { - case 'TOLOWER': - $returnval = strtolower($returnval); - break; - case 'TOUPPER': - $returnval = strtoupper($returnval); - break; - case 'IDNTOASCII': - $returnval = $app->functions->idn_encode($returnval); - break; - case 'IDNTOUTF8': - $returnval = $app->functions->idn_decode($returnval); - break; - default: - $this->errorMessage .= "Unknown Filter: ".$filter['type']; - break; - } - } - } - return $returnval; - } - - /** - * process the validators for a given field. - * - * @param field_name = Name of the field - * @param field_value = value of the field - * @param validatoors = Array of validators - * @return record - */ - - function validateField($field_name, $field_value, $validators) { - - global $app; - - $escape = '`'; - - // loop trough the validators - foreach($validators as $validator) { - - switch ($validator['type']) { - case 'REGEX': - $validator['regex'] .= 's'; - if(!preg_match($validator['regex'], $field_value)) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - break; - case 'UNIQUE': - if($validator['allowempty'] != 'y') $validator['allowempty'] = 'n'; - if($validator['allowempty'] == 'n' || ($validator['allowempty'] == 'y' && $field_value != '')){ - if($this->action == 'NEW') { - $num_rec = $app->db->queryOneRecord("SELECT count(*) as number FROM ".$escape.$this->formDef['db_table'].$escape. " WHERE $field_name = '".$app->db->quote($field_value)."'"); - if($num_rec["number"] > 0) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } else { - $num_rec = $app->db->queryOneRecord("SELECT count(*) as number FROM ".$escape.$this->formDef['db_table'].$escape. " WHERE $field_name = '".$app->db->quote($field_value)."' AND ".$this->formDef['db_table_idx']." != ".$this->primary_id); - if($num_rec["number"] > 0) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } - } - break; - case 'NOTEMPTY': - if(empty($field_value)) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - break; - case 'ISEMAIL': - if(function_exists('filter_var')) { - if(filter_var($field_value, FILTER_VALIDATE_EMAIL) === false) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } else { - if(!preg_match("/^\w+[\w\.\-\+]*\w{0,}@\w+[\w.-]*\w+\.[a-zA-Z0-9\-]{2,30}$/i", $field_value)) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } - break; - case 'ISINT': - if(function_exists('filter_var') && $field_value < 2147483647) { - if($field_value != '' && filter_var($field_value, FILTER_VALIDATE_INT) === false) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } else { - $tmpval = $app->functions->intval($field_value); - if($tmpval === 0 and !empty($field_value)) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } - break; - case 'ISPOSITIVE': - if(!is_numeric($field_value) || $field_value <= 0){ - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - break; - case 'ISV6PREFIX': - $v6_prefix_ok = 0; - $explode_field_value = explode(':',$field_value); - if ($explode_field_value[count($explode_field_value)-1]=='' && $explode_field_value[count($explode_field_value)-2]=='' ){ - if ( count($explode_field_value) <= 9 ) { - if(filter_var(substr($field_value,0,strlen($field_value)-2),FILTER_VALIDATE_IP,FILTER_FLAG_IPV6) or filter_var(substr($field_value,0,strlen($field_value)-2).'::0',FILTER_VALIDATE_IP,FILTER_FLAG_IPV6) or filter_var(substr($field_value,0,strlen($field_value)-2).':0',FILTER_VALIDATE_IP,FILTER_FLAG_IPV6) ) { - $v6_prefix_ok = 1; - } - } - } else { - $v6_prefix_ok = 2; - } - // check subnet against defined server-ipv6 - $sql_v6 = $app->db->queryOneRecord("SELECT ip_address FROM server_ip WHERE ip_type = 'IPv6' AND virtualhost = 'y' LIMIT 0,1"); - $sql_v6_explode=explode(':',$sql_v6['ip_address']); - if ( count($sql_v6_explode) < count($explode_field_value) && isset($sql_v6['ip_address']) ) { - $v6_prefix_ok = 3; - } - if($v6_prefix_ok == 0) { - $errmsg = $validator['errmsg']; - } - if($v6_prefix_ok == 2) { - $errmsg = 'IPv6 Prefix must end with ::'; - } - if($v6_prefix_ok == 3) { - $errmsg = 'IPv6 Prefix too long (according to Server IP Addresses)'; - } - if($v6_prefix_ok <> 1){ - $this->errorMessage .= $errmsg."
\r\n"; - } - break; - case 'ISIPV4': - $vip=1; - if(preg_match("/^[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}$/", $field_value)){ - $groups=explode(".",$field_value); - foreach($groups as $group){ - if($group<0 OR $group>255) - $vip=0; - } - }else{$vip=0;} - if($vip==0) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - break; - case 'ISIP': - if($validator['allowempty'] != 'y') $validator['allowempty'] = 'n'; - if($validator['allowempty'] == 'y' && $field_value == '') { - //* Do nothing - } else { - //* Check if its a IPv4 or IPv6 address - if(isset($validator['separator']) && $validator['separator'] != '') { - //* When the field may contain several IP addresses, split them by the char defined as separator - $field_value_array = explode($validator['separator'],$field_value); - } else { - $field_value_array[] = $field_value; - } - foreach($field_value_array as $field_value) { - $field_value = trim($field_value); - if(function_exists('filter_var')) { - if(!filter_var($field_value,FILTER_VALIDATE_IP)) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } else { - //* Check content with regex, if we use php < 5.2 - $ip_ok = 0; - if(preg_match("/^(\:\:([a-f0-9]{1,4}\:){0,6}?[a-f0-9]{0,4}|[a-f0-9]{1,4}(\:[a-f0-9]{1,4}){0,6}?\:\:|[a-f0-9]{1,4}(\:[a-f0-9]{1,4}){1,6}?\:\:([a-f0-9]{1,4}\:){1,6}?[a-f0-9]{1,4})(\/\d{1,3})?$/i", $field_value)){ - $ip_ok = 1; - } - if(preg_match("/^[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}$/", $field_value)){ - $ip_ok = 1; - } - if($ip_ok == 0) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - } - } - } - break; - case 'RANGE': - //* Checks if the value is within the given range or above / below a value - //* Range examples: < 10 = ":10", between 2 and 10 = "2:10", above 5 = "5:". - $range_parts = explode(':',trim($validator['range'])); - $ok = true; - if($range_parts[0] != '' && $field_value < $range_parts[0]) { - $ok = false; - } - if($range_parts[1] != '' && $field_value > $range_parts[1]) { - $ok = false; - } - if($ok != true) { - $errmsg = $validator['errmsg']; - if(isset($this->wordbook[$errmsg])) { - $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; - } else { - $this->errorMessage .= $errmsg."
\r\n"; - } - } - unset($range_parts); - break; - case 'CUSTOM': - // Calls a custom class to validate this record - if($validator['class'] != '' and $validator['function'] != '') { - $validator_class = $validator['class']; - $validator_function = $validator['function']; - $app->uses($validator_class); - $this->errorMessage .= $app->$validator_class->$validator_function($field_name, $field_value, $validator); - } else { - $this->errorMessage .= "Custom validator class or function is empty
\r\n"; - } - break; - default: - $this->errorMessage .= "Unknown Validator: ".$validator['type']; - break; - } - - - } - - return true; - } - - /** - * Create SQL statement - * - * @param record = Datensatz als Array - * @param action = INSERT oder UPDATE - * @param primary_id - * @return record - */ - function getSQL($record, $tab, $action = 'INSERT', $primary_id = 0, $sql_ext_where = '') { - - global $app; - - // If there are no data records on the tab, return empty sql string - if(count($this->formDef['tabs'][$tab]['fields']) == 0) return ''; - - // checking permissions - if($this->formDef['auth'] == 'yes' && $_SESSION["s"]["user"]["typ"] != 'admin') { - if($action == "INSERT") { - if(!$this->checkPerm($primary_id,'i')) $this->errorMessage .= "Insert denied.
