reviewed cookies api

includes/controller/angeltypes_controller.php

@@ -38,7 +38,7 @@ function angeltype_delete_controller() {
   if (! in_array('admin_angel_types', $privileges))
     redirect(page_link_to('angeltypes'));
   
-  $angeltype = mAngelType($_REQUEST['angeltype_id']);
+  $angeltype = AngelType($_REQUEST['angeltype_id']);
   if ($angeltype === false)
     engelsystem_error("Unable to load angeltype.");
   if ($angeltype == null)
@@ -69,7 +69,7 @@ function angeltype_edit_controller() {
   $name = "";
   $restricted = false;
   if (isset($_REQUEST['angeltype_id'])) {
-    $angeltype = mAngelType($_REQUEST['angeltype_id']);
+    $angeltype = AngelType($_REQUEST['angeltype_id']);
     if ($angeltype === false)
       engelsystem_error("Unable to load angeltype.");
     if ($angeltype == null)
@@ -127,7 +127,7 @@ function angeltype_controller() {
   if (! isset($_REQUEST['angeltype_id']))
     redirect(page_link_to('angeltypes'));
   
-  $angeltype = mAngelType($_REQUEST['angeltype_id']);
+  $angeltype = AngelType($_REQUEST['angeltype_id']);
   if ($angeltype === false)
     engelsystem_error("Unable to load angeltype.");
   if ($angeltype == null)

includes/controller/api.php

@@ -1,6 +1,5 @@
 <?php
 
-
 /************************************************************************************************
  * API Documentation
  ************************************************************************************************
@@ -103,12 +102,11 @@ sendMessage
 
 ************************************************************************************************/
 
-
 /**
  * General API Controller
  */
 function api_controller() {
-  global $user, $DataJson, $_REQUEST;
+  global $user, $DataJson;
   
   header("Content-Type: application/json; charset=utf-8");
   
@@ -140,18 +138,21 @@ function api_controller() {
   else
     die(json_encode(array(
         'status' => 'failed',
-          'error' => 'Missing parameter "key".' )));
+        'error' => 'Missing parameter "key".' 
+    )));
     
     // check API key
   $user = User_by_api_key($key);
   if ($user === false)
     die(json_encode(array(
         'status' => 'failed',
-          'error' => 'Unable to find user' )));
+        'error' => 'Unable to find user' 
+    )));
   if ($user == null)
     die(json_encode(array(
         'status' => 'failed',
-          'error' => 'Key invalid.' )));
+        'error' => 'Key invalid.' 
+    )));
     
     // decode command
   switch ($cmd) {
@@ -162,13 +163,15 @@ function api_controller() {
       getAngelType();
       break;
     case 'getuser':
-      getUser();
+      // TODO Dataleak! Only coordinators are allowed to see so much user informations.
+      //getUser();
       break;
     case 'getshift':
       getShift();
       break;
     case 'getmessage':
-      getMessage();
+      // TODO Dataleak!
+      //getMessage();
       break;
     case 'sendmessage':
       sendMessage();
@@ -176,18 +179,21 @@ function api_controller() {
     default:
       $DataJson = array(
           'status' => 'failed',
-          'error' => 'Unknown Command "'. $cmd. '"' );
+          'error' => 'Unknown Command "' . $cmd . '"' 
+      );
   }
   
   // check
   if ($DataJson === false) {
     $DataJson = array(
         'status' => 'failed',
-      'error' => 'DataJson === false' );
+        'error' => 'DataJson === false' 
+    );
   } elseif ($DataJson == null) {
     $DataJson = array(
         'status' => 'failed',
-      'error' => 'DataJson == null' );
+        'error' => 'DataJson == null' 
+    );
   }
   
   echo json_encode($DataJson);
@@ -202,25 +208,26 @@ function getVersion(){
   
   $DataJson = array(
       'status' => 'success',
-    'Version' => 1);
+      'Version' => 1 
+  );
 }
 
