Changeset 726

Timestamp:

01/06/10 23:35:21 (2 years ago)

Author:

brieb

Message:

• We bother to program security roles, and then forget to set those roles for the most crucial area - users. Ugh!

Location:

trunk/phpbms

Files:

• install/tabledefs.sql (modified) (1 diff)
• install/updatev0.98.sql (modified) (5 diffs)
• loadsearch.php (modified) (1 diff)
• modules/base/tabledefs_addedit.php (modified) (1 diff)

trunk/phpbms/install/tabledefs.sql

@@ -1 @@
-INSERT INTO `tabledefs` (`uuid`, `displayname`, `prefix`, `type`, `moduleid`, `maintable`, `querytable`, `editfile`, `editroleid`, `addfile`, `addroleid`, `importfile`, `importroleid`, `searchroleid`, `advsearchroleid`, `viewsqlroleid`, `deletebutton`, `canpost`, `hascustomfields`, `defaultwhereclause`, `defaultsortorder`, `defaultsearchtype`, `defaultcriteriafindoptions`, `defaultcriteriaselection`, `createdby`, `creationdate`, `modifiedby`, `modifieddate`) VALUES ('tbld:afe6d297-b484-4f0b-57d4-1c39412e9dfb', 'Users', 'usr', 'system', 'mod:29873ee8-c12a-e3f6-9010-4cd24174ffd7', 'users', 'users', 'modules/base/users_addedit.php', '', 'modules/base/users_addedit.php', '', NULL, 'Admin', '', 'Admin', 'Admin', 'revoke', '0', '1', 'users.id !=0', 'users.id', '', '', '', 1, NOW(), 1, NOW());
-INSERT INTO `tabledefs` (`uuid`, `displayname`, `prefix`, `type`, `moduleid`, `maintable`, `querytable`, `editfile`, `editroleid`, `addfile`, `addroleid`, `importfile`, `importroleid`, `searchroleid`, `advsearchroleid`, `viewsqlroleid`, `deletebutton`, `canpost`, `hascustomfields`, `defaultwhereclause`, `defaultsortorder`, `defaultsearchtype`, `defaultcriteriafindoptions`, `defaultcriteriaselection`, `createdby`, `creationdate`, `modifiedby`, `modifieddate`) VALUES ('tbld:8d19c73c-42fb-d829-3681-d20b4dbe43b9', 'Relationships', 'rln', 'system', 'mod:29873ee8-c12a-e3f6-9010-4cd24174ffd7', 'relationships', '(`relationships` INNER JOIN `tabledefs` AS `fromtable` ON `relationships`.`fromtableid`=`fromtable`.`uuid`) INNER JOIN `tabledefs` AS `totable` ON `relationships`.`totableid`=`totable`.`uuid`', 'modules/base/relationships_addedit.php', '', 'modules/base/relationships_addedit.php', '', NULL, 'Admin', '', 'Admin', 'Admin', 'delete', '0', '0', 'relationships.id != 0', 'fromtable.displayname, name', '', '', '', 1, NOW(), 1, NOW());
+INSERT INTO `tabledefs` (`uuid`, `displayname`, `prefix`, `type`, `moduleid`, `maintable`, `querytable`, `editfile`, `editroleid`, `addfile`, `addroleid`, `importfile`, `importroleid`, `searchroleid`, `advsearchroleid`, `viewsqlroleid`, `deletebutton`, `canpost`, `hascustomfields`, `defaultwhereclause`, `defaultsortorder`, `defaultsearchtype`, `defaultcriteriafindoptions`, `defaultcriteriaselection`, `createdby`, `creationdate`, `modifiedby`, `modifieddate`) VALUES ('tbld:afe6d297-b484-4f0b-57d4-1c39412e9dfb', 'Users', 'usr', 'system', 'mod:29873ee8-c12a-e3f6-9010-4cd24174ffd7', 'users', 'users', 'modules/base/users_addedit.php', 'Admin', 'modules/base/users_addedit.php', 'Admin', NULL, 'Admin', 'Admin', 'Admin', 'Admin', 'revoke', '0', '1', 'users.id !=0', 'users.id', '', '', '', 1, NOW(), 1, NOW());
+INSERT INTO `tabledefs` (`uuid`, `displayname`, `prefix`, `type`, `moduleid`, `maintable`, `querytable`, `editfile`, `editroleid`, `addfile`, `addroleid`, `importfile`, `importroleid`, `searchroleid`, `advsearchroleid`, `viewsqlroleid`, `deletebutton`, `canpost`, `hascustomfields`, `defaultwhereclause`, `defaultsortorder`, `defaultsearchtype`, `defaultcriteriafindoptions`, `defaultcriteriaselection`, `createdby`, `creationdate`, `modifiedby`, `modifieddate`) VALUES ('tbld:8d19c73c-42fb-d829-3681-d20b4dbe43b9', 'Relationships', 'rln', 'system', 'mod:29873ee8-c12a-e3f6-9010-4cd24174ffd7', 'relationships', '(`relationships` INNER JOIN `tabledefs` AS `fromtable` ON `relationships`.`fromtableid`=`fromtable`.`uuid`) INNER JOIN `tabledefs` AS `totable` ON `relationships`.`totableid`=`totable`.`uuid`', 'modules/base/relationships_addedit.php', 'Admin', 'modules/base/relationships_addedit.php', 'Admin', NULL, 'Admin', 'Admin', 'Admin', 'Admin', 'delete', '0', '0', 'relationships.id != 0', 'fromtable.displayname, name', '', '', '', 1, NOW(), 1, NOW());
