From 8cb878258612be73abd35196415f4c1de71b01e6 Mon Sep 17 00:00:00 2001 From: Paminger Date: Sun, 1 May 2016 11:53:15 +0200 Subject: [PATCH] ACL-Fix --- application/config/constants.php | 19 +++ application/config/fhcomplete.php | 8 +- application/controllers/Vilesci.php | 30 +---- application/core/DB_Model.php | 114 +++++++++++++++-- application/core/FHC_Model.php | 40 +++--- application/language/de-AT/fhc_db_lang.php | 2 - application/language/de-AT/fhc_model_lang.php | 7 ++ .../language/de-AT/fhcomplete_lang.php | 2 +- application/language/en-US/fhc_db_lang.php | 2 - application/language/en-US/fhc_model_lang.php | 7 ++ .../language/en-US/fhcomplete_lang.php | 2 +- application/libraries/FHC_DB_ACL.php | 4 +- .../models/person/Prestudent_model.php | 30 +++++ ci_db_extra.php | 119 ++++++++++++++++++ ci_hack.php | 118 +---------------- include/studiengang.class.php | 9 +- 16 files changed, 326 insertions(+), 187 deletions(-) delete mode 100644 application/language/de-AT/fhc_db_lang.php create mode 100644 application/language/de-AT/fhc_model_lang.php delete mode 100644 application/language/en-US/fhc_db_lang.php create mode 100644 application/language/en-US/fhc_model_lang.php create mode 100644 application/models/person/Prestudent_model.php create mode 100755 ci_db_extra.php diff --git a/application/config/constants.php b/application/config/constants.php index 48283e223..92a784220 100755 --- a/application/config/constants.php +++ b/application/config/constants.php @@ -1,6 +1,24 @@ 'basis/person' +); diff --git a/application/controllers/Vilesci.php b/application/controllers/Vilesci.php index ab33260c1..3cbf06974 100755 --- a/application/controllers/Vilesci.php +++ b/application/controllers/Vilesci.php @@ -1,7 +1,7 @@ dbupdate()) - echo 'System-DB needs update!'; - else - { - $this->load->view('templates/header'); - $this->load->view('vilesci_frameset'); - $this->load->view('templates/footer'); - } - } - - /** - * - * @return bool - */ - private function __dbupdate() - { - // Check for update (codeigniter migration) - $this->load->library('migration'); - if ($this->migration->current() === false) - show_error($this->migration->error_string()); - if ($this->migration->current() != $this->migration->latest()) - return true; - else - return false; + $this->load->view('templates/header'); + $this->load->view('vilesci_frameset'); + $this->load->view('templates/footer'); } } diff --git a/application/core/DB_Model.php b/application/core/DB_Model.php index 1e590b3e3..c154e27e6 100644 --- a/application/core/DB_Model.php +++ b/application/core/DB_Model.php @@ -2,28 +2,118 @@ class DB_Model extends FHC_Model { - protected $dbTable = NULL; // Name of the DB-Table for CI-Insert, -Update, ... + protected $dbTable; // Name of the DB-Table for CI-Insert, -Update, ... + protected $pk; // Name of the PrimaryKey for DB-Update, Load, ... + protected $acl; // Name of the PrimaryKey for DB-Update, Load, ... + // Addon ID, stored to let to check the permissions private $_addonID; - function __construct() + function __construct($dbTable = null, $pk = null) { parent::__construct(); + $this->dbTable = $dbTable; + $this->pk = $pk; $this->load->database(); - $this->lang->load('fhc_db'); + $this->acl = $this->config->item('fhc_acl'); } + /** --------------------------------------------------------------- + * Insert Data into DB-Table + * + * @param array $data DataArray for Insert + * @return array + */ public function insert($data) { - if(!is_null($this->dbTable)) - { - $this->db->insert($this->dbTable, $data); - return TRUE; - } + // Check Class-Attributes + if(is_null($this->dbTable)) + return $this->_error(lang('fhc_'.FHC_NODBTABLE), FHC_MODEL_ERROR); + + // Check rights + if (! $this->fhc_db_acl->isBerechtigt((string)($this->acl[$this->dbTable]), 