\r\n"; - } else { - if(!$this->checkPerm($primary_id,'u')) $this->errorMessage .= "Update denied.
\r\n"; - } - } - - $this->action = $action; - $this->primary_id = $primary_id; - - $record = $this->encode($record,$tab,true); - $sql_insert_key = ''; - $sql_insert_val = ''; - $sql_update = ''; - - if(!is_array($this->formDef)) $app->error("Form definition not found."); - if(!is_array($this->formDef['tabs'][$tab])) $app->error("The tab is empty or does not exist (TAB: $tab)."); - - // go trough all fields of the tab - if(is_array($record)) { - foreach($this->formDef['tabs'][$tab]['fields'] as $key => $field) { - // Wenn es kein leeres Passwortfeld ist - if (!($field['formtype'] == 'PASSWORD' and $record[$key] == '')) { - // Erzeuge Insert oder Update Quelltext - if($action == "INSERT") { - if($field['formtype'] == 'PASSWORD') { - $sql_insert_key .= "`$key`, "; - if($field['encryption'] == 'CRYPT') { - $record[$key] = $app->auth->crypt_password(stripslashes($record[$key])); - $sql_insert_val .= "'".$app->db->quote($record[$key])."', "; - } elseif ($field['encryption'] == 'MYSQL') { - $tmp = $app->db->queryOneRecord("SELECT PASSWORD('".$app->db->quote(stripslashes($record[$key]))."') as `crypted`"); - $record[$key] = $tmp['crypted']; - $sql_insert_val .= "'".$app->db->quote($record[$key])."', "; - } elseif ($field['encryption'] == 'CLEARTEXT') { - $sql_insert_val .= "'".$app->db->quote($record[$key])."', "; - } else { - $record[$key] = md5(stripslashes($record[$key])); - $sql_insert_val .= "'".$app->db->quote($record[$key])."', "; - } - - } elseif ($field['formtype'] == 'CHECKBOX') { - $sql_insert_key .= "`$key`, "; - if($record[$key] == '') { - // if a checkbox is not set, we set it to the unchecked value - $sql_insert_val .= "'".$field['value'][0]."', "; - $record[$key] = $field['value'][0]; - } else { - $sql_insert_val .= "'".$record[$key]."', "; - } - } else { - $sql_insert_key .= "`$key`, "; - $sql_insert_val .= "'".$record[$key]."', "; - } - } else { - if($field['formtype'] == 'PASSWORD') { - if(isset($field['encryption']) && $field['encryption'] == 'CRYPT') { - $record[$key] = $app->auth->crypt_password(stripslashes($record[$key])); - $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', "; - } elseif (isset($field['encryption']) && $field['encryption'] == 'MYSQL') { - $tmp = $app->db->queryOneRecord("SELECT PASSWORD('".$app->db->quote(stripslashes($record[$key]))."') as `crypted`"); - $record[$key] = $tmp['crypted']; - $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', "; - } elseif (isset($field['encryption']) && $field['encryption'] == 'CLEARTEXT') { - $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', "; - } else { - $record[$key] = md5(stripslashes($record[$key])); - $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', "; - } - - } elseif ($field['formtype'] == 'CHECKBOX') { - if($record[$key] == '') { - // if a checkbox is not set, we set it to the unchecked value - $sql_update .= "`$key` = '".$field['value'][0]."', "; - $record[$key] = $field['value'][0]; - } else { - $sql_update .= "`$key` = '".$record[$key]."', "; - } - } else { - $sql_update .= "`$key` = '".$record[$key]."', "; - } - } - } else { - // we unset the password filed, if empty to tell the datalog function - // that the password has not been changed - unset($record[$key]); - } - } - } - - - // Add backticks for incomplete table names - if(stristr($this->formDef['db_table'],'.')) { - $escape = ''; - } else { - $escape = '`'; - } - - - if($action == "INSERT") { - if($this->formDef['auth'] == 'yes') { - // Set user and group - $sql_insert_key .= "`sys_userid`, "; - $sql_insert_val .= ($this->formDef["auth_preset"]["userid"] > 0)?"'".$this->formDef["auth_preset"]["userid"]."', ":"'".$_SESSION["s"]["user"]["userid"]."', "; - $sql_insert_key .= "`sys_groupid`, "; - $sql_insert_val .= ($this->formDef["auth_preset"]["groupid"] > 0)?"'".$this->formDef["auth_preset"]["groupid"]."', ":"'".$_SESSION["s"]["user"]["default_group"]."', "; - $sql_insert_key .= "`sys_perm_user`, "; - $sql_insert_val .= "'".$this->formDef["auth_preset"]["perm_user"]."', "; - $sql_insert_key .= "`sys_perm_group`, "; - $sql_insert_val .= "'".$this->formDef["auth_preset"]["perm_group"]."', "; - $sql_insert_key .= "`sys_perm_other`, "; - $sql_insert_val .= "'".$this->formDef["auth_preset"]["perm_other"]."', "; - } - $sql_insert_key = substr($sql_insert_key,0,-2); - $sql_insert_val = substr($sql_insert_val,0,-2); - $sql = "INSERT INTO ".$escape.$this->formDef['db_table'].$escape." ($sql_insert_key) VALUES ($sql_insert_val)"; - } else { - if($this->formDef['auth'] == 'yes') { - if($primary_id != 0) { - $sql_update = substr($sql_update,0,-2); - $sql = "UPDATE ".$escape.$this->formDef['db_table'].$escape." SET ".$sql_update." WHERE ".$this->getAuthSQL('u')." AND ".$this->formDef['db_table_idx']." = ".$primary_id; - if($sql_ext_where != '') $sql .= " and ".$sql_ext_where; - } else { - $app->error("Primary ID fehlt!"); - } - } else { - if($primary_id != 0) { - $sql_update = substr($sql_update,0,-2); - $sql = "UPDATE ".$escape.$this->formDef['db_table'].$escape." SET ".$sql_update." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id; - if($sql_ext_where != '') $sql .= " and ".$sql_ext_where; - } else { - $app->error("Primary ID fehlt!"); - } - } - //* return a empty string if there is nothing to update - if(trim($sql_update) == '') $sql = ''; - } - - return $sql; - } - - /** - * Debugging arrays. - * - * @param array_data - */ - function dbg($array_data) { - - echo "
";
-				print_r($array_data);
-				echo "
"; - - } - - - function showForm() { - global $app,$conf; - - if(!is_array($this->formDef)) die("Form Definition wurde nicht geladen."); - - $active_tab = $this->getNextTab(); - - // go trough the tabs - foreach( $this->formDef["tabs"] as $key => $tab) { - - $tab['name'] = $key; - // Translate the title of the tab - $tab['title'] = $this->lng($tab['title']); - - if($tab['name'] == $active_tab) { - - // If module is set, then set the template path relative to the module.. - if($this->module != '') $tab["template"] = "../".$this->module."/".$tab["template"]; - - // Generate the template if it does not exist yet. - - - - if(!is_file($tab["template"])) { - $app->uses('tform_tpl_generator'); - $app->tform_tpl_generator->buildHTML($this->formDef,$tab['name']); - } - $app->tpl->setVar('readonly_tab', (isset($tab['readonly']) && $tab['readonly'] == true)); - $app->tpl->setInclude('content_tpl',$tab["template"]); - $tab["active"] = 1; - $_SESSION["s"]["form"]["tab"] = $tab['name']; - } else { - $tab["active"] = 0; - } - - // Unset unused variables. - unset($tab["fields"]); - unset($tab["plugins"]); - - $frmTab[] = $tab; - } - - // setting form tabs - $app->tpl->setLoop("formTab", $frmTab); - - // Set form action - $app->tpl->setVar('form_action',$this->formDef["action"]); - $app->tpl->setVar('form_active_tab',$active_tab); - - // Set form title - $form_hint = $this->lng($this->formDef["title"]); - if($this->formDef["description"] != '') $form_hint .= '
'.$this->lng($this->formDef["description"]).'
