blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-21 08:52:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

- Method execReadOnlyQuery of DB_Model has a less strict check about the query statement

Browse Source 
- Added a first management of the type date
This commit is contained in:
Paolo
2017-12-05 17:39:31 +01:00
parent e6aba9a3e2
commit a7582c8868
3 changed files with 62 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/controllers/system/TestFilterWidget.php
+5 -3
View File
@@ -27,13 +27,15 @@ class TestFilterWidget extends VileSci_Controller
p.nachname AS "Nachname",
p.vorname AS "Vorname",
k.kontakt AS "Email",
p.aktiv AS "Aktiv"
p.aktiv AS "Aktiv",
k.updateamum AS "Update date"
FROM public.tbl_person p INNER JOIN public.tbl_kontakt k USING(person_id)
WHERE p.aktiv = TRUE
AND p.person_id = k.person_id
AND k.kontakttyp = \'email\'
AND p.person_id < 1000
',
'hideFilters' => true,
'checkboxes' => array('PersonId'),
'additionalColumns' => array('Delete', 'Edit'),
'formatRaw' => function($fieldName, $fieldValue, $datasetRaw) {
@@ -42,11 +44,11 @@ class TestFilterWidget extends VileSci_Controller
{
$datasetRaw->{$fieldName} = '<a href="view/'.$datasetRaw->PersonId.'">'.$fieldValue.'</a>';
}
if ($fieldName == 'Delete')
elseif ($fieldName == 'Delete')
{
$datasetRaw->{$fieldName} = '<a href="delete/'.$datasetRaw->PersonId.'">Delete</a>';
}
if ($fieldName == 'Edit')
elseif ($fieldName == 'Edit')
{
$datasetRaw->{$fieldName} = '<a href="edit/'.$datasetRaw->PersonId.'">Edit</a>';
}
application/core/DB_Model.php
+16 -12
View File
@@ -694,21 +694,25 @@ class DB_Model extends FHC_Model
*/
public function execReadOnlyQuery($query, $parametersArray = null)
{
$result = error('You are allowed to run only query for reading data'); //
$cleanedQuery = trim(preg_replace('/\t|\n|\r|;/', '', $query)); //
//
if (!stripos($query, 'INSERT')
&& !stripos($query, 'UPDATE')
&& !stripos($query, 'DELETE')
&& !stripos($query, 'CREATE')
&& !stripos($query, 'ALTER')
&& !stripos($query, 'GRANT')
&& !stripos($query, 'DROP'))
if (stripos($cleanedQuery, 'SELECT') == 0
&& (stripos($cleanedQuery, 'INSERT') > 0 || stripos($cleanedQuery, 'INSERT') == false)
&& (stripos($cleanedQuery, 'UPDATE') > 0 || stripos($cleanedQuery, 'UPDATE') == false)
&& (stripos($cleanedQuery, 'CREATE') > 0 || stripos($cleanedQuery, 'CREATE') == false)
&& (stripos($cleanedQuery, 'DELETE') > 0 || stripos($cleanedQuery, 'DELETE') == false)
&& (stripos($cleanedQuery, 'ALTER') > 0 || stripos($cleanedQuery, 'ALTER') == false)
&& (stripos($cleanedQuery, 'GRANT') > 0 || stripos($cleanedQuery, 'GRANT') == false)
&& (stripos($cleanedQuery, 'DROP') > 0 || stripos($cleanedQuery, 'DROP') == false))
{
return $this->execQuery($query, $parametersArray);
}
else
{
return error('You are allowed to run only query for reading data');
$queryToExec = str_replace(';', '', $query); //
$result = $this->execQuery($queryToExec, $parametersArray);
}
return $result;
}
// ------------------------------------------------------------------------------------------
application/widgets/FilterWidget.php
+41 -10
View File
@@ -47,6 +47,8 @@ class FilterWidget extends Widget
const OP_CONTAINS = 'contains';
const OP_NOT_CONTAINS = 'ncontains';
const DEFAULT_DATE_FORMAT = 'd.m.Y H:i:s';
private $app;
private $query;
private $datasetName;
@@ -56,6 +58,8 @@ class FilterWidget extends Widget
private $formatRaw;
private $checkboxes;
private $metaData;
private static $FilterWidgetInstance;
/**
@@ -96,10 +100,10 @@ class FilterWidget extends Widget
$listFields = $this->FiltersModel->getExecutedQueryListFields();
//
$metaData = $this->FiltersModel->getExecutedQueryMetaData();
$this->metaData = $this->FiltersModel->getExecutedQueryMetaData();
//
$this->loadViewFilters($listFields, $metaData, $dataset);
$this->loadViewFilters($listFields, $this->metaData, $dataset);
}
/**
@@ -227,6 +231,23 @@ class FilterWidget extends Widget
</span>
';
}
elseif ($filterMetaData->type == 'timestamp')
{
$html = '
<span>
<select name="%s" class="select-filter-operation">
<option value="'.self::OP_LESS_THAN.'" '.($activeFilterOperationValue == self::OP_LESS_THAN ? 'selected' : '').'>less than</option>
</select>
</span>
<span>
<input type="text" name="%s" value="%s" class="select-filter-operation-value">
</span>
<select name="" class="select-filter-">
<option value="">Days</option>
<option value="">Months</option>
</select>
';
}
return sprintf($html, $filterMetaData->name.'-operation', $filterMetaData->name, $activeFilterValue);
}
@@ -236,18 +257,28 @@ class FilterWidget extends Widget
*/
public static function formatRaw($fieldName, $fieldValue, $datasetRaw)
{
$tmpDatasetRaw = clone $datasetRaw;
$tmpDatasetRaw = null;
if (is_bool($fieldValue))
if (is_object($datasetRaw))
{
$tmpDatasetRaw->{$fieldName} = $fieldValue === true ? 'true' : 'false';
}
$tmpDatasetRaw = clone $datasetRaw;
$tmpMetaData = self::getFilterMetaData($fieldName, self::$FilterWidgetInstance->metaData);
$formatRaw = self::$FilterWidgetInstance->getFormatRaw();
if (is_bool($fieldValue))
{
$tmpDatasetRaw->{$fieldName} = $fieldValue === true ? 'true' : 'false';
}
elseif ($tmpMetaData != null && $tmpMetaData->type == 'timestamp')
{
$tmpDatasetRaw->{$fieldName} = date(self::DEFAULT_DATE_FORMAT, strtotime($fieldValue));
}
if ($formatRaw != null)
{
$tmpDatasetRaw = $formatRaw($fieldName, $fieldValue, $tmpDatasetRaw);
$formatRaw = self::$FilterWidgetInstance->getFormatRaw();
if ($formatRaw != null)
{
$tmpDatasetRaw = $formatRaw($fieldName, $fieldValue, $tmpDatasetRaw);
}
}
return $tmpDatasetRaw;