kenken999/php

1<?php2ini_set("display_errors","1");3ini_set("display_startup_errors","1");4include("include/dbcommon.php");5header("Expires: Thu, 01 Jan 1970 00:00:01 GMT");6include("include/reportfunctions.php");7 8 9//	CSRF protection10if( !isPostRequest() )11	return;12 13if(postvalue("name")=="password")14{15	if(DecodeUTF8(postvalue("password"))==$WRAdminPagePassword)16	{17		$_SESSION["WRAdmin"]=true;18		echo "OK";19	}20	else21	{22		unset($_SESSION["WRAdmin"]);23		echo "ERROR";24	}25	exit();26}27 28if(!isWRAdmin())29{30	$_SESSION["MyURL"]=$_SERVER["SCRIPT_NAME"]."?".$_SERVER["QUERY_STRING"];31	header("Location: ".GetTableLink("webreport", "", "message=expired"));32	return;33}34 35// #9875 It's expected that webreport_sql, webreport_admin tables belong to the same db connection36$_connection = $cman->getForWebReports();37 38if(postvalue("name")=="deletesql")39{40	if( postvalue("idsql") )41		$_connection->exec("delete from ".$_connection->addTableWrappers("webreport_sql")."  where ".$_connection->addFieldWrappers("id")."=".postvalue("idsql"));42	echo "OK";43	exit();44}45 46if(postvalue("name")=="sqledit")47{48	$errstr = "";49	$sqlcontent=postvalue("sqlcontent");50	$_SESSION["object_sql"]=$sqlcontent;51	$qResult=$_connection->query($sqlcontent);52	$rs = $qResult->fetchAssoc();53	if(!$rs)54	{55		echo $errstr;56		exit();57	}58	if($_SESSION["idSQL"])59	{60		$_connection->exec("update ".$_connection->addTableWrappers("webreport_sql")61			." set ".$_connection->addFieldWrappers("sqlname")."=".$_connection->prepareString( DecodeUTF8(postvalue("namesql") ))62			.",".$_connection->addFieldWrappers("sqlcontent")."=".$_connection->prepareString( $sqlcontent )63			." where ".$_connection->addFieldWrappers("id")."=".$_SESSION["idSQL"]);64			65		$_connection->exec("update ".$_connection->addTableWrappers("webreport_admin")66			." set ".$_connection->addFieldWrappers("tablename")."=".$_connection->prepareString( DecodeUTF8(postvalue("namesql")) )67			." where ".$_connection->addFieldWrappers("tablename")."=".$_connection->prepareString( $_SESSION["nameSQL"] ));68		69		$_SESSION["nameSQL"] = DecodeUTF8(postvalue("namesql"));70	}71	else72	{73		$sname=DecodeUTF8(postvalue("namesql"));74		$prefix=0;75		while(true)76		{77			if($prefix > 0)78				$sname = DecodeUTF8(postvalue("namesql"))."_".$prefix;79			80			$sql = "select count(*) from ".$_connection->addTableWrappers("webreport_sql")81				." where ".$_connection->addFieldWrappers("sqlname")."=".$_connection->prepareString( $sname );82				83			$data = $_connection->query( $sql )->fetchNumeric();84			if( $data[0] > 0 )85				$prefix++;86			else87				break;88		}89		90		$_connection->exec("insert into ".$_connection->addTableWrappers("webreport_sql")." (".$_connection->addFieldWrappers("sqlname")91			.",".$_connection->addFieldWrappers("sqlcontent").") values (".$_connection->prepareString($sname).",".$_connection->prepareString($sqlcontent).")");92		93		$_connection->exec("insert into ".$_connection->addTableWrappers("webreport_admin")." (".$_connection->addFieldWrappers("tablename")94			.",".$_connection->addFieldWrappers("db_type").",".$_connection->addFieldWrappers("group_name").")"95			." values (".$_connection->prepareString($sname).",'custom',".$_connection->prepareString( Security::getUserName() ).")");96		97		$sql = "select ".$_connection->addFieldWrappers("id")." from ".$_connection->addTableWrappers("webreport_sql")98			." where ".$_connection->addFieldWrappers("sqlname")."=".$_connection->prepareString($sname);99		100		$data = $_connection->query( $sql )->fetchNumeric();101		$_SESSION["idSQL"] = $data[0];102	}103	echo "OK";104	exit();105}106if(postvalue("name")=="viewsql")107{108 109	$arr=array();110	$arr=array(0,"",postvalue("output"));111	$customSQL=$arr[2];112	$_SESSION["customSQL"]=$customSQL;113	$_SESSION["idSQL"]=$arr[0];114	$_SESSION["nameSQL"]=$arr[1];115	$_SESSION["object_sql"]=$customSQL;116	echo $customSQL;117	exit();118}119if(postvalue("name")=="getcustomsql")120{121	$arr=array();122	$arr=WRgetCurrentCustomSQL(postvalue("output"));123	$customSQL=$arr[2];124	$_SESSION["customSQL"]=$customSQL;125	$_SESSION["idSQL"]=$arr[0];126	$_SESSION["nameSQL"]=$arr[1];127	$_SESSION["object_sql"]=$customSQL;128	echo $customSQL;129	exit();130}131 132$arr = my_json_decode(DecodeUTF8(postvalue("output")));133$_connection->exec("delete from ".$_connection->addTableWrappers("webreport_admin"));134foreach($arr as $val)135{136	$_connection->exec("insert into ".$_connection->addTableWrappers("webreport_admin")137		." (".$_connection->addFieldWrappers("tablename").",".$_connection->addFieldWrappers("db_type").",".$_connection->addFieldWrappers("group_name").")"138		." values (".$_connection->prepareString($val["table"]).",'".$val["db_type"]."',".$_connection->prepareString($val["group"]).")");139}140echo "OK";141?>