[Mapbender-commits] r5823 - branches/2.6/http/javascripts

Mon Mar 22 09:18:02 EDT 2010

Author: christoph
Date: 2010-03-22 09:18:00 -0400 (Mon, 22 Mar 2010)
New Revision: 5823

Modified:
   branches/2.6/http/javascripts/mod_legend.php
Log:
set element ID hard wired, validation changed to "Permission"

Modified: branches/2.6/http/javascripts/mod_legend.php
===================================================================

--- branches/2.6/http/javascripts/mod_legend.php	2010-03-22 13:15:29 UTC (rev 5822)
+++ branches/2.6/http/javascripts/mod_legend.php	2010-03-22 13:18:00 UTC (rev 5823)
@@ -16,8 +16,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
- 
-require_once(dirname(__FILE__)."/../php/mb_validateSession.php");
+
+$e_id = "legend";
+require_once(dirname(__FILE__)."/../php/mb_validatePermission.php");
 ?>
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 
@@ -33,9 +34,9 @@
 <?php
 include '../include/dyn_css.php';
 
-$sql = "SELECT DISTINCT e_target, e_width, e_height FROM gui_element WHERE e_id = '".$_REQUEST["e_id_css"]."' AND fkey_gui_id = $1";
-$v = array($gui_id);
-$t = array('s');
+$sql = "SELECT DISTINCT e_target, e_width, e_height FROM gui_element WHERE e_id = $1 AND fkey_gui_id = $2";
+$v = array($e_id, $gui_id);
+$t = array('s', 's');
 $res = db_prep_query($sql, $v, $t);
 $cnt = 0;
 while($row = db_fetch_array($res)){    
@@ -46,9 +47,9 @@
 	echo "alert('legend: ID not unique!');";
 }
 
-$sql2 = "SELECT e_left,e_top,e_width,e_height FROM gui_element WHERE e_id = '".$e_target."' AND fkey_gui_id = $1";
-$v = array($gui_id);
-$t = array('s');
+$sql2 = "SELECT e_left,e_top,e_width,e_height FROM gui_element WHERE e_id = $1 AND fkey_gui_id = $2";
+$v = array($e_target, $gui_id);
+$t = array('s','s');
 $res2 = db_prep_query($sql2, $v, $t);
 echo "<script type='text/javascript'>\n";
 echo "var mod_legend_target = '".$e_target."';\n";

