]> git.wh0rd.org - tt-rss.git/blobdiff - backend.php
user editor improved, some form parameter validation reimplemented for prototyped...
[tt-rss.git] / backend.php
index 8c4dbcfe35857126bd51fa5cc7e9a1c1099cbc91..745a1a13269a4f640a3c492427ef4494992e5c75 100644 (file)
                1440 => "Daily",
                10080 => "Weekly");
 
+       $access_level_names = array(
+               0 => "User", 
+               10 => "Administrator");
+
        $script_started = getmicrotime();
 
        $link = db_connect(DB_HOST, DB_USER, DB_PASS, DB_NAME); 
                                print "<tr><td>Category:</td>";
                                print "<td>";
 
-                               print_feed_cat_select($link, "cat_id", $cat_id);
+                               print_feed_cat_select($link, "cat_id", $cat_id, "class=\"iedit\"");
 
                                print "</td>";
                                print "</td></tr>";
 
                        print "<td>";
 
-                       print "<select name=\"update_interval\">";
-                       
-                       foreach (array_keys($update_intervals) as $i) {
-                       
-                               if ($i == $update_interval) {
-                                       $selected = "selected";
-                               } else {
-                                       $selected = "";
-                               }                                       
-                               print "<option $selected value=\"$i\">" . $update_intervals[$i] . "</option>";
-                       }
-                               
-                       print "</select>";
+                       print_select_hash("update_interval", $update_interval, $update_intervals,
+                               "class=\"iedit\"");
 
                        print "</td>";
 
                                $disabled = "disabled";
                        }
 
-                       print "<select $disabled name=\"parent_feed\">";
+                       print "<select class=\"iedit\" $disabled name=\"parent_feed\">";
                        
                        print "<option value=\"0\">Not linked</option>";
 
 
                        print "<td>";
 
-                       print "<select name=\"purge_interval\">";
+                       print_select_hash("purge_interval", $purge_interval, $purge_intervals, 
+                               "class=\"iedit\"");
                        
-                       foreach (array_keys($purge_intervals) as $i) {
-                       
-                               if ($i == $purge_interval) {
-                                       $selected = "selected";
-                               } else {
-                                       $selected = "";
-                               }                                       
-                               print "<option $selected value=\"$i\">" . $purge_intervals[$i] . "</option>";
-                       }
-                               
-                       print "</select>";
-
                        print "</td>";
 
                        $auth_login = db_fetch_result($result, 0, "auth_login");
 
                        print "<div align='center'>
                                <input type=\"submit\" class=\"button\" 
-                               onclick=\"feedEditSave()\" value=\"Save\">
+                               onclick=\"return feedEditSave()\" value=\"Save\">
                                <input type='submit' class='button'                     
-                               onclick=\"feedEditCancel()\" value=\"Cancel\"></div>";
+                               onclick=\"return feedEditCancel()\" value=\"Cancel\"></div>";
                        return;
                }
 
 
                        if (db_num_rows($result) != 0) {
        
+                               print "<form id=\"feed_cat_edit_form\">";
+                               
                                print "<p><table width=\"100%\" class=\"prefFeedCatList\" 
                                        cellspacing=\"0\" id=\"prefFeedCatList\">";
 
                                        $edit_cat_id = $_GET["id"];
                
                                        if ($subop == "editCat" && $cat_id != $edit_cat_id) {
-                                               $class .= "Grayed";
-                                               $this_row_id = "";
+                                                       $class .= "Grayed";
+                                                       $this_row_id = "";
                                        } else {
                                                $this_row_id = "id=\"FCATR-$cat_id\"";
                                        }
                
                                        } else if ($cat_id != $edit_cat_id) {
                
-                                               print "<td><input disabled=\"true\" type=\"checkbox\" 
+                                               print "<td align='center'><input disabled=\"true\" type=\"checkbox\" 
                                                        id=\"FRCHK-".$line["id"]."\"></td>";
                
                                                print "<td>$edit_title</td>";           
                