'; - $app->tpl->setVar('form_hint',$form_hint); - - // Set Wordbook for this form - - $app->tpl->setVar($this->wordbook); - } - - function getDataRecord($primary_id) { - global $app; - $escape = '`'; - $sql = "SELECT * FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id." AND ".$this->getAuthSQL('r',$this->formDef['db_table']); - return $app->db->queryOneRecord($sql); - } - - - function datalogSave($action,$primary_id, $record_old, $record_new) { - global $app,$conf; - - $app->db->datalogSave($this->formDef['db_table'], $action, $this->formDef['db_table_idx'], $primary_id, $record_old, $record_new); - return true; -<<<<<<< .mine - /* - // Add backticks for incomplete table names. - if(stristr($this->formDef['db_table'],'.')) { - $escape = ''; - } else { - $escape = '`'; - } - - $this->diffrec = array(); - - // Full diff records for ISPConfig, they have a different format then the simple diffrec - $diffrec_full = array(); - - if(is_array($record_old) && count($record_old) > 0) { - foreach($record_old as $key => $val) { - //if(isset($record_new[$key]) && $record_new[$key] != $val) { - if(!isset($record_new[$key]) || $record_new[$key] != $val) { - // Record has changed - $diffrec_full['old'][$key] = $val; - $diffrec_full['new'][$key] = $record_new[$key]; - $this->diffrec[$key] = array( 'new' => $record_new[$key], - 'old' => $val); - } else { - $diffrec_full['old'][$key] = $val; - $diffrec_full['new'][$key] = $val; - } - } - } elseif(is_array($record_new)) { - foreach($record_new as $key => $val) { - if(isset($record_new[$key]) && $record_old[$key] != $val) { - // Record has changed - $diffrec_full['new'][$key] = $val; - $diffrec_full['old'][$key] = $record_old[$key]; - $this->diffrec[$key] = array( 'old' => @$record_old[$key], - 'new' => $val); - } else { - $diffrec_full['new'][$key] = $val; - $diffrec_full['old'][$key] = $val; - } - } - } - - //$this->diffrec = $diffrec; - // Insert the server_id, if the record has a server_id - $server_id = (isset($record_old["server_id"]) && $record_old["server_id"] > 0)?$record_old["server_id"]:0; - if(isset($record_new["server_id"])) $server_id = $record_new["server_id"]; - - if(count($this->diffrec) > 0) { - $diffstr = addslashes(serialize($diffrec_full)); - $username = $app->db->quote($_SESSION["s"]["user"]["username"]); - $dbidx = $this->formDef['db_table_idx'].":".$primary_id; - // $action = ($action == 'INSERT')?'i':'u'; - - if($action == 'INSERT') $action = 'i'; - if($action == 'UPDATE') $action = 'u'; - if($action == 'DELETE') $action = 'd'; - $sql = "INSERT INTO sys_datalog (dbtable,dbidx,server_id,action,tstamp,user,data) VALUES ('".$this->formDef['db_table']."','$dbidx','$server_id','$action','".time()."','$username','$diffstr')"; - $app->db->query($sql); - } - - return true; - */ - -=======>>>>>>> .theirs } - - function getAuthSQL($perm, $table = '') { - if($_SESSION["s"]["user"]["typ"] == 'admin') { - return '1'; - } else { - if ($table != ''){ - $table = ' ' . $table . '.'; - } - $groups = ( $_SESSION["s"]["user"]["groups"] ) ? $_SESSION["s"]["user"]["groups"] : 0; - $sql = '('; - $sql .= "(" . $table . "sys_userid = ".$_SESSION["s"]["user"]["userid"]." AND " . $table . "sys_perm_user like '%$perm%') OR "; - $sql .= "(" . $table . "sys_groupid IN (".$groups.") AND " . $table ."sys_perm_group like '%$perm%') OR "; - $sql .= $table . "sys_perm_other like '%$perm%'"; - $sql .= ')'; - - return $sql; - } - } - +$app->load('tform_base'); +class tform extends tform_base { /* This function checks if a user has the parmissions $perm for the data record with the ID $record_id If record_id = 0, the the permissions are tested against the defaults of the form file. diff --git a/interface/lib/classes/tform_base.inc.php b/interface/lib/classes/tform_base.inc.php new file mode 100644 index 000000000..e53cb397c --- /dev/null +++ b/interface/lib/classes/tform_base.inc.php @@ -0,0 +1,1356 @@ +tableDef = $table; + $this->table_name = $table_name; + $this->table_index = $table_index; + return true; + } + */ + + function loadFormDef($file,$module = '') { + global $app,$conf; + + include($file); + $this->formDef = $form; + + $this->module = $module; + $wb = array(); + + include_once(ISPC_ROOT_PATH.'/lib/lang/'.$_SESSION['s']['language'].'.lng'); + + if(is_array($wb)) $wb_global = $wb; + + if($module == '') { + $lng_file = "lib/lang/".$_SESSION["s"]["language"]."_".$this->formDef["name"].".lng"; + if(!file_exists($lng_file)) $lng_file = "lib/lang/en_".$this->formDef["name"].".lng"; + include($lng_file); + } else { + $lng_file = "../$module/lib/lang/".$_SESSION["s"]["language"]."_".$this->formDef["name"].".lng"; + if(!file_exists($lng_file)) $lng_file = "../$module/lib/lang/en_".$this->formDef["name"].".lng"; + include($lng_file); + } + + if(is_array($wb_global)) { + $wb = $app->functions->array_merge($wb_global,$wb); + } + if(isset($wb_global)) unset($wb_global); + + $this->wordbook = $wb; + + $this->dateformat = $app->lng('conf_format_dateshort'); + + return true; + } + + /* + * Converts the data in the array to human readable format + * Datatype conversion e.g. to show the data in lists + * + * @param record + * @param tab + * @param apply_filters + * @return record + */ + protected function _decode($record, $tab = '', $api = false) { + $new_record = ''; + if($api == false) { + $table_idx = $this->formDef['db_table_idx']; + if(isset($record[$table_idx])) $new_record[$table_idx] = $app->functions->intval($record[$table_idx ]); + $fields = &$this->formDef['tabs'][$tab]['fields']; + } else { + $fields = &$this->formDef['fields']; + } + + if(is_array($record)) { + foreach($fields as $key => $field) { + + //* Apply filter to record value. + if($api == false && isset($field['filters']) && is_array($field['filters'])) { + $record[$key] = $this->filterField($key, (isset($record[$key]))?$record[$key]:'', $field['filters'], 'SHOW'); + } + + switch ($field['datatype']) { + case 'VARCHAR': + $new_record[$key] = ($api == true ? stripslashes($record[$key]) : $record[$key]); + break; + + case 'TEXT': + $new_record[$key] = ($api == true ? stripslashes($record[$key]) : $record[$key]); + break; + + case 'DATETSTAMP': + if($record[$key] > 0) { + $new_record[$key] = date($this->dateformat,$record[$key]); + } + break; + + case 'DATE': + if($record[$key] != '' && $record[$key] != '0000-00-00') { + $tmp = explode('-',$record[$key]); + $new_record[$key] = date($this->dateformat,mktime(0, 0, 0, $tmp[1] , $tmp[2], $tmp[0])); + } + break; + + case 'INTEGER': + $new_record[$key] = $app->functions->intval($record[$key]); + break; + + case 'DOUBLE': + $new_record[$key] = $record[$key]; + break; + + case 'CURRENCY': + $new_record[$key] = $app->functions->currency_format($record[$key]); + break; + + default: + $new_record[$key] = ($api == true ? stripslashes($record[$key]) : $record[$key]); + } + } + + } + + return $new_record; + } + + /** + * Converts the data in the array to human readable format + * Datatype conversion e.g. to show the data in lists + * + * @param record + * @return record + */ + function decode($record,$tab) { + global $conf, $app; + if(!is_array($this->formDef['tabs'][$tab])) $app->error("Tab does not exist or the tab is empty (TAB: $tab)."); + return $this->_decode($record, $tab, false); + } + + /** + * Get the key => value array of a form filled from a datasource definitiom + * + * @param field = array with field definition + * @param record = Dataset as array + * @return key => value array for the value field of a form + */ + + protected function _getDatasourceData($field, $record, $api = false) { + global $app; + + $values = array(); + + if($field["datasource"]["type"] == 'SQL') { + + // Preparing SQL string. We will replace some + // common placeholders + $querystring = $field["datasource"]["querystring"]; + $querystring = str_replace("{USERID}",$_SESSION["s"]["user"]["userid"],$querystring); + $querystring = str_replace("{GROUPID}",$_SESSION["s"]["user"]["default_group"],$querystring); + $querystring = str_replace("{GROUPS}",$_SESSION["s"]["user"]["groups"],$querystring); + $table_idx = $this->formDef['db_table_idx']; + + $tmp_recordid = (isset($record[$table_idx]))?