-
 /**
  * Get API Key
  */
 function getApiKey() {
-  global $DataJson, $_REQUEST;
+  global $DataJson;
   
   if (! isset($_REQUEST['user'])) {
     $DataJson = array(
         'status' => 'failed',
-      'error' => 'Missing parameter "user".' );
+        'error' => 'Missing parameter "user".' 
-  }
+    );
-  elseif (!isset($_REQUEST['pw']) ) {
+  } elseif (! isset($_REQUEST['pw'])) {
     $DataJson = array(
         'status' => 'failed',
-      'error' => 'Missing parameter "pw".' );
+        'error' => 'Missing parameter "pw".' 
+    );
   } else {
     $Erg = sql_select("SELECT `UID`, `Passwort`, `api_key` FROM `User` WHERE `Nick`='" . sql_escape($_REQUEST['user']) . "'");
     
@@ -230,33 +237,35 @@ function getApiKey(){
         $key = $Erg["api_key"];
         $DataJson = array(
             'status' => 'success',
-          'Key' => $key);
+            'Key' => $key 
+        );
       } else {
         $DataJson = array(
             'status' => 'failed',
-          'error' => 'PW wrong' );
+            'error' => 'PW wrong' 
+        );
       }
     } else {
       $DataJson = array(
           'status' => 'failed',
-        'error' => 'User not found.' );
+          'error' => 'User not found.' 
+      );
     }
   }
   
   sleep(1);
 }
 
-
 /**
  * Get Room
  */
 function getRoom() {
-  global $DataJson, $_REQUEST;
+  global $DataJson;
   
   if (isset($_REQUEST['id'])) {
-    $DataJson = mRoom( $_REQUEST['id']);
+    $DataJson = Room($_REQUEST['id']);
   } else {
-    $DataJson = mRoomList();
+    $DataJson = Room_ids();
   }
 }
 
@@ -264,12 +273,12 @@ function getRoom(){
  * Get AngelType
  */
 function getAngelType() {
-  global $DataJson, $_REQUEST;
+  global $DataJson;
   
   if (isset($_REQUEST['id'])) {
-    $DataJson = mAngelType( $_REQUEST['id']);
+    $DataJson = AngelType($_REQUEST['id']);
   } else {
-    $DataJson = mAngelTypeList();
+    $DataJson = AngelType_ids();
   }
 }
 
@@ -277,12 +286,12 @@ function getAngelType(){
  * Get User
  */
 function getUser() {
-  global $DataJson, $_REQUEST;
+  global $DataJson;
   
   if (isset($_REQUEST['id'])) {
     $DataJson = mUser_Limit($_REQUEST['id']);
   } else {
-    $DataJson = mUserList();
+    $DataJson = User_ids();
   }
 }
 
@@ -290,25 +299,26 @@ function getUser(){
  * Get Shift
  */
 function getShift() {
-  global $DataJson, $_REQUEST;
+  global $DataJson;
   
   if (isset($_REQUEST['id'])) {
-    $DataJson = mShift( $_REQUEST['id']);
+    $DataJson = Shift($_REQUEST['id']);
   } else {
-    $DataJson = mShiftList();
+    $DataJson = Shifts_filtered();
   }
 }
 
 /**
+ * @TODO: Why are ALL messages of ALL users returned? Data leak. It is not checked if this is my message!
  * Get Message
  */
 function getMessage() {
-  global $DataJson, $_REQUEST;
+  global $DataJson;
   
   if (isset($_REQUEST['id'])) {
-    $DataJson = mMessage( $_REQUEST['id']);
+    $DataJson = Message($_REQUEST['id']);
   } else {
-    $DataJson = mMessageList();
+    $DataJson = Message_ids();
   }
 }
 
@@ -316,24 +326,28 @@ function getMessage(){
  * Send Message
  */
 function sendMessage() {
-  global $DataJson, $_REQUEST;
+  global $DataJson;
   
   if (! isset($_REQUEST['uid'])) {
     $DataJson = array(
         'status' => 'failed',
-  			'error' => 'Missing parameter "uid".' );
+        'error' => 'Missing parameter "uid".' 
-  }
+    );
-  elseif (!isset($_REQUEST['text']) ) {
+  } elseif (! isset($_REQUEST['text'])) {
     $DataJson = array(
         'status' => 'failed',
-      'error' => 'Missing parameter "text".' );
+        'error' => 'Missing parameter "text".' 
+    );
   } else {
-    if( mMessage_Send( $_REQUEST['uid'], $_REQUEST['text']) === true) {
+    if (Message_send($_REQUEST['uid'], $_REQUEST['text']) === true) {
-    	$DataJson = array( 'status' => 'success');
+      $DataJson = array(
+          'status' => 'success' 
+      );
     } else {
       $DataJson = array(
           'status' => 'failed',
-        'error' => 'Transmitting was terminated with an Error.');
+          'error' => 'Transmitting was terminated with an Error.' 
+      );
     }
   }
 }