'i')) + return $this->_error(lang('fhc_'.FHC_NORIGHT), FHC_MODEL_ERROR); + + // DB-INSERT + if ($this->db->insert($this->dbTable, $data)) + return $this->_success($this->db->insert_id()); else - { - return FALSE; - } + return $this->_error($this->db->error(), FHC_DB_ERROR); + } + + /** --------------------------------------------------------------- + * Replace Data in DB-Table + * + * @param array $data DataArray for Replacement + * @return array + */ + public function replace($data) + { + // Check Class-Attributes + if(is_null($this->dbTable)) + return $this->_error(lang('fhc_'.FHC_NODBTABLE), FHC_MODEL_ERROR); + + // Check rights + if (! $this->fhc_db_acl->isBerechtigt((string)($this->acl[$this->dbTable]), 'ui')) + return $this->_error(lang('fhc_'.FHC_NORIGHT), FHC_MODEL_ERROR); + + // DB-REPLACE + if ($this->db->replace($this->dbTable, $data)) + return $this->_success($this->db->insert_id()); + else + return $this->_error($this->db->error(), FHC_DB_ERROR); + } + + /** --------------------------------------------------------------- + * Update Data in DB-Table + * + * @param string $id PK for DB-Table + * @param array $data DataArray for Insert + * @return array + */ + public function update($id, $data) + { + // Check Class-Attributes + if(is_null($this->dbTable)) + return $this->_error(lang('fhc_'.FHC_NODBTABLE), FHC_MODEL_ERROR); + if(is_null($this->pk)) + return $this->_error(lang('fhc_'.FHC_NOPK), FHC_MODEL_ERROR); + + // Check rights + if (! $this->fhc_db_acl->isBerechtigt((string)($this->acl[$this->dbTable]), 'u')) + return $this->_error(lang('fhc_'.FHC_NORIGHT), FHC_MODEL_ERROR); + + // DB-UPDATE + $this->db->where($this->pk, $id); + if ($this->db->update($this->dbTable, $data)) + return $this->_success($id); + else + return $this->_error($this->db->error(), FHC_DB_ERROR); + } + + /** --------------------------------------------------------------- + * Replace Data in DB-Table + * + * @param array $data DataArray for Replacement + * @return array + */ + public function load($id) + { + // Check Class-Attributes + if(is_null($this->dbTable)) + return $this->_error(lang('fhc_'.FHC_NODBTABLE), FHC_MODEL_ERROR); + if(is_null($this->pk)) + return $this->_error(lang('fhc_'.FHC_NOPK), FHC_MODEL_ERROR); + + // Check rights + if (! $this->fhc_db_acl->isBerechtigt((string)($this->acl[$this->dbTable]), 's')) + return $this->_error(lang('fhc_'.FHC_NORIGHT), FHC_MODEL_ERROR); + + // DB-SELECT + if ($this->db->get_where($this->dbTable, array($this->pk => $id))) + return $this->_success($id); + else + return $this->_error($this->db->error(), FHC_DB_ERROR); } /** --------------------------------------------------------------- @@ -61,4 +151,4 @@ class DB_Model extends FHC_Model { return $this->_addonID; } -} \ No newline at end of file +} diff --git a/application/core/FHC_Model.php b/application/core/FHC_Model.php index 67cda7d15..d9d8c6690 100644 --- a/application/core/FHC_Model.php +++ b/application/core/FHC_Model.php @@ -4,13 +4,17 @@ defined('BASEPATH') OR exit('No direct script access allowed'); class FHC_Model extends CI_Model { //protected errormsg; - function __construct() + function __construct($uid = null) { parent::__construct(); $this->load->helper('language'); - $this->load->helper('fhc_db_acl'); + $this->lang->load('fhc_model'); + //$this->load->helper('fhc_db_acl'); $this->lang->load('fhcomplete'); - //$this->load->library('FHC_DB_ACL'); + //$this->load->library('session'); + if (is_null($uid)) + $uid = $this->session->uid; + $this->load->library('FHC_DB_ACL',array('uid' => $uid)); } /** --------------------------------------------------------------- @@ -19,14 +23,14 @@ class FHC_Model extends CI_Model * @param mixed $retval * @return array */ - protected