$record[$table_idx]:0; + $querystring = str_replace("{RECORDID}",$tmp_recordid,$querystring); + unset($tmp_recordid); + + $querystring = str_replace("{AUTHSQL}",$this->getAuthSQL('r'),$querystring); + + // Getting the records + $tmp_records = $app->db->queryAllRecords($querystring); + if($app->db->errorMessage != '') die($app->db->errorMessage); + if(is_array($tmp_records)) { + $key_field = $field["datasource"]["keyfield"]; + $value_field = $field["datasource"]["valuefield"]; + foreach($tmp_records as $tmp_rec) { + $tmp_id = $tmp_rec[$key_field]; + $values[$tmp_id] = $tmp_rec[$value_field]; + } + } + } + + if($field["datasource"]["type"] == 'CUSTOM') { + // Calls a custom class to validate this record + if($field["datasource"]['class'] != '' and $field["datasource"]['function'] != '') { + $datasource_class = $field["datasource"]['class']; + $datasource_function = $field["datasource"]['function']; + $app->uses($datasource_class); + $values = $app->$datasource_class->$datasource_function($field, $record); + } else { + $this->errorMessage .= "Custom datasource class or function is empty
\r\n"; + } + } + + if($api == false && isset($field['filters']) && is_array($field['filters'])) { + $new_values = array(); + foreach($values as $index => $value) { + $new_index = $this->filterField($index, $index, $field['filters'], 'SHOW'); + $new_values[$new_index] = $this->filterField($index, (isset($values[$index]))?$values[$index]:'', $field['filters'], 'SHOW'); + } + $values = $new_values; + unset($new_values); + unset($new_index); + } + + return $values; + + } + + /** + * Get the key => value array of a form filled from a datasource definitiom + * + * @param field = array with field definition + * @param record = Dataset as array + * @return key => value array for the value field of a form + */ + + function getDatasourceData($field, $record) { + return $this->_getDatasourceData($field, $record, false); + } + + //* If the parameter 'valuelimit' is set + function applyValueLimit($limit,$values) { + + global $app; + + $limit_parts = explode(':',$limit); + + //* values are limited to a comma separated list + if($limit_parts[0] == 'list') { + $allowed = explode(',',$limit_parts[1]); + } + + //* values are limited to a field in the client settings + if($limit_parts[0] == 'client') { + if($_SESSION["s"]["user"]["typ"] == 'admin') { + return $values; + } else { + $client_group_id = $_SESSION["s"]["user"]["default_group"]; + $client = $app->db->queryOneRecord("SELECT ".$limit_parts[1]." as lm FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id"); + $allowed = explode(',',$client['lm']); + } + } + + //* values are limited to a field in the reseller settings + if($limit_parts[0] == 'reseller') { + if($_SESSION["s"]["user"]["typ"] == 'admin') { + return $values; + } else { + //* Get the limits of the client that is currently logged in + $client_group_id = $_SESSION["s"]["user"]["default_group"]; + $client = $app->db->queryOneRecord("SELECT parent_client_id FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id"); + //echo "SELECT parent_client_id FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id"; + //* If the client belongs to a reseller, we will check against the reseller Limit too + if($client['parent_client_id'] != 0) { + + //* first we need to know the groups of this reseller + $tmp = $app->db->queryOneRecord("SELECT userid, groups FROM sys_user WHERE client_id = ".$client['parent_client_id']); + $reseller_groups = $tmp["groups"]; + $reseller_userid = $tmp["userid"]; + + // Get the limits of the reseller of the logged in client + $client_group_id = $_SESSION["s"]["user"]["default_group"]; + $reseller = $app->db->queryOneRecord("SELECT ".$limit_parts[1]." as lm FROM client WHERE client_id = ".$client['parent_client_id']); + $allowed = explode(',',$reseller['lm']); + } else { + return $values; + } + } // end if admin + } // end if reseller + + //* values are limited to a field in the system settings + if($limit_parts[0] == 'system') { + $app->uses('getconf'); + $tmp_conf = $app->getconf->get_global_config($limit_parts[1]); + $tmp_key = $limit_parts[2]; + $allowed = $tmp_conf[$tmp_key]; + } + + $values_new = array(); + foreach($values as $key => $val) { + if(in_array($key,$allowed)) $values_new[$key] = $val; + } + + return $values_new; + } + + + /** + * Prepare the data record to show the data in a form. + * + * @param record = Datensatz als Array + * @param action = NEW oder EDIT + * @return record + */ + function getHTML($record, $tab, $action = 'NEW') { + + global $app; + + $this->action = $action; + + if(!is_array($this->formDef)) $app->error("No form definition found."); + if(!is_array($this->formDef['tabs'][$tab])) $app->error("The tab is empty or does not exist (TAB: $tab)."); + + $new_record = array(); + if($action == 'EDIT') { + $record = $this->decode($record,$tab); + if(is_array($record)) { + foreach($this->formDef['tabs'][$tab]['fields'] as $key => $field) { + + if(isset($record[$key])) { + $val = $record[$key]; + } else { + $val = ''; + } + + // If Datasource is set, get the data from there + if(isset($field['datasource']) && is_array($field['datasource'])) { + if(is_array($field["value"])) { + //$field["value"] = array_merge($field["value"],$this->getDatasourceData($field, $record)); + $field["value"] = $app->functions->array_merge($field["value"],$this->getDatasourceData($field, $record)); + } else { + $field["value"] = $this->getDatasourceData($field, $record); + } + } + + // If a limitation for the values is set + if(isset($field['valuelimit']) && is_array($field["value"])) { + $field["value"] = $this->applyValueLimit($field['valuelimit'],$field["value"]); + } + + switch ($field['formtype']) { + case 'SELECT': + $out = ''; + if(is_array($field['value'])) { + foreach($field['value'] as $k => $v) { + $selected = ($k == $val)?' SELECTED':''; + if(!empty($this->wordbook[$v])) + $v = $this->wordbook[$v]; + $out .= "\r\n"; + } + } + $new_record[$key] = $out; + break; + case 'MULTIPLE': + if(is_array($field['value'])) { + + // Split + $vals = explode($field['separator'],$val); + + // write HTML + $out = ''; + foreach($field['value'] as $k => $v) { + + $selected = ''; + foreach($vals as $tvl) { + if(trim($tvl) == trim($k)) $selected = ' SELECTED'; + } + + $out .= "\r\n"; + } + } + $new_record[$key] = $out; + break; + + case 'PASSWORD': + $new_record[$key] = ''; + break; + + case 'CHECKBOX': + $checked = ($val == $field['value'][1])?' CHECKED':''; + $new_record[$key] = "\r\n"; + break; + + case 'CHECKBOXARRAY': + if(is_array($field['value'])) { + + // aufsplitten ergebnisse + $vals = explode($field['separator'],$val); + + // HTML schreiben + $out = ''; + $elementNo = 0; + foreach($field['value'] as $k => $v) { + + $checked = ''; + foreach($vals as $tvl) { + if(trim($tvl) == trim($k)) $checked = ' CHECKED'; + } + // $out .= "\r\n"; + $out .= "
