Skip to content

Commit d5dfed2

Browse files
uralm1uralm1
committed
Up to 72ff76b 13.03.22
1 parent 3b20a7c commit d5dfed2

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+1068
-107
lines changed

‎.htaccess

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
RewriteEngine On
22
RewriteRule (installer\.php|index\.php|install_form.js.php)$ - [L]
3-
RewriteRule !.+\.(png|jpg|gif|GIF|PNG|JPG|jpeg|JPEG|ICO|js|css|html|xml|htm|woff|eot|woff2|ttf)$ 403.html [L]
3+
RewriteRule !.+\.(png|jpg|gif|GIF|PNG|JPG|jpeg|JPEG|ICO|js|css|html|xml|htm|woff|eot|woff2|ttf|svg)$ 403.html [L]

‎Dataface/Application.php

+274-9
Large diffs are not rendered by default.

‎Dataface/AuthenticationTool.php

+59-10
Original file line numberDiff line numberDiff line change
@@ -241,6 +241,7 @@ function createLoginToken($username, $redirectUrl = null) {
241241
if (!$redirectUrl) {
242242
$redirectUrl = DATAFACE_SITE_HREF;
243243
}
244+
$allowEmailLoginAndAutoRegister = $this->getEmailColumn() and $this->usernameColumn and @$this->conf['allow_register'] and @$this->conf['auto_register'] and $this->isEmailLoginAllowed();
244245

245246
// We need to verify the username
246247
if ($this->usernameColumn) {
@@ -261,7 +262,10 @@ function createLoginToken($username, $redirectUrl = null) {
261262
list($num) = xf_db_fetch_row($res);
262263
xf_db_free_result($res);
263264
if (intval($num) !== 1) {
264-
return false;
265+
if (!$allowEmailLoginAndAutoRegister) {
266+
return false;
267+
}
268+
265269
}
266270
}
267271
}
@@ -306,16 +310,28 @@ function getCredentials(){
306310
$tokenTable = self::TOKEN_TABLE;
307311
if (self::table_exists($tokenTable)) {
308312
$res = xf_db_query("delete from `".$tokenTable."` where expires < NOW()", df_db());
309-
310-
$res = xf_db_query("select `username`, `autologin` from `".$tokenTable."` where `token` = '".addslashes($token)."'", df_db());
313+
if (!empty($this->conf['short_token_length']) and intval($this->conf['short_token_length']) === strlen($token)) {
314+
$tokLen = strlen($token);
315+
$res = xf_db_query("select `username`, `autologin`, `token` from `".$tokenTable."` where SUBSTRING(MD5(`token`), 1, $tokLen) = '".addslashes($token)."'",df_db());
316+
} else {
317+
$res = xf_db_query("select `username`, `autologin`, `token` from `".$tokenTable."` where `token` = '".addslashes($token)."'",df_db());
318+
}
319+
311320
if (!$res) {
312321
throw new Exception("SQL error checking token");
313322
}
314-
list($username, $autologin) = xf_db_fetch_row($res);
315-
if ($autologin and @$this->conf['autologin']) {
316-
$_REQUEST['--remember-me'] = 1;
323+
if (xf_db_num_rows($res) > 0) {
324+
325+
326+
list($username, $autologin, $token) = xf_db_fetch_row($res);
327+
if ($autologin and @$this->conf['autologin']) {
328+
$_REQUEST['--remember-me'] = 1;
329+
}
330+
317331
}
318332
xf_db_free_result($res);
333+
334+
319335
}
320336
}
321337
if ($username and self::is_email_address($username) and $this->usersTable and $this->getEmailColumn()) {
@@ -328,6 +344,10 @@ function getCredentials(){
328344
list($numUsernames) = xf_db_fetch_row($res);
329345
xf_db_free_result($res);
330346
if ($numUsernames == 0) {
347+
348+
349+
350+
331351
// No usernames found
332352
// Let's try to find an email address.
333353
$res = xf_db_query("select `".$this->usernameColumn."` from `".$this->usersTable."` where `".$this->getEmailColumn()."` = '".addslashes($username)."'", df_db());
@@ -339,6 +359,20 @@ function getCredentials(){
339359
} else if (xf_db_num_rows($res) == 1) {
340360
// One to one match
341361
list($username) = xf_db_fetch_row($res);
362+
} else {
363+
if ($this->getEmailColumn() and $this->usernameColumn and @$this->conf['allow_register'] and @$this->conf['auto_register'] and $this->isEmailLoginAllowed()) {
364+
$values = [];
365+
$values[$this->getEmailColumn()] = $username;
366+
$values[$this->usernameColumn] = $username;
367+
$record = new Dataface_Record($this->usersTable, array());
368+
$record->setValues($values);
369+
$res2 = $record->save();
370+
if ( PEAR::isError($res2) ){
371+
xf_db_free_result($res);
372+
throw new Exception("Failed to save user record: " . $res->getMessage());
373+
}
374+
375+
}
342376
}
343377
xf_db_free_result($res);
344378
}
@@ -463,14 +497,25 @@ function userHasPassword() {
463497
return false;
464498
}
465499

