misc.php

来自「这是一个用于资产管理的源码工具包」· PHP 代码 · 共 457 行 · 第 1/2 页

<?
/*****************************************************************************
*	SimpleAssets - an online web based asset management application.
*	Copyright (C) 2002 Jeff Gordon ([e-mail]). All rights reserved.
*	Public Works and Government Services Canada (PWGSC)
*   Architecture and Standards Directorate
*
*	Released July 2002
*
*  	This program is free software licensed under the 
* 	GNU General Public License (GPL).
*
*	This file is part of SimpleAssets.
*
*	SimpleAssets is free software; you can redistribute it and/or modify
*	it under the terms of the GNU General Public License as published by
*	the Free Software Foundation; either version 2 of the License, or
*	(at your option) any later version.
*
*	SimpleAssets is distributed in the hope that it will be useful,
*	but WITHOUT ANY WARRANTY; without even the implied warranty of
*	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
*	GNU General Public License for more details.
*
*	You should have received a copy of the GNU General Public License
*	along with SimpleAssets; if not, write to the Free Software
*	Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
*******************************************************************************/

// contains functions:

// database
// ----------
// db_connect($ip,$sql_login,$sql_pass)
// db_select($user_db)
// doSql($sql)

// security
// ----------
// login()
// loginbox()
// securityError()

// display functions
// ------------------
// menu_header($top,$title,$icon)
// import()
// doStylise($field, $name, $link)
// dateDropdown($ext,$month,$day,$year,$month_now_offset,$default_day)
// getMsg()

// misc string functions
// ---------------------
// q_replace($txt);
// html($txt);
// dehtml($txt);
// is_alphanum($input)
// is_alphanum_str($input)
// make_seed()

// connects to the database.
function db_connect($ip,$sql_login,$sql_pass) {
	@$db = mysql_pconnect($ip,$sql_login,$sql_pass);
	return $db;
}

// select the database from the server
function db_select($user_db) {
	return mysql_select_db($user_db);
}

// performs an sql statement and logs it
function doSql($sql) {
	$result = mysql_query($sql);
//	if ($result) echo "<p>" . $sql . " <b>number of rows=" . mysql_num_rows($result) . "</b>";
//	else " <b>no results</b>";
	return $result;
}




// determines login state
function login() {
	global $lastaction, $lastkey, $loginout, $login, $pass, $my_access_level, $activelogin, $activepass;
	global $my_emp_id;
	global $db_status;
	global $action;
	global $resetpassword;
	global $key;
	global $loginname;
	global $password;
	global $stored_login, $stored_pass;
	global $emp_db;
	global $HTTP_SERVER_VARS;
	global $HTTP_COOKIE_VARS;
	
	if (isset($_SESSION['sessionid'])) $sessionid = $_SESSION['sessionid'];
	else $sessionid = "";

	// Cookie domain
	$domain = $HTTP_SERVER_VARS['HTTP_HOST'];
    if (empty($domain)) $domain = getenv('HTTP_HOST');
	$domain = preg_replace('/:.*/', '', $domain);

	
	// check for at least one active user;
	$sql = "SELECT AccessLevel, Id FROM " . $emp_db . "Employees WHERE Active=1;";
	$is_user = (($result = doSql($sql)) && (mysql_num_rows($result)));
	if ((!$db_status) || (!$is_user)) $loginout = 2;

	if ($loginout == 2) {

		// logout
		$my_access_level = 0;
		$activelogin = "";
		$activepass = "";
		$my_emp_id = "";

		// remove the session id
		session_start();
		$sessionid = session_id();
		$sql = "UPDATE " . $emp_db . "Employees SET SessionId='' WHERE SessionId='" . $sessionid . "';";
		doSql($sql);
		$cookietime = time()[phone];
		setcookie("sessionid", "", $cookietime, "/",$domain,1);
		$_SESSION['sessionid'] = "";
		session_unset();
		session_destroy();
		