\r\n"; + $elementNo++; + } + } + $new_record[$key] = $out; + break; + + case 'RADIO': + if(is_array($field['value'])) { + + // HTML schreiben + $out = ''; + $elementNo = 0; + foreach($field['value'] as $k => $v) { + $checked = ($k == $val)?' CHECKED':''; + //$out .= "\r\n"; + $out .= "\r\n"; + $elementNo++; + } + } + $new_record[$key] = $out; + break; + + case 'DATETIME': + if (strtotime($val) !== false) { + $dt_value = $val; + } elseif ( isset($field['default']) && (strtotime($field['default']) !== false) ) { + $dt_value = $field['default']; + } else { + $dt_value = 0; + } + + $display_seconds = (isset($field['display_seconds']) && $field['display_seconds'] == true) ? true : false; + + $new_record[$key] = $this->_getDateTimeHTML($key, $dt_value, $display_seconds); + break; + + default: + if(isset($record[$key])) { + $new_record[$key] = htmlspecialchars($record[$key]); + } else { + $new_record[$key] = ''; + } + } + } + } + } else { + // Action: NEW + foreach($this->formDef['tabs'][$tab]['fields'] as $key => $field) { + + // If Datasource is set, get the data from there + if(@is_array($field['datasource'])) { + if(is_array($field["value"])) { + $field["value"] = $app->functions->array_merge($field["value"],$this->getDatasourceData($field, $record)); + } else { + $field["value"] = $this->getDatasourceData($field, $record); + } + } + + // If a limitation for the values is set + if(isset($field['valuelimit']) && is_array($field["value"])) { + $field["value"] = $this->applyValueLimit($field['valuelimit'],$field["value"]); + } + + switch ($field['formtype']) { + case 'SELECT': + if(is_array($field['value'])) { + $out = ''; + foreach($field['value'] as $k => $v) { + $selected = ($k == $field["default"])?' SELECTED':''; + $out .= "\r\n"; + } + } + if(isset($out)) $new_record[$key] = $out; + break; + case 'MULTIPLE': + if(is_array($field['value'])) { + + // aufsplitten ergebnisse + $vals = explode($field['separator'],$val); + + // HTML schreiben + $out = ''; + foreach($field['value'] as $k => $v) { + + $out .= "\r\n"; + } + } + $new_record[$key] = $out; + break; + + case 'PASSWORD': + //$new_record[$key] = ''; + $new_record[$key] = htmlspecialchars($field['default']); + break; + + case 'CHECKBOX': + // $checked = (empty($field["default"]))?'':' CHECKED'; + $checked = ($field["default"] == $field['value'][1])?' CHECKED':''; + $new_record[$key] = "\r\n"; + break; + + case 'CHECKBOXARRAY': + if(is_array($field['value'])) { + + // aufsplitten ergebnisse + $vals = explode($field['separator'],$field["default"]); + + // HTML schreiben + $out = ''; + $elementNo = 0; + foreach($field['value'] as $k => $v) { + + $checked = ''; + foreach($vals as $tvl) { + if(trim($tvl) == trim($k)) $checked = ' CHECKED'; + } + // $out .= "\r\n"; + $out .= "  \r\n"; + $elementNo++; + } + } + $new_record[$key] = $out; + break; + + case 'RADIO': + if(is_array($field['value'])) { + + // HTML schreiben + $out = ''; + $elementNo = 0; + foreach($field['value'] as $k => $v) { + $checked = ($k == $field["default"])?' CHECKED':''; + //$out .= "\r\n"; + $out .= "\r\n"; + $elementNo++; + } + } + $new_record[$key] = $out; + break; + + case 'DATETIME': + $dt_value = (isset($field['default'])) ? $field['default'] : 0; + $display_seconds = (isset($field['display_seconds']) && $field['display_seconds'] == true) ? true : false; + + $new_record[$key] = $this->_getDateTimeHTML($key, $dt_value, $display_seconds); + break; + + default: + $new_record[$key] = htmlspecialchars($field['default']); + } + } + + } + + if($this->debug == 1) $this->dbg($new_record); + + return $new_record; + } + + /** + * Rewrite the record data to be stored in the database + * and check values with regular expressions. + * + * @param record = Datensatz als Array + * @return record + */ + function _encode($record,$tab,$dbencode = true,$api = false) { + global $app; + if($api == true) $fields = &$this->formDef['fields']; + else $fields = &$this->formDef['tabs'][$tab]['fields']; + if(is_array($record)) { + foreach($fields as $key => $field) { + + //* Apply filter to record value + if(isset($field['filters']) && is_array($field['filters'])) { + $record[$key] = $this->filterField($key, (isset($record[$key]))?$record[$key]:'', $field['filters'], 'SAVE'); + } + //* Validate record value + if(isset($field['validators']) && is_array($field['validators'])) { + $this->validateField($key, (isset($record[$key]))?$record[$key]:'', $field['validators']); + } + + switch ($field['datatype']) { + case 'VARCHAR': + if(!@is_array($record[$key])) { + $new_record[$key] = (isset($record[$key]))?$record[$key]:''; + } else { + $new_record[$key] = implode($field['separator'],$record[$key]); + } + break; + case 'TEXT': + if(!is_array($record[$key])) { + $new_record[$key] = $record[$key]; + } else { + $new_record[$key] = implode($field['separator'],$record[$key]); + } + break; + case 'DATETSTAMP': + if($record[$key] > 0) { + list($tag,$monat,$jahr) = explode('.',$record[$key]); + $new_record[$key] = mktime(0,0,0,$monat,$tag,$jahr); + } else { + $new_record[$key] = 0; + } + break; + case 'DATE': + if($record[$key] != '' && $record[$key] != '0000-00-00') { + if(function_exists('date_parse_from_format')) { + $date_parts = date_parse_from_format($this->dateformat,$record[$key]); + //list($tag,$monat,$jahr) = explode('.',$record[$key]); + $new_record[$key] = $date_parts['year'].'-'.$date_parts['month'].'-'.$date_parts['day']; + //$tmp = strptime($record[$key],$this->dateformat); + //$new_record[$key] = ($tmp['tm_year']+1900).'-'.($tmp['tm_mon']+1).'-'.$tmp['tm_mday']; + } else { + //$tmp = strptime($record[$key],$this->dateformat); + //$new_record[$key] = ($tmp['tm_year']+1900).'-'.($tmp['tm_mon']+1).'-'.$tmp['tm_mday']; + $tmp = strtotime($record[$key]); + $new_record[$key] = date('Y-m-d',$tmp); + } + } else { + $new_record[$key] = '0000-00-00'; + } + break; + case 'INTEGER': + $new_record[$key] = (isset($record[$key]))?$app->functions->intval($record[$key]):0; + //if($new_record[$key] != $record[$key]) $new_record[$key] = $field['default']; + //if($key == 'refresh') die($record[$key]); + break; + case 'DOUBLE': + $new_record[$key] = $record[$key]; + break; + case 'CURRENCY': + $new_record[$key] = str_replace(",",".",$record[$key]); + break; + + case 'DATETIME': + if (is_array($record[$key])) + { + $filtered_values = array_map(create_function('$item','return (int)$item;'), $record[$key]); + extract($filtered_values, EXTR_PREFIX_ALL, '_dt'); + + if ($_dt_day != 0 && $_dt_month != 0 && $_dt_year != 0) { + $new_record[$key] = date( 'Y-m-d H:i:s', mktime($_dt_hour, $_dt_minute, $_dt_second, $_dt_month, $_dt_day, $_dt_year) ); + } + } + break; + } + + // The use of the field value is deprecated, use validators instead + if(isset($field['regex']) && $field['regex'] != '') { + // Enable that "." matches also newlines + $field['regex'] .= 's'; + if(!preg_match($field['regex'], $record[$key])) { + $errmsg = $field['errmsg']; + $this->errorMessage .= ($api == true ? $errmsg : $this->wordbook[$errmsg]."