                                        } else {
                
-                                               print "<td><input disabled=\"true\" type=\"checkbox\" checked></td>";
+                                               print "<td align='center'><input disabled=\"true\" type=\"checkbox\" checked>";
+                                               
+                                               print "<input type=\"hidden\" name=\"id\" value=\"$cat_id\">";
+                                               print "<input type=\"hidden\" name=\"op\" value=\"pref-feeds\">";
+                                               print "<input type=\"hidden\" name=\"subop\" value=\"saveCat\">";
+                                       
+                                               print "</td>";
                
-                                               print "<td><input id=\"iedit_title\" value=\"$edit_title\"></td>";
+                                               print "<td><input name=\"title\" class=\"iedit\" value=\"$edit_title\"></td>";
                                                
                                        }
                                        
                                }
        
                                print "</table>";
+
+                               print "</form>";
        
                                print "<p id=\"catOpToolbar\">";
        
                                if ($subop == "editCat") {
                                        print "Edit category:&nbsp;
                                                <input type=\"submit\" class=\"button\"
-                                                       onclick=\"javascript:feedCatEditCancel()\" value=\"Cancel\">
+                                                       onclick=\"javascript:feedCatEditSave()\" value=\"Save\">
                                                <input type=\"submit\" class=\"button\"
-                                                       onclick=\"javascript:feedCatEditSave()\" value=\"Save\">";
+                                                       onclick=\"javascript:feedCatEditCancel()\" value=\"Cancel\">";
                                        } else {
                
                                        print "
 
                if ($subop == "editSave") {
 
-                       $regexp = db_escape_string(trim($_GET["r"]));
-                       $match = db_escape_string(trim($_GET["m"]));
+                       $reg_exp = db_escape_string(trim($_GET["reg_exp"]));
+                       $filter_type = db_escape_string(trim($_GET["filter_type"]));
                        $filter_id = db_escape_string($_GET["id"]);
-                       $feed_id = db_escape_string($_GET["fid"]);
-                       $action_id = db_escape_string($_GET["aid"]); 
+                       $feed_id = db_escape_string($_GET["feed_id"]);
+                       $action_id = db_escape_string($_GET["action_id"]); 
 
                        if (!$feed_id) {
                                $feed_id = 'NULL';
                        }
                        
                        $result = db_query($link, "UPDATE ttrss_filters SET 
-                               reg_exp = '$regexp', 
-                               feed_id = $feed_id,
-                               action_id = '$action_id',
-                               filter_type = (SELECT id FROM ttrss_filter_types WHERE
-                                       description = '$match')
+                                       reg_exp = '$reg_exp', 
+                                       feed_id = $feed_id,
+                                       action_id = '$action_id',
+                                       filter_type = '$filter_type'
                                WHERE id = '$filter_id'");
                }
 
                
                        if (!WEB_DEMO_MODE) {
 
-                               $regexp = db_escape_string(trim($_GET["regexp"]));
-                               $match = db_escape_string(trim($_GET["match"]));
-                               $feed_id = db_escape_string($_GET["fid"]);
-                               $action_id = db_escape_string($_GET["aid"]); 
+                               $regexp = db_escape_string(trim($_GET["reg_exp"]));
+                               $match_id = db_escape_string(trim($_GET["match_id"]));
+                               $feed_id = db_escape_string($_GET["feed_id"]);
+                               $action_id = db_escape_string($_GET["action_id"]); 
 
                                if (!$feed_id) {
                                        $feed_id = 'NULL';
                                        "INSERT INTO ttrss_filters (reg_exp,filter_type,owner_uid,feed_id,
                                                action_id) 
                                        VALUES 
-                                               ('$regexp', (SELECT id FROM ttrss_filter_types WHERE
-                                                       description = '$match'),'".$_SESSION["uid"]."', 
+                                               ('$regexp', '$match_id','".$_SESSION["uid"]."', 
                                                        $feed_id, '$action_id')");
                        } 
                }
                print "<div id=\"infoBoxShadow\">
                        <div id=\"infoBox\">PLACEHOLDER</div></div>";
 
