svn commit: r340 - trunk/mapbender/http/php/mod_user_gui.php

Wed May 24 07:58:45 EDT 2006

Author: uli
Date: 2006-05-24 11:58:45+0000
New Revision: 340

Modified:
   trunk/mapbender/http/php/mod_user_gui.php

Log:
validation of permissions
prepared statements included

Modified: trunk/mapbender/http/php/mod_user_gui.php
Url: https://mapbender.osgeo.org/source/browse/mapbender/trunk/mapbender/http/php/mod_user_gui.php?view=diff&rev=340&p1=trunk/mapbender/http/php/mod_user_gui.php&p2=trunk/mapbender/http/php/mod_user_gui.php&r1=339&r2=340
==============================================================================

--- trunk/mapbender/http/php/mod_user_gui.php	(original)
+++ trunk/mapbender/http/php/mod_user_gui.php	2006-05-24 11:58:45+0000
@@ -19,11 +19,13 @@
 import_request_variables("PG");
 session_start();
 $gui_id = $_SESSION["mb_user_gui"];
-//require_once("mb_validateInput.php");
+
 require_once("../../conf/mapbender.conf");
-require_once("../classes/class_wms.php"); 
-$con = db_connect($DBSERVER,$OWNER,$PW);
+$con = db_connect(DBSERVER,OWNER,PW);
 db_select_db(DB,$con);
+require_once("mb_validatePermission.php");
+require_once("../classes/class_wms.php"); 
+$self = $PHP_SELF . "?".SID."&guiID=".$_REQUEST["guiID"]."&elementID=".$_REQUEST["elementID"];
 ?>
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 
@@ -79,12 +81,16 @@
 	if(count($selected_gui)>0){
 		for($i=0; $i<count($selected_gui); $i++){
 			$exists = false;
-			$sql_insert = "SELECT * from gui_mb_user where fkey_mb_user_id = '".$selected_user."' and fkey_gui_id = '".$selected_gui[$i]."'";
-			$res_insert = db_query($sql_insert);
+			$sql_insert = "SELECT * from gui_mb_user where fkey_mb_user_id = $1 and fkey_gui_id = $2";
+			$v = array($selected_user,$selected_gui[$i]);
+			$t = array('i','s');
+			$res_insert = db_prep_query($sql_insert,$v,$t);
 			while($row = db_fetch_array($res_insert)){$exists = true;}
 			if($exists == false){
-				$sql_insert = "INSERT INTO gui_mb_user(fkey_mb_user_id, fkey_gui_id) VALUES('$selected_user', '".$selected_gui[$i]."');";
-				$res_insert = db_query($sql_insert);
+				$sql_insert = "INSERT INTO gui_mb_user(fkey_mb_user_id, fkey_gui_id) VALUES($1, $2)";
+				$v = array($selected_user,$selected_gui[$i]);
+				$t = array('i','s');
+				$res_insert = db_prep_query($sql_insert,$v,$t);
 			}
 		}
 	}
@@ -92,8 +98,10 @@
 if($remove){
 	if(count($remove_gui)>0){
 		for($i=0; $i<count($remove_gui); $i++){
-			$sql_remove = "DELETE FROM gui_mb_user WHERE fkey_gui_id = '".$remove_gui[$i]."' and fkey_mb_user_id = '$selected_user'";
-			db_query($sql_remove);
+			$sql_remove = "DELETE FROM gui_mb_user WHERE fkey_gui_id = $1 and fkey_mb_user_id = $2";
+			$v = array($remove_gui[$i],$selected_user);
+			$t = array('s','i');
+			db_prep_query($sql_remove,$v,$t);
 		}
 	}
 }
@@ -120,12 +128,13 @@
 /*get all gui from selected_user******************************************************************************/
 $sql_user_mb_gui = "SELECT gui.gui_id, gui.gui_name, gui_mb_user.fkey_mb_user_id FROM gui_mb_user ";
 $sql_user_mb_gui .= "INNER JOIN gui ON gui_mb_user.fkey_gui_id = gui.gui_id ";
-$sql_user_mb_gui .= "WHERE gui_mb_user.fkey_mb_user_id=";
+$sql_user_mb_gui .= "WHERE gui_mb_user.fkey_mb_user_id = $1 ORDER BY gui.gui_name";
+
+if(!$selected_user){$v = array($user_id[0]);}
+if($selected_user){$v = array($selected_user);}
+$t = array('i');
 
-if(!$selected_user){$sql_user_mb_gui .= $user_id[0];}
-if($selected_user){$sql_user_mb_gui .= $selected_user;}
-$sql_user_mb_gui .= " ORDER BY gui.gui_name";
-$res_user_mb_gui = db_query($sql_user_mb_gui);
+$res_user_mb_gui = db_prep_query($sql_user_mb_gui,$v,$t);
 while($row = db_fetch_array($res_user_mb_gui)){
 	$gui_id_user[$cnt_gui_user] = $row["gui_id"];
 	$gui_name_user[$cnt_gui_user] =  $row["gui_name"];
@@ -133,7 +142,7 @@
 }
 
 /*INSERT HTML*/
-echo "<form name='form1' action='" . $PHP_SELF . "?".SID."&e_id_css=".$_REQUEST["e_id_css"]."' method='post'>";
+echo "<form name='form1' action='" . $self ."&e_id_css=".$_REQUEST["e_id_css"]."' method='post'>";
 
 /*insert all user in selectbox*************************************************************************************/
 echo "<div class='text1'>USER: </div>";


