Skip to content

Commit 9dc8720

Browse files
oliveratgithuboliveratgithub
authored
zorg Code v4.8.2-hotfix
Merge pull request #73 from zorgch/develop
2 parents d4e6fb5 + 406842b commit 9dc8720

6 files changed

Lines changed: 406 additions & 404 deletions

File tree

‎www/actions/events.php‎

Lines changed: 35 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,8 @@
2525
if ( isset($_POST['id']) && is_numeric($_POST['id']) && $_POST['id'] >= 0) $eventId = $_POST['id'];
2626
if ( isset($_POST['name']) && !empty($_POST['name'])) $eventName = sanitize_userinput($_POST['name']);
2727
if ( !empty($_POST['location'])) $eventLocation = sanitize_userinput($_POST['location']);
28-
if ( !empty($_POST['link'])) $eventLink = escape_text((filter_var($_POST['link'], FILTER_VALIDATE_URL)===false?(filter_var(SITE_PROTOCOL.$_POST['link'], FILTER_VALIDATE_URL)!==false?SITE_PROTOCOL.$_POST['link']:$error='Ungültiger Event-Link'):$_POST['link']));
29-
if ( !empty($_POST['review_url'])) $eventReviewlink = escape_text((filter_var($_POST['review_url'], FILTER_VALIDATE_URL)===false?(filter_var(SITE_PROTOCOL.$_POST['review_url'], FILTER_VALIDATE_URL)!==false?SITE_PROTOCOL.$_POST['review_url']:$error='Ungültige Review-URL'):$_POST['review_url']));
28+
if ( !empty($_POST['link'])) $eventLink = (filter_var($_POST['link'], FILTER_VALIDATE_URL)===false?(filter_var(SITE_PROTOCOL.$_POST['link'], FILTER_VALIDATE_URL)!==false?SITE_PROTOCOL.$_POST['link']:$error='Ungültiger Event-Link'):$_POST['link']);
29+
if ( !empty($_POST['review_url'])) $eventReviewlink = (filter_var($_POST['review_url'], FILTER_VALIDATE_URL)===false?(filter_var(SITE_PROTOCOL.$_POST['review_url'], FILTER_VALIDATE_URL)!==false?SITE_PROTOCOL.$_POST['review_url']:$error='Ungültige Review-URL'):$_POST['review_url']);
3030
if ( !empty($_POST['description'])) $eventDescription = htmlspecialchars_decode($_POST['description'], ENT_COMPAT | ENT_SUBSTITUTE);
3131
if ( isset($_POST['gallery_id']) && is_numeric($_POST['gallery_id']) && $_POST['gallery_id'] >= 0) $eventGallery = $_POST['gallery_id'];
3232
if ( isset($_GET['join']) && is_numeric($_GET['join']) && $_GET['join'] >= 0) $eventJoinId = $_GET['join'];
@@ -38,30 +38,28 @@
3838
/** Validation Error */
3939
case (!empty($error)):
4040
/** If $error break switch() instantly */
41-
if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> Error: %s', __FILE__, __LINE__, $error));
41+
zorgDebugger::me()->warn('Validation Error: %s%s', [$error]);
4242
break;
4343

4444

4545
/** Add new Event */
4646
case ((isset($_POST['action']) && $_POST['action'] === 'new')):
47-
if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> New Event: %s', __FILE__, __LINE__, $eventName));
48-
$sql = 'INSERT INTO
49-
events
50-
(name, location, link, description, startdate, enddate, gallery_id, reportedby_id, reportedon_date, review_url)
51-
VALUES
52-
(
53-
"'.$eventName.'"
54-
,"'.$eventLocation.'"
55-
,"'.$eventLink.'"
56-
,"'.$eventDescription.'"
57-
,"'.$_POST['startYear'].'-'.$_POST['startMonth'].'-'.$_POST['startDay'].' '.$_POST['startHour'].':00"
58-
,"'.$_POST['endYear'].'-'.$_POST['endMonth'].'-'.$_POST['endDay'].' '.$_POST['endHour'].':00"
59-
,'.$eventGallery.'
60-
,'.$user->id.'
61-
,'.timestamp(true).'
62-
,"'.$eventReviewlink.'"
63-
)';
64-
$idNewEvent = $db->query($sql, __FILE__, __LINE__, 'INSERT INTO events');
47+
zorgDebugger::me()->debug('Adding new Event: %s', [$eventName]);
48+
$startdate = sprintf('%s-%s-%s %s:00', $_POST['startYear'], $_POST['startMonth'], $_POST['startDay'], $_POST['startHour']);
49+
$enddate = sprintf('%s-%s-%s %s:00', $_POST['endYear'], $_POST['endMonth'], $_POST['endDay'], $_POST['endHour']);
50+
$values = [
51+
'name' => $eventName,
52+
'location' => $eventLocation,
53+
'link' => $eventLink,
54+
'description' => $eventDescription,
55+
'startdate' => $startdate,
56+
'enddate' => $enddate,
57+
'gallery_id' => $eventGallery,
58+
'reportedby_id' => $user->id,
59+
'reportedon_date' => timestamp(true),
60+
'review_url' => $eventReviewlink
61+
];
62+
$idNewEvent = $db->insert('events', $values, __FILE__, __LINE__, 'INSERT INTO events');
6563

6664
/** Error */
6765
if (empty($idNewEvent))
@@ -80,21 +78,23 @@
8078

8179
/** Save updated Event details */
8280
case ((isset($_POST['action']) && $_POST['action'] === 'edit')):
83-
if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> Update Event: %d "%s"', __FILE__, __LINE__, $eventId, $eventName));
81+
zorgDebugger::me()->debug('Update existing Event: %d «%s»', [$eventId, $eventName]);
8482

83+
$newStartdate = sprintf('%s-%s-%s %s:00', $_POST['startYear'], $_POST['startMonth'], $_POST['startDay'], $_POST['startHour']);
84+
$newEnddate = sprintf('%s-%s-%s %s:00', $_POST['endYear'], $_POST['endMonth'], $_POST['endDay'], $_POST['endHour']);
8585
$sql = 'UPDATE events
8686
SET
8787
name = "'.$eventName.'"
8888
, location = "'.$eventLocation.'"
8989
, link = "'.$eventLink.'"
9090
, description = "'.$eventDescription.'"
91-
, startdate = "'.$_POST['startYear'].'-'.$_POST['startMonth'].'-'.$_POST['startDay'].' '.$_POST['startHour'].':00"
92-
, enddate = "'.$_POST['endYear'].'-'.$_POST['endMonth'].'-'.$_POST['endDay'].' '.$_POST['endHour'].':00"
91+
, startdate = "'.$newStartdate.'"
92+
, enddate = "'.$newEnddate.'"
9393
, gallery_id = '.$eventGallery.'
9494
, review_url = "'.$eventReviewlink.'"
9595
WHERE id = '.$eventId
9696
;
97-
if (DEVELOPMENT) error_log($sql);
97+
// TODO use $db->update() Method
9898
$result = $db->query($sql, __FILE__, __LINE__, 'edit');
9999
if ($result === false) $error = 'Error updating Event ID "' . $eventId . '"';
100100

@@ -103,16 +103,13 @@
103103

104104
/** Join User to Event */
105105
case (isset($eventJoinId) && is_numeric($eventJoinId)):
106-
if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> Join Event: %d', __FILE__, __LINE__, $eventJoinId));
106+
zorgDebugger::me()->debug('User joins Event: %d', [$eventJoinId]);
107107
$redirect_url .= '&event_id='.$eventJoinId;
108108

109-
$sql = 'INSERT INTO events_to_user VALUES('.$user->id.', '.$eventJoinId.')';
110-
if ($db->query($sql,__FILE__, __LINE__) === false)
111-
{
109+
$insertValues = ['user_id' => $user->id, 'event_id' => $eventJoinId];
110+
if ($db->insert('events_to_user', $insertValues, __FILE__, __LINE__) === false) {
112111
$error = 'Cannot join Event ID ' . $eventJoinId;
113-
break;
114112
} else {
115-
/** Activity Eintrag auslösen */
116113
Activities::addActivity($user->id, 0, 'nimmt an <a href="'.$redirect_url.'">'.Events::getEventName($eventJoinId).'</a> teil.', 'ev');
117114
}
118115

@@ -121,18 +118,18 @@
121118

122119
/** Unjoin User from Event */
123120
case (isset($eventUnjoinId) && is_numeric($eventUnjoinId)):
124-
if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> Unjoin Event: %d', __FILE__, __LINE__, $eventUnjoinId));
121+
zorgDebugger::me()->debug('User unjoins Event: %d', [$eventUnjoinId]);
125122
$redirect_url .= '&event_id='.$eventUnjoinId;
126123