function _success($retval = '', $message = FHC_SUCCESS) + protected function _success($retval, $message = FHC_SUCCESS) { - return array( - 'err' => 0, - 'code' => FHC_SUCCESS, - 'msg' => lang('fhc_' . $message), - 'retval' => $retval - ); + $return = new stdClass(); + $return->error = EXIT_SUCCESS; + $return->code = $message; + $return->msg = lang('fhc_' . $message); + $return->retval = $retval; + return $return; } /** --------------------------------------------------------------- @@ -34,13 +38,13 @@ class FHC_Model extends CI_Model * * @return array */ - protected function _general_error($retval = '', $message = FHC_ERR_GENERAL) + protected function _error($retval = '', $message = FHC_MODEL_ERROR) { - return array( - 'err' => 1, - 'code' => FHC_ERR_GENERAL, - 'msg' => lang('fhc_' . $message), - 'retval' => $retval - ); + $return = new stdClass(); + $return->error = EXIT_MODEL; + $return->code = $message; + $return->msg = lang('fhc_' . $message); + $return->retval = $retval; + return $return; } -} \ No newline at end of file +} diff --git a/application/language/de-AT/fhc_db_lang.php b/application/language/de-AT/fhc_db_lang.php deleted file mode 100644 index 463582f53..000000000 --- a/application/language/de-AT/fhc_db_lang.php +++ /dev/null @@ -1,2 +0,0 @@ -bb = new benutzerberechtigung(); - $this->uid = $uid; + $this->uid = $param['uid']; } function isBerechtigt($berechtigung_kurzbz, $art=null, $oe_kurzbz=null, $kostenstelle_id=null) diff --git a/application/models/person/Prestudent_model.php b/application/models/person/Prestudent_model.php new file mode 100644 index 000000000..ac4ff8d3b --- /dev/null +++ b/application/models/person/Prestudent_model.php @@ -0,0 +1,30 @@ +dbTable='public.tbl_prestudent'; + $this->pk='prestudent_id'; + } + + /** + * + */ + public function loadPrestudentPerson($prestudentID) + { + $this->db->select('*') + ->from('public.tbl_prestudent') + ->join('public.tbl_person', 'person_id') + ->where('prestudent_id', $prestudentID); + return $this->db->get()->result_array(); + } + + +} diff --git a/ci_db_extra.php b/ci_db_extra.php new file mode 100755 index 000000000..23f512a41 --- /dev/null +++ b/ci_db_extra.php @@ -0,0 +1,119 @@ +db_result=$this->db->simple_query($sql)) + return $this->db_result; + else + { + $this->errormsg.='Abfrage in Datenbank fehlgeschlagen! '.$this->db_last_error(); + return false; + } + } + + public function db_fetch_object($result = null, $i=null) + { + if(is_null($result)) + { + if(is_null($i)) + return pg_fetch_object($this->db_result); + else + return pg_fetch_object($this->db_result, $i); + } + else + { + if(is_null($i)) + return pg_fetch_object($result); + else + return pg_fetch_object($result, $i); + } + } + + public function db_add_param($var, $type=FHC_STRING, $nullable=true) + { + if($var==='' && $type!=FHC_BOOLEAN) + { + if($nullable) + return 'null'; + else + return "''"; + } + + switch($type) + { + case FHC_INTEGER: + $var = $this->db_escape($var); + if(!is_numeric($var) && $var!=='') + die('Invalid Integer Parameter detected:'.$var); + $var = $this->db_null_value($var, false); + break; + + case FHC_BOOLEAN: + if($var===true) + $var='true'; + elseif($var===false) + $var='false'; + elseif($var=='' && $nullable) + $var = 'null'; + else + die('Invalid Boolean Parameter detected'); + break; + + case FHC_STRING: + default: + $var = $this->db_escape($var); + $var = $this->db_null_value($var); + break; + } + return $var; + } + + public function db_escape($var) + { + return pg_escape_string($var); + } + + public function db_null_value($var, $qoute=true) + { + if($qoute) + return ($var!==''?$this->db_qoute($var):'null'); + else + return ($var!==''?$var:'null'); + } + + public function db_qoute($var) + { + return "'".