Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix #555, limit to uploadable categories on file upload form #556

Merged
merged 2 commits into from
Nov 16, 2022
Merged

Fix #555, limit to uploadable categories on file upload form #556

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
73bcaac
Fix #555, limit to uploadable categories on file upload form
leegarner Aug 22, 2022
b085b23
Use querybuilder for clearer SQL
leegarner Aug 26, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
112 changes: 76 additions & 36 deletions private/plugins/filemgmt/classes/Category.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,9 @@
*/
class Category
{
const ACCESS_READ = 1;
const ACCESS_WRITE = 2;

/** Category ID.
* @var integer */
private $cid = 0;
Expand Down Expand Up @@ -60,7 +63,6 @@ public function __construct($id=0)
global $_USER, $_VARS;

$this->isNew = true;

if (is_array($id)) {
$this->setVars($id, true);
} elseif ($id > 0) {
Expand Down Expand Up @@ -102,27 +104,34 @@ public function setVars($row, $fromDB=false)
* @param integer $id Optional ID. Current ID is used if zero.
* @return boolean True if a record was read, False on failure
*/
public function Read($id = 0)
public function Read(int $id = 0) : bool
{
global $_TABLES;

$id = (int)$id;
if ($id == 0) $id = $this->cid;
if ($id == 0) {
$this->error = 'Invalid ID in Read()';
return;
return false;
}

$sql = "SELECT * FROM {$_TABLES['filemgmt_cat']}
WHERE cid = '$id'";
$result = DB_query($sql);
if (!$result || DB_numRows($result) != 1) {
return false;
} else {
$row = DB_fetchArray($result, false);
try {
$row = Database::getInstance()->conn->executeQuery(
"SELECT * FROM {$_TABLES['filemgmt_cat']}
WHERE cid = ?",
array($id),
array(Database::INTEGER)
)->fetchAssociative();
} catch (\Throwable $e) {
Log::write('system', Log::ERROR, __METHOD__ . ': ' . $e->getMessage());
$row = false;
}
if (is_array($row)) {
$this->setVars($row, true);
$this->isNew = false;
return true;
} else {
return false;
}
}

Expand All @@ -134,7 +143,7 @@ public function Read($id = 0)
* @param integer $cid Category ID
* @return object Category object
*/
public static function getInstance($cid)
public static function getInstance(int $cid)
{
static $cats = array();
if (!isset($cats[$cid])) {
Expand Down Expand Up @@ -710,24 +719,45 @@ public static function getAll()
}


public static function getChildren($pid=0, $checkAccess=true)
/**
* Get all the child categories from a given root.
*
* @param integer $pid Root category ID
* @param integer $checkAccess 1 to check view, 2 to check write
* @return array Array of categories
*/
public static function getChildren(int $pid=0, int $checkAccess=1) : array
{
global $_TABLES, $_GROUPS;

$retval = array();
$pid = (int)$pid;
$sql = "SELECT * FROM {$_TABLES['filemgmt_cat']} WHERE pid = $pid ";
$qb = Database::getInstance()->conn->createQueryBuilder();
$qb->select('*')
->from($_TABLES['filemgmt_cat'])
->where('pid = :pid')
->setParameter('pid', $pid, Database::INTEGER)
->orderBy('cid', 'ASC');
$values = array($pid);
$types = array(Database::INTEGER);
if ($checkAccess) {
if (count($_GROUPS) == 1) {
$sql .= " AND grp_access = '" . current($_GROUPS) ."' ";
$values[] = array_values($_GROUPS);
if ($checkAccess == self::ACCESS_WRITE) {
$qb->andWhere('grp_writeaccess IN (:groups)');
} else {
$sql .= " AND grp_access IN (" . implode(',',array_values($_GROUPS)) .") ";
$qb->andWhere('grp_access IN (:groups)');
}
$qb->setParameter('groups', array_values($_GROUPS), Database::PARAM_INT_ARRAY);
}
try {
$stmt = $qb->execute();
} catch (\Throwable $e) {
Log::write('system', Log::ERROR, __METHOD__ . ': ' . $e->getMessage());
$stmt = false;
}
$sql .= "ORDER BY cid";
$result = DB_query($sql);
while ($A = DB_fetchArray($result, false)) {
$retval[$A['cid']] = new self($A);
if ($stmt) {
while ($A = $stmt->fetchAssociative()) {
$retval[$A['cid']] = new self($A);
}
}
return $retval;
}
Expand Down Expand Up @@ -785,29 +815,39 @@ public function getDscp()
* @param integer $current_cat Current category ID, to set "selected"
* @return string HTML for selection options
*/
public static function getChildOptions($pid, $indent, $current_cat)
public static function getChildOptions(int $pid, string $indent, int $current_cat) : string
{
global $_TABLES;

$pid = (int)$pid;
$retval = '';
$spaces = ($indent+1) * 2;

$sql = "SELECT * FROM {$_TABLES['filemgmt_cat']}
WHERE pid = $pid
ORDER BY title ASC";
$result = DB_query($sql);
while (($C = DB_fetchArray($result)) != NULL) {
$retval .= '<option value="'.$C['cid'].'"';
if ( $C['cid'] == $current_cat ) {
$retval .= ' selected="selected"';
}
$retval .= '>';
for ($x=0;$x<=$spaces;$x++) {
$retval .= '&nbsp;';
try {
$stmt = Database::getInstance()->conn->executeQuery(
"SELECT * FROM {$_TABLES['filemgmt_cat']}
WHERE pid = ?
ORDER BY title ASC",
array($pid),
array(Database::INTEGER)
);
} catch (\Throwable $e) {
Log::write('system', Log::ERROR, __METHOD__ . ': ' . $e->getMessage());
$stmt = false;
}
if ($stmt) {
while ($C = $stmt->fetchAssociative()) {
$retval .= '<option value="'.$C['cid'].'"';
if ( $C['cid'] == $current_cat ) {
$retval .= ' selected="selected"';
}
$retval .= '>';
for ($x=0;$x<=$spaces;$x++) {
$retval .= '&nbsp;';
}
$retval .= $C['title'].'</option>';
$retval .= self::getChildOptions($C['cid'], $indent+1, $current_cat);
}
$retval .= $C['title'].'</option>';
$retval .= self::getChildOptions($C['cid'], $indent+1, $current_cat);
}
return $retval;
}
Expand Down
2 changes: 1 addition & 1 deletion private/plugins/filemgmt/classes/Download.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1018,7 +1018,7 @@ public function edit($post=array())
$pathstring .= "<a href=\"{$_FM_CONF['url']}/index.php?id={$this->lid}\">{$hdr_title}</a>";

$categorySelectHTML = '';
$rootCats = Category::getChildren(0, true);
$rootCats = Category::getChildren(0, 2);
foreach ($rootCats as $cid=>$Cat) {
$categorySelectHTML .= '<option value="'.$cid.'"';
if ($cid == $this->cid) {
Expand Down
2 changes: 1 addition & 1 deletion public_html/admin/plugins/filemgmt/index.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,7 @@
COM_refresh("{$_FM_CONF['admin_url']}/index.php?categoryConfigAdmin");
break;
case 'modCat':
$content .= Filemgmt\Category::getInstance($opval)->edit();
$content .= Filemgmt\Category::getInstance((int)$opval)->edit();
break;
case 'saveCat':
case "modCatS":
Expand Down