<?php
+function passwd($login,$pass)
+{
+ return md5(md5($pass).$login);
+}
+
+function format_ajax($data)
+{
+ header('Content-type: application/json; charset=UTF-8');
+ echo json_encode($data);
+ exit;
+}
+
+function check_permissions($name)
+{
+ $sql = sprintf("SELECT count(*) AS count FROM sys_mask "
+ . "JOIN sys_menu ON sys_mask.menu = sys_menu.id "
+ . "JOIN sys_group_mask ON sys_mask.id = sys_group_mask.mask "
+ . "WHERE sys_group_mask.gid = %d AND fname = '%s'",
+ $_SESSION['sys']['group'], pg_escape_string($name));
+ error_log($sql);
+
+ $sth = pg_query($sql);
+
+ if ($sth === false) return false;
+
+ $row = pg_fetch_assoc($sth);
+ if ($row === false) return false;
+
+ if ($row['count'] == 0)
+ return false;
+
+ return true;
+}
+
function check_session()
{
- if (!empty($_POST['login']) && !empty($_POST['passwd'])) {
+ if (!empty($_SESSION['sys']['login']) && !empty($_GET['logout'])) {
+ session_destroy();
+ header('Location: ./?login=true');
+ exit();
+ }
+
+ if (substr($_SERVER["SCRIPT_FILENAME"],-10) == '/index.php' &&
+ !empty($_POST['login']) && !empty($_POST['passwd'])) {
require_once('lib/login.php');
if (check_passwd()) {
header('Location: ./');
header('Location: ./?login=true');
exit();
}
+
+ /* regular mask */
+ if (!empty($_GET['mask'])) {
+ if (check_permissions($_GET['mask']))
+ return true;
+ else {
+ header('Location: ./');
+ exit();
+ }
+ }
+
+ /* table data */
+ if (substr($_SERVER["SCRIPT_FILENAME"],-17) == '/ricoXMLquery.php' &&
+ !empty($_GET['id']) && substr($_GET['id'],0,5) == 'grid_') {
+ if (check_permissions(substr($_GET['id'],5)))
+ return true;
+ else
+ format_ajax(array('error' => 'No permission to access data'));
+ }
+
+ /* table connections */
+ if (substr($_SERVER["SCRIPT_FILENAME"],-25) == '/ricoUpdateConnection.php' &&
+ !empty($_POST['table'])) {
+ if (check_permissions($_POST['table']))
+ return true;
+ else
+ format_ajax(array('error' => 'No permission to access data'));
+ }
+
+ /* ajax calls */
+ if (substr($_SERVER["SCRIPT_FILENAME"],-9) == '/ajax.php' &&
+ !empty($_POST['source'])) {
+ if (check_permissions(substr($_POST['source'],5)))
+ return true;
+ else
+ format_ajax(array('error' => 'No permission to access data'));
+ }
+
}
function sanitise_filename($file)
return str_replace('./','x',$file);
}
-function load_mask($name, $prefix = '')
+function load_mask($name)
{
global $mask;
+ global $jscode;
$name = sanitise_filename($name);
- $file = $prefix . 'masks/' . $name . '.php';
+ $file = $_SESSION['sys']['basedir'] . 'masks/' . $name . '.php';
if (!file_exists($file))
return false;
pg_connect($dsn);
}
+function query_db($sql)
+{
+ $sth = pg_query($sql);
+
+ if ($sth === false) return false;
+
+ $result = array();
+ while ($row = pg_fetch_assoc($sth))
+ $result[] = $row;
+
+ return $result;
+}
+
function load_js($jsfiles, $jscode)
{
$ret = '';
return $html;
}
+function grid_sql($name, $mask)
+{
+ $fields = array();
+ foreach ($mask['list'] as $field => $data) {
+ if (array_key_exists('sql', $data))
+ $fields[] = $data['sql'] . ' AS ' . $field;
+ else
+ $fields[] = $field;
+ }
+
+ $_SESSION['grid_' . $name] = sprintf("SELECT %s FROM %s",
+ implode(',', $fields), $mask['table']);
+ if (array_key_exists('join', $mask)) $_SESSION['grid_' . $name] .= ' JOIN ' . join(' JOIN ', $mask['join']);
+ if (array_key_exists('where', $mask)) $_SESSION['grid_' . $name] .= ' WHERE ' . $mask['where'];
+}
+
?>