Skip to content
Snippets Groups Projects
Commit abbaafbd authored by Robert Anderson's avatar Robert Anderson
Browse files

Fixed up syntax 

Improved security
Improved readability
parent 43799fb9
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
webui/wisp-multiuser-add.php
+ 3
− 6
View file @ abbaafbd
......@@ -84,7 +84,7 @@ if (isset($_POST['frmaction']) && $_POST['frmaction'] == "insert") {
<p class="pageheader">Add WiSP Users</p>
<?php
#FIXME
# Perform checks on input
if (isset($_POST['num_users']) && isset($_POST['session_timeout']) && isset($_POST['data_limit']) && isset($_POST['time_limit'])) {
$db->beginTransaction();
......@@ -116,10 +116,9 @@ if (isset($_POST['frmaction']) && $_POST['frmaction'] == "insert") {
$userName = $randomString;
$lookForUser = $db->query("SELECT ID FROM ${DB_TABLE_PREFIX}users WHERE Username LIKE '%$userName%'");
$lookForUserRow = $lookForUser->fetchObject();
# If the user was found
if ($lookForUserRow) {
if ($lookForUser->rowCount() > 0) {
$checkUsernameDuplicates = 1;
} else {
$checkUsernameDuplicates = 0;
......@@ -130,15 +129,13 @@ if (isset($_POST['frmaction']) && $_POST['frmaction'] == "insert") {
$userName = $loginNamePrefix."_".$randomString;
$lookForUser = $db->query("SELECT ID FROM ${DB_TABLE_PREFIX}users WHERE Username LIKE '%$userName%'");
$lookForUserRow = $lookForUser->fetchObject();
# If the user was found
if ($lookForUserRow) {
if ($lookForUser->rowCount() > 0) {
$checkUsernameDuplicates = 1;
} else {
$checkUsernameDuplicates = 0;
}
}
} while ($checkUsernameDuplicates > 0);
......
webui/wisp-user-delete.php
+ 4
− 4
View file @ abbaafbd
......@@ -77,14 +77,14 @@ if (isset($_POST['frmaction']) && $_POST['frmaction'] == "delete") {
<?php
if (isset($_POST['user_id'])) {
if ($_POST['confirm'] == "yes") {
if (isset($_POST['confirm']) && $_POST['confirm'] == "yes") {
$db->beginTransaction();
# Delete user data
$userDataDeleteResult = $db->exec("DELETE FROM userdata WHERE UserID = ".$_POST['user_id']);
$userDataDeleteResult = $db->exec("DELETE FROM userdata WHERE UserID = ".$db->quote($_POST['user_id']));
# Delete user attributes
$attrDeleteResult = $db->exec("DELETE FROM user_attributes WHERE UserID = ".$_POST['user_id']);
$attrDeleteResult = $db->exec("DELETE FROM user_attributes WHERE UserID = ".$db->quote($_POST['user_id']));
# Delete from users
$userDeleteResult = $db->exec("DELETE FROM users WHERE ID = ".$_POST['user_id']);
$userDeleteResult = $db->exec("DELETE FROM users WHERE ID = ".$db->quote($_POST['user_id']));
if ($userDataDeleteResult && $attrDeleteResult && $userDeleteResult) {
?>
......
webui/wisp-user-edit.php
+ 6
− 7
View file @ abbaafbd
......@@ -35,7 +35,6 @@ if (isset($_POST['frmaction']) && $_POST['frmaction'] == "edit") {
# Check a user was selected
if (isset($_POST['user_id'])) {
# Prepare statements
$userID = $_POST['user_id'];
$sql = "SELECT
FirstName,
......@@ -46,7 +45,7 @@ if (isset($_POST['frmaction']) && $_POST['frmaction'] == "edit") {
FROM
userdata
WHERE
UserID = '$userID'
UserID = ".$db->quote($userID)."
";
$userDataResult = $db->query($sql);
......@@ -57,7 +56,7 @@ if (isset($_POST['frmaction']) && $_POST['frmaction'] == "edit") {
FROM
user_attributes
WHERE
UserID = '$userID'
UserID = ".$db->quote($userID)."
AND
Name = 'Framed-IP-Address'
";
......@@ -70,7 +69,7 @@ if (isset($_POST['frmaction']) && $_POST['frmaction'] == "edit") {
FROM
user_attributes
WHERE
UserID = '$userID'
UserID = ".$db->quote($userID)."
AND
Name = 'Calling-Station-Id'
";
......@@ -84,7 +83,7 @@ if (isset($_POST['frmaction']) && $_POST['frmaction'] == "edit") {
FROM
user_attributes
WHERE
UserID = '$userID'
UserID = ".$db->quote($userID)."
AND
Name = 'User-Password'
";
......@@ -98,7 +97,7 @@ if (isset($_POST['frmaction']) && $_POST['frmaction'] == "edit") {
FROM
user_attributes
WHERE
UserID = '$userID'
UserID = ".$db->quote($userID)."
AND
Name = 'SMRadius-Capping-Traffic-Limit'
";
......@@ -112,7 +111,7 @@ if (isset($_POST['frmaction']) && $_POST['frmaction'] == "edit") {
FROM
user_attributes
WHERE
UserID = '$userID'
UserID = ".$db->quote($userID)."
AND
Name = 'SMRadius-Capping-Time-Limit'
";
......
webui/wisp-user-list.php
+ 10
− 10
View file @ abbaafbd
......@@ -233,16 +233,16 @@ if (isset($_POST['frmaction']) && $_POST['frmaction'] == "dofilter") {
?>
<tr class="resultsitem">
<td><input type="radio" name="user_id" value="<?php echo $row->id ?>"/><?php echo $row->id ?></td>
<td><?php echo $row->username ?></td>
<td><?php echo $row->firstname ?></td>
<td><?php echo $row->lastname ?></td>
<td><?php echo $row->email ?></td>
<td><?php echo $row->phone ?></td>
<td><?php echo $row->location ?></td>
<td><?php echo $dataCap ?> MB</td>
<td><?php echo $timeCap ?> Min</td>
<td><?php echo $userIP ?></td>
<td><input type="radio" name="user_id" value="<?php echo $row->id; ?>"/><?php echo $row->id; ?></td>
<td><?php echo $row->username; ?></td>
<td><?php echo $row->firstname; ?></td>
<td><?php echo $row->lastname; ?></td>
<td><?php echo $row->email; ?></td>
<td><?php echo $row->phone; ?></td>
<td><?php echo $row->location; ?></td>
<td><?php echo $dataCap; ?> MB</td>
<td><?php echo $timeCap; ?> Min</td>
<td><?php echo $userIP; ?></td>
</tr>
<?php
......
webui/wisp-user-logs.php
+ 1
− 2
View file @ abbaafbd
......@@ -33,7 +33,6 @@ printHeader(array(
));
?>
<p class="pageheader">WiSP User Log</p>
......@@ -233,7 +232,7 @@ if (isset($_POST['user_id'])) {
?>
<tr>
<td colspan="23" class="textcenter">No logs found for user: <?php echo $getuser ?></td>
<td colspan="23" class="textcenter">No logs found for user: <?php echo $getuser; ?></td>
</tr>
<?php
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment