From 7e15ef47121117463d2e02c0056bc3fe9714bb75 Mon Sep 17 00:00:00 2001 From: Ryan Walberg Date: Thu, 15 Nov 2012 03:33:41 +0000 Subject: [PATCH] event page done. found some SQL injection too :( --- src/event.php | 241 ++++++++-------------------------------- src/templates/event.tpl | 143 ++++++++++++++++++++++++ 2 files changed, 191 insertions(+), 193 deletions(-) create mode 100644 src/templates/event.tpl diff --git a/src/event.php b/src/event.php index b46eccf..45886a0 100644 --- a/src/event.php +++ b/src/event.php @@ -30,11 +30,15 @@ if (!empty($_GET["message"])) { $message = strip_tags($_GET["message"]); } +if (isset($_GET["eventid"])) { + $eventid = (int) $_GET["eventid"]; +} + // for security, let's make sure that if an eventid was passed in, it belongs // to $userid (or is a system event and the user is an admin). // all operations on this page should only be performed by the event's owner. -if (isset($_GET["eventid"]) && $_GET["eventid"] != "") { - $query = "SELECT * FROM {$OPT["table_prefix"]}events WHERE eventid = " . $_GET["eventid"] . " AND "; +if (isset($eventid)) { + $query = "SELECT * FROM {$OPT["table_prefix"]}events WHERE eventid = $eventid AND "; if ($_SESSION["admin"] == 1) $query .= "(userid = " . $_SESSION["userid"] . " OR userid IS NULL)"; else @@ -52,7 +56,8 @@ $action = isset($_GET["action"]) ? $_GET["action"] : ""; if ($action == "insert" || $action == "update") { /* validate the data. */ $description = trim($_GET["description"]); - $eventdate = mktime(0,0,0,$_GET["month"],$_GET["day"],$_GET["century"] . $_GET["year"]); // may not assemble a good date. + $eventdate = $_GET["eventdate"]; + $ts = strtotime($eventdate); $recurring = (strtoupper($_GET["recurring"]) == "ON" ? 1 : 0); $systemevent = (strtoupper($_GET["system"]) == "ON" ? 1 : 0); if (!get_magic_quotes_gpc()) @@ -63,28 +68,24 @@ if ($action == "insert" || $action == "update") { $haserror = true; $description_error = "A description is required."; } - if ($eventdate < 0) { + if ($ts < 0 || $ts == FALSE) { $haserror = true; $eventdate_error = "Date is out of range for this server."; } - if (!checkdate($_GET["month"],$_GET["day"],$_GET["century"] . $_GET["year"])) { - $haserror = true; - $eventdate_error = "Invalid date. (Check that the day of the month exists.)"; - } } if ($action == "delete") { - $query = "DELETE FROM {$OPT["table_prefix"]}events WHERE eventid = " . $_GET["eventid"]; + $query = "DELETE FROM {$OPT["table_prefix"]}events WHERE eventid = $eventid"; mysql_query($query) or die("Could not query: " . mysql_error()); header("Location: " . getFullPath("event.php?message=Event+deleted.")); exit; } else if ($action == "edit") { - $query = "SELECT description, eventdate, recurring, userid FROM {$OPT["table_prefix"]}events WHERE eventid = " . $_GET["eventid"]; + $query = "SELECT description, eventdate, recurring, userid FROM {$OPT["table_prefix"]}events WHERE eventid = $eventid"; $rs = mysql_query($query) or die("Could not query: " . mysql_error()); if ($row = mysql_fetch_array($rs,MYSQL_ASSOC)) { - $description = htmlspecialchars($row["description"]); - $eventdate = strtotime($row["eventdate"]); + $description = $row["description"]; + $eventdate = $row["eventdate"]; $recurring = $row["recurring"]; $systemevent = ($row["userid"] == ""); } @@ -92,14 +93,14 @@ else if ($action == "edit") { } else if ($action == "") { $description = ""; - $eventdate = time(); + $eventdate = date("m/d/Y"); $recurring = 1; $systemevent = 0; } else if ($action == "insert") { if (!$haserror) { $query = "INSERT INTO {$OPT["table_prefix"]}events(userid,description,eventdate,recurring) " . - "VALUES(" . ($systemevent ? "NULL" : $userid) . ",'$description','" . strftime("%Y-%m-%d",$eventdate) . "',$recurring)"; + "VALUES(" . ($systemevent ? "NULL" : $userid) . ",'$description','" . strftime("%Y-%m-%d", $ts) . "',$recurring)"; mysql_query($query) or die("Could not query: " . mysql_error()); header("Location: " . getFullPath("event.php?message=Event+added.")); exit; @@ -110,9 +111,9 @@ else if ($action == "update") { $query = "UPDATE {$OPT["table_prefix"]}events SET " . "userid = " . ($systemevent ? "NULL" : $userid) . ", " . "description = '$description', " . - "eventdate = '" . strftime("%Y-%m-%d",$eventdate) . "', " . + "eventdate = '" . strftime("%Y-%m-%d", $ts) . "', " . "recurring = $recurring " . - "WHERE eventid = " . $_GET["eventid"]; + "WHERE eventid = $eventid"; mysql_query($query) or die("Could not query: " . mysql_error()); header("Location: " . getFullPath("event.php?message=Event+updated.")); exit; @@ -123,188 +124,42 @@ else { exit; } -echo "\r\n"; -?> - - - -Gift Registry - Manage Events - - - -" . $message . ""; -} - $query = "SELECT eventid, userid, description, eventdate, recurring " . "FROM {$OPT["table_prefix"]}events " . "WHERE userid = $userid"; if ($_SESSION["admin"] == 1) $query .= " OR userid IS NULL"; // add in system events $query .= " ORDER BY userid, eventdate"; -$events = mysql_query($query) or die("Could not query: " . mysql_error()); - -if ($OPT["show_helptext"]) { - ?> -

