Skip to content

Commit fa8e747

Browse files
author
Ahmad Gneady
committed
As generated by AppGini 5.97
1 parent a0325e3 commit fa8e747

37 files changed

+517
-354
lines changed

‎app/admin/getUsers.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<?php
2-
// This script and data application were generated by AppGini 5.95
2+
// This script and data application were generated by AppGini 5.97
33
// Download AppGini for free from https://bigprof.com/appgini/download/
44

55
/*

‎app/admin/incFunctions.php

Lines changed: 176 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88
createThumbnail($img, $specs) -- $specs is an array as returned by getThumbnailSpecs(). Returns true on success, false on failure.
99
makeSafe($string)
1010
checkPermissionVal($pvn)
11-
sql($statment, $o)
12-
sqlValue($statment)
11+
sql($statement, $o)
12+
sqlValue($statement)
1313
getLoggedAdmin()
1414
checkUser($username, $password)
1515
logOutUser()
@@ -258,6 +258,8 @@ function createThumbnail($img, $specs) {
258258
function makeSafe($string, $is_gpc = true) {
259259
static $cached = []; /* str => escaped_str */
260260

261+
if(!strlen($string)) return '';
262+
261263
if(!db_link()) sql("SELECT 1+1", $eo);
262264

263265
// if this is a previously escaped string, return from cached
@@ -281,115 +283,191 @@ function checkPermissionVal($pvn) {
281283
}
282284
}
283285
########################################################################
284-
if(!function_exists('sql')) {
285-
function sql($statment, &$o) {
286+
function dieErrorPage($error) {
287+
global $Translation;
286288

287-
/*
288-
Supported options that can be passed in $o options array (as array keys):
289-
'silentErrors': If true, errors will be returned in $o['error'] rather than displaying them on screen and exiting.
290-
*/
289+
$header = (defined('ADMIN_AREA') ? __DIR__ . '/incHeader.php' : __DIR__ . '/../header.php');
290+
$footer = (defined('ADMIN_AREA') ? __DIR__ . '/incFooter.php' : __DIR__ . '/../footer.php');
291291

292-
global $Translation;
293-
static $connected = false, $db_link;
292+
ob_start();
294293

295-
$dbServer = config('dbServer');
296-
$dbUsername = config('dbUsername');
297-
$dbPassword = config('dbPassword');
298-
$dbDatabase = config('dbDatabase');
294+
@include_once($header);
295+
echo Notification::placeholder();
296+
echo Notification::show([
297+
'message' => $error,
298+
'class' => 'danger',
299+
'dismiss_seconds' => 7200
300+
]);
301+
@include_once($footer);
299302

300-
$admin_dir = dirname(__FILE__);
301-
$header = (defined('ADMIN_AREA') ? "{$admin_dir}/incHeader.php" : "{$admin_dir}/../header.php");
302-
$footer = (defined('ADMIN_AREA') ? "{$admin_dir}/incFooter.php" : "{$admin_dir}/../footer.php");
303+
echo ob_get_clean();
304+
exit;
305+
}
306+
########################################################################
307+
function openDBConnection(&$o) {
308+
static $connected = false, $db_link;
303309

304-
ob_start();
310+
$dbServer = config('dbServer');
311+
$dbUsername = config('dbUsername');
312+
$dbPassword = config('dbPassword');
313+
$dbDatabase = config('dbDatabase');
305314

306-
if(!$connected) {
307-
/****** Connect to MySQL ******/
308-
if(!extension_loaded('mysql') && !extension_loaded('mysqli')) {
309-
$o['error'] = 'PHP is not configured to connect to MySQL on this machine. Please see <a href="https://www.php.net/manual/en/ref.mysql.php">this page</a> for help on how to configure MySQL.';
310-
if($o['silentErrors']) return false;
311-
312-
@include_once($header);
313-
echo Notification::placeholder();
314-
echo Notification::show(array(
315-
'message' => $o['error'],
316-
'class' => 'danger',
317-
'dismiss_seconds' => 7200
318-
));
319-
@include_once($footer);
320-
echo ob_get_clean();
321-
exit;
322-
}
323-
324-
if(!($db_link = @db_connect($dbServer, $dbUsername, $dbPassword))) {
325-
$o['error'] = db_error($db_link, true);
326-
if($o['silentErrors']) return false;
327-
328-
@include_once($header);
329-
echo Notification::placeholder();
330-
echo Notification::show(array(
331-
'message' => $o['error'],
332-
'class' => 'danger',
333-
'dismiss_seconds' => 7200
334-
));
335-
@include_once($footer);
336-
echo ob_get_clean();
337-
exit;
338-
}
339-
340-
/****** Select DB ********/
341-
if(!db_select_db($dbDatabase, $db_link)) {
342-
$o['error'] = db_error($db_link);
343-
if($o['silentErrors']) return false;
344-
345-
@include_once($header);
346-
echo Notification::placeholder();
347-
echo Notification::show(array(
348-
'message' => $o['error'],
349-
'class' => 'danger',
350-
'dismiss_seconds' => 7200
351-
));
352-
@include_once($footer);
353-
echo ob_get_clean();
354-
exit;
355-
}
356-
357-
$connected = true;
358-
}
315+
if($connected) return $db_link;
359316