includes/controller/user_angeltypes_controller.php

@@ -13,7 +13,7 @@ function user_angeltypes_delete_all_controller() {
     redirect(page_link_to('angeltypes'));
   }
   
-  $angeltype = mAngelType($_REQUEST['angeltype_id']);
+  $angeltype = AngelType($_REQUEST['angeltype_id']);
   if ($angeltype === false)
     engelsystem_error("Unable to load angeltype.");
   if ($angeltype == null) {
@@ -50,7 +50,7 @@ function user_angeltypes_confirm_all_controller() {
     redirect(page_link_to('angeltypes'));
   }
   
-  $angeltype = mAngelType($_REQUEST['angeltype_id']);
+  $angeltype = AngelType($_REQUEST['angeltype_id']);
   if ($angeltype === false)
     engelsystem_error("Unable to load angeltype.");
   if ($angeltype == null) {
@@ -95,7 +95,7 @@ function user_angeltype_confirm_controller() {
     redirect(page_link_to('angeltypes'));
   }
   
-  $angeltype = mAngelType($user_angeltype['angeltype_id']);
+  $angeltype = AngelType($user_angeltype['angeltype_id']);
   if ($angeltype === false)
     engelsystem_error("Unable to load angeltype.");
   if ($angeltype == null) {
@@ -143,7 +143,7 @@ function user_angeltype_delete_controller() {
     redirect(page_link_to('angeltypes'));
   }
   
-  $angeltype = mAngelType($user_angeltype['angeltype_id']);
+  $angeltype = AngelType($user_angeltype['angeltype_id']);
   if ($angeltype === false)
     engelsystem_error("Unable to load angeltype.");
   if ($angeltype == null) {
@@ -194,7 +194,7 @@ function user_angeltype_add_controller() {
     redirect(page_link_to('angeltypes'));
   }
   
-  $angeltype = mAngelType($_REQUEST['angeltype_id']);
+  $angeltype = AngelType($_REQUEST['angeltype_id']);
   if ($angeltype === false)
     engelsystem_error("Unable to load angeltype.");
   if ($angeltype == null) {

includes/model/AngelType_model.php

@@ -80,7 +80,7 @@ function AngelTypes_with_user($user) {
 /**
  * Returns AngelType id array
  */
-function mAngelTypeList() {
+function AngelType_ids() {
   $angelType_source = sql_select("SELECT `id` FROM `AngelTypes`");
   if ($angelType_source === false)
     return false;
@@ -95,7 +95,7 @@ function mAngelTypeList() {
  * @param $id angelType
  *          ID
  */
-function mAngelType($id) {
+function AngelType($id) {
   $angelType_source = sql_select("SELECT * FROM `AngelTypes` WHERE `id`=" . sql_escape($id) . " LIMIT 1");
   if ($angelType_source === false)
     return false;

includes/model/Message_model.php

@@ -3,21 +3,17 @@
 /**
  * Returns Message id array
  */
-function mMessageList() {
+function Message_ids() {
-	$message_source = sql_select("SELECT `id` FROM `Messages`");
+  return sql_select("SELECT `id` FROM `Messages`");
-	if ($message_source === false)
-		return false;
-	if (count($message_source) > 0)
-		return $message_source;
-	return null;
 }
 
 /**
  * Returns message by id.
  *
- * @param $id message ID
+ * @param $id message
+ *          ID
  */
-function mMessage($id) {
+function Message($id) {
   $message_source = sql_select("SELECT * FROM `Messages` WHERE `id`=" . sql_escape($id) . " LIMIT 1");
   if ($message_source === false)
     return false;
@@ -26,21 +22,23 @@ function mMessage($id) {
   return null;
 }
 