") . "\r\n"; + } + } + + //* Add slashes to all records, when we encode data which shall be inserted into mysql. + if($dbencode == true) $new_record[$key] = $app->db->quote($new_record[$key]); + } + } + return $new_record; + } + + /** + * Rewrite the record data to be stored in the database + * and check values with regular expressions. + * + * @param record = Datensatz als Array + * @return record + */ + function encode($record,$tab,$dbencode = true) { + global $app; + + if(!is_array($this->formDef['tabs'][$tab])) $app->error("Tab is empty or does not exist (TAB: $tab)."); + return $this->_encode($record, $tab, $dbencode, false); + } + + /** + * process the filters for a given field. + * + * @param field_name = Name of the field + * @param field_value = value of the field + * @param filters = Array of filters + * @param filter_event = 'SAVE'or 'SHOW' + * @return record + */ + + function filterField($field_name, $field_value, $filters, $filter_event) { + + global $app; + $returnval = $field_value; + + //* Loop trough all filters + foreach($filters as $filter) { + if($filter['event'] == $filter_event) { + switch ($filter['type']) { + case 'TOLOWER': + $returnval = strtolower($returnval); + break; + case 'TOUPPER': + $returnval = strtoupper($returnval); + break; + case 'IDNTOASCII': + $returnval = $app->functions->idn_encode($returnval); + break; + case 'IDNTOUTF8': + $returnval = $app->functions->idn_decode($returnval); + break; + default: + $this->errorMessage .= "Unknown Filter: ".$filter['type']; + break; + } + } + } + return $returnval; + } + + /** + * process the validators for a given field. + * + * @param field_name = Name of the field + * @param field_value = value of the field + * @param validatoors = Array of validators + * @return record + */ + + function validateField($field_name, $field_value, $validators) { + + global $app; + + $escape = '`'; + + // loop trough the validators + foreach($validators as $validator) { + + switch ($validator['type']) { + case 'REGEX': + $validator['regex'] .= 's'; + if(!preg_match($validator['regex'], $field_value)) { + $errmsg = $validator['errmsg']; + if(isset($this->wordbook[$errmsg])) { + $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; + } else { + $this->errorMessage .= $errmsg."
\r\n"; + } + } + break; + case 'UNIQUE': + if($validator['allowempty'] != 'y') $validator['allowempty'] = 'n'; + if($validator['allowempty'] == 'n' || ($validator['allowempty'] == 'y' && $field_value != '')){ + if($this->action == 'NEW') { + $num_rec = $app->db->queryOneRecord("SELECT count(*) as number FROM ".$escape.$this->formDef['db_table'].$escape. " WHERE $field_name = '".$app->db->quote($field_value)."'"); + if($num_rec["number"] > 0) { + $errmsg = $validator['errmsg']; + if(isset($this->wordbook[$errmsg])) { + $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; + } else { + $this->errorMessage .= $errmsg."
\r\n"; + } + } + } else { + $num_rec = $app->db->queryOneRecord("SELECT count(*) as number FROM ".$escape.$this->formDef['db_table'].$escape. " WHERE $field_name = '".$app->db->quote($field_value)."' AND ".$this->formDef['db_table_idx']." != ".$this->primary_id); + if($num_rec["number"] > 0) { + $errmsg = $validator['errmsg']; + if(isset($this->wordbook[$errmsg])) { + $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; + } else { + $this->errorMessage .= $errmsg."
\r\n"; + } + } + } + } + break; + case 'NOTEMPTY': + if(empty($field_value)) { + $errmsg = $validator['errmsg']; + if(isset($this->wordbook[$errmsg])) { + $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; + } else { + $this->errorMessage .= $errmsg."
\r\n"; + } + } + break; + case 'ISEMAIL': + if(function_exists('filter_var')) { + if(filter_var($field_value, FILTER_VALIDATE_EMAIL) === false) { + $errmsg = $validator['errmsg']; + if(isset($this->wordbook[$errmsg])) { + $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; + } else { + $this->errorMessage .= $errmsg."
\r\n"; + } + } + } else { + if(!preg_match("/^\w+[\w\.\-\+]*\w{0,}@\w+[\w.-]*\w+\.[a-zA-Z0-9\-]{2,30}$/i", $field_value)) { + $errmsg = $validator['errmsg']; + if(isset($this->wordbook[$errmsg])) { + $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; + } else { + $this->errorMessage .= $errmsg."
\r\n"; + } + } + } + break; + case 'ISINT': + if(function_exists('filter_var') && $field_value < 2147483647) { + if($field_value != '' && filter_var($field_value, FILTER_VALIDATE_INT) === false) { + $errmsg = $validator['errmsg']; + if(isset($this->wordbook[$errmsg])) { + $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; + } else { + $this->errorMessage .= $errmsg."
\r\n"; + } + } + } else { + $tmpval = $app->functions->intval($field_value); + if($tmpval === 0 and !empty($field_value)) { + $errmsg = $validator['errmsg']; + if(isset($this->wordbook[$errmsg])) { + $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; + } else { + $this->errorMessage .= $errmsg."
\r\n"; + } + } + } + break; + case 'ISPOSITIVE': + if(!is_numeric($field_value) || $field_value <= 0){ + $errmsg = $validator['errmsg']; + if(isset($this->wordbook[$errmsg])) { + $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; + } else { + $this->errorMessage .= $errmsg."
\r\n"; + } + } + break; + case 'ISV6PREFIX': + $v6_prefix_ok = 0; + $explode_field_value = explode(':',$field_value); + if ($explode_field_value[count($explode_field_value)-1]=='' && $explode_field_value[count($explode_field_value)-2]=='' ){ + if ( count($explode_field_value) <= 9 ) { + if(filter_var(substr($field_value,0,strlen($field_value)-2),FILTER_VALIDATE_IP,FILTER_FLAG_IPV6) or filter_var(substr($field_value,0,strlen($field_value)-2).'::0',FILTER_VALIDATE_IP,FILTER_FLAG_IPV6) or filter_var(substr($field_value,0,strlen($field_value)-2).':0',FILTER_VALIDATE_IP,FILTER_FLAG_IPV6) ) { + $v6_prefix_ok = 1; + } + } + } else { + $v6_prefix_ok = 2; + } + // check subnet against defined server-ipv6 + $sql_v6 = $app->db->queryOneRecord("SELECT ip_address FROM server_ip WHERE ip_type = 'IPv6' AND virtualhost = 'y' LIMIT 0,1"); + $sql_v6_explode=explode(':',$sql_v6['ip_address']); + if ( count($sql_v6_explode) < count($explode_field_value) && isset($sql_v6['ip_address']) ) { + $v6_prefix_ok = 3; + } + if($v6_prefix_ok == 0) { + $errmsg = $validator['errmsg']; + } + if($v6_prefix_ok == 2) { + $errmsg = 'IPv6 Prefix must end with ::'; + } + if($v6_prefix_ok == 3) { + $errmsg = 'IPv6 Prefix too long (according to Server IP Addresses)'; + } + if($v6_prefix_ok <> 1){ + $this->errorMessage .= $errmsg."