360-
if(!$result = @db_query($statment, $db_link)) {
361-
if(!stristr($statment, "show columns")) {
362-
// retrieve error codes
363-
$errorNum = db_errno($db_link);
364-
$errorMsg = htmlspecialchars(db_error($db_link));
365-
366-
if(getLoggedAdmin()) $errorMsg .= "<pre class=\"ltr\">{$Translation['query:']}\n" . htmlspecialchars($statment) . "</pre><p><i class=\"text-right\">{$Translation['admin-only info']}</i></p><p>{$Translation['try rebuild fields']}</p>";
367-
368-
if($o['silentErrors']) { $o['error'] = $errorMsg; return false; }
369-
370-
@include_once($header);
371-
echo Notification::placeholder();
372-
echo Notification::show(array(
373-
'message' => $errorMsg,
374-
'class' => 'danger',
375-
'dismiss_seconds' => 7200
376-
));
377-
@include_once($footer);
378-
echo ob_get_clean();
379-
exit;
380-
}
381-
}
317+
/****** Check that MySQL module is enabled ******/
318+
if(!extension_loaded('mysql') && !extension_loaded('mysqli')) {
319+
$o['error'] = 'PHP is not configured to connect to MySQL on this machine. Please see <a href="https://www.php.net/manual/en/ref.mysql.php">this page</a> for help on how to configure MySQL.';
320+
if($o['silentErrors']) return false;
382321

383-
ob_end_clean();
384-
return $result;
322+
dieErrorPage($o['error']);
323+
}
324+
325+
/****** Connect to MySQL ******/
326+
if(!($db_link = @db_connect($dbServer, $dbUsername, $dbPassword))) {
327+
$o['error'] = db_error($db_link, true);
328+
if($o['silentErrors']) return false;
329+
330+
dieErrorPage($o['error']);
331+
}
332+
333+
/****** Select DB ********/
334+
if(!db_select_db($dbDatabase, $db_link)) {
335+
$o['error'] = db_error($db_link);
336+
if($o['silentErrors']) return false;
337+
338+
dieErrorPage($o['error']);
385339
}
340+
341+
$connected = true;
342+
return $db_link;
343+
}
344+
########################################################################
345+
function sql($statement, &$o) {
346+
347+
/*
348+
Supported options that can be passed in $o options array (as array keys):
349+
'silentErrors': If true, errors will be returned in $o['error'] rather than displaying them on screen and exiting.
350+
'noSlowQueryLog': don't log slow query if true
351+
'noErrorQueryLog': don't log error query if true
352+
*/
353+
354+
global $Translation;
355+
356+
$db_link = openDBConnection($o);
357+
358+
/*
359+
if openDBConnection() fails, it would abort execution unless 'silentErrors' is true,
360+
in which case, we should return false from sql() without further action since
361+
$o['error'] would be already set by openDBConnection()
362+
*/
363+
if(!$db_link) return false;
364+
365+
$t0 = microtime(true);
366+
367+
if(!$result = @db_query($statement, $db_link)) {
368+
if(!stristr($statement, "show columns")) {
369+
// retrieve error codes
370+
$errorNum = db_errno($db_link);
371+
$o['error'] = htmlspecialchars(db_error($db_link));
372+
373+
if(empty($o['noErrorQueryLog']))
374+
logErrorQuery($statement, $o['error']);
375+
376+
if(getLoggedAdmin())
377+
$o['error'] .= "<pre class=\"ltr\">{$Translation['query:']}\n" . htmlspecialchars($statement) . "</pre><p><i class=\"text-right\">{$Translation['admin-only info']}</i></p><p>{$Translation['try rebuild fields']}</p>";
378+
379+
if($o['silentErrors']) return false;
380+
381+
dieErrorPage($o['error']);
382+
}
383+
}
384+
385+
/* log slow queries that take more than 1 sec */
386+
$t1 = microtime(true);
387+
if($t1 - $t0 > 1.0 && empty($o['noSlowQueryLog']))
388+
logSlowQuery($statement, $t1 - $t0);
389+
390+
return $result;
391+
}
392+
########################################################################
393+
function logSlowQuery($statement, $duration) {
394+
if(!createQueryLogTable()) return;
395+
396+
$o = [
397+
'silentErrors' => true,
398+
'noSlowQueryLog' => true,
399+
'noErrorQueryLog' => true
400+
];
401+
$statement = makeSafe($statement);
402+
$duration = floatval($duration);
403+
$memberID = makeSafe(getLoggedMemberID());
404+
$uri = makeSafe($_SERVER['REQUEST_URI']);
405+
406+
sql("INSERT INTO `appgini_query_log` SET
407+
`statement`='$statement',
408+
`duration`=$duration,
409+
`memberID`='$memberID',
410+
`uri`='$uri'
411+
", $o);
412+
}
413+
########################################################################
414+
function logErrorQuery($statement, $error) {
415+
if(!createQueryLogTable()) return;
416+
417+
$o = [
418+
'silentErrors' => true,
419+
'noSlowQueryLog' => true,
420+
'noErrorQueryLog' => true
421+
];
422+
$statement = makeSafe($statement);
423+
$error = makeSafe($error);
424+
$memberID = makeSafe(getLoggedMemberID());
425+
$uri = makeSafe($_SERVER['REQUEST_URI']);
426+
427+
sql("INSERT INTO `appgini_query_log` SET
428+
`statement`='$statement',
429+
`error`='$error',
430+
`memberID`='$memberID',
431+
`uri`='$uri'
432+
", $o);
433+
}
434+
435+
########################################################################
436+
function createQueryLogTable() {
437+
static $created = false;
438+
if($created) return true;
439+
440+
$o = [
441+
'silentErrors' => true,
442+
'noSlowQueryLog' => true,
443+
'noErrorQueryLog' => true
444+
];
445+
446+
sql("CREATE TABLE IF NOT EXISTS `appgini_query_log` (
447+
`datetime` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
448+
`statement` LONGTEXT,
449+
`duration` DECIMAL(10,2) UNSIGNED DEFAULT 0.0,
450+
`error` TEXT,
451+
`memberID` VARCHAR(200),
452+
`uri` VARCHAR(200)
453+
) CHARSET " . mysql_charset, $o);
454+
455+
// check if table created
456+
//$o2 = $o;
457+
//$o2['error'] = '';
458+
//sql("SELECT COUNT(1) FROM 'appgini_query_log'", $o2);
459+
460+
//$created = empty($o2['error']);
461+
462+
$created = true;
463+
return $created;
386464
}
387465