-               $result = db_query($link, "SELECT description 
+               $result = db_query($link, "SELECT id,description 
                        FROM ttrss_filter_types ORDER BY description");
 
                $filter_types = array();
 
                while ($line = db_fetch_assoc($result)) {
-                       array_push($filter_types, $line["description"]);
+                       //array_push($filter_types, $line["description"]);
+                       $filter_types[$line["id"]] = $line["description"];
                }
 
                print "<input type=\"submit\" 
 
                if (db_num_rows($result) != 0) {
 
+                       print "<form id=\"filter_edit_form\">";                 
+
                        print "<p><table width=\"100%\" cellspacing=\"0\" class=\"prefFilterList\" 
                                id=\"prefFilterList\">";
 
                                if (!$line["feed_title"]) $line["feed_title"] = "All feeds";
        
                                if (!$edit_filter_id || $subop != "edit") {
-       
+
                                        print "<td align='center'><input onclick='toggleSelectPrefRow(this, \"filter\");' 
                                        type=\"checkbox\" id=\"FICHK-".$line["id"]."\"></td>";
        
 
                                } else {
        
-                                       print "<td align='center'><input disabled=\"true\" type=\"checkbox\" checked></td>";
+                                       print "<td align='center'><input disabled=\"true\" type=\"checkbox\" checked>";
+                                       
+                                       print "<input type=\"hidden\" name=\"id\" value=\"$filter_id\">";
+                                       print "<input type=\"hidden\" name=\"op\" value=\"pref-filters\">";
+                                       print "<input type=\"hidden\" name=\"subop\" value=\"editSave\">";
+
+                                       print "</td>";
        
-                                       print "<td><input id=\"iedit_regexp\" value=\"".$line["reg_exp"].
+                                       print "<td><input class=\"iedit\" name=\"reg_exp\" value=\"".$line["reg_exp"].
                                                "\"></td>";
        
                                        print "<td>";   
-                                       print_feed_select($link, "iedit_feed", $line["feed_id"]);                                       
+                                       print_feed_select($link, "feed_id", $line["feed_id"], "class=\"iedit\"");
                                        print "</td>";
                                        
                                        print "<td>";
-                                       print_select("iedit_match", $line["filter_type_descr"], $filter_types);
+                                       print_select_hash("filter_type", $line["filter_type"], $filter_types,   
+                                               "class=\"iedit\"");
                                        print "</td>";
 
                                        print "<td>";
-                                       print "<select id=\"iedit_filter_action\">";
+                                       print "<select name=\"action_id\" class=\"iedit\">";
        
                                        $tmp_result = db_query($link, "SELECT id,description FROM ttrss_filter_actions
                                                ORDER BY description");
                                                } else {
                                                        $is_selected = "";
                                                }
-                                               printf("<option $is_selected id='%d'>%s</option>", 
+                                               printf("<option $is_selected value='%d'>%s</option>", 
                                                        $tmp_line["id"], $tmp_line["description"]);
                                        }
        
                        }
        
                        print "</table>";
+
+                       print "</form>";
        
                        print "<p id=\"filterOpToolbar\">";
        
                                        onclick=\"javascript:editSelectedFilter()\" value=\"Edit\">
                                <input type=\"submit\" class=\"button\" disabled=\"true\"
                                        onclick=\"javascript:removeSelectedFilters()\" value=\"Remove\">";
-                       }
+                       }                       
 
                } else {
 
 
                if ($subop == "editSave") {
 
-                       $sql_exp = trim($_GET["s"]);
-                       $descr = trim($_GET["d"]);
+                       $sql_exp = trim($_GET["sql_exp"]);
+                       $descr = db_escape_string(trim($_GET["description"]));
                        $label_id = db_escape_string($_GET["id"]);
                        
