svn commit: r221 - trunk/mapbender/http/php/mod_group_gui.php
uli at osgeo.org
uli at osgeo.org
Wed May 10 09:53:56 EDT 2006
Author: uli
Date: 2006-05-10 13:53:55+0000
New Revision: 221
Modified:
trunk/mapbender/http/php/mod_group_gui.php
Log:
db_prep_query included
verification of user permissions
Modified: trunk/mapbender/http/php/mod_group_gui.php
Url: https://mapbender.osgeo.org/source/browse/mapbender/trunk/mapbender/http/php/mod_group_gui.php?view=diff&rev=221&p1=trunk/mapbender/http/php/mod_group_gui.php&p2=trunk/mapbender/http/php/mod_group_gui.php&r1=220&r2=221
==============================================================================
--- trunk/mapbender/http/php/mod_group_gui.php (original)
+++ trunk/mapbender/http/php/mod_group_gui.php 2006-05-10 13:53:55+0000
@@ -17,13 +17,13 @@
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
-session_start();
+
import_request_variables("PG");
-require_once("../php/mb_validateSession.php");
require_once("../../conf/mapbender.conf");
-$con = db_connect($DBSERVER,$OWNER,$PW);
+$con = db_connect(DBSERVER,OWNER,PW);
db_select_db(DB,$con);
-$gui_id = $_SESSION["mb_user_gui"];
+require_once("../php/mb_validatePermission.php");
+$self = $PHP_SELF . "?".SID."&guiID=".$_REQUEST["guiID"]."&elementID=".$_REQUEST["elementID"];
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
@@ -35,9 +35,10 @@
<script language="JavaScript">
function validate(wert){
if(document.forms[0]["selected_group"].selectedIndex == -1){
- document.getElementsByName("selected_group")[0].style.backgroundColor = '#ff0000';
- return;
- }else{
+ document.getElementsByName("selected_group")[0].style.backgroundColor = '#ff0000';
+ return;
+ }
+ else{
if(wert == "remove"){
if(document.forms[0]["remove_gui[]"].selectedIndex == -1){
document.getElementsByName("remove_gui[]")[0].style.backgroundColor = '#ff0000';
@@ -61,11 +62,6 @@
</head>
<body>
<?php
-require_once("../../conf/mapbender.conf");
-$con = db_connect($DBSERVER,$OWNER,$PW);
-db_select_db(DB,$con);
-
-
$fieldHeight = 20;
$cnt_gui = 0;
@@ -77,17 +73,23 @@
$gui_id_array = array();
-/*handle remove, update and insert**************************************************************************************/
+/*handle remove, update and insert*****************************************************************/
if($insert){
if(count($selected_gui)>0){
for($i=0; $i<count($selected_gui); $i++){
$exists = false;
- $sql_insert = "SELECT * from gui_mb_group where fkey_mb_group_id = '".$selected_group."' and fkey_gui_id = '".$selected_gui[$i]."'";
- $res_insert = db_query($sql_insert);
+ $sql_insert = "SELECT * FROM gui_mb_group WHERE fkey_mb_group_id = $1 ";
+ $sql_insert .= " and fkey_gui_id = $2 ";
+ $v = array($selected_group,$selected_gui[$i]);
+ $t = array('i','s');
+ $res_insert = db_prep_query($sql_insert,$v,$t);
while(db_fetch_row($res_insert)){$exists = true;}
if($exists == false){
- $sql_insert = "INSERT INTO gui_mb_group(fkey_mb_group_id, fkey_gui_id) VALUES('$selected_group', '".$selected_gui[$i]."');";
- $res_insert = db_query($sql_insert);
+ $sql_insert = "INSERT INTO gui_mb_group(fkey_mb_group_id, fkey_gui_id) ";
+ $sql_insert .= "VALUES($1, $2);";
+ $v = array($selected_group,$selected_gui[$i]);
+ $t = array('i','s');
+ $res_insert = db_prep_query($sql_insert,$v,$t);
}
}
}
@@ -95,13 +97,16 @@
if($remove){
if(count($remove_gui)>0){
for($i=0; $i<count($remove_gui); $i++){
- $sql_remove = "DELETE FROM gui_mb_group WHERE fkey_gui_id = '".$remove_gui[$i]."' and fkey_mb_group_id = '$selected_group'";
- db_query($sql_remove);
+ $sql_remove = "DELETE FROM gui_mb_group WHERE fkey_gui_id = $1";
+ $sql_remove .= " and fkey_mb_group_id = $2";
+ $v = array($remove_gui[$i],$selected_group);
+ $t = array('s','i');
+ db_prep_query($sql_remove,$v,$t);
}
}
}
-/*get all gui ********************************************************************************************/