$var."'"; + } + + public function db_parse_bool($var) + { + if($var=='t') + return true; + elseif($var=='f') + return false; + elseif($var=='') + return ''; + else + die('Invalid DB Boolean. Wrong DB-Engine?'); + } + + /** + * Bereitet ein Array von Elementen auf, damit es in der IN-Klausel eines + * Select Befehls verwendet werden kann. + */ + public function db_implode4SQL($array) + { + $string = ''; + foreach($array as $row) + { + if($string!='') + $string.=','; + $string.=$this->db_add_param($row); + } + return $string; + } +} diff --git a/ci_hack.php b/ci_hack.php index 5fdf40e3f..8bafa5f7b 100755 --- a/ci_hack.php +++ b/ci_hack.php @@ -369,121 +369,5 @@ require_once(dirname(__FILE__).'/application/core/FHC_Model.php'); $model=new CI_Model(); // Traits -trait db_extra -{ - protected $db_result=null; +require_once(dirname(__FILE__).'db_extra.php'); - public function db_query($sql) - { - if ($this->db_result=$this->db->simple_query($sql)) - return $this->db_result; - else - { - $this->errormsg.='Abfrage in Datenbank fehlgeschlagen! '.$this->db_last_error(); - return false; - } - } - - public function db_fetch_object($result = null, $i=null) - { - if(is_null($result)) - { - if(is_null($i)) - return pg_fetch_object($this->db_result); - else - return pg_fetch_object($this->db_result, $i); - } - else - { - if(is_null($i)) - return pg_fetch_object($result); - else - return pg_fetch_object($result, $i); - } - } - - public function db_add_param($var, $type=FHC_STRING, $nullable=true) - { - if($var==='' && $type!=FHC_BOOLEAN) - { - if($nullable) - return 'null'; - else - return "''"; - } - - switch($type) - { - case FHC_INTEGER: - $var = $this->db_escape($var); - if(!is_numeric($var) && $var!=='') - die('Invalid Integer Parameter detected:'.$var); - $var = $this->db_null_value($var, false); - break; - - case FHC_BOOLEAN: - if($var===true) - $var='true'; - elseif($var===false) - $var='false'; - elseif($var=='' && $nullable) - $var = 'null'; - else - die('Invalid Boolean Parameter detected'); - break; - - case FHC_STRING: - default: - $var = $this->db_escape($var); - $var = $this->db_null_value($var); - break; - } - return $var; - } - - public function db_escape($var) - { - return pg_escape_string($var); - } - - public function db_null_value($var, $qoute=true) - { - if($qoute) - return ($var!==''?$this->db_qoute($var):'null'); - else - return ($var!==''?$var:'null'); - } - - public function db_qoute($var) - { - return "'".$var."'"; - } - - public function db_parse_bool($var) - { - if($var=='t') - return true; - elseif($var=='f') - return false; - elseif($var=='') - return ''; - else - die('Invalid DB Boolean. Wrong DB-Engine?'); - } - - /** - * Bereitet ein Array von Elementen auf, damit es in der IN-Klausel eines - * Select Befehls verwendet werden kann. - */ - public function db_implode4SQL($array) - { - $string = ''; - foreach($array as $row) - { - if($string!='') - $string.=','; - $string.=$this->db_add_param($row); - } - return $string; - } -} \ No newline at end of file diff --git a/include/studiengang.class.php b/include/studiengang.class.php index aa756d0cb..f2c8069f2 100755 --- a/include/studiengang.class.php +++ b/include/studiengang.class.php @@ -25,7 +25,12 @@ require_once(dirname(__FILE__).'/datum.class.php'); // CI -require_once(dirname(__FILE__).'/../ci_hack.php'); +// look if get_instance() is declared +if (function_exists('get_instance')) + require_once(dirname(__FILE__).'/../ci_db_extra.php'); +else + require_once(dirname(__FILE__).'/../ci_hack.php'); + require_once(dirname(__FILE__).'/../application/models/lehre/Studiengang_model.php'); class studiengang extends Studiengang_model @@ -908,4 +913,4 @@ class studiengang extends Studiengang_model return false; } } -} \ No newline at end of file +}