-//                     print "$sql_exp : $descr : $label_id";
-                       
                        $result = db_query($link, "UPDATE ttrss_labels SET 
                                sql_exp = '$sql_exp', 
                                description = '$descr'
 
                if (db_num_rows($result) != 0) {
 
+                       print "<form id=\"label_edit_form\">";
+
                        print "<p><table width=\"100%\" cellspacing=\"0\" 
                                class=\"prefLabelList\" id=\"prefLabelList\">";
 
        
                                } else {
        
-                                       print "<td align='center'><input disabled=\"true\" type=\"checkbox\" checked></td>";
+                                       print "<td align='center'><input disabled=\"true\" type=\"checkbox\" checked>";
+
+                                       print "<input type=\"hidden\" name=\"id\" value=\"$label_id\">";
+                                       print "<input type=\"hidden\" name=\"op\" value=\"pref-labels\">";
+                                       print "<input type=\"hidden\" name=\"subop\" value=\"editSave\">";
+                                       
+                                       print "</td>";
        
-                                       print "<td><input id=\"iedit_expr\" value=\"".$line["sql_exp"].
+                                       print "<td><input class=\"iedit\" name=\"sql_exp\" value=\"".$line["sql_exp"].
                                                "\"></td>";
        
-                                       print "<td><input id=\"iedit_descr\" value=\"".$line["description"].
+                                       print "<td><input class=\"iedit\" name=\"description\" value=\"".$line["description"].
                                                "\"></td>";                                                     
                                }
                                        
                        }
        
                        print "</table>";
+
+                       print "</form>";
        
                        print "<p id=\"labelOpToolbar\">";
        
                                        id=\"fadd_submit_btn\" disabled=\"true\"
                                        type=\"submit\" onclick=\"javascript:qafAdd()\" value=\"Subscribe\">
                                <input class=\"button\"
-                                       type=\"submit\" onclick=\"javascript:closeInfoBox()\" 
+                                       type=\"submit\" onclick=\"javascript:feedEditCancel()\" 
                                        value=\"Cancel\"></td></tr></table>";
-               }
-
-               if ($id == "quickDelFeed") {
-
-                       $param = db_escape_string($param);
-
-                       $result = db_query($link, "SELECT title FROM ttrss_feeds WHERE id = '$param'");
 
-                       if ($result) {
-
-                               $f_title = db_fetch_result($result, 0, "title");
-               
-                               print "Remove current feed (<b>$f_title</b>)?&nbsp;
-                               <input class=\"button\"
-                                       type=\"submit\" onclick=\"javascript:qfdDelete($param)\" value=\"Remove\">
-                               <input class=\"button\"
-                                       type=\"submit\" onclick=\"javascript:closeInfoBox()\" 
-                                       value=\"Cancel\">";
-                       } else {
-                               print "Error: Feed $param not found.&nbsp;
-                               <input class=\"button\"
-                                       type=\"submit\" onclick=\"javascript:closeInfoBox()\" 
-                                       value=\"Cancel\">";             
-                       }
                }
 
                if ($id == "search") {
                        print "<div id=\"infoBoxTitle\">Create filter</div>";
                        print "<div class=\"infoBoxContents\">";
 
+                       print "<form id=\"filter_add_form\">";
+
+                       print "<input type=\"hidden\" name=\"op\" value=\"pref-filters\">";
+                       print "<input type=\"hidden\" name=\"quiet\" value=\"1\">";
+                       print "<input type=\"hidden\" name=\"subop\" value=\"add\">"; 
+
 //                     print "<div class=\"notice\"><b>Note:</b> filter will only apply to new articles.</div>";
                        
-                       $result = db_query($link, "SELECT description 
+                       $result = db_query($link, "SELECT id,description 
                                FROM ttrss_filter_types ORDER BY description");
        
                        $filter_types = array();
        
                        while ($line = db_fetch_assoc($result)) {
-                               array_push($filter_types, $line["description"]);
+                               //array_push($filter_types, $line["description"]);
+                               $filter_types[$line["id"]] = $line["description"];
                        }
 
