phpBMS

root/trunk/phpbms/modules/base/tabledefs_searchfields.php

Revision 727, 8.4 KB (checked in by brieb, 2 years ago)
  • Added more rights look ups to certain pages
  • Fixed several path disclosure errors
  • Property svn:keywords set to LastChangedBy LastChangedDate LastChangedRevision
Line 
1<?php
2/*
3 $Rev$ | $LastChangedBy$
4 $LastChangedDate$
5 +-------------------------------------------------------------------------+
6 | Copyright (c) 2004 - 2010, Kreotek LLC                                  |
7 | All rights reserved.                                                    |
8 +-------------------------------------------------------------------------+
9 |                                                                         |
10 | Redistribution and use in source and binary forms, with or without      |
11 | modification, are permitted provided that the following conditions are  |
12 | met:                                                                    |
13 |                                                                         |
14 | - Redistributions of source code must retain the above copyright        |
15 |   notice, this list of conditions and the following disclaimer.         |
16 |                                                                         |
17 | - Redistributions in binary form must reproduce the above copyright     |
18 |   notice, this list of conditions and the following disclaimer in the   |
19 |   documentation and/or other materials provided with the distribution.  |
20 |                                                                         |
21 | - Neither the name of Kreotek LLC nor the names of its contributore may |
22 |   be used to endorse or promote products derived from this software     |
23 |   without specific prior written permission.                            |
24 |                                                                         |
25 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS     |
26 | "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT       |
27 | LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A |
28 | PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT      |
29 | OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,   |
30 | SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT        |
31 | LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,   |
32 | DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY   |
33 | THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT     |
34 | (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE   |
35 | OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.    |
36 |                                                                         |
37 +-------------------------------------------------------------------------+
38*/
39
40        include("../../include/session.php");
41        include("include/fields.php");
42        include("include/tabledefs_searchfields_include.php");
43
44        if(!hasRights("Admin"))
45                goURL(APP_PATH."noaccess.php");
46
47        if(!isset($_GET["id"]))
48                $error = new appError(-200, "Passed parameter missing", "Invalid request", true);
49
50        $searchfields = new tableSearchFields($db, $_GET["id"]);
51
52        //grab the table name
53        $querystatement = "SELECT displayname FROM tabledefs WHERE id=".((int) $_GET["id"]);
54        $queryresult = $db->query($querystatement);
55        $tableRecord = $db->fetchArray($queryresult);
56
57        //process page
58        $thecommand="";
59        $action="add search field";
60        $thesearchfield = $searchfields->getDefaults();
61
62        if (isset($_GET["command"])) $thecommand=$_GET["command"];
63        if (isset($_POST["command"])) $thecommand=$_POST["command"];
64
65        switch($thecommand){
66                case "edit":
67                        $singlesearchfieldsquery = $searchfields->get($_GET["searchfieldid"]);
68                        $thesearchfield=$db->fetchArray($singlesearchfieldsquery);
69                        $action="edit search field";
70                break;
71
72                case "delete":
73                        $statusmessage = $searchfields->delete($_GET["searchfieldid"]);
74                break;
75
76                case "add search field":
77                        $statusmessage = $searchfields->add(addSlashesToArray($_POST));
78                break;
79
80                case "edit search field":
81                        $statusmessage = $searchfields->update(addSlashesToArray($_POST));
82                break;
83
84                case "moveup":
85                        $statusmessage = $searchfields->move($_GET["columnid"], "up");
86                break;
87
88                case "movedown":
89                        $statusmessage = $searchfields->move($_GET["columnid"], "down");
90                break;
91        }//end switch
92
93        $searchfieldsquery = $searchfields->get();
94        $pageTitle="Table Definition Search Fields: ".$tableRecord["displayname"];
95
96        $phpbms->cssIncludes[] = "pages/tablequicksearch.css";
97
98                //Form Elements
99                //==============================================================
100                $theform = new phpbmsForm();
101
102                $theinput = new inputField("name",$thesearchfield["name"],NULL,true,NULL,32,64);
