{$count} rows"); return $result; } function maybe_null($value) { if ($value == NULL) return 'NULL'; if (strlen( (string) $value ) > 0) return "'".mysql_real_escape_string($value)."'"; else return 'NULL'; } #define('LOG_ERR', 3); #define('LOG_WARNING', 4); #define('LOG_INFO', 6); function logger($severity, $scriptname, $scope, $message) { if (config('logging') <= $severity) return; $user = 'NULL'; if ($_SESSION['role'] & ROLE_SYSTEMUSER) $user = "'{$_SESSION['userinfo']['username']}'"; elseif ($_SESSION['role'] & ROLE_CUSTOMER) $user = "'{$_SESSION['customerinfo']['customerno']}'"; $remote = mysql_real_escape_string($_SERVER['REMOTE_ADDR']); $scriptname = mysql_real_escape_string($scriptname); $scope = mysql_real_escape_string($scope); $message = mysql_real_escape_string($message); db_query("INSERT INTO misc.scriptlog (remote, user,scriptname,scope,message) VALUES ('{$remote}', {$user}, '{$scriptname}', '{$scope}', '{$message}');"); } function html_header($arg) { global $html_header; $html_header .= $arg; } function output($arg) { global $output; $output .= $arg; } function random_string($nc, $a='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789') { $l=strlen($a)-1; $r=''; while($nc-->0) $r.=$a{mt_rand(0,$l)}; return $r; } function are_you_sure($query_string, $question) { $query_string = encode_querystring($query_string); $token = random_string(20); $_SESSION['are_you_sure_token'] = $token; output("

Sicherheitsabfrage

\n"); } function user_is_sure() { if (isset($_POST['really'])) { if ($_POST['random_token'] == $_SESSION['are_you_sure_token']) return true; else system_failure("Possible Cross-site-request-forgery detected!"); } elseif (isset($_POST['not_really'])) return false; else return NULL; } function generate_form_token($form_id) { require_once("inc/debug.php"); $sessid = session_id(); if ($sessid == "") { DEBUG("Uh? Session not running? Wtf?"); system_failure("Internal error!"); } if (! isset($_SESSION['session_token'])) $_SESSION['session_token'] = random_string(10); return hash('sha256', $sessid.$form_id.$_SESSION['session_token']); } function check_form_token($form_id, $formtoken = NULL) { if ($formtoken == NULL) $formtoken = $_POST['formtoken']; $sessid = session_id(); if ($sessid == "") { DEBUG("Uh? Session not running? Wtf?"); system_failure("Internal error! (Session not running)"); } $correct_formtoken = hash('sha256', $sessid.$form_id.$_SESSION['session_token']); if (! ($formtoken == $correct_formtoken)) system_failure("Possible cross-site-request-forgery!"); } function have_module($modname) { return in_array($modname, config('modules')); } function encode_querystring($querystring) { global $debugmode; if ($debugmode) $querystring = 'debug&'.$querystring; DEBUG($querystring); $query = explode('&', $querystring); $new_query = array(); foreach ($query AS $item) if ($item != '') { $split = explode('=', $item, 2); if (count($split) == 1) $new_query[] = $split[0]; else $new_query[] = $split[0].'='.urlencode($split[1]); } $querystring = implode('&', $new_query); if ($querystring) $querystring = '?'.$querystring; DEBUG($querystring); return $querystring; } function addnew($file, $label, $querystring = '') { output('

'.internal_link($file, $label, $querystring).'

'); } function internal_link($file, $label, $querystring = '', $attribs = '') { global $prefix; if (strpos($file, '/') === 0) { $file = $prefix.substr($file, 1); } $querystring = encode_querystring($querystring); return "{$label}"; } function html_form($form_id, $scriptname, $querystring, $content) { $querystring = encode_querystring($querystring); $ret = ''; $ret .= ''; return $ret; } function html_select($name, $options, $default='', $free='') { require_once('inc/security.php'); $ret = "'; return $ret; } ?>