                        print "<table width='100%'>";
 
                        print "<tr><td>Match:</td>
                                <td><input onkeyup=\"toggleSubmitNotEmpty(this, 'infobox_submit')\"
-                               id=\"fadd_regexp\" size=\"30\">&nbsp;";
+                                       name=\"reg_exp\" size=\"30\">&nbsp;";
                        
-                       print_select("fadd_match", "Title", $filter_types);     
+                       print_select_hash("match_id", 1, $filter_types);        
        
                        print "</td></tr>";
                        print "<tr><td>Feed:</td><td>";
 
-                       print_feed_select($link, "fadd_feed");
+                       print_feed_select($link, "feed_id");
                        
                        print "</td></tr>";
        
                        print "<tr><td>Action:</td>";
        
-                       print "<td><select id=\"fadd_action\">";
+                       print "<td><select name=\"action_id\">";
        
                        $result = db_query($link, "SELECT id,description FROM ttrss_filter_actions 
                                ORDER BY name");
 
                        while ($line = db_fetch_assoc($result)) {
-                               printf("<option id='%d'>%s</option>", $line["id"], $line["description"]);
+                               printf("<option value='%d'>%s</option>", $line["id"], $line["description"]);
                        }
        
                        print "</select>";
-       
-                       print "</td></tr><tr><td colspan=\"2\" align=\"right\">";
-       
+
+                       print "</td></tr></table>";
+
+                       print "</form>";
+
+                       print "<div align='right'>";
+
                        print "<input type=\"submit\" 
                                id=\"infobox_submit\"
-                               class=\"button\" onclick=\"javascript:qaddFilter()\" 
+                               class=\"button\" onclick=\"qaddFilter()\" 
                                disabled=\"true\" value=\"Create\"> ";
 
                        print "<input class=\"button\"
-                               type=\"submit\" onclick=\"javascript:closeInfoBox()\" 
+                               type=\"submit\" onclick=\"closeInfoBox()\" 
                                value=\"Cancel\">";
 
-                       print "</td></tr></table>";
+                       print "</div>";
+
+//                     print "</td></tr></table>"; 
 
                }
 
 
                $subop = $_GET["subop"];
 
+               if ($subop == "edit") {
+
+                       $id = db_escape_string($_GET["id"]);
+
+                       print "<div id=\"infoBoxTitle\">User editor</div>";
+                       
+                       print "<div class=\"infoBoxContents\">";
+
+                       print "<form id=\"user_edit_form\">";
+
+                       print "<input type=\"hidden\" name=\"id\" value=\"$id\">";
+                       print "<input type=\"hidden\" name=\"op\" value=\"pref-users\">";
+                       print "<input type=\"hidden\" name=\"subop\" value=\"editSave\">";
+
+                       $result = db_query($link, "SELECT * FROM ttrss_users WHERE id = '$id'");
+
+                       $login = db_fetch_result($result, 0, "login");
+                       $access_level = db_fetch_result($result, 0, "access_level");
+                       $email = db_fetch_result($result, 0, "email");
+
+                       print "<table width='100%'>";
+                       print "<tr><td>Login:</td><td>
+                               <input class=\"iedit\" name=\"login\" value=\"$login\"></td></tr>";
+
+                       print "<tr><td>Change password:</td><td>
+                               <input class=\"iedit\" name=\"password\"></td></tr>";
+
+                       print "<tr><td>E-mail:</td><td>
+                               <input class=\"iedit\" name=\"email\" value=\"$email\"></td></tr>";
+
+                       $sel_disabled = ($id == $_SESSION["uid"]) ? "disabled" : "";
+                               
+                       print "<tr><td>Access level:</td><td>";
+                       print_select_hash("access_level", $access_level, $access_level_names, 
+                               $sel_disabled);
+                       print "</td></tr>";
+
+                       print "</table>";
+
+                       print "</form>";
+                       
+                       print "<div align='right'>
+                               <input class=\"button\"
+                                       type=\"submit\" onclick=\"javascript:userEditSave()\" value=\"Save\">
+                               <input class=\"button\"
+                                       type=\"submit\" onclick=\"javascript:userEditCancel()\" 
+                                       value=\"Cancel\"></div>";
+
+                       print "</div>";
+
+                       return;
+               }
+
                if ($subop == "editSave") {
        