 INSERT INTO `tabledefs` (`uuid`, `displayname`, `prefix`, `type`, `moduleid`, `maintable`, `querytable`, `editfile`, `editroleid`, `addfile`, `addroleid`, `importfile`, `importroleid`, `searchroleid`, `advsearchroleid`, `viewsqlroleid`, `deletebutton`, `canpost`, `hascustomfields`, `defaultwhereclause`, `defaultsortorder`, `defaultsearchtype`, `defaultcriteriafindoptions`, `defaultcriteriaselection`, `createdby`, `creationdate`, `modifiedby`, `modifieddate`) VALUES ('tbld:5c9d645f-26ab-5003-b98e-89e9049f8ac3', 'Table Definitions', 'tbld', 'system', 'mod:29873ee8-c12a-e3f6-9010-4cd24174ffd7', 'tabledefs', '`tabledefs` LEFT JOIN `modules` ON `tabledefs`.`moduleid` = `modules`.`uuid`', 'modules/base/tabledefs_addedit.php', 'Admin', 'modules/base/tabledefs_addedit.php', 'Admin', NULL, 'Admin', 'Admin', 'Admin', 'Admin', 'delete', '0', '0', 'tabledefs.id != 0', 'modules.name, tabledefs.displayname', '', '', '', 1, NOW(), 1, NOW());
 INSERT INTO `tabledefs` (`uuid`, `displayname`, `prefix`, `type`, `moduleid`, `maintable`, `querytable`, `editfile`, `editroleid`, `addfile`, `addroleid`, `importfile`, `importroleid`, `searchroleid`, `advsearchroleid`, `viewsqlroleid`, `deletebutton`, `canpost`, `hascustomfields`, `defaultwhereclause`, `defaultsortorder`, `defaultsearchtype`, `defaultcriteriafindoptions`, `defaultcriteriaselection`, `createdby`, `creationdate`, `modifiedby`, `modifieddate`) VALUES ('tbld:a4cdd991-cf0a-916f-1240-49428ea1bdd1', 'Notes', 'note', 'table', 'mod:29873ee8-c12a-e3f6-9010-4cd24174ffd7', 'notes', 'notes', 'modules/base/notes_addedit.php', '', 'modules/base/notes_addedit.php', '', NULL, 'Admin', '', 'Admin', 'Admin', 'delete', '0', '1', 'notes.type=\'NT\' AND notes.createdby = {{$_SESSION[\'userinfo\'][\'id\']}} AND completed=0', 'notes.category,notes.type,notes.importance DESC,notes.creationdate', 'search', 'My Unread Notes', 'new', 1, NOW(), 1, NOW());
-INSERT INTO `tabledefs` (`uuid`, `displayname`, `prefix`, `type`, `moduleid`, `maintable`, `querytable`, `editfile`, `editroleid`, `addfile`, `addroleid`, `importfile`, `importroleid`, `searchroleid`, `advsearchroleid`, `viewsqlroleid`, `deletebutton`, `canpost`, `hascustomfields`, `defaultwhereclause`, `defaultsortorder`, `defaultsearchtype`, `defaultcriteriafindoptions`, `defaultcriteriaselection`, `createdby`, `creationdate`, `modifiedby`, `modifieddate`) VALUES ('tbld:d595ef42-db9d-2233-1b9b-11dfd0db9cbb', 'Reports', 'rpt', 'system', 'mod:29873ee8-c12a-e3f6-9010-4cd24174ffd7', 'reports', '`reports` LEFT JOIN `tabledefs` ON `reports`.`tabledefid` = `tabledefs`.`uuid`', 'modules/base/reports_addedit.php', '', 'modules/base/reports_addedit.php', '', NULL, 'Admin', '', 'Admin', 'Admin', 'delete', '0', '0', 'reports.id != 0', 'tabledefid,displayorder DESC, reports.name', '', '', '', 1, NOW(), 1, NOW());
-INSERT INTO `tabledefs` (`uuid`, `displayname`, `prefix`, `type`, `moduleid`, `maintable`, `querytable`, `editfile`, `editroleid`, `addfile`, `addroleid`, `importfile`, `importroleid`, `searchroleid`, `advsearchroleid`, `viewsqlroleid`, `deletebutton`, `canpost`, `hascustomfields`, `defaultwhereclause`, `defaultsortorder`, `defaultsearchtype`, `defaultcriteriafindoptions`, `defaultcriteriaselection`, `createdby`, `creationdate`, `modifiedby`, `modifieddate`) VALUES ('tbld:e251524a-2da4-a0c9-8725-d3d0412d8f4a', 'Saved Searches/Sorts', 'sss', 'system', 'mod:29873ee8-c12a-e3f6-9010-4cd24174ffd7', 'usersearches', '(`usersearches` LEFT JOIN `users` ON `usersearches`.`userid` = `users`.`uuid`) INNER JOIN `tabledefs` ON `usersearches`.`tabledefid`=`tabledefs`.`uuid`', 'modules/base/usersearches_edit.php', '', 'N/A', '', NULL, 'Admin', '', 'Admin', 'Admin', 'delete', '0', '0', 'usersearches.id != 0', 'usersearches.name', '', '', '', 1, NOW(), 1, NOW());
