iger
/
engelsystem
9
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

bugfix und security 

git-svn-id: svn://svn.cccv.de/engel-system@265 29ba0400-6e00-0410-a75a-ca02368028f8
This commit is contained in:
cookie 2007-12-29 17:35:39 +00:00
parent 4ef096e843
commit f58879ba0d
2 changed files with 66 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
www-ssl/admin/UserPicture.php
View File

@ -12,7 +12,7 @@ if( IsSet($_GET["action"]) )
switch ($_GET["action"]) switch ($_GET["action"])
{ {
case 'FormUpload': case 'FormUpload':
echo "Hier kannst Du ein Foto hochladen für:"; echo "Hier kannst Du ein Foto hochladen för:";
echo "<form action=\"./UserPicture.php?action=sendPicture\" method=\"post\" enctype=\"multipart/form-data\">\n"; echo "<form action=\"./UserPicture.php?action=sendPicture\" method=\"post\" enctype=\"multipart/form-data\">\n";
echo "\t<select name=\"UID\">\n"; echo "\t<select name=\"UID\">\n";
$usql="SELECT * FROM `User` ORDER BY `Nick`"; $usql="SELECT * FROM `User` ORDER BY `Nick`";
@ -76,13 +76,13 @@ if( IsSet($_GET["action"]) )
echo "Fehlerhafter Aufruf"; echo "Fehlerhafter Aufruf";
break; break;
case 'del': case 'del':
echo "Wollen Sie das Bild von '". UID2Nick( $_GET["UID"]). "' wirklich löschen? ". echo "Wollen Sie das Bild von '". UID2Nick( $_GET["UID"]). "' wirklich l&ouml;schen? ".
"<a href=\"./UserPicture.php?action=delYes&UID=". $_GET["UID"]. "\">Yes</a>"; "<a href=\"./UserPicture.php?action=delYes&UID=". $_GET["UID"]. "\">Yes</a>";
break; break;
case 'delYes': case 'delYes':
if (IsSet($_GET["UID"])) if (IsSet($_GET["UID"]))
{ {
echo "Bild von '". UID2Nick( $_GET["UID"]). "' wurde gelöscht:<br>"; echo "Bild von '". UID2Nick( $_GET["UID"]). "' wurde gel&ouml;scht:<br>";
$SQL = "DELETE FROM `UserPicture` WHERE `UID`='". $_GET["UID"]. "' LIMIT 1"; $SQL = "DELETE FROM `UserPicture` WHERE `UID`='". $_GET["UID"]. "' LIMIT 1";
} }
else else
@ -121,24 +121,24 @@ echo "<tr class=\"contenttopic\">\n";
echo "\t<td>User</td>\n"; echo "\t<td>User</td>\n";
echo "\t<td>Bild</td>\n"; echo "\t<td>Bild</td>\n";
echo "\t<td>Status</td>\n"; echo "\t<td>Status</td>\n";
echo "\t<td>Löschen</td>\n"; echo "\t<td>L&ouml;schen</td>\n";
echo "</tr>"; echo "</tr>";
for( $t = 0; $t < mysql_num_rows($Erg); $t++ ) for( $t = 0; $t < mysql_num_rows($Erg); $t++ )
{ {
$UID = mysql_result($Erg, $t, "UID"); $UIDs = mysql_result($Erg, $t, "UID");
echo "\t<tr class=\"content\">\n"; echo "\t<tr class=\"content\">\n";
echo "\t\t<td>". UID2Nick(mysql_result($Erg, $t, "UID")). "</td>\n"; echo "\t\t<td>". UID2Nick(mysql_result($Erg, $t, "UID")). "</td>\n";
echo "\t\t<td>". displayPictur( $UID, 0). "</td>\n"; echo "\t\t<td>". displayPictur( $UIDs, 0). "</td>\n";
if( GetPicturShow( $UID) == "Y") if( GetPicturShow( $UIDs) == "Y")
echo "\t\t<td><a href=\"./UserPicture.php?action=SetN&UID=$UID\">sperren</a></td>\n"; echo "\t\t<td><a href=\"./UserPicture.php?action=SetN&UID=$UIDs\">sperren</a></td>\n";
elseif( GetPicturShow( $UID) == "N") elseif( GetPicturShow( $UIDs) == "N")
echo "\t\t<td><a href=\"./UserPicture.php?action=SetY&UID=$UID\">freigeben</a></td>\n"; echo "\t\t<td><a href=\"./UserPicture.php?action=SetY&UID=$UIDs\">freigeben</a></td>\n";
else else
echo "\t\t<td>ERROR: show='". GetPicturShow( $UID). "'</td>\n"; echo "\t\t<td>ERROR: show='". GetPicturShow( $UIDs). "'</td>\n";
echo "\t\t<td><a href=\"./UserPicture.php?action=del&UID=$UID\">del</a></td>\n"; echo "\t\t<td><a href=\"./UserPicture.php?action=del&UID=$UIDs\">del</a></td>\n";
echo "\t</tr>\n"; echo "\t</tr>\n";
} // ende Auflistung Raeume } // ende Auflistung Raeume
echo "</table>"; echo "</table>";