500+
501+
466502
/**
467503
* Creates a session token.
468504
*/
469-
function createToken() {
505+
function createToken($addToDatabase = false) {
470506
if (session_id() == '') {
471507
return null;
472508
}
473-
return md5('sessid').'.'.base64_encode(session_id());
509+
$tok = md5('sessid').'.'.base64_encode(session_id());
510+
if ($addToDatabase) {
511+
Dataface_Application::getInstance()->updateBearerTokensTables();
512+
$res = xf_db_query("replace into dataface__tokens (`token`, `hashed_token`) values ('".addslashes($tok)."', '".addslashes(sha1($tok))."')", df_db());
513+
if (!$res) {
514+
error_log("Failed ot add token to database: " . xf_db_error(df_db()));
515+
throw new Exception("Failed to add token to database");
516+
}
517+
}
518+
return $tok;
474519
}
475520

476521
function authenticate(){
@@ -547,7 +592,7 @@ function authenticate(){
547592
if ($json) {
548593
df_write_json(array(
549594
'code' => 200,
550-
'token' => $this->createToken(),
595+
'token' => $this->createToken(true),
551596
'message' => 'Logged in'
552597
));
553598
exit;
@@ -624,7 +669,7 @@ function authenticate(){
624669
if ($json) {
625670
df_write_json(array(
626671
'code' => 200,
627-
'token' => $this->createToken(),
672+
'token' => $this->createToken(true),
628673
'message' => 'Logged in'
629674
));
630675
exit;
@@ -719,6 +764,10 @@ function showLoginPrompt($msg=''){
719764
echo "<html><body>Please Log In</body></html>";
720765
exit;
721766
}
767+
if (@$query['-response'] == 'json') {
768+
df_write_json(['code' => 401, 'message' => 'Please log in']);
769+
exit;
770+
}
722771

723772
if ( isset($this->delegate) and method_exists($this->delegate, 'showLoginPrompt') ){
724773
return $this->delegate->showLoginPrompt($msg);

‎Dataface/FeedTool.php

+12
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,12 @@ function createFeedItem(&$record){
256256
$item->title = $data['title'];
257257
$item->link = $data['link'];
258258
$item->description = $data['description'];
259+
if (!empty($data['itunes'])) {
260+
$item->itunes = $data['itunes'];
261+
}
262+
if (!empty($data['guid'])) {
263+
$item->guid = $data['guid'];
264+
}
259265

260266
//optional
261267
//item->descriptionTruncSize = 500;
@@ -303,6 +309,12 @@ function createFeed($query=null){
303309
if (!empty($feed_data['itunes'])) {
304310
$rss->itunes = $feed_data['itunes'];
305311
}
312+
if (!empty($feed_data['copyright'])) {
313+
$rss->copyright = $feed_data['copyright'];
314+
}
315+
if (!empty($feed_data['language'])) {
316+
$rss->language = $feed_data['language'];
317+
}
306318
//optional
307319
//$rss->descriptionTruncSize = 500;
308320
//$rss->descriptionHtmlSyndicated = true;

‎Dataface/IO.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -911,7 +911,7 @@ function _update(&$record, $keys=null, $tablename=null, $secure=false ){
911911
// we don't need to perform any permissions on it
912912
continue;
913913
}
914-
if (@$field['ownerstamp']) {
914+
if (@$field['ownerstamp'] or @$field['uuid']) {
915915
continue;
916916
}
917917
// If this field's change doesn't have veto power and its value has changed,