+INSERT INTO `tabledefs` (`uuid`, `displayname`, `prefix`, `type`, `moduleid`, `maintable`, `querytable`, `editfile`, `editroleid`, `addfile`, `addroleid`, `importfile`, `importroleid`, `searchroleid`, `advsearchroleid`, `viewsqlroleid`, `deletebutton`, `canpost`, `hascustomfields`, `defaultwhereclause`, `defaultsortorder`, `defaultsearchtype`, `defaultcriteriafindoptions`, `defaultcriteriaselection`, `createdby`, `creationdate`, `modifiedby`, `modifieddate`) VALUES ('tbld:d595ef42-db9d-2233-1b9b-11dfd0db9cbb', 'Reports', 'rpt', 'system', 'mod:29873ee8-c12a-e3f6-9010-4cd24174ffd7', 'reports', '`reports` LEFT JOIN `tabledefs` ON `reports`.`tabledefid` = `tabledefs`.`uuid`', 'modules/base/reports_addedit.php', 'Admin', 'modules/base/reports_addedit.php', 'Admin', NULL, 'Admin', 'Admin', 'Admin', 'Admin', 'delete', '0', '0', 'reports.id != 0', 'tabledefid,displayorder DESC, reports.name', '', '', '', 1, NOW(), 1, NOW());
+INSERT INTO `tabledefs` (`uuid`, `displayname`, `prefix`, `type`, `moduleid`, `maintable`, `querytable`, `editfile`, `editroleid`, `addfile`, `addroleid`, `importfile`, `importroleid`, `searchroleid`, `advsearchroleid`, `viewsqlroleid`, `deletebutton`, `canpost`, `hascustomfields`, `defaultwhereclause`, `defaultsortorder`, `defaultsearchtype`, `defaultcriteriafindoptions`, `defaultcriteriaselection`, `createdby`, `creationdate`, `modifiedby`, `modifieddate`) VALUES ('tbld:e251524a-2da4-a0c9-8725-d3d0412d8f4a', 'Saved Searches/Sorts', 'sss', 'system', 'mod:29873ee8-c12a-e3f6-9010-4cd24174ffd7', 'usersearches', '(`usersearches` LEFT JOIN `users` ON `usersearches`.`userid` = `users`.`uuid`) INNER JOIN `tabledefs` ON `usersearches`.`tabledefid`=`tabledefs`.`uuid`', 'modules/base/usersearches_edit.php', 'Admin', 'N/A', 'Admin', NULL, 'Admin', 'Admin', 'Admin', 'Admin', 'delete', '0', '0', 'usersearches.id != 0', 'usersearches.name', '', '', '', 1, NOW(), 1, NOW());
 INSERT INTO `tabledefs` (`uuid`, `displayname`, `prefix`, `type`, `moduleid`, `maintable`, `querytable`, `editfile`, `editroleid`, `addfile`, `addroleid`, `importfile`, `importroleid`, `searchroleid`, `advsearchroleid`, `viewsqlroleid`, `deletebutton`, `canpost`, `hascustomfields`, `defaultwhereclause`, `defaultsortorder`, `defaultsearchtype`, `defaultcriteriafindoptions`, `defaultcriteriaselection`, `createdby`, `creationdate`, `modifiedby`, `modifieddate`) VALUES ('tbld:83187e3d-101e-a8a5-037f-31e9800fed2d', 'Menu', 'menu', 'system', 'mod:29873ee8-c12a-e3f6-9010-4cd24174ffd7', 'menu', '((menu LEFT JOIN menu as parentmenu on menu.parentid=parentmenu.uuid) LEFT JOIN roles on menu.roleid=roles.uuid)', 'modules/base/menu_addedit.php', 'Admin', 'modules/base/menu_addedit.php', 'Admin', NULL, 'Admin', 'Admin', 'Admin', 'Admin', 'delete', '0', '0', 'menu.id!=0', 'if(parentmenu.name is null,menu.displayorder,parentmenu.displayorder+(menu.displayorder+1)/10000)', '', '', '', 1, NOW(), 1, NOW());
-INSERT INTO `tabledefs` (`uuid`, `displayname`, `prefix`, `type`, `moduleid`, `maintable`, `querytable`, `editfile`, `editroleid`, `addfile`, `addroleid`, `importfile`, `importroleid`, `searchroleid`, `advsearchroleid`, `viewsqlroleid`, `deletebutton`, `canpost`, `hascustomfields`, `defaultwhereclause`, `defaultsortorder`, `defaultsearchtype`, `defaultcriteriafindoptions`, `defaultcriteriaselection`, `createdby`, `creationdate`, `modifiedby`, `modifieddate`) VALUES ('tbld:ea159d67-5e89-5b7f-f5a0-c740e147cd73', 'Installed Modules', 'mod', 'system', 'mod:29873ee8-c12a-e3f6-9010-4cd24174ffd7', 'modules', 'modules', 'modules/base/modules_view.php', '', 'modules/base/modules_view.php', '', NULL, 'Admin', '', 'Admin', 'Admin', 'NA', '0', '0', 'modules.id!=0', 'modules.name', '', '', '', 1, NOW(), 1, NOW());