- Here you can specify events of your own, like your birthday or your anniversary. When the event occurs within days, an event reminder will appear in the display of everyone who shops for you. - System events are events which belong to no one -- like Christmas -- and will appear on everyone's display."; ?> - Marking an item as Recurring yearly will cause them to show up year after year. -

- assign('message', $message); +} +$smarty->assign('action', $action); +$smarty->assign('haserror', $haserror); +$smarty->assign('events', $events); +$smarty->assign('eventdate', strftime("%m/%d/%Y", strtotime($eventdate))); +if (isset($eventdate_error)) { + $smarty->assign('eventdate_error', $eventdate_error); +} +$smarty->assign('description', $description); +if (isset($description_error)) { + $smarty->assign('description_error', $description_error); +} +$smarty->assign('recurring', $recurring); +$smarty->assign('systemevent', $systemevent); +$smarty->assign('eventid', $eventid); +$smarty->assign('userid', $userid); +$smarty->assign('isadmin', $_SESSION['admin']); +$smarty->assign('opt', $OPT); +$smarty->display('event.tpl'); ?> -

- - - - - - - - - - - - - - - "> - - - - - - - - - -
" align="center">Events
Event dateDescriptionRecurring?System event? 
- ">Edit - / - ">Delete -
-

-

- Add a new event / Back to main -

-
- - "> - - - - -
- - - - - - - - - - - - - - - - -
Description - -
-
Date - - - , - - -
-
- >Recurring yearly -   - - >System event - -
-
-

-

- "/> - -
-

-
- - diff --git a/src/templates/event.tpl b/src/templates/event.tpl new file mode 100644 index 0000000..43c5334 --- /dev/null +++ b/src/templates/event.tpl @@ -0,0 +1,143 @@ +{* +This program is free software; you can redistribute it and/or modify +it under the terms of the GNU General Public License as published by +the Free Software Foundation; either version 2 of the License, or +(at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU General Public License for more details. + +You should have received a copy of the GNU General Public License +along with this program; if not, write to the Free Software +Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +*} + + + + + Gift Registry - Manage Events + + + + + +
+ {if isset($message)} +
+
+
+ {$message|escape:'htmlall'} +
+
+
+ {/if} + {if $opt.show_helptext} +
+
+
+ Here you can specify events of your own, like your birthday or your anniversary. When the event occurs within {$opt.event_threshold} days, an event reminder will appear in the display of everyone who shops for you. + {if $isadmin} + System events are events which belong to no one -- like Christmas -- and will appear on everyone's display. + {/if} + Marking an item as Recurring yearly will cause them to show up year after year. +
+
+
+ {/if} +
+
+
+

Events

+ + + + + + + {if $isadmin} + + {/if} + + + + + {foreach from=$events item=row} + + + + + {if $isadmin} + + {/if} + + + {/foreach} + +
Event dateDescriptionRecurring?System event? 
{$row.eventdate}{$row.description|escape:'htmlall'}{if $row.recurring}Yes{else}No{/if} + {if $row.userid == ''}Yes{else}No{/if} + + Edit Event Delete Event +
+
Add a new event
+
+
+
+
+
+
+
+ Event Details + {if $action == "edit" || (isset($haserror) && $action == "update")} + + + {elseif $action == "" || (isset($haserror) && $action == "insert")} + + {/if} +
+ +
+ + {if isset($description_error)} + {$description_error} + {/if} +
+
+
+ +
+ +

mm/dd/yyyy

+ {if isset($eventdate_error)} + {$eventdate_error} + {/if} +
+
+
+ +
+ + Recurring yearly +
+
+ {if $isadmin} +
+ +
+ + System event +
+
+ {/if} +
+ + +
+
+
+
+
+
+ +