Changeset 720 for trunk/phpbms

Timestamp:

01/06/10 17:04:26 (2 years ago)

Author:

brieb

Message:

• fixed checkunique breaking with uuids and possible SQL injection
• fixed backslashes in searches
• fixed mark_as in invoice search commands incorrectly setting value to string 'NULL'

Location:

trunk/phpbms

Files:

• checkunique.php (modified) (1 diff)
• common/javascript/fields.js (modified) (1 diff)
• include/search_class.php (modified) (1 diff)
• modules/bms/include/invoices.php (modified) (4 diffs)
• modules/bms/javascript/product.js (modified) (1 diff)
• search.php (modified) (3 diffs)

trunk/phpbms/checkunique.php

@@ -37 +37 @@
  +-------------------------------------------------------------------------+
 */
-        require ("include/session.php");
 
-        function isUnique($tablename,$column,$value,$excludeid,$db){
-                
-                $thereturn=false;
-                
-                $querystatement="SELECT count(id) AS thecount FROM ".$tablename." WHERE ".$column."=\"".$value."\" AND id!=".$excludeid;
-                $queryresult=$db->query($querystatement);
-                if($queryresult){
-                        $therecord=$db->fetchArray($queryresult);
-                        if($therecord["thecount"]==0)
-                                $thereturn=true;
-                }
-                
-                return $thereturn;
-        }
-        
-        
-        $isunique=false;
-        
-        if(isset($_GET["tdid"]) && isset($_GET["c"]) && isset($_GET["val"]) && isset($_GET["xid"])) {
-                $_GET["tdid"]=((int) $_GET["tdid"]);
-                $_GET["xid"]=((int) $_GET["xid"]);
-                
-                $querystatement="SELECT maintable FROM tabledefs WHERE id=".$_GET["tdid"];
-                $queryresult=$db->query($querystatement);
-                if($queryresult)
-                        if($therecord=$db->fetchArray($queryresult))
-                                $isunique=isUnique($therecord["maintable"],$_GET["c"],$_GET["val"],$_GET["xid"],$db);           
-        }
-        
-        header('Content-Type: text/xml');
-        echo '<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>';
-?>
-<response>
-  <isunique><?php echo ((int) $isunique) ?></isunique>
-</response>
+
+class uniqueChecker{
+
+    var $db;
+
+    function uniqueChecker($db){
+
+        $this->db = $db;
+        $this->db->errorFormat = "json";
+
+    }//end function init
+
+
+    function check($tabledefuuid, $columname, $value, $excludeid = NULL){
+
+        $querystatement = "
+            SELECT
+                `maintable`
+            FROM
+                `tabledefs`
+            WHERE
+                `uuid` = '".mysql_real_escape_string($tabledefuuid)."'";
+
+        $queryresult = $this->db->query($querystatement);
+
+        if($this->db->numRows($queryresult) === 0)
+            return "error";
+
+        $therecord = $this->db->fetchArray($queryresult);
+
+        $table = $therecord["maintable"];
+
+        $columname = mysql_real_escape_string(str_replace("`","", $columname));
+        $value = mysql_real_escape_string($value);
+
+        $querystatement = "
+            SELECT
+                count(id) AS thecount
+            FROM
+                `".$table."`
+            WHERE
+                `".$columname."` = '".$value."'";
+
+        if($excludeid){
+
+            $querystatement .= " AND `uuid` != '".mysql_real_escape_string($excludeid)."'";
+
+        }//endif
+
+        $queryresult = $this->db->query($querystatement);
+
+        $therecord = $this->db->fetchArray($queryresult);
+
+        return ($therecord["thecount"] == 0);
+
+    }//end function check
+
+}//end class
+
+
+/**
+ * PROCESSING ==================================================================
+ */
+if(!isset($noOutput)){
+
+    require_once("include/session.php");
+
+    if(!isset($_GET["tduuid"]) || !isset($_GET["cname"]) || !isset($_GET["value"]))
+        $error = new appError(200, "passed parameters not set");
+
+    if(!isset($_GET["xuuid"]))
+        $_GET["xuuid"] = "";
+
+    $checker = new uniqueChecker($db);
+
+    echo json_encode($checker->check($_GET["tduuid"], $_GET["cname"], $_GET["value"], $_GET["xuuid"]));
+
+}//endif

trunk/phpbms/common/javascript/fields.js

@@ -237 +237 @@
 }
 
-function checkUnique(tabledefid,column,checkvalue,excludeid){
-
-        var theurl=APP_PATH+"checkunique.php?tdid="+parseInt(tabledefid);
-        theurl=theurl+"&c="+encodeURIComponent(column);
-        theurl=theurl+"&val="+encodeURIComponent(checkvalue);
-        theurl=theurl+"&xid="+parseInt(excludeid);
-
+function checkUnique(tabledefuuid , columnName, value, excludeuuid){
+
+        var theurl= APP_PATH + "checkunique.php?tduuid=" + encodeURIComponent(tabledefuuid);
+
+        theurl=theurl+"&cname="+encodeURIComponent(columnName);
+        theurl=theurl+"&value="+encodeURIComponent(value);
+        theurl=theurl+"&xuuid="+encodeURIComponent(excludeuuid);
 
         loadXMLDoc(theurl,null,false);
 