+INSERT INTO `tabledefs` (`uuid`, `displayname`, `prefix`, `type`, `moduleid`, `maintable`, `querytable`, `editfile`, `editroleid`, `addfile`, `addroleid`, `importfile`, `importroleid`, `searchroleid`, `advsearchroleid`, `viewsqlroleid`, `deletebutton`, `canpost`, `hascustomfields`, `defaultwhereclause`, `defaultsortorder`, `defaultsearchtype`, `defaultcriteriafindoptions`, `defaultcriteriaselection`, `createdby`, `creationdate`, `modifiedby`, `modifieddate`) VALUES ('tbld:ea159d67-5e89-5b7f-f5a0-c740e147cd73', 'Installed Modules', 'mod', 'system', 'mod:29873ee8-c12a-e3f6-9010-4cd24174ffd7', 'modules', 'modules', 'modules/base/modules_view.php', 'Admin', 'modules/base/modules_view.php', 'Admin', NULL, 'Admin', 'Admin', 'Admin', 'Admin', 'NA', '0', '0', 'modules.id!=0', 'modules.name', '', '', '', 1, NOW(), 1, NOW());
 INSERT INTO `tabledefs` (`uuid`, `displayname`, `prefix`, `type`, `moduleid`, `maintable`, `querytable`, `editfile`, `editroleid`, `addfile`, `addroleid`, `importfile`, `importroleid`, `searchroleid`, `advsearchroleid`, `viewsqlroleid`, `deletebutton`, `canpost`, `hascustomfields`, `defaultwhereclause`, `defaultsortorder`, `defaultsearchtype`, `defaultcriteriafindoptions`, `defaultcriteriaselection`, `createdby`, `creationdate`, `modifiedby`, `modifieddate`) VALUES ('tbld:2bc3e683-81f9-694a-9550-a0c7263057de', 'Tasks', NULL, 'view', 'mod:29873ee8-c12a-e3f6-9010-4cd24174ffd7', 'notes', '((`notes` LEFT JOIN `users` AS `assignedto` ON `assignedto`.`uuid` = `notes`.`assignedtoid`)  LEFT JOIN `users` as `assignedby` ON `assignedby`.`uuid`=`notes`.`assignedbyid`)', 'modules/base/notes_addedit.php?backurl=../../search.php?id=23', '', 'modules/base/notes_addedit.php?ty=TS&backurl=../../search.php?id=23', '', NULL, 'Admin', '', 'Admin', 'Admin', 'delete', '0', '0', 'notes.type=\'TS\' AND notes.createdby = {{$_SESSION[\'userinfo\'][\'id\']}} AND completed=0', 'notes.category,notes.enddate,notes.endtime,notes.startdate,notes.starttime,notes.importance DESC,notes.subject', 'search', 'My Uncompleted Tasks', '', 1, NOW(), 1, NOW());
 INSERT INTO `tabledefs` (`uuid`, `displayname`, `prefix`, `type`, `moduleid`, `maintable`, `querytable`, `editfile`, `editroleid`, `addfile`, `addroleid`, `importfile`, `importroleid`, `searchroleid`, `advsearchroleid`, `viewsqlroleid`, `deletebutton`, `canpost`, `hascustomfields`, `defaultwhereclause`, `defaultsortorder`, `defaultsearchtype`, `defaultcriteriafindoptions`, `defaultcriteriaselection`, `createdby`, `creationdate`, `modifiedby`, `modifieddate`) VALUES ('tbld:0fcca651-6c34-c74d-ac04-2d88f602dd71', 'Events', NULL, 'view', 'mod:29873ee8-c12a-e3f6-9010-4cd24174ffd7', 'notes', '((`notes` LEFT JOIN `users` AS `assignedto` ON `assignedto`.`uuid` = `notes`.`assignedtoid`)  LEFT JOIN `users` as `assignedby` ON `assignedby`.`uuid`=`notes`.`assignedbyid`)', 'modules/base/notes_addedit.php?backurl=../../search.php?id=24', '', 'modules/base/notes_addedit.php?ty=EV&backurl=../../search.php?id=24', '', NULL, 'Admin', '', 'Admin', 'Admin', 'delete', '0', '0', 'notes.type=\'EV\' AND notes.createdby = {{$_SESSION[\'userinfo\'][\'id\']}} AND ((notes.startdate = year(notes.startdate)=year(curdate()) and week(notes.startdate)=week(curdate())))', 'notes.startdate DESC,notes.starttime DESC,notes.enddate DESC,notes.endtime DESC,notes.importance', 'search', NULL, NULL, 1, NOW(), 1, NOW());