‎Dataface/QueryBuilder.php

+9-3
Original file line numberDiff line numberDiff line change
@@ -417,7 +417,7 @@ function update(&$record, $key_vals=null, $tablename=null){
417417
// state of the record.
418418
continue;
419419
}
420-
if (@$fieldArr['ownerstamp']) {
420+
if (@$fieldArr['ownerstamp'] or @$fieldArr['uuid']) {
421421
continue;
422422
}
423423

@@ -515,6 +515,11 @@ function insert(&$record, $tablename=null){
515515
continue;
516516
}
517517
}
518+
if (@$field['uuid']) {
519+
$insertedKeys[] = '`'.$key.'`';
520+
$insertedValues[] = 'UUID()';
521+
continue;
522+
}
518523
if (@$field['ownerstamp']) {
519524
if (class_exists('Dataface_AuthenticationTool')) {
520525
$auth = Dataface_AuthenticationTool::getInstance();
@@ -528,9 +533,10 @@ function insert(&$record, $tablename=null){
528533
} else {
529534
$user = $auth->getLoggedInUser();
530535
if ($user) {
531-
$keynames = array_keys($keys);
536+
$keynames = array_keys($user->table()->keys());
532537
if (count($keynames) == 1) {
533-
$id = $user->val($keynames[0]);
538+
$keyname = array_shift($keynames);
539+
$id = $user->val($keyname);
534540
$insertedKeys[] = '`'.$key.'`';
535541
$insertedValues[] = $this->prepareValue($key, $id);
536542
$record->setValue($key, $id);

‎Dataface/QuickForm.php

+20
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,10 @@ class Dataface_QuickForm extends HTML_QuickForm {
157157

158158

159159
var $submitLabel = null;
160+
161+
private $addRelatedContext;
162+
private $parentRecord;
163+
private $relationship;
160164

161165
/**
162166
* @param $tablename The name of the table upon which this form is based. - or a Dataface_Record object to edit.
@@ -179,6 +183,22 @@ function __construct($tablename, $db='', $query='', $formname='', $new=false, $
179183
$app =& Dataface_Application::getInstance();
180184
$this->app =& $app;
181185
$appQuery =& $app->getQuery();
186+
187+
if ($new) {
188+
// This request may have been redirected from new_related_record if this table is being used
189+
// as a proxy for adding to a relationship. In this case it would pass the -add-related-context
190+
// parameter with a JSON value of the form ['id' => RECORDID, ' => 'relationship' => RELATIONSHIPNAME]
191+
$this->addRelatedContext = empty($query['-add-related-context']) ?
192+
null :
193+
json_decode($query['-add-related-context'], true);
194+
$this->parentRecord = ($this->addRelatedContext and !empty($this->addRelatedContext['id'])) ?
195+
df_get_record_by_id($this->addRelatedContext['id']) :
196+
null;
197+
$this->relationship = ($this->addRelatedContext and $this->parentRecord and !empty($this->addRelatedContext['relationship'])) ?
198+
$this->parentRecord->_table->getRelationship($this->addRelatedContext['relationship']) :
199+
null;
200+
}
201+
182202
if ( !isset($lang) && !isset($this->_lang) ){
183203
$this->_lang = $app->_conf['lang'];
184204
} else if ( isset($lang) ){

‎Dataface/Record.php

+26-2
Original file line numberDiff line numberDiff line change
@@ -429,7 +429,9 @@ function callDelegateFunction($function, $fallback=null, $param=null){
429429
}
430430

431431

432-
432+
function tablename() {
433+
return $this->_table->tablename;
434+
}
433435

434436

435437
/**
@@ -2597,11 +2599,15 @@ function display($fieldname, $index=0, $where=0, $sort=0, $urlencode=true, $thum
25972599
}
25982600

