Handle save request as insert when there is no ID

[misc/kostenrechnung] / lib / general.php

diff --git a/lib/general.php b/lib/general.php
index f088db0..8c95557 100644 (file)
--- a/lib/general.php
+++ b/lib/general.php
@@ -1,16 +1,111 @@
 <?php
 
+function passwd($login,$pass)
+{
+  return md5(md5($pass).$login);
+}
+
+function format_ajax($data)
+{
+  header('Content-type: application/json; charset=UTF-8');
+  echo json_encode($data);
+  exit;
+}
+
+function check_permissions($name)
+{
+  $sql = sprintf("SELECT count(*) AS count FROM sys_mask "
+                . "JOIN sys_menu ON sys_mask.menu = sys_menu.id "
+                . "JOIN sys_group_mask ON sys_mask.id = sys_group_mask.mask "
+                . "WHERE sys_group_mask.gid = %d AND fname = '%s'",
+                $_SESSION['sys']['group'], pg_escape_string($name));
+
+  $sth = pg_query($sql);
+
+  if ($sth === false) return false;
+
+  $row = pg_fetch_assoc($sth);
+  if ($row === false) return false;
+
+  if ($row['count'] == 0)
+    return false;
+
+  return true;
+}
+
+function check_session()
+{
+  if (!empty($_SESSION['sys']['login']) && !empty($_GET['logout'])) {
+    session_destroy();
+    header('Location: ./?login=true');
+    exit();
+  }
+
+  if (substr($_SERVER["SCRIPT_FILENAME"],-10) == '/index.php' &&
+      !empty($_POST['login']) && !empty($_POST['passwd'])) {
+    require_once('lib/login.php');
+    if (check_passwd()) {
+      header('Location: ./');
+      exit();
+    }
+  }
+
+  if (empty($_SESSION['sys']['login']) && empty($_GET['login'])) {
+    header('Location: ./?login=true');
+    exit();
+  }
+
+  /* regular mask */
+  if (!empty($_GET['mask'])) {
+    if (check_permissions($_GET['mask']))
+      return true;
+    else {
+      header('Location: ./');
+      exit();
+    }
+  }
+
+  /* table data */
+  if (substr($_SERVER["SCRIPT_FILENAME"],-17) == '/ricoXMLquery.php' &&
+      !empty($_GET['id']) && substr($_GET['id'],0,5) == 'grid_') {
+    if (check_permissions(substr($_GET['id'],5)))
+      return true;
+    else
+      format_ajax(array('error' => 'No permission to access data'));
+  }
+
+  /* table connections */
+  if (substr($_SERVER["SCRIPT_FILENAME"],-25) == '/ricoUpdateConnection.php' &&
+      !empty($_POST['table'])) {
+    if (check_permissions($_POST['table']))
+      return true;
+    else
+      format_ajax(array('error' => 'No permission to access data'));
+  }
+
+  /* ajax calls */
+  if (substr($_SERVER["SCRIPT_FILENAME"],-9) == '/ajax.php' &&
+      !empty($_POST['source'])) {
+    if (check_permissions($_POST['source']))
+      return true;
+    else
+      format_ajax(array('error' => 'No permission to access data'));
+  }
+
+}
+
 function sanitise_filename($file)
 {
   return str_replace('./','x',$file);
 }
 
-function load_mask($name, $prefix = '')
+function load_mask($name)
 {
   global $mask;
+  global $jscode;
 
   $name = sanitise_filename($name);
-  $file = $prefix . 'masks/' . $name . '.php';
+  $file = $_SESSION['sys']['basedir'] . 'masks/' . $name . '.php';
 
   if (!file_exists($file))
     return false;
@@ -26,6 +121,19 @@ function connect_db()
   pg_connect($dsn);
 }
 
+function query_db($sql)
+{
+  $sth = pg_query($sql);
+
+  if ($sth === false) return false;
+
+  $result = array();
+  while ($row = pg_fetch_assoc($sth))
+    $result[] = $row;
+
+  return $result;
+}
+
 function load_js($jsfiles, $jscode)
 {
   $ret = '';
@@ -40,19 +148,59 @@ function load_js($jsfiles, $jscode)
 
 function process()
 {
+  if (!empty($_GET['login'])) {
+    require_once('lib/login.php');
+    return mask_login();
+  }
+
   if (!empty($_GET['mask'])) {
     require_once('lib/mask.php');
     return mask($_GET['mask']);
   }
 
-  $masks = array('sys_user','sys_group','sys_mask',
-                'anbaugeraete','arbeitsarten','personal','materialien','gebiet','geraete',
-                'kostenstellen','materialverbrauch','einsatz');
-  $ret = '';
-  foreach ($masks as $m)
-    $ret .= sprintf('<a href="index.php?mask=%s">%s</a><br>', $m, $m);
+  $ret = '<div style="height: 600px; font-size: large; font-weight: bold;">Willkommen in der Kostenrechnung der Friesoyther Wasseracht!</div>';
   
   return $ret;
 }
 
+function debug_log($text)
+{
+  global $debug_info;
+
+  $debug_info .= '<br>' . $text;
+}
+
+function debug_info()
+{
+  global $jsfiles;
+  global $debug_info;
+
+  if (DEBUG !== true) return '';
+
+  $jsfiles[] = 'lib/debug_joey.js';
+
+  $html = '<div style="background: #DDD; margin: 5px; padding-left: 4px; border: 1px solid #AAA;clear:both;">';
+  $html .= "\n<pre>\n\$_SESSION = " . var_export($_SESSION,true) . "\n";
+  $html .= "\n\$_COOKIE = " . var_export($_COOKIE,true) . "\n</pre>\n";
+  $html .= $debug_info;
+  $html .= '</div>';
+  return $html;
+}
+
+function grid_sql($name, $mask)
+{
+  $fields = array();
+  foreach ($mask['list'] as $field => $data) {
+    if (array_key_exists('sql', $data))
+      $fields[] = $data['sql'] . ' AS ' . $field;
+    else
+      $fields[] = $field;
+  }
+
+  $_SESSION['grid_' . $name] = sprintf("SELECT %s FROM %s",
+                                      implode(',', $fields), $mask['table']);
+  if (array_key_exists('join', $mask)) $_SESSION['grid_' . $name] .= ' JOIN ' . join(' JOIN ', $mask['join']);
+  if (array_key_exists('where', $mask)) $_SESSION['grid_' . $name] .= ' WHERE ' . $mask['where'];
+}
+
 ?>