kenken999/php

1<?php 2ini_set("display_errors","1");3ini_set("display_startup_errors","1");4 5include("include/dbcommon.php");6include("include/reportfunctions.php");7 8 9//	security - begin10 11 12	if(!isLogged() || !postvalue("rname"))13	{ 14		return;15	}16 17if(!postvalue("rname"))18	return;19 20$rpt_array = wrGetEntityArray(postvalue("rname"), WR_REPORT );21 22// if old23if (is_wr_project()) 24	return;25 26	if ( $rpt_array['settings']['status'] == "private" && $rpt_array['owner'] != Security::getUserName() ) {27		exit();28	}29	if (pre8count(GetUserGroups()) > 1) {30		$arr_reports = array();31		$arr_reports = wrGetEntityList( WR_REPORT );32		foreach ( $arr_reports as $rpt ) {33			if (( $rpt["owner"] != Security::getUserName() || $rpt["owner"] == "") && $rpt["view"]==0 && $rpt_array['settings']['name']==$rpt["name"])34			{35				exit();36			}37		}38	}39 40global $cman;41$defConnection = $cman->getForWebReports();42	43$field="";44$table="";45WRSplitFieldName(postvalue("field"),$table,$field);46//	check if field is allowed to display47$show=false;48foreach($rpt_array["totals"] as $fld)49{50	if($fld["table"]==$table && $fld["name"]==$field)51	{52		if($fld["show"])53			$show=true;54		break;55	}56}57if(!$show)58	exit();59 60//	security - end61 62//	construct sql63 64$keys = DBGetTableKeys($table);65if(!pre8count($keys))66	exit();67$strkeywhere = "";68foreach($keys as $idx=>$k)69{70	if(strlen($strkeywhere))71		$strkeywhere.=" and ";72	$strkeywhere.=$defConnection->addTableWrappers($table).".".$defConnection->addFieldWrappers($k)."=";73	$type=WRGetFieldType($table.".".$k);74	if(NeedQuotes($type))75		$strkeywhere.=db_prepare_string(postvalue("key".($idx+1)));76	else77	{78		$value=postvalue("key".($idx+1));79		$strvalue = (string)$value;80		$strvalue = str_replace(",",".",$strvalue);81		if(is_numeric($strvalue))82			$value=$strvalue;83		else84			$value=0;85		$strkeywhere.=$value;86	}87}88 89$strSQL = $rpt_array['sql'] . " WHERE ". $strkeywhere;90 91$rs = $defConnection->query($strSQL);92 93 94if(!$rs || !($data=$rs->fetchAssoc()))95  return DisplayNoImage();96 97 98$value=db_stripslashesbinaryAccess($data[postvalue("alias")]);99if(!$value)100{101	return DisplayNoImage();102}103 104$itype=SupposeImageType($value);105if($itype)106	header("Content-Type: ".$itype);107else108	return DisplayFile();109echoBinary($value);110return;111 112 113?>114