trunk/phpbms/install/updatev0.98.sql

@@ -335 +335 @@
 UPDATE `tabledefs` SET
     `uuid` = 'tbld:afe6d297-b484-4f0b-57d4-1c39412e9dfb',
+    `searchroleid` = -100,
+    `addroleid` = -100,
+    `editroleid` = -100,
     `prefix` = 'usr'
 WHERE
@@ -341 +344 @@
 UPDATE `tabledefs` SET
     `uuid`='tbld:8d19c73c-42fb-d829-3681-d20b4dbe43b9',
+    `searchroleid` = -100,
+    `addroleid` = -100,
+    `editroleid` = -100,
     `prefix` = 'rln',
     `querytable` = '(`relationships` INNER JOIN `tabledefs` AS `fromtable` ON `relationships`.`fromtableid`=`fromtable`.`uuid`) INNER JOIN `tabledefs` AS `totable` ON `relationships`.`totableid`=`totable`.`uuid`'
@@ -361 +367 @@
 UPDATE `tabledefs` SET
     `uuid`='tbld:d595ef42-db9d-2233-1b9b-11dfd0db9cbb',
+    `searchroleid` = -100,
+    `addroleid` = -100,
+    `editroleid` = -100,
     `prefix` = 'rpt',
     `querytable` = '`reports` LEFT JOIN `tabledefs` ON `reports`.`tabledefid` = `tabledefs`.`uuid`'
@@ -368 +377 @@
 UPDATE `tabledefs` SET
     `uuid`='tbld:e251524a-2da4-a0c9-8725-d3d0412d8f4a',
+    `searchroleid` = -100,
+    `addroleid` = -100,
+    `editroleid` = -100,
     `prefix` = 'sss',
     `querytable` = '(`usersearches` LEFT JOIN `users` ON `usersearches`.`userid` = `users`.`uuid`) INNER JOIN `tabledefs` ON `usersearches`.`tabledefid`=`tabledefs`.`uuid`'
@@ -375 +387 @@
 UPDATE `tabledefs` SET
     `uuid`='tbld:ea159d67-5e89-5b7f-f5a0-c740e147cd73',
+    `searchroleid` = -100,
+    `addroleid` = -100,
+    `editroleid` = -100,
     `prefix` = 'mod'
 WHERE