-
 /**
+ * TODO: use validation functions, return new message id
+ * TODO: global $user con not be used in model!
  * send message
  *
- * @param $id User ID of Reciever
+ * @param $id User
- * @param $text Text of Message
+ *          ID of Reciever
+ * @param $text Text
+ *          of Message
  */
-function mMessage_Send($id, $text) {
+function Message_send($id, $text) {
   global $user;
   
   $text = preg_replace("/([^\p{L}\p{P}\p{Z}\p{N}\n]{1,})/ui", '', strip_tags($text));
   $to = preg_replace("/([^0-9]{1,})/ui", '', strip_tags($id));
   
-  if (($text != "" && is_numeric($to)) && 
+  if (($text != "" && is_numeric($to)) && (sql_num_query("SELECT * FROM `User` WHERE `UID`=" . sql_escape($to) . " AND NOT `UID`=" . sql_escape($user['UID']) . " LIMIT 1") > 0)) {
-      (sql_num_query("SELECT * FROM `User` WHERE `UID`=" . sql_escape($to) . " AND NOT `UID`=" . sql_escape($user['UID']) . " LIMIT 1") > 0) ) {
     sql_query("INSERT INTO `Messages` SET `Datum`=" . sql_escape(time()) . ", `SUID`=" . sql_escape($user['UID']) . ", `RUID`=" . sql_escape($to) . ", `Text`='" . sql_escape($text) . "'");
     return true;
   } else {

includes/model/Room_model.php

@@ -3,7 +3,7 @@
 /**
  * Returns room id array
  */
-function mRoomList() {
+function Room_ids() {
   $room_source = sql_select("SELECT `RID` FROM `Room` WHERE `show` = 'Y'");
   if ($room_source === false)
     return false;
@@ -12,13 +12,12 @@ function mRoomList() {
   return null;
 }
 
-
 /**
  * Returns room by id.
  *
  * @param $id RID          
  */
-function mRoom($id) {
+function Room($id) {
   $room_source = sql_select("SELECT * FROM `Room` WHERE `RID`=" . sql_escape($id) . " AND `show` = 'Y' LIMIT 1");
   if ($room_source === false)
     return false;
@@ -27,5 +26,4 @@ function mRoom($id) {
   return null;
 }
 
-
 ?>

includes/model/Shifts_model.php

@@ -1,9 +1,10 @@
 <?php
 
 /**
+ * TODO: $_REQUEST is not allowed in model!
  * Returns Shift id array
  */
-function mShiftList() {
+function Shifts_filtered() {
 	global $_REQUEST;
 	$filter = "";
 	
@@ -49,7 +50,7 @@ function mShiftList() {
  *
  * @param $id Shift ID
  */
-function mShift($id) {
+function Shift($id) {
 	$shifts_source = sql_select("SELECT * FROM `Shifts` WHERE `SID`=" . sql_escape($id) . " LIMIT 1");
 	$shiftsEntry_source = sql_select("SELECT `TID` , `UID` , `freeloaded` FROM `ShiftEntry` WHERE `SID`=" . sql_escape($id) );
 	

includes/model/User_model.php

@@ -16,13 +16,8 @@ function Users_by_angeltype($angeltype) {
 /**
  * Returns User id array
  */
-function mUserList() {
+function User_ids() {
-  $user_source = sql_select("SELECT `UID` FROM `User`");
+  return sql_select("SELECT `UID` FROM `User`");
-  if ($user_source === false)
-    return false;
-  if (count($user_source) > 0)
-    return $user_source;
-  return null;
 }
 
 /**
@@ -49,6 +44,7 @@ function User($id) {
 }
 
 /**
+ * TODO: Merge into normal user function
  * Returns user by id (limit informations.
  *
  * @param $id UID          

includes/pages/user_messages.php

@@ -98,7 +98,7 @@ function user_messages() {
         break;
       
       case "send":
-        if( mMessage_Send( $_REQUEST['to'], $_REQUEST['text']) === true) {
+        if (Message_send($_REQUEST['to'], $_REQUEST['text']) === true) {
           redirect(page_link_to("user_messages"));
         } else {
           return error(_("Transmitting was terminated with an Error."), true);