388466
########################################################################
389-
function sqlValue($statment, &$error = NULL) {
390-
// executes a statment that retreives a single data value and returns the value retrieved
467+
function sqlValue($statement, &$error = NULL) {
468+
// executes a statement that retreives a single data value and returns the value retrieved
391469
$eo = ['silentErrors' => true];
392-
if(!$res = sql($statment, $eo)) { $error = $eo['error']; return false; }
470+
if(!$res = sql($statement, $eo)) { $error = $eo['error']; return false; }
393471
if(!$row = db_fetch_row($res)) return false;
394472
return $row[0];
395473
}

‎app/admin/incHeader.php

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -200,14 +200,16 @@ function hideDialogs() {
200200
<ul class="dropdown-menu">
201201
<li><a href="pageSettings.php"><i class="glyphicon menu-item-icon text-info glyphicon-cog"></i> <?php echo $Translation['admin settings']; ?></a></li>
202202
<li class="divider"></li>
203-
<li><a href="pageRebuildFields.php"><i class="glyphicon menu-item-icon text-info glyphicon-refresh"></i> <?php echo $Translation['view or rebuild fields']; ?></a></li>
204-
<li><a href="pageUploadCSV.php"><i class="glyphicon menu-item-icon text-info glyphicon-upload"></i> <?php echo $Translation['import CSV']; ?></a></li>
205203
<li><a href="pageTransferOwnership.php"><i class="glyphicon menu-item-icon text-info glyphicon-random"></i> <?php echo $Translation['batch transfer']; ?></a></li>
206204
<li><a href="pageMail.php?sendToAll=1"><i class="glyphicon menu-item-icon text-info glyphicon-envelope"></i> <?php echo $Translation['mail all users']; ?></a></li>
207-
<li><a href="pageBackupRestore.php"><i class="glyphicon menu-item-icon text-info glyphicon-tasks"></i> <?php echo $Translation['database backups']; ?></a></li>
208205
<li><a href="pageServerStatus.php"><i class="glyphicon menu-item-icon text-info glyphicon-hdd"></i> <?php echo $Translation['server status']; ?></a></li>
209206
<li><a href="app-documentation.php"><i class="glyphicon menu-item-icon text-info glyphicon-book"></i> <?php echo $Translation['app documentation']; ?></a></li>
210207
<li class="divider"></li>
208+
<li><a href="pageRebuildFields.php"><i class="glyphicon menu-item-icon text-info glyphicon-refresh"></i> <?php echo $Translation['view or rebuild fields']; ?></a></li>
209+
<li><a href="pageBackupRestore.php"><i class="glyphicon menu-item-icon text-info glyphicon-tasks"></i> <?php echo $Translation['database backups']; ?></a></li>
210+
<li><a href="pageUploadCSV.php"><i class="glyphicon menu-item-icon text-info glyphicon-upload"></i> <?php echo $Translation['import CSV']; ?></a></li>
211+
<li><a href="pageQueryLogs.php"><i class="glyphicon menu-item-icon text-info glyphicon-book"></i> <?php echo $Translation['Query logs']; ?></a></li>
212+
<li class="divider"></li>
211213
<li><a href="https://forums.appgini.com" target="_blank"><i class="glyphicon menu-item-icon text-info glyphicon-new-window"></i> <?php echo $Translation['AppGini forum']; ?></a></li>
212214
</ul>
213215
</li>