78
www-ssl/nonpublic/schichtplan_add.php
View File

@ -15,6 +15,12 @@ if (isset($_POST["newtext"]) && isset($_POST["SID"]) && isset($_POST["TID"])) {
$beginSchicht = mysql_result($ShiftErg, 0, "DateS"); $beginSchicht = mysql_result($ShiftErg, 0, "DateS");
$endSchicht = mysql_result($ShiftErg, 0, "DateE"); $endSchicht = mysql_result($ShiftErg, 0, "DateE");
//wenn keien rechte definiert sind
if( !isset($_SESSION['CVS'][ $TID2Name[$_POST["TID"]] ]))
$_SESSION['CVS'][ $TID2Name[$_POST["TID"]] ] = "Y";
if( $_SESSION['CVS'][ $TID2Name[$_POST["TID"]] ] == "Y")
{
// Ueberpruefung, ob der Engel bereits für eine Schicht zu dieser Zeit eingetragen ist // Ueberpruefung, ob der Engel bereits für eine Schicht zu dieser Zeit eingetragen ist
$SSQL="SELECT * FROM `Shifts`". $SSQL="SELECT * FROM `Shifts`".
" INNER JOIN `ShiftEntry` ON `ShiftEntry`.`SID` = `Shifts`.`SID`". " INNER JOIN `ShiftEntry` ON `ShiftEntry`.`SID` = `Shifts`.`SID`".
@ -57,40 +63,62 @@ if (isset($_POST["newtext"]) && isset($_POST["SID"]) && isset($_POST["TID"])) {
}//TO Many USERS }//TO Many USERS
}//Allready in Shift }//Allready in Shift
}
else
{
echo "<h1>:-(</h1>";
array_push($error_messages, "Hack atteck\n");
}
} }
elseif (isset($_GET["SID"]) && isset($_GET["TID"])) { elseif (isset($_GET["SID"]) && isset($_GET["TID"]))
echo Get_Text("pub_schichtplan_add_Text1"). "<br><br>\n\n". {
"<form action=\"./schichtplan_add.php\" method=\"post\">\n". //wenn keien rechte definiert sind
"<table border=\"0\">\n"; if( !isset($_SESSION['CVS'][ $TID2Name[$_GET["TID"]] ]))
$_SESSION['CVS'][ $TID2Name[$_GET["TID"]] ] = "Y";
$SQL = "SELECT * FROM `Shifts` WHERE ";
$SQL .="(`SID` = '". $_GET["SID"]. "')";
$Erg = mysql_query($SQL, $con);
echo "<tr><td>". Get_Text("pub_schichtplan_add_Date"). ":</td> <td>".
mysql_result($Erg, 0, "DateS"). "</td></tr>\n";
echo "<tr><td>". Get_Text("pub_schichtplan_add_Place"). ":</td> <td>". if( $_SESSION['CVS'][ $TID2Name[$_GET["TID"]] ] == "Y")
$RoomID[ mysql_result($Erg, 0, "RID") ]. "</td></tr>\n"; {
echo "<tr><td>". Get_Text("pub_schichtplan_add_Job"). ":</td> <td>". echo Get_Text("pub_schichtplan_add_Text1"). "<br><br>\n\n".
$EngelTypeID[$_GET["TID"]]. "</td></tr>\n"; "<form action=\"./schichtplan_add.php\" method=\"post\">\n".
"<table border=\"0\">\n";
echo "<tr><td>". Get_Text("pub_schichtplan_add_Len"). ":</td> <td>". $SQL = "SELECT * FROM `Shifts` WHERE ";
mysql_result($Erg, 0, "Len"). "h</td></tr>\n"; $SQL .="(`SID` = '". $_GET["SID"]. "')";
$Erg = mysql_query($SQL, $con);
echo "<tr><td>". Get_Text("pub_schichtplan_add_TextFor"). ":</td> <td>". echo "<tr><td>". Get_Text("pub_schichtplan_add_Date"). ":</td> <td>".
mysql_result($Erg, 0, "Man"). "</td></tr>\n"; mysql_result($Erg, 0, "DateS"). "</td></tr>\n";
echo "<tr><td valign='top'>". Get_Text("pub_schichtplan_add_Comment"). ":</td>\n <td>". echo "<tr><td>". Get_Text("pub_schichtplan_add_Place"). ":</td> <td>".
"<textarea name='newtext' cols='50' rows='10'></textarea> </td></tr>\n"; $RoomID[ mysql_result($Erg, 0, "RID") ]. "</td></tr>\n";
echo "<tr><td>&nbsp;</td>\n". echo "<tr><td>". Get_Text("pub_schichtplan_add_Job"). ":</td> <td>".
"<td><input type=\"submit\" value=\"". Get_Text("pub_schichtplan_add_submit"). "\"> </td></tr>\n". $EngelTypeID[$_GET["TID"]]. "</td></tr>\n";
"</table>\n".
"<input type=\"hidden\" name=\"SID\" value=\"". $_GET["SID"]. "\">\n". echo "<tr><td>". Get_Text("pub_schichtplan_add_Len"). ":</td> <td>".
"<input type=\"hidden\" name=\"TID\" value=\"". $_GET["TID"]. "\">\n". mysql_result($Erg, 0, "Len"). "h</td></tr>\n";
"</form>";
echo "<tr><td>". Get_Text("pub_schichtplan_add_TextFor"). ":</td> <td>".
mysql_result($Erg, 0, "Man"). "</td></tr>\n";
echo "<tr><td valign='top'>". Get_Text("pub_schichtplan_add_Comment"). ":</td>\n <td>".
"<textarea name='newtext' cols='50' rows='10'></textarea> </td></tr>\n";
echo "<tr><td>&nbsp;</td>\n".
"<td><input type=\"submit\" value=\"". Get_Text("pub_schichtplan_add_submit"). "\"> </td></tr>\n".
"</table>\n".
"<input type=\"hidden\" name=\"SID\" value=\"". $_GET["SID"]. "\">\n".
"<input type=\"hidden\" name=\"TID\" value=\"". $_GET["TID"]. "\">\n".
"</form>";
}
else
{
echo "<h1>:-(</h1>";
array_push($error_messages, "Hack atteck\n");
}
} }