103                $theinput->setAttribute("class","important");
104                $theform->addField($theinput);
105
106                $theinput = new  inputBasicList("type",$thesearchfield["type"],array("field"=>"field","SQL where clause"=>"whereclause"));
107                $theform->addField($theinput);
108
109                $theinput = new inputTextarea("field", $thesearchfield["field"], NULL, true, 2, 64, false);
110                $theform->addField($theinput);
111
112                $theform->jsMerge();
113                //==============================================================
114                //End Form Elements
115
116        include("header.php");
117
118        $phpbms->showTabs("tabledefs entry","tab:22d08e82-5047-4150-6de7-49e89149f56b",$_GET["id"])?><div class="bodyline">
119        <h1 id="topTitle"><span><?php echo $pageTitle?></span></h1>
120
121        <div class="fauxP">
122   <table border="0" cellpadding="0" cellspacing="0" class="querytable">
123        <tr>
124         <th align="left" nowrap="nowrap" class="queryheader">move</th>
125         <th align="left" nowrap="nowrap" class="queryheader">type</th>
126         <th align="left" nowrap="nowrap"class="queryheader" width="100%">name</th>
127         <th nowrap="nowrap" class="queryheader">&nbsp;</th>
128        </tr>
129        <?php
130                $topdisplayorder=-1;
131                $row=1;
132                while($therecord=$db->fetchArray($searchfieldsquery)){
133                        $topdisplayorder=$therecord["displayorder"];
134                        if($row==1) $row=2; else $row=1;
135        ?>
136        <tr class="qr<?php echo $row?> noselects">
137                <td nowrap="nowrap" valign="top" class="small">
138                        <button type="button" class="graphicButtons buttonUp" onclick="document.location='<?php echo $_SERVER["PHP_SELF"]."?id=".$_GET["id"]."&amp;command=moveup&amp;columnid=".$therecord["id"]?>';"><span>up</span></button>
139                        <button type="button" class="graphicButtons buttonDown" onclick="document.location='<?php echo $_SERVER["PHP_SELF"]."?id=".$_GET["id"]."&amp;command=movedown&amp;columnid=".$therecord["id"]?>';"><span>dn</span></button>
140                        <?php echo $therecord["displayorder"]?>
141                </td>
142                <td nowrap="nowrap" valign="top" ><?php echo htmlQuotes($therecord["type"]);?></td>
143                <td valign="top">
144                        <strong><?php echo htmlQuotes($therecord["name"])?></strong><br />
145                        <span class="small"><?php echo htmlQuotes($therecord["field"])?></span>
146                </td>
147                <td nowrap="nowrap" valign="top">
148                         <button id="edit<?php echo $therecord["id"]?>" type="button" onclick="document.location='<?php echo $_SERVER["PHP_SELF"]."?id=".$_GET["id"]."&amp;command=edit&amp;searchfieldid=".$therecord["id"]?>';" class="graphicButtons buttonEdit"><span>edit</span></button>
149                         <button id="delete<?php echo $therecord["id"]?>" type="button" onclick="document.location='<?php echo $_SERVER["PHP_SELF"]."?id=".$_GET["id"]."&amp;command=delete&amp;searchfieldid=".$therecord["id"]?>';" class="graphicButtons buttonDelete"><span>delete</span></button>
150                </td>
151        </tr>
152        <?php } ?>
153        <tr class="queryfooter">
154                <td>&nbsp;</td>
155                <td>&nbsp;</td>
156                <td>&nbsp;</td>
157                <td>&nbsp;</td>
158        </tr>
159        </table></div>
160
161        <form action="<?php echo htmlentities($_SERVER["PHP_SELF"])."?id=".$_GET["id"] ?>" method="post" name="record" onsubmit="return validateForm(this);">
162        <fieldset>
163                <legend><?php echo $action?></legend>
164                        <input id="searchfieldid" name="searchfieldid" type="hidden" value="<?php echo $thesearchfield["id"]?>" />
165                        <input id="displayorder" name="displayorder" type="hidden" value="<?php if($action=="add search field") echo $topdisplayorder+1; else echo $thesearchfield["displayorder"]?>" />
166
167                        <p><?php $theform->showField("name")?></p>
168
169                        <p><?php $theform->showField("type")?></p>
170
171                        <p>
172                                <?php $theform->showField("field"); ?><br />
173                                <span class="notes">This can be a simple SQL field name (e.g notes.title) or a complex SQL clause where the value is passed
174                                (e.g. assignedto.firstname like "{{value}}%"or assignedto.lastname like "{{value}}%") depending on the type drop down (above) chosen.</span>
175                        </p>
176        </fieldset>
177                <p align="right">
178                        <input name="command" id="save" type="submit" value="<?php echo $action?>" class="Buttons" />
179                <?php if($action == "edit search field"){?>
180                        <input name="command" id="cancel" type="submit" value="cancel edit" class="Buttons" />
181                <?php }?>
182                </p>
183        </form>
184
185</div>
186<?php include("footer.php");?>
Note: See TracBrowser for help on using the browser.
phpBMS vulnerability assesment provided by Orvant Inc. Copyright © 2010 Kreotek, LLC. All Rights reserved.