	} elseif ($loginout == 1) {

		// login
		$sql = "SELECT AccessLevel, Id FROM " . $emp_db . "Employees WHERE LoginName='" . $login . "' and UserPass=password('" . $pass . "') AND Active=1;";
		if (($result = doSql($sql)) && (mysql_num_rows($result))) {
			//correct login
			$query_data = mysql_fetch_row($result);
			$my_access_level = $query_data[0];
			$my_emp_id = $query_data[1];
			$activelogin = $login;
			$activepass = $pass;
			
			// add the new session id
			session_start();
			$sessionid = session_id();
			doSql("UPDATE " . $emp_db . "Employees SET SessionId='" . $sessionid . "' WHERE LoginName='" . $login . "';");
			$cookietime = time()[phone];
			$_SESSION['sessionid'] = $sessionid;
			setcookie("sessionid", $sessionid, $cookietime, "/",$domain,1);
		} else {
			//incorrect login
			$my_access_level = 0;
			$activelogin = "";
			$activepass = "";
			$my_emp_id = "";

			if (strcmp($lastaction,"login") == 0) $lastaction = "";
			header("Location: " . $PHP_SELF . "?action=login&lastaction=" . $lastaction . "&lastkey=" . html($lastkey) ."&loginfail=1");
			exit;
		}
	} else {
		// no login or logout

		// if sessionid not in cookies, try PHP sessions
		session_start();
		if ($sessionid == "") $sessionid = session_id();
		
		$sql = "SELECT " . $emp_db . "Employees.LoginName as LoginName, " . $emp_db . "Employees.UserPass as UserPass, " . $emp_db . "Employees.AccessLevel as AccessLevel, " . $emp_db . "Employees.Id as Id FROM " . $emp_db . "Employees WHERE Active=1 AND SessionId='" . $sessionid . "';";
		if (($result = doSql($sql)) && (mysql_num_rows($result)) && ($query_data = mysql_fetch_array($result))) {
			// login name verified
			$my_access_level = $query_data["AccessLevel"];
			$my_emp_id = $query_data["Id"];
			$activelogin = $query_data["LoginName"];
			$activepass = $query_data["UserPass"];
		} else {
			// login name not verified
			$my_access_level = 0;
			$activelogin = "";
			$activepass = "";
			$my_emp_id = "";
		}
	}

	if ($is_user) return $my_emp_id;
	else return "E";
}

function loginbox($key) {
	global $action;
	global $lastaction;
	global $lastkey;
	global $loginfail;
	global $print_screen;
	global $hrcolor;
	global $demo_mode;
	
	$PHP_SELF = $_SERVER['PHP_SELF'];
	menu_header("","Login","security.jpg");
	if ($loginfail == 1) echo "<center><font class='text11bold' color='#ff0033'>Login incorrect.</font></center>";
	echo "<form action='" . $PHP_SELF . "?action=" . $lastaction . "&lastkey=" . $lastkey . "&loginout=1' method='post'><blockquote>";
	echo "<center><table><tr>";
	echo "<td class='text12bold' align='right'>User:</td>";
	echo "<td class='text12'><input name='login' type='text' class='boxtext13' size=30></td>";
	echo "</tr></tr>";
	echo "<td class='text12bold' align='right'>Password:</td>";
	echo "<td class='text12'><input name='pass' type='password' class='boxtext13' size=30></td>";
	echo "</tr>";
	echo "<tr><td class='text12' colspan=2>";
	echo "<center>";
	echo "<a href='" . $PHP_SELF . "?action=employeeregister'><img src='images/register.jpg' width=88 height=27 border=0></a>";
	echo "<input type=image src='images/login.jpg' width=88 height=27 border=0>";
	if ($demo_mode == true) echo "<p><font color='#ff0033' class='text12bold'>Use login 'demo' and no password to login.</font>";
	echo "</center>";
	echo "</td></tr></table>";
	echo "</center></blockquote></form>";
}

// displays an error message when attempting to access admin features without logging in
function securityError() {
	global $loginout;
	global $hrcolor;
	global $key;
	global $action;
	global $key;
	global $lastaction;
	global $lastkey;
	$lastaction = $action;
	$lastkey = $key;
	if ($loginout != "") {