trunk/phpbms/loadsearch.php

@@ -37 +37 @@
  +-------------------------------------------------------------------------+
 */
-        require("include/session.php");
-
-        class savedSearch{
-
-                var $db;
-
-                function savedSearch($db){
-                        $this->db=$db;
-                }
-
-                function delete($id){
-                        $querystatement="DELETE FROM usersearches
-                                                        WHERE id=".((int) $id);
-                        $queryresult = $this->db->query($querystatement);
-
-                        echo "success";
-                }
-
-
-                /**
-                 * saves current search
-                 *
-                 * @param string $name name to save search as
-                 * @param integer $tabledefid table definition's id
-                 * @param string $userid uuid of user
-                 */
-                function save($name,$tabledefid,$userid){
-
-                        $uuid = getUuid($this->db, "tbld:5c9d645f-26ab-5003-b98e-89e9049f8ac3", $tabledefid);
-
-                        $querystatement = "
-                SELECT
-                    `prefix`
-                FROM
-                    `tabledefs`
-                WHERE
-                    `uuid` = '".$uuid."'
-            ";
+
+class savedSearch{
+
+    var $db;
+
+    function savedSearch($db){
+
+        $this->db=$db;
+
+    }//end function init
+
+
+    function delete($id){
+
+        $querystatement="DELETE FROM usersearches
+                                        WHERE id=".((int) $id);
+        $queryresult = $this->db->query($querystatement);
+
+        echo "success";
+
+    }//end function delete
+
+
+    /**
+     * saves current search
+     *
+     * @param string $name name to save search as
+     * @param integer $tabledefid table definition's id
+     * @param string $userid uuid of user
+     */
+    function save($name,$tabledefid,$userid){
+
+        $uuid = getUuid($this->db, "tbld:5c9d645f-26ab-5003-b98e-89e9049f8ac3", $tabledefid);
+
+        $querystatement = "
+            SELECT
+                `prefix`
+            FROM
+                `tabledefs`
+            WHERE
+                `uuid` = '".$uuid."'";
+
+        $queryresult = $this->db->query($querystatement);
+
+        $therecord = $this->db->fetchArray($queryresult);
+        $prefix = $therecord["prefix"];
+
+        $insertstatement = "
+                INSERT INTO
+                        usersearches
+                (
+                        userid,
+                        tabledefid,
+                        name,
+                        `type`,
+                        sqlclause,
+                        `uuid`
+                ) VALUES (
+                        '".mysql_real_escape_string($userid)."',
+                        '".mysql_real_escape_string($uuid)."',
+                        '".mysql_real_escape_string($name)."',
+                        'SCH',
+                        '".addslashes($_SESSION["tableparams"][$tabledefid]["querywhereclause"])."',
+                        '".uuid($prefix.":")."'
+                )";
+
+        $this->db->query($insertstatement);
+
+        echo "search saved";
+
+    }//endfunction save
+
+
+    /**
+     * displays sql clause for saved search
+     *
+     * @param integer $id savedsearch id
+     */
+    function get($id){
+
+        $querystatement="
+                    SELECT
+                            sqlclause
+                    FROM
+                            usersearches
+                    WHERE id=".((int) $id);
+
+        $queryresult = $this->db->query($querystatement);
+
+        $therecord = $this->db->fetchArray($queryresult);
+
+        echo $therecord["sqlclause"];
+
+    }//end function
+
+
+    /**
+     * generates the select input of saved searches
+     *
+     * @param mysql query result $queryresult
+     */
+    function showSavedSearchList($queryresult){
+
+        $numrows = $this->db->numRows($queryresult);
+
+        ?>
+        <select id="LSList" name="LSList" <?php if ($numrows<1) echo "disabled" ?> size="10" style="width:170px;height:160px;" onchange="LSsearchSelect(this,'<?php echo APP_PATH ?>')">
+            <?php if($numrows<1) {?>
+
+                <option value="NA">No Saved Searches</option>
+
+            <?php
+                } else {
+
+                    $numglobal=0;
+
+                    while($therecord=$this->db->fetchArray($queryresult))
+                            if($therecord["userid"]<1) $numglobal++;
+
+                    $this->db->seek($queryresult,0);
+
+                     if($numglobal>0){ ?>
+                            <option value="NA" style="font-style:italic;font-weight:bold"> -- global searches ---------</option>
+                    <?php
+                    }//end if
+
+                    $userqueryline = true;
+
+                    while($therecord=$this->db->fetchArray($queryresult)){
+
+                        if ($therecord["userid"] != '' and $userqueryline) {
+
+                            $userqueryline = false;
+
+                            ?><option value="NA" style="font-style:italic;font-weight:bold"> -- user searches ---------</option><?php
+
+                        }//endif
+
+                        ?><option value="<?php echo $therecord["id"]?>"><?php echo $therecord["name"]?></option><?php
+
+                    }// end while
+
+                }//end if
+                ?>
+        </select>
+        <?php
+
+    }//end function showSavedSearchList
+
+
+    /**
+     * displays the load box for saved searches
+     *
+     * @param integer $tabledefid id of tabledef
+     * @param string $userid uuid of user
+     * @param string $securitywhere additional security based where clause to pass
+     */
+    function showLoad($tabledefid,$userid,$securitywhere){
+
+            $uuid = getUuid($this->db, "tbld:5c9d645f-26ab-5003-b98e-89e9049f8ac3", $tabledefid);
+
+            $querystatement = "
+                    SELECT
+                            id,
+                            name,
+                            userid
+                    FROM
+                            usersearches
+                    WHERE
+                            tabledefid = '".$uuid."'
+                            AND type='SCH'
+                            AND (
+                                    (userid = '' ".$securitywhere.")
+                                    OR userid = '".$userid."')
+                    ORDER BY
+                            userid,
+                            name";
 