\r\n"; + } + break; + case 'ISIPV4': + $vip=1; + if(preg_match("/^[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}$/", $field_value)){ + $groups=explode(".",$field_value); + foreach($groups as $group){ + if($group<0 OR $group>255) + $vip=0; + } + }else{$vip=0;} + if($vip==0) { + $errmsg = $validator['errmsg']; + if(isset($this->wordbook[$errmsg])) { + $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; + } else { + $this->errorMessage .= $errmsg."
\r\n"; + } + } + break; + case 'ISIP': + if($validator['allowempty'] != 'y') $validator['allowempty'] = 'n'; + if($validator['allowempty'] == 'y' && $field_value == '') { + //* Do nothing + } else { + //* Check if its a IPv4 or IPv6 address + if(isset($validator['separator']) && $validator['separator'] != '') { + //* When the field may contain several IP addresses, split them by the char defined as separator + $field_value_array = explode($validator['separator'],$field_value); + } else { + $field_value_array[] = $field_value; + } + foreach($field_value_array as $field_value) { + $field_value = trim($field_value); + if(function_exists('filter_var')) { + if(!filter_var($field_value,FILTER_VALIDATE_IP)) { + $errmsg = $validator['errmsg']; + if(isset($this->wordbook[$errmsg])) { + $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; + } else { + $this->errorMessage .= $errmsg."
\r\n"; + } + } + } else { + //* Check content with regex, if we use php < 5.2 + $ip_ok = 0; + if(preg_match("/^(\:\:([a-f0-9]{1,4}\:){0,6}?[a-f0-9]{0,4}|[a-f0-9]{1,4}(\:[a-f0-9]{1,4}){0,6}?\:\:|[a-f0-9]{1,4}(\:[a-f0-9]{1,4}){1,6}?\:\:([a-f0-9]{1,4}\:){1,6}?[a-f0-9]{1,4})(\/\d{1,3})?$/i", $field_value)){ + $ip_ok = 1; + } + if(preg_match("/^[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}(\.)[0-9]{1,3}$/", $field_value)){ + $ip_ok = 1; + } + if($ip_ok == 0) { + $errmsg = $validator['errmsg']; + if(isset($this->wordbook[$errmsg])) { + $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; + } else { + $this->errorMessage .= $errmsg."
\r\n"; + } + } + } + } + } + break; + case 'RANGE': + //* Checks if the value is within the given range or above / below a value + //* Range examples: < 10 = ":10", between 2 and 10 = "2:10", above 5 = "5:". + $range_parts = explode(':',trim($validator['range'])); + $ok = true; + if($range_parts[0] != '' && $field_value < $range_parts[0]) { + $ok = false; + } + if($range_parts[1] != '' && $field_value > $range_parts[1]) { + $ok = false; + } + if($ok != true) { + $errmsg = $validator['errmsg']; + if(isset($this->wordbook[$errmsg])) { + $this->errorMessage .= $this->wordbook[$errmsg]."
\r\n"; + } else { + $this->errorMessage .= $errmsg."
\r\n"; + } + } + unset($range_parts); + break; + case 'CUSTOM': + // Calls a custom class to validate this record + if($validator['class'] != '' and $validator['function'] != '') { + $validator_class = $validator['class']; + $validator_function = $validator['function']; + $app->uses($validator_class); + $this->errorMessage .= $app->$validator_class->$validator_function($field_name, $field_value, $validator); + } else { + $this->errorMessage .= "Custom validator class or function is empty
\r\n"; + } + break; + default: + $this->errorMessage .= "Unknown Validator: ".$validator['type']; + break; + } + + + } + + return true; + } + + /** + * Create SQL statement + * + * @param record = Datensatz als Array + * @param action = INSERT oder UPDATE + * @param primary_id + * @return record + */ + protected function _getSQL($record, $tab, $action = 'INSERT', $primary_id = 0, $sql_ext_where = '', $api = false) { + + global $app; + + $this->action = $action; + $this->primary_id = $primary_id; + + + $record = $this->encode($record,$tab,true); + $sql_insert_key = ''; + $sql_insert_val = ''; + $sql_update = ''; + + if($api == true) $fields = &$this->formDef['fields']; + else $fields = &$this->formDef['tabs'][$tab]['fields']; + + // go trough all fields of the tab + if(is_array($record)) { + foreach($fields as $key => $field) { + // Wenn es kein leeres Passwortfeld ist + if (!($field['formtype'] == 'PASSWORD' and $record[$key] == '')) { + // Erzeuge Insert oder Update Quelltext + if($action == "INSERT") { + if($field['formtype'] == 'PASSWORD') { + $sql_insert_key .= "`$key`, "; + if ((isset($field['encryption']) && $field['encryption'] == 'CLEARTEXT') || (isset($record['_ispconfig_pw_crypted']) && $record['_ispconfig_pw_crypted'] == 1)) { + $sql_insert_val .= "'".$app->db->quote($record[$key])."', "; + } elseif(isset($field['encryption']) && $field['encryption'] == 'CRYPT') { + $record[$key] = $app->auth->crypt_password(stripslashes($record[$key])); + $sql_insert_val .= "'".$app->db->quote($record[$key])."', "; + } elseif (isset($field['encryption']) && $field['encryption'] == 'MYSQL') { + $tmp = $app->db->queryOneRecord("SELECT PASSWORD('".$app->db->quote(stripslashes($record[$key]))."') as `crypted`"); + $record[$key] = $tmp['crypted']; + $sql_insert_val .= "'".$app->db->quote($record[$key])."', "; + } else { + $record[$key] = md5(stripslashes($record[$key])); + $sql_insert_val .= "'".$app->db->quote($record[$key])."', "; + } + } elseif ($field['formtype'] == 'CHECKBOX') { + $sql_insert_key .= "`$key`, "; + if($record[$key] == '') { + // if a checkbox is not set, we set it to the unchecked value + $sql_insert_val .= "'".$field['value'][0]."', "; + $record[$key] = $field['value'][0]; + } else { + $sql_insert_val .= "'".$record[$key]."', "; + } + } else { + $sql_insert_key .= "`$key`, "; + $sql_insert_val .= "'".$record[$key]."', "; + } + } else { + if($field['formtype'] == 'PASSWORD') { + if ((isset($field['encryption']) && $field['encryption'] == 'CLEARTEXT') || (isset($record['_ispconfig_pw_crypted']) && $record['_ispconfig_pw_crypted'] == 1)) { + $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', "; + } elseif(isset($field['encryption']) && $field['encryption'] == 'CRYPT') { + $record[$key] = $app->auth->crypt_password(stripslashes($record[$key])); + $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', "; + } elseif (isset($field['encryption']) && $field['encryption'] == 'MYSQL') { + $tmp = $app->db->queryOneRecord("SELECT PASSWORD('".$app->db->quote(stripslashes($record[$key]))."') as `crypted`"); + $record[$key] = $tmp['crypted']; + $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', "; + } else { + $record[$key] = md5(stripslashes($record[$key])); + $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', "; + } + + } elseif ($field['formtype'] == 'CHECKBOX') { + if($record[$key] == '') { + // if a checkbox is not set, we set it to the unchecked value + $sql_update .= "`$key` = '".