‎app/admin/pageBackupRestore.php

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ protected function utf8ize($mixed) {
129129
*/
130130
protected function get_specified_backup_file() {
131131
$md5_hash = $this->request['md5_hash'];
132-
if(!preg_match('/^[a-f0-9]{32}$/i', $md5_hash)) return false;
132+
if(!preg_match('/^[a-f0-9]{17,32}$/i', $md5_hash)) return false;
133133

134134
$bfile = "{$this->curr_dir}/backups/{$md5_hash}.sql";
135135
if(!is_file($bfile)) return false;
@@ -361,10 +361,10 @@ public function get_backup_files() {
361361
$list = [];
362362

363363
while(false !== ($entry = $d->read())) {
364-
if(!preg_match('/^[a-f0-9]{32}\.sql$/i', $entry)) continue;
364+
if(!preg_match('/^[a-f0-9]{17,32}\.sql$/i', $entry)) continue;
365365
$fts = @filemtime("{$bdir}/{$entry}");
366366
$list[$fts] = array(
367-
'md5_hash' => substr($entry, 0, 32),
367+
'md5_hash' => substr($entry, 0, -4),
368368
'datetime' => date($dtf, $fts),
369369
'size' => number_format(@filesize("{$bdir}/{$entry}") / 1024)
370370
);
@@ -388,7 +388,7 @@ public function create_backup() {
388388
$config = ['dbServer' => '', 'dbUsername' => '', 'dbPassword' => '', 'dbDatabase' => ''];
389389
foreach($config as $k => $v) $config[$k] = escapeshellarg(config($k));
390390

391-
$dump_file = escapeshellarg(normalize_path($this->curr_dir)) . '/backups/' . md5(microtime()) . '.sql';
391+
$dump_file = escapeshellarg(normalize_path($this->curr_dir)) . '/backups/' . substr(md5(microtime() . rand(0, 100000)), -17) . '.sql';
392392
$pass_param = ($config['dbPassword'] ? "-p{$config['dbPassword']}" : '');
393393
$this->cmd = "(mysqldump --no-tablespaces -u{$config['dbUsername']} {$pass_param} -h{$config['dbServer']} {$config['dbDatabase']} -r {$dump_file}) 2>&1";
394394

‎app/admin/pageEditMember.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -383,7 +383,7 @@
383383
.parents('.form-group').removeClass('has-error has-success');
384384
},
385385
success: function(resp) {
386-
if(resp.match(/\<!-- AVAILABLE --\>/)) {
386+
if(resp.indexOf('username-available') > -1) {
387387
$j('#username-available')
388388
.removeClass('hidden')
389389
.parents('.form-group').addClass('has-success');

‎app/admin/pageMail.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@
8484
}
8585

8686
// save mail queue
87-
$queueFile = md5(microtime());
87+
$queueFile = substr(md5(microtime() . rand(0, 100000)), -17);
8888
$currDir = dirname(__FILE__);
8989
if(!($fp = fopen("{$currDir}/{$queueFile}.php", 'w'))) {
9090
echo Notification::show(array(

‎app/admin/pageSender.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
$queue = $_REQUEST['queue'];
1515
$simulate = (isset($_REQUEST['simulate']) ? true : false);
16-
if(!preg_match('/^[a-f0-9]{32}$/i', $queue)) {
16+
if(!preg_match('/^[a-f0-9]{17,32}$/i', $queue)) {
1717
echo "<div class=\"alert alert-danger\">{$Translation['invalid mail queue']}</div>";
1818
include("{$currDir}/incFooter.php");
1919
}

0 commit comments

Comments
 (0)