             $queryresult = $this->db->query($querystatement);
 
-            $therecord = $this->db->fetchArray($queryresult);
-            $prefix = $therecord["prefix"];
-
-                        $insertstatement = "
-                                INSERT INTO
-                                        usersearches
-                                (
-                                        userid,
-                                        tabledefid,
-                                        name,
-                                        `type`,
-                                        sqlclause,
-                                        `uuid`
-                                ) VALUES (
-                                        '".mysql_real_escape_string($userid)."',
-                                        '".mysql_real_escape_string($uuid)."',
-                                        '".mysql_real_escape_string($name)."',
-                                        'SCH',
-                                        '".addslashes($_SESSION["tableparams"][$tabledefid]["querywhereclause"])."',
-                                        '".uuid($prefix.":")."'
-                                )";
-
-                        $this->db->query($insertstatement);
-
-                        echo "search saved";
-
-                }//endfunction save
-
-
-                /**
-                 * displays sql clause for saved search
-                 *
-                 * @param integer $id savedsearch id
-                 */
-                function get($id){
-
-                    $querystatement="
-                                SELECT
-                                        sqlclause
-                                FROM
-                                        usersearches
-                                WHERE id=".((int) $id);
-
-                    $queryresult = $this->db->query($querystatement);
-
-                    $therecord = $this->db->fetchArray($queryresult);
-
-                    echo $therecord["sqlclause"];
-
-                }//end function
-
-
-                /**
-                 * generates the select input of saved searches
-                 *
-                 * @param mysql query result $queryresult
-                 */
-                function showSavedSearchList($queryresult){
-
-                        $numrows = $this->db->numRows($queryresult);
-
-                        ?>
-                        <select id="LSList" name="LSList" <?php if ($numrows<1) echo "disabled" ?> size="10" style="width:170px;height:160px;" onchange="LSsearchSelect(this,'<?php echo APP_PATH ?>')">
-                                <?php if($numrows<1) {?>
-
-                                        <option value="NA">No Saved Searches</option>
-
-                                <?php
-                                        } else {
-
-                                                $numglobal=0;
-
-                                                while($therecord=$this->db->fetchArray($queryresult))
-                                                        if($therecord["userid"]<1) $numglobal++;
-
-                                                $this->db->seek($queryresult,0);
-
-                                                 if($numglobal>0){ ?>
-                                                        <option value="NA" style="font-style:italic;font-weight:bold"> -- global searches ---------</option>
-                                                <?php
-                                                }//end if
-
-                                                $userqueryline = true;
-
-                                                while($therecord=$this->db->fetchArray($queryresult)){
-
-                                                        if ($therecord["userid"] != '' and $userqueryline) {
-
-                                                                $userqueryline = false;
-
-                                                                ?><option value="NA" style="font-style:italic;font-weight:bold"> -- user searches ---------</option><?php
-
-                                                        }//endif
-
-                                                        ?><option value="<?php echo $therecord["id"]?>"><?php echo $therecord["name"]?></option><?php
-
-                                                }// end while
-
-                                        }//end if
-                                ?>
-                        </select>
-                        <?php
-
-                }//end function showSavedSearchList
-
-
-                /**
-                 * displays the load box for saved searches
-                 *
-                 * @param integer $tabledefid id of tabledef
-                 * @param string $userid uuid of user
-                 * @param string $securitywhere additional security based where clause to pass
-                 */
-                function showLoad($tabledefid,$userid,$securitywhere){
-
-                        $uuid = getUuid($this->db, "tbld:5c9d645f-26ab-5003-b98e-89e9049f8ac3", $tabledefid);
-
-                        $querystatement = "
-                                SELECT
-                                        id,
-                                        name,
-                                        userid
-                                FROM
-                                        usersearches
-                                WHERE
-                                        tabledefid = '".$uuid."'
-                                        AND type='SCH'
-                                        AND (
-                                                (userid = '' ".$securitywhere.")
-                                                OR userid = '".$userid."')
