From a7582c88683e016a9831d72f517e433d6ecf0444 Mon Sep 17 00:00:00 2001 From: Paolo Date: Tue, 5 Dec 2017 17:39:31 +0100 Subject: [PATCH] - Method execReadOnlyQuery of DB_Model has a less strict check about the query statement - Added a first management of the type date --- .../controllers/system/TestFilterWidget.php | 8 +-- application/core/DB_Model.php | 28 +++++----- application/widgets/FilterWidget.php | 51 +++++++++++++++---- 3 files changed, 62 insertions(+), 25 deletions(-) diff --git a/application/controllers/system/TestFilterWidget.php b/application/controllers/system/TestFilterWidget.php index e269e4cf9..1984ddb15 100644 --- a/application/controllers/system/TestFilterWidget.php +++ b/application/controllers/system/TestFilterWidget.php @@ -27,13 +27,15 @@ class TestFilterWidget extends VileSci_Controller p.nachname AS "Nachname", p.vorname AS "Vorname", k.kontakt AS "Email", - p.aktiv AS "Aktiv" + p.aktiv AS "Aktiv", + k.updateamum AS "Update date" FROM public.tbl_person p INNER JOIN public.tbl_kontakt k USING(person_id) WHERE p.aktiv = TRUE AND p.person_id = k.person_id AND k.kontakttyp = \'email\' AND p.person_id < 1000 ', + 'hideFilters' => true, 'checkboxes' => array('PersonId'), 'additionalColumns' => array('Delete', 'Edit'), 'formatRaw' => function($fieldName, $fieldValue, $datasetRaw) { @@ -42,11 +44,11 @@ class TestFilterWidget extends VileSci_Controller { $datasetRaw->{$fieldName} = ''.$fieldValue.''; } - if ($fieldName == 'Delete') + elseif ($fieldName == 'Delete') { $datasetRaw->{$fieldName} = 'Delete'; } - if ($fieldName == 'Edit') + elseif ($fieldName == 'Edit') { $datasetRaw->{$fieldName} = 'Edit'; } diff --git a/application/core/DB_Model.php b/application/core/DB_Model.php index e6bd31114..3dc5e85ac 100644 --- a/application/core/DB_Model.php +++ b/application/core/DB_Model.php @@ -694,21 +694,25 @@ class DB_Model extends FHC_Model */ public function execReadOnlyQuery($query, $parametersArray = null) { + $result = error('You are allowed to run only query for reading data'); // + $cleanedQuery = trim(preg_replace('/\t|\n|\r|;/', '', $query)); // + // - if (!stripos($query, 'INSERT') - && !stripos($query, 'UPDATE') - && !stripos($query, 'DELETE') - && !stripos($query, 'CREATE') - && !stripos($query, 'ALTER') - && !stripos($query, 'GRANT') - && !stripos($query, 'DROP')) + if (stripos($cleanedQuery, 'SELECT') == 0 + && (stripos($cleanedQuery, 'INSERT') > 0 || stripos($cleanedQuery, 'INSERT') == false) + && (stripos($cleanedQuery, 'UPDATE') > 0 || stripos($cleanedQuery, 'UPDATE') == false) + && (stripos($cleanedQuery, 'CREATE') > 0 || stripos($cleanedQuery, 'CREATE') == false) + && (stripos($cleanedQuery, 'DELETE') > 0 || stripos($cleanedQuery, 'DELETE') == false) + && (stripos($cleanedQuery, 'ALTER') > 0 || stripos($cleanedQuery, 'ALTER') == false) + && (stripos($cleanedQuery, 'GRANT') > 0 || stripos($cleanedQuery, 'GRANT') == false) + && (stripos($cleanedQuery, 'DROP') > 0 || stripos($cleanedQuery, 'DROP') == false)) { - return $this->execQuery($query, $parametersArray); - } - else - { - return error('You are allowed to run only query for reading data'); + $queryToExec = str_replace(';', '', $query); // + + $result = $this->execQuery($queryToExec, $parametersArray); } + + return $result; } // ------------------------------------------------------------------------------------------ diff --git a/application/widgets/FilterWidget.php b/application/widgets/FilterWidget.php index f8c2881c2..3a5e93247 100644 --- a/application/widgets/FilterWidget.php +++ b/application/widgets/FilterWidget.php @@ -47,6 +47,8 @@ class FilterWidget extends Widget const OP_CONTAINS = 'contains'; const OP_NOT_CONTAINS = 'ncontains'; + const DEFAULT_DATE_FORMAT = 'd.m.Y H:i:s'; + private $app; private $query; private $datasetName; @@ -56,6 +58,8 @@ class FilterWidget extends Widget private $formatRaw; private $checkboxes; + private $metaData; + private static $FilterWidgetInstance; /** @@ -96,10 +100,10 @@ class FilterWidget extends Widget $listFields = $this->FiltersModel->getExecutedQueryListFields(); // - $metaData = $this->FiltersModel->getExecutedQueryMetaData(); + $this->metaData = $this->FiltersModel->getExecutedQueryMetaData(); // - $this->loadViewFilters($listFields, $metaData, $dataset); + $this->loadViewFilters($listFields, $this->metaData, $dataset); } /** @@ -227,6 +231,23 @@ class FilterWidget extends Widget '; } + elseif ($filterMetaData->type == 'timestamp') + { + $html = ' + + + + + + + + '; + } return sprintf($html, $filterMetaData->name.'-operation', $filterMetaData->name, $activeFilterValue); } @@ -236,18 +257,28 @@ class FilterWidget extends Widget */ public static function formatRaw($fieldName, $fieldValue, $datasetRaw) { - $tmpDatasetRaw = clone $datasetRaw; + $tmpDatasetRaw = null; - if (is_bool($fieldValue)) + if (is_object($datasetRaw)) { - $tmpDatasetRaw->{$fieldName} = $fieldValue === true ? 'true' : 'false'; - } + $tmpDatasetRaw = clone $datasetRaw; + $tmpMetaData = self::getFilterMetaData($fieldName, self::$FilterWidgetInstance->metaData); - $formatRaw = self::$FilterWidgetInstance->getFormatRaw(); + if (is_bool($fieldValue)) + { + $tmpDatasetRaw->{$fieldName} = $fieldValue === true ? 'true' : 'false'; + } + elseif ($tmpMetaData != null && $tmpMetaData->type == 'timestamp') + { + $tmpDatasetRaw->{$fieldName} = date(self::DEFAULT_DATE_FORMAT, strtotime($fieldValue)); + } - if ($formatRaw != null) - { - $tmpDatasetRaw = $formatRaw($fieldName, $fieldValue, $tmpDatasetRaw); + $formatRaw = self::$FilterWidgetInstance->getFormatRaw(); + + if ($formatRaw != null) + { + $tmpDatasetRaw = $formatRaw($fieldName, $fieldValue, $tmpDatasetRaw); + } } return $tmpDatasetRaw;