127-
$sql = 'DELETE FROM events_to_user WHERE user_id = '.$user->id.' AND event_id = '.$eventUnjoinId;
128-
if (!$db->query($sql,__FILE__, __LINE__)) $error = 'Cannot unjoin Event ID ' . $eventUnjoinId;
124+
$sql = 'DELETE FROM events_to_user WHERE user_id=? AND event_id=?';
125+
if (!$db->query($sql,__FILE__, __LINE__, 'Event Unjoin', [$user->id, $eventUnjoinId])) $error = 'Cannot unjoin Event ID ' . $eventUnjoinId;
129126

130127
break;
131128

132129

133130
/** Post Event to Twitter */
134131
case ((isset($_POST['action']) && $_POST['action'] === 'tweet')):
135-
if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> Tweet Event: %s', __FILE__, __LINE__, $redirect_url));
132+
zorgDebugger::me()->debug('Tweet Event: %s', [$redirect_url]);
136133

137134
/**
138135
* Load Twitter Class & Grab the Twitter API Keys
@@ -194,6 +191,7 @@
194191
}
195192

196193
/** Redirect request */
197-
if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> Redirecting to %s', __FILE__, __LINE__, $redirect_url.rawurlencode($error)));
198-
header('Location: ' . $redirect_url . ( !empty($error) ? '&error='.rawurlencode($error) : '') );
194+
$goToUrl = $redirect_url . ( !empty($error) ? '&error='.rawurlencode($error) : '');
195+
zorgDebugger::me()->debug('Redirecting to %s', [$goToUrl]);
196+
header('Location: ' . $goToUrl );
199197
exit;

‎www/controller/layout.controller.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ class Layout extends \MVC\Controller
6363
public function __construct()
6464
{
6565
/** Position vom user bestimmen */
66-
if (DEVELOPMENT === true) error_log(sprintf('[DEBUG] <%s:%d> new \Utils\IP2Geolocation()', __FILE__, __LINE__));
66+
\zorgDebugger::me()->debug('New \Utils\IP2Geolocation()');
6767
$userLocationData = new \Utils\User\IP2Geolocation();
6868

6969
/** Assign user location vars */
@@ -147,7 +147,7 @@ private function setCountryFlagicon($countryCode='CHE')
147147
*/
148148
private function setColors()
149149
{
150-
if (DEVELOPMENT === true) error_log(sprintf('[DEBUG] <%s:%d> Color Layout: %s', __METHOD__, __LINE__, $this->layouttype));
150+
\zorgDebugger::me()->debug('Color Layout: %s', [$this->layouttype]);
151151

152152
/** Background colors */
153153
if (!defined('BACKGROUNDCOLOR')) define('BACKGROUNDCOLOR', ($this->layouttype === 'day' ? '#F2F2F2' : '#141414'));

‎www/getfile.php‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,16 +32,19 @@
3232
if ((isset($_GET['user']) && !empty($_GET['user']) && is_numeric($_GET['user']) && $_GET['user'] > 0) &&
3333
(isset($_GET['file']) && !empty($_GET['file'])))
3434
{
35-
$e = $db->query('SELECT * FROM files WHERE user=' . (int)$_GET['user'] . ' AND name="' . addslashes($_GET['file']) .'"', __FILE__, __LINE__, 'SELECT files by user');
35+
$e = $db->query('SELECT * FROM files WHERE user=? AND name=?',
36+
__FILE__, __LINE__, 'SELECT files by user', [(int)$_GET['user'], addslashes($_GET['file'])]);
3637
$d = $db->fetch($e);
37-
38+
}
3839
/** ...else check & validate for file-id in URL-Params */
39-
} elseif (isset($_GET['id']) && is_numeric($_GET['id']) && $_GET['id'] > 0)
40-
{
41-
$e = $db->query('SELECT * FROM files WHERE id=' . (int)$_GET['id'], __FILE__, __LINE__, 'SELECT files by id');
42-
$d = $db->fetch($e);
43-
}
44-
} else {
40+
elseif (isset($_GET['id']) && is_numeric($_GET['id']) && $_GET['id'] > 0)
41+
{
42+
$e = $db->query('SELECT * FROM files WHERE id=?',
43+
__FILE__, __LINE__, 'SELECT files by id', [(int)$_GET['id']]);
44+
$d = $db->fetch($e);
45+
}
46+
/** ...finally: it's an invalid requests, it seems */
47+
else {
4548
http_response_code(400); // Set response code 400 (bad request) and exit.
4649
exit('Invalid or missing GET-Parameter');
4750
}

0 commit comments

Comments
 (0)