+/*get all gui *************************************************************************************/
$sql_gui = "SELECT * FROM gui ORDER BY gui_name";
$res_gui = db_query($sql_gui);
while($row = db_fetch_array($res_gui)){
@@ -110,7 +115,7 @@
$cnt_gui++;
}
-/*get all group **********************************************************************************************/
+/*get all group ***********************************************************************************/
$sql_group = "SELECT * FROM mb_group ORDER BY mb_group_name";
$res_group = db_query($sql_group);
while($row = db_fetch_array($res_group)){
@@ -119,15 +124,16 @@
$cnt_group++;
}
-/*get all gui from selected_group******************************************************************************/
+/*get all gui from selected_group******************************************************************/
$sql_group_mb_gui = "SELECT gui.gui_id, gui.gui_name, gui_mb_group.fkey_mb_group_id FROM gui_mb_group ";
$sql_group_mb_gui .= "INNER JOIN gui ON gui_mb_group.fkey_gui_id = gui.gui_id ";
-$sql_group_mb_gui .= "WHERE gui_mb_group.fkey_mb_group_id=";
-
-if(!$selected_group){$sql_group_mb_gui .= $group_id[0];}
-if($selected_group){$sql_group_mb_gui .= $selected_group;}
+$sql_group_mb_gui .= "WHERE gui_mb_group.fkey_mb_group_id = $1 ";
$sql_group_mb_gui .= " ORDER BY gui.gui_name";
-$res_group_mb_gui = db_query($sql_group_mb_gui);
+if(!$selected_group){$v = array($group_id[0]);}
+if($selected_group){$v = array($selected_group);}
+$t = array('i');
+
+$res_group_mb_gui = db_prep_query($sql_group_mb_gui,$v,$t);
while($row = db_fetch_array($res_group_mb_gui)){
$gui_id_group[$cnt_gui_group] = $row["gui_id"];
$gui_name_group[$cnt_gui_group] = $row["gui_name"];
@@ -135,9 +141,9 @@
}
/*INSERT HTML*/
-echo "<form name='form1' action='" . $PHP_SELF . "?".SID."&e_id_css=".$_REQUEST["e_id_css"]."' method='post'>";
+echo "<form name='form1' action='" .$self."' method='post'>";
-/*insert all group in selectbox*************************************************************************************/
+/*insert all group in selectbox********************************************************************/
echo "<div class='text1'>GROUP: </div>";
echo "<select style='background:#ffffff' class='select1' name='selected_group' onChange='submit()' size='10'>";
for($i=0; $i<$cnt_group; $i++){
@@ -149,7 +155,7 @@
}
echo "</select>";
-/*insert all gui in selectbox**************************************************************************/
+/*insert all gui in selectbox***********************************************************************/
echo "<div class='text2'>GUI:</div>";
echo "<select style='background:#ffffff' class='select2' multiple='multiple' name='selected_gui[]' size='$fieldHeight' >";
for($i=0; $i<$cnt_gui; $i++){
@@ -157,7 +163,7 @@
}
echo "</select>";
-/*Button****************************************************************************************************/
+/*Button*******************************************************************************************/
echo "<div class='button1'><input type='button' value='==>' onClick='validate(\"insert\")'></div>";
echo "<input type='hidden' name='insert'>";
@@ -165,7 +171,7 @@
echo "<div class='button2'><input type='button' value='<==' onClick='validate(\"remove\")'></div>";
echo "<input type='hidden' name='remove'>";
-/*insert group_gui_dependence in selectbox**************************************************/
+/*insert group_gui_dependence in selectbox*********************************************************/
echo "<div class='text3'>SELECTED GUI:</div>";
echo "<select style='background:#ffffff' class='select3' multiple='multiple' name='remove_gui[]' size='$fieldHeight' >";
for($i=0; $i<$cnt_gui_group; $i++){
More information about the Mapbender_commits
mailing list