mirror/zoneminder
1
0 Fork 0
mirror of https://github.com/ZoneMinder/zoneminder.git synced 2026-10-27 16:58:31 -04:00
Code Issues Packages Projects Releases Wiki Activity

Add testing for limit, sortField and all the filters to ensure that they are valid.

Browse Source
This commit is contained in:
Isaac Connor committed 2016-12-08 13:31:44 -05:00
1 parent 75b8c35059
commit 587fd16aa6
1 file changed
+66 -38
Download Patch File Download Diff File Expand all files Collapse all files
web/ajax/log.php
+66 -38
View File
@@ -1,5 +1,9 @@
<?php
# Moved up here because it is used in several spots.
# These are the valid columns that you can filter on.
$filterFields = array( 'Component', 'ServerId', 'Pid', 'Level', 'File', 'Line' );
switch ( $_REQUEST['task'] )
{
case 'create' :
@@ -31,68 +35,85 @@ switch ( $_REQUEST['task'] )
if ( !canView( 'System' ) )
ajaxError( 'Insufficient permissions to view log entries' );
$servers = Server::find_all();
$servers_by_Id = array();
# There is probably a better way to do this.
foreach ( $servers as $server ) {
$servers_by_Id[$server->Id()] = $server;
}
$servers = Server::find_all();
$servers_by_Id = array();
# There is probably a better way to do this.
foreach ( $servers as $server ) {
$servers_by_Id[$server->Id()] = $server;
}
$minTime = isset($_POST['minTime'])?$_POST['minTime']:NULL;
$maxTime = isset($_POST['maxTime'])?$_POST['maxTime']:NULL;
$limit = isset($_POST['limit'])?$_POST['limit']:100;
$filter = isset($_POST['filter'])?$_POST['filter']:array();
$sortField = isset($_POST['sortField'])?$_POST['sortField']:'TimeKey';
$limit = 100;
if ( isset($_POST['limit']) ) {
if ( ! is_integer( $_POST['limit'] ) ) {
Error("Invalid value for limit " . ?$_POST['limit'] );
} else {
$limit = $_POST['limit'];
}
}
$sortField = 'TimeKey';
if ( isset($_POST['sortField']) ) {
if ( ! in_array( $_POST['sortField'], $filterFields ) and ( $_POST['sortField'] != 'TimeKey' ) ) {
Error("Invalid sort field " . $_POST['sortField'] );
} else {
$sortField = $_POST['sortField']
}
}
$sortOrder = (isset($_POST['sortOrder']) and $_POST['sortOrder']) == 'asc' ? 'asc':'desc';
$filter = isset($_POST['filter'])?$_POST['filter']:array();
$filterFields = array( 'Component', 'ServerId', 'Pid', 'Level', 'File', 'Line' );
$total = dbFetchOne( "SELECT count(*) AS Total FROM Logs", 'Total' );
$total = dbFetchOne( 'SELECT count(*) AS Total FROM Logs', 'Total' );
$sql = 'SELECT * FROM Logs';
$where = array();
$values = array();
$values = array();
if ( $minTime ) {
$where[] = "TimeKey > ?";
$values[] = $minTime;
} elseif ( $maxTime ) {
$where[] = "TimeKey < ?";
$values[] = $maxTime;
}
$where[] = "TimeKey > ?";
$values[] = $minTime;
} elseif ( $maxTime ) {
$where[] = "TimeKey < ?";
$values[] = $maxTime;
}
foreach ( $filter as $field=>$value ) {
if ( $field == 'Level' ){
$where[] = $field." <= ?";
$values[] = $value;
} else {
$where[] = $field." = ?";
$values[] = $value;
}
}
if ( count($where) )
if ( ! in_array( $field, $fileFields ) ) {
Error("$field is not in valid filter fields");
continue;
}
if ( $field == 'Level' ){
$where[] = $field." <= ?";
$values[] = $value;
} else {
$where[] = $field." = ?";
$values[] = $value;
}
}
if ( count($where) )
$sql.= ' WHERE '.join( ' AND ', $where );
$sql .= " order by ".$sortField." ".$sortOrder." limit ".$limit;
$logs = array();
foreach ( dbFetchAll( $sql, NULL, $values ) as $log ) {
$log['DateTime'] = preg_replace( '/^\d+/', strftime( "%Y-%m-%d %H:%M:%S", intval($log['TimeKey']) ), $log['TimeKey'] );
$log['Server'] = ( $log['ServerId'] and isset($servers_by_Id[$log['ServerId']]) ) ? $servers_by_Id[$log['ServerId']]->Name() : '';
$log['Server'] = ( $log['ServerId'] and isset($servers_by_Id[$log['ServerId']]) ) ? $servers_by_Id[$log['ServerId']]->Name() : '';
$logs[] = $log;
}
$options = array();
$where = array();
$values = array();
$values = array();
foreach( $filter as $field=>$value ) {
if ( $field == 'Level' ) {
$where[$field] = $field." <= ?";
$values[$field] = $value;
$values[$field] = $value;
} else {
$where[$field] = $field." = ?";
$values[$field] = $value;
}
}
$values[$field] = $value;
}
}
foreach( $filterFields as $field )
{
$sql = "SELECT DISTINCT $field FROM Logs WHERE NOT isnull($field)";
$fieldWhere = array_diff_key( $where, array( $field=>true ) );
$fieldValues = array_diff_key( $values, array( $field=>true ) );
$fieldValues = array_diff_key( $values, array( $field=>true ) );
if ( count($fieldWhere) )
$sql.= " AND ".join( ' AND ', $fieldWhere );
$sql.= " ORDER BY $field ASC";
@@ -147,8 +168,15 @@ switch ( $_REQUEST['task'] )
}
//$limit = isset($_POST['limit'])?$_POST['limit']:1000;
$filter = isset($_POST['filter'])?$_POST['filter']:array();
$sortField = isset($_POST['sortField'])?$_POST['sortField']:'TimeKey';
$sortOrder = isset($_POST['sortOrder'])?$_POST['sortOrder']:'asc';
$sortField = 'TimeKey';
if ( isset($_POST['sortField']) ) {
if ( ! in_array( $_POST['sortField'], $filterFields ) and ( $_POST['sortField'] != 'TimeKey' ) ) {
Error("Invalid sort field " . $_POST['sortField'] );
} else {
$sortField = $_POST['sortField']
}
}
$sortOrder = (isset($_POST['sortOrder']) and $_POST['sortOrder']) == 'asc' ? 'asc':'desc';
$servers = Server::find_all();
$servers_by_Id = array();
@@ -216,7 +244,7 @@ switch ( $_REQUEST['task'] )
foreach ( dbFetchAll( $sql, NULL, $values ) as $log )
{
$log['DateTime'] = preg_replace( '/^\d+/', strftime( "%Y-%m-%d %H:%M:%S", intval($log['TimeKey']) ), $log['TimeKey'] );
$log['Server'] = ( $log['ServerId'] and isset($servers_by_Id[$log['ServerId']]) ) ? $servers_by_Id[$log['ServerId']]->Name() : '';
$log['Server'] = ( $log['ServerId'] and isset($servers_by_Id[$log['ServerId']]) ) ? $servers_by_Id[$log['ServerId']]->Name() : '';
$logs[] = $log;
}
switch( $format )