$field['value'][0]."', "; + $record[$key] = $field['value'][0]; + } else { + $sql_update .= "`$key` = '".$record[$key]."', "; + } + } else { + $sql_update .= "`$key` = '".$record[$key]."', "; + } + } + } else { + // we unset the password filed, if empty to tell the datalog function + // that the password has not been changed + unset($record[$key]); + } + } + } + + + // Add backticks for incomplete table names + if(stristr($this->formDef['db_table'],'.')) { + $escape = ''; + } else { + $escape = '`'; + } + + + if($action == "INSERT") { + if($this->formDef['auth'] == 'yes') { + // Set user and group + $sql_insert_key .= "`sys_userid`, "; + $sql_insert_val .= ($this->formDef["auth_preset"]["userid"] > 0)?"'".$this->formDef["auth_preset"]["userid"]."', ":"'".$_SESSION["s"]["user"]["userid"]."', "; + $sql_insert_key .= "`sys_groupid`, "; + $sql_insert_val .= ($this->formDef["auth_preset"]["groupid"] > 0)?"'".$this->formDef["auth_preset"]["groupid"]."', ":"'".$_SESSION["s"]["user"]["default_group"]."', "; + $sql_insert_key .= "`sys_perm_user`, "; + $sql_insert_val .= "'".$this->formDef["auth_preset"]["perm_user"]."', "; + $sql_insert_key .= "`sys_perm_group`, "; + $sql_insert_val .= "'".$this->formDef["auth_preset"]["perm_group"]."', "; + $sql_insert_key .= "`sys_perm_other`, "; + $sql_insert_val .= "'".$this->formDef["auth_preset"]["perm_other"]."', "; + } + $sql_insert_key = substr($sql_insert_key,0,-2); + $sql_insert_val = substr($sql_insert_val,0,-2); + $sql = "INSERT INTO ".$escape.$this->formDef['db_table'].$escape." ($sql_insert_key) VALUES ($sql_insert_val)"; + } else { + if($this->formDef['auth'] == 'yes') { + if($primary_id != 0) { + if($api == true && $_SESSION["s"]["user"]["client_id"] > 0 && $_SESSION["s"]["user"]["iserid"] > 0 && $_SESSION["s"]["user"]["default_group"] > 0) { + $sql_update .= '`sys_userid` = '.$this->sys_userid.', '; + $sql_update .= '`sys_groupid` = '.$this->sys_default_group.', '; + } + + $sql_update = substr($sql_update,0,-2); + $sql = "UPDATE ".$escape.$this->formDef['db_table'].$escape." SET ".$sql_update." WHERE ".$this->getAuthSQL('u')." AND ".$this->formDef['db_table_idx']." = ".$primary_id; + if($sql_ext_where != '') $sql .= " and ".$sql_ext_where; + } else { + $app->error("Primary ID fehlt!"); + } + } else { + if($primary_id != 0) { + $sql_update = substr($sql_update,0,-2); + $sql = "UPDATE ".$escape.$this->formDef['db_table'].$escape." SET ".$sql_update." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id; + if($sql_ext_where != '') $sql .= " and ".$sql_ext_where; + } else { + $app->error("Primary ID fehlt!"); + } + } + //* return a empty string if there is nothing to update + if(trim($sql_update) == '') $sql = ''; + } + + return $sql; + } + + /** + * Create SQL statement + * + * @param record = Datensatz als Array + * @param action = INSERT oder UPDATE + * @param primary_id + * @return record + */ + function getSQL($record, $tab, $action = 'INSERT', $primary_id = 0, $sql_ext_where = '') { + + global $app; + + // If there are no data records on the tab, return empty sql string + if(count($this->formDef['tabs'][$tab]['fields']) == 0) return ''; + + // checking permissions + if($this->formDef['auth'] == 'yes' && $_SESSION["s"]["user"]["typ"] != 'admin') { + if($action == "INSERT") { + if(!$this->checkPerm($primary_id,'i')) $this->errorMessage .= "Insert denied.
\r\n"; + } else { + if(!$this->checkPerm($primary_id,'u')) $this->errorMessage .= "Update denied.
\r\n"; + } + } + + if(!is_array($this->formDef)) $app->error("Form definition not found."); + if(!is_array($this->formDef['tabs'][$tab])) $app->error("The tab is empty or does not exist (TAB: $tab)."); + + return $this->_getSQL($record, $tab, $action, $primary_id, $sql_ext_where, false); + } + + /** + * Debugging arrays. + * + * @param array_data + */ + function dbg($array_data) { + + echo "
";
+				print_r($array_data);
+				echo "
"; + + } + + + function showForm() { + global $app,$conf; + + if(!is_array($this->formDef)) die("Form Definition wurde nicht geladen."); + + $active_tab = $this->getNextTab(); + + // go trough the tabs + foreach( $this->formDef["tabs"] as $key => $tab) { + + $tab['name'] = $key; + // Translate the title of the tab + $tab['title'] = $this->lng($tab['title']); + + if($tab['name'] == $active_tab) { + + // If module is set, then set the template path relative to the module.. + if($this->module != '') $tab["template"] = "../".$this->module."/".$tab["template"]; + + // Generate the template if it does not exist yet. + + + + if(!is_file($tab["template"])) { + $app->uses('tform_tpl_generator'); + $app->tform_tpl_generator->buildHTML($this->formDef,$tab['name']); + } + $app->tpl->setVar('readonly_tab', (isset($tab['readonly']) && $tab['readonly'] == true)); + $app->tpl->setInclude('content_tpl',$tab["template"]); + $tab["active"] = 1; + $_SESSION["s"]["form"]["tab"] = $tab['name']; + } else { + $tab["active"] = 0; + } + + // Unset unused variables. + unset($tab["fields"]); + unset($tab["plugins"]); + + $frmTab[] = $tab; + } + + // setting form tabs + $app->tpl->setLoop("formTab", $frmTab); + + // Set form action + $app->tpl->setVar('form_action',$this->formDef["action"]); + $app->tpl->setVar('form_active_tab',$active_tab); + + // Set form title + $form_hint = $this->lng($this->formDef["title"]); + if($this->formDef["description"] != '') $form_hint .= '
'.$this->lng($this->formDef["description"]).'
'; + $app->tpl->setVar('form_hint',$form_hint); + + // Set Wordbook for this form + + $app->tpl->setVar($this->wordbook); + } + + function getDataRecord($primary_id) { + global $app; + $escape = '`'; + $sql = "SELECT * FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id." AND ".$this->getAuthSQL('r',$this->formDef['db_table']); + return $app->db->queryOneRecord($sql); + } + + + function datalogSave($action,$primary_id, $record_old, $record_new) { + global $app,$conf; + + $app->db->datalogSave($this->formDef['db_table'], $action, $this->formDef['db_table_idx'], $primary_id, $record_old, $record_new); + return true; + } + + function getAuthSQL($perm, $table = '') { + if($_SESSION["s"]["user"]["typ"] == 'admin') { + return '1'; + } else { + if ($table != ''){ + $table = ' ' . $table . '.'; + } + $groups = ( $_SESSION["s"]["user"]["groups"] ) ? $_SESSION["s"]["user"]["groups"] : 0; + $sql = '('; + $sql .= "(" . $table . "sys_userid = ".$_SESSION["s"]["user"]["userid"]." AND " . $table . "sys_perm_user like '%$perm%') OR "; + $sql .= "(" . $table . "sys_groupid IN (".$groups.") AND " . $table ."sys_perm_group like '%$perm%') OR "; + $sql .= $table . "sys_perm_other like '%$perm%'"; + $sql .= ')'; + + return $sql; + } + } +} + +?> -- GitLab