-                                ORDER BY
-                                        userid,
-                                        name";
-
-                        $queryresult = $this->db->query($querystatement);
-
-                        if(!$queryresult)
-                                $error = new appError(500,"Cannot retrieve saved search information");
-
-                        $querystatement="
-                                SELECT
-                                        advsearchroleid
-                                FROM
-                                        tabledefs
-                                WHERE id= '".$tabledefid."'";
-
-                        $tabledefresult = $this->db->query($querystatement);
-
-                        if(!$tabledefresult)
-                                $error = new appError(500,"Cannot retrieve table definition information.");
-
-                        $tableinfo=$this->db->fetchArray($tabledefresult);
-
-                        ?>
-                        <table border="0" cellpadding="0" cellspacing="0">
-                                <tr>
-                                        <td valign="top">
-                                                <p>
-                                                        <label for="LSList">saved searches</label><br />
-                                                        <?php $this->showSavedSearchList($queryresult)?>
-                                                </p>
-                                        </td>
-                                        <td valign="top" width="100%">
-                                                <p>
-                                                        <label for="LSSelectedSearch">name</label><br />
-                                                        <input type="text" id="LSSelectedSearch" size="10" readonly="readonly" class="uneditable" />
-                                                </p>
-                                                <p>
-                                                        <textarea id="LSSQL" rows="8" cols="10" <?php if(!hasRights($tableinfo["advsearchroleid"])) echo " readonly=\"readonly\""?>></textarea>
-                                                </p>
-                                        </td>
-                                        <td valign="top">
-                                                <p><br/><input id="LSLoad" type="button" onclick="LSRunSearch()" class="Buttons" disabled="disabled" value="run search"/></p>
-                                                <p><input id="LSDelete" type="button" onclick="LSDeleteSearch('<?php echo APP_PATH ?>')" class="Buttons" disabled="disabled" value="delete"/></p>
-                                                <div id="LSResults">&nbsp;</div>
-                                        </td>
-                                </tr>
-                        </table>
-                        <?php
-
-                }//end function showLoad
-
-        }//end class
+            if(!$queryresult)
+                    $error = new appError(500,"Cannot retrieve saved search information");
+
+            $querystatement="
+                    SELECT
+                            advsearchroleid
+                    FROM
+                            tabledefs
+                    WHERE id= '".$tabledefid."'";
+
+            $tabledefresult = $this->db->query($querystatement);
+
+            if(!$tabledefresult)
+                    $error = new appError(500,"Cannot retrieve table definition information.");
+
+            $tableinfo=$this->db->fetchArray($tabledefresult);
+
+            ?>
+            <table border="0" cellpadding="0" cellspacing="0">
+                    <tr>
+                            <td valign="top">
+                                    <p>
+                                            <label for="LSList">saved searches</label><br />
+                                            <?php $this->showSavedSearchList($queryresult)?>
+                                    </p>
+                            </td>
+                            <td valign="top" width="100%">
+                                    <p>
+                                            <label for="LSSelectedSearch">name</label><br />
+                                            <input type="text" id="LSSelectedSearch" size="10" readonly="readonly" class="uneditable" />
+                                    </p>
+                                    <p>
+                                            <textarea id="LSSQL" rows="8" cols="10" <?php if(!hasRights($tableinfo["advsearchroleid"])) echo " readonly=\"readonly\""?>></textarea>
+                                    </p>
+                            </td>
+                            <td valign="top">
+                                    <p><br/><input id="LSLoad" type="button" onclick="LSRunSearch()" class="Buttons" disabled="disabled" value="run search"/></p>
+                                    <p><input id="LSDelete" type="button" onclick="LSDeleteSearch('<?php echo APP_PATH ?>')" class="Buttons" disabled="disabled" value="delete"/></p>
+                                    <div id="LSResults">&nbsp;</div>
+                            </td>
+                    </tr>
+            </table>
+            <?php
+
+    }//end function showLoad
+
+}//end class
 
 

trunk/phpbms/modules/base/tabledefs_addedit.php

@@ -69 +69 @@
                 $theform->addField($theinput);
 
-        $theinput = new inputCheckbox("apiaccessible",$therecord["apiaccessible"],"api accessible");
+                $theinput = new inputCheckbox("apiaccessible",$therecord["apiaccessible"],"api accessible");
                 $theform->addField($theinput);