-                       if (!WEB_DEMO_MODE) {
+                       if (!WEB_DEMO_MODE && $_SESSION["access_level"] >= 10) {
 
-                               $login = db_escape_string($_GET["l"]);
+                               $login = db_escape_string(trim($_GET["login"]));
                                $uid = db_escape_string($_GET["id"]);
-                               $access_level = sprintf("%d", $_GET["al"]);
-                               $email = db_escape_string($_GET["e"]);
+                               $access_level = sprintf("%d", $_GET["access_level"]);
+                               $email = db_escape_string(trim($_GET["email"]));
+                               $password = db_escape_string(trim($_GET["password"]));
+
+                               if ($password) {
+                                       $pwd_hash = 'SHA1:' . sha1($password);
+                                       $pass_query_part = "pwd_hash = '$pwd_hash', ";                                  
+                                       print "<div class='notice'>Changed password for user <b>$login</b>.</div>";
+                               } else {
+                                       $pass_query_part = "";
+                               }
 
-                               db_query($link, "UPDATE ttrss_users SET login = '$login', 
+                               db_query($link, "UPDATE ttrss_users SET $pass_query_part login = '$login', 
                                        access_level = '$access_level', email = '$email' WHERE id = '$uid'");
 
                        }
 
                print "<tr class=\"title\">
                                        <td align='center' width=\"5%\">&nbsp;</td>
-                                       <td width='20%'>Login</td>
-                                       <td width='20%'>E-mail</td>
-                                       <td width='20%'>Access Level</td>
-                                       <td width='20%'>Last login</td></tr>";
+                                       <td width='40%'>Login</td>
+                                       <td width='40%'>Access Level</td>
+                                       <td width='30%'>Last login</td></tr>";
                
                $lnum = 0;
                
 
                        $access_level_names = array(0 => "User", 10 => "Administrator");
 
-                       if (!$edit_uid || $subop != "edit") {
+//                     if (!$edit_uid || $subop != "edit") {
 
                                print "<td align='center'><input onclick='toggleSelectPrefRow(this, \"user\");' 
                                type=\"checkbox\" id=\"UMCHK-$uid\"></td>";
 
                                if (!$line["email"]) $line["email"] = "&nbsp;";
 
-                               print "<td><a href=\"javascript:editUser($uid);\">" . 
-                                       $line["email"] . "</td>";                       
-
                                print "<td><a href=\"javascript:editUser($uid);\">" . 
                                        $access_level_names[$line["access_level"]] . "</td>";                   
 
-                       } else if ($uid != $edit_uid) {
+/*                     } else if ($uid != $edit_uid) {
 
                                if (!$line["email"]) $line["email"] = "&nbsp;";
 
                                print "</select>";
                                print "</td>";
 
-                       }
+                       } */
                                
                        print "<td>".$line["last_login"]."</td>";               
                
 
                print "<p id='userOpToolbar'>";
 
-               if ($subop == "edit") {
+/*             if ($subop == "edit") {
                        print "Edit user:
                                <input type=\"submit\" class=\"button\" 
                                        onclick=\"javascript:userEditSave()\" value=\"Save\">
                                <input type=\"submit\" class=\"button\" 
                                        onclick=\"javascript:userEditCancel()\" value=\"Cancel\">";
                                        
-               } else {
+               } else { */
 
                        print "
                                Selection:
                        <input type=\"submit\" class=\"button\" disabled=\"true\"
                                onclick=\"javascript:resetSelectedUserPass()\" value=\"Reset password\">";
 
-               }
+//             }
        }
 
        if ($op == "user-details") {