-        response = req.responseXML.documentElement;
-        thevalue = response.getElementsByTagName('isunique')[0].firstChild.data;
-
-        if(thevalue==1) return true; else return false;
-}
+        var isUnique = false;
+
+        try {
+
+            isUnique = eval("(" + req.responseText + ")")
+
+        } catch(err) {
+
+            isUnique = false;
+
+        }
+
+        return isUnique;
+
+}

trunk/phpbms/include/search_class.php

@@ -671 +671 @@
 
                 <label for="startswith">starts with</label><br />
-                <input id="startswith" name="startswith" type="text"  value="<?php if($this->querytype=="search" and isset($this->savedstartswith)) echo formatVariable($this->savedstartswith) ?>" size="35" maxlength="128" tabindex="1"/>
+                <input id="startswith" name="startswith" type="text"  value="<?php if($this->querytype=="search" and isset($this->savedstartswith)) echo formatVariable(stripslashes(stripslashes($this->savedstartswith))) ?>" size="35" maxlength="128" tabindex="1"/>
 
             </p>

trunk/phpbms/modules/bms/include/invoices.php

@@ -816 +816 @@
                                 }//end if
 
-                                if(!in_array(((string)$variables["assignedtoid"]),$this->_availableUserUUIDs))
+                                if(!in_array(((string)$variables["assignedtoid"]), $this->_availableUserUUIDs))
                                         $this->verifyErrors[] = "The `assignedtoid` field does not give an existing/acceptable user id number.";
 
@@ -1556 +1556 @@
 
                                 if($therecord["defaultassignedtoid"]!="")
-                                        $assignedtoid = $therecord["defaultassignedtoid"];
+                                        $assignedtoid = "'".$therecord["defaultassignedtoid"]."'";
                                 else
                                         $assignedtoid="NULL";
@@ -1595 +1595 @@
                                         SET
                                                 invoices.statusdate=NOW(),
-                                                assignedtoid='".$assignedtoid."',
+                                                assignedtoid=".$assignedtoid.",
                                                 modifiedby=".$_SESSION["userinfo"]["id"].", ";
 
@@ -1627 +1627 @@
                                 $querystatement="INSERT INTO invoicestatushistory (invoiceid,invoicestatusid,statusdate,assignedtoid) values (";
                                 $querystatement.="'".$therecord["uuid"]."','".$statusid."',NOW(),";
-                                $querystatement.="'".$assignedtoid."'";
+                                $querystatement.= $assignedtoid;
                                 $querystatement.=")";
                                 $insertresult = $this->db->query($querystatement);

trunk/phpbms/modules/bms/javascript/product.js

@@ -81 +81 @@
 
         var partnumber = getObjectFromID("partnumber");
-        var excludeid = getObjectFromID("id");
-
-        if(!checkUnique(4, "partnumber", partnumber.value, parseInt(excludeid.value))){
+        var excludeid = getObjectFromID("uuid");
+
+        if(!checkUnique('tbld:7a9e87ed-d165-c4a4-d9b9-0a4adc3c5a34', "partnumber", partnumber.value, excludeid.value)){
 
             alert("Part number must be unique.");

trunk/phpbms/search.php

@@ -49 +49 @@
         //initialize the object
         $displayTable->initialize($_GET["id"]);
-        
-        if (isset($passedjoinclause)) $_SESSION["passedjoinclause"] = $passedjoinclause; 
-        if (isset($passedjoinwhere)) $_SESSION["passedjoinwhere"] = $passedjoinwhere; 
+
+        if (isset($passedjoinclause)) $_SESSION["passedjoinclause"] = $passedjoinclause;
+        if (isset($passedjoinwhere)) $_SESSION["passedjoinwhere"] = $passedjoinwhere;
 
 
@@ -121 +121 @@
 
                         }//endif
-                        
+
                         /**
-                          *  If the command is a push command, include tables.php 
+                          *  If the command is a push command, include tables.php
                           */
                         if(strpos($functionname, ":") !== false)
                                 include("include/tables.php");
-                        
+
                         //try to include table specific functions
                         if(file_exists("modules/".$displayTable->thetabledef["name"]."/include/".$displayTable->thetabledef["maintable"].".php"))
@@ -142 +142 @@
 
                         if(!preg_match("/\:/", $functionname)){
-                                
+
                                 if(method_exists($searchFunctions,$functionname))
                                         $statusmessage = $searchFunctions->$functionname();
                                 else
                                         $statusmessage = "Function ".$functionname." not defined";
-                                        
+
                         }else{
-                                
+
                                 if(moduleExists("mod:b2d42220-443b-fe74-dbdb-ed2c0968c38c", $phpbms->modules))
                                         $statusmessage = $searchFunctions->runPush($therecord["name"]);
-                                
+
                         }//end if
                         break;