25992601
$field =& $this->_table->getField($fieldname);
2602+
if (PEAR::isError($field)) {
2603+
throw new Exception("Attempt to get non-existent field $fieldname in table ".$this->_table->tablename.": ".$field->getMessage());
2604+
}
26002605
if (@$field['displayField']) {
26012606
return $this->display($field['displayField'], $index, $where, $sort, $urlencode);
26022607
}
26032608
if ( $this->_table->isBlob($fieldname) or ($this->_table->isContainer($fieldname) and (@$field['secure'] or @$field['transform']))){
2604-
if ($this->getLength($fieldname) > 0) {
2609+
$thumb = null;
2610+
if ($this->getLength($fieldname) > 0) {
26052611
unset($table);
26062612
$table =& Dataface_Table::loadTable($field['tablename']);
26072613
$keys = array_keys($table->keys());
@@ -2623,6 +2629,15 @@ function display($fieldname, $index=0, $where=0, $sort=0, $urlencode=true, $thum
26232629
} else {
26242630
$out = '';
26252631
}
2632+
2633+
$evt = new stdClass;
2634+
$evt->record = $this;
2635+
$evt->field =& $field;
2636+
$evt->value = $out;
2637+
$evt->thumb = $thumb;
2638+
$table->app->fireEvent('Record::display', $evt);
2639+
$out = $evt->value;
2640+
26262641
if (!$thumbnail) {
26272642
$this->cache[__FUNCTION__][$fieldname][$index][$where][$sort] = $out;
26282643
}
@@ -2644,6 +2659,15 @@ function display($fieldname, $index=0, $where=0, $sort=0, $urlencode=true, $thum
26442659
if ( strlen($out) > 1 and $out[0] == '/' and $out[1] == '/' ){
26452660
$out = substr($out,1);
26462661
}
2662+
2663+
$evt = new stdClass;
2664+
$evt->record = $this;
2665+
$evt->field =& $field;
2666+
$evt->value = $out;
2667+
$evt->thumbnail = $thumbnail;
2668+
$table->app->fireEvent('Record::display', $evt);
2669+
$out = $evt->value;
2670+
26472671
$this->cache[__FUNCTION__][$fieldname][$index][$where][$sort] = $out;
26482672
if (!$out and @$field['display.fallback']) {
26492673
$out = $field['display.fallback'];

‎Dataface/RelatedList.php

+1
Original file line numberDiff line numberDiff line change
@@ -776,6 +776,7 @@ function toHtml($mode = 'all') {
776776
ob_start();
777777
$context['filters'] = $this->filters;
778778
$context['listStyle'] = $this->listStyle;
779+
$context['targetDevice'] = $mode;
779780
df_display($context, 'xataface/RelatedList/list.html');
780781
$out = ob_get_contents();
781782
ob_end_clean();

‎Dataface/Relationship.php

+21-2
Original file line numberDiff line numberDiff line change
@@ -120,8 +120,23 @@ function __construct($tablename, $relationshipName, &$values){
120120
$this->_permissions =& $this->_schema['permissions'];
121121

122122
}
123-
function Dataface_Relationship($tablename, $relationshipName, &$values) { self::__construct($tablename, $relationshipName, $values); }
124-
123+
function Dataface_Relationship($tablename, $relationshipName, &$values) { self::__construct($tablename, $relationshipName, $values); }
124+
125+
/**
126+
* Returns the name of a table that is used as a proxy for inserting new records into this
127+
* relationship.
128+
*/
129+
function getAddRelatedRecordTable() {
130+
if (!empty($this->_schema['add']['table'])) {
131+
return $this->_schema['add']['table'];
132+
}
133+
$defaultTableName = 'xf_add_'.$this->_sourceTable->tablename . '__' . $this->_name;
134+
if (Dataface_Table::tableExists($defaultTableName)) {
135+
return $defaultTableName;
136+
}
137+
return null;
138+
}
139+
125140

126141
function &getFieldDefOverride($field_name, $default=array()){
127142
if ( strpos($field_name,'.') !== false ){
@@ -141,6 +156,10 @@ function setFieldDefOverride($field_name, array $field_def){
141156
}
142157
$this->_field_def_overrides[$field_name] = $field_def;
143158
}
159+
160+
function isLinkToDomainRecord() {
161+
return !empty($this->_schema['list']['link_to_domain_record']) and $this->_schema['list']['link_to_domain_record'];
162+
}
144163

145164
/**
146165
* Returns an array of names of fields in this relationship.

0 commit comments

Comments
 (0)